TWI808902B - Apparatus for detecting errors during data encryption - Google Patents

Apparatus for detecting errors during data encryption Download PDF

Info

Publication number
TWI808902B
TWI808902B TW111137122A TW111137122A TWI808902B TW I808902 B TWI808902 B TW I808902B TW 111137122 A TW111137122 A TW 111137122A TW 111137122 A TW111137122 A TW 111137122A TW I808902 B TWI808902 B TW I808902B
Authority
TW
Taiwan
Prior art keywords
parity
circuit
bit
key
encryption
Prior art date
Application number
TW111137122A
Other languages
Chinese (zh)
Other versions
TW202326491A (en
Inventor
吳溫哲
陳柏宏
鄭巧雯
余俊宏
劉志尉
Original Assignee
慧榮科技股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 慧榮科技股份有限公司 filed Critical 慧榮科技股份有限公司
Publication of TW202326491A publication Critical patent/TW202326491A/en
Application granted granted Critical
Publication of TWI808902B publication Critical patent/TWI808902B/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0861—Generation of secret information including derivation or calculation of cryptographic keys or passwords
    • H04L9/0863—Generation of secret information including derivation or calculation of cryptographic keys or passwords involving passwords or one-time passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/088—Usage controlling of secret information, e.g. techniques for restricting cryptographic keys to pre-authorized uses, different access levels, validity of crypto-period, different key- or password length, or different strong and weak cryptographic algorithms
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Detection And Correction Of Errors (AREA)
  • Error Detection And Correction (AREA)

Abstract

The invention relates to an apparatus and a method for detecting errors during data encryption. The apparatus includes: encoding circuitry; and error detection circuitry. The encoding circuitry is arranged operably to realize an encryption algorithm including multiple rounds, and the encryption algorithm in each round uses a round key to encode plaintext or encryption intermediate. The error detection circuitry is arranged operably to predict redundant data corresponding to the plaintext or the encryption intermediate, and issue an error signal to a processing unit when detecting that the encryption intermediate does not match the redundant data at a designated mid-point during the encryption process. With the arrangement of error detection circuitry, the error detection can be achieved by circuitry smaller than the encoding circuitry.

Description

資料加密的錯誤偵測裝置 Error detection device for data encryption

本發明涉及資料加密，尤指一種資料加密的錯誤偵測裝置及方法。 The present invention relates to data encryption, in particular to an error detection device and method for data encryption.

由於現在的儲存裝置(例如，NAND閃存)常用來儲存系統程式碼、應用程式碼、驅動程式和使用者的隱私資料等，因此資料安全性是重要議題。高級加密標準(Advanced Encryption Standard，AES)是目前由美國聯邦政府採用的一種區塊加密標準，並且已經被多方驗證且廣為採用。然而，AES運作的過程中可能遭到惡意的攻擊，而讓AES編碼器錯誤的產生運算結果。或者是，晶片製作過程中有些暇疵，使得AES編碼器在運行一段時間後會產生不預期的運算結果。或者是，儲存裝置處在惡劣的環境下，讓AES編碼器中的部分元件失能而產生不預期的運算結果。錯誤的加密過程將使原始的使用者資料無法回復，造成巨大的損失。因此，本發明提出一種資料加密的錯誤偵測裝置及方法，避免寫入錯誤的加密後資料到儲存裝置。 Since current storage devices (eg, NAND flash memory) are commonly used to store system codes, application codes, drivers, and user privacy data, etc., data security is an important issue. Advanced Encryption Standard (AES) is a block encryption standard currently adopted by the US federal government, and has been verified by multiple parties and widely adopted. However, malicious attacks may occur during the operation of AES, and the AES encoder may generate incorrect calculation results. Or, there are some defects in the chip manufacturing process, so that the AES encoder will produce unexpected calculation results after running for a period of time. Or, the storage device is in a harsh environment, which causes some components in the AES encoder to fail and produce unexpected calculation results. Wrong encryption process will make the original user data irrecoverable, resulting in huge losses. Therefore, the present invention proposes a data encryption error detection device and method to avoid writing wrong encrypted data to the storage device.

有鑑於此，如何減輕或消除上述相關領域的缺失，實為有待解決的問題。 In view of this, how to alleviate or eliminate the deficiencies in the above-mentioned related fields is a problem to be solved.

本說明書涉及一種資料加密的錯誤偵測裝置，包含：編碼電路；和錯誤檢查電路。編碼電路設置以實現加密演算法，其中，加密演算法包含多個回合，並且在每個回合中使用回合密鑰對明文或者中間加密結果進行編碼。錯誤檢查電路設置以預測出相應於明文或者中間加密結果的冗餘資料；並且在加密過程中的指定中間點發現中間 加密結果和冗餘資料不匹配時，發出錯誤訊號給處理單元。 This specification relates to an error detection device for data encryption, including: an encoding circuit; and an error checking circuit. The encoding circuit is configured to implement an encryption algorithm, wherein the encryption algorithm includes multiple rounds, and a round key is used to encode plaintext or an intermediate encryption result in each round. error checking circuitry configured to predict redundant data corresponding to plaintext or intermediate encryption results; and to detect intermediate When the encryption result does not match the redundant data, an error signal is sent to the processing unit.

本說明書另涉及一種資料加密的錯誤偵測裝置，包含：搜索電路；和替代校驗電路。搜索電路設置以依據查找表將輸入的相應於明文或者中間加密結果的1個位元組的第一值轉換為第二值。替代校驗電路設置以使用相應於查找表的公式判斷第一值轉換為第二值的過程中是否發生錯誤，以及當發現錯誤時，發出錯誤訊號。 This specification also relates to an error detection device for data encryption, which includes: a search circuit; and a replacement verification circuit. The search circuit is configured to convert an input first value of 1 byte corresponding to plaintext or an intermediate encryption result into a second value according to a lookup table. The replacement verification circuit is configured to use a formula corresponding to the look-up table to determine whether an error occurs during the process of converting the first value into the second value, and when an error is found, an error signal is sent.

上述實施例的優點之一，通過以上所述錯誤檢查電路的設置，可利用比編碼電路較少面積的電路來完成錯誤偵測。 One of the advantages of the above-mentioned embodiment is that by setting the above-mentioned error checking circuit, the error detection can be completed with a circuit having a smaller area than the encoding circuit.

本發明的其他優點將搭配以下的說明和圖式進行更詳細的解說。 Other advantages of the present invention will be explained in more detail with the following description and drawings.

10:電子裝置 10: Electronic device

110:主機端 110: Host side

130:閃存控制器 130: Flash memory controller

131:主機介面 131: host interface

132:匯流排 132: busbar

134:處理單元 134: processing unit

136:隨機存取記憶體 136: random access memory

137:高級加密標準編碼器 137: Advanced Encryption Standard Encoder

138:直接記憶體存取控制器 138: Direct memory access controller

139:閃存介面 139: Flash interface

150:閃存模組 150: Flash memory module

151:介面 151: interface

153#0~153#15:NAND閃存單元 153#0~153#15: NAND flash memory unit

CH#0~CH#3:通道 CH#0~CH#3: channel

CE#0~CE#3:致能訊號 CE#0~CE#3: enable signal

R#0:初始回合 R#0: Initial round

R#1~R#9:中間回合 R#1~R#9: Middle round

R#10:最終回合 R#10: Final Round

S310#1~S310#10:替代位元組步驟 S310#1~S310#10: Substitute byte step

S320#1~S320#10:位移列步驟 S320#1~S320#10: shift sequence steps

S330#1~S330#9:混合行步驟 S330#1~S330#9: mixed line steps

S340#1~S340#10:加上回合密鑰步驟 S340#1~S340#10: Steps of adding round key

S350:擴展密鑰步驟 S350: Extended key steps

w[0,3]:基礎密鑰 w[0,3]: basic key

w[4,7],w[36,39],w[40,43]:擴展後的密鑰 w[4,7],w[36,39],w[40,43]: the expanded key

400:AES編碼器 400:AES Encoder

410,430:AES編碼電路 410,430: AES encoding circuit

450:比較器 450: Comparator

500:AES編碼器 500: AES encoder

510:AES編碼電路 510: AES encoding circuit

530:錯誤偵測電路 530: Error detection circuit

550:冗餘資料產生電路 550: redundant data generating circuit

570:冗餘密鑰產生電路 570: redundant key generation circuit

S0~S15:體 S 0 ~S 15 : Body

P0~P15:體內奇偶校驗位元 P 0 ~P 15 : Internal parity bits

Q0~Q3:跨體奇偶校驗9位元 Q 0 ~Q 3 : 9 bits of cross-body parity check

k0~k31:小鑰 k 0 ~k 31 : small key

R0~R31:小鑰內奇偶校驗位元 R 0 ~R 31 : parity bits in the small key

V0~V7:跨小鑰奇偶校驗9位元 V 0 ~V 7 : 9 bits of parity across small keys

810:AES資料處理電路 810: AES data processing circuit

813:編碼電路 813: encoding circuit

815:編碼錯誤檢查電路 815: Coding error checking circuit

830:AES密鑰排程電路 830: AES key scheduling circuit

833:密鑰產生電路 833: key generation circuit

835:密鑰錯誤檢查電路 835: key error check circuit

850:或閘 850: OR gate

870:控制器 870:Controller

912:資料寄存器 912: data register

914:奇偶校驗碼寄存器 914: parity check code register

920:增強型替代位元組電路 920: Enhanced Alternative Byte Circuits

930:位移列電路 930: shift column circuit

940:混合行電路 940: mixed row circuit

950:加上回合密鑰電路 950: add round key circuit

960:奇偶校驗檢查電路 960: parity check circuit

970:奇偶校驗預測電路 970: Parity prediction circuit

980:多工器 980: multiplexer

1010:體內奇偶校驗位元預測電路 1010: Internal parity bit prediction circuit

1030:跨體奇偶校驗9位元預測電路 1030: Cross-body parity 9-bit prediction circuit

1110:體內奇偶校驗位元產生電路 1110: Internal parity bit generation circuit

1120:位移列預測電路 1120: displacement column prediction circuit

1130:混合行預測電路 1130: Hybrid row prediction circuit

1140:多工器 1140: multiplexer

1150:加上回合密鑰預測電路 1150: Add round key prediction circuit

1160:位移列電路 1160: shift column circuit

1210:多工器 1210: multiplexer

1230:體內互斥或閘 1230: internal mutex or gate

1310:跨體奇偶校驗位元組產生電路 1310: cross-body parity byte generation circuit

1330:跨小鑰奇偶校驗位元組分割電路 1330: Inter-small key parity byte segmentation circuit

1350:跨體奇偶校驗位元組預測電路 1350: Span parity byte prediction circuit

1370:跨體奇偶校驗1位元預測電路 1370: Cross-body parity 1-bit prediction circuit

1390:跨體奇偶校驗9位元合併電路 1390: 9-bit merging circuit for cross-body parity

1410:跨體奇偶校驗位元組分割電路 1410: Cross-body parity byte segmentation circuit

1430#0~1430#15:增強型查表電路 1430#0~1430#15: enhanced look-up table circuit

1450:跨體奇偶校驗位元組合併電路 1450: Cross-body parity bit combination combination circuit

1510:搜索電路 1510: search circuit

1530:替代校驗電路 1530: Alternative calibration circuit

1610:計算電路 1610: Calculation Circuit

1630:乘法器 1630: multiplier

1650:比較器 1650: comparator

1710,1750:密鑰分割電路 1710,1750: key splitting circuit

1712,1714:寄存器 1712, 1714: Register

1720,1730:鑰字處理電路 1720,1730: key word processing circuit

1725,1727,1729:互斥或閘 1725, 1727, 1729: mutex or gate

1742,1744:密鑰奇偶校驗碼產生電路 1742, 1744: key parity code generation circuit

1752,1754,1782,1784:寄存器 1752, 1754, 1782, 1784: registers

1762,1764:密鑰奇偶校驗檢查電路 1762, 1764: Key parity check circuits

1772,1774:密鑰奇偶校驗預測電路 1772, 1774: key parity prediction circuit

1810:鑰字分割電路 1810: key word segmentation circuit

1820:旋轉鑰字電路 1820: Rotary key word circuit

1830:替代鑰字電路 1830: Alternative key circuit

1840:捨去常數電路 1840: Rounding off the constant circuit

1850:鑰字合併電路 1850: key word combination circuit

1860:鑰字奇偶校驗產生電路 1860: Key word parity check generation circuit

1870:鑰字奇偶校驗預測電路 1870: Key Word Parity Prediction Circuit

1880:鑰字跨奇偶校驗預測電路 1880: Key word cross parity prediction circuit

1890:鑰字奇偶校驗9位元合併電路 1890: Key word parity check 9-bit merge circuit

1930#0~1930#3:增強型查表電路 1930#0~1930#3: enhanced look-up table circuit

2010:互斥或閘 2010: Mutual exclusion or gate

2110:鑰字分割電路 2110: key word segmentation circuit

2130:替代鑰字電路 2130: Alternative key word circuit

2150:鑰字合併電路 2150: key combination circuit

2160:鑰字奇偶校驗產生電路 2160: key word parity check generation circuit

2180:鑰字跨奇偶校驗預測電路 2180: key word cross parity prediction circuit

2190:鑰字奇偶校驗9位元合併電路 2190: keyword parity check 9-bit merge circuit

圖1為依據本發明實施例的電子裝置的系統架構圖。 FIG. 1 is a system architecture diagram of an electronic device according to an embodiment of the invention.

圖2為依據本發明實施例的閃存模組的示意圖。 FIG. 2 is a schematic diagram of a flash memory module according to an embodiment of the invention.

圖3為以128位元密鑰使用10個回合的演算法的高階示意圖。 FIG. 3 is a high-level schematic diagram of an algorithm using 10 rounds with a 128-bit key.

圖4為依據一些實施方式的高級加密標準(Advanced Encryption Standard，AES)編碼器的方塊圖。 Figure 4 is a block diagram of an Advanced Encryption Standard (AES) encoder in accordance with some implementations.

圖5為依據本發明實施例的AES編碼器的方塊圖。 FIG. 5 is a block diagram of an AES encoder according to an embodiment of the present invention.

圖6為依據本發明實施例的體、體內奇偶校驗位元和跨體奇偶校驗9位元的示意圖。 FIG. 6 is a schematic diagram of a body, body parity bits, and cross-body parity 9 bits according to an embodiment of the present invention.

圖7為依據本發明實施例的小鑰、小鑰內奇偶校驗位元和跨小鑰奇偶校驗9位元的示意圖。 Fig. 7 is a schematic diagram of a small key, parity bits within a small key, and 9 bits of parity across small keys according to an embodiment of the present invention.

圖8為依據本發明實施例的AES編碼器的方塊圖。 FIG. 8 is a block diagram of an AES encoder according to an embodiment of the present invention.

圖9為依據本發明實施例的AES資料處理電路的方塊圖。 FIG. 9 is a block diagram of an AES data processing circuit according to an embodiment of the present invention.

圖10為依據本發明實施例的奇偶校驗預測電路的方塊圖。 FIG. 10 is a block diagram of a parity prediction circuit according to an embodiment of the present invention.

圖11為依據本發明實施例的體內奇偶校驗位元預測電路的方塊圖。 FIG. 11 is a block diagram of an in-body parity bit prediction circuit according to an embodiment of the present invention.

圖12為依據本發明實施例的體內奇偶校驗位元產生電路的方塊圖。 FIG. 12 is a block diagram of an internal parity bit generating circuit according to an embodiment of the present invention.

圖13為依據本發明實施例的跨體奇偶校驗9位元預測電路的方塊圖。 FIG. 13 is a block diagram of a 9-bit prediction circuit for cross-body parity according to an embodiment of the present invention.

圖14為依據本發明實施例的增強型替代位元組電路的方塊圖。 FIG. 14 is a block diagram of an enhanced replacement byte circuit according to an embodiment of the present invention.

圖15為依據本發明實施例的增強型查表電路的方塊圖。 FIG. 15 is a block diagram of an enhanced look-up table circuit according to an embodiment of the present invention.

圖16為依據本發明實施例的替代校驗電路的方塊圖。 FIG. 16 is a block diagram of an alternative verification circuit according to an embodiment of the present invention.

圖17為依據本發明實施例的AES密鑰排程電路的方塊圖。 FIG. 17 is a block diagram of an AES key scheduling circuit according to an embodiment of the present invention.

圖18為依據本發明實施例的鑰字處理電路的方塊圖。 FIG. 18 is a block diagram of a key word processing circuit according to an embodiment of the present invention.

圖19為依據本發明實施例的替代鑰字電路的方塊圖。 FIG. 19 is a block diagram of an alternative key circuit according to an embodiment of the present invention.

圖20為依據本發明實施例的捨去常數電路的示意圖。 FIG. 20 is a schematic diagram of a rounding constant circuit according to an embodiment of the present invention.

圖21為依據本發明實施例的鑰字處理電路的方塊圖。 FIG. 21 is a block diagram of a key word processing circuit according to an embodiment of the present invention.

以下說明為完成發明的較佳實現方式，其目的在於描述本發明的基本精神，但並不用以限定本發明。實際的發明內容必須參考之後的權利要求範圍。 The following description is a preferred implementation mode of the invention, and its purpose is to describe the basic spirit of the invention, but not to limit the invention. For the actual content of the invention, reference must be made to the scope of the claims that follow.

必須了解的是，使用於本說明書中的「包含」、「包括」等詞，用以表示存在特定的技術特徵、數值、方法步驟、作業處理、元件以及/或組件，但並不排除可加上更多的技術特徵、數值、方法步驟、作業處理、元件、組件，或以上的任意組合。 It must be understood that words such as "comprising" and "including" used in this specification are used to indicate the existence of specific technical features, values, method steps, operations, components and/or components, but do not exclude the addition of more technical features, values, method steps, operations, processes, components, components, or any combination of the above.

於權利要求中使用如「第一」、「第二」、「第三」等詞是用來修飾權利要求中的元件，並非用來表示之間具有優先順序，前置關係，或者是一個元件先於另一個元件，或者是執行方法步驟時的時間先後順序，僅用來區別具有相同名字的元件。 Words such as "first", "second", and "third" used in the claims are used to modify the elements in the claims, and are not used to indicate that there is a priority order, a preceding relationship, or that one element precedes another element, or the chronological order of performing method steps, and are only used to distinguish between elements with the same name.

必須了解的是，當元件描述為「連接」或「耦接」至另一元件時，可以是直接連結、或耦接至其他元件，可能出現中間元件。相反地，當元件描述為「直接連接」或「直接耦接」至另一元件時，其中不存在任何中間元件。使用來描述元件之間關係的其他語詞也可類似方式解讀，例如「介於」相對於「直接介於」，或者是「鄰接」相對於「直接鄰接」等等。 It should be understood that when an element is referred to as being "connected" or "coupled" to another element, it can be directly connected or coupled to the other element, intervening elements may be present. In contrast, when an element is described as being "directly connected" or "directly coupled" to another element, there are no intervening elements present. Other words used to describe the relationship between elements may be interpreted in a similar manner, such as "between" versus "directly between," or "adjacent" versus "directly adjacent," and so on.

參考圖1。電子裝置10包含主機端(Host Side)110、閃存控制器130及閃存模組150，並且閃存控制器130及閃存模組150可合稱為裝置 端(Device Side)。電子裝置10可實施於個人電腦、筆記型電腦(Laptop PC)、平板電腦、手機、數位相機、數位攝影機、智慧型電視、智慧型電冰箱、車用電子系統(Automotive Electronics System)等電子產品之中。主機端110與閃存控制器130的主機介面(Host Interface)137可以通用序列匯流排(Universal Serial Bus，USB)、先進技術附著(advanced technology attachment，ATA)、序列先進技術附著(serial advanced technology attachment，SATA)、快速周邊元件互聯(peripheral component interconnect express，PCI-E)、通用快閃記憶儲存(Universal Flash Storage UFS)、嵌入式多媒體卡(Embedded Multi-Media Card eMMC)等通訊協定彼此溝通。閃存控制器130的閃存介面(Flash Interface)139與閃存模組150可以雙倍資料率(Double Data Rate DDR)通訊協定彼此溝通，例如，開放NAND快閃(Open NAND Flash Interface ONFI)、雙倍資料率開關(DDR Toggle)或其他通訊協定。閃存控制器130包含處理單元134，可使用多種方式實施，如使用通用硬體(例如，單一處理器、具平行處理能力的多處理器、圖形處理器或其他具運算能力的處理器)，並且在執行軟體以及/或韌體指令時，提供之後描述的功能。處理單元134通過主機介面131接收主機命令，例如讀取命令(Read Command)、寫入命令(Write Command)、抹除命令(Erase Command)等，排程並執行這些命令。閃存控制器130另包含隨機存取記憶體(Random Access Memory，RAM)136，可實施為動態隨機存取記憶體(Dynamic Random Access Memory，DRAM)、靜態隨機存取記憶體(Static Random Access Memory，SRAM)或上述兩者的結合，用於配置空間作為資料緩衝區，儲存從主機端110讀取並即將寫入閃存模組150的主機資料，以及從閃存模組150讀取並即將輸出給主機端110的主機資料。隨機存取記憶體136另可儲存執行過程中需要的資料，例如，變數、資料表、主機- 閃存對照表(Host-to-Flash H2F Table)、閃存-主機對照表(Flash-to-Host F2H Table)等。閃存介面139包含NAND閃存控制器(NAND Flash Controller NFC)，提供存取閃存模組150時需要的功能，例如命令序列器(Command Sequencer)、低密度奇偶校驗(Low Density Parity Check LDPC)等。 Refer to Figure 1. The electronic device 10 includes a host side (Host Side) 110, a flash memory controller 130 and a flash memory module 150, and the flash memory controller 130 and the flash memory module 150 can be collectively referred to as a device end (Device Side). The electronic device 10 can be implemented in electronic products such as personal computers, notebook computers (Laptop PC), tablet computers, mobile phones, digital cameras, digital video cameras, smart TVs, smart refrigerators, and automotive electronic systems (Automotive Electronics System). The host interface (Host Interface) 137 of the host terminal 110 and the flash memory controller 130 can be Universal Serial Bus (Universal Serial Bus, USB), advanced technology attachment (advanced technology attachment, ATA), serial advanced technology attachment (serial advanced technology attachment, SATA), fast peripheral component interconnect express (PCI-E), universal Communication protocols such as Universal Flash Storage UFS and Embedded Multi-Media Card eMMC communicate with each other. The flash memory interface (Flash Interface) 139 of the flash memory controller 130 and the flash memory module 150 can communicate with each other through a double data rate (DDR) communication protocol, for example, Open NAND Flash (Open NAND Flash Interface ONFI), double data rate switch (DDR Toggle) or other communication protocols. The flash memory controller 130 includes a processing unit 134, which can be implemented in a variety of ways, such as using general-purpose hardware (for example, a single processor, a multi-processor with parallel processing capabilities, a graphics processor, or other processors with computing capabilities), and when executing software and/or firmware instructions, it provides the functions described later. The processing unit 134 receives host commands, such as read commands (Read Command), write commands (Write Command), erase commands (Erase Command), etc., through the host interface 131, and schedules and executes these commands. The flash memory controller 130 further includes a random access memory (Random Access Memory, RAM) 136, which can be implemented as a dynamic random access memory (Dynamic Random Access Memory, DRAM), a static random access memory (Static Random Access Memory, SRAM) or a combination of the above two, used for configuring the space as a data buffer, storing host data that is read from the host end 110 and is about to be written into the flash memory module 150, and read and written from the flash memory module 150. Host information to be output to the host terminal 110 . Random access memory 136 can also store data needed during execution, for example, variables, data tables, host- Host-to-Flash H2F Table, Flash-to-Host F2H Table, etc. The flash interface 139 includes a NAND flash controller (NAND Flash Controller NFC), which provides functions required for accessing the flash memory module 150, such as command sequencer (Command Sequencer), low density parity check (Low Density Parity Check LDPC) and so on.

閃存控制器130中可配置匯流排架構(Bus Architecture)132，用於讓元件之間彼此耦接以傳遞資料、位址、控制訊號等，這些元件包含主機介面131、處理單元134、RAM 136、高級加密標準(Advanced Encryption Standard，AES)編碼器137、直接記憶體存取(Direct Memory Access，DMA)控制器138、閃存介面139等。DMA控制器138可依據處理單元134的指令，通過匯流排架構132在元件間遷移資料，例如，將RAM 136的特定資料緩存器中的資料搬到AES編碼器137的特定寄存器(Register)，將AES編碼器137的特定寄存器中的資料搬到RAM 136的特定資料緩存器等。 A bus architecture (Bus Architecture) 132 can be configured in the flash memory controller 130 for coupling components to transmit data, addresses, and control signals. The DMA controller 138 can transfer data between components through the bus architecture 132 according to the instructions of the processing unit 134, for example, moving data in a specific data register of the RAM 136 to a specific register (Register) of the AES encoder 137, moving data in a specific register of the AES encoder 137 to a specific data register of the RAM 136, etc.

閃存模組150提供大量的儲存空間，通常是數百個千兆位元組(Gigabytes，GB)，甚至是數個萬億位元組(Terabytes，TB)，用於儲存大量的主機資料，例如高解析度圖片、影片等。閃存模組150中包含控制電路以及記憶體陣列，記憶體陣列中的記憶單元可在抹除後組態為單層式單元(Single Level Cells，SLCs)、多層式單元(Multiple Level Cells，MLCs)三層式單元(Triple Level Cells，TLCs)、四層式單元(Quad-Level Cells，QLCs)或上述的任意組合。處理單元134通過閃存介面139寫入主機資料到閃存模組150中的指定位址(目的位址)，以及從閃存模組150中的指定位址(來源位址)讀取主機資料。閃存介面139使用數個電子訊號來協調閃存控制器130與閃存模組150間的資料與命令傳遞，包含資料線(Data Line)、時脈訊號(Clock Signal)與控制訊號(Control Signal)。資料線可用於傳遞命令、位址、讀出及寫入的資料；控 制訊號線可用於傳遞晶片致能(Chip Enable，CE)、位址提取致能(Address Latch Enable，ALE)、命令提取致能(Command Latch Enable，CLE)、寫入致能(Write Enable，WE)等控制訊號。 The flash memory module 150 provides a large amount of storage space, usually hundreds of gigabytes (Gigabytes, GB), or even several trillion bytes (Terabytes, TB), for storing a large amount of host data, such as high-resolution pictures and videos. The flash memory module 150 includes a control circuit and a memory array. The memory cells in the memory array can be configured as single-level cells (Single Level Cells, SLCs), multi-level cells (Multiple Level Cells, MLCs), triple-level cells (Triple Level Cells, TLCs), quad-level cells (Quad-Level Cells, QLCs) or any combination of the above after erasing. The processing unit 134 writes host data to a specified address (destination address) in the flash memory module 150 through the flash memory interface 139 and reads host data from a specified address (source address) in the flash memory module 150 . The flash memory interface 139 uses several electronic signals to coordinate data and command transmission between the flash memory controller 130 and the flash memory module 150 , including data lines (Data Line), clock signals (Clock Signal) and control signals (Control Signal). The data line can be used to transmit commands, addresses, read and write data; control The control signal line can be used to transmit control signals such as Chip Enable (CE), Address Latch Enable (ALE), Command Latch Enable (CLE), and Write Enable (WE).

參考圖2，閃存模組150中的介面151可包含四個輸出入通道(I/O channels，以下簡稱通道)CH#0至CH#3，每個通道連接四個NAND閃存單元，例如，通道CH#0連接NAND閃存單元153#0、153#4、153#8及153#12。每個NAND閃存單元可封裝為獨立的芯片(Die)。閃存介面139可通過介面151發出致能訊號CE#0至CE#3中的一個來致能NAND閃存單元153#0至153#3、153#4至153#7、153#8至153#11、或153#12至153#15，接著以並行的方式從致能的NAND閃存單元讀取主機資料，或者寫入主機資料至致能的NAND閃存單元。 Referring to FIG. 2, the interface 151 in the flash memory module 150 may include four input/output channels (I/O channels, hereinafter referred to as channels) CH#0 to CH#3, each channel is connected to four NAND flash memory units, for example, channel CH#0 is connected to NAND flash memory units 153#0, 153#4, 153#8 and 153#12. Each NAND flash memory unit can be packaged as an independent chip (Die). The flash memory interface 139 can send one of the enable signals CE#0 to CE#3 through the interface 151 to enable the NAND flash memory units 153#0 to 153#3, 153#4 to 153#7, 153#8 to 153#11, or 153#12 to 153#15, and then read host data from the enabled NAND flash memory units in parallel, or write host data to the enabled NAND flash memory units.

AES編碼器137實施一種Rijndael的變形演算法，其中使用固定的128位元大小的塊和128、192或256位元大小的基礎密鑰。AES編碼器137針對4x4以行為主的有序陣列(4x4 Column-major Order Array)的位元組進行操作，每個位元組稱為體(State)。大部分的AES計算都是在特定有限域(Finite Field)中完成的。例如，16個體S0、S1到S15可用以下二維陣列(Two-dimensional Array)表示：

Figure 111137122-A0305-02-0008-1
AES加密中使用的密鑰大小決定了轉換回合的數目，此加密用以將輸入訊息(稱為明文)轉換成為最後輸出(稱為密文)。例如，128位元密鑰使用10個回合(n=10)加密，192位元密鑰使用12個回合(n=12)加密，256位元密鑰使用14個回合(n=14)加密。每個回合包含數個處理步驟(或者稱為操作)，其中包含一個取決於加密密鑰本身的步驟。參考圖3所示的以128位元密鑰使用10個回合的 演算法的高階示意圖。演算法使用擴展密鑰的步驟S350(也稱為AES密鑰排程)，根據128位元基礎密鑰(Root Key)w[0,3]來擴展出多個回合所需要的密鑰。初始回合包含加上回合密鑰(Add-Round-Key)的步驟S340#0，用於加上回合密鑰，每個體使用逐位元的XOR運算合併上基礎密鑰w[0,3]中的相應位元組。接下來的9個回合，每個回合包含替代位元組(Substitute-Bytes)的步驟S310#i、位移列(Shift-Rows)的步驟S320#i、混合行(Mix-Columns)的步驟S330#i、加上回合密鑰的步驟S340#i，其中i為1到9之間的任意正整數。步驟S310#i是一個非線性替代的步驟，根據查找表(又可稱為Rijndael S-box)將每個體的值替換為另一個值，其中的查找表使用以下公式建立：SBi=Affine((i)-1)SBi代表i的輸出結果，Affine()代表Affine轉換函數，i為從0到127的正整數。步驟S320#i是一個調換位置的步驟，將下面三列的每一者向左或向右循環位移指定步數。步驟S330#i執行線性混合操作，作用於行，用於將每一行的四個體進行合併。步驟S340#i用於加上回合密鑰，每個體使用逐位元的XOR運算合併上基礎密鑰w[i*4,i*4+3]中的相應位元組。最後回合(也就是第10回合)包含步驟S310#10、S320#10、S340#10，其功能分別類似於步驟S310#i、S320#i、S340#i。雖然圖3只介紹了128位元密鑰使用10個回合的演算法，所屬技術領域人員理解192位元密鑰使用12個回合及256位元密鑰使用14個回合的演算法的技術細節，可從美國國家標準與技術研究院(National Institute of Standard and Technology，NIST)發表的標準文件中獲取。 The AES encoder 137 implements a variant of Rijndael using a fixed 128-bit size block and a base key size of 128, 192 or 256 bits. The AES encoder 137 operates on a 4x4 column-major order array (4x4 Column-major Order Array) of bytes, and each byte is called a body (State). Most of the AES calculations are done in a specific finite field (Finite Field). For example, 16 individuals S 0 , S 1 to S 15 can be represented by the following two-dimensional array (Two-dimensional Array):
Figure 111137122-A0305-02-0008-1
 The key size used in AES encryption determines the number of conversion rounds used to convert an input message (called plaintext) into a final output (called ciphertext). For example, a 128-bit key is encrypted using 10 rounds (n=10), a 192-bit key is encrypted using 12 rounds (n=12), and a 256-bit key is encrypted using 14 rounds (n=14). Each round consists of several processing steps (or operations), including one that depends on the encryption key itself. Refer to Figure 3 for a high-level schematic diagram of the algorithm using 10 rounds with a 128-bit key. The algorithm uses the step S350 of expanding the key (also called AES key scheduling) to expand the keys needed for multiple rounds according to the 128-bit root key (Root Key) w[0,3]. The initial round includes the step S340#0 of adding a round key (Add-Round-Key), which is used to add a round key, and each body uses a bit-by-bit XOR operation to combine the corresponding bytes in the basic key w[0,3]. Next 9 rounds, each round includes step S310#i of Substitute-Bytes, step S320#i of Shift-Rows, step S330#i of Mix-Columns, and step S340#i of adding round key, wherein i is any positive integer between 1 and 9. Step S310#i is a step of non-linear substitution. The value of each volume is replaced by another value according to a lookup table (also called Rijndael S-box), wherein the lookup table is established using the following formula: SB i =Affine((i) -1 )SB i represents the output result of i, Affine() represents the Affine conversion function, and i is a positive integer from 0 to 127. Step S320#i is a step of exchanging positions, cyclically shifting each of the following three columns to the left or right by a specified number of steps. Step S330#i executes a linear blending operation, acting on rows, for merging four volumes in each row. Step S340#i is used to add the round key, each body uses the bitwise XOR operation to combine the corresponding bytes in the basic key w[i*4, i*4+3]. The last round (that is, the tenth round) includes steps S310#10, S320#10, and S340#10, the functions of which are similar to steps S310#i, S320#i, and S340#i respectively. Although FIG. 3 only introduces the algorithm using 10 rounds for 128-bit keys, those skilled in the art understand the technical details of algorithms using 12 rounds for 192-bit keys and 14 rounds for 256-bit keys, which can be obtained from standard documents published by the National Institute of Standards and Technology (NIST).

由於在遭遇惡意攻擊、晶片瑕疵、惡劣環境等情況時，AES加密的過程中會發生錯誤而造成使用者資料無法回復的重大傷害。參考圖4，在一些實施方式的AES編碼器400中，包含兩套相同的用於實現 如上所示演算法的AES編碼電路410和430。AES編碼器400另設置比較器450，用於從AES編碼電路410接收每個體的密文C#1，從AES編碼電路430接收每個體的密文C#2，並且比較兩者是否相同。如果相同，則比較器450輸出密文C#1和加密成功的訊息。如果不同，則比較器450輸出加密失敗的訊息，用於通知處理單元中運行的韌體，需要執行錯誤管理程序。然而，以上實施方式的AES編碼器400的面積大於兩套AES編碼電路的面積，造成製造成本上升。 Due to malicious attacks, chip defects, harsh environments, etc., errors will occur during the AES encryption process, which will cause major damage to user data that cannot be recovered. Referring to FIG. 4 , in some embodiments of the AES encoder 400, two identical sets are included for realizing The AES encoding circuits 410 and 430 of the algorithm shown above. The AES encoder 400 is further provided with a comparator 450 for receiving the ciphertext C#1 of each body from the AES encoding circuit 410 and the ciphertext C#2 of each body from the AES encoding circuit 430, and comparing whether they are the same. If they are the same, the comparator 450 outputs the ciphertext C#1 and the message that the encryption is successful. If not, the comparator 450 outputs an encryption failure message, which is used to notify the firmware running in the processing unit that an error management program needs to be executed. However, the area of the AES encoder 400 in the above embodiment is larger than the area of the two sets of AES encoding circuits, resulting in increased manufacturing costs.

為了讓AES編碼器的面積小於兩套AES編碼電路的面積，從一個方面來說，參考圖5，本發明實施例提出在AES編碼器500中除了設置用於實現如上所示演算法的AES編碼電路510之外，還設置面積較一套完整的AES編碼電路510更小的錯誤偵測電路530來完成加密過程是否發生錯誤的偵測。在每個體的加密過程中，錯誤偵測電路530使用比16個體及其所屬的回合密鑰更少的資訊來判斷整個加密過程中是否發生錯誤。如果判定沒有任何錯誤，則錯誤偵測電路530可輸出加密成功訊息。如果判定發生錯誤，則錯誤偵測電路530輸出加密失敗的訊息，用於通知處理單元中運行的韌體，需要執行錯誤管理程序。 In order to make the area of the AES encoder smaller than the area of two sets of AES encoding circuits, from one aspect, referring to FIG. 5 , the embodiment of the present invention proposes that in addition to the AES encoding circuit 510 for implementing the algorithm shown above, an error detection circuit 530 with an area smaller than that of a complete set of AES encoding circuits 510 is provided in the AES encoder 500 to detect whether an error occurs during the encryption process. During the encryption process of each block, the error detection circuit 530 uses less information than 16 blocks and their associated round keys to determine whether an error occurs during the entire encryption process. If it is determined that there is no error, the error detection circuit 530 may output an encryption success message. If it is determined that an error occurs, the error detection circuit 530 outputs an encryption failure message for notifying the firmware running in the processing unit that an error management program needs to be executed.

冗餘資料產生電路550可在16個體附加上用於讓錯誤偵測電路530判斷加密過程中是否發生錯誤的冗餘資料，而冗餘資料是一種根據16個體中的值或者中間加密結果和AES加密演算法的預測結果。參考圖6，在一些實施例中，冗餘資料產生電路(Redundant-data Generation Circuitry)550可預測一個體內奇偶校驗位元(In-state Parity Bit)，並且將體內奇偶校驗位元(當作第8個位元)附加在體(第0~7個位元)之後。需要注意的是，所屬技術領域人員不應依據上述的附加操作解讀為8位元的體和1位元的體內奇偶校驗位元實際儲存於9位元的連續空間，不同但等同的資料結構都是允許的。例如，冗餘資料產生電路550可預測體S0的體內奇偶校驗位元P0，預 測體S1的體內奇偶校驗位元P1，依此類推。體和相應體內奇偶校驗位元之間的匹配可使用以下範例公式表示：

Figure 111137122-A0305-02-0011-2
Pi代表第i個體的體內奇偶校驗位元的值，Si,j代表第i個體中的第j個位元的值，i為從0到15的正整數。當公式的兩邊相等時，代表第i個體和第i個體內奇偶校驗位元是匹配的。否則，代表兩者間不匹配。冗餘資料產生電路550可預測相應於每行的體的值及其體內奇偶校驗位元的一個跨體奇偶校驗9位元(Across-state Parity 9-bit)。例如，冗餘資料產生電路550可預測相應於體S0及其體內奇偶校驗位元P0、體S1及其體內奇偶校驗位元P1、體S2及其體內奇偶校驗位元P2和體S3及其體內奇偶校驗位元P3的跨體奇偶校驗9位元Q0，依此類推。每個行的多個體及其體內奇偶校驗位元和相應跨體奇偶校驗9位元之間的匹配可使用以下範例公式表示：
Figure 111137122-A0305-02-0011-50
,for j=0~8
Figure 111137122-A0305-02-0011-51
,for j=0~8
Figure 111137122-A0305-02-0011-52
,for j=0~8
Figure 111137122-A0305-02-0011-53
,for j=0~8 Q0,j代表第0個跨體奇偶校驗9位元的第j個位元的值，Q1,j代表第1個跨體奇偶校驗9位元的第j個位元的值，Q2,j代表第2個跨體奇偶校驗9位元的第j個位元的值，Q3,j代表第3個跨體奇偶校驗9位元的第j個位元的值，Si,j代表第i個體中的第j個位元的值，j為從0至8的任意整數。當第i個跨體奇偶校驗9位元中的每個位元等於第i行中的相應位元的加總(或者互斥或運算的結果)時，代表第i行的體及體內奇偶校驗位元和第i個跨體奇偶校驗9位元之間是匹配的。否則，代表兩者間不匹配。 The redundant data generation circuit 550 can add redundant data to the 16 blocks for the error detection circuit 530 to judge whether an error occurs during the encryption process, and the redundant data is a prediction result based on the value in the 16 blocks or the intermediate encryption result and the AES encryption algorithm. Referring to FIG. 6 , in some embodiments, a redundant-data generation circuit (Redundant-data Generation Circuitry) 550 can predict an in-state parity bit (In-state Parity Bit), and append the in-state parity bit (as the 8th bit) to the body (the 0th to 7th bits). It should be noted that those skilled in the art should not interpret the 8-bit body and 1-bit body parity bits to be actually stored in a 9-bit continuous space based on the above additional operations, and different but equivalent data structures are allowed. For example, the redundant data generating circuit 550 can predict the internal parity bit P 0 of the bank S 0 , predict the internal parity bit P 1 of the bank S 1 , and so on. A match between a body and the corresponding body parity bits can be expressed using the following example formula:
Figure 111137122-A0305-02-0011-2
 P i represents the value of the internal parity bit of the i-th individual, S i,j represents the value of the j-th bit in the i-th individual, and i is a positive integer from 0 to 15. When both sides of the formula are equal, it means that the i-th individual and the parity bits in the i-th individual match. Otherwise, there is a mismatch between the two. The redundant data generation circuit 550 can predict an Across-state Parity 9-bit corresponding to the bank value of each row and its bank parity bits. For example, the redundant data generation circuit 550 can predict the cross-bank parity 9-bit Q 0 corresponding to bank S 0 and its internal parity bit P 0 , bank S 1 and its internal parity bit P 1 , bank S 2 and its internal parity bit P 2 , bank S 3 and its internal parity bit P 3 , and so on. The matching between multiple banks of each row and its internal parity bits and the corresponding straddle parity 9 bits can be expressed using the following example formula:
Figure 111137122-A0305-02-0011-50
, for j =0~8
Figure 111137122-A0305-02-0011-51
, for j =0~8
Figure 111137122-A0305-02-0011-52
, for j =0~8
Figure 111137122-A0305-02-0011-53
,for j =0~8 Q 0,j represents the value of the j-th bit of the 0th straddle parity check 9-bit, Q 1,j represents the value of the j-th bit of the 1st spanning parity 9-bit, Q 2,j represents the value of the j-th bit of the second straddle parity 9-bit, Q 3,j represents the value of the j-th bit of the 3rd straddle parity 9-bit, S i,j represents the value of the i-th individual The value of the jth bit of , where j is any integer from 0 to 8. When each bit in the i-th straddle parity 9-bit is equal to the sum of the corresponding bits in the i-th row (or the result of an exclusive OR operation), it represents a match between the i-th row's body and body parity bits and the i-th straddle parity 9-bit. Otherwise, there is a mismatch between the two.

從一個方面來說，AES編碼電路510和冗餘資料產生電路550是獨立且並行運行的，兩者之間不會進行資料和訊息交換。冗餘資料產生 電路550使用冗餘資料更新演算法來產生預測冗餘資料，而冗餘資料更新演算法是從AES加密演算法推導出來的，使得AES編碼電路510產生的中間加密結果和冗餘資料產生電路550預測的冗餘資料能夠在加密明文過程中的每個特定中間點，在沒有發生錯誤的情況下，都能維持指定的數學關係。 From one aspect, the AES encoding circuit 510 and the redundant data generating circuit 550 run independently and in parallel, and there is no exchange of data and messages between the two. redundant data generation The circuit 550 uses a redundant data updating algorithm to generate predicted redundant data, and the redundant data updating algorithm is derived from the AES encryption algorithm, so that the intermediate encryption result generated by the AES encoding circuit 510 and the redundant data predicted by the redundant data generating circuit 550 can maintain a specified mathematical relationship at each specific intermediate point in the process of encrypting the plaintext without errors.

冗餘密鑰產生電路(Redundant-key Generation Circuitry)570在每個基礎密鑰或者回合密鑰附加上用於讓錯誤偵測電路530判斷密鑰產生過程中是否發生錯誤的冗餘資料，而冗餘資料是一種根據基礎密鑰或者回合密鑰中的值和AES密鑰排程演算法的預測結果。參考圖7，以256位元基礎密鑰為例，冗餘密鑰產生電路570可先將基礎密鑰依序切分為32個位元組(每個位元組可稱為小鑰，Subkey)，並組織為8行4列的矩陣。冗餘密鑰產生電路570可預測一個小鑰內奇偶校驗位元(In-subkey Parity Bit)，並且將小鑰內奇偶校驗位元(當作第8個位元)附加在小鑰(第0~7個位元)之後。需要注意的是，所屬技術領域人員不能夠依據上述的附加操作解讀為8位元的小鑰和1位元的小鑰內奇偶校驗位元實際儲存於9位元的連續空間，不同但等同的資料結構都是允許的。例如，冗餘密鑰產生電路570可預測小鑰k0的小鑰內奇偶校驗位元R0，預測小鑰k1的小鑰內奇偶校驗位元R1，依此類推。小鑰和小鑰內奇偶校驗位元之間的匹配可使用以下範例公式表示：

Figure 111137122-A0305-02-0012-4
Ri代表第i個小鑰的小鑰內奇偶校驗位元的值，ki,j代表第i個小鑰中的第j個位元的值，i為從0到15的正整數。當公式的兩邊相等時，代表第i個小鑰和第i個小鑰內奇偶校驗位元是匹配的。否則，代表兩者間不匹配。冗餘密鑰產生電路570可預測相應於每行的小鑰的值及其小鑰內奇偶校驗位元的一個跨小鑰奇偶校驗9位元(Across- subkey Parity 9-bit)。例如，冗餘密鑰產生電路570可預測相應於小鑰k0及其小鑰內奇偶校驗位元R0、小鑰k1及其體內奇偶校驗位元R1、小鑰k2及其小鑰內奇偶校驗位元R2和小鑰k3及其小鑰內奇偶校驗位元R3的跨小鑰奇偶校驗9位元V0，依此類推。每個行的多個小鑰及其小鑰內奇偶校驗位元和相應跨小鑰奇偶校驗9位元之間的匹配可使用以下範例公式表示：
Figure 111137122-A0305-02-0013-54
,for j=0~8
Figure 111137122-A0305-02-0013-55
,for j=0~8
Figure 111137122-A0305-02-0013-56
,for j=0~8
Figure 111137122-A0305-02-0013-57
,for j=0~8
Figure 111137122-A0305-02-0013-66
,for j=0~8
Figure 111137122-A0305-02-0013-59
,for j=0~8
Figure 111137122-A0305-02-0013-60
,for j=0~8
Figure 111137122-A0305-02-0013-61
,for j=0~8 V0,j代表第0個跨小鑰奇偶校驗9位元的第j個位元的值，V1,j代表第1個跨小鑰奇偶校驗9位元的第j個位元的值，V2,j代表第2個跨小鑰奇偶校驗9位元的第j個位元的值，V3,j代表第3個跨小鑰奇偶校驗9位元的第j個位元的值，V4,j代表第4個跨小鑰奇偶校驗9位元的第j個位元的值，V5,j代表第5個跨小鑰奇偶校驗9位元的第j個位元的值，V6,j代表第6個跨小鑰奇偶校驗9位元的第j個位元的值，V7,j代表第7個跨小鑰奇偶校驗9位元的第j個位元的值，ki,j代表第i個小鑰中的第j個位元的值，j為從0至8的任意整數。當第i個跨小鑰奇偶校驗9位元中的每個位元等於第i行中的相應位元的加總(或者互斥或運算的結果)時，代表第i行的小鑰及小鑰內奇偶校驗位元和第i個跨小鑰奇偶校驗9位元之間是匹配的。否則，代表兩者間不匹配。 The redundant-key generation circuit (Redundant-key Generation Circuitry) 570 adds redundant data for each basic key or round key to allow the error detection circuit 530 to determine whether an error occurs during key generation, and the redundant data is a prediction result based on the value in the basic key or round key and the AES key scheduling algorithm. Referring to FIG. 7 , taking a 256-bit basic key as an example, the redundant key generation circuit 570 can first divide the basic key into 32 bytes (each byte can be called a subkey), and organize it into a matrix with 8 rows and 4 columns. The redundant key generation circuit 570 can predict an in-subkey parity bit (In-subkey Parity Bit), and append the in-subkey parity bit (as the 8th bit) to the subkey (bits 0-7). It should be noted that those skilled in the art cannot interpret the parity bits in the 8-bit small key and the 1-bit small key to be actually stored in a 9-bit continuous space based on the above additional operations, and different but equivalent data structures are allowed. For example, the redundant key generation circuit 570 can predict the parity bit R 0 of the small key k 0 , predict the parity bit R 1 of the small key k 1 , and so on. The match between the keylet and the parity bits within the keylet can be expressed using the following example formula:
Figure 111137122-A0305-02-0012-4
 R i represents the value of the parity bit in the i-th small key, ki ,j represents the value of the j-th bit in the i-th small key, and i is a positive integer from 0 to 15. When both sides of the formula are equal, it means that the i-th small key matches the parity bits in the i-th small key. Otherwise, there is a mismatch between the two. The redundant key generation circuit 570 can predict an Across-subkey Parity 9-bit (Across-subkey Parity 9-bit) corresponding to the value of the subkey of each row and the parity bits within the subkey. For example, the redundant key generation circuit 570 may predict the cross-keylet parity 9-bit V 0 corresponding to keylet k 0 and its intra-key parity bit R 0 , keylet k 1 and its internal parity bit R 1 , keylet k 2 and its intra-key parity bit R 2 , keylet k 3 and its intra-key parity bit R 3 , and so on. Multiple keys per row and the matching between their intra-keylet parity bits and the corresponding cross-keylet parity 9 bits can be expressed using the following example formula:
Figure 111137122-A0305-02-0013-54
, for j =0~8
Figure 111137122-A0305-02-0013-55
, for j =0~8
Figure 111137122-A0305-02-0013-56
, for j =0~8
Figure 111137122-A0305-02-0013-57
, for j =0~8
Figure 111137122-A0305-02-0013-66
, for j =0~8
Figure 111137122-A0305-02-0013-59
, for j =0~8
Figure 111137122-A0305-02-0013-60
, for j =0~8
Figure 111137122-A0305-02-0013-61
,for j =0~8 V 0,j代表第0個跨小鑰奇偶校驗9位元的第j個位元的值，V 1,j代表第1個跨小鑰奇偶校驗9位元的第j個位元的值，V 2,j代表第2個跨小鑰奇偶校驗9位元的第j個位元的值，V 3,j代表第3個跨小鑰奇偶校驗9位元的第j個位元的值，V 4,j代表第4個跨小鑰奇偶校驗9位元的第j個位元的值，V 5,j代表第5個跨小鑰奇偶校驗9位元的第j個位元的值，V 6,j代表第6個跨小鑰奇偶校驗9位元的第j個位元的值，V 7,j代表第7個跨小鑰奇偶校驗9位元的第j個位元的值，k i,j代表第i個小鑰中的第j個位元的值，j為從0至8的任意整數。 When each bit in the 9-bit parity check across the i-th small key is equal to the sum of the corresponding bits in the i-th row (or the result of an exclusive OR operation), it means that there is a match between the small key in the i-th row and the parity bits in the small key and the 9-bit parity check across the i-th small key. Otherwise, there is a mismatch between the two.

從一個方面來說，AES編碼電路510和冗餘密鑰產生電路570是獨立且並行運行的，兩者之間不會進行資料和訊息交換。冗餘密鑰產生 電路570使用冗餘密鑰更新演算法來產生預測冗餘資料，而冗餘密鑰更新演算法是從AES加密演算法中的AES密鑰排程推導出來的，使得AES編碼電路510產生的回合密鑰和冗餘密鑰產生電路570預測的冗餘資料能夠在產生回合密鑰過程中的每個特定中間點，在沒有發生錯誤的情況下，都能維持指定的數學關係。 From one aspect, the AES encoding circuit 510 and the redundant key generating circuit 570 operate independently and in parallel, and there is no exchange of data and messages between the two. redundant key generation The circuit 570 uses a redundant key updating algorithm to generate predicted redundant data, and the redundant key updating algorithm is derived from the AES key schedule in the AES encryption algorithm, so that the round key generated by the AES encoding circuit 510 and the redundant data predicted by the redundant key generating circuit 570 can maintain a specified mathematical relationship at each specific intermediate point in the process of generating the round key without errors.

雖然圖5將AES編碼電路510、錯誤偵測電路530、冗餘資料產生電路550和冗餘密鑰產生電路570以不同方塊表示，但這只是為了讓讀者容易理解，所屬技術領域人員可在實際實現時，將AES編碼電路510、錯誤偵測電路530、冗餘資料產生電路550和冗餘密鑰產生電路570以適當的方式整合在一起，本發明並不因此局限。 Although FIG. 5 shows the AES encoding circuit 510, the error detection circuit 530, the redundant data generating circuit 550, and the redundant key generating circuit 570 in different blocks, this is only for easy understanding by readers. Those skilled in the art can integrate the AES encoding circuit 510, the error detecting circuit 530, the redundant data generating circuit 550, and the redundant key generating circuit 570 in an appropriate manner during actual implementation, and the present invention is not limited thereto.

從另一個方面來說，參考圖8，本發明實施例提出在AES編碼器137中設置AES資料處理電路(AES Data Processing Circuitry)810和AES密鑰排程電路(AES Key Schedule Circuitry)830。AES密鑰排程電路830包含密鑰產生電路833，用於完成如圖3所示的擴展密鑰步驟S350。控制器870發出控制訊號給AES密鑰排程電路830，用於驅動AES密鑰排程電路830根據基礎密鑰K0或者之前的回合密鑰Ki-2產生新的回合密鑰，並且輸出指定回合的回合密鑰Ki及其相應的冗餘資料(例如，小鑰內奇偶校驗位元R和跨小鑰奇偶校驗9位元V)給AES資料處理電路810。AES密鑰排程電路830包含密鑰錯誤檢查電路835，設置以計算出相應於每個回合密鑰的冗餘資料；並且在擴展密鑰過程中的指定中間點發現任何回合密鑰和相應冗餘資料不匹配時，發出錯誤訊號ERR_KEY=1。回合密鑰可切分為16個小鑰且組織為4x4位元組陣列，每個小鑰為1位元組；冗餘資料包含相應於每個小鑰的小鑰內奇偶校驗位元，和相應於每個行的跨小鑰奇偶校驗9位元。密鑰錯誤檢查電路835在擴展密鑰過程中的指定中間點發現任何小鑰不匹配於相應小鑰內奇偶校驗位元時，或者發現相應於任何行的小鑰加上4個相應小鑰內奇偶校驗位元，不匹配於相應 跨小鑰奇偶校驗9位元時，發出錯誤訊號ERR_KEY=1。 From another aspect, referring to FIG. 8 , the embodiment of the present invention proposes setting an AES Data Processing Circuit (AES Data Processing Circuit) 810 and an AES Key Schedule Circuit (AES Key Schedule Circuit) 830 in the AES encoder 137 . The AES key scheduling circuit 830 includes a key generation circuit 833 for completing the key expansion step S350 shown in FIG. 3 . The controller 870 sends a control signal to the AES key scheduling circuit 830, which is used to drive the AES key scheduling circuit 830 to generate a new round key according to the basic key K 0 or the previous round key K i-2 , and output the round key K i of the specified round and its corresponding redundant data (for example, the parity bit R within the small key and the 9-bit parity V across small keys) to the AES data processing circuit 810. The AES key scheduling circuit 830 includes a key error checking circuit 835 configured to calculate redundant data corresponding to each round key; and to send an error signal ERR_KEY=1 when any round key does not match the corresponding redundant data at a specified intermediate point in the key expansion process. The round key can be divided into 16 small keys and organized as a 4x4 byte array, each small key is 1 byte; the redundant data includes the parity bit within the small key corresponding to each small key, and the 9 bits of parity across small keys corresponding to each row. When the key error checking circuit 835 finds that any keylet does not match the parity bit in the corresponding keylet at a specified intermediate point in the process of expanding the key, or finds that the keylet corresponding to any row plus 4 parity bits in the corresponding keylet do not match the corresponding 9 bits of parity across the keylets, an error signal ERR_KEY=1 is sent.

AES資料處理電路810包含編碼電路813，設置以實現如圖3所示的AES演算法中的替代位元組步驟S310、位移列步驟S320、混合行步驟S330和加上回合密鑰步驟S340。AES演算法包含多個回合，並且在每個回合中用於使用回合密鑰對明文或者中間加密結果進行編碼。控制器870發出控制訊號給AES資料處理電路810，用於驅動AES資料處理電路810來安排上述步驟的執行順序，以符合AES演算法的回合設置。AES資料處理電路810包含編碼錯誤檢查電路815，設置以計算出相應於明文或者中間加密結果的冗餘資料；在加密過程中的指定中間點發現中間加密結果和冗餘資料之間不匹配時，發出編碼錯誤訊號ERR_ENC=1。明文可切分為16個體且組織為4x4陣列，每個體為1位元組，冗餘資料包含相應於每個體的體內奇偶校驗位元，和相應於明文中的每個行的跨體奇偶校驗9位元。編碼錯誤檢查電路815在加密過程中的指定時間點發現任何所述體的中間加密結果不匹配於相應體內奇偶校驗位元時，或者發現相應於明文中的任何行的中間加密結果加上4個相應體內奇偶校驗位元，不匹配於相應跨體奇偶校驗9位元時，發出編碼錯誤訊號ERR_ENC=1。 The AES data processing circuit 810 includes an encoding circuit 813, which is configured to implement the byte replacement step S310, column displacement step S320, row mixing step S330 and round key addition step S340 in the AES algorithm shown in FIG. The AES algorithm consists of multiple rounds, and in each round is used to encode plaintext or intermediate encryption results using the round key. The controller 870 sends a control signal to the AES data processing circuit 810 for driving the AES data processing circuit 810 to arrange the execution sequence of the above steps to meet the round setting of the AES algorithm. The AES data processing circuit 810 includes an encoding error checking circuit 815, which is configured to calculate redundant data corresponding to the plaintext or the intermediate encryption result; when a mismatch between the intermediate encryption result and the redundant data is found at a specified intermediate point in the encryption process, an encoding error signal ERR_ENC=1 is sent. The plaintext can be divided into 16 bodies and organized as a 4x4 array, each body is 1 byte, and the redundant data includes the body parity bit corresponding to each body, and the cross-body parity 9 bits corresponding to each line in the plaintext. When the encoding error checking circuit 815 finds that the intermediate encryption result of any of the bodies does not match the corresponding body parity bit at a specified point in the encryption process, or finds that the intermediate encryption result corresponding to any row in the plaintext plus 4 corresponding body parity bits does not match the corresponding straddle body parity 9 bits, an encoding error signal ERR_ENC=1 is sent.

或閘850耦接編碼錯誤檢查電路815和密鑰錯誤檢查電路835的輸出端。當編碼錯誤檢查電路815輸出編碼錯誤訊號ERR_ENC=1和/或密鑰錯誤檢查電路835輸出密鑰錯誤訊號ERR_KEY=1時，或閘850輸出AES錯誤訊號ERR_AES=1給處理單元134。 The OR gate 850 is coupled to the output terminals of the encoding error checking circuit 815 and the key error checking circuit 835 . When the encoding error checking circuit 815 outputs the encoding error signal ERR_ENC=1 and/or the key error checking circuit 835 outputs the key error signal ERR_KEY=1, the OR gate 850 outputs the AES error signal ERR_AES=1 to the processing unit 134 .

參考圖9所示的AES資料處理電路810的方塊圖。資料寄存器912用於儲存在AES加密過程中產生的16位元組(也就是128比特)的中間或者最終結果，而奇偶校驗碼寄存器(Parity Registers)914用於儲存在AES加密過程中產生的相應於16位元組的中間或者最終結果的體內奇偶校驗位元和跨體奇偶校驗9位元。位移列電路(Shift-row Circuitry)930用於執行如如圖3所示的位移列的步驟S320，並且其 結構為所屬技術領域人員所公知，為求簡明不再贅述。混合行電路(Mix-column Circuitry)940用於執行如如圖3所示的混合行的步驟S330，並且其結構為所屬技術領域人員所公知，為求簡明不再贅述。加上回合密鑰電路(Add-round-key Circuitry)950用於執行如如圖3所示的加上回合密鑰的步驟S340，並且其結構為所屬技術領域人員所公知，為求簡明不再贅述。 Refer to the block diagram of the AES data processing circuit 810 shown in FIG. 9 . The data register 912 is used to store the intermediate or final result of the 16-byte group (that is, 128 bits) generated in the AES encryption process, and the parity register (Parity Registers) 914 is used to store the internal parity bit and the cross-body parity 9-bit corresponding to the intermediate or final result of the 16-byte group generated during the AES encryption process. A shift column circuit (Shift-row Circuitry) 930 is used to perform the step S320 of shift column as shown in Figure 3, and its The structure is well known to those skilled in the art, and will not be repeated for the sake of brevity. A Mix-column Circuitry (Mix-column Circuitry) 940 is used to execute the step S330 of mixing columns as shown in FIG. 3 , and its structure is well known to those skilled in the art, and will not be repeated for brevity. The Add-round-key Circuit (Add-round-key Circuit) 950 is used to execute the step S340 of adding the round key as shown in FIG. 3 , and its structure is well known to those skilled in the art, and will not be repeated for simplicity.

控制器870可在每個回合發出選擇訊號R_sel給多工器980和奇偶校驗預測電路(Parity Prediction Circuitry)970，用於控制流經指定電路的資料流。多工器980包含三個輸入端I0、I1及I2和一個輸出端O。輸入端I0耦接AES編碼器137的輸入腳位以接收16位元組的明文，輸入端I1耦接混合行電路940的輸出以接收16位元組的運算結果，輸入端I2耦接位移列電路930的輸出以接收16位元組的運算結果，輸出端O耦接加上回合密鑰電路950的輸入。詳細來說，在初始回合，控制器870可使用控制訊號R_sel控制多工器980將輸入端I0連接上輸出端O，使得從AES編碼器137的輸入腳位接收到的16位元組的明文S能夠饋入加上回合密鑰電路950。在中間回合(例如使用256位元密鑰的第1至第13回合)，控制器870可使用控制訊號R_sel控制多工器980將輸入端I1連接上輸出端O，使得混合行電路940的輸出能夠饋入加上回合密鑰電路950。在最終回合(例如使用256位元密鑰的第14回合)，控制器870可使用控制訊號R_sel控制多工器980將輸入端I2連接上輸出端O，使得位移列電路930的輸出能夠饋入加上回合密鑰電路950。此外，在初始回合，控制器870可使用控制訊號R_sel控制奇偶校驗預測電路970，讓從AES編碼器137的輸入腳位接收到的16位元組的明文S能夠饋入奇偶校驗預測電路970，用於產生相應於明文的體內奇偶校驗位元P和跨體奇偶校驗9位元Q。在中間和最終回合，控制器870可使用控制訊號R_sel控制奇偶校驗預測電路970，讓增強型替代位元組電路920的輸出能夠饋入奇偶校驗預測電路970， 用於產生相應於中間加密結果的體內奇偶校驗位元P和跨體奇偶校驗9位元Q。 The controller 870 can send a selection signal R_sel to the multiplexer 980 and the parity prediction circuit (Parity Prediction Circuit) 970 in each round for controlling the data flow through the designated circuit. The multiplexer 980 includes three input terminals I 0 , I 1 and I 2 and one output terminal O. The input terminal I0 is coupled to the input pin of the AES encoder 137 to receive the 16-byte plain text, the input terminal I1 is coupled to the output of the mixing row circuit 940 to receive the 16-byte operation result, the input terminal I2 is coupled to the output of the column shift circuit 930 to receive the 16-byte operation result, and the output terminal O is coupled to the input of the round key circuit 950. In detail, in the initial round, the controller 870 can use the control signal R_sel to control the multiplexer 980 to connect the input terminal I0 to the output terminal O, so that the 16-byte plaintext S received from the input pin of the AES encoder 137 can be fed into the adding round key circuit 950. In intermediate rounds (for example, the 1st to 13th rounds using a 256-bit key), the controller 870 can use the control signal R_sel to control the multiplexer 980 to connect the input terminal I1 to the output terminal O, so that the output of the mixing row circuit 940 can be fed to the adding round key circuit 950. In the final round (for example, the 14th round using a 256-bit key), the controller 870 can use the control signal R_sel to control the multiplexer 980 to connect the input terminal I2 to the output terminal O, so that the output of the column shift circuit 930 can be fed to the adding round key circuit 950. In addition, in the initial round, the controller 870 can use the control signal R_sel to control the parity prediction circuit 970, so that the 16-byte plaintext S received from the input pin of the AES encoder 137 can be fed into the parity prediction circuit 970 for generating the body parity P and the straddle parity 9 bits Q corresponding to the plaintext. In the intermediate and final rounds, the controller 870 can use the control signal R_sel to control the parity prediction circuit 970, so that the output of the enhanced surrogate byte circuit 920 can be fed into the parity prediction circuit 970 for generating the internal parity bit P and the straddle parity 9-bit Q corresponding to the intermediate encryption result.

參考圖10所示的奇偶校驗預測電路970的方塊圖。奇偶校驗預測電路970包含體內奇偶校驗位元預測電路(In-state Parity-bit Prediction Circuitry)1010和跨體奇偶校驗9位元預測電路(Across-state Parity-9-bit Prediction Circuitry)1030。體內奇偶校驗位元預測電路1010依據控制訊號R_sel選擇輸入明文S(相應於初始回合)或者中間加密結果S’(相應於中間或者最終回合)，並且根據明文S/中間加密結果S’和小鑰內奇偶校驗位元R產生體內奇偶校驗位元P。跨體奇偶校驗9位元預測電路1030依據控制訊號R_sel選擇輸入明文S(相應於初始回合)或者中間加密結果S’(相應於中間或者最終回合)，並且根據明文S/中間加密結果S’和跨小鑰奇偶校驗9位元V產生跨體奇偶校驗9位元Q。 Refer to the block diagram of the parity prediction circuit 970 shown in FIG. 10 . The parity prediction circuit 970 includes an in-state parity-bit prediction circuit (In-state Parity-bit Prediction Circuitry) 1010 and a cross-state parity-check 9-bit prediction circuit (Across-state Parity-9-bit Prediction Circuitry) 1030 . The internal parity bit prediction circuit 1010 selects the input plaintext S (corresponding to the initial round) or the intermediate encryption result S' (corresponding to the intermediate or final round) according to the control signal R_sel, and generates the internal parity bit P according to the plaintext S/intermediate encryption result S' and the parity bit R in the small key. The 9-bit straddle parity prediction circuit 1030 selects the input plaintext S (corresponding to the initial round) or the intermediate encryption result S' (corresponding to the intermediate or final round) according to the control signal R_sel, and generates the 9-bit straddle parity Q according to the plaintext S/intermediate encryption result S' and the 9-bit cross-key parity V.

參考圖11所示的體內奇偶校驗位元預測電路1010的方塊圖。控制器870可在每個回合發出選擇訊號R_sel給多工器1140和體內奇偶校驗位元產生電路1110，用於控制流經指定電路的資料流。多工器1140包含三個輸入端I0、I1及I2和一個輸出端O。輸入端I0耦接體內奇偶校驗位元產生電路1110的輸出以接收相應於明文的16位元的體內奇偶校驗碼，輸入端I1耦接混合行預測電路1130的輸出以接收16位元的運算結果，輸入端I2耦接位移列預測電路1120的輸出以接收16位元的運算結果，輸出端O耦接加上回合密鑰預測電路1150的輸入。詳細來說，在初始回合，控制器870可使用控制訊號R_sel驅動體內奇偶校驗位元產生電路1110從AES編碼器137的輸入腳位接收16位元組的明文，並且控制多工器1140將輸入端I0連接上輸出端O，使得從體內奇偶校驗位元產生電路1110的輸出所接收到的相應於明文S的16位元的體內奇偶校驗碼能夠饋入加上回合密鑰預測電路1150。在中間回合(例如使用256位元密鑰的第1至第13回合)，控制器 870可使用控制訊號R_sel驅動體內奇偶校驗位元產生電路1110從資料寄存器912獲取16位元組的中間加密結果S’，並且控制多工器1140將輸入端I1連接上輸出端O，使得從混合行預測電路1130的輸出所接收到的相應於中間加密結果S’的16位元的體內奇偶校驗碼能夠饋入加上回合密鑰預測電路1150。在最終回合(例如使用256位元密鑰的第14回合)，控制器870可使用控制訊號R_sel驅動體內奇偶校驗位元產生電路1110從資料寄存器912獲取16位元組的中間加密結果S’，並且控制多工器1140將輸入端I2連接上輸出端O，使得從位移列預測電路1120的輸出所接收到的相應於中間加密結果S’的16位元的體內奇偶校驗碼能夠饋入加上回合密鑰預測電路1150。 Refer to the block diagram of the internal parity bit prediction circuit 1010 shown in FIG. 11 . The controller 870 can send a selection signal R_sel to the multiplexer 1140 and the internal parity bit generating circuit 1110 in each round to control the data flow through the designated circuit. The multiplexer 1140 includes three input terminals I 0 , I 1 and I 2 and one output terminal O. The input terminal I0 is coupled to the output of the internal parity generation circuit 1110 to receive the 16-bit internal parity code corresponding to the plaintext, the input terminal I1 is coupled to the output of the hybrid row prediction circuit 1130 to receive the 16-bit operation result, the input terminal I2 is coupled to the output of the shift column prediction circuit 1120 to receive the 16-bit operation result, and the output terminal O is coupled to the input of the plus round key prediction circuit 1150. In detail, in the initial round, the controller 870 can use the control signal R_sel to drive the internal parity generating circuit 1110 to receive 16-byte plaintext from the input pin of the AES encoder 137, and control the multiplexer 1140 to connect the input terminal I0 to the output terminal O, so that the 16-bit internal parity code corresponding to the plaintext S received from the output of the internal parity generating circuit 1110 can be fed to the adding round key prediction circuit 1 150. In the middle round (for example, the 1st to the 13th round using a 256-bit key), the controller 870 can use the control signal R_sel to drive the internal parity bit generation circuit 1110 to obtain the 16-byte intermediate encrypted result S' from the data register 912, and control the multiplexer 1140 to connect the input terminal I1 to the output terminal O, so that the 16-bit internal parity code corresponding to the intermediate encrypted result S' received from the output of the mixed row prediction circuit 1130 Can be fed into plus round key prediction circuit 1150 . In the final round (for example, the 14th round using a 256-bit key), the controller 870 can use the control signal R_sel to drive the internal parity bit generating circuit 1110 to obtain the 16-byte intermediate encryption result S' from the data register 912, and control the multiplexer 1140 to connect the input terminal I2 to the output terminal O, so that the 16-bit internal parity code corresponding to the intermediate encryption result S' received from the output of the shift column prediction circuit 1120 can be fed into A round key prediction circuit 1150 is added.

參考圖12所示的體內奇偶校驗位元產生電路1110的方塊圖。控制器870可在每個回合發出選擇訊號R_sel給多工器1210，用於控制流經指定電路的資料流。多工器1210包含兩個輸入端I0及I1和一個輸出端O。詳細來說，在初始回合，控制器870可使用控制訊號R_sel控制多工器1210將輸入端I0連接上輸出端O，使得從AES編碼器137的輸入腳位所接收到的16位元組的明文S能夠饋入體內互斥或閘1230。在中間和最終回合(例如使用256位元密鑰的第1至第14回合)，控制器870可使用控制訊號R_sel控制多工器1210將輸入端I1連接上輸出端O，使得從資料寄存器912獲取16位元組的中間加密結果S’能夠饋入體內互斥或閘1230。體內互斥或閘1230包含多個互斥或閘，安排以依據接收到的16位元組的明文S或者中間加密結果S’，產生如圖6所示的體內奇偶校驗位元P0至P15。 Refer to the block diagram of the internal parity bit generation circuit 1110 shown in FIG. 12 . The controller 870 can send a selection signal R_sel to the multiplexer 1210 in each round to control the data flow through the designated circuit. The multiplexer 1210 includes two input terminals I 0 and I 1 and one output terminal O. Specifically, in the initial round, the controller 870 can use the control signal R_sel to control the multiplexer 1210 to connect the input terminal I0 to the output terminal O, so that the 16-byte plaintext S received from the input pin of the AES encoder 137 can be fed into the exclusive OR gate 1230 in the body. In the intermediate and final rounds (such as the 1st to 14th rounds using a 256-bit key), the controller 870 can use the control signal R_sel to control the multiplexer 1210 to connect the input terminal I1 to the output terminal O, so that the 16-byte intermediate encryption result S′ obtained from the data register 912 can be fed into the exclusive OR gate 1230 in the body. The internal exclusive OR gate 1230 comprises a plurality of exclusive OR gates arranged to generate internal parity bits P 0 to P 15 as shown in FIG. 6 according to the received 16-byte plaintext S or the intermediate encryption result S′.

參考回圖11，明文S或中間加密結果S’組織為4x4個體的陣列。位移列電路1160用於將下面三列的每一者向左循環位移指定步數。舉例來說，明文S表示如下：

Figure 111137122-A0305-02-0019-6
位移列電路1160用於將第一列向左循環位移一個體，將第二列向左循環位移兩個體，以及將第三列向左循環位移三個體。位移結果如下所示：
Figure 111137122-A0305-02-0019-7
 Referring back to Fig. 11, the plaintext S or the intermediate encryption result S' is organized as an array of 4x4 entities. The column shift circuit 1160 is used to cyclically shift each of the lower three columns to the left by a specified number of steps. For example, the plaintext S is expressed as follows:
Figure 111137122-A0305-02-0019-6
 The column shift circuit 1160 is used to cyclically shift the first column to the left by one bank, the second column to the left by two banks, and the third column to the left by three banks. The displacement results are as follows:
Figure 111137122-A0305-02-0019-7

相應於明文S或中間加密結果S’的體內奇偶校驗位元組織為4x4個位元的陣列。位移列預測電路1120用於將下面三列的每一者向左循環位移指定步數。舉例來說，相應於明文S的體內奇偶校驗位元表示如下：

Figure 111137122-A0305-02-0019-8
位移列預測電路1120用於將第一列向左循環位移一個位元，將第二列向左循環位移兩個位元，以及將第三列向左循環位移三個位元。位移結果如下所示：
Figure 111137122-A0305-02-0019-9
 The body parity bits corresponding to the plaintext S or the intermediate encrypted result S' are organized as an array of 4x4 bits. The shift column prediction circuit 1120 is used to cyclically shift each of the lower three columns to the left by a specified number of steps. For example, the body parity bits corresponding to the plaintext S are expressed as follows:
Figure 111137122-A0305-02-0019-8
 The column shift prediction circuit 1120 is used to cyclically shift the first column to the left by one bit, the second column to the left by two bits, and the third column to the left by three bits. The displacement results are as follows:
Figure 111137122-A0305-02-0019-9

混合行預測電路1130耦接位移列預測電路1120和位移列電路1160的輸出，使用所屬技術領域人員所習知的16個公式，每個公式加總位移後的明文S或中間加密結果S’的4x4位元組陣列以及位移後的體內奇偶校驗位元的4x4位元陣列中指定部分的值，產生混合後的體內奇偶校驗位元的矩陣中的指定的值。 The mixed row prediction circuit 1130 is coupled to the outputs of the shifted column prediction circuit 1120 and the shifted column circuit 1160, using 16 formulas known to those skilled in the art, and each formula sums up the shifted plaintext S or the intermediate encryption result S' 4x4 byte array and the value of a specified part in the shifted internal parity bit array 4x4 bit array to generate a specified value in the mixed internal parity bit matrix.

加上回合密鑰預測電路1150使用以下公式計算體內奇偶校驗位元的加密後結果：

Figure 111137122-A0305-02-0020-10
P(out) i代表輸出的第i個體的體內奇偶校驗位元，P(in) i代表輸入的第i個體的體內奇偶校驗位元，Ri代表第i個小鑰內奇偶校驗位元，i為從0至15的任意整數。需要注意的是，此時P(in) i和P(out) i所對應到的矩陣中的位置指的是混合行預測電路1130所輸出矩陣中的位置，不是對應到體內奇偶校驗位元產生電路1110所輸出矩陣中的位置。 Plus the round key prediction circuit 1150 uses the following formula to calculate the encrypted result of the parity bit in the body:
Figure 111137122-A0305-02-0020-10
 P (out) i represents the internal parity bit of the i-th individual output, P (in) i represents the internal parity bit of the i-th individual input, R i represents the internal parity bit of the i-th small key, and i is any integer from 0 to 15. It should be noted that at this time, the positions in the matrix corresponding to P (in) i and P (out) i refer to the positions in the matrix output by the hybrid row prediction circuit 1130, not the positions in the matrix output by the internal parity generation circuit 1110.

參考圖13所示的跨體奇偶校驗9位元預測電路1030的方塊圖。控制器870可在每個回合發出選擇訊號R_sel給跨體奇偶校驗位元組產生電路1310，用於控制跨體奇偶校驗位元組產生電路1310輸入的資料流。詳細來說，在初始回合，控制器870可使用控制訊號R_sel驅動跨體奇偶校驗位元組產生電路1310從AES編碼器137的輸入腳位接收16位元組的明文，使得跨體奇偶校驗位元組產生電路1310依據明文S的16位元組產生跨體奇偶校驗位元組。在中間回合(例如使用256位元密鑰的第1至第13回合)或者最終回合(例如使用256位元密鑰的第14回合)，控制器870可使用控制訊號R_sel驅動跨體奇偶校驗位元組產生電路1310從資料寄存器912獲取16位元組的中間加密結果S’，使得跨體奇偶校驗位元組產生電路1310依據中間加密結果S’的16位元組產生跨體奇偶校驗位元組。 Refer to the block diagram of the 9-bit prediction circuit 1030 for cross-body parity shown in FIG. 13 . The controller 870 can send a selection signal R_sel to the span parity generating circuit 1310 in each round for controlling the input data flow of the span parity generating circuit 1310 . In detail, in the initial round, the controller 870 can use the control signal R_sel to drive the straddle parity generating circuit 1310 to receive 16-byte plaintext from the input pin of the AES encoder 137, so that the straddle parity generating circuit 1310 generates straddling parity according to the 16-byte plaintext S. In the middle round (such as the 1st to 13th rounds using a 256-bit key) or the final round (such as the 14th round using a 256-bit key), the controller 870 can use the control signal R_sel to drive the straddle parity generation circuit 1310 to obtain the 16-byte intermediate encryption result S' from the data register 912, so that the straddle parity generation circuit 1310 generates a stride parity according to the 16-byte intermediate encryption result S' group.

跨體奇偶校驗位元組產生電路1310包含多個互斥或閘，在初始回合安排以依據接收到的16位元組的明文S，完成如圖6所示的跨體奇偶校驗位元組(不包含相應於體內奇偶校驗位元的第8位元)Q0,0..7至Q3,0..7。在中間回合或者最終回合安排以依據接收到的16位元組的中間加密結果S’，並且使用以下公式計算跨體奇偶校驗位元組(不包含相應於體內奇偶校驗位元的第8位元)Q0,0..7至Q3,0..7：Q 0,j =S' 0,j +S' 5,j +S' 10,j +S' 15,j ,for j=0~7 Q 1,j =S' 4,j +S' 9,j +S' 14,j +S' 3,j ,for j=0~7 Q 2,j =S' 8,j +S' 13,j +S' 2,j +S' 7,j ,for j=0~7 Q 3,j =S' 12,j +S' 1,j +S' 6,j +S' 11,j ,for j=0~7 Q0,j到Q3,j分別代表第0個到第3個跨體奇偶校驗位元組的第j個位元的值，S’0,j到S’15,j分別代表相應於第0個到第15個中間加密結果中的第j個位元的值。 The straddle parity check byte generation circuit 1310 includes a plurality of exclusive OR gates, arranged in the initial round to complete the straddle parity check byte set (excluding the 8th bit corresponding to the internal parity check bit) Q 0,0..7 to Q 3,0..7 as shown in FIG. 6 according to the received plaintext S of 16 bytes.在中間回合或者最終回合安排以依據接收到的16位元組的中間加密結果S'，並且使用以下公式計算跨體奇偶校驗位元組(不包含相應於體內奇偶校驗位元的第8位元)Q 0,0..7至Q 3,0..7 ： Q 0 ,j = S' 0 ,j + S' 5 ,j + S' 10 ,j + S' 15 ,j ,for j =0~7 Q 1 ,j = S' 4 ,j + S' 9 ,j + S' 14 ,j + S' 3 ,j ,for j =0~7 Q 2 ,j = S' 8 ,j + S' 13 ,j + S' 2 ,j + S' 7 ,j ,for j =0~7 Q 3 ,j = S' 12 ,j + S' 1 ,j + S' 6 ,j + S' 11 ,j ,for j =0~7 Q 0,j到Q 3,j分別代表第0個到第3個跨體奇偶校驗位元組的第j個位元的值，S'0,j到S' 15,j分別代表相應於第0個到第15個中間加密結果中的第j個位元的值。

跨小鑰奇偶校驗位元組分割電路(Across-subkey Parity-byte Split Circuitry)1330移除每個跨小鑰奇偶校驗9位元的第8個位元，成為跨小鑰奇偶校驗位元組，並且將跨小鑰奇偶校驗位元組饋入跨體奇偶校驗位元組預測電路1350。 The cross-subkey parity-byte split circuit (Across-subkey Parity-byte Split Circuitry) 1330 removes the 8th bit of each cross-subkey parity 9-bit to become an cross-subkey parity byte, and feeds the cross-subkey parity byte to the cross-subkey parity prediction circuit 1350.

跨體奇偶校驗位元組預測電路1350使用以下公式計算每個跨體奇偶校驗位元組的預測結果：

Figure 111137122-A0305-02-0021-62
,for j=0~7
Figure 111137122-A0305-02-0021-63
,for j=0~7
Figure 111137122-A0305-02-0021-64
,for j=0~7
Figure 111137122-A0305-02-0021-65
,for j=0~7 Q(out) 0,j代表輸出的第0個跨體奇偶校驗位元組的第j個位元的值，Q(out) 1,j代表輸出的第1個跨體奇偶校驗位元組的第j個位元的值，Q(out) 2,j代表輸出的第2個跨體奇偶校驗位元組的第j個位元的值，Q(out) 3,j代表輸出的第3個跨體奇偶校驗位元組的第j個位元的值，Q(in) i,j代表輸入的第i個跨體奇偶校驗位元組的第j個位元的值，Vi,j代表第i個跨小鑰奇偶校驗位元組中的第j個位元的值。 The span parity byte prediction circuit 1350 calculates the prediction result for each span parity byte using the following formula:
Figure 111137122-A0305-02-0021-62
, for j =0~7
Figure 111137122-A0305-02-0021-63
, for j =0~7
Figure 111137122-A0305-02-0021-64
, for j =0~7
Figure 111137122-A0305-02-0021-65
,for j =0~7 Q (out) 0,j代表輸出的第0個跨體奇偶校驗位元組的第j個位元的值，Q (out) 1,j代表輸出的第1個跨體奇偶校驗位元組的第j個位元的值，Q (out) 2,j代表輸出的第2個跨體奇偶校驗位元組的第j個位元的值，Q (out) 3,j代表輸出的第3個跨體奇偶校驗位元組的第j個位元的值，Q (in) i,j代表輸入的第i個跨體奇偶校驗位元組的第j個位元的值，V i,j代表第i個跨小鑰奇偶校驗位元組中的第j個位元的值。

跨體奇偶校驗1位元預測電路1370使用以下公式計算每個跨體奇偶校驗9位元的第8個位元的預測結果：

Figure 111137122-A0305-02-0021-12
Figure 111137122-A0305-02-0022-13
 Q0,8代表第0個行的跨體奇偶校驗9位元的第8個位元的值，Q1,8代表第1個行的跨體奇偶校驗9位元的第8個位元的值，Q2,8代表第2個行的跨體奇偶校驗9位元的第8個位元的值，Q3,8代表第3個行的跨體奇偶校驗9位元的第8個位元的值，Pi,8代表相應於第i個體的體內奇偶校驗位元(也就是第8個位元)的值。 The straddle parity 1 bit prediction circuit 1370 calculates the prediction result of the 8th bit of each span parity 9 bits using the following formula:
Figure 111137122-A0305-02-0021-12
Figure 111137122-A0305-02-0022-13
 Q 0,8 represents the value of the 8th bit of the 9-bit straddle parity of the 0th row, Q 1,8 represents the value of the 8th bit of the 9-bit straddle parity of the 1st row, Q 2,8 represents the value of the 8th bit of the 9-bit straddle parity of the 2nd row, Q 3,8 represents the value of the 8th bit of the 9-bit straddle parity of the third row, Pi ,8 represents the value corresponding to the i-th individual The value of the parity bit (that is, the 8th bit) in the body.

跨體奇偶校驗9位元合併電路(Across-state Parity-9-bit Concatenation Circuitry)1390將每個從跨體奇偶校驗位元組預測電路1350輸出的跨體奇偶校驗位元組，附加上從跨體奇偶校驗1位元預測電路1370輸出的相應第8個位元，成為完整的跨體奇偶校驗9位元。 The Across-state Parity-9-bit Concatenation Circuit (Across-state Parity-9-bit Concatenation Circuitry) 1390 adds the corresponding 8th bit output from the Across-state Parity-9-bit prediction circuit 1370 to each Across-state Parity-9-bit Concatenation output from the Across-state Parity prediction circuit 1350 to form a complete 9-bit Across-state Parity.

參考回圖9，奇偶校驗檢查電路(Parity Check Circuitry)960檢查上一回合的執行結果是否發生錯誤。奇偶校驗檢查電路960從資料寄存器912獲取中間加密結果S’，以及從奇偶校驗碼寄存器914獲取相應於中間加密結果S’的體內奇偶校驗位元P和跨體奇偶校驗9位元Q。奇偶校驗檢查電路960判斷中間的加密結果S’和體內奇偶校驗位元P之間是否匹配，如果不匹配，則發出線性錯誤訊號err_L=1給處理單元134，使得處理單元134執行任何因應AES加密錯誤的管理程序。奇偶校驗檢查電路960還判斷中間的加密結果S’、中間的體內奇偶校驗位元P和跨體奇偶校驗9位元Q之間是否匹配，如果不匹配，則發出線性錯誤訊號err_L=1給處理單元134。 Referring back to FIG. 9 , a parity check circuit (Parity Check Circuitry) 960 checks whether an error occurs in the execution result of the previous round. The parity check circuit 960 obtains the intermediate encrypted result S' from the data register 912, and obtains the internal parity bit P and the cross-body parity 9-bit Q corresponding to the intermediate encrypted result S' from the parity register 914. The parity check circuit 960 judges whether the intermediate encryption result S' matches the parity bit P in the body, and if not, sends a linear error signal err_L=1 to the processing unit 134, so that the processing unit 134 executes any management procedures in response to AES encryption errors. The parity checking circuit 960 also judges whether the middle encrypted result S', the middle body parity bit P, and the straddle parity 9-bit Q match, and if not, sends a linear error signal err_L=1 to the processing unit 134.

增強型替代位元組電路(Enhanced Substitute-byte Circuitry)920除了完成演算法中的替代位元組步驟S310之外，也要檢查此步驟的執行結果是否正確。參考圖14所示的增強型替代位元組電路920的方塊圖。跨體奇偶校驗位元組分割電路1410從資料寄存器912獲取128位元的中間結果S’，切分為16個位元組，並且將這16個位元組分別饋入增強型查表電路1430#0至1430#15。增強型查表電路1430#0至 1430#15中的每一個完成替代位元組步驟S310，並且判斷此操作是否正確。如果增強型查表電路1430#0至1430#15中的任何一個發現此操作錯誤，則輸出非線性錯誤訊號err_nl_i=1，i為0到15的正整數。只要任何一個增強型查表電路輸出非線性錯誤訊號err_nl_i，則增強型替代位元組電路920輸出非線性錯誤訊號err_nL=1給處理單元134，使得處理單元134執行任何因應AES加密錯誤的管理程序。跨體奇偶校驗位元組合併電路1450搜集增強型查表電路1430#0至1430#15的查表結果，並且將轉換後的128位元輸出到位移列電路930。 The Enhanced Substitute-byte Circuit (Enhanced Substitute-byte Circuit) 920, in addition to completing the byte-substitute step S310 in the algorithm, also checks whether the execution result of this step is correct. Refer to the block diagram of the enhanced replacement byte circuit 920 shown in FIG. 14 . The cross-body parity byte segmentation circuit 1410 obtains the 128-bit intermediate result S' from the data register 912, divides it into 16 byte groups, and feeds these 16 byte groups into the enhanced look-up table circuits 1430#0 to 1430#15 respectively. Enhanced look-up table circuit 1430#0 to Each of 1430#15 completes the byte replacement step S310, and judges whether the operation is correct. If any one of the enhanced look-up table circuits 1430#0 to 1430#15 finds the operation error, it outputs a non-linear error signal err_nl_i=1, where i is a positive integer from 0 to 15. As long as any enhanced look-up table circuit outputs the non-linear error signal err_nl_i, the enhanced surrogate byte circuit 920 outputs the non-linear error signal err_nL=1 to the processing unit 134, so that the processing unit 134 executes any management procedures in response to AES encryption errors. The cross-body parity bit combining circuit 1450 collects the table look-up results of the enhanced look-up table circuits 1430 #0 to 1430 #15, and outputs the converted 128 bits to the shift column circuit 930 .

參考圖15所示的增強型查表電路1430#i的方塊圖，i為0到15的正整數。搜索電路1510依據如上所述的查找表將輸入的1個位元組S’(in)轉換出1個位元組S’(out)。替代校驗電路(Substitution Check Circuitry)1530從搜索電路1510接收轉換後的1個位元組S’(out)，並且使用相應於查找表的公式判斷S’(in)轉換到S’(out)的過程中是否發生錯誤。如果發現錯誤，則替代校驗電路1530輸出非線性錯誤訊號err_nl_i=1。 Referring to the block diagram of the enhanced look-up table circuit 1430 #i shown in FIG. 15 , i is a positive integer ranging from 0 to 15. The search circuit 1510 converts the input byte S' (in) into a byte S' (out) according to the above-mentioned lookup table. The substitution check circuit (Substitution Check Circuitry) 1530 receives the converted 1-byte S' (out) from the search circuit 1510, and uses a formula corresponding to the lookup table to determine whether an error occurs during the conversion from S' (in) to S' (out) . If an error is found, the substitution check circuit 1530 outputs a non-linear error signal err_nl_i=1.

參考圖16所示的替代校驗電路1530的方塊圖。計算電路1610從搜索電路1510獲取轉換後的位元組S’(out) i，計算Affine(S’(out) i)-1，Affine()-1代表Affine轉換的反函數，並且將計算結果輸出到乘法器1630和比較器1650。乘法器1630將S’(in) i乘上Affine(S’(out) i)-1以產生S’(mul) i。比較器1650實施以下邏輯運算式來產生判斷結果：err_nl_i=0,if(S’(mul) i==1)&&(S’(in) i！=0)&&(Affine(S’(out) i)-1！=0) err_nl_i=0,if(S’(mul) i==0)&&(S’(in) i==0)&&(Affine(S’(out) i)-1==0) err_nl_i=1,otherwise當err_nl_i等於1時，代表發生非線性錯誤訊號。 Refer to the block diagram of the alternative verification circuit 1530 shown in FIG. 16 . The calculation circuit 1610 obtains the converted bytes S' (out) i from the search circuit 1510, calculates Affine(S' (out) i ) -1 , Affine () -1 represents the inverse function of Affine conversion, and outputs the calculation result to the multiplier 1630 and the comparator 1650. The multiplier 1630 multiplies S' (in) i by Affine(S' (out) i ) -1 to generate S' (mul) i . The comparator 1650 implements the following logical operation formula to generate a judgment result: err_nl_i=0, if(S' (mul) i ==1)&&(S' (in) i !=0)&&(Affine(S'( out ) i ) -1 !=0) err_nl_i=0,if(S' (mul) i ==0)&&(S' (in) i ==0)&&(Affine(S' (out) i ) -1 ==0) err_nl_i=1, otherwise when err_nl_i is equal to 1, it means a non-linear error signal occurs.

資料寄存器912、搜索電路1510、位移列電路930、混合行電路940、多工器980和加上回合密鑰電路950可視為AES編碼電路。奇偶校驗碼寄存器914、替代校驗電路1530、奇偶校驗檢查電路960和奇偶校驗預測電路970可視為錯誤檢查電路。 The data register 912, the search circuit 1510, the column shift circuit 930, the mixed row circuit 940, the multiplexer 980 and the adding round key circuit 950 can be regarded as an AES encoding circuit. The parity code register 914, the substitution check circuit 1530, the parity check circuit 960, and the parity prediction circuit 970 may be considered as error checking circuits.

參考圖17所示的AES密鑰排程電路830的方塊圖。密鑰分割電路1750將256位元的基礎密鑰K0切分為2個密鑰K#0和K#1，每個鑰字的長度為128位元，相同於一個體的長度。密鑰奇偶校驗碼產生電路(Key Parity Generation Circuitry)1742包含多個互斥或閘，安排以依據接收到的密鑰K#0，產生如圖7所示的小鑰內奇偶校驗位元R0至R15(可統稱為R#0)，以及跨小鑰奇偶校驗9位元V0至V3(可統稱為V#0)，並且將小鑰內奇偶校驗位元R#0和跨小鑰奇偶校驗9位元V#0儲存到寄存器1752。密鑰奇偶校驗碼產生電路1744包含多個互斥或閘，安排以依據接收到的密鑰K#1，產生如圖7所示的小鑰內奇偶校驗位元R16至R31(可統稱為R#1)，以及跨小鑰奇偶校驗9位元V4至V7(可統稱為V#1)，並且將小鑰內奇偶校驗位元R#1和跨小鑰奇偶校驗9位元V#1儲存到寄存器1754。寄存器1752和1754又可稱為目前周期奇偶校驗寄存器(Current Cycle Parity Registers)。 Refer to the block diagram of the AES key scheduling circuit 830 shown in FIG. 17 . The key division circuit 1750 divides the 256-bit basic key K 0 into two keys K#0 and K#1, and the length of each key word is 128 bits, which is the same as the length of an individual. The key parity generation circuit (Key Parity Generation Circuitry) 1742 includes a plurality of mutually exclusive OR gates, arranged to generate the parity bits R 0 to R 15 (collectively referred to as R# 0 ) in the small key as shown in FIG. Element V#0 is stored in register 1752. The key parity code generation circuit 1744 includes a plurality of exclusive OR gates, arranged to generate parity bits R16 to R31 (collectively referred to as R#1) within the small key and 9 bits V4 to V7 (collectively referred to as V#1) within the small key as shown in FIG. The registers 1752 and 1754 can also be called current cycle parity registers (Current Cycle Parity Registers).

密鑰奇偶校驗檢查電路(Key Parity Check Circuitry)1762和1764分別檢查密鑰K#0和K#1的產生是否發生錯誤。密鑰奇偶校驗檢查電路1762從密鑰分割電路1750獲取密鑰K#0，以及從寄存器1752獲取相應於密鑰K#0的小鑰內奇偶校驗位元R#0和跨小鑰奇偶校驗9位元V#0。密鑰奇偶校驗檢查電路1762判斷密鑰K#0和小鑰內奇偶校驗位元R#0之間是否匹配，如果不匹配，則發出密鑰錯誤訊號err_kc=1。密鑰奇偶校驗檢查電路1762還判斷密鑰K#0、小鑰內奇偶校驗位元R#0和跨小鑰奇偶校驗9位元V#0之間是否匹配，如果不匹配，則發出密鑰錯誤訊號err_kc=1。密鑰奇偶校驗檢查電路1764從密鑰分割電路1750獲取密鑰K#1，以及從寄存器1754獲取相應於密鑰K#1的小鑰內奇偶校驗位元R#1和跨小鑰奇偶校驗9位元V#1。密鑰奇偶校驗檢查電路1764判斷密鑰K#1和小鑰內奇偶校驗位元R#1之間是否匹配，如果不匹配，則發出密鑰錯誤訊號err_kd=1。密鑰奇偶校驗檢查電路1764還判斷密鑰K#1、小鑰內奇偶校驗位元R#1和跨小鑰 奇偶校驗9位元V#1之間是否匹配，如果不匹配，則發出密鑰錯誤訊號err_kd=1。密鑰錯誤訊號err_kc=1或者err_kd=1可觸發處理單元134執行任何因應AES密鑰錯誤的管理程序。 Key parity check circuits (Key Parity Check Circuitry) 1762 and 1764 respectively check whether an error occurs in the generation of keys K#0 and K#1. The key parity check circuit 1762 obtains the key K#0 from the key split circuit 1750 , and the intra-key parity bit R#0 and inter-key parity 9-bit V#0 corresponding to the key K#0 from the register 1752 . The key parity check circuit 1762 judges whether the key K#0 matches the parity bit R#0 in the small key, and if not, sends a key error signal err_kc=1. The key parity check circuit 1762 also judges whether the key K#0, the parity bit R#0 within the small key and the 9-bit parity V#0 across small keys match, and if not, it sends a key error signal err_kc=1. The key parity check circuit 1764 obtains the key K#1 from the key split circuit 1750 , and obtains the intra-keylet parity bit R#1 and cross-keylet parity 9-bit V#1 corresponding to the key K#1 from the register 1754 . The key parity check circuit 1764 judges whether the key K#1 matches the parity bit R#1 in the small key, and if not, sends a key error signal err_kd=1. The key parity check circuit 1764 also judges the key K#1, the parity bit R#1 within the small key and the cross small key Whether the 9-bit V#1 of the parity check matches, if not, a key error signal err_kd=1 is issued. The key error signal err_kc=1 or err_kd=1 can trigger the processing unit 134 to execute any management procedures in response to AES key errors.

密鑰分割電路1710將256位元的基礎密鑰K0切分為8個鑰字(Word)W0,0至W0,3和W1,0至W1,3，每個鑰字的長度為4個位元組，並且將8個鑰字儲存在寄存器1712。鑰字處理電路1720根據最後一個鑰字W1,3產生一個鑰字的中間運算結果，此運算結果被用來和第一個鑰字W0,0進行逐位元邏輯互斥或運算(Bitwise Logical XOR Operation)，以產生密鑰K#2的第一個鑰字W2,0。除了產生中間運算結果以外，鑰字處理電路1720還可以檢查中間運算結果的產生過程是否發生錯誤。如果是，則鑰字處理電路1720輸出密鑰錯誤訊號err_ka=1。密鑰錯誤訊號err_ka=1可觸發處理單元134執行任何因應AES密鑰錯誤的管理程序。 The key splitting circuit 1710 splits the 256-bit basic key K 0 into 8 words (Words) W 0,0 to W 0,3 and W 1,0 to W 1,3 , each word has a length of 4 bytes, and stores the 8 words in the register 1712 . The key processing circuit 1720 generates an intermediate operation result of a key according to the last key W 1,3 , and this operation result is used for bitwise logical XOR operation (Bitwise Logical XOR Operation) with the first key W 0,0 to generate the first key W 2,0 of the key K#2. In addition to generating the intermediate operation result, the key word processing circuit 1720 can also check whether an error occurs in the generation process of the intermediate operation result. If yes, the key word processing circuit 1720 outputs a key error signal err_ka=1. The key error signal err_ka=1 can trigger the processing unit 134 to execute any management procedures in response to AES key errors.

參考圖18所示的鑰字處理電路1720的方塊圖。鑰字分割電路1810從寄存器1712讀取最後一個鑰字W1,3，並且切分為4個小鑰，每個小鑰為1位元組。旋轉鑰字電路(Rotate-Word Circuitry)1820將這4個小鑰向左循環位移1個小鑰。替代鑰字電路(Substitute-Word Circuitry)1830根據查找表(又可稱為Rijndael S-box)將每個位移後小鑰的值替換為另一個值，其中的查找表使用以下公式建立：SBi=Affine((i)-1),for i=0~127 SBi代表i的輸出結果，Affine()代表Affine轉換函數，i為從0到127的正整數。替代鑰字電路1830除了完成每個輸入位元組的值的轉換之外，也要檢查轉換的執行結果是否正確。 Refer to the block diagram of the key word processing circuit 1720 shown in FIG. 18 . The key word segmentation circuit 1810 reads the last key word W 1,3 from the register 1712 and divides it into 4 small keys, each of which is 1 byte. Rotate-Word Circuit (Rotate-Word Circuitry) 1820 cyclically shifts the 4 small keys to the left by 1 small key. The Substitute-Word Circuit (Substitute-Word Circuitry) 1830 replaces the value of each shifted small key with another value according to the lookup table (also called Rijndael S-box), where the lookup table is established using the following formula: SB i =Affine((i) -1 ), for i=0~127 SB i represents the output result of i, Affine() represents the Affine conversion function, and i is a positive integer from 0 to 127. In addition to converting the value of each input byte, the substitution key circuit 1830 also checks whether the conversion result is correct.

參考圖19所示的替代鑰字電路1830的方塊圖。增強型查表電路1930#0至1930#3中的每一個完成相應位元組的值的替換操作，並且判斷此操作是否正確。如果增強型查表電路1930#0至1930#3中的任何一個發現此操作錯誤，則輸出查表錯誤訊號err_w_i=1，i為0到3 的正整數。只要任何一個增強型查表電路輸出查表錯誤訊號err_w_i，則替代鑰字電路1830輸出密鑰錯誤訊號err_ka=1給處理單元134，使得處理單元134執行任何因應AES加密錯誤的管理程序。由於增強型查表電路1930#0至1930#3中的任一個的電路結構、功能和操作細節類似於增強型查表電路1430#i，所以讀者可參考圖15和圖16的描述，為求簡明不再贅述。 Referring to the block diagram of the replacement key circuit 1830 shown in FIG. 19 . Each of the enhanced look-up table circuits 1930#0 to 1930#3 completes the replacement operation of the value of the corresponding byte group, and judges whether the operation is correct. If any one of the enhanced look-up table circuits 1930#0 to 1930#3 finds this operation error, then output the look-up table error signal err_w_i=1, i is 0 to 3 positive integer of . As long as any enhanced table look-up circuit outputs the table look-up error signal err_w_i, the substitute key circuit 1830 outputs the key error signal err_ka=1 to the processing unit 134, so that the processing unit 134 executes any management procedures for AES encryption errors. Since the circuit structure, function and operation details of any of the enhanced look-up table circuits 1930#0 to 1930#3 are similar to the enhanced look-up table circuit 1430#i, readers can refer to the descriptions in FIG. 15 and FIG. 16 , and will not repeat them for simplicity.

參考回圖18，捨去常數電路(Round-Constant Circuitry)1840將鑰字w#0(in)和常數C執行逐位元互斥或(XOR)操作。參考圖20所示的捨去常數電路1840的示意圖。XOR閘2010設置將鑰字w#0(in)的每個位元和常數C的相應位元執行邏輯互斥或操作。 Referring back to FIG. 18 , the round-constant circuit (Round-Constant Circuitry) 1840 performs a bitwise exclusive OR (XOR) operation on the key word w#0 (in) and the constant C. Refer to the schematic diagram of the truncation constant circuit 1840 shown in FIG. 20 . The XOR gate 2010 is set to perform a logical exclusive OR operation between each bit of the key word w#0 (in) and the corresponding bit of the constant C.

鑰字合併電路(Word Concatenation Circuitry)1850從捨去常數電路1840獲取4個小鑰w#0至w#3，合併小鑰w#0至w#3為完整的鑰字W(out)，並且輸出鑰字W(out)至互斥或閘1725。 The word concatenation circuit (Word Concatenation Circuitry) 1850 obtains 4 small keys w#0 to w#3 from the discarding constant circuit 1840, combines the small keys w#0 to w#3 into a complete key word W (out) , and outputs the key word W (out) to the exclusive OR gate 1725.

鑰字奇偶校驗產生電路(Word Parity Generation Circuitry)1860包含小鑰內奇偶校驗產生電路和跨小鑰奇偶校驗產生電路。小鑰內奇偶校驗產生電路包含多個互斥或閘，安排以依據從替代鑰字電路1830接收到的小鑰w#0至w#3，產生4個小鑰內奇偶校驗位元rt10至rt13。跨小鑰奇偶校驗產生電路包含多個互斥或閘，安排以依據從替代鑰字電路1830接收到的小鑰w#0至w#3，產生1個跨小鑰奇偶校驗位元組vt10..7。 The key word parity generation circuit (Word Parity Generation Circuitry) 1860 includes a small-key intra-key parity generation circuit and an inter-small-key parity generation circuit. The intra-key parity generation circuit includes a plurality of exclusive OR gates arranged to generate four intra-key parity bits rt1 0 to rt1 3 according to the keylets w#0 to w# 3 received from the substitute key circuit 1830 . The cross-key parity generation circuit includes a plurality of exclusive OR gates arranged to generate a cross-key parity byte vt1 0..7 according to the keys w#0 to w#3 received from the substitute key circuit 1830 .

鑰字奇偶校驗預測電路(Word Parity Prediction Circuitry)1870包含小鑰內奇偶校驗預測電路和跨小鑰奇偶校驗預測電路。小鑰內奇偶校驗預測電路使用以下公式預測小鑰內奇偶校驗位元rt10 (out)，並且輸出到鑰字跨奇偶校驗預測電路(Word Cross-parity Prediction Circuit)1880和密鑰奇偶校驗預測電路(Key Parity Prediction Circuit)1772：

Figure 111137122-A0305-02-0027-14
rt10 (out)代表計算後的第0個小鑰內奇偶校驗位元，rt10 (in)代表從鑰字奇偶校驗產生電路1860接收到的第0個小鑰內奇偶校驗位元，Ci代表捨去常數電路1840中使用的常數C中的第i個位元。此外，小鑰內奇偶校驗預測電路直接輸出從鑰字奇偶校驗產生電路1860接收到的小鑰內奇偶校驗位元rt11至rt13到鑰字跨奇偶校驗預測電路1880和密鑰奇偶校驗預測電路1772。跨小鑰奇偶校驗預測電路使用以下公式預測跨小鑰奇偶校驗位元組，並且輸出到鑰字奇偶校驗9位元合併電路(Word Parity 9-bit Concatenation Circuit)1890：vt10..7 (out)=vt10..7 (in)+C vt10..7 (out)代表輸出的跨小鑰奇偶校驗位元組，vt10..7 (in)代表從鑰字奇偶校驗產生電路1860接收到的跨小鑰奇偶校驗位元組，C代表捨去常數電路1840中使用的常數。 The key word parity prediction circuit (Word Parity Prediction Circuit) 1870 includes a parity prediction circuit within a small key and a parity prediction circuit across small keys. The parity prediction circuit in the small key uses the following formula to predict the parity bit rt1 0 (out) in the small key, and outputs to the Word Cross-parity Prediction Circuit (Word Cross-parity Prediction Circuit) 1880 and the Key Parity Prediction Circuit (Key Parity Prediction Circuit) 1772:
Figure 111137122-A0305-02-0027-14
 rt1 0 (out) represents the calculated parity bit in the 0th small key, rt1 0 (in) represents the parity bit in the 0th small key received from the key word parity generation circuit 1860, and C i represents the i-th bit in the constant C used in the constant circuit 1840. In addition, the intra-key parity prediction circuit directly outputs the intra-key parity bits rt1 1 to rt1 3 received from the key word parity generation circuit 1860 to the cross-key parity prediction circuit 1880 and the key parity prediction circuit 1772 . The cross-small-key parity prediction circuit uses the following formula to predict the cross-small-key parity bytes, and outputs them to the word parity 9-bit concatenation circuit (Word Parity 9-bit Concatenation Circuit) 1890: vt1 0..7 (out) =vt1 0..7 (in) +C vt1 0..7 (out) represents the output cross-small-key parity bytes, and vt1 0..7 (in) represents the slave key The word parity generating circuit 1860 receives the cross-key parity bytes, and C represents the constant used in the truncation constant circuit 1840 .

鑰字跨奇偶校驗預測電路1880使用以下公式計算跨小鑰奇偶校驗9位元vt的最後一個位元：

Figure 111137122-A0305-02-0027-15
vt18代表跨小鑰奇偶校驗9位元vt的最後一個位元，rt1i代表第i個小鑰內奇偶校驗位元。 The key word cross-parity prediction circuit 1880 uses the following formula to calculate the last bit of the cross-small key parity 9-bit vt:
Figure 111137122-A0305-02-0027-15
 vt1 8 represents the last bit of the 9-bit parity across the small key vt, and rt1 i represents the parity bit in the ith small key.

鑰字奇偶校驗9位元合併電路1890將鑰字奇偶校驗預測電路1870的計算結果vt10..7合併上鑰字跨奇偶校驗預測電路1880的計算結果vt18，成為跨鑰字奇偶校驗9位元vt10..8，並且輸出到密鑰奇偶校驗電路1772。 The key word parity 9-bit merging circuit 1890 combines the calculation result vt1 0..7 of the key word parity prediction circuit 1870 with the calculation result vt1 8 of the key word cross-parity prediction circuit 1880 to become a cross-key word parity 9-bit vt1 0..8 , and outputs it to the key parity circuit 1772.

參考回圖17，鑰字處理電路1730根據互斥或閘1727的運算結果(也就是鑰字W2,3)產生一個鑰字的中間運算結果，此運算結果被用來和鑰字W1,0進行逐位元邏輯互斥或運算，以產生密鑰K#3的第一個鑰字W3,0。除了產生中間運算結果以外，鑰字處理電路1730還可以檢查中間運算結果的產生過程是否發生錯誤。如果是，則鑰字處理 電路1730輸出密鑰錯誤訊號err_kb=1。密鑰錯誤訊號err_kb=1可觸發處理單元134執行任何因應AES密鑰錯誤的管理程序。 Referring back to FIG. 17 , the key word processing circuit 1730 generates an intermediate key word operation result according to the operation result of the exclusive OR gate 1727 (that is, the key word W 2,3 ), and this operation result is used to perform a bitwise logical exclusive OR operation with the key word W 1,0 to generate the first key word W 3,0 of the key K#3. In addition to generating the intermediate operation result, the key word processing circuit 1730 can also check whether an error occurs in the generation process of the intermediate operation result. If yes, the key word processing circuit 1730 outputs a key error signal err_kb=1. The key error signal err_kb=1 can trigger the processing unit 134 to execute any management procedures in response to AES key errors.

參考圖21所示的鑰字處理電路1730的方塊圖。鑰字分割電路2110從互斥或閘1727讀取運算結果(也就是鑰字W2,3)，並且切分為4個位元組。替代鑰字電路2130根據查找表將每個位元組的值替換為另一個值，其中的查找表使用以下公式建立：SBi=Affine((i)-1),for i=0~127 SBi代表i的輸出結果，Affine()代表Affine轉換函數，i為從0到127的正整數。替代鑰字電路2130除了完成每個輸入位元組的值的轉換之外，也要檢查轉換的執行結果是否正確。由於替代鑰字電路2130的電路結構、功能和運算結果類似於替代鑰字電路1830，所以讀者可參考圖15、圖16和圖19的描述，為求簡明不再贅述。只要替代鑰字電路2130中的任何一個增強型查表電路輸出查表錯誤訊號err_w_i，則替代鑰字電路2130輸出密鑰錯誤訊號err_kb=1給處理單元134，使得處理單元134執行任何因應AES加密錯誤的管理程序。 Refer to the block diagram of the key word processing circuit 1730 shown in FIG. 21 . The key word segmentation circuit 2110 reads the operation result (that is, the key word W 2,3 ) from the exclusive OR gate 1727 and divides it into 4 bytes. The replacement key word circuit 2130 replaces the value of each byte with another value according to the lookup table, wherein the lookup table is established using the following formula: SB i =Affine((i) -1 ), for i=0~127 SB i represents the output result of i, Affine() represents the Affine conversion function, and i is a positive integer from 0 to 127. In addition to converting the value of each input byte, the substitution key circuit 2130 also checks whether the conversion result is correct. Since the circuit structure, function and operation results of the substitution key circuit 2130 are similar to those of the substitution key circuit 1830, readers may refer to the descriptions in FIG. 15, FIG. 16 and FIG. 19, and will not repeat them for simplicity. As long as any enhanced table look-up circuit in the replacement key circuit 2130 outputs the table look-up error signal err_w_i, the replacement key circuit 2130 outputs the key error signal err_kb=1 to the processing unit 134, so that the processing unit 134 executes any management procedures in response to AES encryption errors.

鑰字合併電路2150從替代鑰字電路2130獲取替代後的4個小鑰w#0至w#3，合併小鑰w#0至w#3為完整的鑰字W(out)，並且輸出鑰字W(out)至互斥或閘1729。 The key combination circuit 2150 obtains the substituted four small keys w#0 to w#3 from the replacement key circuit 2130, merges the small keys w#0 to w#3 into a complete key W (out) , and outputs the key W (out) to the exclusive OR gate 1729.

鑰字奇偶校驗產生電路2160包含小鑰內奇偶校驗產生電路和跨小鑰奇偶校驗產生電路。小鑰內奇偶校驗產生電路包含多個互斥或閘，安排以依據從替代鑰字電路2130接收到的小鑰w#0至w#3，產生相應於小鑰w#0至w#3的四個小鑰內奇偶校驗位元rt20至rt23。這四個小鑰內奇偶校驗位元rt20至rt23輸出至鑰字跨奇偶校驗預測電路2180和密鑰奇偶校驗預測電路1774。跨小鑰奇偶校驗產生電路包含多個互斥或閘，安排以依據從替代鑰字電路2130接收到的小鑰w#0至w#3，產生相應於小鑰w#0至w#3的一個跨小鑰奇偶校驗位元組vt20..7(也就是缺少跨小鑰奇偶校驗9位元vt2中的第8個位元)。這個跨小鑰奇 偶校驗位元組vt20..7輸出至鑰字奇偶校驗9位元合併電路2190。 The key word parity generation circuit 2160 includes an intra-key parity generation circuit and an inter-small-key parity generation circuit. The intra-key parity generating circuit includes a plurality of exclusive OR gates arranged to generate four intra-key parity bits rt2 0 to rt2 3 corresponding to keylets w#0 to w#3 according to keylets w # 0 to w# 3 received from the substitute key circuit 2130 . The parity bits rt2 0 to rt2 3 in the four small keys are output to the key cross parity prediction circuit 2180 and the key parity prediction circuit 1774 . The cross-keylet parity generation circuit includes a plurality of exclusive OR gates arranged to generate a cross-keylet parity bit group vt2 0..7 corresponding to keylets w#0 to w#3 (that is, lacking the 8th bit in the 9-bit cross-keylet parity vt2) according to the keylets w#0 to w#3 received from the substitute key word circuit 2130. This cross-key parity byte vt2 0..7 is output to the key word parity 9-bit merge circuit 2190 .

鑰字跨奇偶校驗預測電路2180使用以下公式計算相應於小鑰w#0至w#3的跨小鑰奇偶校驗9位元的最後一個位元：

Figure 111137122-A0305-02-0029-16
vt28代表相應於小鑰w#0至w#3的一個跨小鑰奇偶校驗9位元的最後一個位元，rt2i代表相應於小鑰w#i的小鑰內奇偶校驗位元。 The key word cross-parity prediction circuit 2180 uses the following formula to calculate the last bit of the 9 bits of parity across small keys corresponding to small keys w#0 to w#3:
Figure 111137122-A0305-02-0029-16
 vt2 8 represents the last bit of a 9-bit cross-key parity corresponding to key w#0 to w#3, and rt2 i represents the intra-key parity bit corresponding to key w#i.

鑰字奇偶校驗9位元合併電路2190將鑰字奇偶校驗產生電路2160的計算結果vt20..7合併上鑰字跨奇偶校驗預測電路2180的計算結果vt28，作為跨鑰字奇偶校驗9位元vt20..8，並且輸出到密鑰奇偶校驗預測電路1774。 The key word parity 9-bit merging circuit 2190 combines the calculation result vt2 0..7 of the key word parity generation circuit 2160 with the calculation result vt2 8 of the key word cross-parity prediction circuit 2180 as the cross-key word parity 9-bit vt2 0..8 , and outputs it to the key parity prediction circuit 1774.

參考回圖17，密鑰奇偶校驗預測電路(Key Parity Prediction Circuitry)1772包含多個加法器，安排以使用以下公式計算出相應於密鑰K#2的小鑰內奇偶校驗位元R#20至R#215：R#2i=rt1i+R#0i,for i=0~3 R#2i=R#2i-4+R#0i,for i=4~15 R#2i代表相應於密鑰K#2的第i個小鑰內奇偶校驗位元，rt1i代表從鑰字處理電路1720獲取的第i個小鑰內奇偶校驗位元，R#0i代表從寄存器1752讀取的相應於密鑰K#0的第i個小鑰內奇偶校驗位元，R#2i-4代表從寄存器1752讀取的相應於密鑰K#2的第i-4個小鑰內奇偶校驗位元。密鑰奇偶校驗預測電路1772另包含多個加法器，安排以使用以下公式計算出相應於密鑰K#2的跨小鑰奇偶校驗9位元V#20至V#23：V#2i=vt1+V#0i,for i=0 V#2i=V#2i-1+V#0i,for i=1~3 V#2i代表相應於密鑰K#2的第i個跨小鑰奇偶校驗9位元，vt1代表從鑰字處理電路1720獲取的跨小鑰奇偶校驗9位元，V#0i代表從寄存器1752讀取的相應於密鑰K#0的第i個跨小鑰奇偶校驗9位元，V#2i-1代表從寄存器1752讀取的相應於密鑰K#2的第i-1個跨小鑰奇偶校驗9 位元。密鑰奇偶校驗預測電路1772將預測結果R#2、V#2儲存到寄存器1782，用於在下一個迭代中讓密鑰奇偶校驗檢查電路1762進行檢查。 參考回圖17，密鑰奇偶校驗預測電路(Key Parity Prediction Circuitry)1772包含多個加法器，安排以使用以下公式計算出相應於密鑰K#2的小鑰內奇偶校驗位元R#2 0至R#2 15 ：R#2 i =rt1 i +R#0 i ,for i=0~3 R#2 i =R#2 i-4 +R#0 i ,for i=4~15 R#2 i代表相應於密鑰K#2的第i個小鑰內奇偶校驗位元，rt1 i代表從鑰字處理電路1720獲取的第i個小鑰內奇偶校驗位元，R#0 i代表從寄存器1752讀取的相應於密鑰K#0的第i個小鑰內奇偶校驗位元，R#2 i-4代表從寄存器1752讀取的相應於密鑰K#2的第i-4個小鑰內奇偶校驗位元。密鑰奇偶校驗預測電路1772另包含多個加法器，安排以使用以下公式計算出相應於密鑰K#2的跨小鑰奇偶校驗9位元V#2 0至V#2 3 ：V#2 i =vt1+V#0 i ,for i=0 V#2 i =V#2 i-1 +V#0 i ,for i=1~3 V#2 i代表相應於密鑰K#2的第i個跨小鑰奇偶校驗9位元，vt1代表從鑰字處理電路1720獲取的跨小鑰奇偶校驗9位元，V#0 i代表從寄存器1752讀取的相應於密鑰K#0的第i個跨小鑰奇偶校驗9位元，V#2 i-1代表從寄存器1752讀取的相應於密鑰K#2的第i-1個跨小鑰奇偶校驗9 位元。 The key parity prediction circuit 1772 stores the prediction results R#2, V#2 into the register 1782 for checking by the key parity check circuit 1762 in the next iteration.

密鑰奇偶校驗預測電路1774包含多個加法器，安排以使用以下公式計算出相應於密鑰K#3的小鑰內奇偶校驗位元R#30至R#315：R#3i=rt2i+R#1i,for i=0~3 R#3i=R#3i-4+R#1i,for i=4~15 R#3i代表相應於密鑰K#3的第i個小鑰內奇偶校驗位元，rt2i代表從鑰字處理電路1730獲取的第i個小鑰內奇偶校驗位元，R#1i代表從寄存器1754讀取的相應於密鑰K#1的第i個小鑰內奇偶校驗位元，R#3i-4代表從寄存器1754讀取的相應於密鑰K#3的第i-4個小鑰內奇偶校驗位元。密鑰奇偶校驗預測電路1774另包含多個加法器，安排以使用以下公式計算出相應於密鑰K#3的跨小鑰奇偶校驗9位元V#30至V#33：V#3i=vt2+V#1i,for i=0 V#3i=V#3i-1+V#1i,for i=1~3 V#3i代表相應於密鑰K#3的第i個跨小鑰奇偶校驗9位元，vt2代表從鑰字處理電路1730獲取的跨小鑰奇偶校驗9位元，V#1i代表從寄存器1754讀取的相應於密鑰K#1的第i個跨小鑰奇偶校驗9位元，V#3i-1代表從寄存器1754讀取的相應於密鑰K#3的第i-1個跨小鑰奇偶校驗9位元。密鑰奇偶校驗預測電路1774將預測結果R#3、V#3儲存到寄存器1784，用於在下一個迭代中讓密鑰奇偶校驗檢查電路1764進行檢查。 密鑰奇偶校驗預測電路1774包含多個加法器，安排以使用以下公式計算出相應於密鑰K#3的小鑰內奇偶校驗位元R#3 0至R#3 15 ：R#3 i =rt2 i +R#1 i ,for i=0~3 R#3 i =R#3 i-4 +R#1 i ,for i=4~15 R#3 i代表相應於密鑰K#3的第i個小鑰內奇偶校驗位元，rt2 i代表從鑰字處理電路1730獲取的第i個小鑰內奇偶校驗位元，R#1 i代表從寄存器1754讀取的相應於密鑰K#1的第i個小鑰內奇偶校驗位元，R#3 i-4代表從寄存器1754讀取的相應於密鑰K#3的第i-4個小鑰內奇偶校驗位元。密鑰奇偶校驗預測電路1774另包含多個加法器，安排以使用以下公式計算出相應於密鑰K#3的跨小鑰奇偶校驗9位元V#3 0至V#3 3 ：V#3 i =vt2+V#1 i ,for i=0 V#3 i =V#3 i-1 +V#1 i ,for i=1~3 V#3 i代表相應於密鑰K#3的第i個跨小鑰奇偶校驗9位元，vt2代表從鑰字處理電路1730獲取的跨小鑰奇偶校驗9位元，V#1 i代表從寄存器1754讀取的相應於密鑰K#1的第i個跨小鑰奇偶校驗9位元，V#3 i-1代表從寄存器1754讀取的相應於密鑰K#3的第i-1個跨小鑰奇偶校驗9位元。 The key parity prediction circuit 1774 stores the prediction results R#3, V#3 into the register 1784 for checking by the key parity check circuit 1764 in the next iteration.

雖然圖17只描述了密鑰K#2和K#3的產生及其產生過程的錯誤偵測，但是因為密鑰K#2和K#3就是產生密鑰K#4和K#5時所使用的密鑰(也就是下一個迭代所使用的密鑰)，依此類推，所屬技術領域人員可參考以上的技術內容推導出其他回合密鑰的產生及其產生過程的錯誤偵測。 Although FIG. 17 only describes the generation of keys K#2 and K#3 and the error detection of the generation process, because the keys K#2 and K#3 are the keys used when generating the keys K#4 and K#5 (that is, the keys used in the next iteration), and so on, those skilled in the art can refer to the above technical content to deduce the generation of other round keys and the error detection of the generation process.

在一些實施例中，寄存器1712和1714可為實體上不同的寄存器。在另一些實施例中，寄存器1712和1714可指相同寄存器，但在指定的時間順序上依序儲存基礎密鑰和後續產生的回合密鑰。 In some embodiments, registers 1712 and 1714 may be physically distinct registers. In other embodiments, the registers 1712 and 1714 may refer to the same register, but store the base key and the subsequently generated round key sequentially in a specified time sequence.

在一些實施例中，寄存器1752和1782可為實體上不同的寄存器。在另一些實施例中，寄存器1752和1782可指相同寄存器，但在指定的時間順序上依序儲存第一個小鑰內奇偶校驗位元R#0和跨小鑰奇偶校驗9位元V#0，以及後續產生的小鑰內奇偶校驗位元和跨小鑰奇偶校驗9位元。 In some embodiments, registers 1752 and 1782 may be physically distinct registers. In some other embodiments, the registers 1752 and 1782 may refer to the same register, but store the first intra-key parity bit R#0 and cross-key parity 9-bit V#0 sequentially in the specified time sequence, and the subsequent generated intra-key parity bits and cross-key parity 9-bits.

在一些實施例中，寄存器1754和1784可為實體上不同的寄存器。在另一些實施例中，寄存器1754和1784可指相同寄存器，但在指定的時間順序上依序儲存第二個小鑰內奇偶校驗位元R#1和跨小鑰奇偶校驗9位元V#1，以及後續產生的小鑰內奇偶校驗位元和跨小鑰奇偶校驗9位元。 In some embodiments, registers 1754 and 1784 may be physically distinct registers. In some other embodiments, the registers 1754 and 1784 may refer to the same register, but store the second intra-key parity bit R#1 and cross-key parity 9-bit V#1 sequentially in the specified time sequence, and the subsequent generated intra-key parity bits and cross-key parity 9-bits.

雖然圖1至圖2、圖5、圖8至圖21中包含了以上描述的元件，但不排除在不違反發明的精神下，使用更多其他的附加元件，以達成更佳的技術效果。 Although the elements described above are included in FIGS. 1 to 2 , 5 , and 8 to 21 , it is not excluded to use more other additional elements to achieve better technical effects without violating the spirit of the invention.

雖然本發明使用以上實施例進行說明，但需要注意的是，這些描述並非用以限縮本發明。相反地，此發明涵蓋了熟習此技藝人士顯而易見的修改與相似設置。所以，申請權利要求範圍須以最寬廣的方式解釋來包含所有顯而易見的修改與相似設置。 Although the present invention is described using the above examples, it should be noted that these descriptions are not intended to limit the present invention. On the contrary, the invention covers modifications and similar arrangements obvious to those skilled in the art. Therefore, the claims of the application must be interpreted in the broadest manner to include all obvious modifications and similar arrangements.

810:AES資料處理電路 810: AES data processing circuit

813:編碼電路 813: encoding circuit

815:編碼錯誤檢查電路 815: Coding error checking circuit

830:AES密鑰排程電路 830: AES key scheduling circuit

833:密鑰產生電路 833: key generation circuit

835:密鑰錯誤檢查電路 835: key error check circuit

850:或閘 850: OR gate

870:控制器 870:Controller

Claims (12)

一種資料加密的錯誤偵測裝置，包含：編碼電路，設置以實現加密演算法，其中所述加密演算法包含多個回合，並且在每個所述回合中使用回合密鑰對明文或者中間加密結果進行編碼；以及錯誤檢查電路，耦接所述編碼電路，設置以計算出相應於所述明文或者中間加密結果的冗餘資料；並且在加密過程中的指定中間點發現所述中間加密結果和所述冗餘資料不匹配時，發出錯誤訊號給處理單元，其中，所述加密演算法包含初始回合、多個中間回合和最後回合；所述初始回合執行加上回合密鑰操作；每個所述中間回合依序執行替代位元組操作、位移列操作、混合行操作和所述加上回合密鑰操作；以及所述最後回合執行所述替代位元組操作、所述位移列操作和所述加上回合密鑰操作。 An error detection device for data encryption, comprising: an encoding circuit configured to implement an encryption algorithm, wherein the encryption algorithm includes multiple rounds, and uses a round key to encode plaintext or intermediate encryption results in each of the rounds; and an error checking circuit, coupled to the encoding circuit, configured to calculate redundant data corresponding to the plaintext or intermediate encryption results; and sends an error signal to a processing unit when the intermediate encryption results and the redundant data are found at a specified intermediate point in the encryption process. The last round; the initial round performs adding a round key operation; each of the intermediate rounds sequentially executes a replacement byte operation, a shift column operation, a mixed row operation, and the addition round key operation; and the last round executes the replacement byte operation, the shift column operation, and the addition round key operation. 如請求項1所述的資料加密的錯誤偵測裝置，其中，所述回合密鑰根據256位元的基礎密鑰產生。 The error detection device for data encryption according to claim 1, wherein the round key is generated according to a 256-bit basic key. 如請求項1所述的資料加密的錯誤偵測裝置，其中，所述明文切分為16個體且組織為4x4位元組陣列，每個所述體為1位元組；所述冗餘資料包含相應於每個所述體的體內奇偶校驗位元，和相應於每個行的跨體奇偶校驗9位元；其中，所述錯誤檢查電路在所述加密過程中的指定中間點發現任何所述體的中間加密結果不匹配於相應體內奇偶校驗位元時，或者發現相應於任何行的中間加密結果加上4個相應體內奇偶校驗位元，不匹配於相應跨體奇偶校驗9位元時，發出所述錯誤 訊號給所述處理單元。 The error detection device for data encryption according to claim 1, wherein the plaintext is divided into 16 individuals and organized as a 4x4 byte array, each of which is 1 byte; the redundant data includes an internal parity bit corresponding to each of the bodies, and a cross-body parity 9 bits corresponding to each row; wherein, when the error checking circuit finds that any intermediate encryption result of the body does not match the corresponding internal parity bit at a specified intermediate point in the encryption process, or finds that the intermediate encryption result corresponding to any row is added The error is issued when the 4 corresponding body parity bits do not match the corresponding 9 bits of interbody parity signal to the processing unit. 如請求項3所述的資料加密的錯誤偵測裝置，其中，每個所述體和所述相應體內奇偶校驗位元之間的匹配可使用以下公式表示：
Figure 111137122-A0305-02-0037-17
 Pi代表第i個體的體內奇偶校驗位元的值，Si,j代表第i個體中的第j個位元的值，i為從0到15的正整數，其中，每個所述行的所述體及其體內奇偶校驗位元和所述相應跨體奇偶校驗9位元之間的匹配可使用以下公式表示：
Figure 111137122-A0305-02-0037-19
,for j=0~8
Figure 111137122-A0305-02-0037-20
,for j=0~8
Figure 111137122-A0305-02-0037-21
,for j=0~8
Figure 111137122-A0305-02-0037-22
,for j=0~8 Q0,j代表第0個跨體奇偶校驗9位元的第j個位元的值，Q1,j代表第1個跨體奇偶校驗9位元的第j個位元的值，Q2,j代表第2個跨體奇偶校驗9位元的第j個位元的值，Q3,j代表第3個跨體奇偶校驗9位元的第j個位元的值，Si,j代表第i個體中的第j個位元的值，j為從0至8的任意整數。 The error detection device for data encryption according to claim 3, wherein the matching between each body and the parity bits in the corresponding body can be represented by the following formula:
Figure 111137122-A0305-02-0037-17
 P i represents the value of the i-th individual's internal parity bit, S i,j represents the value of the j-th bit in the i-th individual, and i is a positive integer from 0 to 15, wherein the matching between the body of each row and its internal parity bit and the corresponding 9-bit straddle parity can be expressed by the following formula:
Figure 111137122-A0305-02-0037-19
, for j =0~8
Figure 111137122-A0305-02-0037-20
, for j =0~8
Figure 111137122-A0305-02-0037-21
, for j =0~8
Figure 111137122-A0305-02-0037-22
,for j =0~8 Q 0,j represents the value of the jth bit of the 0th straddle parity check 9-bit, Q 1,j represents the value of the j-th bit of the 1st spanning parity 9-bit, Q 2,j represents the value of the j-th bit of the second spanning parity 9-bit, Q 3,j represents the value of the j-th bit of the 3rd spanning parity 9-bit, S i,j represents the value of the i-th individual The value of the jth bit of , where j is any integer from 0 to 8. 如請求項3所述的資料加密的錯誤偵測裝置，其中，所述加密演算法包含多個回合，以及所述錯誤檢查電路，包含：奇偶校驗預測電路，設置以在一個回合中，依據所述明文或者所述中間加密結果的所述16個體，以及相應回合密鑰的小鑰內奇偶校驗位元和跨小鑰奇偶校驗位元組預測相應於每個所述體的所述體內奇偶校驗位元，和相應於每個所述行的所述跨體奇偶校 驗9位元；以及奇偶校驗檢查電路，耦接所述奇偶校驗預測電路，設置以發現所述回合中產生的任何所述體的所述中間加密結果不匹配於所述相應體內奇偶校驗位元時，或者發現相應於任何行的所述中間加密結果加上所述4個相應體內奇偶校驗位元，不匹配於所述相應跨體奇偶校驗9位元時，發出所述錯誤訊號給所述處理單元。 The error detection device for data encryption according to claim 3, wherein the encryption algorithm includes multiple rounds, and the error checking circuit includes: a parity prediction circuit configured to predict the internal parity bits corresponding to each of the bodies and the cross-body parity corresponding to each of the rows according to the 16 individuals of the plaintext or the intermediate encryption results in one round, and the parity bits in the small key and the parity bits across the small keys of the corresponding round key and a parity check circuit, coupled to the parity prediction circuit, configured to send the error signal to the processing unit when it is found that the intermediate encrypted result of any of the bodies generated in the round does not match the corresponding internal parity bits, or that the intermediate encrypted result plus the four corresponding internal parity bits corresponding to any row does not match the corresponding cross-body parity 9 bits. 如請求項5所述的資料加密的錯誤偵測裝置，其中，所述奇偶校驗預測電路，包含：體內奇偶校驗位元預測電路，設置以依據所述明文或者所述中間加密結果的所述16個體，以及所述相應回合密鑰的所述小鑰內奇偶校驗位元預測相應於每個所述體的所述體內奇偶校驗位元；以及跨體奇偶校驗9位元預測電路，設置以依據所述明文或者所述中間加密結果的所述16個體，以及所述相應回合密鑰的所述跨小鑰奇偶校驗位元組預測相應於每個所述行的所述跨體奇偶校驗9位元。 The error detection device for data encryption according to claim 5, wherein the parity prediction circuit includes: an in-body parity prediction circuit configured to predict the internal parity bits corresponding to each of the bodies based on the 16 individuals of the plaintext or the intermediate encryption result, and the parity bits in the corresponding round key; A parity byte prediction corresponds to the span parity 9 bits for each of the rows. 如請求項6所述的資料加密的錯誤偵測裝置，其中，所述體內奇偶校驗位元預測電路，包含：體內奇偶校驗位元產生電路，設置以依據所述明文或者所述中間加密結果的所述16個體產生16個第一中間體內奇偶校驗位元，所述16個第一中間體內奇偶校驗位元組織成第一4x4位元陣列；位移列預測電路，耦接所述體內奇偶校驗位元產生電路，設置以將所述第一4x4位元陣列的第二列向左循環位移一個位元，將所述第一4x4位元陣列的第三列向左循環位移二個位元，將所述第一4x4位元陣列的第四列向左循環位移三個位元； 位移列電路，設置以將所述中間加密結果的所述4x4位元組陣列的第二列向左循環位移一個位元組，將所述4x4位元組陣列的第三列向左循環位移二個位元組，將所述4x4位元組陣列的第四列向左循環位移三個位元組；混合行預測電路，耦接所述位移列預測電路和所述位移列電路，設置以使用16個公式產生16個第二中間體內奇偶校驗位元，所述16個第二中間體內奇偶校驗位元組織成第二4x4位元陣列，每個所述公式加總位移後的4x4位元組陣列和位移後的4x4位元陣列中指定部分的值；多工器，包含第一輸入端、第二輸入端、第三輸入端和輸出端，所述第一輸入端耦接所述體內奇偶校驗位元產生電路，所述第二輸入端耦接所述混合行預測電路，所述第三輸入端耦接所述位移列預測電路，設置以當初始回合時將所述第一輸入端連接所述輸出端，當中間回合時將所述第二輸入端連接所述輸出端，當最終回合時將所述第三輸入端連接所述輸出端；以及加上回合密鑰預測電路，耦接所述多工器的輸出端，設置以使用以下公式計算相應於每個所述體的所述體內奇偶校驗位元：P(out) i=P(in) i+Ri P(out) i代表輸出的第i個體的體內奇偶校驗位元，P(in) i代表從所述多工器輸入的第i個體的體內奇偶校驗位元，Ri代表第i個小鑰內奇偶校驗位元，i為從0至15的任意整數。 The error detection device for data encryption according to claim 6, wherein the internal parity bit prediction circuit includes: an internal parity bit generation circuit configured to generate 16 first intermediate internal parity bits according to the plaintext or the 16 entities of the intermediate encryption result, and the 16 first intermediate internal parity bits are organized into a first 4x4 bit array; a displacement column prediction circuit is coupled to the internal parity bit generation circuit and configured to cycle the second column of the first 4x4 bit array to the left Shifting one bit, cyclically shifting the third column of the first 4x4 bit array to the left by two bits, and shifting the fourth column of the first 4x4 bit array to the left by three bits; a column shift circuit configured to cyclically shift the second column of the 4x4 byte array of the intermediate encryption result to the left by one byte, cyclically shift the third column of the 4x4 byte array to the left by two bytes, and cyclically shift the fourth column of the 4x4 byte array to the left by three bytes; a hybrid row prediction circuit coupled to the shifted column prediction circuit and the shifted column circuit, configured to use 16 formulas to generate 16 second internal parity bits, and the 16 second intermediate internal parity bits The even parity bit is organized into a second 4x4 bit array, and each of the formulas adds up the shifted 4x4 bit array and the value of a specified part of the shifted 4x4 bit array; a multiplexer includes a first input end, a second input end, a third input end and an output end, the first input end is coupled to the parity bit generation circuit in the body, the second input end is coupled to the mixed row prediction circuit, and the third input end is coupled to the shifted column prediction circuit. Connecting the second input terminal to the output terminal during the round, connecting the third input terminal to the output terminal during the final round; and adding a round key prediction circuit, coupled to the output terminal of the multiplexer, configured to calculate the internal parity bits corresponding to each of the banks using the following formula: P(out) i=P(in) i+Ri P(out) iRepresents the body parity bits of the output i-th individual, P(in) iRepresents the internal parity bit of the i-th individual input from the multiplexer, RiRepresents the parity bit in the i-th small key, where i is any integer from 0 to 15. 如請求項6所述的資料加密的錯誤偵測裝置，其中，所述跨體奇偶校驗9位元預測電路，包含：跨體奇偶校驗位元組產生電路，設置以在初始回合依據所述明文的4個行的所述體產生4個行的第一中間跨體奇偶校驗位元組，以及在中間或者最終回合使用以下公式計算所述4個行的第二中 間跨體奇偶校驗位元組：Q 0,j =S' 0,j +S' 5,j +S' 10,j +S' 15,j ,for j=0~7 Q 1,j =S' 4,j +S' 9,j +S' 14,j +S' 3,j ,for j=0~7 Q 2,j =S' 8,j +S' 13,j +S' 2,j +S' 7,j ,for j=0~7 Q 3,j =S' 12,j +S' 1,j +S' 6,j +S' 11,j ,for j=0~7 Q0,j到Q3,j分別代表第0行到第3行的第二中間跨體奇偶校驗位元組的第j個位元的值，S’0,j到S’15,j分別代表相應於第0個到第15個中間加密結果中的第j個位元的值；跨體奇偶校驗位元組預測電路，耦接所述跨體奇偶校驗位元組產生電路，設置以使用以下公式預測所述4個行的第三中間跨體奇偶校驗位元組：
Figure 111137122-A0305-02-0040-23
,for j=0~7
Figure 111137122-A0305-02-0040-24
,for j=0~7
Figure 111137122-A0305-02-0040-25
,for j=0~7
Figure 111137122-A0305-02-0040-26
,for j=0~7 Q(out) 0,j代表所述第0行的第三中間跨體奇偶校驗位元組的第j個位元的值，Q(out) 1,j代表所述第1行的第三中間跨體奇偶校驗位元組的第j個位元的值，Q(out) 2,j代表所述第2行的第三中間跨體奇偶校驗位元組的第j個位元的值，Q(out) 3,j代表所述第3行的第三中間跨體奇偶校驗位元組的第j個位元的值，Q(in) i,j代表第i行的第一或第二中間跨體奇偶校驗位元組的第j個位元的值，Vi,j代表第i個跨小鑰奇偶校驗位元組中的第j個位元的值；跨體奇偶校驗1位元預測電路，設置以使用以下公式預測4個行的所述跨體奇偶校驗9位元的第8個位元：
Figure 111137122-A0305-02-0040-27
Figure 111137122-A0305-02-0041-28
 Q0,8代表所述第0行的所述跨體奇偶校驗9位元的第8個位元的值，Q1,8代表所述第1行的所述跨體奇偶校驗9位元的第8個位元的值，Q2,8代表所述第2行的所述跨體奇偶校驗9位元的第8個位元的值，Q3,8代表所述第3行的所述跨體奇偶校驗9位元的第8個位元的值，Pi,8代表相應於第i個體的所述體內奇偶校驗位元的值：以及跨體奇偶校驗9位元合併電路，耦接所述跨體奇偶校驗位元組預測電路和所述跨體奇偶校驗1位元預測電路，設置以分別合併所述第0行到所述第3行的所述第三中間跨體奇偶校驗位元組的值和所述第0行到所述第3行的所述跨體奇偶校驗9位元的所述第8個位元的值，用於產生所述第0行到所述第3行的所述跨體奇偶校驗9位元的值。 如請求項6所述的資料加密的錯誤偵測裝置，其中，所述跨體奇偶校驗9位元預測電路，包含：跨體奇偶校驗位元組產生電路，設置以在初始回合依據所述明文的4個行的所述體產生4個行的第一中間跨體奇偶校驗位元組，以及在中間或者最終回合使用以下公式計算所述4個行的第二中間跨體奇偶校驗位元組： Q 0 ,j = S' 0 ,j + S' 5 ,j + S' 10 ,j + S' 15 ,j ,for j =0~7 Q 1 ,j = S' 4 ,j + S' 9 ,j + S' 14 ,j + S' 3 ,j ,for j =0~7 Q 2 ,j = S' 8 ,j + S' 13 ,j + S' 2 ,j + S' 7 ,j ,for j =0~7 Q 3 ,j = S' 12 ,j + S' 1 ,j + S' 6 ,j + S' 11 ,j ,for j =0~7 Q 0,j到Q 3,j分別代表第0行到第3行的第二中間跨體奇偶校驗位元組的第j個位元的值，S'0,j到S' 15,j分別代表相應於第0個到第15個中間加密結果中的第j個位元的值；跨體奇偶校驗位元組預測電路，耦接所述跨體奇偶校驗位元組產生電路，設置以使用以下公式預測所述4個行的第三中間跨體奇偶校驗位元組：
Figure 111137122-A0305-02-0040-23
, for j =0~7
Figure 111137122-A0305-02-0040-24
, for j =0~7
Figure 111137122-A0305-02-0040-25
, for j =0~7
Figure 111137122-A0305-02-0040-26
,for j =0~7 Q (out) 0,j代表所述第0行的第三中間跨體奇偶校驗位元組的第j個位元的值，Q (out) 1,j代表所述第1行的第三中間跨體奇偶校驗位元組的第j個位元的值，Q (out) 2,j代表所述第2行的第三中間跨體奇偶校驗位元組的第j個位元的值，Q (out) 3,j代表所述第3行的第三中間跨體奇偶校驗位元組的第j個位元的值，Q (in) i,j代表第i行的第一或第二中間跨體奇偶校驗位元組的第j個位元的值，V i,j代表第i個跨小鑰奇偶校驗位元組中的第j個位元的值；跨體奇偶校驗1位元預測電路，設置以使用以下公式預測4個行的所述跨體奇偶校驗9位元的第8個位元：
Figure 111137122-A0305-02-0040-27
Figure 111137122-A0305-02-0041-28
 Q 0,8代表所述第0行的所述跨體奇偶校驗9位元的第8個位元的值，Q 1,8代表所述第1行的所述跨體奇偶校驗9位元的第8個位元的值，Q 2,8代表所述第2行的所述跨體奇偶校驗9位元的第8個位元的值，Q 3,8代表所述第3行的所述跨體奇偶校驗9位元的第8個位元的值，P i,8代表相應於第i個體的所述體內奇偶校驗位元的值：以及跨體奇偶校驗9位元合併電路，耦接所述跨體奇偶校驗位元組預測電路和所述跨體奇偶校驗1位元預測電路，設置以分別合併所述第0行到所述第3行的所述第三中間跨體奇偶校驗位元組的值和所述第0行到所述第3行的所述跨體奇偶校驗9位元的所述第8個位元的值，用於產生所述第0行到所述第3行的所述跨體奇偶校驗9位元的值。 一種資料加密的錯誤偵測裝置，包含：搜索電路，設置以依據查找表將輸入的相應於明文或者中間加密結果的1個位元組的第一值轉換為第二值；以及替代校驗電路，耦接所述搜索電路，設置以使用相應於所述查找表的公式判斷所述第一值轉換為所述第二值的過程中是否發生錯誤，以及當發現錯誤時，發出錯誤訊號。 An error detection device for data encryption, comprising: a search circuit, configured to convert an input first value of 1 byte corresponding to plaintext or an intermediate encryption result into a second value according to a lookup table; and a replacement check circuit, coupled to the search circuit, configured to use a formula corresponding to the lookup table to determine whether an error occurs during the conversion of the first value into the second value, and to send an error signal when an error is found. 如請求項9所述的資料加密的錯誤偵測裝置，其中，所述查找表使用以下公式建立：SBi=Affine((i)-1)SBi代表i的輸出結果，Affine()代表Affine轉換函數，i為從0到127的正整數。 The error detection device for data encryption as described in claim 9, wherein the look-up table is established using the following formula: SB i =Affine((i) -1 ) SB i represents the output of i, Affine() represents the Affine conversion function, and i is a positive integer from 0 to 127. 如請求項10所述的資料加密的錯誤偵測裝置，其中，所述替代校驗電路，包含：計算電路，耦接所述搜索電路，設置以獲取所述第二值，並且計算Affine(S’(out))-1而產生第三值，其中，S’(out)代表所述第二值，Affine()-1代表Affine轉換的反函數；乘法器，耦接所述搜索電路和所述計算電路，設置以將所述第二值乘上所述第三值以產生第四值；以及比較器，耦接所述搜索電路和所述乘法器，設置以實施以下邏輯運算式來產生判斷結果：err_nl=0,if(S’(mul)==1)&&(S’(in)！=0)&&(Affine(S’(out))-1！=0) err_nl=0,if(S’(mul)==0)&&(S’(in)==0)&&(Affine(S’(out))-1==0) err_nl=1,otherwise當err_nl等於1時，代表發現錯誤，S’(mul)代表所述第四值，S’(in)代表所述第一值，S’(out)代表所述第二值。 The error detection device for data encryption according to claim 10, wherein the substitution check circuit includes: a calculation circuit, coupled to the search circuit, configured to obtain the second value, and calculate Affine(S'(out))-1And produce a third value, where, S'(out)Representing the second value, Affine()-1Representing the inverse function of Affine conversion; a multiplier, coupled to the search circuit and the calculation circuit, configured to multiply the second value by the third value to generate a fourth value; and a comparator, coupled to the search circuit and the multiplier, configured to implement the following logical operation formula to generate a judgment result: err_nl=0, if(S'(mul)==1)&&(S'(in)! =0)&&(Affine(S'(out))-1! =0) err_nl=0,if(S’(mul)==0)&&(S'(in)==0)&&(Affine(S'(out))-1==0) err_nl=1, otherwise when err_nl is equal to 1, it means an error was found, S’(mul)represents the fourth value, S'(in)represents the first value, S'(out)represents the second value. 如請求項9所述的資料加密的錯誤偵測裝置，其中，所述搜索電路設置以完成高級加密標準演算法中的替代位元組操作。 The device for detecting errors in data encryption as claimed in Claim 9, wherein the search circuit is configured to perform a byte-substitution operation in the Advanced Encryption Standard algorithm.
TW111137122A 2021-12-21 2022-09-30 Apparatus for detecting errors during data encryption TWI808902B (en)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US202163292038P 2021-12-21 2021-12-21
US63/292,038 2021-12-21

Publications (2)

Publication Number Publication Date
TW202326491A TW202326491A (en) 2023-07-01
TWI808902B true TWI808902B (en) 2023-07-11

Family

ID=86778519

Family Applications (2)

Application Number Title Priority Date Filing Date
TW111137122A TWI808902B (en) 2021-12-21 2022-09-30 Apparatus for detecting errors during data encryption
TW111137123A TWI804439B (en) 2021-12-21 2022-09-30 Apparatus and method for detecting errors during data encryption

Family Applications After (1)

Application Number Title Priority Date Filing Date
TW111137123A TWI804439B (en) 2021-12-21 2022-09-30 Apparatus and method for detecting errors during data encryption

Country Status (2)

Country Link
CN (2) CN116318622A (en)
TW (2) TWI808902B (en)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107003911A (en) * 2014-11-26 2017-08-01 新思公司 Two-way parity errors error detection for Advanced Encryption Standard engine
TW202109300A (en) * 2019-08-16 2021-03-01 旺宏電子股份有限公司 Method and system for secure memory
US20210255923A1 (en) * 2018-12-24 2021-08-19 SK Hynix Inc. Controller and memory system
CN113556332A (en) * 2021-07-09 2021-10-26 深圳市高德信通信股份有限公司 Data encryption transmission method

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
DE102015220081A1 (en) * 2015-10-15 2017-04-20 Robert Bosch Gmbh Method for generating a key in a circuit arrangement
US10333698B2 (en) * 2017-07-14 2019-06-25 Raytheon Company Entwined encryption and error correction
CN111756541A (en) * 2019-03-26 2020-10-09 北京普安信科技有限公司 Method, server, terminal and system for transmitting secret key

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107003911A (en) * 2014-11-26 2017-08-01 新思公司 Two-way parity errors error detection for Advanced Encryption Standard engine
US20210255923A1 (en) * 2018-12-24 2021-08-19 SK Hynix Inc. Controller and memory system
TW202109300A (en) * 2019-08-16 2021-03-01 旺宏電子股份有限公司 Method and system for secure memory
CN113556332A (en) * 2021-07-09 2021-10-26 深圳市高德信通信股份有限公司 Data encryption transmission method

Also Published As

Publication number Publication date
CN116318622A (en) 2023-06-23
TW202326433A (en) 2023-07-01
TWI804439B (en) 2023-06-01
TW202326491A (en) 2023-07-01
CN116318644A (en) 2023-06-23

Similar Documents

Publication Publication Date Title
US9407286B2 (en) Data compression apparatus, data compression method, and memory system including the data compression apparatus
CN101149709B (en) Encryption processor of memory card and method for writing and reading data using the same
US9348693B2 (en) Data accessing method for flash memory module
US8831229B2 (en) Key transport method, memory controller and memory storage apparatus
JP2022517534A (en) Replay protection nonce generation
US11899829B2 (en) Memory systems and devices including examples of generating access codes for memory regions using authentication logic
CN105229592A (en) For generating the apparatus and method in order to again to access the descriptor of the nonvolatile semiconductor memory of memory driver due to mistake
CN108959168B (en) SHA512 full-flow water circuit based on-chip memory and implementation method thereof
TWI808902B (en) Apparatus for detecting errors during data encryption
US20150222434A1 (en) Crt-rsa encryption method and apparatus
TWI835381B (en) Apparatus for detecting errors during data encryption
TWI835601B (en) Apparatus and method for expanding round keys during data encryption
TW202420088A (en) Apparatus for detecting errors during data encryption
TWI776351B (en) Data accessing method using data protection with aid of advanced encryption standard processing circuit, memory controller of memory device, and advanced encryption standard processing circuit of memory controller of memory device
CN117997797A (en) Error detecting device for data encryption
US20230198754A1 (en) Apparatus and method for detecting errors during data encryption
US20230198755A1 (en) Apparatus and method for detecting errors during data encryption
TWI823436B (en) Apparatus and method for generating low-density parity-check (ldpc) code
US20230068302A1 (en) Memory device and method for data encryption/decryption of memory device
CN113468567B (en) Data processing method and data processing equipment
US20230421178A1 (en) Apparatus and method for generating low-density parity-check (ldpc) code
US20230044214A1 (en) Storage device, host device and data transfer method thereof
CN114969850A (en) Data transmission method and storage system
CN117955629A (en) Encryption encoding method and device in DNA storage, electronic equipment and storage medium