MULTICORE IMPLEMENTATION OF THE AES ALGORITHM IN THE MEASUREMENT SYSTEM

Transcription

1 XIX IMEKO World Congress Fundamental and Appled Metrology September 6 11, 2009, Lsbon, Portugal MULTICORE IMPLEMENTATION OF THE AES ALGORITHM IN THE MEASUREMENT SYSTEM Potr Blsk 1,2, Wesław Wneck 2 1 Warsaw Unversty of Lfe Scences, Faculty of Appled Informatcs and Mathematcs, Warsaw, Poland, potr_blsk@sggw.pl, pblsk@elka.pw.edu.pl 2 Warsaw Unversty of Technology, Insttute of Radoelectroncs, Warsaw, Poland, W.Wneck@re.pw.edu.pl Abstract The paper presents the mplementaton of the Advanced Encrypton Algorthm (AES) n the measurement system, where the vrtual nstruments equpped wth the mult-core processors are used. The encrypton algorthm s frst presented, then ts modfcaton to take advantage over the mult-core processor s descrbed. Implementaton of the latter n the vrtual nstrument workng under the Real-Tme (RT) mode s presented. Fnally, test vectors are used to verfy the valdty of the modfed algorthm and comparson between the tradtonal algorthm and the verson usng the parallel computatons s performed. the measured quanttes are converted nto the form acceptable by the computer system, they must be sent to the second element of the system,.e. data processng server. It s the central node of the system, responsble for storng the gathered nformaton and performng the data processng. The scheme of the system s presented n Fg. 1. Keywords: vrtual nstrumentaton, cryptography, Real- Tme systems 1. INTRODUCTION The nfluence of the computer technologes on the modern measurement systems s steadly ncreasng. Multple solutons not only allow connectng the tradtonal devces to the computers, but requre the computer network or processors to perform calculatons on the acqured data. As the dstrbuted measurement systems are a common mplementaton, the problem becomes the securty of the data transferred between the nodes of the system. The threats related to the tradtonal computer network are well dentfed and complete software and hardware solutons were mplemented. Securty of the dstrbuted measurement systems s stll not clearly defned, but numerous ncdents ndcate that n the near future all the data n such a system wll have to be secured from the unauthorzed access. The most popular method of the data securty s the mplementaton of the cryptographc algorthms. In the measurement systems nvolvng the software (for example, vrtual nstruments - VI), mplementaton of the algorthm n the applcaton run by the processor s the correct approach. The measurement system can be supplemented wth the encrypton schemes n two ways, related to ts structure. Generally, there are two types of the nodes. The frst one are measurement nodes, where the data acquston (DAQ) operatons are performed. They are usually sensory networks or general purpose computers equpped wth the DAQ hardware, etc. The nature of the measurements deps on the character of the analyzed phenomenon: temperature, pressure, voltage, current and smlar. When Fg. 1. Archtecture of the dstrbuted computer measurement system. Introducton of the encrypton schemes nto the system s asymmetrc. When the DAQ nodes gather measured data, they must be encrypted before sng to the server. Unfortunately, a very lmted computng power s avalable here, such as sngle core processors of lower frequences. The cryptographc algorthms are usually computatonally expensve, and may be dffcult to mplement n the small mcrocontrollers, such as Intel On the other sde there s the hgh performance computng machne workng as a server. Although t has greater processng abltes, ts responsblty s the smultaneous decrypton of the measurement data sent from multple nodes and encrypton of the confguraton data sent to them. It s often mportant to acqure the data from the sensors and process them wthn the predefned tme lmts. To ensure such determnsm, the RT system s needed. The latter can easly be mplemented on the server (personal computer), and operate the measurement applcaton desgned n on of the ntegrated programmng envronments, such as Natonal Instruments LabVIEW, or Aglent VEE. One of the newest achevements n the measurement systems s the ablty to use the mult-core processors n the RT mode. Ths gves the opportunty to ncrease the speed

2 of computatons and overcome the problem of the RT data processng. The paper presents the mplementaton of the AES algorthm n the RT measurement server. The former was desgned usng the LabVIEW envronment and run on the four-core Intel processor. Organzaton of the paper s as follows. In secton 2 the AES algorthm s presented. Secton 3 contans dscusson of the modfcaton of the orgnal algorthm to take advantage of the multple cores. In secton 4 mplementaton of the algorthm n LabVIEW envronment s descrbed. Secton 5 contans the verfcaton of the algorthm and measurements of ts effcency. In secton 6 there are conclusons and future prospects. 2. THE AES ALGORITHM DESCRIPTION The AES algorthm s the most popular symmetrc block cpher, approved by the Natonal Insttute of Standards and Technology n 20 [1]. The purpose of the algorthm s to replace the older and less relable algorthms, such as Data Encrypton Standard (DES). The algorthm operates on the 128-bt (16-byte) data blocks (called plan text, n the measurement system the latter can be represented by the acqured samples, arrays etc.) and uses 128-, 192-, or 256- bt key to obtan 128-bt cpher. Applcaton of the algorthm conssts of encrypton (transformaton of the plan text nto the cpher) and decrypton (the opposte transformaton). In both operatons, the same key s used. The hardware and software requrements are relatvely small, makng the AES the most popular symmetrc standard [2]. Therefore t can be successfully used n the smple measurement nodes of the dstrbuted system, where sensors and DAQ hardware gather the desred quanttes, then create blocks, encrypt them and s to the server. The mplementaton of the algorthm s based on the substtuton-permutaton network AES encrypton scheme The pseudocode for the AES encrypton s presented n Fg. 1. It transforms the nput data (IN measurements) nto the cpher (OUT) usng the expanded key W. AEScpher(IN(4 Nb), OUT(4 Nb), W[Nb (Nr+1)]) begn [4,Nb] = IN AddRoundKey(, W[0, Nb-1]) for = 1 to Nr-1 SubBytes() ShftRows() MxColumns() AddRoundKey(, W[ Nb, (+1) Nb-1]) SubBytes() ShftRows() AddRoundKey(, W[Nr Nb, (Nr+1) Nb-1]) OUT = Fg. 2. Pseudocode of the AES encrypton [1]. where Nb s the number of the processed bytes (here four), Nr s the number of the algorthm s teratons (depng on the length of the key, equal to 10, 12, or 14 respectvely), IN s the 128-bts long plan text, OUT s the output vector (cpher, 128-bts long), W s the expanded key (the sequence of Nb (Nr+1) bytes generated from the ntal Nk bytes of the key K) and s the matrx (consstng of 4 rows and 32 bts n each row). Operatons performed durng the encrypton nclude: Assgnment of the IN vector to the matrx and the matrx to the OUT vector. The nput bytes vector s transformed nto the array, accordng to (1): [ row, column] = IN[ row + 4 column] (1) The output bytes vector s obtaned from the accordng to (2): OUT [ row + 4 column] = [ row, column] (2) AddRoundKey the xor operaton performed on every column of the array, usng the partcular bytes of the expanded key (3): [*, column] = [*, column] W[ Nb + column] (3) b SubBytes operaton of exchangng the elements of the matrx nto the new values, usng the structure called s-box. The latter s the array 16x16, contanng the substtuton values. The substtuton s performed accordng to (4): = b c (4) ( + 4) mod8 ( + 5) mod8 ( + 6) mod8 ( + 7) mod8 where c s the bt of the byte {1001}. ShftRows operaton of rotatng rght the rows of the array at postons, where =(0,1,2,3). Ths means that the frst row s not changed, and the fourth row has the form: {a 3,3 a 3,0 a 3,1 a 3,2 }. MxColumns n ths operaton every column of the array s transformed usng the equaton (5): 02 = AES decrypton scheme The decrypton algorthm s smlar to the encrypton, but contans the nverse array operatons, whch are also n dfferent order than n the encrypton scheme. It wll be used by the data processng server do decrypt the ncomng measurement data and by the DAQ nodes to decrypt the nstructons from the control nodes or the server. The generc decrypton procedure [1] s presented n Fg. 3. The addtonal operatons are as follows: InvShftRows operaton of rotatng left the rows of the array at postons, where =(0,1,2,3). Agan, the frst row s not changed, and the fourth row has the form: {a 3,1 a 3,2 a 3,3 a 3,0 }. (5)

3 InvSubBytes the nverse operaton of exchangng the elements of the matrx nto the new values, usng the nverted s-box. InvMxColumns n ths operaton every column of the array s transformed usng the equaton (6): 0e = 09 0d 0b 0b 0e 09 0d 0d 0b 0e d 0b 0e AESnvcpher(IN(4 Nb), OUT(4 Nb), W[Nb (Nr+1)]) begn [4,Nb] = IN AddRoundKey(, W[Nr Nb, (Nr+1) Nb-1]) for = Nr-1 to 1 InvShftRows() InvSubBytes() AddRoundKey(, W[ Nb, (+1) Nb-1]) InvMxColumns() InvShftRows() InvSubBytes() AddRoundKey(, W[0, Nb-1]) OUT = Fg. 3. Pseudocode of the AES decrypton [1] Expanded key generaton scheme The last element of the AES scheme s the expanson of the key W. It takes the ntal cpher key K and generates from t Nb (Nr+1) bytes, further used n the algorthms presented n Fg. 2 and 3. AESkeyexpanson(K(4 Nk), W[Nb (Nr+1)], Nk) begn = 0 whle ( < Nk) W[] = [K[4 ] K[4 +1] K[4 +2] K[4 +3]] = + 1 = Nk whle ( < Nb (Nr+1)) temp = W[-1] f (mod(, Nk)==0) temp = xor(subword(rotword(temp)),rcon[/nk]) elsef (Nk > 6 & mod(, Nk) == 4) temp = SubWord(temp) W[] = xor(w[-nk], temp) = I + 1 Fg. 4. Pseudocode of the key expanson [1]. (6) The algorthm s performed before the encrypton or decrypton takes place. Its man operatons are: SubWord the operaton smlar to SubBytes, as t transforms the nput four bytes nto the output bytes usng the s-box. RotWord the operaton of a cyclc permutaton, changng the poston of the bytes n the sequence, accordng to the followng schema: {a 0 a 1 a 2 a 3 } {a 1 a 2 a 3 a 0 }. Rcon a constant word array, that has the followng form: {x -1 {00} {00} {00}}, where x -1 s the power of {02} n the feld GF(2 8 ) The detaled nformaton about all the algorthms can be found n [1]. 3. THE AES ALGORITHM MODIFICATIONS The algorthms presented n secton 2 can be used n any node of the dstrbuted system. However, to take advantage of the multprocessng unts present n the nodes responsble for the data processng, ther modfcatons must be proposed. Accordng to the parallel computatons paradgms [3], the ndepent parts of the algorthms must be dentfed and then prepared to work n separate threads. One of two approaches should be appled here. Both are based on the observaton that the algorthms from secton 2 perform ndepent matrx row or column transformatons, whch can be performed concurrently. Secton 3.1 presents the overall approach to the smultaneous block encrypton and decrypton assumng that multple processor cores are avalable (so each core processes ts own block). In secton 3.2 addtonal parallelsm of the algorthms operatons are presented. The effcency of the latter soluton s lmted to the sze of the matrces and works best wth four cores Concurrent block encrypton and decrypton The frst modfcaton of the orgnal algorthm does not requre any changes n the algorthm tself. The procedure nvolves dvdng the nput, plantext bytes nto blocks that can be encrypted and decrypted ndepently. Ths way multple blocks can be processed smultaneously. The procedure s multpled and every copy processes every -th block, accordng to (6): AES = f ( IN ) j mod(,4) (6) j j = where j = {1,,n}, n s the number of the copes of the AES procedure (performng n smultaneous blocks processng) and ={1,,m}, m s the number of the plan text blocks. The frst operaton here s separatng the plan text or cpher blocks nto ndepent streams and then applyng the AES encrypton or decrypton procedures. The expected ncrease of the computatonal effcency deps on the number of the appled copes of the procedure. Implementaton of the modfcaton n the programmng language requres mult-threadng mechansm. The example of the encrypton usng the multple copes of the encryptng procedure s n Fg. 5.

4 s possble. However, the analyss of the operatons nsde of these steps shows that the matrx operatons can be broken nto ndepent parts. The SubBytes and ShftRows are the operatons that transform the ndvdual rows n the array each row can be processed separately. Moreover, as these operatons are put one after another n the algorthm, there s no need to treat them as the separate subprocedures. They can be used nsde one program functon. The result of the optmzaton s presented n Fg. 6. Fg. 5. Exemplary encrypton usng concurrent AES procedures for n=3 and m=6. Ths modfcaton s especally useful n the data processng server, whch obtans multple data from many DAQ nodes. Also, large amount of data sent from one node (for example, long waveforms of thousands of samples) must be dvded nto blocks Modfcaton nsde the algorthm The modfcaton presented n secton 3.1 s smple and requres lttle tol from the desgner of the measurement system. However, a more effcent approach may be the modfcaton made nsde the algorthm to make every subprocedure nsde the AES schedule to be able to run on the ndepent processor cores. Ths mght also be necessary when the plan text or cpher blocks are processed n relaton to the values obtaned n the prevous teratons. To modfy the orgnal algorthm, the analyss of the scheme presented n Fg. 2, 3 and 4 was conducted. The general soluton s presented on the exemplary encrypton scheme. The decrypton and key expanson algorthms are performed the same way. Note that the parallelsm of the whole scheme requres frstly row, then column operatons. Fg. 6. Concurrent SubBytes and ShftRows operatons. Frstly, the steps of the algorthms that are n a sequence can not be modfed to be run smultaneously, as ther results dep on the results obtaned from the precedng operatons. Therefore, the steps nsde the for loop (SubBytes, ShftRows, MxColumns and AddRoundKey) must be processed sequentally, and no concurrent executon Fg. 7. Concurrent MxColumns and AddRoundKey operatons. Smlarly, MxColumns and AddRoundKey can be decomposed nto the smultaneously processed parts, but ths tme the latter operate on columns. The soluton s presented n Fg IMPLEMENTATION OF THE ALGORITHM The proposed modfcatons were mplemented n the exemplary measurement system, where the presented operatons could be tested. It conssted of two nodes DAQ and processng, whch justfes applcaton of the encrypton and decrypton schemes. The algorthm was mplemented n the LabVIEW programmng envronment. To run the parallel tasks under the RT system, RT module was used. Because the cryptographc algorthms for LabVIEW are currently avalable thanks to the Crypto-G lbrary [4], the AES mplementaton from the latter was exploted as the reference applcaton. To ensure the parallel computatons, the algorthm mplementaton was modfed to run under the RT module. The abltes of the latter of runnng smultaneously computaton-demandng tasks were verfed durng the prevous research [5]. In the desgned software the operatons must be dvded nto separate threads (to reflect the concurrent data processng see secton 3). Two approaches to mplement the latter were tred. The frst one uses the tmed sequences [6],.e. programmng structures allowng determnaton of the order of the partcular functons executon and assgn the processor cores to these tasks. In every subprocedure presented n secton 3, the array was decomposed nto the ndepent parts, and then nserted nto the tmed sequence, assgned to the partcular core. Fnally, the ndepent rows or columns were put together, restorng the array. Note that usng the tmed

5 structures (desgned especally for the RT operatng system (RTOS)) makes the AES procedure runnable only under the latter. The example of the algorthm mplementaton usng the tmed sequence s n Fg. 8. The second approach s based on the ablty of the RTOS to automatcally assgn the partcular tasks to the processor s cores. Ths tme the array operatons are smply dvded nto the separate data streams, wthout any explct core assgnment. The example of the code wthout the tmed structures s presented n Fg. 9. The man advantage of such mplementaton s the ablty to run the functons both under the general purpose operatng system (GPOS) and RTOS. standard network card. The verson of the LabVIEW envronment used to desgn and mplement the algorthm was 8.5 (the frst one supportng the multcore programmng technques under the RTOS). Networkng nfrastructure used to ensure the communcaton between the control node and RT target. Both computers must be equpped wth the network cards, whch are also connected to the swtch. The laboratory test stand s presented n Fg. 10. Fg. 10. Laboratory test stand. Fg. 8. Fragment of the MxColumns procedure usng the tmed sequence. Fg. 9. Fragment of the MxColumns procedure wthout the tmed structures. Durng tests both mplementatons were verfed wth respect to the correctness of the encrypton and decrypton, and the speed of computatons. To obtan the latter the measurement mechansms of the RT module were exploted,.e. tmestamp measurements wth the mcrosecond accuracy. The frst one s used to take the tme of the encrypton and decrypton computatons. The second s used to observe, how the processor s cores are used to perform the measurement of applcaton s computatons. To test the algorthm the followng laboratory confguraton was assembled (smlar to [7]): RT target a computer run under the RTOS and executng the AES algorthm mplemented n the LabVIEW envronment. It s equpped wth the Intel Core2Quad processor, 2 GB of RAM, 160 GB hard dsk drve wth FAT32 partton and the network card accepted by the system. control node a computer run under Wndows XP operatng system, controllng the RT node. It s used to desgn the software part of the vrtual nstrument and deploy t on the RT node. It s equpped wth the Athlon XP processor, 2 GB of RAM and 5. TESTS AND MEASUREMENTS All versons of the algorthm were verfed usng the standard test vectors, ncludng 16-byte plan texts and and 32-byte long keys. The tests ncluded both encrypton and decrypton to compare the tmes of both operatons. The example of the tme analyss of processng one 16-byte word usng all types of the keys s presented n Table 1. The algorthm verson wth the mplct core assgnment - ICA (see Fg. 8) s the fastest one, the verson wth explct core assgnment (ECA) requres too much overhead for the tmed structures to be effectve aganst the sngle block. However, for larger data structures t may be much faster. The encrypton and decrypton operatons have smlar tme of executon, because both consst of dentcal number of analogous matrx operatons. Table 1. Speed of dfferent versons of the AES encrypton and decrypton for the sngle plan text block and dfferent key lengths. Key length Basc ICA ECA AES ,35 ms 45,78 ms 118,74 ms AES ,74 ms 51,59 ms 150,36 ms AES ,65 ms 57,35 ms 181,55 ms The reference algorthm from the Crypto-G lbrary worked correctly under GPOS, but dd not work under RTOS. On the other hand, the algorthm desgned for the RTOS usng the tme sequences dd not run well under the GPOS. The verson of the algorthm desgned wthout the RT programmng elements worked under both OS. Another experment conssted n the block encrypton and decrypton of the whole waveform gathered n the node (see secton 3.1). Ths tme the encryptons mode must be used. In the smplest case, ECB, each dentcal sample would be encrypted the same way, producng the same

6 cpher, as each block s encrypted separately here. If perodcal sgnals are measured, the ECB mode compromses the cpher wthout the knowledge of the keys. Therefore the more sophstcated mode, CBC s used. Here the cpher from the prevous teraton s mxed wth the next plantext block (usng the XOR operaton) and then put to the encrypton procedure. The sequence of blocks s the sequence of measured values of the waveform. Each sample has a double representaton,.e. requres 32 bts. AES works wth nput sequences of four 32-bt long words, therefore sequences of four words must be put as the nput of the AES scheme. The method was tested on the RT target, whch receved waveforms of dfferent length. For encrypton all three key lengths were used. Before the data s processed, the converson between the numercal values and ther bnary representaton must be performed. The samples vector was also decomposed nto subvectors, each of whch was encrypted by the separate core. The recprocal operaton s requred to be performed on the other sde of the transmsson lne, when the data must be decrypted. Results of the encrypton/decrypton scheme for the exemplary 1024-samples long waveform are n Table 2. Table 2. Speed of dfferent versons of the algorthm for the 1024 samples waveform and dfferent key lengths. Key length Basc ICA ECA AES-128 9,83 s 4,74 s 16,21 s AES ,84 s 8,03 s 21,99 s AES ,98 s 11,21 s 28,88 s The relaton between the partcular versons of the AES scheme s smlar to the one from Table 1. Agan, the mplct core assgnment s the most effectve. To successfully transmt all samples between the nodes n the dstrbuted system, the overall tme wll be requred: t = t + t + t + t + t (7) ovr conv enc net dec conv where t ovr s the overall tme of sng the data, t conv s the tme of convertng the numbers to the byte arrays (1024 total conversons) and dvdng the samples vector nto four concurrent vectors, t enc s the tme of the whole vector encrypton, t net s the tme requred for successful network transmsson, t dec s the decrypton tme of the whole samples vector. The largest amount of tme s requred for encrypton and decrypton. In the Basc mplementaton (where no multthreadng for the matrx operatons s nvolved), each operaton lasts for about 50 ms. The optmal mplementaton requres about 30 ms. Note that the tmes of the overall waveform encrypton are 64 tmes the sngle block encrypton/decrypton tme, because the 1024 samples vector s decomposed nto four 256-element subvectors. Each four subsequent elements of the partcular subvector are the nput of the AES scheme (to form 128-bt sequence). The nfluence of the waveform length on the encrypton and decrypton effcency s presented n Fg. 11. The most effcent s the ICA verson of the algorthm. Fg. 11. Tme of the AES scheme executon for dfferent lengths of samples vectors. 6. CONCLUSIONS The mplemented AES algorthm works well under the RTOS and can be used n both the measurement server, gatherng the encrypted data from the nodes of the system, and DAQ node equpped wth the mult-core processor (such as PXI-8110 [8]). The mproved mplementaton of the algorthm may be useful n the future relable measurement systems, where not only the effcency and determnsm wll be mportant, but also safety of transmtted data. The tme analyss of the presented algorthm shows that the RT verson s more effcent than the straghtforward verson from the Crypto-G lbrary. Ths mples that the smlar approaches to mplement addtonal cryptographc algorthms should be made n the future. The power of the hardware responsble for the algorthm realzaton strongly affects the effcency of encrypton/decrypton scheme. Therefore the desgner must assess computatonal requrements of hs system and prepare the computers capable of fulfllng them. Also, the am of the upcomng research may be the full cryptographc lbrary suted for the RT systems. REFERENCES [1] Announcng the Advanced Encrypton Standard (AES), Avalable: [2] T. Good, M. Benassa, AES on FPGA: from the fastest to the smallest, Proceedngs CHES, Ednburgh, UK. Aug. 29 -Sept. 1, 2005, pp [3] H. Kasahara, S. Narta, "Practcal Multprocessor Schedulng Algorthms for Effcent Parallel Processng," IEEE Trans. Comput., Vol.c-33, No.11,pp ,Nov [4] Vartor Crypto-G lbrary, avalable at [5] W. Wneck and P. Blsk, "Mult-Core Programmng Approach n the Real-Tme Vrtual Instrumentaton", Proceedngs IEEE I2MTC, Vctora, Brtsh Columba, Canada, May, 2008, pp [6] Multcore Programmng wth LabVIEW Techncal Resource Gude, avalable at: ftp://ftp.n.com/evaluaton/labvew/ekt/multcore_programm ng_resource_gude.pdf [7] P. Blsk, W. Wneck, Dstrbuted Real-Tme Measurement System Usng Tme-Trggered Network Approach, Internatonal Journal of Computng, 2008, Vol. 7, pp [8] Natonal Instruments Announces PXI U Quad-Core Embedded Controller for PXI System, avalable at: