High-performance dot multiplication architecture based on two-way interleaving working mechanism

Abstract

The invention discloses a high-performance dot product architecture based on a two-way interleaving working mechanism. The architecture comprises an arithmetic logic unit based on the two-way interleaving working mechanism, a phase-locked loop module, an arbiter and an instruction memory, a two-way interleaving working mechanism is adopted, the throughput rate index is superior to that of an existing design, and the method faces a high-performance calculation application scene. On the premise that the high throughput rate is obtained, the performance index of the method is superior to that of most existing designs, a high-performance point multiplication operation framework is achieved on the premise that a large number of hardware resources are expended, and the high-performance characteristic of the design has better universality in finite fields of different scales. According to the method, a partial parallel modular inversion algorithm is adopted, the defect that parallel computing resources cannot be fully utilized by a traditional ITA algorithm is overcome, and therefore the utilization rate of hardware resources is increased. According to the invention, a heterogeneous multiplier design thought is adopted, and the time delay of a critical path LUT in a dot multiplication architecture is optimized.

Description

Technical Field

[0001] The present invention belongs to the field of digital integrated circuit design, and in particular to a high-performance point multiplication architecture based on a dual-path interleaving working mechanism. Background Art

[0002] On binary elliptic curves, the Montgomery Ladder point multiplication algorithm has strong resistance to simple power analysis attacks. Thanks to its ordinate omission feature, the Montgomery Ladder point multiplication algorithm has lower computational overhead than traditional binary scan point multiplication algorithms. Therefore, the Montgomery Ladder point multiplication algorithm has become a key algorithm in most elliptic curve cryptography point multiplication architectures.

[0003] Existing hardware-accelerated designs for the Montgomery Ladder multiplication algorithm typically address the parallelism of the multipliers based on the modular multiplication requirements of a single iteration. Specifically, given that a single iteration of the Montgomery Ladder multiplication algorithm on a binary elliptic curve requires six modular multiplications, a low-complexity architecture can be implemented by multiplexing one modular multiplier over six clock cycles. Similarly, two or three modular multipliers can be used, multiplexing three or two clock cycles.

[0004] Although this existing solution is simple and effective, its optimization bottleneck lies in the fixed data dependency between modular multiplication operations in the MontgomeryLadder point multiplication algorithm. Therefore, when the number of parallel multipliers is large, the critical path of the point multiplication architecture will increase significantly, which in turn leads to a decrease in the operating frequency of the point multiplication architecture.

[0005] In some application scenarios with high elliptic curve cryptography point multiplication workloads and high concurrency (such as massive machine-to-machine communications, a typical 5G application scenario), the core security gateway needs to utilize elliptic curve cryptography to complete a large number of tasks such as digital signatures, key agreement, and key distribution in a short period of time. In this scenario, treating a single point multiplication architecture as a PE and simply reusing "strictly isolated" PEs can certainly be a "naive" solution to high workload and high concurrency application scenarios. However, this brings the optimization of a single PE back to the bottleneck problem of the existing single Montgomery Ladder point multiplication algorithm. In this case, it is advisable to consider multiple point multiplication algorithms together, rather than focusing solely on the optimization and hardware acceleration of a single point multiplication operation. This invention aims to study scheduling strategies for efficient parallel computing across multiple PEs, achieving overall improvements in computing performance by reusing "shared" hardware resources between some PEs. Furthermore, given that massive amounts of private data must be processed by devices such as the core security gateway, this invention, while ensuring the high performance of the point multiplication architecture, also focuses on the proposed point multiplication architecture's ability to resist side-channel attacks, and verifies this through experiments. Summary of the Invention

[0006] The present invention provides a high-performance point multiplication architecture based on a dual-path interleaving working mechanism to address the defects in the prior art.

[0007] The present invention is achieved through the following technical solutions:

[0008] A high-performance point multiplication architecture based on a dual-path interleaving mechanism, including an arithmetic logic unit based on a dual-path interleaving mechanism, a phase-locked loop module, an arbiter, and an instruction memory;

[0009] The arithmetic logic unit based on the two-way interleaving mechanism includes three parallel modular multipliers, five modular squarers, five modular adders, and a series of registers and multiplexers. The three parallel arrangements include two dedicated multipliers (DMUL) and one interleaved multiplier (IMUL). The addresses of all the multiplexers of the modular multipliers together constitute the microinstructions of the arithmetic logic unit based on the two-way interleaving mechanism.

[0010] The phase-locked loop module is used to provide a global clock;

[0011] The arbiter can input scalar values k1 and k2 to the two scalar input ports according to the current working state of the arithmetic logic unit based on the two-way interleaving mechanism, so as to ensure that the two dot product data paths of the high-performance dot product architecture are always busy.

[0012] The instruction memory is used to store the operation instructions of the arithmetic logic unit based on the two-way interleaving mechanism.

[0013] As described above, a high-performance dot multiplication architecture based on a dual-path interleaving mechanism has a reserved random number input port, which can be used to complete the randomization of the Z coordinate before each dot multiplication operation to enhance the architecture's resistance to DPA.

[0014] As described above, a high-performance point multiplication architecture based on a dual-path interleaving working mechanism is described, in which the interleaved multiplier is responsible for PA_MUL4 and PD_MUL2 in the two point multiplication operations, and the two professional multipliers are respectively responsible for the residual modular multiplication operations in the two point multiplication operations. The order of starting each round of iteration is to execute PA_MUL1 first and then PA_MUL2.

[0015] In the high-performance point multiplication architecture based on the dual-path interleaving mechanism, the lookup table delays of the interleaved modular multiplier and the dedicated modular multiplier are shown as follows:

[0016] D IMUL =D POW +D CM +D red +D add +D MUX

[0017] D DMUL =D split +D CM +D align +D red +D add +D MUX

[0018] Since the interleaving module multiplier adopts the CM architecture, the lookup table delay of the interleaving module multiplier with an m-bit width is For the dedicated modular multiplier, this paper adopts the KOM splitting strategy with the best area-delay ratio. 163 )、GF(2 283 ) and GF(2 571 ), θ is 3, 4 and 5 respectively.

[0019] As described above, a high-performance point multiplication architecture based on a dual-path interleaving mechanism, wherein the high-performance point multiplication algorithm in the arithmetic logic unit of the dual-path interleaving mechanism is based on two point multiplication operations of scalar k=[k (1) ,k (2)] as input, the iterative link adopts an interleaved working mechanism. Two dedicated multipliers are responsible for their own point multiplication operations respectively. The interleaved multiplier is responsible for PA_MUL4 and PD_MUL2 in the two point multiplication operations. In order to distinguish the two point multiplication operations, P1(X1,Y1) and P2(X2,Y2) are a set of point values in one point multiplication operation, and P3(X3,Y3) and P4(X4,Y4) are another set of point values, among which P1(X1,Y1) and P3(X3,Y3) are equivalent, and P2(X2,Y2) and P4(X4,Y4) are equivalent.

[0020] As described above, a high-performance point multiplication architecture based on a dual-path interleaving mechanism, a high-performance point multiplication algorithm in the arithmetic logic unit of the dual-path interleaving mechanism includes an initialization stage (Initialization Stage), an accumulation stage (Accumulation Stage) and a post-processing stage (Post-Processing Stage).

[0021] As described above, a high-performance dot multiplication architecture based on a two-way interleaving mechanism is proposed. The initialization requirements of the dot multiplication algorithm in the initialization phase are integrated into the accumulation phase, so that the output result of the first round of iteration in the accumulation phase is exactly the initialization requirement. In the proposed two-way interleaving mode dot multiplication algorithm, the initialization requirements are simplified to register assignments (1,0) and (x P ,1), after the first round of iteration, the coordinates of the two points calculated are exactly the required initialization requirements - (x P ,1) and (x P 4 +b,x P 2 ), of course, at the same time, the number of iterative cycles in the accumulation phase of the proposed two-way interleaved mode dot multiplication algorithm increases by one compared to the MontgomeryLadder dot multiplication algorithm. Therefore, the computational cost of the proposed two-way interleaved mode dot multiplication algorithm in the accumulation phase is 2m×(6M+5S+3A), where m, M, S, and A represent the finite field size, modular multiplication operation, modular square operation, and modular addition operation, respectively. For the post-processing phase, this paper simultaneously completes the ordinate restoration and modular inverse operation in the post-processing phase. The computational cost of the post-processing phase after each dot multiplication operation in the proposed two-way interleaved mode dot multiplication algorithm is (10M+5A+I), where I represents the modular inverse operation. The ordinate restoration and modular inverse operations use the ordinate restoration method after common denominator.

[0022] As described above, a high-performance point multiplication architecture based on a dual-path interleaving mechanism is described. In the accumulation phase, X2Z1 (or X4Z3) and Z2X1 (or Z4X3) in each iteration of the point multiplication operation are serially calculated in the first two clock cycles (st1 and st2) by a dedicated multiplier, so as to satisfy PA_MUL1 and PA_MUL2, which have the highest priority in the data relationship. After the first two clock cycles, the calculation of the two modular multiplication operations in the dot multiplication operation is started. Since there is no data dependency between PA_MUL3 and PA_MUL4, and the multiple modular square operations that the two depend on are The calculation can be completed within the first two clock cycles, so dedicated multipliers and interleaved multipliers are arranged in st3 to complete the calculation of PA_MUL3 and PA_MUL4 in parallel. In the fourth clock cycle st4, the results of the modular multiplication operations PA_MUL1 and PA_MUL2 calculated in the first two clock cycles have been obtained. At the same time, considering that there is no data dependency between PA_MUL3 and PA_MUL4, dedicated multipliers and interleaved multipliers are also used to complete the calculation of the two in parallel. At the same time, the dual-path interleaved mode point multiplication algorithm only retains the scalar value corresponding to the current round before the doubling point operation. The data is selected, and the algorithm is further refined by using the selection flag f = [f (0) ,f (1) ] controls the data gating for the accumulation and post-processing phases of the two dot products. The gating flags required for the (i-1)th iteration are determined before the end of the i-th iteration. Similarly, the gating flags for the post-processing phase are determined before the end of the last iteration of the accumulation phase. Furthermore, to ensure the correct initialization requirements are calculated during the first accumulation phase, the gating flags are set to f = [2, 4] during the initialization phase.

[0023] In the high-performance point multiplication architecture based on a two-way interleaving mechanism, the arithmetic logic unit of the two-way interleaving mechanism disassembles and reconstructs the addition chain in the traditional ITA modular inversion algorithm to construct a partially parallel modular inversion calculation method that also adopts the interleaving mechanism; the partially parallel modular inversion algorithm proposed by the arithmetic logic unit of the two-way interleaving mechanism also constructs an addition chain for (m-1), but unlike the traditional ITA modular inversion algorithm, the addition chain is constructed from the least significant bit to the most significant bit, that is, m0>2→ <m1m0>2→...→ <m q-1 ...m1m0>2, this addition chain is the basic addition chain in Algorithm 10. This "reverse" basic addition chain provides an opportunity for partial parallelization of the modular multiplier. By observation, it can be found that an auxiliary addition chain needs to be built synchronously with the basic addition chain. <1> 2→ <10> 2→...→<10...00>2 to assist the accumulation process of the basic addition chain.

[0024] As described above, a high-performance point multiplication architecture based on a two-way interleaving mechanism is provided. The arithmetic logic unit of the two-way interleaving mechanism provides a partially parallel working mode of two addition chains: for the i-th iteration in the modular inverse operation, the basic addition chain needs to be <m i-1 m i-2 ...m1m0>2 to m i m i-1 ...m1m0>2 completes the accumulation, and at the same time, the auxiliary addition chain also completes the accumulation from bit i to bit i+1. In this process, if m i =0, then

[0025]

[0026] And if m i =1, then It can be accumulated according to the following relationship:

[0027]

[0028] at the same time, The accumulation can be completed by auxiliary addition chain in the following way:

[0029]

[0030] Based on the above analysis, it can be found that the auxiliary addition chain needs to complete accumulation in each round of iteration, while the basic addition chain only needs to complete accumulation in m i = 1, the accumulation is completed with the help of auxiliary addition chain. In the iterative process of the proposed modular inverse algorithm, the dedicated modular multiplier is scheduled to complete the accumulation of the auxiliary addition chain, and at the same time, i = 1, the interleaving module multiplier is scheduled to complete the accumulation of the basic addition chain; and when m i = 0, the basic addition chain remains unchanged. Since the partially parallel modular inversion algorithm proposed in this paper realizes the parallel splitting of the basic addition chain and the auxiliary addition chain, it has a significant advantage in reducing the number of clock cycles compared to the traditional ITA modular inversion algorithm.

[0031] The advantages of the present invention are:

[0032] This invention utilizes a dual-path interleaving mechanism, achieving superior throughput to existing designs and targeting high-performance computing applications. While achieving high throughput, the invention outperforms most existing designs, enabling a high-performance point multiplication architecture with minimal hardware overhead. Furthermore, the high-performance characteristics of this design are universally applicable across finite fields of varying sizes.

[0033] The present invention adopts a partially parallel modular inversion algorithm to solve the defect that the traditional ITA algorithm cannot fully utilize parallel computing resources, thereby improving the utilization rate of hardware resources.

[0034] The present invention adopts a heterogeneous multiplier design approach to optimize the critical path LUT delay in the dot product architecture. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following is a brief introduction to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0036] Figure 1 This is a schematic diagram of the high-performance point multiplication architecture based on the dual-path interleaving working mechanism of the present invention;

[0037] Figure 2 Schematic diagram of a high-performance point multiplication algorithm based on a two-way interleaving working mechanism of the present invention;

[0038] Figure 3 It is a schematic diagram of the structure of the arithmetic logic unit of the present invention;

[0039] Figure 4 A physical image of the Sakura-G side-channel analysis experimental environment of the present invention;

[0040] Figure 5 This is a schematic diagram of the connection of the Sakura-G side channel analysis experimental environment of the present invention;

[0041] Figure 6 Schematic diagram of a simple energy analysis experiment on mean energy trace using a sliding window method in the present invention;

[0042] Figure 7 This is a schematic diagram of detecting power consumption side channel leakage using a standard TVLA experiment for the proposed architecture of the present invention. DETAILED DESCRIPTION

[0043] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0044] like Figure 1 As shown, a high-performance point multiplication architecture based on a dual-path interleaving mechanism includes an arithmetic logic unit based on a dual-path interleaving mechanism, a phase-locked loop module, an arbiter, and an instruction memory;

[0045] The arithmetic logic unit based on the two-way interleaving mechanism includes three parallel modular multipliers, five modular squarers, five modular adders, and a series of registers and multiplexers. The three parallel arrangements include two dedicated multipliers (DMUL) and one interleaved multiplier (IMUL). The addresses of all the multiplexers of the modular multipliers together constitute the microinstructions of the arithmetic logic unit based on the two-way interleaving mechanism.

[0046] The phase-locked loop module is used to provide a global clock;

[0047] The arbiter can input scalar values k1 and k2 to the two scalar input ports according to the current working state of the arithmetic logic unit based on the two-way interleaving mechanism, so as to ensure that the two dot product data paths of the high-performance dot product architecture are always busy.

[0048] The instruction memory is used to store the operation instructions of the arithmetic logic unit based on the two-way interleaving mechanism.

[0049] Preferably, the high-performance dot product architecture described in this embodiment reserves a random number input port, which can be used to complete the randomization of the Z coordinate before each dot product operation to enhance the resistance of this architecture to DPA.

[0050] Preferably, the interleaved multiplier described in this embodiment is responsible for PA_MUL4 and PD_MUL2 in the two point multiplication operations, and the two professional multipliers are respectively responsible for the residual modular multiplication operations in the two point multiplication operations. The order of starting each round of iteration is to execute PA_MUL1 first and then PA_MUL2.

[0051] Preferably, the lookup table delay of the interleaved modular multiplier and the dedicated modular multiplier described in this embodiment is shown as follows:

[0052] D IMUL =D POW +D CM +D red +D add +D MUX

[0053] D DMUL =D split +D CM +D align +D red +D add +D MUX

[0054] Since the interleaving module multiplier adopts the CM architecture, the lookup table delay of the interleaving module multiplier with an m-bit width is For the dedicated modular multiplier, this paper adopts the KOM splitting strategy with the best area-delay ratio. 163 )、GF(2 283 ) and GF(2 571 ), θ is 3, 4 and 5 respectively

[0055] Preferably, the high-performance point multiplication algorithm in the arithmetic logic unit of the dual-path interleaving mechanism described in this embodiment uses the scalar k=[k (1) ,k (2) ] as input, the iterative link adopts an interleaved working mechanism. Two dedicated multipliers are responsible for their own point multiplication operations respectively. The interleaved multiplier is responsible for PA_MUL4 and PD_MUL2 in the two point multiplication operations. In order to distinguish the two point multiplication operations, P1(X1,Y1) and P2(X2,Y2) are a set of point values in one point multiplication operation, and P3(X3,Y3) and P4(X4,Y4) are another set of point values, among which P1(X1,Y1) and P3(X3,Y3) are equivalent, and P2(X2,Y2) and P4(X4,Y4) are equivalent.

[0056] Preferably, the high-performance dot multiplication algorithm in the arithmetic logic unit of the dual-path interleaving mechanism described in this embodiment includes an initialization stage, an accumulation stage, and a post-processing stage.

[0057] Preferably, the initialization requirements of the dot multiplication algorithm in the initialization phase of this embodiment are integrated into the accumulation phase, so that the output result of the first round of iteration in the accumulation phase is exactly the initialization requirement. In the proposed two-way interleaved mode dot multiplication algorithm, the initialization requirement is simplified to register assignment (1,0) and (x P ,1), after the first round of iteration, the coordinates of the two points calculated are exactly the required initialization requirements - (x P ,1) and (x P 4 +b,x P 2 ), of course, at the same time, the number of iterative cycles in the accumulation phase of the proposed two-way interleaved mode dot multiplication algorithm is increased by one compared to the Montgomery Ladder dot multiplication algorithm, so the computational complexity of the proposed two-way interleaved mode dot multiplication algorithm in the accumulation phase is 2m×(6M+5S+3A), where m, M, S, and A represent the finite field scale, modular multiplication operation, modular square operation, and modular addition operation, respectively. For the post-processing phase, this paper simultaneously completes the vertical coordinate restoration and modular inverse operation in the post-processing phase. The computational complexity of the post-processing phase after each dot multiplication operation in the proposed two-way interleaved mode dot multiplication algorithm is (10M+5A+I) (such as Figure 2 As shown, steps 29 to 34, and steps 35 to 39), wherein I represents a modular inverse operation, and the ordinate restoration and modular inverse operation adopt the ordinate restoration method after common denominator.

[0058] Preferably, in the accumulation phase described in this embodiment, X2Z1 (or X4Z3) and Z2X1 (or Z4X3) in each round of iteration of the dot multiplication operation are serially calculated in the first two clock cycles (st1 and st2) by a dedicated multiplier, so as to meet the highest priority PA_MUL1 and PA_MUL2 in the data dependency relationship; after the first two clock cycles, the calculation of the two modular multiplication operations in the dot multiplication operation is started. Since there is no data dependency between PA_MUL3 and PA_MUL4, and the multiple modular square operations on which the two depend can be performed in the first two clock cycles, The calculation is completed within the clock cycle, so a dedicated multiplier and an interleaved multiplier are arranged in st3 to complete the calculation of PA_MUL3 and PA_MUL4 in parallel. In the fourth clock cycle st4, the results of the modular multiplication operations PA_MUL1 and PA_MUL2 calculated in the first two clock cycles have been obtained. At the same time, considering that there is no data dependency between PA_MUL3 and PA_MUL4, a dedicated multiplier and an interleaved multiplier are also used to complete the calculation of the two in parallel. At the same time, the dual-path interleaved mode point multiplication algorithm only retains the scalar value corresponding to the current round before the doubling operation. The data is selected, and the algorithm is further refined by using the selection flag f = [f (0) ,f (1) ] controls the data gating for the accumulation and post-processing phases of the two dot products. The gating flags required for the (i-1)th iteration are determined before the end of the i-th iteration. Similarly, the gating flags for the post-processing phase are determined before the end of the last iteration of the accumulation phase. Furthermore, to ensure the correct initialization requirements are calculated during the first accumulation phase, the gating flags are set to f = [2, 4] during the initialization phase.

[0059] The traditional ITA modular inversion algorithm decomposes (m-1) from the most significant bit to the least significant bit, thereby converting the modular inversion operation into a series of modular multiplication operations and modular squaring operations on a finite field. Although the traditional ITA modular inversion algorithm is the most efficient modular inversion algorithm based on Fermat's little theorem, the decomposition method of (m-1) in the traditional ITA modular inversion algorithm causes a series of modular multiplication operations to have data dependencies, namely steps 2 to 9 in Algorithm 3. Therefore, the designer can only use one modular multiplier to calculate all modular multiplication operations in series, which is undoubtedly a waste of hardware resources and inefficient for the point multiplication hardware architecture with multiple multipliers. For the present invention, as shown in the post-processing stage in Algorithm 9, a total of two modular inversion operations need to be calculated independently to complete the coordinate transformation. If the present invention uses two dedicated modular multipliers to calculate the modular inversion operation in parallel based on the traditional ITA modular inversion, then the interleaved modular multiplier will always remain idle in the post-processing stage, which will lead to a more serious waste of hardware resources.

[0060] The high performance dot multiplication algorithm in the present invention is characterized by a two-way interleaving operation mode. Figure 2 As shown, during the accumulation phase, the present invention schedules an interleaved modular multiplier to work with two dedicated modular multipliers at fixed times, accelerating the iteration process through partially parallel computing. During the modular inverse calculation in the post-processing phase, the present invention inherits this dual-path interleaving mode and similarly accelerates the modular inverse calculation through partially parallel computing, thus addressing the aforementioned hardware resource waste issue.

[0061] Preferably, the arithmetic logic unit of the two-way interleaving mechanism described in this embodiment disassembles and reconstructs the addition chain in the traditional ITA modular inversion algorithm, thereby constructing a partially parallel modular inversion calculation method that also adopts the interleaving working mechanism; the partially parallel modular inversion algorithm proposed by the arithmetic logic unit of the two-way interleaving mechanism also constructs an addition chain for (m-1), but unlike the traditional ITA modular inversion algorithm, the construction direction of the addition chain is from the least significant bit to the most significant bit, that is, <m0> 2→ <m1m0>2→...→ <m q-1 ...m1m0>2, this addition chain is the basic addition chain in Algorithm 10. This "reverse" basic addition chain provides an opportunity for partial parallelization of the modular multiplier. By observation, it can be found that an auxiliary addition chain 1>2→ needs to be built synchronously with the basic addition chain. <10> 2→...→<10...00>2 to assist the accumulation process of the basic addition chain.

[0062] Preferably, the arithmetic logic unit of the two-way interleaving mechanism described in this embodiment provides a partially parallel working mode of two addition chains: for the i-th iteration in the modular inverse operation, the basic addition chain needs to be i-1 m i-2 ...m1m0>2 direction <m i m i-1 ...m1m0>2 completes the accumulation, and at the same time, the auxiliary addition chain also completes the accumulation from bit i to bit i+1. In this process, if m i =0, then

[0063]

[0064] And if m i =1, then It can be accumulated according to the following relationship:

[0065]

[0066] at the same time, The accumulation can be completed by auxiliary addition chain in the following way:

[0067]

[0068] Based on the above analysis, it can be found that the auxiliary addition chain needs to complete accumulation in each round of iteration, while the basic addition chain only needs to complete accumulation in m i = 1, the accumulation is completed with the help of auxiliary addition chain. Figure 2 As shown, in the iterative process of the proposed modular inverse algorithm (steps 3 to 10), the dedicated modular multiplier is scheduled to complete the accumulation of the auxiliary addition chain (steps 8 and 9), and at the same time i = 1, the interleaving module multiplier is scheduled to complete the accumulation of the basic addition chain (steps 5 and 6). i = 0, the basic addition chain remains unchanged. Since the partially parallel modular inversion algorithm proposed in this paper realizes the parallel splitting of the basic addition chain and the auxiliary addition chain, it has a significant advantage in reducing the number of clock cycles compared to the traditional ITA modular inversion algorithm.

[0069] Implementation results and comparison

[0070] (1) Throughput and Performance Analysis

[0071] Since this architecture can perform two point multiplications simultaneously, to provide a fair comparison with existing designs, this paper uses the point multiplication throughput as an evaluation metric. Hardware circuit throughput is defined as the amount of data that can be processed per unit time. Since this architecture uses an iterative calculation strategy rather than a full pipeline, the point multiplication throughput is calculated as follows:

[0072]

[0073] Among them, T total is the total latency, which is the product of the total number of clock cycles and the operating frequency. The total number of clock cycles includes the clock cycles for the dot product operation and the pipeline delay clock cycles. Given that the multiplier in this invention uses a two-stage pipeline design, the pipeline delay is fixed at two clock cycles. The operating frequency is calculated based on the actual clock constraints within the EDA tool.

[0074] According to Algorithm 9, the clock cycle cost of the dot product operation consists of two parts: the accumulation phase and the post-processing phase. For the accumulation phase, the iterative process has a clock cycle cost of (4 × m + 2) (two clock cycles of pipeline latency). For the post-processing phase, restoring the Y coordinate in the projected coordinate system requires 10 modular multiplications, or 12 clock cycles (also including two clock cycles of pipeline latency). When executing the partially parallel modular inversion algorithm, a modular quarticizer is used for fast accumulation to reduce the clock cycle cost. The clock cycle components of the dot product operation on three common finite fields are shown in Table 5.4.

[0075] Table 5.4 Clock cycle number composition

[0076]

[0077] To evaluate the tradeoff between resource overhead and throughput of the dot product architecture, this article uses the ratio of throughput to FPGA hardware resource overhead as a performance metric. The calculation method is as follows, where #Slices is provided directly by the EDA tool and throughput is calculated using the above formula.

[0078]

[0079] Security Analysis

[0080] In order to verify the anti-side channel capability of the present invention, the present invention uses the Sakura-G side channel analysis and evaluation platform to conduct experiments. The actual experimental environment is shown in the figure below. Figure 4 As shown, the connection diagram is as follows Figure 5 shown.

[0081] Using Xilinx ISE 14.7 EDA tool, GF (2 163 ) is implemented with a clock constraint of 25 MHz and downloaded and deployed on the main FPGA of the Sakura-G side channel analysis and evaluation platform. Since the high-performance dot multiplication architecture proposed in the present invention has the function of randomizing the Z coordinate, a linear feedback shift register (LFSR) is additionally integrated in the original control FPGA to generate a pseudo-random number as the Z coordinate. The high-performance dot multiplication architecture on the main FPGA replaces the initialized Z coordinate value each time a dot multiplication operation is performed. The oscilloscope used to collect energy waveforms is a PicoScope 3000 Series USB oscilloscope, which is triggered by the "busy" signal of the main FPGA to collect waveforms. Based on the Sakura-G side channel analysis and evaluation platform and the commercial side channel analysis software in the host computer, a simple energy analysis experiment and a test vector leakage assessment (TVLA) experiment were performed on the high-performance dot multiplication architecture proposed in the present invention.

[0082] The basic principle of simple energy analysis experiment follows the classic literature. The specific experimental process is as follows: Figure 6 As shown. In this experiment, a total of 10 energy traces were collected. After the energy traces were aligned using the host computer, the mean of each point was calculated to form the mean energy trace. The sliding window size was selected to be slightly larger than half of the iterative process of the dot multiplication operation, and the correlation analysis of the mean energy trace was performed by sliding the window. The experimental results are the correlation heat map shown in Figure 6 As shown on the right. Since point addition and doubling operations occur periodically during the iterative process of point multiplication, simple energy analysis attacks aim to distinguish between point addition and doubling operations through observation. However, since the high-performance point multiplication algorithm proposed in this invention includes one point addition and one doubling operation in each round of operations, and there is no clear separation between the main operators (modular multiplication operations) of the two operations, but rather they are mixed together, attempting to use a simple energy analysis attack on this architecture is ineffective. This is reflected in the correlation heat map, where the pattern of bright and dark stripes corresponding to each iteration is the same, making it impossible to distinguish the stripes belonging to the point addition or doubling operation.

[0083] This invention protects against differential energy analysis attacks through externally input randomized Z coordinates. By enabling the LFSR module in the FPGA, the main FPGA obtains a randomized Z coordinate value at the beginning of each dot product operation and initiates the iterative dot product process based on this coordinate value. To analyze the resistance of the randomized Z coordinate approach to differential energy analysis, this paper uses the international standard TVLA experiment. Recently, Jayasena has discussed the difficulty of waveform alignment in the standard TVLA experiment. In this experiment, to achieve precise waveform alignment for TVLA experiments, the dot product architecture uses a low operating frequency (25MHz), which is far lower than the oscilloscope's sampling frequency. Furthermore, a "busy" signal is used to accurately indicate the entire dot product execution process, triggering accurate sampling by the oscilloscope. Furthermore, commercial side-channel analysis software in the host computer features automatic alignment within a small range (10 sampling points on each side).

[0084] The process and results of TVLA implementation are as follows Figure 7 This experiment sets two groups of contrast waveforms. Group A has a fixed scalar value k for the dot multiplication operation. fixed , Group B uses a random scalar value k rand , 100,000 energy traces were collected from each group. First, all energy traces in groups A and B were aligned point by point, and then the mean μ and standard deviation s of the 100,000 points were calculated point by point. Finally, the mean and standard deviation were calculated using the t-test in the standard TVLA. The absolute value |t| of the t-test result was calculated as follows: Figure 7 As shown in the upper right corner. According to the requirements of the standard TVLA test, if the |t| of all points does not exceed 4.5, the confidence level of passing the TVLA test reaches 99.999%, which means that this architecture has no differential energy analysis leakage in the TVLA test. The experimental results show that the highest level of |t| of this architecture is close to 2.0, so

[0085] The calculated results of some points are all lower than 4.5. Therefore, this architecture has the ability to resist differential energy analysis by randomizing the Z coordinate.

[0086] (3) Comparison and analysis of experimental results

[0087] To ensure a fair comparison with existing similar designs, the high-performance dot-product architecture proposed in this paper, based on a dual-path interleaving mechanism, was implemented on a Xilinx Virtex-7 series FPGA, using Vivado 2023.2 as the EDA tool. During the design process, multiple synthesis passes were performed by varying the synthesis implementation strategy and adjusting constraints to find the optimal design.

[0088] In GF(2 163 ), GF(2 283 ) and GF(2 571 ) three finite fields, the irreducible polynomial is a pentaminum, and in GF(2 233 ) and GF(2 409 ) two finite fields are irreducible polynomials that are trinomials, so in GF(2 233 ) and GF(2 409 ) are more concise. In order to measure the performance of the present invention in complex situations and make a fair comparison with existing designs, the present invention is used in GF(2 163 ), GF(2 283 ) and GF(2 571 ) are implemented on three finite fields. Of course, the present invention is also capable of being ported to other finite fields. The implementation results of the present invention and those of similar existing designs are summarized in Tables 5.5 and 5.6, where the results of the present invention are in bold to distinguish them.

[0089] In GF(2 163 ), the operating frequency of the present invention can reach 366MHz, the hardware resource overhead is 8762 slices, and the throughput of the dot multiplication operation is 158.03Mbps; in GF(2 283 ), the operating frequency of the present invention can reach 317MHz, the hardware resource overhead is 20451 slices, and the throughput of the dot multiplication operation is 138.23Mbps; in GF(2 571 ), the operating frequency of the present invention can reach 267MHz, the hardware resource overhead is 41974 slices, and the throughput of the dot multiplication operation is 117.50Mbps.

[0090] It should be noted that, considering the finite field GF(2 233 ) and GF(2 283 ) is similar in size. Table 5.6 also lists the 233 ) is provided as a reference, but considering the differences in the reduction polynomials and the width of the operands, the finite field GF(2 233 ) The implementation results of existing designs are not included in the specific comparison process. Some existing designs in Table 5.5 and Table 5.6 do not provide some parameters, which are marked with horizontal lines in the table. For the key parameter #Slice, if the existing design does not report, the prediction method is used. To calculate the key parameter #Slice for evaluating performance indicators. In addition, Table 5.7 lists the present invention in GF(2 163 ), GF(2 283 ) and GF(2 571 The hardware resource overhead of the main operation modules (KOM architecture multiplier, CM architecture multiplier, and modular squarer) on three finite fields is shown in Figure 2. On each finite field, two KOM architecture multipliers and one CM architecture multiplier each account for 90% of the total hardware resource overhead.

[0091] Table 5.5 Comparison of experimental data on Virtex-7 platform (GF(2 163 ))

[0092]

[0093] -: This document does not provide this data

[0094] *: This result is an estimated result

[0095] This result is based on an estimated #Slice

[0096] Table 5.6 Comparison of experimental data on Virtex-7 platform (GF(2 233 ), GF(2 283 ) and GF(2 571 ))

[0097]

[0098] 1. This document does not provide this data

[0099] *: This result is an estimated result

[0100] This result is based on an estimated #slice

[0101] Table 5.7 Hardware resource composition

[0102]

[0103] Since the present invention adopts a dual-path interleaving mechanism, the throughput rate is relatively high. The throughput rate index of the present invention is better than all existing designs in Table 5.5 and Table 5.6. 163 ), GF(2 283 ) and GF(2 571 ), compared with SOTA (Salarifard design, Li design and Li design), they are improved by 45%, 52% and 40% respectively. Among them, the existing designs are all oriented to high-performance computing application scenarios, which are similar to the application scenarios of the present invention. Some designs are oriented to resource-constrained or low-power application scenarios, such as the Internet of Things, but from the perspective of hardware circuit design, the compromise between hardware resource overhead and performance is still of reference value. The throughput of the point multiplication operation architecture can be simply improved by running multiple PEs in parallel. However, applying this naive method on FPGA will lead to a tense layout and routing process, which will lead to a decrease in operating frequency and a decrease in overall performance indicators.

[0104] From the perspective of performance indicators jointly constructed by throughput and hardware resource overhead, the present invention adopts a dual-path interleaving working mechanism. Under the premise of achieving high throughput, the performance indicators of the present invention are better than those of other designs in Table 5.5 and Table 5.6 except Salarifard design and Kumar design. 163 ), the performance index of the present invention lags behind that of the Salarifard design and the Kumar design by only a small margin (within 5%); in GF(2 283 ), the present invention has established a slight lead over the Kumar design. In engineering practice, this slight lag may be caught up by further optimizing the Verilog coding style and EDA synthesis implementation strategy, so the three can be considered to be at the same level. In addition, considering that the hardware resource overhead (#Slice) of the Salarifard design and the Kumar design is much smaller than that of the present invention, the present invention can still be regarded as a technical solution for realizing a high-performance point multiplication operation architecture under the premise of a large amount of overhead hardware resources. In particular, the Kumar design, as a point multiplication operation architecture for small area and low power consumption, adopts a hybrid KOM architecture multiplier to achieve higher performance. The Kumar design point multiplication architecture has high performance in small and medium finite fields (GF(2 163 ), GF(2 283 ) and GF(2 571 )) is implemented in hardware and in GF(2 163 ) and GF(2 283 ) two finite fields, the performance indicators of the present invention are ahead of each other, but the gap does not exceed 5%; but at the same time, the present invention has no significant difference in the large finite field GF(2 571 ) also leads the existing designs, so the high-performance characteristics of the present invention have better universality on finite domains of different sizes.

[0105] Furthermore, existing designs, such as the Salarifar design and the Zhang design, both employ a dot multiplication acceleration strategy based on Comb pre-computation. This pre-computation strategy can significantly increase the speed of dot multiplication operations when the base point is relatively fixed. However, when the base point varies, particularly in extreme cases where the base point changes for every dot multiplication operation, the advantages of this pre-computation strategy are severely limited. In contrast, the present invention does not rely on a fixed base point to accelerate dot multiplication operations. Even if the base point changes for each dot multiplication operation, the present invention can still maintain the same high throughput.

[0106] In terms of power consumption, the present invention uses Xilinx Power Estimator to evaluate the power consumption of the dot product architecture. When the ambient temperature is set to 60°C and the FPGA supply voltages are set to typical values (VCCINT = 1.000V, VCCAUX = 1.800V), the estimated total on-chip power consumption of the dot product architecture of the present invention on three finite fields is shown in Table 5.8. The operating frequency and estimated total on-chip power consumption of the present invention are both at a relatively high level, but considering that the heat dissipation measures in the high-performance application scenarios of the present invention are generally more complete, the power consumption level of the present invention is acceptable.

[0107] Table 5.8 Power consumption analysis results and comparison

[0108]

[0109] In terms of the portability and compatibility of the point multiplication architecture, the arithmetic logic unit architecture based on the dual-path interleaving mechanism of the present invention does not use the IP core provided by Xilinx, so the present invention has strong portability to ASIC. In addition, the present invention is a dedicated point multiplication operation architecture for fixed finite fields, and the finite field of operation of this architecture can be changed by the method of FPGA static reconstruction. In actual engineering practice, a compatible architecture can also be used to enable this architecture to support finite fields of different sizes, such as using a pulsating array multiplier array to expand the multiplication bit width. In this case, larger-scale FPGA devices are usually used, such as XilinxVU13P, etc., to meet the hardware resource overhead and layout and wiring requirements of the design. In order to make a fair comparison with the existing design, the present invention adopts a finite field-specific point multiplication operation architecture similar to the existing design.

[0110] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention. < / m0>

Claims

1. A high-performance point multiplication architecture based on a two-way interleaving mechanism, characterized by: It includes an arithmetic logic unit, a phase-locked loop module, an arbiter, and an instruction memory based on a two-way interleaving mechanism; The arithmetic logic unit based on the two-way interleaving mechanism includes three parallel modular multipliers, five modular squarers, five modular adders, and a series of registers and multiplexers. The three parallel arrangements include two dedicated multipliers and one interleaved multiplier. The addresses of all the multiplexers of the modular multipliers together constitute the microinstructions of the arithmetic logic unit based on the two-way interleaving mechanism. The phase-locked loop module is used to provide a global clock; The arbiter can input scalar values k1 and k2 to the two scalar input ports according to the current working state of the arithmetic logic unit based on the two-way interleaving mechanism, so as to ensure that the two dot product data paths of the high-performance dot product architecture are always busy. The instruction memory is used to store the operation instructions of the arithmetic logic unit based on the two-way interleaving mechanism.

2. The high-performance point multiplication architecture based on a dual-path interleaving mechanism according to claim 1, characterized in that: The high-performance dot product architecture reserves a random number input port, which can be used to randomize the Z coordinate before each dot product operation to enhance the architecture's resistance to DPA.

3. The high-performance point multiplication architecture based on a dual-path interleaving mechanism according to claim 1, characterized in that: The interleaved multiplier is responsible for PA_MUL4 and PD_MUL2 in the two point multiplication operations, and the two professional multipliers are respectively responsible for the residual modular multiplication operations in the two point multiplication operations. The order of starting each round of iteration is to execute PA_MUL1 first and then PA_MUL2.

4. The high-performance point multiplication architecture based on a dual-path interleaving mechanism according to claim 3, characterized in that: The lookup table delays of the interleaved modular multiplier and the dedicated modular multiplier are shown below: D IMUL =D POW +D CM +D red +D add +D MUX D DMUL =D split +D CM +D align +D red +D add +D MUX Since the interleaving module multiplier adopts the CM architecture, the lookup table delay of the interleaving module multiplier with an m-bit width is For the dedicated modular multiplier, this paper adopts the KOM splitting strategy with the best area-delay ratio. 163 )、GF(2 283 ) and GF(2 571 ), θ is 3, 4 and 5 respectively.

5. The high-performance point multiplication architecture based on a dual-path interleaving mechanism according to claim 1, characterized in that: The high performance point multiplication algorithm in the arithmetic logic unit of the dual-way interleaving mechanism uses two scalars k=[k (1) ,k (2) ] as input, the iterative link adopts an interleaved working mechanism. Two dedicated multipliers are responsible for their own point multiplication operations respectively. The interleaved multiplier is responsible for PA_MUL4 and PD_MUL2 in the two point multiplication operations. In order to distinguish the two point multiplication operations, P1(X1,Y1) and P2(X2,Y2) are a set of point values in one point multiplication operation, and P3(X3,Y3) and P4(X4,Y4) are another set of point values, among which P1(X1,Y1) and P3(X3,Y3) are equivalent, and P2(X2,Y2) and P4(X4,Y4) are equivalent.

6. The high-performance point multiplication architecture based on a dual-path interleaving mechanism according to claim 5, characterized in that: The high-performance dot multiplication algorithm in the arithmetic logic unit of the dual-path interleaving mechanism includes an initialization stage, an accumulation stage, and a post-processing stage.

7. The high-performance point multiplication architecture based on a dual-path interleaving mechanism according to claim 6, characterized in that: The initialization requirements of the initialization phase dot multiplication algorithm are integrated into the accumulation phase, so that the output result of the first round of accumulation phase is exactly the initialization requirement. In the proposed two-way interleaved mode dot multiplication algorithm, the initialization requirement is simplified to register assignment (1,0) and (x P ,1), after the first round of iteration, the coordinates of the two points calculated are exactly the required initialization requirements - (x P ,1) and (x P 4 +b,x P 2 ), of course, at the same time, the number of iterations in the accumulation phase of the proposed two-way interleaved dot multiplication algorithm increases by one compared to the Montgomery Ladder dot multiplication algorithm. Therefore, the computational cost of the proposed two-way interleaved dot multiplication algorithm in the accumulation phase is 2m×(6M+5S+3A), where m, M, S, and A represent the finite field size, modular multiplication, modular squaring, and modular addition, respectively. For the post-processing phase, this paper simultaneously performs ordinate restoration and modular inversion operations. The computational cost of the post-processing phase after each dot multiplication operation in the proposed two-way interleaved dot multiplication algorithm is (10M+5A+I), where I represents the modular inversion operation. The ordinate restoration and modular inversion operations use the ordinate restoration method after common denominator.

8. The high-performance point multiplication architecture based on a dual-path interleaving mechanism according to claim 6, characterized in that: In the accumulation phase, X2Z1 (or X4Z3) and Z2X1 (or Z4X3) in each iteration of the dot multiplication operation are serially calculated in the first two clock cycles (st1 and st2) by a dedicated multiplier, so as to satisfy PA_MUL1 and PA_MUL2, which have the highest priority in the data relationship. After the first two clock cycles, the calculation of the two modular multiplication operations in the dot multiplication operation is started. Since there is no data dependency between PA_MUL3 and PA_MUL4, and the multiple modular square operations on which the two depend can be completed in the first two clock cycles, To complete the calculation, a dedicated multiplier and an interleaved multiplier are arranged in st3 to complete the calculation of PA_MUL3 and PA_MUL4 in parallel. In the fourth clock cycle st4, the results of the modular multiplication operations PA_MUL1 and PA_MUL2 calculated in the first two clock cycles have been obtained. At the same time, considering that there is no data dependency between PA_MUL3 and PA_MUL4, a dedicated multiplier and an interleaved multiplier are also used to complete the calculation of the two in parallel. At the same time, the dual-path interleaved mode point multiplication algorithm only retains the scalar value corresponding to the current round before the doubling point operation. The data is selected, and the algorithm is further refined by using the selection flag f = [f (0) ,f (1) ] controls the data gating in the accumulation and post-processing stages of the two dot products. The gating flags required for the (i-1)th iteration are determined before the end of the i-th iteration. Similarly, the gating flags for the post-processing stage are determined before the end of the last iteration of the accumulation stage. In addition, to ensure that the correct initialization requirements are calculated in the first round of the accumulation stage, the gating flags are set to f = [2, 4] during the initialization stage.

9. The high-performance point multiplication architecture based on a dual-path interleaving mechanism according to claim 1, characterized in that: The arithmetic logic unit of the two-way interleaving mechanism disassembles and reconstructs the addition chain in the traditional ITA modular inversion algorithm, thereby constructing a partially parallel modular inversion calculation method that also adopts the interleaving working mechanism; the partially parallel modular inversion algorithm proposed by the arithmetic logic unit of the two-way interleaving mechanism also constructs an addition chain for (m-1), but unlike the traditional ITA modular inversion algorithm, the construction direction of the addition chain is from the least significant bit to the most significant bit, that is, <m0> 2→ <m1m0>2→...→ <m q-1 ...m1m0>2, this addition chain is the basic addition chain in Algorithm 10. This "reverse" basic addition chain provides an opportunity for partial parallelization of the modular multiplier. By observation, it can be found that an auxiliary addition chain needs to be built synchronously with the basic addition chain. <1> 2→10>2→...→<10...00>2 to assist the accumulation process of the basic addition chain. < / m0> 10. The high-performance point multiplication architecture based on a dual-path interleaving mechanism according to claim 9, characterized in that: The arithmetic logic unit of the two-way interleaving mechanism provides a partially parallel working mode of two addition chains: for the i-th iteration in the modular inverse operation, the basic addition chain needs to be i-1 m i-2 ...m1m0>2 direction <m i m i-1 ...m1m0>2 completes the accumulation, and at the same time, the auxiliary addition chain also completes the accumulation from bit i to bit i+1. In this process, if m i =0, then And if m i =1, then It can be accumulated according to the following relationship: at the same time, The accumulation can be completed by auxiliary addition chain in the following way: Based on the above analysis, it can be found that the auxiliary addition chain needs to complete accumulation in each round of iteration, while the basic addition chain only needs to complete accumulation in m i = 1, the accumulation is completed with the help of the auxiliary addition chain. In the iterative process of the proposed modular inverse algorithm, the dedicated modular multiplier is scheduled to complete the accumulation of the auxiliary addition chain. i = 1, the interleaving module multiplier is scheduled to complete the accumulation of the basic addition chain; and when m i = 0, the basic addition chain remains unchanged. Since the partially parallel modular inversion algorithm proposed in this paper realizes the parallel splitting of the basic addition chain and the auxiliary addition chain, it has a significant advantage in reducing the number of clock cycles compared to the traditional ITA modular inversion algorithm.

Images