Decryption method capable of resisting side channel attack and multi-chip system

Abstract

The invention provides an anti-side channel attack decryption method and a multi-core system, and the technical scheme of the invention is that a private key at a fixed position in a Paillier algorithm is split into two types of key pairs based on a random number, and the method comprises the steps: splitting an index in the private key into a first private index and a second private index according to the random number, and splitting a coefficient in the private key into a first private coefficient and a second private coefficient according to the random number. And decryption is carried out according to the two secret key pairs obtained dynamically before each time of decryption, so that each time of modular exponentiation and modular multiplication does not have a fixed item, an attacker is difficult to obtain a fixed feature through side channel attack to capture the private key, and the protection effect on the side channel attack can be improved.

Description

Technical Field

[0001] This invention relates to the field of computer information technology, specifically to the intersection of information security and integrated circuit technology, and more specifically, to a decryption method and multi-core system resistant to side-channel attacks. Background Technology

[0002] The Paillier semi-homomorphic encryption scheme (Paillier algorithm for short) is an asymmetric encryption scheme first proposed by Pascal Paillier in 1999. Due to its support for additive homomorphism, it is widely used in privacy computing, blockchain, and cloud computing. The core feature of the Paillier algorithm is its support for additive homomorphism; that is, multiplying two ciphertexts and then decrypting the result is equivalent to the sum of the plaintexts. Specifically, if the plaintext is... and The encryption results are as follows: and The decryption operation is denoted as Then the following condition is met:

[0003]

[0004] In addition to its basic functions, Paillier semi-homomorphic encryption, like other asymmetric encryption schemes, also includes basic operations such as key generation, encryption, and decryption. Let the auxiliary L function be denoted as... The schematic flowcharts for each basic operation are as follows:

[0005] Key generation: Randomly select two independent large prime numbers and ,satisfy Calculate the modulus and ,in, Represents the greatest common divisor. Indicates the least common multiple. Select parameters. ,satisfy and calculate Finally, the public key was obtained. and private key .

[0006] Encryption operation: given plaintext Select random numbers Using public key Calculate the encrypted ciphertext :

[0007]

[0008] Decryption operation: Given ciphertext Using private key Calculate the decrypted plaintext :

[0009]

[0010] Most current research focuses on accelerating the computation of basic operations in the Paillier algorithm, neglecting protection against side-channel attacks. The Paillier algorithm typically relies on a single processing unit to perform encryption and decryption operations. Modular exponentiation and modular multiplication during decryption present security vulnerabilities, easily leaking power consumption and timing information. Attackers can exploit Simple Power Analysis (SPA) or Differential Power Analysis (DPA) attacks to obtain the private key during decryption and crack the encrypted information. Therefore, existing Paillier algorithms are susceptible to side-channel attacks during decryption, which could leak the private key and lead to the disclosure of sensitive information.

[0011] It should be noted that the background information presented here is only for illustrating relevant information about the present invention to aid in understanding the technical solution of the present invention, and does not imply that the relevant information is necessarily prior art. The relevant information was submitted and disclosed together with the present invention, and should not be considered prior art unless there is evidence that the relevant information was disclosed before the filing date of the present invention. Summary of the Invention

[0012] Therefore, the purpose of this invention is to overcome the shortcomings of the prior art and provide a decryption method and multi-core system resistant to side-channel attacks.

[0013] The objective of this invention is achieved through the following technical solution:

[0014] According to a first aspect of the present invention, a decryption method resistant to side-channel attacks is provided for decrypting ciphertext under the Paillier algorithm. The method includes: obtaining ciphertext, a modulus, a first private key pair, and a second private key pair, wherein the first private key pair includes a first private exponent and a second private exponent constructed based on a random number and an exponent in the original private key, and the second private key pair includes a first private coefficient and a second private coefficient constructed based on a random number and a coefficient in the original private key; performing a modular exponentiation operation based on the first private exponent, the modulus, and the ciphertext to obtain a first intermediate value; performing a modular exponentiation operation based on the second private exponent, the modulus, and the ciphertext to obtain a second intermediate value; multiplying the first and second intermediate values ​​and then taking the modulus by the square of the modulus to obtain a third intermediate value; calculating the third intermediate value using the L function, subtracting 1, and dividing by the modulus to obtain the L function value; performing a modular multiplication operation based on the L function value, the first private coefficient, and the modulus to obtain a decryption intermediate value; and performing a modular multiplication operation based on the decryption intermediate value, the second private coefficient, and the modulus to obtain the decrypted plaintext. This scheme can achieve at least the following beneficial technical effects: in the prior art, the private key... (That is, the exponent) is fixed at the exponent position of the modular exponentiation, while the private key contains The fixed position of the coefficients in the modular multiplication, which leaks information, can be used for side-channel attacks. Therefore, this invention proposes an improved decryption method for the Paillier algorithm. This method splits the fixed-position private key into two key pairs based on random numbers: the exponents in the private key are split into a first private exponent and a second private exponent, and the coefficients in the private key are split into a first private coefficient and a second private coefficient. Decryption is performed using these two dynamically obtained key pairs before each operation, ensuring that no fixed term is present in the modular exponentiation and modular multiplication. This makes it difficult for attackers to obtain fixed characteristics and capture the private key through side-channel attacks.

[0015] Optionally, either the first private index or the second private index is in The random number obtained by randomly selecting an integer, the sum of the first private exponent and the second private exponent, equals the exponent in the original private key, where, This represents the exponent in the original private key. This scheme can achieve at least the following beneficial technical effects: the first private exponent (or the second private exponent) is set to... The range is randomly generated positive integers. The second private exponent (or the first private exponent) is equal to the exponent in the original private key minus the first private exponent (or the second private exponent). This splits the original exponent into two private exponents, the first and the second, constructed based on random numbers. This prevents the original exponent from being directly used in each decryption, thus protecting the original exponent from side-channel attacks.

[0016] Optionally, the first and second private coefficients in the second private key pair are constructed as follows:

[0017]

[0018]

[0019] in, Indicates the first private coefficient. This represents the second private coefficient. In order to be in A random number obtained by randomly selecting an integer. This represents the modulo operation. Represents the modulus. express In modulus Multiplicative inverse, This represents the coefficient in the original private key. This scheme can achieve at least the following beneficial technical effects: This scheme uses random numbers... The original coefficients in the private key are split into a first private coefficient and a second private coefficient, so that the original coefficients in the private key are not directly used during each decryption, thus achieving protection against side-channel attacks on the original exponent.

[0020] Optionally, the method further includes: before decrypting the ciphertext, obtaining a first private key pair and a second private key pair from a private key store as a dynamic private key for decrypting the ciphertext. The private key store is pre-constructed in the following manner: multiple different first private key pairs are pre-constructed based on the exponent in the original private key, and multiple different second private key pairs are pre-constructed based on the coefficient in the original private key; and a confidential private key store is maintained, storing the multiple first private key pairs and multiple second private key pairs in the private key store. This scheme can achieve at least the following beneficial technical effects: the scheme can first construct multiple private key pairs and store them in a dynamic private key store. Before decrypting any ciphertext, a set of first and second private key pairs can be extracted from the private key store as a dynamic private key to further improve the protection against side-channel attacks.

[0021] Optionally, the decryption process corresponding to this method is represented as follows:

[0022]

[0023]

[0024]

[0025] ,in,

[0026]

[0027]

[0028] in, Indicates the first intermediate value. This indicates that the value is assigned. Indicates ciphertext, Indicates the first private index, This represents the modulo operation. Represents the modulus. Indicates the second intermediate value. This indicates the second private index. Indicates the third intermediate value. Represents the value of function L. Represents the L function, This indicates the intermediate value for decryption. Indicates the first private coefficient. This represents the second private coefficient. This represents the decrypted plaintext.

[0029] According to a second aspect of the present invention, a multi-core system is provided, comprising at least one control unit, one or more storage units, one or more random number units, multiple modular exponentiation units, and multiple modular multiplication units, wherein different units are disposed in different cores, wherein: the control unit is used to control the storage unit, random number unit, modular exponentiation unit, and modular multiplication unit to complete decryption; the storage unit is used to store multiple first private key pairs and multiple second private key pairs; the random number unit is used to generate random numbers, including random numbers required for calculating public and private keys, random numbers required for constructing first private key pairs, and another random number required for constructing second private key pairs; the modular exponentiation unit is used to perform modular exponentiation operations in the decryption process; and the modular multiplication unit is used to perform modular multiplication operations and calculations corresponding to the L function in the decryption process. This scheme can achieve at least the following beneficial technical effects: by implementing different functional units through multiple cores in the core system, the decryption operation is distributed in different cores, further increasing the difficulty of side-channel attacks and improving the protection effect.

[0030] Optionally, the control unit is configured to: before decrypting each ciphertext, randomly select a first number of modular exponentiation units and a second number of modular multiplication units according to the order of decryption operations, the first number of modular exponentiation operations, and the second number of modular multiplication operations, to construct a dynamic decryption path for the ciphertext on multiple cores; schedule the units on this dynamic decryption path to cooperate in sequence to complete the decryption process. This scheme can achieve at least the following beneficial technical effects: side-channel attackers often require a specific environment in which users read and use keys in a fixed and repetitive manner to decrypt, and attackers obtain private keys through side-channel attacks to decrypt private information. This scheme, by randomly selecting the functional units participating in the decryption of a ciphertext, constructs a dynamically changing decryption path for different ciphertexts, increasing the difficulty of implementing side-channel attacks and further improving the protection effect.

[0031] Optionally, the control module is also configured to: for any ciphertext, schedule at least a portion of idle cores outside the dynamic decryption path corresponding to the ciphertext to perform interference calculations not required for decryption during the decryption of the ciphertext. This scheme can achieve at least the following beneficial technical effects: side-channel attackers typically want as little behavior as possible in the attack environment other than the private information to be obtained (less interference), reducing the difficulty of obtaining private information. Therefore, this scheme schedules cores on the non-dynamic decryption path to perform interference calculations during the decryption process. By loading irrelevant loads and performing irrelevant calculations, it can confuse side-channel attackers and further improve the protection effect.

[0032] According to a third aspect of the present invention, an electronic device is provided, comprising: one or more processors; and a memory for storing executable instructions; wherein the one or more processors are configured to implement the steps of the method described in the first aspect by executing the executable instructions. Attached Figure Description

[0033] The embodiments of the present invention will be further described below with reference to the accompanying drawings, wherein:

[0034] Figure 1 This is a flowchart illustrating a decryption method for resisting side-channel attacks according to an embodiment of the present invention;

[0035] Figure 2 This is a schematic diagram of a multi-core system according to an embodiment of the present invention. Detailed Implementation

[0036] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and are not intended to limit the invention.

[0037] As mentioned in the background section, the existing Paillier algorithm is vulnerable to side-channel attacks during the decryption process, which could leak the private key and lead to the disclosure of confidential information. To illustrate, the original algorithm requires calculating a modular exponent with a fixed power during the decryption process. Modular multiplication with fixed terms Among them, those located in the fixed items and This is the private key for the Paillier encryption scheme. Attackers can use side-channel attacks to obtain the energy or timing characteristics of this fixed pattern, and thus recover the key. Therefore, this invention proposes an improved decryption method that splits the fixed-position private key into two key pairs based on random numbers. This includes splitting the exponent in the private key into a first private exponent and a second private exponent based on random numbers, and splitting the coefficient in the private key into a first private coefficient and a second private coefficient based on random numbers. Before each decryption, decryption is performed using the two dynamically obtained key pairs, ensuring that each modular exponentiation and modular multiplication has no fixed terms, making it difficult for attackers to obtain fixed characteristics for side-channel attacks.

[0038] Before describing the embodiments of the present invention in detail, some of the terms used therein are explained as follows:

[0039] Plain text refers to the data to be encrypted.

[0040] Ciphertext refers to the result obtained by encrypting plaintext using the Paillier algorithm.

[0041] The raw private key refers to the private key constructed by the Paillier algorithm itself. Typically, this private key is represented as... ,in, This represents the exponent in the original private key. This represents the coefficient in the original private key.

[0042] Although this invention improves the decryption method in the Paillier algorithm to reduce the risk of data leakage caused by side-channel attacks during the decryption process, the following illustrative explanations will cover key generation, private key store, encryption, and decryption processes to facilitate a more intuitive and comprehensive understanding of the entire improved Paillier algorithm workflow.

[0043] I. Key Generation

[0044] For the sender and receiver to communicate, the receiver needs to generate a key before communication. The key generation process can refer to the original Paillier algorithm. Illustratively, the key generation process includes:

[0045] Randomly select two independent large prime numbers and ,satisfy ,in, and All are positive integers. This represents the greatest common divisor; it should be understood that in cryptography, large prime numbers... and It's clear that this doesn't refer to size in a mathematical sense, but rather to the infeasibility of brute-force factorization. With technological advancements and improved computer processing performance, large prime numbers... and The specific size can be determined based on the computer's capabilities and the required security level for encrypted data during product implementation. There has been much research in this field, and this invention does not impose any limitations on it.

[0046] Calculate the modulus Sum of Indices ,in, Indicates the least common multiple;

[0047] Select parameters ,satisfy And calculate the coefficients. .

[0048] according to , , and Construct a key that contains the public key. and private key .

[0049] The public key can be published to anyone; for example, the recipient can distribute the public key to various senders to encrypt data, obtaining ciphertext. The sender then sends the ciphertext to the recipient over the network. The private key is kept secret by the recipient and stored locally for decrypting data.

[0050] II. Private Key Store

[0051] In the prior art, the private key is directly used to decrypt data, while the private key of the present invention is not directly used to decrypt data, but is first used to create a private key store.

[0052] According to one embodiment of the present invention, the private key store is constructed in advance in the following manner:

[0053] A1. Based on the exponent in the original private key Pre-construct multiple different first private key pairs, including:

[0054] A11, in The random number obtained by randomly selecting an integer is used as the first private exponent. ;

[0055] A12. Transfer the exponent from the original private key. Subtract the first private index Obtain the corresponding second private index , is represented as: , will the first private index and its corresponding second private index The association serves as a first private key pair { , };

[0056] A13. Return to step A11 and execute steps A11 and A12 a total of Z times to obtain Z first private key pairs.

[0057] It should be understood that, as an alternative implementation, step A11 above may also include... The random number obtained by randomly selecting an integer is used as the second private exponent. Then A12 is changed to the exponent in the original private key. Subtract the second private index Obtain the corresponding first private index , is represented as: .

[0058] A2. Construct multiple different second private key pairs in advance based on the coefficients in the original private key, including:

[0059] A21, in Random numbers obtained by randomly selecting integers ;

[0060] A22. Based on the random number obtained in step A21 Determine the first private coefficient Second private coefficient As a second private key pair { , },in, , , This represents the modulo operation. Represents the modulus. express In modulus Multiplicative inverse, This represents the coefficient in the original private key;

[0061] A23. Return to step A21 and execute steps A21 and A22 a total of X times to obtain X first private key pairs. The values ​​of X and Z can be the same or different, and this invention does not impose any restrictions on this.

[0062] A3. Maintain a confidential private key store, storing multiple first private key pairs and multiple second private key pairs in the private key store.

[0063] According to one embodiment of the present invention, the private key store is located locally on the sender's site. Before decrypting a piece of ciphertext each time, a first private key pair and a second private key pair are extracted from the private key store for that ciphertext.

[0064] III. Encryption Process

[0065] Given plaintext Select random numbers Using public key Calculate the encrypted ciphertext :

[0066]

[0067] Among them, random numbers The range of values ​​is .

[0068] IV. Decryption Process

[0069] According to one embodiment of the present invention, see Figure 1 This invention provides a decryption method resistant to side-channel attacks, comprising steps S1-S7. To better understand this invention, each step is described in detail below with reference to specific embodiments.

[0070] Step S1: Obtain the ciphertext, modulus, first private key pair, and second private key pair, wherein the first private key pair contains a first private exponent and a second private exponent constructed based on the exponent in the random number and the original private key, and the second private key pair contains a first private coefficient and a second private coefficient constructed based on the coefficient in the random number and the original private key.

[0071] According to one embodiment of the present invention, after obtaining the ciphertext from the sender, the public key is used... Obtain the modulus The first and second private key pairs are obtained from the private key store. That is, the first and second private key pairs are extracted / obtained from multiple pre-computed first and second private key pairs stored in the private key store. The implementation methods for obtaining the first and second private key pairs from the private key store each time can also vary.

[0072] For example, for each ciphertext, a first private key pair can be obtained from Z first private key pairs and a second private key pair can be obtained from X second private key pairs in a polling manner.

[0073] Alternatively, a first private key pair and a second private key pair can be extracted for decryption of a preset number of ciphertexts (e.g., every 5, 10, or 20 ciphertexts). Once the preset number of ciphertexts has been decrypted, a new first private key pair and a second private key pair can be extracted.

[0074] Alternatively, to improve resistance to attacks, for each ciphertext, one first private key pair can be randomly selected from Z first private key pairs and one second private key pair can be randomly selected from X second private key pairs to decrypt the ciphertext.

[0075] Alternatively, if there is enough storage space, each time a first private key pair and a second private key pair are extracted, they can be permanently invalidated. When the private key pairs in the private key store are exhausted, they can be replenished in the manner described above.

[0076] Alternatively, after extracting a first private key pair and a second private key pair each time, you can set them to be unobtainable again within a specified period (such as a preset duration t or number of extractions w) to further enhance security.

[0077] Step S2: Perform modular exponentiation based on the first private exponent, the modulus, and the ciphertext to obtain the first intermediate value.

[0078] According to one embodiment of the present invention, the first intermediate value Calculate as follows:

[0079]

[0080] in, This indicates that the value is assigned. Indicates ciphertext, Indicates the first private index, This represents the modulo operation. Represents the modulus.

[0081] Step S3: Perform modular exponentiation based on the second private exponent, the modulus, and the ciphertext to obtain the second intermediate value.

[0082] According to one embodiment of the present invention, the second intermediate value Calculate as follows:

[0083]

[0084] in, Indicates ciphertext, This indicates the second private index. This represents the modulo operation. Represents the modulus.

[0085] Step S4: Multiply the first intermediate value and the second intermediate value, and then take the modulus of the square of the modulus to obtain the third intermediate value.

[0086] According to one embodiment of the present invention, the third intermediate value Calculate as follows:

[0087]

[0088] in, Indicates the first intermediate value. Indicates the second intermediate value. This represents the modulo operation. Represents the modulus.

[0089] Step S5: Calculate the third intermediate value of the L function, subtract 1, and divide by the modulus to obtain the value of the L function.

[0090] According to one embodiment of the present invention, the value of the L function is calculated in the following manner:

[0091] ,in,

[0092] in, Represents the value of function L. Represents the L function, Indicates the third intermediate value. Represents the modulus.

[0093] Step S6: Perform modular multiplication based on the L function value, the first private coefficient, and the modulus to obtain the decryption intermediate value.

[0094] According to one embodiment of the present invention, decrypting intermediate values Calculate as follows:

[0095]

[0096] in, Represents the value of function L. Indicates the first private coefficient. This represents the modulo operation. Represents the modulus.

[0097] Step S7: Perform modular multiplication based on the decryption intermediate value, the second private coefficient, and the modulus to obtain the decrypted plaintext.

[0098] According to one embodiment of the present invention, the decrypted plaintext Calculate as follows:

[0099]

[0100] in, This indicates the intermediate value for decryption. This represents the second private coefficient. This represents the modulo operation. Represents the modulus.

[0101] According to an example of the present invention, the illustrative decryption algorithm corresponding to the decryption process is shown in the following table:

[0102]

[0103] The meanings of the letters in this table can be found in the previous text and will not be repeated here.

[0104] According to one embodiment of the present invention, the above decryption process can be executed on a general-purpose processor or a single chip. However, a single processor or single chip has a performance bottleneck: most existing Paillier semi-homomorphic encryption systems are based on Field-Programmable Gate Arrays (FPGAs) or single-chip Application-Specific Integrated Circuits (ASICs). Due to manufacturing process limitations, the design of a single processor / single chip cannot meet the requirements of large-scale modular multiplication and exponentiation parallel computation, resulting in insufficient throughput of the encryption system. To further improve the effectiveness against side-channel attacks and / or increase the decryption speed, the decryption process can be ported to a multi-chip system. See also Figure 2 This paper presents a multi-core system, where each box represents a functional unit implemented by a core. Blue arrows indicate data paths, and red arrows indicate control signal paths. The multi-core system includes at least one control unit, one or more storage units, one or more random number units, multiple modular exponentiation units, and multiple modular multiplication units. Different units are located in different cores. Specifically: the control unit controls the storage unit, random number unit, modular exponentiation unit, and modular multiplication unit to complete decryption; the storage unit sets up a private key store to store the original private key, multiple first private key pairs, and multiple second private key pairs; the random number unit generates random numbers, including random numbers needed to calculate the public and private keys, random numbers needed to construct the first private key pairs, and another random number needed to construct the second private key pairs; the modular exponentiation unit performs modular exponentiation operations during decryption; and the modular multiplication unit performs modular multiplication operations and the calculation of the L function during decryption. The system contains five basic units: control unit, storage unit, random number unit, modular exponentiation unit, and modular multiplication unit. The modular exponentiation unit and modular multiplication unit have multiple repeated instances as computational units to improve computational efficiency.

[0105] According to one embodiment of the present invention, the control unit is configured to: before decrypting each ciphertext, randomly select a first number of modular exponentiation units and a second number of modular multiplication units based on the order of decryption operations, a first number of modular exponentiation operations, and a second number of modular multiplication operations to construct a dynamic decryption path for the ciphertext on multiple cores; and schedule the units on the dynamic decryption path to cooperate in sequence to complete the decryption process. Illustratively, the control unit is responsible for organizing the computation path (dynamic decryption path) and scheduling the units to work collaboratively; the modular multiplication units and modular exponentiation units, as computation units, are responsible for efficiently completing modular multiplication and modular exponentiation operations. In addition, the modular multiplication units are also responsible for calculating... The function uses a signal to control whether to continue using the result for calculation after calculating the modular multiplication result. The function, where the third intermediate value is used to calculate the result after each modular multiplication. The function; the storage unit is responsible for storing the randomly split private key pair, where a positive integer is randomly selected after key generation. and Calculate several and multiple The data is saved to the storage unit; the random number unit is responsible for providing the random numbers required for key generation and random splitting. Physically Unclonable Functions (PUF) technology can be used to ensure sufficient randomness in the generated results. This scheme achieves at least the following beneficial technical effects: Side-channel attackers often require a specific environment where users read and decrypt keys in a fixed and repetitive manner. Attackers obtain the private key through a side-channel attack to decrypt private information. This scheme, by randomly selecting the functional units involved in decrypting a ciphertext, constructs a dynamically changing decryption path for different ciphertexts, increasing the difficulty of implementing side-channel attacks and further enhancing the protection effect.

[0106] According to one embodiment of the present invention, the control module is further configured to: for any ciphertext, schedule at least a portion of the idle cores outside the dynamic decryption path corresponding to the ciphertext to perform interference calculations not required for decryption during the decryption of the ciphertext. For example, assuming that the dynamic decryption path of ciphertext m involves cores 2, 4, 5, 8, and 9, and the idle cores include cores 0, 1, 3, 6, and 7. Several designated cores, such as cores 1 and 6, are randomly selected from the idle cores. During the decryption of ciphertext m by cores 2, 4, 5, 8, and 9, cores 1 and 6 perform interference calculations not required for decryption. Adding random load interference further improves the randomness of energy and timing information, which can effectively combat side-channel attacks by attackers.

[0107] According to an embodiment of the present invention, the scheduling method of a multi-core system includes: K1, firstly, determining the order of operations to be performed based on the type of operation (including key generation, encryption, and decryption), and randomly selecting a corresponding number of modular multiplication units and modular exponentiation units to form a data path (divided into dynamic encryption path and dynamic decryption path); K2, randomly selecting units from the remaining idle operation units to add random loads to perform interference calculations; K3, the control unit sends control signals to notify each unit to perform the assigned operation to complete the corresponding operation. This scheduling method further reduces and improves the randomness of energy and timing information by using random data paths and adding random load interference, which can effectively resist side-channel attacks by attackers.

[0108] In summary, this invention provides a decryption method and a multi-core system for accelerating Paillier semi-homomorphic encryption. By improving the decryption method in the original Paillier semi-homomorphic encryption scheme, it enables the multi-core system proposed in this invention to resist side-channel attacks. Some embodiments of this invention can achieve at least one of the following beneficial effects:

[0109] (1) Paillier semi-homomorphic encryption scheme algorithm level: Based on the Paillier semi-homomorphic encryption scheme, this invention analyzes the reasons that the original decryption algorithm may lead to side-channel attacks and leak private keys, and proposes an improved algorithm to combat side-channel attacks by using a random splitting calculation method.

[0110] (2) Multi-core system structure: This invention proposes a multi-core system structure for running the above-mentioned improved algorithm. The design of the multi-core system can guarantee the high throughput of the entire encryption system. The overall multi-core system consists of several modular multiplication calculation units, several modular exponentiation calculation units, a control unit and a storage unit. Each unit is implemented as a single core in the multi-core system to provide resistance to side-channel attacks.

[0111] (3) Multi-core system scheduling level: This invention proposes a scheduling algorithm for running the improved Paillier semi-homomorphic encryption scheme on the multi-core system proposed above. In addition to the random splitting calculation strategy in the algorithm, the scheduling algorithm provides additional means such as dynamic scheduling and redundant calculation to resist side channel attacks, thereby improving the security of the overall encryption system.

[0112] It should be noted that although the steps are described in a specific order above, it does not mean that the steps must be executed in the above specific order. In fact, some of these steps can be executed concurrently, or even in a different order, as long as the required function can be achieved.

[0113] This invention can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of the invention.

[0114] Computer-readable storage media can be tangible devices that hold and store instructions for use by an instruction execution device. Computer-readable storage media can include, for example, but not limited to, electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination thereof.

[0115] The various embodiments of the present invention have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A decryption method resistant to side-channel attacks, used to decrypt ciphertext using the Paillier algorithm, the method comprising: Obtain the ciphertext, modulus, first private key pair and second private key pair, wherein the first private key pair contains a first private exponent and a second private exponent constructed based on the exponent in the random number and the original private key, and the second private key pair contains a first private coefficient and a second private coefficient constructed based on the coefficient in the random number and the original private key; The first intermediate value is obtained by performing modular exponentiation based on the first private exponent, the modulus, and the ciphertext; The second intermediate value is obtained by performing modular exponentiation based on the second private exponent, the modulus, and the ciphertext. Multiply the first and second intermediate values, then take the modulus of the square of the modulus to obtain the third intermediate value; The value of the L function is obtained by subtracting 1 from the third intermediate value of the L function and then dividing by the modulus. Modular multiplication is performed based on the L function value, the first private coefficient, and the modulus to obtain the intermediate decryption value; Modular multiplication is performed using the decryption intermediate value, the second private coefficient, and the modulus to obtain the decrypted plaintext.

2. The method according to claim 1, characterized in that, The first private index or the second private index is in The random number obtained by randomly selecting an integer, the sum of the first private exponent and the second private exponent, equals the exponent in the original private key, where, This represents the exponent in the original private key.

3. The method according to claim 2, characterized in that, Construct the first and second private coefficients in the second private key pair as follows: in, Indicates the first private coefficient. This represents the second private coefficient. In order to be in A random number obtained by randomly selecting an integer. This represents the modulo operation. Represents the modulus. express In modulus Multiplicative inverse, This represents the coefficient in the original private key.

4. The method according to any one of claims 1-3, characterized in that, The method also includes: Before decrypting the ciphertext, the first and second private key pairs are obtained from the private key store as dynamic private keys for decrypting the ciphertext. The private key store is constructed in advance as follows: Multiple different first private key pairs are pre-constructed based on the exponent in the original private key, and multiple different second private key pairs are pre-constructed based on the coefficients in the original private key; and Maintain a confidential private key store, storing multiple first private key pairs and multiple second private key pairs in the private key store.

5. The method according to any one of claims 1-3, characterized in that, The decryption process corresponding to this method is represented as follows: ,in, in, Indicates the first intermediate value. This indicates that the value is assigned. Indicates ciphertext, Indicates the first private index, This represents the modulo operation. Represents the modulus. Indicates the second intermediate value. This indicates the second private index. Indicates the third intermediate value. Represents the value of function L. Represents the L function, This indicates the intermediate value for decryption. Indicates the first private coefficient. This represents the second private coefficient. This represents the decrypted plaintext.

6. A multi-core system, comprising at least one control unit, one or more storage units, one or more random number units, multiple modular exponentiation units, and multiple modular multiplication units, wherein different units are disposed in different cores, wherein: The control unit is used to control the storage unit, random number unit, modular exponentiation unit, and modular multiplication unit to complete the decryption process. A storage unit for storing multiple first private key pairs and multiple second private key pairs; The random number unit is used to generate random numbers, including the random numbers needed to calculate the public and private keys, the random numbers needed to construct the first private key pair, and another random number needed to construct the second private key pair; Modular exponentiation unit, used to perform modular exponentiation operations during the decryption process; The modular multiplication unit is used to perform modular multiplication operations and calculations corresponding to the L function during the decryption process.

7. The multi-core system according to claim 6, characterized in that, The control unit is configured as follows: Before decrypting each ciphertext, based on the order of decryption operations, the first number of modular exponentiation operations, and the second number of modular multiplication operations, a first number of modular exponentiation units and a second number of modular multiplication units are randomly selected to construct a dynamic decryption path for the ciphertext on multiple cores. The units on the dynamic decryption path are scheduled to cooperate in sequence to complete the decryption process.

8. The multi-core system according to claim 7, characterized in that, The control module is also configured to: for any ciphertext, schedule at least a portion of the idle cores outside the dynamic decryption path corresponding to the ciphertext to perform non-decryption interference calculations during the decryption of the ciphertext.

9. A computer-readable storage medium, characterized in that, It stores a computer program that can be executed by a processor to implement the steps of the method according to any one of claims 1-7.

10. An electronic device, characterized in that, include: One or more processors; as well as Memory, wherein the memory is used to store executable instructions; The one or more processors are configured to implement the steps of the method according to any one of claims 1-7 by executing the executable instructions.

Images