Security computation method, device, hardware, chip, equipment, medium and product

Abstract

This invention discloses a secure computation method, apparatus, hardware, chip, device, medium, and product for information. The method includes: acquiring target information to be transformed using number theory during secure computation; determining the data operation order of the butterfly operation in each round of number theory transformation based on a first random seed; updating the new polynomial coefficients corresponding to the target information according to the data operation order; and determining the currently updated polynomial coefficients as the result of the number theory transformation operation on the target information after completing all rounds of number theory transformation. The technical solution of this invention, by shuffling the data operation order of the butterfly operation or introducing a multiplication mask to encrypt the operation result, can provide effective security protection for the operation of post-quantum algorithms without introducing a large amount of additional hardware resources, thus resisting side-channel attacks.

Description

Technical Field

[0001] This invention relates to the field of confidential and secure communication technology, and in particular to a secure information computing method, apparatus, number theory transformation operation hardware, security chip, electronic device, readable storage medium, and computer program product. Background Technology

[0002] To address the threats posed by the rapid development of quantum computers, various post-quantum cryptographic algorithms have emerged. Among them, lattice-based cryptographic algorithms are currently widely used. They utilize the properties of lattice theory to design a series of cryptographic algorithms that can maintain security in a quantum computing environment.

[0003] In lattice-based cryptographic algorithms, NTT (number-theoretic transform) operations are fundamental and crucial. With the rapid development of side-channel attack techniques, attackers can exploit the physical information leaked during NTT operations to recover some or all of the sensitive data.

[0004] Therefore, how to maximize the security of NTT operations and provide effective side-channel leakage protection for NTT operations is an important problem that needs to be solved. Summary of the Invention

[0005] This invention provides a secure computing method, apparatus, number theory transformation operation hardware, security chip, electronic device, readable storage medium, and computer program product for NTT operations, providing effective security protection to resist side-channel attacks to the greatest extent.

[0006] According to one aspect of the present invention, a secure computation method for information is provided, comprising:

[0007] In the process of secure computation of information, the target information to be transformed by number theory is obtained, wherein the data form of the target information is an nth degree polynomial;

[0008] Based on the first random seed determined in each round of number theory transformation, the data operation order of the butterfly operation in each round of number theory transformation is determined, and the new polynomial coefficients corresponding to the target information are updated according to the data operation order.

[0009] After completing all rounds of number theory transformations, the currently updated polynomial coefficients are determined as the result of the number theory transformation operation on the target information.

[0010] According to another aspect of the embodiments of the present invention, another method for securely calculating information is also provided, comprising:

[0011] In the process of secure computation of information, the target information to be transformed by number theory is obtained, wherein the data form of the target information is an nth degree polynomial;

[0012] Based on the third random seed determined in each number theory transformation round, the multiplication mask added to the butterfly operation in each number theory transformation round is determined, and based on the multiplication mask, the new polynomial coefficients corresponding to the target information are updated according to the data operation order of the butterfly operation in each number theory transformation round.

[0013] After completing all rounds of number theory transformations, the currently updated polynomial coefficients are determined as the result of the number theory transformation operation on the target information.

[0014] According to another aspect of the present invention, a secure computing device for information is also provided, comprising:

[0015] The target information acquisition module is used to acquire the target information to be transformed by number theory during the secure computation of information. The target information is in the form of an nth-degree polynomial.

[0016] The data operation order processing module is used to determine the data operation order of the butterfly operation in each number theory transformation round based on the first random seed determined in each number theory transformation round, and update the new polynomial coefficients corresponding to the target information according to the data operation order.

[0017] The transformation result determination module is used to determine the currently updated polynomial coefficients as the result of the number theory transformation operation on the target information after completing all rounds of number theory transformation.

[0018] According to another aspect of the present invention, a secure computing device for information is also provided, comprising:

[0019] The target information determination module is used to obtain the target information to be transformed by number theory during the secure computation of information. The target information is in the form of an nth-degree polynomial.

[0020] The mask processing module is used to determine the multiplication mask added to the butterfly operation in each number theory transformation round based on the third random seed determined in each number theory transformation round, and update the new polynomial coefficients corresponding to the target information according to the multiplication mask and the data operation order of the butterfly operation in each number theory transformation round.

[0021] The result generation module is used to determine the currently updated polynomial coefficients as the result of the number theory transformation operation on the target information after completing all rounds of number theory transformation.

[0022] According to another aspect of the present invention, number theory transformation operation hardware is also provided, including: a control module, a polynomial coefficient storage module, a rotation factor storage module, and a multiplication operation module, wherein:

[0023] The control module is used to receive a first random seed from an external input at each round of number theory transformation during the number theory transformation of the target information; based on the first random seed, it successively determines the storage index of the polynomial coefficient pairs used in each butterfly operation at each round of number theory transformation, and successively determines the storage index of at least one target twitch factor used in each butterfly operation; it sends the storage index of the polynomial coefficient pairs to the polynomial coefficient storage module, and sends the storage index of the target twitch factor to the twitch factor storage module; wherein, the data form of the target information is an nth-degree polynomial;

[0024] The polynomial coefficient storage module is used to retrieve the polynomial coefficient pair used in each butterfly operation based on the storage index of the polynomial coefficient pair received each time, and send it to the multiplication operation module.

[0025] The rotation factor storage module is used to obtain the target rotation factors used in each butterfly operation based on the storage index of the target rotation factor received each time, and send them to the multiplication operation module.

[0026] The multiplication module is used to perform multiplication calculations of a set form based on each received polynomial coefficient pair and at least one target rotation factor, to obtain new polynomial coefficients corresponding to the target information under each number theory transformation cycle, and update and store them in the polynomial coefficient storage module.

[0027] According to another aspect of the present invention, number theory transformation operation hardware is also provided, including: a control module, a polynomial coefficient storage module, a rotation factor storage module, and a multiplication operation module, wherein:

[0028] The control module is used to receive a third random seed from an external input at each number theory transformation round during the number theory transformation of the target information; determine the storage index of the random rotation factor used in each number theory transformation round based on the third random seed; determine the storage index of the polynomial coefficient pair used in each butterfly operation at each number theory transformation round, and determine the storage index of at least one target rotation factor used in each butterfly operation; send the storage index of the polynomial coefficient pair to the polynomial coefficient storage module, and send the storage index of the target rotation factor and the random rotation factor to the rotation factor storage module; wherein, the data form of the target information is an nth-degree polynomial;

[0029] The polynomial coefficient storage module is used to retrieve the polynomial coefficient pair used in each butterfly operation based on the storage index of the polynomial coefficient pair received each time, and send it to the multiplication operation module.

[0030] The rotation factor storage module is used to obtain the target rotation factor and random rotation factor used in each butterfly operation based on the storage index of the target rotation factor and random rotation factor received each time, and send them to the multiplication operation module.

[0031] The multiplication module is used to perform multiplication calculations in a set form based on each received polynomial coefficient pair, target rotation factor, and random rotation factor, to obtain new polynomial coefficients corresponding to the target information under each number theory transformation cycle, and update and store them in the polynomial coefficient storage module.

[0032] According to another aspect of the present invention, a security chip is also provided, comprising number theory transformation operation hardware as described in any one of the embodiments of the present invention.

[0033] According to another aspect of the present invention, an electronic device is also provided, comprising a security chip as described in any one of the embodiments of the present invention.

[0034] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the secure computation method for information as described in any embodiment of the present invention.

[0035] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of a secure computation method for information as described in any embodiment of the present invention.

[0036] The technical solution of this invention, by introducing one or more random seeds in the NTT operation process involved in information security computing to shuffle the data operation order of the butterfly operation, or by introducing a multiplication mask in the butterfly operation result to mask and encrypt the operation result, can provide effective security protection for the operation of post-quantum cryptography algorithms without introducing a large amount of additional hardware resources, so as to resist side-channel attacks to the greatest extent.

[0037] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 This is a flowchart of a secure information calculation method provided by an embodiment of the present invention;

[0040] Figure 2 This is a flowchart of another secure information calculation method provided by an embodiment of the present invention;

[0041] Figure 3 This is a flowchart illustrating a specific implementation method for calculating two new polynomial coefficients after masking, applicable to an embodiment of the present invention.

[0042] Figure 4 This is a flowchart of another secure information calculation method provided by an embodiment of the present invention;

[0043] Figure 5 This is a structural diagram of an information security computing device provided according to an embodiment of the present invention;

[0044] Figure 6 This is a structural diagram of another information security computing device provided according to an embodiment of the present invention;

[0045] Figure 7 This is a structural diagram of a number theory transformation operation hardware provided according to an embodiment of the present invention;

[0046] Figure 8 This is a structural diagram of another number theory transformation operation hardware provided according to an embodiment of the present invention;

[0047] Figure 9 This is a structural diagram of a security chip provided according to an embodiment of the present invention;

[0048] Figure 10 This is a schematic diagram of the structure of an electronic device that implements the secure computation method for information according to embodiments of the present invention. Detailed Implementation

[0049] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0050] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0051] To facilitate understanding of the technical solutions in the various embodiments of the present invention, the principle of NTT operation will first be briefly introduced. NTT operation, also known as fast number-theoretic transform, is a fast transform algorithm that is faster than Fast Fourier Transform. The transform object of NTT operation is an nth-degree polynomial, and its main algorithm logic is as follows:

[0052] First, in the nth degree polynomial, n is an integer power of 2, and the preset initial iteration length is len = n / 2. Starting from len = n / 2, one or more butterfly operations are performed at different iteration lengths (len, len / 2, len / 4, ..., 1) to update the coefficients of each polynomial in the nth degree polynomial. After completing the iteration at len ​​= 1, the NTT operation for the nth degree polynomial is considered complete.

[0053] Furthermore, in the i-th iteration, for the currently set len, from j = 0 to len-1, perform len-1 rounds of butterfly operations (starting from the 0th iteration). During each butterfly operation, read the currently stored pair of polynomial coefficients (a, b) = (X[j], X[j+len]) and the corresponding twitch factor from memory. Perform a butterfly operation to obtain the result (a+b·θ, ab·θ), and then update and store the result as the new polynomial coefficients. After completing the above len-1 rounds of butterfly operations, set len ​​= len / 2 and continue to execute the (i+1)th round of iteration until len = 1, at which point this round of iteration is determined to be the last round of iteration.

[0054] In a specific example, suppose the nth-degree polynomial to be performed in the NTT operation is ax + bx. 2 +cx 3 +dx 4 Since n = 4, len = 4 / 2 = 2 is used in the 0th iteration. Among them, a, b, c and d are the four polynomial coefficients of the above 4th degree polynomial, a is the 0th polynomial coefficient, b is the 1st polynomial coefficient, c is the 2nd polynomial coefficient and d is the 3rd polynomial coefficient. That is, the above four polynomial coefficients can be represented as X[0], X[1], X[2] and X[3] respectively, where X[i] represents the polynomial coefficient located at the i-th position in the n-degree polynomial in order of power from low to high.

[0055] In the i=0th iteration, two butterfly operations need to be performed from j=0 to j=1: In the first butterfly operation for j=0, the polynomial coefficients a(X[0]) and c(X[2]) need to be obtained, and the corresponding rotation factor θ=ω is obtained based on the set ω. 0 After calculating (a+c·θ, ac·θ) as the new a and c, the new a and c are stored as the new polynomial coefficients a and c. In the second butterfly operation for j=1, it is necessary to obtain the two polynomial coefficients b(X[1]) and d(X[3]) and obtain the corresponding rotation factor θ=ω. 1 After calculating (b+d·θ,bd·θ) as the new b and d, store the new b and d as the new polynomial coefficients b and d, and update len to len / 2=1.

[0056] During the i=1th iteration (i.e., the last iteration), a butterfly operation needs to be performed once for j=0: when performing this unique butterfly operation, the polynomial coefficients a(X[0]) and b(X[1]) need to be obtained accordingly, and based on the set ω, the corresponding rotation factor θ=ω is obtained. 0 After calculating (a+b·θ,ab·θ) as the new a and b, the above new a and b are stored as the new polynomial coefficients a and b.

[0057] After completing the above iterative process, the currently stored a, b, c, and d are the NTT operation results corresponding to the nth degree polynomial.

[0058] The inventors discovered through research that the order in which the polynomial coefficient pairs used in each butterfly operation are obtained is fixed during each iteration. For example, for an 8th-degree polynomial, four butterfly operations are required in the 0th iteration. The first butterfly operation uses the polynomial coefficient pair X[0] and X[4], the second butterfly operation uses the polynomial coefficient pair X[1] and X[5], the third butterfly operation uses the polynomial coefficient pair X[2] and X[6], and the fourth butterfly operation uses the polynomial coefficient pair X[3] and X[7]. Obviously, using the order in which the polynomial coefficient pairs are obtained during the butterfly operation as prior knowledge during a side-channel attack will greatly increase the risk of side-channel leakage.

[0059] Furthermore, the results of each butterfly operation are directly used as polynomial coefficients in the next iteration, or directly as polynomial coefficients in the final NTT operation result. This also greatly increases the risk of side-channel leakage when subjected to side-channel attacks.

[0060] Based on this, the inventors creatively proposed to perform certain random processing on NTT operations under the above two dimensions, so as to provide effective side-channel leakage protection for NTT operations.

[0061] Figure 1 This is a flowchart illustrating a secure information computation method provided by an embodiment of the present invention. This embodiment is applicable to situations where NTT operations involved in information encryption and decryption using a predefined cryptographic algorithm are protected for security. The method can be executed by a secure information computation device, which can be implemented in hardware and / or software, and is generally configured in a secure chip used to perform information encryption and decryption operations. This electronic chip is typically configured in a specific electronic device, such as a mobile phone, tablet computer, or vehicle terminal.

[0062] Correspondingly, such as Figure 1 As shown, the method may include:

[0063] S110. In the process of secure computation of information, the target information to be transformed by number theory is obtained, wherein the data form of the target information is an nth degree polynomial.

[0064] The secure computation process of the aforementioned information can be understood as the process by which an electronic device receives encrypted information and decrypts it using a pre-defined decryption algorithm, so that the decrypted information can be used for subsequent data processing. Alternatively, it can be understood as the process by which an electronic device encrypts private information using a pre-defined encryption algorithm before sending the encrypted information.

[0065] Optionally, the above encryption or decryption algorithm can be a lattice-based cryptographic algorithm. In the execution of lattice-based cryptographic algorithms, NTT operations are widely used.

[0066] Accordingly, in the process of secure computation of information, the data format of the target information that needs to be subjected to NTT operation is as follows: ax + bx 2 +…+mx n A polynomial of degree n, where n is 2. l , where l is a positive integer.

[0067] S120. Based on the first random seed determined in each round of number theory transformation, determine the data operation order of the butterfly operation in each round of number theory transformation, and update the new polynomial coefficients corresponding to the target information according to the data operation order.

[0068] As mentioned earlier, in existing technologies, the order of data operations in butterfly operations is known and fixed in each specific NTT round. This prior information increases the security risks of information.

[0069] Continuing the previous example, when the target information is an 8th-degree polynomial, if the 0th iteration is performed, the data operation order of the 4 butterfly operations is: (X[0], X[4]), (X[1], X[5]), (X[2], X[6]), and (X[3], X[7]). Obviously, the positional difference between the two polynomial coefficients in each polynomial coefficient pair is fixed, which is len = 4. However, the first polynomial coefficient in each polynomial coefficient pair is selected sequentially, that is, it is incremented from 0 to 3, thus causing this fixed data operation order.

[0070] Based on this, each embodiment of the present invention uses a first random seed to randomly shuffle the data operation order of the butterfly operation in each round of number theory transformation.

[0071] Specifically, assuming that 5 butterfly operations are required in the current NTT round, the set of options for the first polynomial coefficients is {0,1,2,3,4}. By using the first random seed, the above set of options can be randomly shuffled, for example, shuffled to {4,0,3,1,2}. At this time, the data operation order of these 5 butterfly operations is: (X[4],X[9]), (X[0],X[5]), (X[3],X[8]), (X[1],X[6]) and (X[2],X[7]).

[0072] Optionally, array element randomization algorithms such as the Knuth-shuffle algorithm, the shuffling algorithm, or the recursive randomization algorithm can be used to randomly shuffle the data operation order of the butterfly operation in each round of number theory transformation. Regardless of the array element randomization algorithm used, one or more random numbers are required as input. In this embodiment, one or more random numbers required by the array element randomization algorithm can be generated using a first random seed.

[0073] In a specific example, for the shuffling algorithm, it is necessary to traverse each element of the array (i.e., the set of options in this embodiment). Each time, a random number is used to determine another position B besides the current array element's position A. This array element is then swapped with the array element at position B. This process is repeated until all array elements have been traversed to obtain the final shuffled array. Each random number required for the above traversal process can be obtained by successively determining the first random seed.

[0074] In this case, since the polynomial coefficients at each specific position need to be butterflyed with the matching rotation factor, for example, (X[4], X[9]) needs to be butterflyed with the rotation factor θ=ω 4 Perform butterfly operations, and (X[0], X[5]) needs to be combined with the rotation factor θ = ω. 0 Perform butterfly operations, etc. Therefore, after determining the data operation order of the butterfly operation in each round of number theory transformation, the matching twitch factor can be selected to update the new polynomial coefficients corresponding to the target information according to the above data operation order.

[0075] Based on the above embodiments, according to the first random seed determined in each number theory transformation round, the data operation order of the butterfly operation in each number theory transformation round is determined, and the new polynomial coefficients corresponding to the target information are updated according to the data operation order, which may specifically include:

[0076] Based on the first and second random seeds determined in each number theory transformation round, the data operation order and the added multiplication mask of the butterfly operation in each number theory transformation round are determined, and the new polynomial coefficients corresponding to the target information are updated according to the data operation order and the multiplication mask.

[0077] As mentioned earlier, since the results of each butterfly operation in the existing NTT operation are directly stored, if these results are obtained by a side-channel attack, it will cause direct information leakage. Therefore, this embodiment of the invention further proposes an implementation method that performs mask encryption on the results of each butterfly operation.

[0078] Specifically, a second random seed can be generated in each NTT round. This second random seed is used to generate the multiplication mask required for each NTT round. Through this multiplication mask, all butterfly operation results generated in each NTT round can be masked and encrypted to further ensure information security.

[0079] For example, in the current NTT round, the determined multiplication mask is W. Performing a butterfly operation on a pair of polynomial coefficients (a, b) and a matching rotation factor θ yields a butterfly operation result of the form (a+b·θ, ab·θ). This butterfly operation result can then be masked and encrypted using W. Specifically, a masked encryption result of the form ((a+b·θ)·W, (ab·θ)·W) can be constructed.

[0080] By setting up the above, while randomly shuffling the data operation order of the butterfly operation in each round of number theory transformation, the result of each butterfly operation is further masked and encrypted, thus achieving effective side-channel protection for NTT operation.

[0081] S130. After completing all rounds of number theory transformations, the currently updated polynomial coefficients are determined as the result of the number theory transformation operation on the target information.

[0082] The technical solution of this invention, by introducing a random seed to shuffle the data operation order of the butterfly operation during the NTT operation involved in information security computing, can provide effective security protection for the operation of post-quantum cryptography algorithms without introducing a large amount of additional hardware resources, so as to resist side-channel attacks to the greatest extent.

[0083] Based on the above embodiments, according to the first and second random seeds determined in each number theory transformation round, the data operation order and the added multiplication mask of the butterfly operation in each number theory transformation round are determined, and the new polynomial coefficients corresponding to the target information are updated according to the data operation order and the multiplication mask, which may include:

[0084] Determine the first and second random seeds under the current number theory transformation round, and determine the multiplication mask to be used under the current number theory transformation round based on the second random seed;

[0085] Based on the first random seed, the polynomial coefficient pairs used in each butterfly operation under the current number theory transformation cycle are determined successively. Then, multiple butterfly operations are performed based on the polynomial coefficient pairs and the matching multiplication mask to obtain the new polynomial coefficients corresponding to the target information under the current number theory transformation cycle.

[0086] In this embodiment, a specific number theory transformation cycle is used as an example for detailed description. Under the current number theory transformation cycle, it is necessary to determine the corresponding first random seed and second random seed.

[0087] Based on this first random seed, a random number can be dynamically determined before each butterfly operation. Based on this dynamically determined random number, a polynomial coefficient pair is randomly selected from all polynomial coefficient pairs that have not yet undergone butterfly operations to perform butterfly operations, so as to ensure the random shuffling of the data operation order under the current number theory transformation cycle.

[0088] Based on this second random seed, the multiplication mask used for each butterfly operation result in the current number theory transformation cycle can be determined. Based on this multiplication mask, each butterfly operation result can be uniformly masked and encrypted to finally obtain all the new polynomial coefficients corresponding to the target information in the current number theory transformation cycle.

[0089] It should be noted that, since the calculated polynomial coefficients are masked and encrypted using a randomly determined multiplication mask in each round of number theory transformation, a specific multiplication mask can be added during the NTT operation in the last round to simplify the subsequent data calculation process. This ensures that the product of this multiplication mask with the multiplication masks from other rounds has a set constant, such as 1. In this case, it is equivalent to directly performing mask decryption during the mask encryption process in the last round. Through this setting, it is guaranteed that the calculation results of each butterfly operation in the NTT operation, except for the last round, are masked and encrypted. After each butterfly operation in the last round, the results of the previous mask encryption are decrypted all at once, and the NTT operation result after mask decryption is finally stored. That is, the NTT operation result obtained after the final introduction of the multiplication mask is consistent with the NTT operation result obtained without adding a mask in the existing technology.

[0090] Figure 2The flowchart below illustrates another secure information calculation method provided by an embodiment of the present invention. This embodiment is an optimization based on the above embodiments. In this embodiment, the operation of "determining the polynomial coefficient pairs used in each butterfly operation under the current number theory transformation round according to the first random seed, and performing multiple butterfly operations according to the polynomial coefficient pairs and the matching multiplication mask to obtain new polynomial coefficients corresponding to the target information under the current number theory transformation round" is specifically refined as follows: "Determining the current position index that matches the current butterfly operation within the value range that matches the current number theory transformation round according to the first random seed; obtaining the current polynomial coefficient pair that matches the current butterfly operation according to the current position index; calculating two new polynomial coefficients after masking according to the current polynomial coefficient pair, the current rotation factor corresponding to the current position index, and the multiplication mask used under the current number theory transformation round."

[0091] Correspondingly, such as Figure 2 As shown, the method may include:

[0092] S210. During the secure computation of information, acquire the target information to be transformed by number theory.

[0093] S220. Determine the first and second random seeds under the current number theory transformation round, and determine the multiplication mask used under the current number theory transformation round based on the second random seed.

[0094] In this embodiment, a specific butterfly operation (the current butterfly operation) under a specific number theory transformation cycle (the current number theory transformation cycle) is used as an example to describe the polynomial coefficient update process.

[0095] S230. Based on the first random seed, within the range of values ​​that match the current number theory transformation cycle, determine the current position index that matches the current butterfly operation.

[0096] As mentioned earlier, the polynomial coefficient pairs to be calculated in each NTT round are known, and the positional difference between the later and earlier polynomial coefficients in each pair is also known. Therefore, the position indices of all the preceding polynomial coefficients in the target information in each NTT round can be used to construct a corresponding value range. Within this value range, based on the first random seed, the current position index matching the current butterfly operation is determined.

[0097] For example, for the target information of an 8th degree polynomial, in the first NTT round, the range of values ​​for all the coefficients of the preceding polynomial is {0, 1, 2, 3}.

[0098] Furthermore, when using the first NTT round as the current number theory transformation round, random numbers can be generated sequentially based on the first random seed. Then, based on this random number, within the range of values ​​matching the current number theory transformation round, a data point is obtained from the currently unacquired data points as the current position index matching the current butterfly operation.

[0099] S240. Based on the current position index, obtain the current polynomial coefficient pair that matches the current butterfly operation.

[0100] Continuing from the previous example, if for the target information of the 8th degree polynomial, the current position index obtained for the current butterfly operation under the first NTT round is 2, then the current polynomial coefficient pair that matches the current butterfly operation can be obtained as X[2] and X[6].

[0101] S250. Based on the current polynomial coefficient pair, the current rotation factor corresponding to the current position index, and the multiplication mask used in the current number theory transformation cycle, calculate the two new polynomial coefficients after masking.

[0102] As shown above, considering the correspondence between polynomial coefficient pairs and twisting factors, after obtaining the current polynomial coefficient pair required for the current butterfly operation, the current twisting factor matching the current polynomial coefficient pair can be obtained accordingly.

[0103] In an optional implementation of this embodiment, a butterfly operation can be performed first based on the current polynomial coefficient pair and the current twitch factor to obtain the calculation result. Then, the calculation result is multiplied by the multiplication mask used in the current number theory transformation cycle to obtain two new polynomial coefficients after masking.

[0104] In another optional implementation of this embodiment, to further protect the current rotation factor, it can be hidden in a certain way. Specifically, considering that each rotation factor is an integer power of a set ω, for example, ω 0 ω 1 、…、ω n / 2 And so on. Meanwhile, the following data calculation rules are used: ω i+j =ω i ·ω j If this formula is described using an index, it can be represented as: w i+j =w i ·w j .

[0105] Accordingly, we can consider storing the rotation factors in ascending order of their powers. Simultaneously, we can set the multiplication mask to be an integer power of ω, with the specific power value randomly determined based on the second random seed used in the current number theory transformation round. Furthermore, after obtaining the storage index z of the current rotation factor and the storage index y of the multiplication mask, we can obtain two new factors, one of which is w. y Another factor is w y+z Among them, w y+z =w y ·w z .

[0106] At this point, for a polynomial coefficient pair (a, b), the corresponding computational form can be calculated: (a·w) y +b·w y+z ,a·w y -b·w y+z The calculation result above, after transformation, is equivalent to ((a+b·w) z )·w y ,(ab·w z )·w y That is, it is equivalent to calculating the results for (a, b) and w. z After completing the butterfly calculation, the result of the butterfly calculation is multiplied by the multiplication mask w. y By using the above settings, the rotation factor w used in each calculation can be effectively hidden during the calculation process. z This is to further ensure the security of NTT operations.

[0107] Correspondingly, such as Figure 3 As shown, in an optional implementation of this embodiment, two new polynomial coefficients after masking are calculated based on the current polynomial coefficient pair, the current twiddle factor corresponding to the current position index, and the multiplication mask used in the current number theory transformation round. Specifically, this may include:

[0108] S2501. Determine the first position index corresponding to the current rotation factor based on the current position index.

[0109] As shown above, once the index position of the first polynomial coefficient in the current polynomial coefficient pair is determined, the corresponding current twisting factor is also uniquely determined. Then, based on the current position index of the first polynomial coefficient, the pre-established storage mapping relationship can be queried to obtain the first position index corresponding to the current twisting factor, that is, the storage index z of the current twisting factor in the previous example.

[0110] S2502. The second position index of the multiplication mask used in the current number theory transformation cycle is added to the first position index to obtain the third position index corresponding to the current summation rotation factor.

[0111] In this embodiment, the multiplication mask used is consistent with the data structure of each rotation factor, and is an integer power of ω. Accordingly, when determining the multiplication mask used in the current number theory transformation cycle based on the second random seed, a random index (i.e., the second position index) can be determined from the storage index of all rotation factors according to the second random seed, and the rotation factor stored at this random index is used as the multiplication mask. Since this multiplication mask is randomly obtained based on the second random seed, it can be named the random rotation factor, i.e., w in the previous example. y .

[0112] As mentioned earlier, if it is determined that the current number theory transformation round is not the last round, then the multiplication mask used in the current number theory transformation round is determined according to the second random seed under the current number theory transformation round; if the current number theory transformation round is the last round, then the multiplication mask used in the current number theory transformation round is calculated according to the multiplication masks used in all previous number theory transformation rounds, that is, the product obtained by multiplying the multiplication mask used in the last number theory transformation round with the multiplication masks used in all previous number theory transformation rounds is 1.

[0113] In a specific example, suppose 100 rotation factors are pre-stored, and the NTT operation requires 5 number theory transformation rounds. In the first 4 number theory transformation rounds, a rotation factor can be randomly selected from the 100 rotation factors based on the second random seed used in each round. In the 5th number theory transformation round, instead of randomly selecting a rotation factor, it needs to be based on the 4 random rotation factors used in the previous number theory transformation rounds, for example, w. y1 w y2 w y3 and w y4 The calculation yields w y1 ·w y2 ·w y3 ·w y4 ·w y5 =1 of w y5 , which is the random rotation factor used in the 5th number theory transformation cycle.

[0114] Simultaneously, to achieve information hiding of the current rotation factor, the second position index and the first position index can be added together to obtain a new rotation factor position index, which is the third position index corresponding to the current summed rotation factor. At this point, the current summed rotation factor is w in the previous example. y+z .

[0115] S2503. Obtain the current random rotation factor that matches the second position index and the current summation rotation factor that corresponds to the third position index from the pre-stored rotation factors.

[0116] S2504. Calculate the first multiplication result of the first polynomial coefficient in the current polynomial coefficient pair with the current random twisting factor, and calculate the second multiplication result of the second polynomial coefficient in the current polynomial coefficient pair with the current summation twisting factor.

[0117] S2505. Take the sum of the first and second multiplication results as a polynomial coefficient after masking, and take the subtraction between the first and second multiplication results as another polynomial coefficient after masking.

[0118] S260. After completing all rounds of number theory transformations, the currently updated polynomial coefficients are determined as the result of the number theory transformation operation on the target information.

[0119] The technical solution of this invention, by simultaneously introducing a first random seed and a second random seed in the NTT operation process involved in information security computing, scrambles the data operation order of the butterfly operation and introduces a multiplication mask into the butterfly operation result to mask and encrypt the operation result. This can provide effective security protection for the operation of post-quantum cryptography algorithms without introducing a large amount of additional hardware resources, so as to resist side-channel attacks to the greatest extent.

[0120] Based on the above embodiments, according to the first and second random seeds determined in each number theory transformation round, the data operation order of the butterfly operation and the added multiplication mask are determined in each number theory transformation round, which may specifically include:

[0121] If it is determined that the current number theory transformation round is not the last round, then the multiplication mask used in the current number theory transformation round is determined according to the second random seed under the current number theory transformation round.

[0122] If the current number theory transformation round is the last round, then the multiplication mask used in the current number theory transformation round is calculated based on the multiplication masks used in all previous number theory transformation rounds.

[0123] As the foregoing analysis shows, after completing all butterfly operations in each NTT round, it's equivalent to adding a random rotation factor as a multiplier to each theoretically generated butterfly operation result. The number of multipliers added corresponds to the number of NTT rounds. To ensure that the calculation result obtained in the last NTT round is consistent with the calculation result without adding a multiplication mask, the embodiments of this invention consider not multiplying by a random multiplication mask in the last NTT round, but instead combining the multiplication masks multiplied in all the aforementioned NTT rounds to determine the multiplication mask used in the last NTT round, such that: w a ·w b ·(…)·w m =1, where w a w b ... are the multiplication masks used in each of the aforementioned non-last NTT rounds, w m This is the multiplication mask used in the last NTT round.

[0124] In this embodiment, during the NTT operation on the target information, the multiplication masks used in each NTT round are cached in real time. Therefore, when the last NTT round is reached, the multiplication mask satisfying w can be calculated based on all stored multiplication masks. a ·w b ·(…)·w m When = 1, the multiplication mask used in the last NTT round.

[0125] Figure 4 This is a flowchart illustrating another secure information computation method provided by an embodiment of the present invention. This embodiment is applicable to situations where NTT operations involved in information encryption and decryption using a set cryptographic algorithm are protected for security. This method can be executed by a secure information computation device, which can be implemented in hardware and / or software, and is generally configured in a secure chip used to implement information encryption and decryption operations. This electronic chip is generally configured in a set electronic device, such as a mobile phone, tablet computer, or vehicle terminal.

[0126] Correspondingly, such as Figure 4 As shown, the method may include:

[0127] S410. In the process of secure computation of information, the target information to be transformed by number theory is obtained, wherein the data form of the target information is an nth degree polynomial.

[0128] S420. Based on the third random seed determined in each number theory transformation round, determine the multiplication mask added to the butterfly operation in each number theory transformation round, and update the new polynomial coefficients corresponding to the target information according to the data operation order of the butterfly operation in each number theory transformation round based on the multiplication mask.

[0129] In this embodiment, even if the data operation order of the butterfly operation is not changed in each number theory transformation round, the butterfly operation result is masked and encrypted after each butterfly operation in each number theory transformation round, which can still achieve effective security protection against side-channel attacks based on NTT operation.

[0130] Furthermore, a third random seed can be determined for each number theory transformation cycle, and based on the third random seed, a multiplication mask that is uniformly used for each butterfly operation in each number theory transformation cycle can be determined, thus obtaining the mask encryption result for each butterfly operation.

[0131] It is understood that the data operation order of the butterfly operation used in each number theory transformation cycle in this embodiment of the invention can be as in the prior art, following a fixed acquisition order, such as (X[0], X[4]), (X[1], X[5]), (X[2], X[6]) and (X[4], X[7]), to acquire each polynomial coefficient pair and perform the corresponding butterfly operation. Alternatively, a new random factor can be introduced to shuffle the data operation order of each butterfly operation in each number theory transformation cycle. This embodiment does not impose any restrictions on this.

[0132] Based on the above embodiments, the multiplication mask added to the butterfly operation in each number theory transformation round is determined according to the third random seed determined in each number theory transformation round, which may specifically include:

[0133] If it is determined that the current number theory transformation round is not the last round, then the multiplication mask used in the current number theory transformation round is determined according to the second random seed under the current number theory transformation round.

[0134] If the current number theory transformation round is the last round, then the multiplication mask used in the current number theory transformation round is calculated based on the multiplication masks used in all previous number theory transformation rounds.

[0135] S430. After completing all rounds of number theory transformations, the currently updated polynomial coefficients are determined as the result of the number theory transformation operation on the target information.

[0136] The technical solution of this invention, by introducing a random seed into the multiplication mask in the butterfly operation result during the NTT operation involved in information security computing, can provide effective security protection for the operation of post-quantum cryptography algorithms without introducing a large amount of additional hardware resources, so as to resist side-channel attacks to the greatest extent.

[0137] Figure 5 This is a schematic diagram of the structure of a secure computing device for information provided in an embodiment of the present invention. Figure 5 As shown, the device includes: a target information acquisition module 510, a data processing order module 520, and a transformation result determination module 530, wherein:

[0138] The target information acquisition module 510 is used to acquire the target information to be transformed by number theory during the secure computation of information, wherein the data form of the target information is an nth degree polynomial;

[0139] The data operation order processing module 520 is used to determine the data operation order of the butterfly operation in each number theory transformation round based on the first random seed determined in each number theory transformation round, and update the new polynomial coefficients corresponding to the target information according to the data operation order.

[0140] The transformation result determination module 530 is used to determine the currently updated polynomial coefficients as the result of the number theory transformation operation on the target information after completing all rounds of number theory transformation.

[0141] The technical solution of this invention introduces a random seed into the NTT operation process involved in information security computing to shuffle the data operation order of the butterfly operation. This provides effective security protection for the operation of post-quantum cryptography algorithms without introducing a large amount of additional hardware resources, thereby maximizing the resistance to side-channel attacks.

[0142] Based on the above embodiments, the data processing order module 520 can be specifically used for:

[0143] Based on the first and second random seeds determined in each number theory transformation round, the data operation order and the added multiplication mask of the butterfly operation in each number theory transformation round are determined, and the new polynomial coefficients corresponding to the target information are updated according to the data operation order and the multiplication mask.

[0144] Based on the above embodiments, the data processing order module 520 may further include:

[0145] The multiplication mask determination unit is used to determine the first random seed and the second random seed under the current number theory transformation round, and to determine the multiplication mask used under the current number theory transformation round based on the second random seed;

[0146] The polynomial coefficient successive update unit is used to determine the polynomial coefficient pairs used in each butterfly operation under the current number theory transformation round according to the first random seed, and to perform multiple butterfly operations according to the polynomial coefficient pairs and the matching multiplication mask to obtain the new polynomial coefficients corresponding to the target information under the current number theory transformation round.

[0147] Based on the above embodiments, the polynomial coefficient successive update unit may specifically include:

[0148] The current position index determination sub-unit is used to determine the current position index that matches the current butterfly operation within the range of values ​​that match the current number theory transformation round, based on the first random seed.

[0149] The current polynomial coefficient pair acquisition sub-unit is used to obtain the current polynomial coefficient pair that matches the current butterfly operation based on the current position index;

[0150] The new polynomial coefficient calculation subunit is used to calculate two new polynomial coefficients after masking, based on the current polynomial coefficient pair, the current rotation factor corresponding to the current position index, and the multiplication mask used in the current number theory transformation cycle.

[0151] Based on the above embodiments, the new polynomial coefficient calculation subunit can be specifically used for:

[0152] Determine the first position index corresponding to the current rotation factor based on the current position index;

[0153] The second position index of the multiplication mask used in the current number theory transformation cycle is summed with the first position index to obtain the third position index corresponding to the current summation rotation factor.

[0154] From the pre-stored rotation factors, obtain the current random rotation factor that matches the second position index and the current summation rotation factor that corresponds to the third position index;

[0155] Calculate the first multiplication result of the first polynomial coefficient in the current polynomial coefficient pair with the current random twisting factor, and calculate the second multiplication result of the second polynomial coefficient in the current polynomial coefficient pair with the current summation twisting factor;

[0156] The sum of the first and second multiplication results is used as a polynomial coefficient after masking, and the subtraction between the first and second multiplication results is used as another polynomial coefficient after masking.

[0157] Based on the above embodiments, the data processing order module 520 can be further used for:

[0158] If it is determined that the current number theory transformation round is not the last round, then the multiplication mask used in the current number theory transformation round is determined according to the second random seed under the current number theory transformation round.

[0159] If the current number theory transformation round is the last round, then the multiplication mask used in the current number theory transformation round is calculated based on the multiplication masks used in all previous number theory transformation rounds.

[0160] The secure computing device for information provided in the embodiments of the present invention can execute the secure computing method for information provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0161] Figure 6 This is a schematic diagram of the structure of another secure computing device for information provided in an embodiment of the present invention. (See diagram below.) Figure 6 As shown, the device includes: a target information determination module 610, a mask processing module 620, and a result generation module 630, wherein:

[0162] The target information determination module 610 is used to obtain the target information to be transformed by number theory during the secure computation of information, wherein the data form of the target information is an nth degree polynomial;

[0163] The mask processing module 620 is used to determine the multiplication mask added to the butterfly operation in each number theory transformation round based on the third random seed determined in each number theory transformation round, and update the new polynomial coefficients corresponding to the target information according to the multiplication mask and the data operation order of the butterfly operation in each number theory transformation round.

[0164] The result generation module 630 is used to determine the currently updated polynomial coefficients as the result of the number theory transformation operation on the target information after completing all rounds of number theory transformation.

[0165] The technical solution of this invention, by introducing a random seed into the multiplication mask in the butterfly operation result during the NTT operation involved in information security computing, can provide effective security protection for the operation of post-quantum cryptography algorithms without introducing a large amount of additional hardware resources, so as to resist side-channel attacks to the greatest extent.

[0166] The secure computing device for information provided in the embodiments of the present invention can execute the secure computing method for information provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0167] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution of this invention all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0168] Figure 7 This is a structural diagram of a number theory transformation operation hardware according to an embodiment of the present invention. This embodiment can be adapted to implement NTT operations through pure hardware circuitry. Figure 7 As shown, the number theory transformation operation hardware includes: a control module 710, a polynomial coefficient storage module 720, a rotation factor storage module 730, and a multiplication operation module 740. The control module 710 is connected to both the polynomial coefficient storage module 720 and the rotation factor storage module 730, and both the polynomial coefficient storage module 720 and the rotation factor storage module 730 are connected to the multiplication operation module 740. Specifically:

[0169] The control module 710 is used to receive a first random seed from an external input in each round of number theory transformation during the number theory transformation of the target information; based on the first random seed, it successively determines the storage index of the polynomial coefficient pair used in each butterfly operation in each round of number theory transformation, and successively determines the storage index of at least one target twitch factor used in each butterfly operation; it sends the storage index of the polynomial coefficient pair to the polynomial coefficient storage module 720, and sends the storage index of the target twitch factor to the twitch factor storage module 730; wherein the data form of the target information is an nth degree polynomial.

[0170] In this embodiment, the polynomial coefficients in the target information are stored sequentially in the polynomial coefficient storage module 720, and each polynomial coefficient has a set storage index in the polynomial coefficient storage module 720. Similarly, the rotation factors required during the butterfly operation are stored sequentially in the rotation factor storage module 730, and each rotation factor has a set storage index in the rotation factor storage module 730.

[0171] It should be noted that if the order of data operations in the butterfly operation under each number theory transformation round is determined only by the first random seed, without masking the butterfly operation results, then the aforementioned target twiddle factors refer to the twiddle factors that match the polynomial coefficient pairs. If, in addition to determining the order of data operations in the butterfly operation under each number theory transformation round using the first random seed, the multiplication mask added to the butterfly operation under each number theory transformation round is further determined by the second random seed, then the aforementioned target twiddle factors refer to the twiddle factors that match the polynomial coefficient pairs and the random twiddle factors that match the multiplication mask. Alternatively, the aforementioned target twiddle factors can also be the random twiddle factors that match the multiplication mask and the summation twiddle factors obtained by correspondingly calculating the random twiddle factors and the twiddle factors that match the polynomial coefficient pairs.

[0172] Based on the above embodiments, the control module can further be used for:

[0173] Based on the storage index of the polynomial coefficient pairs, the first storage index of the rotation factor used in each butterfly operation is determined; in each number theory transformation round, the second random seed from the external input is received, and based on the second random seed, the second storage index of the random rotation factor used in each number theory transformation round is determined; the first and second storage indices used in each butterfly operation in each number theory transformation round are summed to obtain the third storage index corresponding to the summed rotation factor, and the second and third storage indices are sent together to the rotation factor storage module;

[0174] Accordingly, the rotation factor storage module can be specifically used for:

[0175] Whenever the second and third storage indices are received, the random rotation factor and summation rotation factor used in each butterfly operation are obtained and sent to the multiplication operation module.

[0176] The polynomial coefficient storage module 720 is used to retrieve the polynomial coefficient pair used in each butterfly operation based on the storage index of the polynomial coefficient pair received each time, and send it to the multiplication operation module 740.

[0177] The rotation factor storage module 730 is used to obtain each target rotation factor used in each butterfly operation according to the storage index of the target rotation factor received each time, and send it to the multiplication operation module 740.

[0178] The multiplication module 740 is used to perform multiplication calculations of a set form based on each received polynomial coefficient pair and at least one target rotation factor, to obtain new polynomial coefficients corresponding to the target information under each number theory transformation cycle, and update and store them in the polynomial coefficient storage module 720.

[0179] This invention provides a computing hardware specifically designed for NTT operations. Through the cooperation of various hardware modules, a random seed can be introduced into the NTT operation process involved in information security computing to shuffle the data operation order of the butterfly operation. This provides effective security protection for the operation of post-quantum cryptography algorithms without introducing a large amount of additional hardware resources, thereby maximizing the resistance to side-channel attacks.

[0180] Figure 8 This is a structural diagram of another number theory transformation operation hardware provided according to an embodiment of the present invention. This embodiment is a refinement based on the above embodiments, and specifically specifies the structure of the control module and the multiplication operation module.

[0181] Correspondingly, such as Figure 8 As shown, in this number theory transformation operation hardware, the control module specifically includes: a linear feedback shift register 8101, a first address generator 8102, and a second address generator 8103, wherein:

[0182] The linear feedback shift register (LFSR) 8101 is used to determine the target random number used in each butterfly operation in each number theory transformation round based on the first random seed received in each number theory transformation round, and send the target random number to the first address generator and the second address generator respectively.

[0183] like Figure 8 As shown, taking a current number theory transformation cycle as an example, the control module responds to the clock signal and can receive the first random seed sent from the outside in the current number theory transformation cycle. Then, based on the first random seed, the target random number x used in the current butterfly operation in the current number theory transformation cycle can be determined by shifting through the linear feedback shift register 8101.

[0184] The first address generator 8102 is used to determine the storage index of the polynomial coefficient pairs of the target information used in each butterfly operation under each round of number theory transformation based on the target random numbers received successively.

[0185] Continuing the previous example, after receiving the target random number x, the first address generator 8102 determines x and x+len as storage indices for the polynomial coefficient pairs of the target information used in the current butterfly operation, based on len that matches the current number theory transformation round. Based on x and x+len, the corresponding two polynomial coefficients a and b can be retrieved from the polynomial coefficient storage module.

[0186] The second address generator 8103 is used to determine the storage index of at least one target rotation factor used in each butterfly operation based on the second random seed received in each round of number theory transformation and the target random number received successively.

[0187] Continuing the previous example, after receiving the target random number x, the second address generator 8103, based on the mapping relationship between polynomial coefficient pairs and matching twitch factors, can determine the storage index z of the twitch factor that performs a butterfly operation with the two polynomial coefficients a and b, based on x. Simultaneously, based on the second random seed received from the outside in the current iteration, it can generate a corresponding storage index y of a random twitch factor. By adding the storage index z and the storage index y, the storage index y+z of the summed twitch factor is obtained.

[0188] By sending the storage index y of the random rotation factor and the storage index y+z of the summation rotation factor to the rotation factor storage module respectively, the corresponding random rotation factor w can be obtained. y And the addition and rotation factor w y+z .

[0189] Furthermore, the multiplication module may specifically include: a first multiplier 8201, a second multiplier 8202, an adder 8203, and a subtractor 8204.

[0190] The first multiplier 8201 is used to perform multiplication calculation on the first polynomial coefficient in each received random rotation factor and polynomial coefficient pair to obtain the first multiplication result, and send the first multiplication result to the adder 8203 and the subtractor 8204 respectively.

[0191] Continuing the previous example, the first multiplier 8201 is used to calculate the first polynomial coefficient 'a' and the random twisting factor 'w' in the polynomial coefficient pair. y The first multiplication result between a·w y .

[0192] The second multiplier 8202 is used to perform multiplication calculations on the second polynomial coefficients in each received pair of addition and rotation factors and polynomial coefficients to obtain the second multiplication result, and send the second multiplication result to the adder 8203 and the subtractor 8204 respectively.

[0193] Continuing the previous example, the second multiplier 8202 is used to calculate the second polynomial coefficient b and the summation rotation factor w in the polynomial coefficient pair. y+z The second multiplication result b·w between y+z .

[0194] Adder 8203 is used to calculate the sum of the first multiplication result and the second multiplication result received each time, and update the sum as a polynomial coefficient after masking and store it in the polynomial coefficient storage module.

[0195] Continuing the previous example, adder 8203 is used to calculate a·w y +b·w y+z The above calculation result is equivalent to (a + b·w) z )·w y That is, a polynomial coefficient after masking was calculated.

[0196] Subtractor 8204 is used to calculate the subtraction value of the first multiplication result minus the second multiplication result each time it is received, and to update and store the subtraction value as another polynomial coefficient after masking processing in the polynomial coefficient storage module.

[0197] Continuing the previous example, the subtractor 8204 is used to calculate a·w y -b·w y+z The above calculation result is equivalent to (ab·w) z )·w y That is, another polynomial coefficient after masking was calculated.

[0198] After completing the above calculations, the multiplication module stores the results back into the polynomial coefficient storage module. After completing all rounds of NTT calculations, the control module can generate a completion signal, allowing other hardware modules to retrieve the final NTT result from the polynomial coefficient storage module. Furthermore, the control module can also respond to a reset signal to reset the entire number theory transformation operation hardware.

[0199] The technical solution of this invention, by simultaneously introducing a first random seed and a second random seed in the NTT operation process involved in information security computing, scrambles the data operation order of the butterfly operation and introduces a multiplication mask into the butterfly operation result to mask and encrypt the operation result. This can provide effective security protection for the operation of post-quantum cryptography algorithms without introducing a large amount of additional hardware resources, so as to resist side-channel attacks to the greatest extent.

[0200] Furthermore, this embodiment of the invention also provides another number theory transformation operation hardware (not shown in the figure), which includes: a control module, a polynomial coefficient storage module, a rotation factor storage module, and a multiplication operation module, wherein:

[0201] The control module is used to receive a third random seed from an external input at each number theory transformation round during the number theory transformation of the target information; determine the storage index of the random rotation factor used in each number theory transformation round based on the third random seed; determine the storage index of the polynomial coefficient pair used in each butterfly operation at each number theory transformation round, and determine the storage index of at least one target rotation factor used in each butterfly operation; send the storage index of the polynomial coefficient pair to the polynomial coefficient storage module, and send the storage index of the target rotation factor and the random rotation factor to the rotation factor storage module; wherein, the data form of the target information is an nth-degree polynomial;

[0202] The polynomial coefficient storage module is used to retrieve the polynomial coefficient pair used in each butterfly operation based on the storage index of the polynomial coefficient pair received each time, and send it to the multiplication operation module.

[0203] The rotation factor storage module is used to obtain the target rotation factor and random rotation factor used in each butterfly operation based on the storage index of the target rotation factor and random rotation factor received each time, and send them to the multiplication operation module.

[0204] The multiplication module is used to perform multiplication calculations in a set form based on each received polynomial coefficient pair, target rotation factor, and random rotation factor, to obtain new polynomial coefficients corresponding to the target information under each number theory transformation cycle, and update and store them in the polynomial coefficient storage module.

[0205] The number theory transformation operation hardware provided by the technical solution of this invention introduces a random seed into the multiplication mask in the butterfly operation result during the NTT operation involved in information security computing to mask and encrypt the operation result. This can provide effective security protection for the operation of post-quantum cryptography algorithms without introducing a large amount of additional hardware resources, so as to resist side-channel attacks to the greatest extent.

[0206] Figure 9 This is a structural diagram of a security chip provided according to an embodiment of the present invention. Figure 9 As shown, the security chip specifically includes number theory transformation operation hardware 910 as described in any embodiment of the present invention.

[0207] Figure 10 This is a schematic diagram of the structure of an electronic device that implements the secure computation method for information according to embodiments of the present invention. For example... Figure 10 As shown, the electronic device specifically includes an electronic chip 1010 as described in any embodiment of the present invention.

[0208] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0209] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A secure computation method for information, characterized in that, include: In the process of secure computation of information, the target information to be transformed by number theory is obtained, wherein the data form of the target information is an nth degree polynomial; Based on the first random seed determined in each round of number theory transformation, the data operation order of the butterfly operation in each round of number theory transformation is determined, and the new polynomial coefficients corresponding to the target information are updated according to the data operation order. After completing all rounds of number theory transformations, the currently updated polynomial coefficients are determined as the result of the number theory transformation operation on the target information.

2. The method according to claim 1, characterized in that, Based on the first random seed determined in each round of number theory transformation, the data operation order of the butterfly operation in each round of number theory transformation is determined, and the new polynomial coefficients corresponding to the target information are updated according to the data operation order, specifically including: Based on the first and second random seeds determined in each number theory transformation round, the data operation order and the added multiplication mask of the butterfly operation in each number theory transformation round are determined, and the new polynomial coefficients corresponding to the target information are updated according to the data operation order and the multiplication mask.

3. The method according to claim 2, characterized in that, Based on the first and second random seeds determined in each number theory transformation round, the data operation order and the added multiplication mask for the butterfly operation in each number theory transformation round are determined. Then, according to the data operation order and the multiplication mask, the new polynomial coefficients corresponding to the target information are updated, including: Determine the first and second random seeds under the current number theory transformation round, and determine the multiplication mask to be used under the current number theory transformation round based on the second random seed; Based on the first random seed, the polynomial coefficient pairs used in each butterfly operation under the current number theory transformation cycle are determined successively. Then, multiple butterfly operations are performed based on the polynomial coefficient pairs and the matching multiplication mask to obtain the new polynomial coefficients corresponding to the target information under the current number theory transformation cycle.

4. The method according to claim 3, characterized in that, Based on the first random seed, the polynomial coefficient pairs used in each butterfly operation under the current number theory transformation cycle are determined successively. Multiple butterfly operations are then performed based on the polynomial coefficient pairs and the matched multiplication mask to obtain new polynomial coefficients corresponding to the target information under the current number theory transformation cycle, including: Based on the first random seed, within the range of values ​​that match the current number theory transformation cycle, determine the current position index that matches the current butterfly operation; Based on the current position index, retrieve the current polynomial coefficient pair that matches the current butterfly operation; Based on the current polynomial coefficient pair, the current rotation factor corresponding to the current position index, and the multiplication mask used in the current number theory transformation cycle, two new polynomial coefficients after masking are calculated.

5. The method according to claim 4, characterized in that, Based on the current polynomial coefficient pair, the current rotation factor corresponding to the current position index, and the multiplication mask used in the current number theory transformation cycle, two new polynomial coefficients after masking are calculated, including: Determine the first position index corresponding to the current rotation factor based on the current position index; The second position index of the multiplication mask used in the current number theory transformation cycle is summed with the first position index to obtain the third position index corresponding to the current summation rotation factor. From the pre-stored rotation factors, obtain the current random rotation factor that matches the second position index and the current summation rotation factor that corresponds to the third position index; Calculate the first multiplication result of the first polynomial coefficient in the current polynomial coefficient pair with the current random twisting factor, and calculate the second multiplication result of the second polynomial coefficient in the current polynomial coefficient pair with the current summation twisting factor; The sum of the first and second multiplication results is used as a polynomial coefficient after masking, and the subtraction between the first and second multiplication results is used as another polynomial coefficient after masking.

6. The method according to any one of claims 2-5, characterized in that, Based on the first and second random seeds determined in each number theory transformation cycle, the data operation order and the added multiplication mask for the butterfly operation in each number theory transformation cycle are determined, specifically including: If it is determined that the current number theory transformation round is not the last round, then the multiplication mask used in the current number theory transformation round is determined according to the second random seed under the current number theory transformation round. If the current number theory transformation round is the last round, then the multiplication mask used in the current number theory transformation round is calculated based on the multiplication masks used in all previous number theory transformation rounds.

7. A method for secure computation of information, characterized in that, include: In the process of secure computation of information, the target information to be transformed by number theory is obtained, wherein the data form of the target information is an nth degree polynomial; Based on the third random seed determined in each number theory transformation round, the multiplication mask added to the butterfly operation in each number theory transformation round is determined, and based on the multiplication mask, the new polynomial coefficients corresponding to the target information are updated according to the data operation order of the butterfly operation in each number theory transformation round. After completing all rounds of number theory transformations, the currently updated polynomial coefficients are determined as the result of the number theory transformation operation on the target information.

8. A secure information computing device, characterized in that, include: The target information acquisition module is used to acquire the target information to be transformed by number theory during the secure computation of information. The target information is in the form of an nth-degree polynomial. The data operation order processing module is used to determine the data operation order of the butterfly operation in each number theory transformation round based on the first random seed determined in each number theory transformation round, and update the new polynomial coefficients corresponding to the target information according to the data operation order. The transformation result determination module is used to determine the currently updated polynomial coefficients as the result of the number theory transformation operation on the target information after completing all rounds of number theory transformation.

9. A secure information computing device, characterized in that, include: The target information determination module is used to obtain the target information to be transformed by number theory during the secure computation of information. The target information is in the form of an nth-degree polynomial. The mask processing module is used to determine the multiplication mask added to the butterfly operation in each number theory transformation round based on the third random seed determined in each number theory transformation round, and update the new polynomial coefficients corresponding to the target information according to the multiplication mask and the data operation order of the butterfly operation in each number theory transformation round. The result generation module is used to determine the currently updated polynomial coefficients as the result of the number theory transformation operation on the target information after completing all rounds of number theory transformation.

10. A number-theoretic transformation operation hardware, characterized in that, include: The module includes a control module, a polynomial coefficient storage module, a twitch factor storage module, and a multiplication operation module, among which: The control module is used to receive a first random seed from an external input at each round of number theory transformation during the number theory transformation of the target information; based on the first random seed, it successively determines the storage index of the polynomial coefficient pairs used in each butterfly operation at each round of number theory transformation, and successively determines the storage index of at least one target twitch factor used in each butterfly operation; it sends the storage index of the polynomial coefficient pairs to the polynomial coefficient storage module, and sends the storage index of the target twitch factor to the twitch factor storage module; wherein, the data form of the target information is an nth-degree polynomial; The polynomial coefficient storage module is used to retrieve the polynomial coefficient pair used in each butterfly operation based on the storage index of the polynomial coefficient pair received each time, and send it to the multiplication operation module. The rotation factor storage module is used to obtain the target rotation factors used in each butterfly operation based on the storage index of the target rotation factor received each time, and send them to the multiplication operation module. The multiplication module is used to perform multiplication calculations of a set form based on each received polynomial coefficient pair and at least one target rotation factor, to obtain new polynomial coefficients corresponding to the target information under each number theory transformation cycle, and update and store them in the polynomial coefficient storage module.

11. The number theory transformation operation hardware according to claim 10, characterized in that, The control module is further used for: Based on the storage index of the polynomial coefficient pairs, the first storage index of the rotation factor used in each butterfly operation is determined; in each number theory transformation round, the second random seed from the external input is received, and based on the second random seed, the second storage index of the random rotation factor used in each number theory transformation round is determined; the first and second storage indices used in each butterfly operation in each number theory transformation round are summed to obtain the third storage index corresponding to the summed rotation factor, and the second and third storage indices are sent together to the rotation factor storage module; The rotation factor storage module is specifically used for: Whenever the second and third storage indices are received, the random rotation factor and summation rotation factor used in each butterfly operation are obtained and sent to the multiplication operation module.

12. The number theory transformation operation hardware according to claim 11, characterized in that, The control module specifically includes: Linear feedback shift register, first address generator, and second address generator; The linear feedback shift register is used to determine the target random number used in each butterfly operation in each number theory transformation round based on the first random seed received in each number theory transformation round, and send the target random number to the first address generator and the second address generator respectively. The first address generator is used to determine the storage index of the polynomial coefficient pairs of the target information used in each butterfly operation under each round of number theory transformation, based on the target random numbers received successively. The second address generator is used to determine the storage index of at least one target rotation factor used in each butterfly operation based on the second random seed received in each round of number theory transformation and the target random number received successively.

13. The number theory transformation operation hardware according to claim 11, characterized in that, The multiplication module specifically includes: a first multiplier, a second multiplier, an adder, and a subtractor; The first multiplier is used to perform multiplication calculation on the first polynomial coefficient in each received random rotation factor and polynomial coefficient pair to obtain the first multiplication result, and send the first multiplication result to the adder and the subtractor respectively; The second multiplier is used to perform multiplication calculations on the second polynomial coefficients in each received pair of addition and rotation factors and polynomial coefficients to obtain the second multiplication result, and then send the second multiplication result to the adder and subtractor respectively. The adder is used to calculate the sum of the first and second multiplication results received each time, and then update the sum as a polynomial coefficient after masking and store it in the polynomial coefficient storage module. The subtractor is used to calculate the subtraction value of the first multiplication result minus the second multiplication result each time it is received, and to update and store the subtraction value as another polynomial coefficient after masking processing in the polynomial coefficient storage module.

14. A number-theoretic transformation operation hardware, characterized in that, include: The module includes a control module, a polynomial coefficient storage module, a twitch factor storage module, and a multiplication operation module, among which: The control module is used to receive a third random seed from an external input at each number theory transformation round during the number theory transformation of the target information; determine the storage index of the random rotation factor used in each number theory transformation round based on the third random seed; determine the storage index of the polynomial coefficient pair used in each butterfly operation at each number theory transformation round, and determine the storage index of at least one target rotation factor used in each butterfly operation; send the storage index of the polynomial coefficient pair to the polynomial coefficient storage module, and send the storage index of the target rotation factor and the random rotation factor to the rotation factor storage module; wherein, the data form of the target information is an nth-degree polynomial; The polynomial coefficient storage module is used to retrieve the polynomial coefficient pair used in each butterfly operation based on the storage index of the polynomial coefficient pair received each time, and send it to the multiplication operation module. The rotation factor storage module is used to obtain the target rotation factor and random rotation factor used in each butterfly operation based on the storage index of the target rotation factor and random rotation factor received each time, and send them to the multiplication operation module. The multiplication module is used to perform multiplication calculations in a set form based on each received polynomial coefficient pair, target rotation factor, and random rotation factor, to obtain new polynomial coefficients corresponding to the target information under each number theory transformation cycle, and update and store them in the polynomial coefficient storage module.

15. A security chip comprising the number theory transformation operation hardware as described in any one of claims 10-14.

Images