Secure computing methods, devices and chips for information

Abstract

This invention discloses a secure computation method, apparatus, and chip for information. The method includes: during secure computation, obtaining the dividend and modulus of a modulo operation; determining a transformation constant for converting the dividend to the Montgomery domain based on the modulus, and secretly calculating a Montgomery modular multiplication factor based on the transformation constant and the modulus; dividing the dividend into multiple local dividends based on the transformation constant, and performing a matching Montgomery modular multiplication on each local dividend according to its position within the dividend and the Montgomery modular multiplication factor, obtaining multiple local modulo results; and calculating the modulo operation result between the dividend and the modulus based on the multiple local modulo results. The technical solution of this embodiment is based on an improved Montgomery modular multiplication algorithm, achieving fast and secure modulo computation during secure computation of information, improving the speed of modulo computation while resisting side-channel attacks.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and information security technology, and in particular to a secure computing method, apparatus and chip for information. Background Technology

[0002] With the increasing demand for information security, people widely use various cryptographic algorithms to encrypt and decrypt sensitive information in order to achieve secure communication. However, the process of encrypting and decrypting information often involves modulo (remainder) calculations of large numbers.

[0003] In computers and other semiconductor integrated circuits, the mainstream approach to modulo operations is division, yielding both the quotient and the remainder. However, in cryptography, the quotient in modulo operations is meaningless, and division is extremely slow, incurring significant time overhead. Furthermore, with the rapid development of side-channel attack techniques, attackers can probe for some or all of the sensitive data in division operations by collecting side-channel information, posing a serious risk of information leakage.

[0004] Therefore, how to efficiently and securely perform modulo operations during secure information computing is an important problem that needs to be solved. Summary of the Invention

[0005] This invention provides a secure computing method, apparatus, and chip for information.

[0006] According to one aspect of the present invention, a secure computation method for information is provided, comprising:

[0007] In the process of secure computation of information, obtain the dividend D and modulus N that match the modulo operation to be performed;

[0008] Based on the modulus N, determine the transformation constant R used to transform the dividend D to the Montgomery domain, and implicitly calculate the Montgomery modular multiplication factor R based on the transformation constant R and the modulus N. 2 %N;

[0009] According to the transformation constant R, the dividend D is split into multiple local dividends. Based on the position of each local dividend in the dividend D, at least one Montgomery modular multiplication is performed on at least one local dividend according to the Montgomery modular multiplication factor to obtain multiple local modular results.

[0010] Based on multiple local modulo results, calculate the modulo operation result between the dividend D and the modulus N.

[0011] According to another aspect of the present invention, a secure computing device for information is also provided, comprising:

[0012] The operation parameter acquisition module is used to acquire the dividend D and modulus N that match the modulo operation to be performed during the secure computation of information.

[0013] The modular multiplication factor privacy calculation module is used to determine the transformation constant R for transforming the dividend D to the Montgomery domain based on the modulus N, and to secretly calculate the Montgomery modular multiplication factor R based on the transformation constant R and the modulus N. 2 %N;

[0014] The local calculation module is used to split the dividend D into multiple local dividends according to the transformation constant R, and perform at least one Montgomery modular multiplication calculation on at least one local dividend according to the position of each local dividend in the dividend D and the Montgomery modular multiplication factor to obtain multiple local modular results.

[0015] The calculation result acquisition module is used to calculate the modulo operation result between the dividend D and the modulus N based on multiple local modulo results.

[0016] According to another aspect of the present invention, a security chip is also provided, the security chip comprising:

[0017] At least one processor; and

[0018] A memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform a secure computation method for information as described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, an electronic device is also provided, the electronic device including a security chip as described in any embodiment of the present invention.

[0021] According to another aspect of the present invention, a computer-readable storage medium is also provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the secure computation method for information as described in any embodiment of the present invention.

[0022] According to another aspect of the present invention, a computer program product is also provided, including a computer program that, when executed by a processor, implements the steps of the secure computation method for information as described in any embodiment of the present invention.

[0023] The technical solution of this invention, during the secure computation of information, obtains the dividend and modulus matching the modulo operation to be performed; determines a transformation constant for converting the dividend to the Montgomery domain based on the modulus, and secretly calculates the Montgomery modular multiplication factor based on the transformation constant and the modulus; splits the dividend into multiple local dividends based on the transformation constant, and performs at least one Montgomery modular multiplication calculation on at least one local dividend based on the position of each local dividend within the dividend, obtaining multiple local modulo results; and calculates the modulo operation result between the dividend and the modulus based on the multiple local modulo results. Based on the improved Montgomery modular multiplication algorithm, this invention achieves fast and secure modulo calculation during the secure computation of information, greatly improving the speed of modulo calculation and correspondingly reducing time overhead, providing effective security protection for the operation of information encryption and decryption algorithms, and maximizing resistance to side-channel attacks.

[0024] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0025] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a flowchart of a secure information calculation method provided by an embodiment of the present invention;

[0027] Figure 2 This is a flowchart of another secure information calculation method provided by an embodiment of the present invention;

[0028] Figure 3 This is a flowchart of another secure information calculation method provided by an embodiment of the present invention;

[0029] Figure 4 This is a flowchart of a method applicable to embodiments of the present invention for performing Montgomery modular multiplication calculations based on Montgomery modular multiplication factors to obtain multiple local modular results;

[0030] Figure 5 This is a flowchart illustrating a fast modulo calculation method applicable to an embodiment of the present invention.

[0031] Figure 6This is a schematic diagram of the structure of an information security computing device provided according to an embodiment of the present invention;

[0032] Figure 7 This is a schematic diagram of the structure of the security chip implementing the embodiments of the present invention;

[0033] Figure 8 This is a schematic diagram of the structure of an electronic device that implements an embodiment of the present invention. Detailed Implementation

[0034] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0035] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0036] Figure 1 This is a flowchart of a secure information computing method provided by an embodiment of the present invention. This embodiment is applicable to situations where the modulo operation involved in the calculation is accelerated and protected during the information encryption and decryption process using a set cryptographic algorithm. The method can be executed by a secure information computing device, which can be implemented in hardware and / or software and is generally configured in a secure chip used to implement information encryption and decryption operations. This electronic chip is generally configured in a set electronic device, such as a mobile phone, tablet computer, or vehicle terminal.

[0037] Correspondingly, such as Figure 1 As shown, the method may include:

[0038] S110. During the secure computation of information, obtain the dividend D and modulus N that match the modulo operation to be performed.

[0039] The secure computation process of the aforementioned information can be understood as the process by which an electronic device receives encrypted information and decrypts it using a pre-defined decryption algorithm, so that the decrypted information can be used for subsequent data processing. Alternatively, it can be understood as the process by which an electronic device encrypts private information using a pre-defined encryption algorithm before sending the encrypted information.

[0040] Optionally, the encryption or decryption algorithm described above can be an asymmetric encryption or decryption algorithm, such as RSA, DSA, SM2, or ECC. Correspondingly, in an optional implementation of this embodiment, during the secure computation of information, obtaining the dividend D and modulus N that match the modulo operation to be performed may include:

[0041] During the process of performing information encryption and decryption calculations based on asymmetric encryption and decryption algorithms on the input information, the dividend D and modulus N that match the modulo operation to be performed are obtained.

[0042] In the process of encrypting and decrypting information using the aforementioned asymmetric encryption and decryption algorithms, modulo operations on large numbers are often involved. That is, it is necessary to calculate the result of D%N.

[0043] In this embodiment, considering that the calculation method of obtaining the required remainder directly through division is time-consuming and easily leads to the leakage of a large amount of sensitive information, an improved Montgomery modular multiplication algorithm is considered to achieve fast modular calculation.

[0044] S120. Based on the modulus N, determine the transformation constant R used to transform the dividend D to the Montgomery domain, and implicitly calculate the Montgomery modular multiplication factor R based on the transformation constant R and the modulus N. 2 %N.

[0045] First, let's briefly describe the concepts related to Montgomery modular multiplication. Montgomery modular multiplication can be understood as a method to accelerate modular multiplication calculations, enabling rapid implementation of the following calculations:

[0046] Mont(x,y,N)=x*y*R -1 %N

[0047] Where N is an odd number, the binary length is Len(N), and x, y are the input multipliers. <N

[0048] Where R is Montgomery's constant, generally R = 2 Len(N) That is, R is an integer power of 2 greater than N.

[0049] In practice, considering factors such as the bit width of the hardware multiplier, the power of R is often a multiple of a binary integer, such as R = 2.32*i This means that R has 32 integer multiples of binary 0s after its highest bit 1. Therefore, when the length of N is not an integer multiple of 32, R will be less than 2. Len(N) It is several bits long.

[0050] In common cryptographic algorithms such as modular idempotency, a large number of modular multiplications (referring to calculating the modulus after multiplication) are required. If all the input multipliers for modular multiplication (taking x and y as an example) are pre-multiplied modularly by the aforementioned R, i.e., the inputs become x*R%N and y*R%N, then:

[0051] Mont(xR,yR,N)=xR*yR*R -1 %N = x * y * R%N

[0052] This means the output will also be multiplied by an additional R. Therefore, during multiple modular multiplications, the state of "multiplied by an additional R" will not change until all modular multiplications are completed, and the result (let's call it w) will still be w*R%N. At this point, we only need to perform a Montgomery modular multiplication with 1 once:

[0053] Mont(wR,1,N)=wR*R -1 By setting %N = w%N, we can obtain the desired modulo result.

[0054] As can be seen from the above analysis, using Montgomery modular multiplication requires pre-computation. The purpose of pre-computation is to transform all data involved in modular multiplication into a state multiplied by an R. This transformation is generally called entering the Montgomery domain, and correspondingly, the operation of removing R is called exiting the Montgomery domain.

[0055] As described above, by performing a multiplication operation of R on all inputs before modular multiplication and then transferring them to the Montgomery domain before performing the Montgomery modular multiplication with the modulus N, the modulo result can be obtained faster and more conveniently than by directly performing division. However, the inventors further discovered that transferring to the Montgomery domain requires a pre-calculation operation of multiplying all inputs by R before the modulus N can be calculated, and the time overhead of this pre-calculation is also relatively large.

[0056] Based on this, the inventors proposed further improvements to the aforementioned pre-calculation process. That is, if R*R%N=R can be directly obtained... 2 %N, then for any data that needs to be pre-calculated (let's say x), i )have:

[0057] Mont(x i ,R 2 (N) = x i *R 2 *R -1 %N=x i *R%N

[0058] Thus, by calculating R only once 2 Using %N avoids the need to pre-calculate R for each input when multiple inputs need to be transferred to the Montgomery domain. In various embodiments of the present invention, R is... 2 %N is called the Montgomery modular multiplication factor.

[0059] Building upon the aforementioned implementation method, the inventors further considered the computation of R... 2 %N involves the calculation of the square of R and R 2 The division by %N is performed, and R is generally not much different from N. In this case, by executing R... 2 The computation significantly increases the bit length of R. Since the operation time of division is positively correlated with the bit length difference between the dividend and divisor, the above operation also increases the computation time of R. 2 The time consumption of %N. Similarly, the aforementioned long division operation time may leak the Hamming weight of the quotient under side-channel attacks, making it easier for R, or R0, to be stolen. 2 The specific value of %N.

[0060] Based on this, the inventor creatively proposed a solution for R. 2 The implicit calculation method for %N. In this implicit calculation method, the division calculation only calculates the specific value of R%N, and by transferring the value 2 into the Montgomery domain, R can ultimately be obtained through Montgomery modular exponentiation, which is equivalent to calculating R. 2 %N. In the above division calculation process, since the bit lengths between R and N are not significantly different, the division result can be obtained with a small time overhead, which can greatly reduce the risk of side-channel leakage.

[0061] S130. Based on the conversion constant R, the dividend D is split into multiple local dividends. Based on the position of each local dividend in the dividend D, at least one Montgomery modular multiplication is performed on at least one local dividend according to the Montgomery modular multiplication factor to obtain multiple local modular results.

[0062] In this embodiment, since the dividend D is generally a large number, its bit length differs greatly from the conversion constant R or the modulus N. In order to further reduce the amount of computation, the dividend D is divided into multiple segments of local dividends according to the conversion constant R, and each segment of local dividend is assigned a corresponding bit weight according to its position in the dividend D.

[0063] Furthermore, based on the place weights, Montgomery modular multiplication factors can be used to perform at least one Montgomery modular multiplication on at least one local dividend to obtain multiple local modular results.

[0064] S140. Based on multiple local modulo results, calculate the modulo operation result between the dividend D and the modulus N.

[0065] In an optional implementation of this embodiment, calculating the modulo operation result between the dividend D and the modulus N based on multiple local modulo results may include:

[0066] The modulo N results from multiple local modulo calculations are summed to obtain the modulo operation result.

[0067] That is, after obtaining multiple local modulo results calculated for the local dividends of multiple segments, the modulo operation result of D%N can be obtained by adding the above local modulo results modulo N.

[0068] The technical solution of this invention, during the secure computation of information, obtains the dividend and modulus matching the modulo operation to be performed; determines a transformation constant for converting the dividend to the Montgomery domain based on the modulus, and secretly calculates the Montgomery modular multiplication factor based on the transformation constant and the modulus; splits the dividend into multiple local dividends based on the transformation constant, and performs at least one Montgomery modular multiplication calculation on at least one local dividend based on the position of each local dividend within the dividend, obtaining multiple local modulo results; and calculates the modulo operation result between the dividend and the modulus based on the multiple local modulo results. Based on the improved Montgomery modular multiplication algorithm, this invention achieves fast and secure modulo calculation during the secure computation of information, greatly improving the speed of modulo calculation and correspondingly reducing time overhead, providing effective security protection for the operation of information encryption and decryption algorithms, and maximizing resistance to side-channel attacks.

[0069] Figure 2 This is a flowchart of another secure information calculation method provided by an embodiment of the present invention. This embodiment is a refinement based on the above embodiments. In this embodiment, specifically, it details "determining the transformation constant R used to transform the dividend D to the Montgomery domain according to the modulus N" and "secretly calculating the Montgomery modular multiplication factor R based on the transformation constant R and the modulus N". 2 The operation of "%N" is specified.

[0070] Correspondingly, such as Figure 2 As shown, the method may include:

[0071] S210. In the process of secure computation of information, obtain the dividend D and modulus N that match the modulo operation to be performed.

[0072] S220. Based on the binary length of the modulus N and the bit width of the hardware algorithm engine, determine the binary length Len(R) of the conversion constant R.

[0073] As mentioned earlier, the conversion constant R is greater than the modulus N, and the conversion constant R is an integer power of 2. Accordingly, we can first calculate the binary length Len(N) of the modulus N. If this binary length Len(N) matches the bit width of the hardware algorithm engine (e.g., 32-bit or 64-bit), then the binary length Len(R) of the conversion constant R can be set based on Len(N). For example, Len(R) = Len(N) + 1. If this binary length Len(N) does not match the bit width of the hardware algorithm engine, then the binary length Len(R) of the conversion constant R can be set directly based on the bit width of the hardware algorithm engine. For example, Len(R) = an integer multiple of the bit width + 1.

[0074] S230. Under the given binary length Len(R), construct an integer power of 2 with the highest bit set to 1 and the remaining bits set to 0, as the conversion constant R.

[0075] In a specific example, if Len(R) is 10 in decimal, then a binary conversion constant R of the form 1000000000 can be constructed.

[0076] S240. Call the modulus calculation function to calculate R%N.

[0077] In this embodiment, the improved Montgomery modular multiplication algorithm performs only one division (modulo) operation, that is, it calculates R%N. As mentioned earlier, in general, the difference in bit length between R and N is not significant; therefore, the computational cost of the above division operation is very small and can be completed in a very short time. This is different from directly calculating R. 2 The time cost of the modulo operation %N is on a completely different order of magnitude.

[0078] S250, call the basic calculation function to calculate 2R%N, so as to introduce the factor 2 under the Montgomery domain.

[0079] In this embodiment, the inventors considered that R is an integer power of 2, and as can be seen from the construction of R in S230, R = 2. Len(R)-1 Furthermore, a creative approach was taken to indirectly calculate R by introducing a factor of 2 under the Montgomery domain. 2 %N.

[0080] Specifically, 2R%N can be obtained by performing a simple addition operation, a comparison operation, and a subtraction operation. That is, after calculating the value of R%N, the two identical R%N values ​​are added together. After obtaining the addition result, it is compared whether the addition result is greater than N. If it is, the addition result is subtracted from the value of N, and this is taken as the result of 2R%N; otherwise, the addition result is taken directly as the result of 2R%N.

[0081] S260. By performing at least one Montgomery modular multiplication calculation, construct a modular exponentiation operation that matches 2R%N, and obtain 2 Len(R)-1 R%N.

[0082] In this embodiment, after obtaining the factor 2 under the Montgomery domain, a modular exponentiation operation can be constructed based on the factor 2 under the Montgomery domain to finally obtain 2. Len(R)-1 R%N.

[0083] Specifically, performing a Montgomery modular multiplication on two identical 2R%N results in 2. 2 R%N, two identical 2 2 Performing Montgomery modular multiplication on R%N yields 2. 4 R%N, and so on, can eventually lead to 2. Len(R)-1 R%N. Optionally, modular exponentiation can be implemented using bit scanning algorithms and other related techniques. This embodiment does not limit the specific algorithm used for modular exponentiation.

[0084] S270, calculate the 2 Len(R)-1 R%N was determined to be the Montgomery modular multiplication factor R. 2 %N.

[0085] As mentioned earlier, since R = 2 Len(R)-1 Therefore, 2 Len(R)-1 R%N is equivalent to R*R%N, which means that R is calculated. 2 %N.

[0086] It should be noted that after calculating R... 2 During the %N calculation, only one actual division operation is used; the rest employ simple basic operations (addition, subtraction, and comparison) or efficient Montgomery modular multiplication. Furthermore, because the difference between the dividend and the modulus is small, this division operation does not generate significant signal fluctuations during side-channel detection. Similarly, other computational methods, due to their simplicity, also do not produce significant signal fluctuations. Therefore, through the technical solution of this invention, the required R can be efficiently calculated while ensuring computational efficiency and security. 2 %N.

[0087] S280. Based on the conversion constant R, the dividend D is split into multiple local dividends. Based on the position of each local dividend in the dividend D, at least one Montgomery modular multiplication is performed on at least one local dividend according to the Montgomery modular multiplication factor to obtain multiple local modular results.

[0088] S290. Based on multiple local modulo results, calculate the modulo operation result between the dividend D and the modulus N.

[0089] The technical solution of this invention calculates R%N by calling a modulo function; calculates 2R%N by calling a basic calculation function to introduce a factor of 2 under the Montgomery domain; and constructs a modular exponentiation operation matching 2R%N by performing at least one Montgomery modular multiplication calculation to obtain 2. Len(R)-1 R%N; the calculated 2 Len(R)-1 R%N was determined to be the Montgomery modular multiplication factor R. 2 The %N technique provides a new implementation method for Montgomery precomputation. Based on this new precomputation method, fast and secure modulo calculation is achieved in the secure computation process of information. This can greatly improve the speed of modulo calculation and reduce the time overhead accordingly, providing effective security protection for the operation of information encryption and decryption algorithms, so as to resist side-channel attacks to the greatest extent.

[0090] Figure 3 This is a flowchart of another information security calculation method provided by an embodiment of the present invention. This embodiment is a refinement based on the above embodiments. In this embodiment, the operation of "splitting the dividend D into multiple local dividends according to the conversion constant R, and performing at least one Montgomery modular multiplication calculation on at least one local dividend according to the position of each local dividend in the dividend D, based on the Montgomery modular multiplication factor, to obtain multiple local modular results" is specifically specified.

[0091] Correspondingly, such as Figure 3 As shown, the method may specifically include:

[0092] S310. In the process of secure computation of information, obtain the dividend D and modulus N that match the modulo operation to be performed.

[0093] S320. Based on the modulus N, determine the transformation constant R used to transform the dividend D to the Montgomery domain, and implicitly calculate the Montgomery modular multiplication factor R based on the transformation constant R and the modulus N. 2 %N.

[0094] S330. Determine the split length based on the binary length Len(R) of the conversion constant R.

[0095] In this embodiment, to ensure that the bit length difference between each local dividend and the modulus is not significant in the subsequent modulo operation, the dividend D can be split based on the bit length of the conversion constant R. That is, the binary length Len(R)-1 of the conversion constant R can be used as the split length.

[0096] S340. According to the splitting length, the dividend D is split into multiple segments of local dividends from low to high.

[0097] S350. If it is determined that the binary length of the local dividend of the highest segment has not reached the split length, then the high-order bits of the local dividend of the highest segment are padded with 0 until the split length is reached.

[0098] In a specific example, if the split length is 5, the data form of the dividend D is A. 13 A 12 A 11 A 10 A9A8A7A6A5A4A3A2A1A0 can be sequentially split from low to high into A4A3A2A1A0, A9A8A7A6A5, and A... 13 A 12 A 11 A 10 There are three segments of local dividends. The highest segment's local dividend, A... 13 A 12 A 11 A 10 The binary length of A is 4, which does not reach the split length of 5. Therefore, we can further analyze A. 13 A 12 A 11 A 10 To fill the high-order bits with 0, we get 0A. 13 A 12 A 11 A 10 .

[0099] S360. Assign a place value to each local dividend based on its position in the dividend D.

[0100] Specifically, a positional weight (also called a positional weight) can be assigned to each local dividend according to the order in which it is split. The earlier the split, the lower the positional weight of that local dividend segment. Continuing the previous example, for the local dividend segment A4A3A2A1A0, the positional weight can be set to 0; for the local dividend segment A9A8A7A6A5, the positional weight can be set to 1; and for the local dividend segment 0A... 13 A 12 A 11 A 10 This local dividend can be set to a place value of 2.

[0101] Accordingly, in an optional implementation of this embodiment, a bit weight is assigned to each local dividend based on its position in the dividend D, which may specifically include:

[0102] In order from low to high segment, obtain the current local dividend in turn, and set the position weight of the current local dividend to the current position weight, wherein the current position weight is initialized to 0;

[0103] Increment the current position weight by 1 to obtain the new current position weight, and then return to execute the operation of obtaining the current local dividend in order from the lowest segment to the highest segment, until all local dividends have been set.

[0104] S370. Determine the modular multiplication number corresponding to each local dividend based on the place value of each local dividend.

[0105] Specifically, the place value of each local dividend can be used as the number of modular multiplications corresponding to each local dividend. Continuing the previous example, if the place value of A4A3A2A1A0 is 0, then 0 Montgomery modular multiplications need to be performed on A4A3A2A1A0. If the place value of A9A8A7A6A5 is 1, then 1 Montgomery modular multiplication needs to be performed on A9A8A7A6A5. 13 A 12 A 11 A 10 If the position weight is 2, then it is necessary to [address] 0A. 13 A 12 A 11 A 10 Perform two Montgomery modular multiplications.

[0106] S380. Based on the Montgomery modular multiplication factor, perform Montgomery modular multiplication calculation on each local dividend according to the matched modular multiplication number to obtain multiple local modular results.

[0107] In one optional implementation of this embodiment, such as Figure 4 As shown, based on the Montgomery modular multiplication factor, Montgomery modular multiplication is performed on each local dividend according to the matched number of modular multiplications, resulting in multiple local modular results, which may include:

[0108] S3801. Obtain the target local dividend currently being processed, and the target modular multiplication count that matches the target local dividend.

[0109] S3802. Determine if the target modular multiplication count is not 0: If yes, execute S3803; otherwise, execute S3804.

[0110] S3803. Take the target modular multiplication count as the count to be calculated and execute S3805.

[0111] S3804. Directly use the target local dividend as the local modulo result that matches the target local dividend.

[0112] S3805. Perform a Montgomery modular multiplication calculation based on the Montgomery modular multiplication factor and the target local dividend to obtain the current modular result, and decrement the number of calculations to be performed by -1 to obtain a new number of calculations to be performed.

[0113] S3806. Check if the new number of counts to be calculated is not 0: if yes, execute S3807; otherwise, execute S3808.

[0114] S3807. After taking the current modulus result as the new target local dividend, return to execute S3805.

[0115] S3808. Use the current modulus result as the local modulus result that matches the target local dividend.

[0116] In this optional embodiment, let the modulo operation to be calculated be D % N, where the binary length of D is Len(D). First, calculate the multiple m of the binary length of D Len(D) with respect to the binary length of R Len(R)-1, where... It represents rounding up.

[0117] Then, the dividend D can be segmented from the least significant bit to the most significant bit according to Len(R)-1:

[0118] D = D m-1 |D m-2 ...D2|D1|D0, where the highest segment D m-1 If less than Len(R)-1 bits are needed, then in the highest segment D... m-1 Fill in the high-order zeros.

[0119] It can be noted at this point that if the dividend D is considered as a large number in a base q, the value of each segment is D. i Then q = R. R is the transformation constant of the Montgomery field, and also the place value of each segment after the dividend D is segmented according to R:

[0120] D = D m-1 *R m-1 +D m-2 R m-2 ...D2*R 2 +D1*R+D0

[0121] At this point, it can be observed that when performing Montgomery modular multiplication calculations on each local dividend according to the matching number of modular multiplications based on the Montgomery modular multiplication factor, D0 does not need to perform Montgomery modular multiplication calculations.

[0122] D1*R%N=Mont(D1,R) 2 ,N);

[0123] D2*R 2 %N = Mont(Mont(D2,R) 2 ,N),R 2 ,N);

[0124] D3*R 3 %N = Mont(Mont(Mont(D2,R) 2 ,N),R 2 ,N),R 2 ,N), and so on.

[0125] That is, if you want to calculate the position weight R k The modulo result between the local dividend and the modulus N only needs to be compared with R. 2 %N can be calculated by performing k Montgomery modular multiplications. Then, by summing the local modular multiplication results modulo N, the final desired modular multiplication result can be obtained.

[0126] Specifically, the complete modulus calculation process described above is as follows: Figure 5 Detailed examples are provided. For example... Figure 5 As shown, the dividend D is completely split into D0, D1, D2, ..., D by padding the high-order bits with 0. m-2 and D m-1 Afterwards, D0 does not require Montgomery modular multiplication, while D1 requires one Montgomery modular multiplication to obtain the modulo result corresponding to D1, that is, based on the modulus N and the pre-calculated R. 2 %N (that is, Figure 5 The RR%N) in the calculation is performed once using the Montgomery modular multiplication (i.e., Figure 5 (Mon with RR%N).

[0127] Similarly, D2 requires two Montgomery modular multiplications to obtain the modulo result corresponding to D2, while D m-1 It requires m-1 Montgomery modular multiplications to obtain the result with respect to D. m-1 The corresponding modulo results. Finally, after calculating the modulo results for D1, D2, ..., D... m-2 and D m-1 After calculating the modulus results for each, add all the above modulus results to D0 modulo N (that is, ...). Figure 5Using ModAdd in the code, you can eventually get the result D%N.

[0128] It needs to be emphasized again that in the above calculation process, only the pre-calculation of R... 2 When %N is called, the division operator is invoked. Since R and N are often of roughly the same length, the time overhead of this call is minimal, and only a few bits of the highest modulus N are leaked on the side channel. Because all other operations are modular addition and Montgomery modular multiplication, no other specially customized computing resources are required. Furthermore, the Montgomery modular multiplication operation time is essentially constant, and its slight time fluctuations cannot be directly linked to any sensitive information. Therefore, compared to existing schemes that leak a significant amount of information in the quotient (D / N) under direct division, the technical solution of this invention has virtually no information leakage.

[0129] S390. Add the multiple local modulo results modulo N to obtain the modulo operation result.

[0130] The technical solution of this invention, during the secure computation of information, obtains the dividend and modulus matching the modulo operation to be performed; determines a transformation constant for converting the dividend to the Montgomery domain based on the modulus, and secretly calculates the Montgomery modular multiplication factor based on the transformation constant and the modulus; splits the dividend into multiple local dividends based on the transformation constant, and performs at least one Montgomery modular multiplication calculation on at least one local dividend based on the position of each local dividend within the dividend, obtaining multiple local modulo results; and calculates the modulo operation result between the dividend and the modulus based on the multiple local modulo results. Based on the improved Montgomery modular multiplication algorithm, this invention achieves fast and secure modulo calculation during the secure computation of information, greatly improving the speed of modulo calculation and correspondingly reducing time overhead, providing effective security protection for the operation of information encryption and decryption algorithms, and maximizing resistance to side-channel attacks.

[0131] Based on the above embodiments, during the secure computation of information, obtaining the dividend D and modulus N that match the modulo operation to be performed may further include:

[0132] In the process of secure computation of information, the privacy divisor D' that needs to be protected is obtained;

[0133] Randomly generate a target random number M, and sum the privacy dividend D' with the target random number M to obtain the dividend D;

[0134] The method may further include: calculating the modulo operation result between the target random number M and the modulus N;

[0135] Accordingly, after calculating the modulo operation result between the dividend D and the modulus N based on multiple local modulo results, it may also include:

[0136] The modulo operation result between the dividend D and the modulus N is subtracted from the modulo operation result between the target random number M and the modulus N by modulo N, to obtain the modulo operation result between the privacy dividend D' and the modulus N.

[0137] That is, set D = D′ + M, where M is the target random number, and the binary length of M is the same as the binary length of D′. Calculate the modulo of D and M respectively according to the above process to obtain D%N and M%N, and then calculate the modulo N subtraction operation: (D%NM%N)%N = D′%N.

[0138] With the above settings, comprehensive masking protection of the privacy dividend D' can be achieved at a low cost (two fast modulo operations), thereby further ensuring the security of privacy information.

[0139] Figure 6 This is a schematic diagram of the structure of a secure computing device for information provided in an embodiment of the present invention. Figure 6 As shown, the device includes: a computational parameter acquisition module 610, a modular multiplication factor privacy calculation module 620, a local calculation module 630, and a computational result acquisition module 640, wherein:

[0140] The operation parameter acquisition module 610 is used to acquire the dividend D and modulus N that match the modulo operation to be performed during the secure computation of information.

[0141] The modular multiplication factor privacy calculation module 620 is used to determine the transformation constant R used to transform the dividend D to the Montgomery domain based on the modulus N, and to secretly calculate the Montgomery modular multiplication factor R based on the transformation constant R and the modulus N. 2 %N;

[0142] The local calculation module 630 is used to split the dividend D into multiple local dividends according to the conversion constant R, and perform at least one Montgomery modular multiplication calculation on at least one local dividend according to the position of each local dividend in the dividend D and the Montgomery modular multiplication factor to obtain multiple local modular results.

[0143] The calculation result acquisition module 640 is used to calculate the modulo operation result between the dividend D and the modulus N based on multiple local modulo results.

[0144] The technical solution of this invention, during the secure computation of information, obtains the dividend and modulus matching the modulo operation to be performed; determines a transformation constant for converting the dividend to the Montgomery domain based on the modulus, and secretly calculates the Montgomery modular multiplication factor based on the transformation constant and the modulus; splits the dividend into multiple local dividends based on the transformation constant, and performs at least one Montgomery modular multiplication calculation on at least one local dividend based on the position of each local dividend within the dividend, obtaining multiple local modulo results; and calculates the modulo operation result between the dividend and the modulus based on the multiple local modulo results. Based on the improved Montgomery modular multiplication algorithm, this invention achieves fast and secure modulo calculation during the secure computation of information, greatly improving the speed of modulo calculation and correspondingly reducing time overhead, providing effective security protection for the operation of information encryption and decryption algorithms, and maximizing resistance to side-channel attacks.

[0145] Based on the above embodiments, the conversion constant R is greater than the modulus N, and the conversion constant R is an integer power of 2.

[0146] Based on the above embodiments, the modular multiplication factor privacy calculation module 620 is specifically used for:

[0147] The binary length Len(R) of the conversion constant R is determined based on the binary length of the modulus N and the bit width of the hardware algorithm engine.

[0148] Under the given binary length Len(R), an integer power of 2 with the highest bit set to 1 and the remaining bits set to 0 is constructed as the conversion constant R.

[0149] Based on the above embodiments, the modular multiplication factor privacy calculation module 620 is further used for:

[0150] Call the modulo function to calculate R%N;

[0151] Call the basic calculation function to calculate 2R%N, and introduce the factor 2 under the Montgomery domain;

[0152] By performing at least one Montgomery modular multiplication, a modular exponentiation operation matching 2R%N is constructed, resulting in 2. Len (R)-1 R%N;

[0153] The calculated 2 Len(R)-1 R%N was determined to be the Montgomery modular multiplication factor R. 2 %N.

[0154] Based on the above embodiments, the local calculation module 630 can be specifically used for:

[0155] The split length is determined based on the binary length Len(R) of the conversion constant R;

[0156] According to the aforementioned splitting length, the dividend D is split into multiple segments of local dividends from low to high;

[0157] If it is determined that the binary length of the local dividend in the highest segment has not reached the split length, then the high-order bits of the local dividend in the highest segment are padded with 0 until the split length is reached.

[0158] Based on the above embodiments, the local calculation module 630 may further include:

[0159] The bit weight setting unit is used to set the bit weight for each local dividend according to the position of each local dividend in the dividend D;

[0160] The modular multiplication number determination unit is used to determine the modular multiplication number corresponding to each local dividend based on the place value of each local dividend;

[0161] The local modular multiplication result acquisition unit is used to perform Montgomery modular multiplication calculation on each local dividend according to the matching number of modular multiplications based on the Montgomery modular multiplication factor, and obtain multiple local modular multiplication results.

[0162] Based on the above embodiments, the position weight setting unit can be specifically used for:

[0163] In order from low to high segment, obtain the current local dividend in turn, and set the position weight of the current local dividend to the current position weight, wherein the current position weight is initialized to 0;

[0164] Increment the current position weight by 1 to obtain the new current position weight, and then return to execute the operation of obtaining the current local dividend in order from the lowest segment to the highest segment, until all local dividends have been set.

[0165] Based on the above embodiments, the local modulus result acquisition unit can be specifically used for:

[0166] Obtain the target local dividend currently being processed, and the target modular multiplication count that matches the target local dividend;

[0167] If the target modular multiplication count is not 0, then the target modular multiplication count is used as the count to be calculated;

[0168] Perform a Montgomery modular multiplication calculation based on the Montgomery modular multiplication factor and the target local dividend to obtain the current modular result, and then decrement the number of calculations to be performed by -1 to obtain a new number of calculations to be performed.

[0169] If the number of calculations to be performed is not zero, then the current modulo result is used as the new target local dividend, and the operation of performing a Montgomery modular multiplication calculation based on the Montgomery modular multiplication factor and the target local dividend is returned.

[0170] If the number of calculations to be performed is 0, then the current modulus result is taken as the local modulus result that matches the target local dividend.

[0171] If the target modular multiplication count is 0, then the target local dividend is directly used as the local modulo result that matches the target local dividend.

[0172] Based on the above embodiments, the calculation result acquisition module 640 can be specifically used for:

[0173] The modulo N results from multiple local modulo calculations are summed to obtain the modulo operation result.

[0174] Based on the above embodiments, the operation parameter acquisition module 610 can be specifically used for:

[0175] In the process of secure computation of information, the privacy divisor D' that needs to be protected is obtained;

[0176] Randomly generate a target random number M, and sum the privacy dividend D' with the target random number M to obtain the dividend D;

[0177] The apparatus may further include a correlation modulus result acquisition module, used for:

[0178] The result of the modulo operation between the target random number M and the modulus N is calculated.

[0179] Accordingly, the device may further include a privacy processing module, used for:

[0180] After calculating the modulo operation result between the dividend D and the modulus N based on multiple local modulo results, the modulo operation result between the dividend D and the modulus N is subtracted from the modulo operation result between the target random number M and the modulus N by modulo N to obtain the modulo operation result between the privacy dividend D' and the modulus N.

[0181] Based on the above embodiments, the operation parameter acquisition module 610 can be specifically used for:

[0182] During the process of performing information encryption and decryption calculations based on asymmetric encryption and decryption algorithms on the input information, the dividend D and modulus N that match the modulo operation to be performed are obtained.

[0183] The secure computing device for information provided in the embodiments of the present invention can execute the secure computing method for information provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of executing the method.

[0184] The collection, storage, use, processing, transmission, provision, and disclosure of user personal information involved in the technical solution disclosed herein comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0185] Figure 7 A schematic diagram of the structure of a security chip 10 that can be used to implement an embodiment of the present invention is shown.

[0186] The security chip 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the processor 11. The memory stores computer programs executable by the processor 11. The processor 11 can perform various appropriate actions and processes based on the computer programs stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the security chip 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0187] The I / O interface 15 in the security chip 10 may include eSPI (Enhanced Serial Peripheral Interface) and SPI (Serial Peripheral Interface), etc.

[0188] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, for example, performing secure computation methods for information as described in the various embodiments of the present invention.

[0189] That is, in the process of secure computation of information, the dividend D and modulus N that match the modulo operation to be performed are obtained;

[0190] Based on the modulus N, determine the transformation constant R used to transform the dividend D to the Montgomery domain, and implicitly calculate the Montgomery modular multiplication factor R based on the transformation constant R and the modulus N. 2 %N;

[0191] According to the transformation constant R, the dividend D is split into multiple local dividends. Based on the position of each local dividend in the dividend D, at least one Montgomery modular multiplication is performed on at least one local dividend according to the Montgomery modular multiplication factor to obtain multiple local modular results.

[0192] Based on multiple local modulo results, calculate the modulo operation result between the dividend D and the modulus N.

[0193] In some embodiments, the secure computation method for information as described in the various embodiments of the present invention can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 16. In some embodiments, part or all of the computer program can be loaded and / or installed on the security chip 10 via ROM 12. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the secure computation method for information as described above in the various embodiments of the present invention can be performed. Alternatively, in other embodiments, processor 11 can be configured to perform the secure computation method for information as described in the various embodiments of the present invention by any other suitable means (e.g., by means of firmware).

[0194] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0195] Figure 8 This is a schematic diagram of the structure of an electronic device implementing an embodiment of the present invention. The electronic device includes a security chip 810 as described in any one of the embodiments of the present invention.

[0196] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0197] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0198] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0199] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method of secure computation of information, characterized by, include: In the process of secure computation of information, obtain the dividend D and modulus N that match the modulo operation to be performed; According to the modulus N, a conversion constant R for converting the dividend D to the Montgomery domain is determined, and according to the conversion constant R and the modulus N, a Montgomery modular multiplication factor R is secretly computed 2 % N; According to the transformation constant R, the dividend D is split into multiple local dividends. Based on the position of each local dividend in the dividend D, at least one Montgomery modular multiplication is performed on at least one local dividend according to the Montgomery modular multiplication factor to obtain multiple local modular results. Based on multiple local modulo results, calculate the modulo operation result between the dividend D and the modulus N.

2. The method of claim 1, wherein, The conversion constant R is greater than the modulus N, and the conversion constant R is an integer power of 2.

3. The method of claim 2, wherein, Based on the modulus N, determine the transformation constant R used to transform the dividend D to the Montgomery domain, including: The binary length Len(R) of the conversion constant R is determined based on the binary length of the modulus N and the bit width of the hardware algorithm engine. Under the given binary length Len(R), an integer power of 2 with the highest bit set to 1 and the remaining bits set to 0 is constructed as the conversion constant R.

4. The method of claim 3, wherein, According to the conversion constant R and the modulus N, the secret computation Montgomery modular multiplication factor R 2 %N, comprising: Call the modulo function to calculate R%N; Call the basic calculation function to calculate 2R%N, and introduce the factor 2 under the Montgomery domain; By performing at least one Montgomery modular multiplication computation, a modular exponentiation operation matching 2R%N is constructed to yield 2 Len(R)- 1 R%N; The calculated 2 Len(R)-1 R %N, determined as Montgomery modular multiplier R 2 %N.

5. The method according to any one of claims 1 to 4, characterized in that, Based on the transformation constant R, the dividend D is split into multiple segments of local dividends, including: The split length is determined based on the binary length Len(R) of the conversion constant R; According to the aforementioned splitting length, the dividend D is split into multiple segments of local dividends from low to high; If it is determined that the binary length of the local dividend in the highest segment has not reached the split length, then the high-order bits of the local dividend in the highest segment are padded with 0 until the split length is reached.

6. The method of claim 5, wherein, Based on the position of each local dividend in the dividend D, at least one Montgomery modular multiplication is performed on at least one local dividend according to the Montgomery modular multiplication factor, resulting in multiple local modular results, including: Assign a bit weight to each local dividend based on its position in the dividend D; Determine the modular multiplication number corresponding to each local dividend based on the place value of each local dividend; Based on the Montgomery modular multiplication factor, Montgomery modular multiplication is performed on each local dividend according to the matched number of modular multiplications to obtain multiple local modular results.

7. The method of claim 6, wherein, Based on the position of each local dividend in the dividend D, assign a place value to each local dividend, including: In order from low to high segment, obtain the current local dividend in turn, and set the position weight of the current local dividend to the current position weight, wherein the current position weight is initialized to 0; Increment the current position weight by 1 to obtain the new current position weight, and then return to execute the operation of obtaining the current local dividend in order from the lowest segment to the highest segment, until all local dividends have been set.

8. The method of claim 6, wherein, Based on the Montgomery modular multiplication factor, Montgomery modular multiplication is performed on each local dividend according to the matched number of modular multiplications, resulting in multiple local modular results, including: Obtain the target local dividend currently being processed, and the target modular multiplication count that matches the target local dividend; If the target modular multiplication count is not 0, then the target modular multiplication count is used as the count to be calculated; Perform a Montgomery modular multiplication calculation based on the Montgomery modular multiplication factor and the target local dividend to obtain the current modular result, and then decrement the number of calculations to be performed by -1 to obtain a new number of calculations to be performed. If the number of calculations to be performed is not zero, then the current modulo result is used as the new target local dividend, and the operation of performing a Montgomery modular multiplication calculation based on the Montgomery modular multiplication factor and the target local dividend is returned. If the number of calculations to be performed is 0, then the current modulus result is taken as the local modulus result that matches the target local dividend. If the target modular multiplication count is 0, then the target local dividend is directly used as the local modulo result that matches the target local dividend.

9. The method of claim 1, wherein, Based on multiple local modulo results, calculate the modulo operation result between the dividend D and the modulus N, including: The modulo N results from multiple local modulo calculations are summed to obtain the modulo operation result.

10. The method of claim 1, wherein, In the process of secure computation of information, obtaining the dividend D and modulus N that match the modulo operation to be performed further includes: In the process of secure computation of information, the privacy divisor D' that needs to be protected is obtained; Randomly generate a target random number M, and sum the privacy dividend D' with the target random number M to obtain the dividend D; The method further includes: calculating the modulo operation result between the target random number M and the modulus N; After calculating the modulo operation result between the dividend D and the modulus N based on multiple local modulo results, the process also includes: The modulo operation result between the dividend D and the modulus N is subtracted from the modulo operation result between the target random number M and the modulus N by modulo N, to obtain the modulo operation result between the privacy dividend D' and the modulus N.

11. The method of claim 1, wherein, In the process of secure computation of information, the dividend D and modulus N that match the modulo operation to be performed are obtained, including: During the process of performing information encryption and decryption calculations based on asymmetric encryption and decryption algorithms on the input information, the dividend D and modulus N that match the modulo operation to be performed are obtained.

12. An apparatus for secure computation of information, characterized by include: The operation parameter acquisition module is used to acquire the dividend D and modulus N that match the modulo operation to be performed during the secure computation of information. A modular multiplication factor privacy computation module is configured to determine a conversion constant R for converting a dividend D to a Montgomery domain according to a modulus N, and to privately compute a Montgomery modular multiplication factor R according to the conversion constant R and the modulus N 2 % N; The local calculation module is used to split the dividend D into multiple local dividends according to the transformation constant R, and perform at least one Montgomery modular multiplication calculation on at least one local dividend according to the position of each local dividend in the dividend D and the Montgomery modular multiplication factor to obtain multiple local modular results. The calculation result acquisition module is used to calculate the modulo operation result between the dividend D and the modulus N based on multiple local modulo results.

13. A secure chip, characterized by The security chip includes: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the secure computation method for information according to any one of claims 1-11.

Images