A secure chip based on a configurable lookup table

Abstract

This invention discloses a security chip based on a configurable lookup table. The security chip includes: at least one configurable logic block, each containing at least one configurable lookup table unit; a dynamic mask generator connected to the configurable lookup table unit, dynamically generating a mask sequence according to the current processing clock cycle; a reconfiguration controller connected to the dynamic mask generator, changing the configuration values ​​of the configurable lookup table units in real time according to a security policy; and a security execution engine, whose input is connected to the output of the configurable lookup table unit, performing secure operations based on the masked lookup results; wherein the configurable lookup table unit presents different truth table mappings for the same logic input in at least two different clock cycles. This invention enables the lookup table unit to present different truth table mappings in different clock cycles, breaking the deterministic correlation between power consumption characteristics and data, and effectively resisting side-channel attacks such as differential power analysis.

Description

Technical Field

[0001] This invention relates to the field of integrated circuit chip design technology, and more specifically to a security chip based on a configurable lookup table. Background Technology

[0002] With the continuous evolution of physical attack methods such as side-channel attacks and fault injection attacks, as well as the emergence of new algorithms such as post-quantum cryptography, security chips are facing unprecedented technical challenges.

[0003] Currently, security chips mainly face the following problems:

[0004] First, the static nature of the lookup table configuration leads to insufficient protection against side-channel attacks. In existing secure processing units, the truth table configuration value of the configurable lookup table remains fixed after the chip is powered on and initialized, and does not change throughout the entire algorithm execution. This means that the lookup table always outputs the same physical value under the same logical input, and there is a deterministic correlation between its power consumption waveform, electromagnetic radiation, and other physical leakage characteristics and the processed data. Attackers can gradually recover the key information by collecting a large number of power consumption trajectories for differential power analysis or correlation power analysis. Although there are existing technologies that use masking to protect fixed logic circuits, these schemes require designing masking circuits separately for each cryptographic algorithm, resulting in high hardware overhead and difficulty in reusing them to configurable lookup table structures. More importantly, because the lookup table configuration value is fixed, even with traditional masking techniques, attackers can still eliminate the randomness of the mask through multiple attacks, causing the protection effect to decay with the increase of the number of attacks.

[0005] Second, the single mapping characteristic of lookup table configurations is vulnerable to high-order side-channel attacks. In existing reconfigurable cryptographic processors, a lookup table unit implements only one fixed truth table mapping relationship at any given time. For chips in the same batch with identical configurations, their physical configurations of the lookup tables are completely identical. Once an attacker obtains the mapping relationship between the configuration information and power consumption characteristics of a particular chip through prior analysis, they can transfer this attack knowledge to all devices with the same configuration, leading to large-scale security risks. Furthermore, the statically configured lookup table has a fixed physical structure during chip operation. Attackers can directly read the configuration values ​​in the storage units through physical intrusion methods such as focused ion beam cutting, thereby obtaining key or algorithm information.

[0006] In summary, existing security chips have significant shortcomings in terms of dynamic security, attack detection capabilities, and algorithm flexibility. There is an urgent need for a new type of security chip that can dynamically change physical execution characteristics, has proactive fault detection capabilities, and supports multiple cryptographic algorithms. Summary of the Invention

[0007] This invention discloses a security chip based on a configurable lookup table.

[0008] Specifically, the security chip includes:

[0009] At least one configurable logic block, each configurable logic block containing at least one configurable lookup table unit based on static random access memory;

[0010] The dynamic mask generator connected to the output of the configurable lookup table unit is used to dynamically generate a mask sequence according to the current processing clock cycle;

[0011] A reconstruction controller connected to the output of the dynamic mask generator is used to change the configuration value of the configurable lookup table unit in real time according to the security policy.

[0012] And a secure execution engine, whose input is connected to the output of the configurable lookup table unit, for performing secure operations based on the masked lookup results;

[0013] The configurable lookup table unit presents different truth table mappings for the same logic input in at least two different clock cycles.

[0014] Furthermore, the dynamic mask generator includes a linear feedback shift register or a chaotic sequence generator for generating a pseudo-random mask sequence bound to the clock cycle; under the control of the pseudo-random mask sequence, the reconstruction controller performs out-of-order replacement of the truth table of the configurable lookup table unit, so that the same logical function presents different physical configurations of the lookup table in different clock cycles.

[0015] Specifically, the configurable lookup table unit is a six-input or eight-input lookup table, and its configuration value is divided into an operation area and a mask area; the operation area is used to store the configuration of the S-box or nonlinear Boolean function, and the mask area is used to store the output mask of the current clock cycle; the secure execution engine reads the values ​​of the operation area and the mask area simultaneously, performs an XOR operation, and then outputs the result.

[0016] Furthermore, the reconfiguration controller has a built-in time-triggered refresh unit that automatically reads a new configuration seed from the on-chip secure read-only memory or physically unclonable function module after each predetermined number of secure operation cycles, and performs global or local dynamic reconfiguration on all or part of the configurable lookup table units, so that the number of lookup table configuration changes during the execution of a single secure processing task is greater than or equal to the square root of the total clock cycle of the task.

[0017] Furthermore, the configurable lookup table unit is also connected to an input pseudo-expansion unit, which expands the original n-bit input into an m-bit pseudo-input, where m is greater than n, and the expansion method is controlled in real time by the dynamic mask generator; the configurable lookup table unit addresses according to the m-bit pseudo-input, thereby physically expanding the lookup table representation of the original n-bit Boolean function to a redundant configuration space of 2 to the power of (mn).

[0018] Specifically, the architecture of the security chip includes at least two security domains, each with an independent configurable lookup table array and a dynamic mask generator; the configurable lookup table configuration buses between different security domains are isolated from each other, and data transmission between domains is carried out through a threshold secret sharing conversion unit based on a lookup table.

[0019] Furthermore, the configurable lookup table is linked to a first configurable lookup table path and a second configurable lookup table path in the secure chip memory; the configurable lookup table is configured to perform polynomial sampling or hashing operations in a lattice-based post-quantum cryptography algorithm; the secure execution engine includes a carry-independent arithmetic logic unit whose input is directly connected to the output of the configurable lookup table unit, and the reconstruction controller dynamically changes the polynomial coefficient mapping relationship implemented by the configurable lookup table unit at different stages of algorithm execution.

[0020] Furthermore, it also includes a fault latch; when the output difference between the first configurable lookup table path and the second configurable lookup table path is detected to last for more than one clock cycle, the dynamic reconfiguration module stops the current operation and forces the lookup table units of the two paths to be configured as a preset fail-safe truth table, while outputting a fault alarm signal to the outside.

[0021] As can be seen from the above technical solution, the present invention has at least the following advantages and positive effects compared with the prior art:

[0022] (i) Enhanced protection against side-channel attacks. This invention uses a dynamic mask generator and a reconstruction controller to enable the lookup table unit to present different truth table mappings for the same input in different clock cycles, breaking the deterministic correlation between power consumption characteristics and data, and effectively resisting high-order side-channel attacks such as differential power analysis.

[0023] (ii) Real-time detection of fault injection attacks. This invention sets up a dual-path redundancy verification mechanism, in which the configuration values ​​of the two paths are inverses of each other. The output is compared in real time by a comparator. When a difference is detected, the configuration is asynchronously refreshed and an alarm is output, which effectively prevents common-mode faults from bypassing detection.

[0024] (III) Enhancing Algorithm Flexibility and Dynamic Security. This invention supports the dynamic configuration of post-quantum cryptography algorithms, dynamically changing the lookup table mapping relationship at different stages of algorithm execution, taking into account the adaptation needs of multiple algorithms and dynamic security protection.

[0025] (iv) Enhanced multi-security domain isolation and physical protection. This invention sets up an independent configuration bus and threshold secret sharing conversion unit for each security domain to achieve physical isolation between domains; and increases the redundant configuration space of the lookup table by input pseudo-expansion unit to resist physical probe attacks. Attached Figure Description

[0026] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort, wherein:

[0027] Figure 1 This is a schematic diagram of a security chip based on a configurable lookup table according to an embodiment of the present invention;

[0028] Figure 2 This is a schematic diagram of the structure of a configurable lookup table unit dynamic reconfiguration and masking processing module provided in another embodiment of the present invention;

[0029] Figure 3 This is a schematic diagram of a multi-security domain isolation and post-quantum cryptography algorithm support structure provided in another embodiment of the present invention. Detailed Implementation

[0030] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] Example 1

[0032] Figure 1 This is a schematic diagram of a security chip based on a configurable lookup table, provided as an embodiment of the present invention.

[0033] like Figure 1 As shown, the security chip 10 includes a configurable logic block array 100, a dynamic mask generator 200, a reconfiguration controller 300, and a security execution engine 400.

[0034] The configurable logic block array 100 contains multiple configurable logic blocks, including a first configurable logic block 101, a second configurable logic block 102, ..., an nth configurable logic block 10N, where N is a positive integer greater than or equal to 1. The structure of each configurable logic block is basically the same. The following detailed explanation uses the first configurable logic block 101 as an example.

[0035] The first configurable logic block 101 includes at least one configurable lookup table unit 110 based on static random access memory (SRAM). The configurable lookup table unit 110 is a core component of the security chip for implementing reconfigurable logic functions. Internally, it contains a configuration storage array composed of SRAM cells, with each SRAM cell storing one bit from a truth table. The input of the configurable lookup table unit 110 receives input signals from external sources or the preceding logic level. These input signals serve as addresses to access the SRAM configuration storage array, reading the configuration value from the corresponding storage cell as the lookup result. Because SRAM is used as the configuration storage medium, the configurable lookup table unit 110 supports dynamic rewriting of configuration values ​​during chip operation, thereby enabling real-time reconfiguration of logic functions.

[0036] Specifically, in this embodiment, the configurable lookup table unit 110 is configured to present different truth table mappings for the same logic input in at least two different clock cycles. That is, even if the external inputs are exactly the same, the lookup results output by the configurable lookup table unit 110 may differ in different clock cycles. This time-varying characteristic is the basis for the implementation of subsequent security mechanisms.

[0037] The input of the dynamic mask generator 200 is connected to the clock signal CLK, and the output is connected to the output of the configurable lookup table unit 110 (e.g., ...). Figure 1 The dashed line indicates the input terminal for providing the mask sequence and the reconfiguration controller 300. The dynamic mask generator 200 dynamically generates a mask sequence based on the current processing clock cycle. This mask sequence changes over time, with each clock cycle having a different mask value.

[0038] Specifically, the dynamic mask generator 200 internally includes a pseudo-random sequence generator bound to the clock cycle. This pseudo-random sequence generator can be implemented using a linear feedback shift register (LFSR) or a chaotic sequence generator. Each time a clock cycle arrives, the dynamic mask generator 200 updates its internal state and outputs a new mask value. This mask value is provided directly to the configurable lookup table unit 110 for masking the lookup results; and also provided to the reconfiguration controller 300 as a control signal to trigger the lookup table configuration update.

[0039] It should be noted that the mask sequence generated by the dynamic mask generator 200 has a high degree of randomness and unpredictability. In a preferred embodiment, the initial seed of the dynamic mask generator 200 comes from a physically unclonable function module or a true random number generator inside the chip, ensuring that the mask sequences generated between different individual chips and at different startup times of the same chip are unique, thereby effectively resisting modeling attacks and replay attacks.

[0040] The input of the reconfiguration controller 300 is connected to the output of the dynamic mask generator 200 to receive the mask sequence generated by the dynamic mask generator 200; the output of the reconfiguration controller 300 is connected to the configuration port CFG of the configurable lookup table unit 110 to change the configuration value of the configurable lookup table unit 110 in real time according to the security policy.

[0041] The reconfiguration controller 300 internally includes configuration value generation logic and configuration write control logic. When a new mask sequence is received from the dynamic mask generator 200, the reconfiguration controller 300 calculates the truth table configuration value that the configurable lookup table unit 110 should use in the current clock cycle according to a preset security policy, and writes the configuration value into the SRAM array of the configurable lookup table unit 110 through the configuration port CFG. Since the SRAM configuration memory has an extremely fast write speed, it can usually complete the update of all configuration bits within one clock cycle. Therefore, the truth table mapping relationship of the configurable lookup table unit 110 can dynamically change with each clock cycle.

[0042] In this embodiment, the security policy executed by the reconfiguration controller 300 includes at least the following two modes:

[0043] The first mode is the fully randomized mode. In this mode, the reconfiguration controller 300 directly uses the mask sequence provided by the dynamic mask generator 200 as the control parameter for truth table address remapping, and randomly permutes the logic function that the configurable lookup table unit 110 was originally supposed to implement. Specifically, suppose the configurable lookup table unit 110 was originally supposed to implement a k-input Boolean function, and its truth table contains 2^k configuration bits. The reconfiguration controller 300 generates a permutation function based on the mask sequence, randomly shuffling the positions of the 2^k configuration bits, so that the configuration value physically stored at the i-th address logically corresponds to the original configuration value at the π(i)-th address. Since the mask sequence is different for each clock cycle, even if the logic function implemented by the configurable lookup table unit 110 remains unchanged macroscopically, its physical configuration state changes completely in each clock cycle.

[0044] The second mode is the dynamic function switching mode. In this mode, the reconfigurable lookup table unit 110 is configured to implement completely different logical functions in different clock cycles according to the security policy. For example, during the execution of a security encryption algorithm, the configurable lookup table unit 110 is configured to implement the lookup table of S-box 1 in the first clock cycle, switched to implement the lookup table of S-box 2 in the second clock cycle, and configured to implement linear transformation in the third clock cycle, etc. This function-level dynamic switching makes it difficult for attackers to perform differential power analysis by collecting power consumption curves of fixed logical functions.

[0045] The input of the secure execution engine 400 is connected to the output of the configurable lookup table unit 110, and is used to receive the masked lookup result output by the configurable lookup table unit 110, and perform secure operations based on the masked lookup result. The output of the secure execution engine 400 outputs the final secure operation result RESULT.

[0046] The secure execution engine 400 internally includes an arithmetic logic unit, a register file, and control logic. Unlike traditional secure processors, in this embodiment, the input of the secure execution engine 400 is directly connected to the output of the configurable lookup table unit 110, without any demasking or derandomization processing in between. In other words, the secure execution engine 400 directly processes the masked intermediate data, and all operations are performed within the mask field. This design avoids the security vulnerabilities and performance overhead associated with traditional masking schemes that require demasking and remasking operations before and after computation.

[0047] Specifically, the secure execution engine 400 supports arithmetic and logical operations performed within a masked domain. For example, when the secure execution engine 400 needs to perform an addition operation, its arithmetic logic unit is designed to directly process masked input data, and the output calculation result still retains the masked form. Throughout the entire operation, the original data never appears in plaintext form in any data path or register, thus effectively resisting probing attacks and differential power analysis.

[0048] In addition, the secure execution engine 400 integrates a security status monitoring function. The secure execution engine 400 includes anomaly detection logic to monitor whether there are timing anomalies or signs of configuration tampering in the output of the configurable lookup table unit 110. When an anomaly is detected, the secure execution engine 400 immediately triggers a security response mechanism, including but not limited to: pausing the current operation, clearing sensitive data registers, and outputting alarm signals to the outside.

[0049] During the chip initialization phase, the reconfiguration controller 300 reads the initial configuration value of the configurable lookup table unit 110 from the on-chip secure memory and writes it into the SRAM array of the configurable lookup table unit 110 via the configuration port CFG. Simultaneously, the dynamic mask generator 200 obtains the initial seed from the true random number generator and begins generating the mask sequence.

[0050] After entering the normal operation phase, at the arrival of each clock cycle, the dynamic mask generator 200 updates the mask sequence according to the current clock cycle and outputs the mask values ​​to the configurable lookup table unit 110 and the reconfiguration controller 300 respectively. Upon receiving the new mask sequence, the reconfiguration controller 300 calculates the truth table configuration value to be used in the current clock cycle according to a preset security policy and performs dynamic reconfiguration on the configurable lookup table unit 110 through the configuration port CFG. After configuration, the configurable lookup table unit 110 receives external input signals based on the new truth table mapping relationship, performs lookup table addressing, and outputs the masked lookup result. The security execution engine 400 obtains the masked lookup result, performs security operations within the mask domain, and outputs or temporarily stores the operation result.

[0051] Because the dynamic mask generator 200 changes the mask sequence every clock cycle, the reconfiguration controller 300 reconfigures the configurable lookup table unit 110 every clock cycle. Therefore, the truth table mapping of the configurable lookup table unit 110 is different in each clock cycle. Even if an attacker obtains the power consumption curve or electromagnetic leakage information for a given clock cycle, they cannot associate it with specific logical operations because the lookup table configuration state corresponding to this information has been completely changed in the next clock cycle. Furthermore, since the secure execution engine 400 always processes masked data, plaintext data never appears in the entire computation path, further enhancing its resistance to attacks.

[0052] Example 2:

[0053] Figure 2 This is a schematic diagram of the structure of a configurable lookup table unit dynamic reconfiguration and masking processing module provided in an embodiment of the present invention.

[0054] like Figure 2 As shown, the dynamic reconfiguration and masking processing module 11 includes a dynamic mask generator 200, a configurable lookup table unit 110, an input pseudo-expansion unit 120, and a reconfiguration controller 300.

[0055] The dynamic mask generator 200 includes either a linear feedback shift register (LFSR) or a chaotic sequence generator 201 to generate a pseudo-random mask sequence bound to a clock cycle. Specifically, the LFSR consists of multiple cascaded register units and feedback taps, performing a shift operation once per clock cycle. The feedback value is generated by an XOR operation on the tap positions, thus outputting a periodic pseudo-random sequence. The chaotic sequence generator generates a chaotic sequence with better randomness and a longer period based on a chaotic mapping function. The dynamic mask generator 200 receives an externally input seed SEED, which originates from the chip's internal true random number generator or physically unclonable function module, ensuring that the mask sequences generated by different individual chips and at different startup times are unique and unpredictable. The pseudo-random mask sequence output by the dynamic mask generator 200 is used both as a mask value directly in the masking process of the search results and as a control signal input to the reconstruction controller 300 to drive the disordered permutation of the truth table.

[0056] The configurable lookup table unit 110 is also connected to an input pseudo-expansion unit 120. The input pseudo-expansion unit 120 expands the original n-bit input into an m-bit pseudo-input, where m is greater than n, and the expansion method is controlled in real-time by the dynamic mask generator 200. Specifically, the input pseudo-expansion unit 120 internally contains an expansion mapping logic. This mapping logic, based on the mask sequence provided by the dynamic mask generator 200, concatenates or linearly transforms the n-bit original input with several redundant bits to generate an m-bit pseudo-input address. The expansion method can dynamically change in each clock cycle, allowing the same original input to correspond to different pseudo-input addresses in different clock cycles. The configurable lookup table unit 110 addresses according to the m-bit pseudo-input, thereby physically expanding the lookup table representation of the original n-bit Boolean function to a redundant configuration space of 2 to the power of (mn). This design prevents attackers from inferring the original input value by probing the address bus or analyzing power consumption characteristics, because the physical address space is much larger than the logical address space, and the address mapping relationship changes dynamically over time.

[0057] The configurable lookup table unit 110 is a six-input or eight-input lookup table, and its configuration value is divided into an operation area and a mask area. Specifically, the SRAM configuration storage array of the configurable lookup table unit 110 is logically divided into two areas: the operation area is used to store the S-box or nonlinear Boolean function configuration, and the mask area is used to store the output mask for the current clock cycle. When the m-bit pseudo-input address output by the input pseudo-expansion unit 120 is applied to the configurable lookup table unit 110, the operation area and the mask area are addressed simultaneously, and the operation value and the mask value are read out respectively. The secure execution engine reads the values ​​of the operation area and the mask area simultaneously, performs an XOR operation, and outputs the result, i.e., the final output result is the XOR result of the operation value and the mask value for the current clock cycle. This design of embedding the mask inside the lookup table avoids adding extra mask XOR logic to the data path, reduces critical path latency, and ensures the security of mask operations.

[0058] The reconfiguration controller 300 includes a truth table out-of-order replacement unit 310 and a time-triggered refresh unit 320. Under the control of a pseudo-random mask sequence output by the dynamic mask generator 200, the truth table out-of-order replacement unit 310 performs out-of-order replacement on the truth table of the configurable lookup table unit 110, allowing the same logical function to present different physical configurations of the lookup table in different clock cycles. Specifically, when the dynamic mask generator 200 outputs a new mask value, the truth table out-of-order replacement unit 310 calculates a replacement function based on that mask value, remapping the configuration bits in the SRAM configuration storage array of the configurable lookup table unit 110. The configuration value originally stored at address i is moved to address π(i), where π is the replacement determined by the mask value. Since the mask value is different for each clock cycle, the corresponding replacement function is also different for each clock cycle, causing the physical configuration state of the configurable lookup table unit 110 to continuously change while the logical function remains unchanged.

[0059] After completing a predetermined number of security operation cycles, the time-triggered refresh unit 320 automatically reads a new configuration seed from the on-chip secure read-only memory or physically unclonable function module, and performs a global or partial dynamic reconfiguration on all or part of the configurable lookup table units 110. Specifically, the time-triggered refresh unit 320 contains a counter that increments by 1 each time a security operation is performed. When the counter value reaches a preset threshold (e.g., the square root of the total clock cycles of the task), a refresh operation is triggered: a new configuration seed is read from the on-chip secure memory, the dynamic mask generator 200 is reinitialized using this seed, and the configuration values ​​of the configurable lookup table units 110 are fully updated. This periodic global refresh mechanism ensures that even if an attacker accumulates power consumption characteristics of a certain configuration state through long-term observation, all accumulated information becomes invalid after the refresh, thus effectively resisting long-term side-channel attacks.

[0060] Example 3:

[0061] Figure 3 This is a schematic diagram of the structure supporting the multi-security domain isolation and post-quantum cryptography algorithm provided in an embodiment of the present invention.

[0062] like Figure 3 As shown, the multi-security-domain isolation and post-quantum cryptography algorithm support structure 12 contains two security domains: a first security domain and a second security domain. Each security domain has an independent configurable lookup table array and a dynamic mask generator 200.

[0063] Specifically, the first security domain contains an independent LUT array (composed of multiple configurable lookup table units 110) and an independent dynamic mask generator 200; the second security domain also contains an independent LUT array and an independent dynamic mask generator 200. The configurable lookup table configuration buses between different security domains are isolated from each other through configuration bus isolation units. These configuration bus isolation units are located between the configuration buses of different security domains, employing a combination of physical and logical isolation to ensure that configuration operations in any security domain cannot affect the lookup table configuration state of other security domains. This design allows different security domains to process data of different security levels separately; even if one security domain is attacked, the data and configuration information of other security domains remain secure.

[0064] Inter-domain data transmission is performed through a threshold secret sharing conversion unit based on a lookup table. The threshold secret sharing conversion unit uses a lookup table to perform secret sharing conversion operations. Its input is connected to the output of the first security domain, and its output is connected to the input of the second security domain.

[0065] Specifically, when data needs to be transmitted from the first security domain to the second security domain, the threshold secret sharing conversion unit splits the original data into multiple secret shares. Each share is transmitted through an independent lookup table path, and the secret is reconstructed within the target security domain using the lookup table. Throughout the entire transmission process, no single data path contains complete secret information. Even if an attacker steals data from a certain path, they cannot recover the original secret. Because the threshold secret sharing conversion unit is implemented using a lookup table, its operation does not rely on arithmetic logic units, thus avoiding the timing side-channel leakage that may occur in traditional secret sharing schemes.

[0066] The configurable lookup table unit 110 is configured to perform polynomial sampling or hashing operations in lattice-based post-quantum cryptography algorithms.

[0067] Specifically, the configurable lookup table unit 110 is linked to a first configurable lookup table path and a second configurable lookup table path in the secure chip memory, forming a dual-path redundancy structure. The lookup table units 110 on the two paths remain synchronized under normal operating conditions and jointly execute the core operations in the post-quantum cryptography algorithm.

[0068] The secure execution engine 400 includes a carry-independent arithmetic logic unit 410, whose input is directly connected to the output of the configurable lookup table unit 110. The carry-independent arithmetic logic unit 410 employs a redundant number system or modular arithmetic architecture, and its operation process does not depend on carry propagation, thus possessing natural resistance to timing side-channel attacks. This arithmetic logic unit 410 is specifically designed to support core operations such as polynomial multiplication, polynomial sampling, and hash operations in lattice-based post-quantum cryptography algorithms. Since post-quantum cryptography algorithms typically involve a large number of polynomial operations, and the data correlation during the operation is strong, traditional processors are prone to leaking power consumption information when executing such algorithms. This embodiment, through the carry-independent arithmetic logic unit 410 combined with the dynamic reconfiguration characteristics of the configurable lookup table unit 110, ensures that each clock cycle of the polynomial operation presents a different hardware configuration state, effectively resisting side-channel attacks targeting post-quantum cryptography algorithms.

[0069] The reconfiguration controller 300 dynamically changes the polynomial coefficient mapping relationship implemented by the configurable lookup table unit 110 at different stages of algorithm execution. Specifically, in the key generation, encryption, and decryption stages of the lattice-based cryptography algorithm, the reconfiguration controller 300 configures the configurable lookup table unit 110 to implement different polynomial coefficient mapping functions according to a preset security policy. For example, in the key generation stage, the configurable lookup table unit 110 is configured to implement the coefficient mapping of ring polynomial multiplication; in the encryption stage, it switches to the sampling mapping of noise polynomials. This stage-based dynamic configuration prevents attackers from inferring the key information of the entire algorithm through power consumption sampling in a single stage.

[0070] The security chip also includes a fault latch 800. The outputs of the first configurable lookup table path and the second configurable lookup table path are respectively connected to the inputs of the fault latch 800. The fault latch 800 continuously compares the output values ​​of the two paths. When it detects that the output difference between the first and second configurable lookup table paths lasts for more than one clock cycle, it determines that a fault injection attack or hardware failure has occurred. At this time, the dynamic reconfiguration module stops the current operation and forcibly configures the lookup table units of the two paths to a preset fault-safe truth table. This fault-safe truth table is designed to output a constant value or perform safe-state operations to ensure that the chip does not leak sensitive information in a fault state. At the same time, the security chip outputs a fault alarm signal to the outside through the fault alarm configuration unit 801 to notify the upper-level system to take appropriate action.

[0071] The above description is merely an embodiment of the present invention and does not limit the patent scope of the present invention. Any equivalent structural or procedural transformations made based on the content of the present invention's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of the present invention.

Claims

1. A security chip based on a configurable lookup table, characterized in that, include: At least one configurable logic block, each configurable logic block containing at least one configurable lookup table unit based on static random access memory; The dynamic mask generator connected to the output of the configurable lookup table unit is used to dynamically generate a mask sequence according to the current processing clock cycle; A reconstruction controller connected to the output of the dynamic mask generator is used to change the configuration value of the configurable lookup table unit in real time according to the security policy. And a secure execution engine, whose input is connected to the output of the configurable lookup table unit, for performing secure operations based on the masked lookup results; The configurable lookup table unit presents different truth table mappings for the same logic input in at least two different clock cycles.

2. The security chip according to claim 1, characterized in that, The dynamic mask generator includes a linear feedback shift register or a chaotic sequence generator for generating a pseudo-random mask sequence bound to the clock cycle; under the control of the pseudo-random mask sequence, the reconstruction controller performs out-of-order replacement of the truth table of the configurable lookup table unit, so that the same logical function presents different physical configurations of the lookup table in different clock cycles.

3. The security chip according to claim 1, characterized in that, The configurable lookup table unit is a six-input or eight-input lookup table, and its configuration value is divided into an operation area and a mask area; the operation area is used to store the configuration of the S-box or nonlinear Boolean function, and the mask area is used to store the output mask of the current clock cycle; the secure execution engine reads the values ​​of the operation area and the mask area simultaneously, performs an XOR operation, and then outputs the result.

4. The security chip according to claim 1, characterized in that, The reconfiguration controller has a built-in time-triggered refresh unit that automatically reads a new configuration seed from the on-chip secure read-only memory or physically unclonable function module after each predetermined number of secure operation cycles, and performs global or local dynamic reconfiguration on all or part of the configurable lookup table units, so that the number of lookup table configuration changes during the execution of a single secure processing task is greater than or equal to the square root of the total clock cycle of the task.

5. The security chip according to claim 1, characterized in that, The configurable lookup table unit is also connected to an input pseudo-expansion unit, which expands the original n-bit input to an m-bit pseudo-input, where m is greater than n, and the expansion method is controlled in real time by the dynamic mask generator; the configurable lookup table unit addresses according to the m-bit pseudo-input, thereby physically expanding the lookup table representation of the original n-bit Boolean function to a redundant configuration space of 2 to the power of (mn).

6. The security chip according to claim 1, characterized in that, The architecture of the security chip includes at least two security domains, each with an independent configurable lookup table array and a dynamic mask generator; the configurable lookup table configuration buses between different security domains are isolated from each other, and data transmission between domains is carried out through a threshold secret sharing conversion unit based on a lookup table.

7. The security chip according to claim 1, characterized in that, The configurable lookup table is linked to a first configurable lookup table path and a second configurable lookup table path in the secure chip memory; the configurable lookup table is configured to perform polynomial sampling or hashing operations in a lattice-based post-quantum cryptography algorithm; the secure execution engine includes a carry-independent arithmetic logic unit whose input is directly connected to the output of the configurable lookup table unit, and the reconstruction controller dynamically changes the polynomial coefficient mapping relationship implemented by the configurable lookup table unit at different stages of algorithm execution.

8. The security chip according to claim 7, characterized in that, It also includes a fault latch; when the output difference between the first configurable lookup table path and the second configurable lookup table path is detected to last for more than one clock cycle, the dynamic reconfiguration module stops the current operation and forces the lookup table units of the two paths to be configured as preset fail-safe truth tables, while outputting a fault alarm signal to the outside.

Images