System and method for large number hardware multiplication for cryptography

Abstract

A system performs large number multiplication during a cryptographic process. This can occur, for example, when a controller in a storage system encrypts data for storage in its memory or decrypts data read from its memory. To perform multiplication of these large input numbers quickly, the system uses a modified Toom-Cook algorithm that includes a coefficient vector of multiple levels for each of the input numbers. This involves performing a sample extraction process, a point multiplication process, and an interpolation (synthesis) process.

Description

Background Technology

[0001] In cryptography, large numbers, typically modulo a large prime number or modulo the product of two prime numbers, are used to encrypt and decrypt data, protecting it from third-party interference. Protection keys can be as large as 512 or 1,024 (or more) bits. Multiplication of these large numbers with the input data often needs to be performed quickly and efficiently. For example, in communications, these calculations must be performed in real time and should not introduce latency during data encryption and decryption. Mathematically, this requires efficiently calculating the multiplication z = x·y, where x and y are both large numbers represented by 512 or 1,024 (or more) bits. Furthermore, many cryptographic applications require exponentiation, where both the base and exponent can be large. Attached Figure Description

[0002] Figure 1A This is a block diagram of a non-volatile storage system as an example.

[0003] Figure 1B A block diagram illustrating the storage module of an embodiment.

[0004] Figure 1C A block diagram illustrating an embodiment of a hierarchical storage system.

[0005] Figure 2A To illustrate the embodiments Figure 1A The block diagram of the controller components of the non-volatile memory system described herein.

[0006] Figure 2B To illustrate the embodiments Figure 1A The block diagram of the components of the non-volatile storage system described herein.

[0007] Figure 3 A block diagram of the host and storage system for an embodiment.

[0008] Figure 4 This is a flowchart illustrating the sample extraction steps in a recursive hierarchical scheme of an embodiment.

[0009] Figure 5 This is a flowchart illustrating the dot multiplication steps in a recursive hierarchical scheme of an embodiment.

[0010] Figure 6 This is a flowchart illustrating the interpolation steps in a recursive hierarchical scheme of an embodiment.

[0011] Figure 7 This is a flowchart illustrating the sample extraction (decomposition) steps in the two-recursive-level scheme of the embodiment.

[0012] Figure 8 This is a flowchart illustrating the sample extraction (decomposition) step in a recursive hierarchical scheme of an embodiment.

[0013] Figure 9 This is a flowchart illustrating the dot product steps in the two-level recursive scheme of the embodiment.

[0014] Figure 10 This is a flowchart illustrating the interpolation (composition) step in the two-recursive-level scheme of the embodiment.

[0015] Figure 11 This is a flowchart illustrating the sample extraction (decomposition) steps of an embodiment.

[0016] Figure 12 A flowchart illustrating the dot product method steps in an embodiment.

[0017] Figure 13 A flowchart illustrating the interpolation (composition) steps of an embodiment.

[0018] Figure 14 This is a diagram illustrating the division process in an example.

[0019] Figure 15 The flowchart is for the Montgomery scheme as an example.

[0020] Figure 16 A graph of sample points for an example. Detailed Implementation

[0021] Brief Overview

[0022] The following embodiments generally relate to performing large number multiplication. Such multiplication can be used in cryptography. For example, controllers in a storage system can use these embodiments in a cryptographic process to encrypt data to be stored in the storage system's memory and to decrypt data read from the storage system's memory. These embodiments can also be used in hosts communicating with storage systems, and more generally, in processors in electronic devices.

[0023] Generally, the multiplication process in these embodiments includes: receiving input numbers x and y for multiplication; generating coefficient vectors for x and y at multiple levels; and performing a sample extraction process involving multiplying the coefficient vectors for x at multiple levels by a first decomposition matrix to obtain a first result vector and multiplying the coefficient vectors for y at multiple levels by a second decomposition matrix to obtain a second result vector. Next, a dot-multiplication process is performed by multiplying the first and second result vectors to obtain a third result vector. The dot-multiplication process of the first and second vectors is a multiplication process in which each coordinate of the first vector is multiplied by the corresponding coordinate of the second vector, so that the third result vector is a vector having the same dimension as the first and second vectors, and each coordinate of the third vector is the product of the corresponding coordinates of the first and second vectors. Then, an interpolation process is performed by multiplying the third result vector by a composition matrix to obtain a result and dividing the result by a constant to obtain a final result. Other embodiments are provided and may be used individually or in combination.

[0024] Exemplary System

[0025] Now turning to the diagrams, a storage system suitable for implementing these embodiments is shown in... Figure 1A-1C middle. Figure 1A A block diagram illustrating a non-volatile memory system 100 (sometimes referred to herein as a memory device or device only) according to embodiments of the subject matter described herein. References Figure 1A The non-volatile memory system 100 includes a controller 102 and non-volatile memory, which may be composed of one or more non-volatile memory dies 104. As used herein, the term "die" refers to a collection of non-volatile memory cells formed on a single semiconductor substrate and the associated circuitry for managing the physical operations of those non-volatile memory cells. The controller 102 interfaces with a host system and transmits sequences of commands for read, program, and erase operations to the non-volatile memory die 104.

[0026] Controller 102 (which may be a non-volatile memory controller (e.g., flash, resistive random access memory (ReRAM), phase-change memory (PCM), or magnetoresistive random access memory (MRAM) controller)) may take the form of a processing circuitry system, a microprocessor or processor, and a computer-readable medium storing computer-readable program code (e.g., firmware), which may be executed by, for example, a (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Controller 102 may be configured to have hardware and / or firmware to perform the various functions described below and shown in the flowcharts. Moreover, some of the components shown as being inside the controller may also be formed outside the controller, and other components may be used. Additionally, the phrase "operationally communicate with..." may mean communicating directly with... or communicating indirectly (wired or wirelessly) with... via one or more components that may or may not be shown or described herein.

[0027] As used herein, a nonvolatile memory controller is a means of managing data stored in nonvolatile memory and communicating with a host, such as a computer or electronic device. In addition to the specific functionalities described herein, a nonvolatile memory controller may have various other functionalities. For example, a nonvolatile memory controller may format the nonvolatile memory to ensure proper operation, map faulty nonvolatile memory cells, and allocate spare cells to replace future failed cells. A portion of the spare cells may be used to store firmware to operate the nonvolatile memory controller and implement other features. In operation, the host may communicate with the nonvolatile memory controller when it needs to read data from or write data to the nonvolatile memory. If the host provides a logical address for reading / writing data, the nonvolatile memory controller may translate the logical address received from the host into a physical address in the nonvolatile memory. (Alternatively, the host may provide a physical address.) The non-volatile memory controller may also perform various memory management functions, such as, but not limited to, wear leveling (distributing writes to avoid wear on specific memory blocks that would otherwise be repeatedly written to) and garbage collection (moving only valid data pages to new blocks after a block is full, so that the full block can be erased and reused). Furthermore, the structure of the “component” listed in the claims may include some or all of the structures of the controller described herein, such as those programmed or manufactured to cause the controller to operate to perform the listed functions.

[0028] The non-volatile memory die 104 may contain any suitable non-volatile storage medium, including ReRAM, MRAM, PCM, NAND flash memory cells, and / or NOR flash memory cells. The memory cells may be in the form of solid-state (e.g., flash) memory cells and may be programmable once, programmable less frequently, or programmable many times. The memory cells may also be single-level cell (SLC), multi-level cell (MLC), three-level cell (TLC), four-level cell (QLC), or combinations thereof, or use other memory cell hierarchy technologies now known or to be developed later. Furthermore, the memory cells may be manufactured in two or three dimensions.

[0029] The interface between controller 102 and non-volatile memory die 104 can be any suitable flash interface, such as Toggle Mode 200, 400, or 800. In one embodiment, storage system 100 can be a card-based system, such as a Secure Digital (SD) or Micro Secure Digital (MicroSD) card (or USB, SSD, etc.). In an alternative embodiment, storage system 100 can be part of an embedded storage system.

[0030] Although Figure 1A In the examples illustrated herein, the non-volatile memory system 100 (sometimes referred to herein as a memory module) includes a single channel between the controller 102 and the non-volatile memory die 104, but the subject matter described herein is not limited to having a single memory channel. For example, in some memory system architectures (e.g. Figure 1B and 1C In the storage system architecture shown herein, depending on the controller capabilities, there may be two, four, eight, or more memory channels between the controller and the memory device. In any of the embodiments described herein, there may be more than a single channel between the controller and the memory die, even if a single channel is shown in the figures.

[0031] Figure 1B The description describes a storage module 200 comprising multiple non-volatile storage systems 100. Thus, the storage module 200 may include a storage controller 202 that interfaces with a host and with a storage system 204 comprising multiple non-volatile storage systems 100. The interface between the storage controller 202 and the non-volatile storage systems 100 may be a bus interface, such as a Serial Advanced Technology Attachment (SATA), a Peripheral Component Interconnect High Speed ​​(PCIe) interface, or a Dual Data Rate (DDR) interface. In one embodiment, the storage module 200 may be a solid-state drive (SSD) or a non-volatile dual in-line memory module (NVDIMM), as found, for example, in server PCs or portable computing devices (e.g., laptops and tablets).

[0032] Figure 1C This is a block diagram illustrating a hierarchical storage system. The hierarchical storage system 250 includes multiple storage controllers 202, each controlling a corresponding storage system 204. A host system 252 can access memory within the storage system via a bus interface. In one embodiment, the bus interface may be a Non-Volatile Memory High Speed ​​(NVMe) interface or an Ethernet Fibre Channel (FCoE) interface. In one embodiment, Figure 1C The system described herein can be a rack-mounted, high-capacity storage system accessible to multiple hosts, and may be found, for example, in data centers or other locations where high-capacity storage is required.

[0033] Figure 2A To illustrate the components of controller 102 in more detail, a block diagram is provided. Controller 102 includes a front-end module 108 that interfaces with a host computer, a back-end module 110 that interfaces with one or more non-volatile memory dies 104, and various other modules that perform the functions described in detail below. Modules may take the form of, for example, packaged functional hardware units designed for use with other components, portions of program code (e.g., software or firmware) executable by a (micro)processor or processing circuitry system that typically performs a specific function of the associated functions, or self-contained hardware or software components that interface with a larger system. Controller 102 may sometimes be referred to herein as a NAND controller or flash controller, but it should be understood that controller 102 can be used with any suitable memory technology, some examples of which are provided below. In this embodiment, controller 102 includes one or more hardware multipliers 33, which can be used to implement the following functions.

[0034] Referring again to the module of controller 102, the buffer manager / bus controller 114 manages the registers in random access memory (RAM) 116 and controls the internal bus arbitration of controller 102. Read-only memory (ROM) 118 stores the system boot code. Although in Figure 2A The description indicates that the RAM 116 and ROM 118 are located separately from the controller 102, but in other embodiments, one or both of them may be located within the controller. In yet another embodiment, portions of the RAM and ROM may be located both within the controller 102 and outside the controller.

[0035] Front-end module 108 includes a host interface 120 and a physical layer interface (PHY) 122 that provide an electrical interface to the host or next-level storage controller. The type of host interface 120 may be selected depending on the type of memory being used. Examples of host interfaces 120 include, but are not limited to, SATA, SATA High Speed, Serial Attached Small Computer System Interface (SAS), Fibre Channel, Universal Serial Bus (USB), PCIe, and NVMe. Host interface 120 typically facilitates the transfer of data, control signals, and timing signals.

[0036] Backend module 110 includes an error correction code (ECC) engine 124 that encodes data bytes received from the host and decodes and error-corrects data bytes read from the non-volatile memory. Command sequencer 126 generates command sequences, such as programming and erasing command sequences, to be transmitted to the non-volatile memory die 104. Redundant Array of Independent Drive (RAID) module 128 manages the generation of RAID parity and the recovery of failed data. RAID parity can be used as an additional layer of integrity protection for writing data into memory device 104. In some cases, RAID module 128 may be part of ECC engine 124. Memory interface 130 provides command sequences to the non-volatile memory die 104 and receives status information from the non-volatile memory die 104. In one embodiment, memory interface 130 may be a dual data rate (DDR) interface, such as a switching mode 200, 400, or 800 interface. The flash control layer 132 controls the overall operation of the backend module 110.

[0037] Storage system 100 also includes other discrete components 140, such as external electrical interfaces, external RAM, resistors, capacitors, or other components that may interface with controller 102. In alternative embodiments, one or more of physical layer interface 122, RAID module 128, media management layer 138, and buffer management / bus controller 114 are optional components that may not be in controller 102.

[0038] Figure 2BTo illustrate the components of the non-volatile memory die 104 in more detail, the non-volatile memory die 104 includes a peripheral circuitry system 141 and a non-volatile memory array 142. The non-volatile memory array 142 includes non-volatile memory cells for storing data. These non-volatile memory cells can be any suitable non-volatile memory cells, including ReRAM, MRAM, PCM, NAND flash memory cells, and / or NOR flash memory cells configured in two-dimensional and / or three-dimensional arrays. The non-volatile memory die 104 further includes a data cache memory 156 for cached data storage. The peripheral circuitry system 141 includes a state machine 152 that provides state information to the controller 102.

[0039] Return to Figure 2A The flash control layer 132 (which will be referred to herein as the Flash Translation Layer (FTL), or more generally, as the “media management layer” when the memory may not be flash) handles flash errors and interfaces with the host. Specifically, the FTL, which may be responsible for the algorithms in the firmware, manages the internal memory and translates writes from the host into writes to memory 104. Because memory 104 may have limited endurance, may only be written to in multi-page format, and / or may not be written to unless erased as a block of memory, an FTL may be necessary. The FTL understands these potential limitations of memory 104, which may not be visible to the host. Therefore, the FTL attempts to translate writes from the host into writes in memory 104.

[0040] The FTL may include a logical-to-physical address (L2P) mapping (sometimes referred to herein as a table or data structure) and allocated cache memory. In this way, the FTL translates logical block addresses (“LBAs”) from the host into physical addresses in memory 104. The FTL may include other features, such as, but not limited to, power-off recovery (so that the FTL’s data structures can be recovered in the event of a sudden power failure) and wear leveling (so that wear is more evenly distributed across memory blocks to prevent excessive wear on some blocks, which would lead to a higher probability of failure).

[0041] Turning back to the diagram, Figure 3 This is a block diagram of a host 300 and a storage system (sometimes referred to herein as a device) 100 according to an embodiment. The host 300 may take any suitable form, including but not limited to a computer, mobile phone, digital camera, tablet computer, wearable device, digital video recorder, monitoring system, etc. The host 300 includes a processor 330 configured to send data (e.g., initially stored in the host's memory 340 (e.g., DRAM)) to the storage system 100 for storage in the storage system's memory 104 (e.g., non-volatile memory die). While the host 300 and storage system 100 are... Figure 3 The storage system 100 is shown as a separate box, but it should be noted that the storage system 100 may be integrated into the host 300, the storage system 100 may be removably connected to the host 300, and the storage system 100 and the host 300 may communicate via a network. It should also be noted that the memory 104 may be integrated into the storage system 100 or removably connected to the storage system 100.

[0042] Large number hardware multiplication for cryptography

[0043] As mentioned above, in cryptography, large numbers, typically modulo a large prime number or modulo the product of two prime numbers, are used to encrypt and decrypt data, thereby protecting it from third-party interference. The number of protection keys can be as large as 512 or 1,024 (or more) bits. Multiplication of these large numbers with the input data often needs to be performed quickly and efficiently. For example, in communications, these calculations must be performed in real time and should not introduce latency during data encryption and decryption. Mathematically, this requires efficiently calculating the multiplication z = x·y, where x and y are both large numbers represented by 512 or 1,024 (or more) bits. Furthermore, many cryptographic applications require exponentiation, where both the base and the exponent can be large.

[0044] Improvements are needed in the process of performing many large multiplication operations to achieve greater overall system improvements. Therefore, the challenge lies in providing efficient large number multipliers for cryptographic applications, which can be implemented efficiently in hardware and are bit-accurate.

[0045] Current cryptographic large number multipliers use the standard (“textbook”) and Karatsuba methods. In both the standard and Karatsuba methods, we can transform large multiplication into several smaller multiplications, the results of which can be computed using smaller standard multipliers.

[0046] Suppose we have n-bit inputs x and y. We can split the numbers into an upper half and a lower half (bitwise):

[0047] x = x1 * 2 n / 2 +x2,y=y1*2 n / 2 +y2

[0048] Performing direct school multiplication requires calculating x1·y1, x1·y2, x2·y1, and x2·y2. Therefore, four multiplications (2^32 + 2^42) are needed. 2 ).

[0049] Using the simple Karachupa multiplication method, the product can be expressed as:

[0050] xy=x1y1*2 n +(x1y2+x2y1)*2 n / 2 +x2y2

[0051] It is equivalent to:

[0052] xy=x1y1*2 n +((x1+x2)(y1+y2)-x1y1-x2y2)*2 n / 2 +x2y2

[0053] Therefore, using the Karachuba method, we need to compute only three multiplications (x1y1, x2y2, (x1+x2)(y1+y2)) for numbers with ~n / 2 digits, which can be used with addition (positive or negative) and shifting (2 t This is equivalent to shifting by t bits to compute larger results, which is efficient in hardware. The equivalence shown allows for the computation of only three smaller multiplications instead of four, where the four smaller multiplications are used in more fundamental multiplication schemes.

[0054] We continue to use this method recursively, breaking each multiplication into three smaller multiplications, and for L recursive levels, we obtain n / 2 L 3 L L multiplications, considering all recursive levels, can be pieced together by shifting the result of each radix multiplication and adding it to the relevant bit range of the final result. For standard multiplication, L recursive levels would require n / 2 L 4th position L Multiplication.

[0055] In the Toom-Cook method, we generalize the approach shown in Karachuba, where in each recursive level, we split each number into m parts instead of exactly two. This makes the mathematical analysis more complex at each level and introduces the need for multiplication with small constants. However, in a hardware implementation, Toom-Cook does not add costly operations and allows numbers to be split into sufficiently small parts for radix multiplication with fewer recursive levels.

[0056] For example, compared to Karachupa, which requires four levels of recursion (2... 4 In a four-part Tum-Cook, we can use recursion with only two levels (4). 2 This allows us to break down x and y into 16 smaller parts. Since each level of recursion adds more complexity to the implementation, Tum-Cook can achieve better performance using a less complex implementation that can actually be implemented in real hardware.

[0057] Our Tum-Cook method allows for the modular generalization of the complete computation for any number of parts per recursion level and for any number of recursion levels, combining all required steps into just three, where at each step an operator combines many actions into one. This allows for the rapid design of different solutions that can be compared to maximize performance. Controller 102 may include a specific circuit system (e.g., hardware multiplier 33) for implementing the large number multiplication process described below.

[0058] The following embodiments can be used to perform current cryptographic large number multipliers by reducing large number multipliers to smaller multiplications and using hardware shifters and adders that perform large-scale multiplication calculations in a more efficient and simpler manner. This allows multiplication to be implemented in hardware, which will be faster and consume less energy.

[0059] Generally, these embodiments use the Tum-Cook method and compute large number multiplication, z = x·y, as the polynomial product given below:

[0060]

[0061] These embodiments transform x and y into polynomials x(t) and y(t) to find their values ​​at specific points, find the values ​​of polynomial z(t) at the same specific points by dot multiplication, interpolate the coefficients of z(t) from the points, and then finally use substitution cardinality to transform the polynomial z(t) back to the desired number z, where the result is bit-accurate (without approximation).

[0062] In one embodiment, we provide a recursive hierarchical scheme for the Tum-Cook algorithm with four parts, which uses the standard Tum-Cook algorithm. These embodiments also provide an improved two-recursive hierarchical scheme using modular matrix representation and a general n-recursive hierarchical scheme. Additionally, these embodiments implement division by 3, 5, or other small prime numbers required in the final stage of computation. Furthermore, these embodiments provide how multiplication can be accomplished modulo n by combining the Tum-Cook algorithm with a Montgomery modular multiplier.

[0063] One recursive level Tumkuk-four scheme:

[0064] (1) In this embodiment, the processor extracts the coefficients of the polynomials x(t) and y(t). The x and y input numbers are divided into 4 parts with the highest part (msb) located at index 3.

[0065] x(base number = t) = x³ * base number 3 +x2*base 2 +x1*base +x0

[0066] x coeff=[x3,x2,x1,x0], base = t = 2 128

[0067] For example, to calculate the th coefficient, we calculate:

[0068] Where i = 0 to (n-1)

[0069] x i =x% base number

[0070] x=(xx i ) / cardinality

[0071] Finish

[0072] x n =x% base number

[0073] Modular division is used to extract the rightmost part of the desired result.

[0074] It should be noted that in the case of binary numbers, only each group of 128 bits is used as the coefficient, and no calculation is required, only shifting.

[0075] (2) The processor then calculates the product of the two specific samples, x0·y0 and x3·y3. Note that z(0) = x(0)·y(0) = x0·y0 and Therefore, we should call x0·y0 z (t=0), and we should call x3·y3 z (t=∞). Even so, the second term is more accurately described above.

[0076] (3) The processor then calculates matrix T. z T x T y It is used to evaluate the polynomials x(t), y(t), and z(t) at specific points. Note that x and y are split into four parts (with base 2). 128 The four coefficients), the order of x(t) is 3, and similarly, the order of y(t) is 3 and therefore the polynomial order (dz) of z is 6. z Given a 5×7 matrix, and T at row i, column j z The element is 5 sampling points t i of Sampling points can be chosen arbitrarily, with smaller sampling points being preferred, in order to keep the numbers in the algorithm as small as possible.

[0077] In this embodiment, the specific values ​​defined are {t1=1,t3=-1,t3=2,t4=-2,t5=3} for Tz (Tz does not include sample points at t=0 and t=inf), but any other small values ​​can be chosen so that the value of matrix Tz is still small enough.

[0078]

[0079] Tz*z coeff ==(z(t1),z(t2),z(t3),z(t4),z(t5)) T

[0080] Extract Tx and Ty from Tz as the last four columns of Tz:

[0081]

[0082] It should be noted that these matrices are computed once offline and can be conveniently used later in online scenarios.

[0083] (4) The processor then uses the Tx and Ty matrices to calculate five samples of x and y:

[0084] The coefficient of x = Tx multiplied by x

[0085] y = the sample of Ty multiplied by the coefficient of y

[0086]

[0087] (5) The processor then calculates five samples of z by multiplying the samples of x and y calculated earlier:

[0088]

[0089] Add z(0) and z(∞) to the calculated 5 z samples:

[0090] Assumption Indicates a T containing only the first and last columns. z A matrix of all columns (in Matlab style). ).but

[0091]

[0092] Subtract z6(1,1) from z_samples 6 ,(-1) 6 ,2 6 ,(-20 6 ,3 6 ,0) T +z0(0,1,1,1,1,1,1) T We have

[0093]

[0094] (6) The processor then calculates the coefficients z5, z4, z3, z2, and z1 of z(t) from the sample. Explicitly

[0095] In this embodiment, the matrix can be used based on the fact that it is a Vandermonde matrix with an inverse. The inverse of the matrix completes the calculation.

[0096] Another way to express this is by using (z5,z4,z3,z2,z1). T The sample is labeled as z_coeff_mid and the sample is (z(1), z(-1), z(2), z(-2), z(3)). T It is labeled as z_samples_mid.

[0097]

[0098] and

[0099] in For Tz, which does not have a first and last column, we consider subtracting z6*t from each sample. 6 +z0 (processes the sample into a polynomial that does not have z6 and z0) to remove these columns.

[0100] In one embodiment, the entire calculation can be accomplished using two or one matrix multiplication:

[0101] 1- Subtraction:

[0102] This involves multiplying the samples of z by this matrix and subtracting the desired value z6*t from each sample. 6 +z0.

[0103] 2-Inverse multiplication:

[0104] The sample of z is multiplied by this matrix, which is the inverse of Tz, and the coefficients are obtained from the sample (where Tz obtains the sample from the coefficients).

[0105] The inverse matrix contains values ​​that are fractions (not integers) and would normally be stored as floating-point values. However, since bit-accurate calculations are required and floating-point values ​​do not preserve accurate values, this embodiment specifies that all coefficients are converted to integers that will preserve bit-accurate calculations by multiplying all values ​​by 120.

[0106]

[0107] Note that the final result will be multiplied by 120, and division may be required in the final calculation stage.

[0108] The complete coefficient vector of z can be computed by applying two matrices to the seven Z(t) samples:

[0109]

[0110] We can perform multiplication from right to left, multiplying by the subtraction matrix and then multiplying the result by the inverse matrix, or we can calculate the equivalent matrices of both beforehand and then multiply by a single matrix:

[0111]

[0112]

[0113] The maximum matrix coefficient 1800 = 2 3 *3 2 *5 2 <2 11 It is still relatively small and consists of smaller prime numbers.

[0114] (7) The processor then calculates the number expressed as a polynomial of z.

[0115] Result = z(base = 2) 128 )=z dz *Base number dz +...+z1*base number+z0=z6*(2 128 ) 6 +…+z1*2 128 +z0

[0116] Mathematically, it can be expressed as:

[0117]

[0118] It should be noted that this operation can be performed in hardware using simple shifting and addition without additional multiplication. It should also be noted that the result obtained through this method is x*y*120, and needs to be divided by 120. Since 120 = 2... 3 *3*5, therefore division can be expressed as dividing by 2 3 It simply shifts three bits to the right and then divides by 3*5, which can be done efficiently in hardware, as will be shown below.

[0119] Turning back to the diagram, Figure 4-6 Flowcharts illustrating a recursive hierarchical scheme are provided. These flowcharts demonstrate a general Tum-Cook algorithm with a recursive hierarchy. The specific numbers of x and y are split into subsets, and the selected sample points {1,-1,2,-2,3} that determine the specific size and value of the matrix are used as part of a two-level scheme that forms part of these embodiments.

[0120] Two-recursive-level Tumkuk solution

[0121] In another embodiment, an additional recursive level of Tum-Cook is added for each 128-bit multiplication, which allows for the use of much more efficient 32-bit radix multiplication.

[0122] These two levels can be represented as:

[0123] x(t)=x 15 t 15 +x 14 t 14 +x 13 t 13 +x 12 t 12 +x 11 t 11 +x 10 t 10 +x9t 9 +x8t 8 +x7t 7 +x6t 6 +x5t 5 +x4t 4 +x3t 3 +x2t 2 +x1t 1 +x0t 0 =X3w 3 +X2w 2 +X1w+X0 where

[0124] w = t 4 X3 = x 15 t 3 +x 14 t 2 +x 13 t+x 12 X2 = x 11 t 3 +x 10 t 2 +x9t+x8,X1=x7t 3 +x6t 2 +x5t+x4,X0=x3t 3 +x2t 2 +x1t+x0.

[0125] Express x as a four-part number: x = X³w 3 +X2w 2 +X1w+X0, and by applying the decomposition matrix, we obtain:

[0126]

[0127] set up It should be noted that each of x(w=∞) is actually a cubic polynomial in t, and similarly, y(w=∞) is also a cubic polynomial in t. Therefore, x(w=∞)·y(w=∞) can be calculated by factoring x(w=∞) and y(w=∞) and multiplying the points by the coordinates of the factored vectors. The same applies to x(w=1), y(w=1), x(w=-1)·y(w=-1), x(w=2), y(w=2), x(w=-2)·y(w=-2), x(w=3), y(w=3), and x(w=0)·y(w=0).

[0128] Therefore, this can be achieved by expanding each of the coordinates into a 4-dimensional vector and multiplying by the following: Decomposition:

[0129]

[0130] However, if the original coefficients X3, X2, X1, and X0 are each expanded into a four-dimensional vector, that is, if we use 16 coordinates x... 15 x 14 ..., x1, x0 and matrix D(1) will be expanded as follows, then the calculation can be realized. The extended vector:

[0131]

[0132] D(2) is derived from D(1) by expanding each element of D(1) into a 4×4 scalar matrix (examples 1→I4, 2→2I4, 0→04).

[0133] By combining them, we obtain the 2-level decomposition as

[0134] x samples =Decomp·x coef

[0135] in And Decomp is a 49×16 matrix.

[0136]

[0137] The second matrix (on the upper left) is generated as a "block scalar matrix", where each block matrix on the main diagonal is a basic sampling matrix.

[0138] This matrix encapsulates the two stages of decomposition (coefficients to samples) into one. D(2) returns samples, similar to D(1), but where D(1) returns samples as numbers, and D(2) returns them as vectors, where each number returns four parts. Since these seven numbers are the seven samples from which we perform dot multiplication, we can use each vector as input for the multiplier, which we also decompose and obtain seven samples from to preform another level of Tum-Cook. In general, the value changes from 16 parts (input) to seven four-part numbers (coefficients of samples) to 49 “part” numbers (samples of samples). This is why a matrix with D(1) on the diagonal is added to perform the second level of recursion individually for each of the four coefficients. However, by combining the operations obtained from the matrix to obtain an equivalent matrix (by computing the multiplication), the two levels are combined into a single operation.

[0139] It should be noted that the conventional way to perform a two-level Tum-Cook decomposition is to first perform a one-level Tum-Cook decomposition on the original number, and then perform another one-level Tum-Cook decomposition on the result of the first level decomposition. In matrix formulas, this is equivalent to:

[0140] 1) Calculate x sample1 =D(2)·x coef And then calculate:

[0141] 2)

[0142] Our method allows for the computation (offline) of the first decomposition matrix Decomp given above, and then x samples Calculate directly as a product

[0143] x samples =Decomp·x coef

[0144] For y, we will typically proceed with a similar process and compute the second decomposition matrix Decomp. y However, usually, the first and second decomposition matrices will be equal.

[0145] In fact, this is an implementation of the correlation law, which is satisfied by matrix multiplication and is expressed as A(BC) = (AB)C for any three matrices that define the product AB and BC.

[0146] Our method has different advantages, such as allowing direct calculation of the contribution of each of the coefficients of x to each of the samples.

[0147] One embodiment uses an equivalent operator in the two-level Tum-Cook derived as described above. Therefore, the actual operation is performed:

[0148]

[0149] Instead of Tx, a decomposition matrix is ​​used, where Tx is used in a single-level scheme (the use of a single matrix operator is the same).

[0150] (3) The processor then computes the sample of z by multiplying the samples of x and y. It should be noted that in the two-level recursive scheme, for each of the seven level-two samples (which are vectors) to be computed, seven level-one samples (numbers) are obtained. Therefore, there are 49 samples:

[0151]

[0152] Therefore, there are 49 multiplications with ~32 bits, instead of seven multiplications with 128 bits:

[0153]

[0154] (4) Synthesis: The synthesis stage is represented by a matrix.

[0155]

[0156] in In a single-level scheme, this is defined as the matrix that transforms samples into coefficients:

[0157]

[0158] Furthermore, we combine it with the substitution matrix to also convert the coefficients into numerical results (for the portion with a size of 128 bits):

[0159] z = S(1) * z samples

[0160] S(1) is used in a single-level recursion, and here S(2) is defined based on S(1), but with a base of 2^32 instead of 2^128 (for the smaller 32-bit portion):

[0161]

[0162] The complete composite matrix then follows:

[0163]

[0164] The first composite matrix (right side) is generated as a "block scalar matrix", where each block matrix on the main diagonal is a basic composite matrix.

[0165] Synthesis is performed in the opposite direction to decomposition. Similar to the decomposition stage, firstly, groups of samples are obtained (seven samples in each group), and S(2) is used to obtain a number from each group ("level one" sample), and then S(1) is used on all samples to obtain the final result of number z (49 samples in the sample, transformed into seven samples, transformed into one result).

[0166] The complete composite matrix is ​​a vector with 49 values, each composed of the sum of its decimal powers (example value: 5*2). 32 -7*2 96 +11*2 160 +…). In the hardware implementation, a little-multiplication method is used, followed by a shift and summation.

[0167] In addition, view the use of matrices The composition of the matrix allows each column to be associated with a quadratic power / shift. Therefore, we can calculate the contribution (weight) of each of the dot product i = 1…49 to each of the coordinates (bit range) of z. This produces a (square) matrix where each column represents the coordinate j of z, and the column contains the weights based on its contribution to z. j The weights of all dot multiplications of the contribution.

[0168] The calculation of z-synthesis can be performed by assigning registers to the final result. Each column of this matrix can be calculated in a separate register and added to the final result register with the corresponding shift after all contributions to the column have been calculated. Each column can be bounded from above, which can be used to limit the number of bits assigned to each column. Moreover, each column is non-negative, so we can ignore overflow and negative results in intermediate calculations. Preferably, each column will be added to the final result register only after all contributions to the column have been added.

[0169] (5) The result obtained is x*y*120 2 (Since both S(1) and S(2) are factored by 120), and then need to be divided by 120. 2 In our case, 120 2 =2 6 *3 2 *5 2 Therefore, dividing by a relatively small number can be expressed as dividing by 2. 6 It only shifts six bits to the right, then divides by 3. 2 *5 2 =15 2 .

[0170] Figure 7-10 The flowchart illustrates a two-level recursive scheme.

[0171] General case: Tum-Cook with m partitions and i recursion levels

[0172] In another embodiment, the Tum-Cook scheme with four partitions and one or two recursive levels can be generalized when using a decomposition and a composition matrix.

[0173] The partitioning of m parts, determined by the cardinality matrices d(1) and s(1), can be achieved by selecting a sufficient number of samples of x and y for z-interpolation (where the sample size should be equal to the order of z). The cardinality matrix can then be obtained in a similar manner to the previous method:

[0174]

[0175] Where t1, ..., t dz-1 Corresponding to the always-selected sample points (which should be small), excluding infinity and zero (first and last rows). dx and dz are the orders of the polynomials x and z, respectively, and they hold that dx = dy and dx + dy = dz (in our four-part instances, x...). 3 Since dx is the highest power and therefore dx = 3, dz = 6, and therefore we need dz-1 = 5 sample points excluding infinity and 0. It also holds that if dx = dy = m-1, then dz = 2m-2, so in general we need m coefficients of x and y and 2m-1 samples to interpolate z.

[0176] Except for the difference in the number of sample points (dz+1 = 2m-1) and the size of each multiplication (~512 / m), the point multiplication is the same (each x sample is multiplied by the y sample using a base multiplier).

[0177] Regarding synthesis:

[0178]

[0179]

[0180] The matrix used for interpolation Now it depends on the new Tz and the selected sample points, and the constants are determined such that It has all coefficients (due to the properties of Tz, the constants are expected to still consist of small prime factors, thus allowing for efficient division).

[0181] Finally, the composite matrix is:

[0182]

[0183] Because we partitioned it into 512 / m-bit groups.

[0184] These matrices can then be used as the basis for any number of recursive levels i:

[0185] General decomposition:

[0186] D(i) is constrained to D(1), where each value t is am i-1 ×m i-1 Block replacement, which has the value t*I mi-1 (For example, in the case of two recursive levels and four parts, the resulting block is 4) 2-1 =4, t*I4). Alternatively, D(i) is constrained to D(i-1), where each value t is replaced by an am×m block having the value t*I. m .

[0187] For example:

[0188]

[0189] The complete decomposition matrix then follows:

[0190]

[0191] All matrices are arranged diagonally in blocks, with the leftmost matrix having a value of (dz+1) on the diagonal. i-1 There are 1 block, and the leftmost second block has (dz+1). i-2 ,etc.

[0192] As emphasized above, this method allows for the first (offline) computation of the matrix Decomp given above, and then directly applying x... samples The calculation is a product, and the contribution of each original coefficient of x to each sample of x is clearly presented in the matrix, and can be calculated immediately after the coefficients are obtained.

[0193] For a product with a multiplicative size of 512 / m i (dz+1) i =(2m-1) i For each point, the dot product is the same.

[0194] Regarding synthesis:

[0195]

[0196]

[0197] All matrices are arranged diagonally in blocks, with the rightmost matrix having (dz+1) on the diagonal. i-1 There are 1 block, and the rightmost second block has (dz+1). i-2 ,etc.

[0198] Finally, we now need to divide the final result by const. i(If const consists of small prime numbers, it can still be done efficiently). Figure 11-13 The flowchart above illustrates the process.

[0199] The final stage of using a lookup table to divide by 15 or 15^2

[0200] Another embodiment identifies that, since the divisor is constant, small, and composed of a very small prime factor (3 in the case of a four-part two-level Tum-Cook), 2 *5 2 The input number is structured as follows, thus allowing for more efficient division using an exhaustive lookup table (LUT). In this embodiment, a small table is prepared beforehand for each possible value (from a small set), storing the division result and remainder. Using hexadecimal numbers (groups of four bits), we can compute long divisions with a LUT as follows: First, the processor iterates through each digit of the input number (four bits in hexadecimal) and concatenates it to the previous remainder. Next, the processor obtains the division result and adds the remainder of the current number to 3 / 5 / 15, etc., from the lookup table. Then, the processor adds the result number to the end of the result, thus saving the remainder for the next iteration. An example of this is shown in [example of example]. Figure 14 middle.

[0201] In each iteration, the algorithm only links and accesses small, fast memories, so many iterations can be completed in a single clock cycle by making serial hardware with several numbers as inputs and starting the next lookup in the same clock cycle by passing the remainder from one iteration to the next. In hexadecimal, the number of iterations is 512 / 4 (one iteration per four-bit group). The LUT size depends on the divisor (for three, the remainder is 0 to 2, so the values ​​are 00 to 2f, 16*3 values). Similarly, for a divisor of five, 16*5 values, and for a divisor of 15, 15*16 values. If radix 2 is used... b Instead of hexadecimal, the number of iterations can be reduced to 512 / b, but the memory required for 3, 5, and 15 LUTs changes to 3*2 respectively. b 5*2 b 15*2 b Therefore, using LUTs is efficient because the table size is proportional to the size of the divisors, and we get small divisors consisting of tiny prime divisors by using small, carefully selected samples in the Tumkuk multiplier.

[0202] This can be achieved by saving only the smaller divisor (which is three and five when dividing by 15, and...). 2These can be 3, 5, 15, or other combinations (similar to 9 and 5) to further reduce the LUT size. When several divisions are required, the full division can be performed in the pipeline, where the result of the division of the next number is passed as input to the next LUT divider on the next iteration. Therefore, a smaller, more memory-efficient LUT can be used to obtain the result, while adding only a small increment to the latency.

[0203] One embodiment optimizes this method to be performed in parallel with the computation of the Tum-Cook result. The Tum-Cook method can prioritize computing any bits of the result first (by computing the required point multiplications, which result in a bit range in an earlier clock cycle), computing the result from the most significant bit (msb) to the least significant bit (lsb). Once the first bit group is computed, division of the first bit group can begin, and the division can continue in parallel with the multiplication, providing subsequent bits of the multiplication result.

[0204] Another option for optimization is to reduce the number of iterations to 512 / 2. b+1 (Half of the previous method) without additional LUT memory, and can be performed by computing the divisions from msb to the middle and from the middle to lsb in parallel, assuming the first remainder of the lsb portion is zero. If the remainder is not zero, the method can be saved. The value of t, where t = 15 or t = 15 2 (The remainder is located at the msb of the number, therefore the difference between the dividend and the actual value (the dividend should be) is the remainder * 2) 257 Then divide by 15), and the value is added to the result by simple addition to correct the result.

[0205] Montgomery Model

[0206] In many cryptographic applications, multiplication should be computed as a modulus n (for some large odd or prime number n). This can be done by computing the modulus after the multiplication, but it would be more efficient to compute the multiplication and modulus together.

[0207] The Montgomery scheme described below is a way to improve the efficiency of modular arithmetic. In the Montgomery multiplier, we want to compute where is any large odd number.

[0208]

[0209] The Montgomery multiplier calculates x·y·R mod n by computing the first input in the Montgomery plane.

[0210]

[0211]

[0212] It then calculates all multiplications so that the result is also in the Montgomery plane:

[0213] If z = x·y mod n, then

[0214] Finally, after all the multiplications, the result can be obtained by multiplying by R. -1 Transform from the Montgomery plane to the normal mod N.

[0215] The following provides the mathematical analysis on how to derive the actual Montgomery calculation. In fact, Montgomery's calculations are as follows: Pre-calculation And perform the following operations:

[0216] (1) Calculation (that is, adopt) log2R LSB-s).

[0217] (2) Calculation

[0218] (3) Calculation

[0219] (4) Calculation

[0220] (5) If Then it ends.

[0221] This option requires: two multiplications of an integer of length log2R bits. It produces a result of length 2·log2R bits; and a multiplication. It only requires calculating log2R LSB⁻¹ of the product. It should be noted that... t < R, therefore

[0222] Using the general Montgomery scheme, which depends on any multiplication method, the proposed Tum-Cook scheme can be used to compute the required multiplications, thus using the improved performance of Tum-Cook to further improve the Montgomery scheme. Since the Montgomery scheme only uses multiplication, addition, and shifting (the latter two being inexpensive and efficient in hardware), performance can be further improved by optimizing the Tum-Cook multiplier used for the specific multiplications required in the scheme.

[0223] To observe the actual Montgomery scheme, three sequential multiplications must be performed (each depending on the previous results):

[0224] However, upon closer examination, the second multiplication... Only depend on The lower log2R bits. Therefore, once the lower log2R bits are calculated, the second multiplication can begin its calculation, and it is only necessary to calculate the lower log2R part of the result (the rest is never used).

[0225] Therefore, in one embodiment, a new mod R-optimized Thom-Cook multiplier is used, where multiplication is performed from lsb to msb, thereby first computing the lower part of the result to accelerate the full Montgomery scheme. This proposed Thom-Cook multiplier differs from the previously described normal output scheme, where the multiplication order is msb to lsb, to allow computation in parallel with division. A more advanced scheme may begin computation from the rightmost bit of log2R to lsb, and then proceed to compute the remaining bits from msb to the rightmost bit of log2R. Thus, parallel computation is achieved while still being optimized for mod R multiplication.

[0226] The Montgomery scheme uses a combination of the proposed normal output Tum-Kook multiplier (msb to lsb) and mod R optimized variants to maximize the scheme's performance by using each variant depending on the specific multiplication (the first two use the mod R variant and the last uses the normal variant).

[0227] Several advantages exist associated with these embodiments. For example, for large number multiplication, the Tum-Cook scheme, with its four parts and two recursive levels, presents many advantages over previous methods because it offers faster and more efficient multiplication hardware than normal hardware multipliers, which are extremely inefficient for large numbers. Multiplication can be performed much faster by converting large multiplication into many multiplications of smaller numbers (e.g., from 512 bits to 32 bits), and the combination of shifts, additions, and multiplications with small constants to obtain the final result is inexpensive and efficient in hardware.

[0228] The Tum-Cook multiplier is also more efficient than the Karachupa multiplier, which simply splits each number into two parts and therefore requires many recursive levels to achieve a sufficiently small base multiplication as in the Tum-Cook multiplier. Adding these recursive levels increases the computational complexity of the hardware and makes it impractical in real-world designs. Furthermore, the inclusion of the required division using the result of a fast and simple hardware operation (LUT lookup) parallel to multiplication allows for the full implementation of the Tum-Cook operation in practical hardware without the performance hit typically obtained from division. This makes the use of the Tum-Cook in hardware feasible, as previous attempts to use it in hardware were hampered by the need for division hardware in the scheme, which can often be slow and costly.

[0229] The proposed division in these embodiments further preserves LUT memory usage by adding pipelines, thereby saving only the LUT for the fractional part and reducing the cost of the division hardware. Efficient division of the result (due to the use of the inverse matrix and the need for bit-accurate results) is possible because the result is multiplied by a constant of a fraction (e.g., 120^2) consisting of small prime factors (e.g., ignoring powers of three and five that can be divided by shifted powers of two). The resulting constant is actually small due to the initial intelligent selection of the sample points.

[0230] The proposed matrix method for Tum-Cook computation, along with the ability to derive the desired matrix for any number of parts / coefficients and any number of recursive levels at each level, allows for the rapid and simple design of different Tum-Cook multipliers with varying parameters. This, in turn, allows for the development of many different Tum-Cook hardware variants and their comparison with the cost and efficiency of the chosen solution through further optimization. The complete decomposition and synthesis stages of the operation, along with the minimization of a matrix multiplication, each allow for the treatment of each stage as a single operation, which can be significantly optimized for performance.

[0231] There are also advantages over using the Karachuba method. For example, the Karachuba method involves a hierarchical approach where each layer can be computed after the aforementioned upper layer. Furthermore, in the synthesis phase, a similar hierarchical approach is applied, and each layer can be computed only after the aforementioned lower layer. In contrast, these embodiments compute decomposition by multiplying the matrices of each layer. Once the decomposition matrix is ​​obtained as a fixed matrix and computed offline by multiplying all the decomposition matrices of each layer together, the decomposition can be computed regardless of the layer. Whenever a portion of x is received, the controller determines how it will be represented in each coordinate of the decomposition output. Therefore, the portion of x can be added to each output coordinate along with the correct linear combination coefficients (it is possible that some coordinates will not contain the portion (i.e., the coefficients for such coordinates are 0)). Thus, these embodiments allow for the computation of linear combinations for each sample of x for each of the samples, without waiting for layers to be computed layer by layer. And the same applies to y.

[0232] After decomposing both x and y, the system multiplies the coordinates of the output of the decomposition matrix and then begins the synthesis process. The system does not need to wait for the decomposition to finish and can begin calculating the dot product at any time, provided there are sufficient x and y samples to contribute to the output of the decomposition matrix. This differs from existing methods that compute synthesis in a bottom-up manner, where lower levels are synthesized first and each level must wait until the aforementioned lower levels are computed. Again, existing methods compute layer by layer, while this embodiment does not require waiting to compute previous levels before computing the current level. In fact, these embodiments are not affected by layers but can compute based on bit importance. For example, in some cases, the system can compute the product from the most significant bit to the least significant bit, while in others, the system can do the reverse and compute the product from the least significant bit to the most significant bit.

[0233] In one embodiment, the system computes the synthesis matrix as a product of the synthesis of all layers, so the system knows precisely where each element in the product should be included and what its coefficient is, thus the system does not have to wait for the layers to complete. Once the system has the product of the two coordinates x and y, it can immediately add up the contributions of each of the coordinates that it has contributed to the product.

[0234] Furthermore, as discussed below, in one embodiment, the system uses modular arithmetic as part of the multiplication, which speeds up the multiplication process. In some cases, the system computes multiplication from the most significant bit to the least significant bit to perform an approximate modulo operation and remove several most significant bits from the intermediate result, thus allowing for faster computation of shorter integers.

[0235] More specifically, the combination of the Montgomery modular multiplier and the Tum-Cook multiplier allows for efficient computation of the result mod n, while saving both the cost of constant-scale operations and the multiplication cost within the Montgomery scheme. Furthermore, the design and use of a special variant of the Tum-Cook hardware for Montgomery allows for profound optimization of every part of the Montgomery operation, resulting in a highly optimized overall design of the modular multiplier that is both fast and efficient. Figure 15 The Montgomery scheme of the embodiment is explained.

[0236] The following paragraphs provide additional information about the specific values ​​used in the Tum-Cook implementation with one level and four sections. For sample point {1,-1,2,-2,3}:

[0237] Coefficients of the sample matrix:

[0238]

[0239]

[0240]

[0241] Sample of the coefficient matrix:

[0242]

[0243]

[0244]

[0245] Inverse matrix multiplication:

[0246] Inverse multiplication by an integer value:

[0247]

[0248] Equivalent matrix:

[0249]

[0250] The following provides information about the complete decomposition matrix used in Tum-Cook, which has two levels and four parts. Figure 16 The graph is for the sample points {1,-1,2,-2,3}.

[0251] The following is Montgomery's mathematical analysis. Given... and The calculation can be performed based on the following principles:

[0252] (1) Calculation

[0253] (2) Find an integer t ≤ R such that

[0254] (3) Due to We have:

[0255]

[0256] Since z = 0 mod R and gcd(n,R) = 1, this implies that for some whole a, c·d + t = a·R.

[0257] (4) Therefore z / R=x·y·R-(d·x+c·y)·n+a·n.

[0258] (5) Therefore, modulo n, we have z / Rmod n=x·y·R mod n.

[0259] (6) Based on our assumption t≤R, Therefore, z < n·(n+R) < 2·n·R.

[0260] Therefore, z / R < 2n. So either z / R < n, or z / Rn < n.

[0261] Exemplary type of memory

[0262] Ultimately, as mentioned above, any suitable type of memory can be used. Semiconductor memory devices include volatile memory devices, such as dynamic random access memory (“DRAM”) or static random access memory (“SRAM”) devices; non-volatile memory devices, such as ReRAM, electrically erasable programmable read-only memory (“EEPROM”), flash memory (which can also be considered a subset of EEPROM), ferroelectric random access memory (“FRAM”), and MRAM; and other semiconductor elements capable of storing information. Each type of memory device can have different configurations. For example, flash memory devices can be configured using NAND or NOR configurations.

[0263] Memory devices can be formed from passive and / or active elements in any combination. By way of non-limiting examples, passive semiconductor memory elements include ReRAM device elements, which in some embodiments include resistivity-switching storage elements, such as antifuse, phase-change materials, etc., and optionally include steering elements, such as diodes, etc. Additionally, by way of non-limiting examples, active semiconductor memory elements include EEPROM and flash memory device elements, which in some embodiments include elements containing charge storage regions, such as floating gates, conductive nanoparticles, or charge storage dielectric materials.

[0264] Multiple memory elements can be configured such that they are connected in series or such that each element can be accessed individually. By way of a non-limiting example, a flash memory device (NAND memory) configured as NAND typically contains memory elements connected in series. A NAND memory array can be configured such that the array consists of multiple memory strings, where each string consists of multiple memory elements sharing a single bit line and accessed as a group. Alternatively, memory elements can be configured such that each element can be accessed individually, for example, a NOR memory array. NAND and NOR memory configurations are examples, and memory elements can be configured in other ways.

[0265] Semiconductor memory elements located within and / or on a substrate can be arranged in two or three dimensions, such as two-dimensional (2D) memory structures or three-dimensional (3D) memory structures.

[0266] In a 2D memory structure, semiconductor memory elements are arranged in a single plane or a single memory device layer. Typically, in a 2D memory structure, the memory elements are arranged in a plane that extends substantially parallel to the main surface of the substrate supporting the memory elements (e.g., in the xz plane). The substrate may be a wafer on which a layer of memory elements is formed, or it may be a carrier substrate attached to the memory elements after the memory elements are formed. As a non-limiting example, the substrate may contain a semiconductor such as silicon.

[0267] Memory elements can be arranged in an ordered array, such as multiple rows and / or columns, within a single memory device hierarchy. However, memory elements can be arranged in an irregular or non-orthogonal configuration. Each memory element may have two or more electrodes or contact lines, such as bit lines and word lines.

[0268] The 3D memory array is arranged such that the memory elements occupy multiple planes or multiple memory device layers, thereby forming a three-dimensional structure (i.e., in the x, y, and z directions, where the y direction is generally perpendicular to the main surface of the substrate, and the x and z directions are generally parallel to the main surface of the substrate).

[0269] As a non-limiting example, a 3D memory structure can be vertically arranged as a stack of multiple 2D memory device layers. As another non-limiting example, a 3D memory array can be arranged as multiple vertical columns (e.g., columns extending generally perpendicular to the main surface of the substrate (i.e., in the y-direction), with each column containing multiple memory elements. The columns can be arranged, for example, in a 2D configuration in the xz plane, resulting in a 3D arrangement of the memory elements, where the elements are located on multiple vertically stacked memory planes. Other configurations of memory elements in a three-dimensional form can also constitute a 3D memory array.

[0270] By way of non-limiting examples, in a 3D NAND memory array, memory elements can be coupled together to form NAND strings within a single horizontal (e.g., xz) memory device layer. Alternatively, memory elements can be coupled together to form vertical NAND strings spanning multiple horizontal memory device layers. Other 3D configurations are conceivable, where some NAND strings contain memory elements within a single memory layer, while others contain memory elements spanning multiple memory layers. 3D memory arrays can also be designed in NOR and ReRAM configurations.

[0271] Typically, in a monolithic 3D memory array, one or more memory device levels are formed above a single substrate. Optionally, the monolithic 3D memory array may also have one or more memory layers at least partially within a single substrate. As a non-limiting example, the substrate may comprise a semiconductor such as silicon. In a monolithic 3D array, the layers constituting each memory device level of the array are typically formed on the layers of the underlying memory device levels of the array. However, layers of adjacent memory device levels in a monolithic 3D memory array may be shared between memory device levels, or intermediate layers may be present between memory device levels.

[0272] Furthermore, two-dimensional arrays can be formed separately and then packaged together to form a non-monolithic memory device with multiple memory layers. For example, a non-monolithic stacked memory can be constructed by forming memory layers on separate substrates and then stacking the memory layers on top of each other. The substrate can be thinned or removed from the memory device layers before stacking, but since the memory device layers are initially formed on separate substrates, the resulting memory array is not a monolithic 3D memory array. Additionally, multiple 2D or 3D memory arrays (monolithic or non-monolithic) can be formed on separate chips and then packaged together to form a stacked chip memory device.

[0273] Typically, an associated circuit system is required to operate and communicate with the memory element. As a non-limiting example, a memory device may have a circuit system for controlling and driving the memory element to perform functions such as programming and reading. This associated circuit system may be on the same substrate as the memory element and / or on a separate substrate. For example, a controller for memory read / write operations may be located on a separate controller chip and / or on the same substrate as the memory element.

[0274] Those skilled in the art will recognize that the present invention is not limited to the described 2D and 3D structures, but encompasses all relevant memory structures as described herein and as understood by those skilled in the art within the spirit and scope of the invention.

[0275] in conclusion

[0276] It is intended that the foregoing detailed description be construed as an illustration of the chosen forms of the invention and not as a limitation thereof. Only the appended claims (including all equivalents) are intended to define the scope of the claimed invention. Finally, it should be noted that any aspect of any of the embodiments described herein may be used alone or in combination with each other.

Claims

1. A storage system comprising: Memory; as well as A controller, including a processor and multiple hardware multipliers, wherein the controller is configured to: Receive data from the host for storage in the memory; The data received from the host is transformed into encrypted data by executing a cryptographic process to encrypt the data in the following manner: Use the processor to: It accepts input numbers x and y for multiplication; and Generate coefficient vectors for x and for y at multiple levels; and Using the aforementioned multiple hardware multipliers to: The sample extraction process is performed by multiplying the coefficient vectors of the multiple levels for x by a first decomposition matrix to obtain a first result vector and by multiplying the coefficient vectors of the multiple levels for y by a second decomposition matrix to obtain a second result vector. The dot multiplication process is performed by multiplying the first result vector and the second result vector to obtain the third result vector; as well as The interpolation process is performed by multiplying the third result vector by the synthesis matrix to obtain the result and dividing the result by a constant to obtain the final result, with small fast memory accessed at the algorithm connection point and the iteration completed in a single clock cycle; as well as The encrypted data is stored in the memory.

2. The storage system of claim 1, wherein the processor is configured to retrieve the constant from a lookup table.

3. The storage system of claim 1, wherein the plurality of hardware multipliers are configured to perform division from a plurality of starting points and to correct for the remainder of the division.

4. The storage system according to claim 1, wherein the cryptographic process is based on the Tum-Cook algorithm, which includes coefficient vectors of the multiple levels.

5. The storage system of claim 1, wherein the plurality of hardware multipliers are configured to perform multiplication from the most significant bit to the least significant bit using a modified Montgomery multiplier.

6. The storage system of claim 1, wherein the first decomposition matrix comprises the product of decomposition matrices for each of the plurality of levels of coefficient vectors for x, and wherein the second decomposition matrix comprises the product of decomposition matrices for each of the plurality of levels of coefficient vectors for y.

7. The storage system of claim 6, wherein the plurality of hardware multipliers are configured to compute the first decomposition matrix offline and then perform the dot multiplication process.

8. The storage system of claim 1, wherein the plurality of hardware multipliers are configured to execute the point multiplication process before the sample extraction process ends.

9. The storage system according to claim 1, wherein the memory includes a three-dimensional memory.

10. A method applied in a data storage device including a memory and a controller, the controller including a processor and a plurality of hardware multipliers, the method comprising: Receive data from the host for storage in the memory; The data received from the host is transformed into encrypted data by executing a cryptographic process to encrypt the data in the following manner: Use the processor to: It accepts input numbers x and y for multiplication; and Generate coefficient vectors for x and for y at multiple levels; and Using the aforementioned multiple hardware multipliers to: The sample extraction process is performed by multiplying the coefficient vectors of the multiple levels for x by a first decomposition matrix to obtain a first result vector and by multiplying the coefficient vectors of the multiple levels for y by a second decomposition matrix to obtain a second result vector. The dot multiplication process is performed by multiplying the first result vector and the second result vector to obtain the third result vector; as well as The interpolation process is performed by multiplying the third result vector by the synthesis matrix to obtain the result and dividing the result by a constant to obtain the final result, with small fast memory accessed at the algorithm connection point and the iteration completed in a single clock cycle; as well as The encrypted data is stored in the memory.

11. The method of claim 10, further comprising using the processor to retrieve the constant from a lookup table.

12. The method of claim 10, further comprising using a Tum-Cook algorithm comprising a coefficient vector of said plurality of levels, wherein the coefficient vector of said plurality of levels comprises two levels, each of said two levels comprising four parts.

13. The method of claim 10, further comprising using a modified Montgomery multiplier to perform multiplication from the most significant bit to the least significant bit.

14. The method of claim 10, wherein the first decomposition matrix comprises a product of decomposition matrices for each of the plurality of levels of the first number, and wherein the second decomposition matrix comprises a product of decomposition matrices for each of the plurality of levels of the second number.

15. The method of claim 10, further comprising using a plurality of hardware multipliers to perform a point multiplication process before the sample extraction process ends.

16. The method of claim 10, wherein the method is performed in a controller of the storage system.

17. The method of claim 11, wherein the method is performed in a host communicating with a storage system.

18. A data storage device, comprising: Memory; as well as A component for transforming data received from a host and intended to be stored in the memory into encrypted data by executing a cryptographic process in such a way as follows: Use the processor to: It accepts input numbers x and y for multiplication; and Generate coefficient vectors for x and for y at multiple levels; and Use multiple hardware multipliers to: The sample extraction process is performed by multiplying the coefficient vectors of the multiple levels for x by a first decomposition matrix to obtain a first result vector and by multiplying the coefficient vectors of the multiple levels for y by a second decomposition matrix to obtain a second result vector. The dot multiplication process is performed by multiplying the first result vector and the second result vector to obtain the third result vector; as well as The interpolation process is performed by multiplying the third result vector by the synthesis matrix to obtain the result and dividing the result by a constant to obtain the final result, with small fast memory accessed at the algorithm connection point and the iteration completed in a single clock cycle; as well as Components for storing the encrypted data in the memory.

Images