Fast Search Method and System for 3-Component Second-Order Threshold Implementation Scheme

Abstract

The present invention discloses a rapid search method and system for three-component second-order threshold implementation solutions, comprising: determining a component coordinate combination based on incompleteness in second-order safety threshold implementation characteristics; determining initial component function expressions of a vector Boolean function based on the component coordinate combination and the correctness of the safety threshold implementation; determining candidate linear additions for each component function based on the component function expressions and the combination probability identical distribution and uniformity in the safety threshold implementation characteristics; placing the component functions corresponding to the coordinate functions that satisfy the probability identical distribution and uniformity and to which the candidate linear additions are added in the memory unit space of the coordinate function; extracting a component function from the memory unit space corresponding to each coordinate function, combining all the extracted component functions into a whole, and taking the whole that satisfies the probability identical distribution, uniformity, and correctness as the final threshold implementation solution. Rapid search for threshold implementation solutions is achieved.

Description

Technical Field

[0001] The present invention relates to the field of threshold search technology, and in particular to a fast search method and system for a three-component second-order threshold implementation solution. Background Art

[0002] The statements in this section merely provide background information related to the present invention and do not necessarily constitute prior art.

[0003] For many cryptographic devices, adversaries often try to obtain secret information by monitoring the physical characteristics of the target device using side-channel attacks. Side-channel attacks are a serious threat to cryptographic devices that do not adopt any protection strategies. To resist side-channel attacks, academia and industry have proposed a large number of protection strategies, among which the masking scheme is the most widely used protection strategy. The masking scheme randomizes the intermediate value of the secret in order to break the relationship between sensitive data and the physical characteristics of the target device during the execution of the password. The specific implementation of the masking scheme varies depending on the software and hardware platforms of the application. The masking scheme suitable for the hardware platform is called threshold implementation. The threshold implementation is not affected by glitches and can ensure the implemented security characteristics while meeting the requirements of all security characteristics. In order to evaluate the security of the threshold implementation scheme, the designer uses a robust glitch extension detection model for analysis.

[0004] Because the threshold implementation has a good theoretical basis, it is indeed safe under the glitch extension detection model, but the threshold scheme for searching nonlinear functions is not simple. For Boolean functions with algebraic degree of t, the traditional threshold implementation scheme of d-order security requires that the number of components of the input variables is at least: td+1. Due to the large number of components of the input variables, as the algebraic degree and security order increase, the threshold implementation of the Boolean function has a higher area implementation cost. In order to reduce the area implementation cost, some literatures proposed a threshold implementation scheme that uses d+1 components to achieve d security. Shahmirzadi et al. proposed a search method for a 3-component 2nd-order security threshold implementation scheme in 2021, but the search method is very complicated, and it takes dozens of minutes to search a scheme, which is time-consuming. Summary of the Invention

[0005] In order to solve the above problems, the present invention proposes a fast search method and system for a three-component second-order threshold implementation scheme, thereby realizing a fast and effective search for the threshold implementation scheme.

[0006] To achieve the above object, the present invention adopts the following technical solutions:

[0007] First, a fast search method for a three-component second-order threshold implementation scheme is proposed, including:

[0008] According to the incompleteness in the second-order security threshold realization characteristics, the component coordinate combination corresponding to the component function of the vector Boolean function threshold realization without adding protection is determined;

[0009] According to the correctness of the component coordinate combination and the second-order safety threshold realization characteristics, the component function expressions of the vector Boolean function threshold realization without adding protection are determined;

[0010] Determine the candidate linear additions for each component function based on the combination of component coordinates, the expressions of each component function, and the identical distribution and uniformity of the combined probabilities in the second-order safety threshold realization characteristics;

[0011] For each coordinate function, each candidate linear addition item is added to the component function, and it is determined whether the coordinate function after adding the candidate linear addition item satisfies the probability identical distribution and uniformity. The component function with the candidate linear addition item added corresponding to the coordinate function that satisfies the probability identical distribution and uniformity is placed in the memory unit space of the coordinate function.

[0012] A component function is extracted from the memory unit space corresponding to each coordinate function, and all the extracted component functions are combined into a whole to determine whether they meet the probability of identical distribution, uniformity and correctness. The whole that meets the probability of identical distribution, uniformity and correctness is the final threshold implementation solution.

[0013] Secondly, a fast search system for a three-component second-order threshold implementation solution is proposed, including:

[0014] A component coordinate combination determination module is used to determine the component coordinate combination corresponding to the component function of the vector Boolean function threshold implementation without adding protection based on the incompleteness in the second-order safety threshold implementation characteristics;

[0015] A component function expression determination module is used to determine the component function expressions of the unprotected vector Boolean function threshold implementation based on the correctness of the component coordinate combination and the second-order safety threshold implementation characteristics;

[0016] A candidate linear addition item determination module is used to determine the candidate linear addition items of each component function based on the combination of component coordinates, the expression of each component function and the same distribution and uniformity of the combination probability in the second-order safety threshold realization characteristic;

[0017] A component function determination module is configured to, for each coordinate function, add each candidate linear addition item to the component function, determine whether the coordinate function after adding the candidate linear addition item satisfies the probability identical distribution and uniformity, and place the component function with the candidate linear addition item added corresponding to the coordinate function that satisfies the probability identical distribution and uniformity in the memory unit space of the coordinate function;

[0018] The threshold implementation scheme determination module is used to extract a component function from the memory unit space corresponding to each coordinate function, combine all the extracted component functions into a whole, and judge whether they meet the probability of identical distribution, uniformity and correctness. The whole that meets the probability of identical distribution, uniformity and correctness is the final threshold implementation scheme.

[0019] In a third aspect, an electronic device is proposed, comprising a memory and a processor, and computer instructions stored in the memory and running on the processor. When the computer instructions are run by the processor, the steps described in the fast search method for the three-component second-order threshold implementation scheme are completed.

[0020] In a fourth aspect, a computer-readable storage medium is proposed for storing computer instructions. When the computer instructions are executed by a processor, the steps of the fast search method for implementing a three-component second-order threshold are completed.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] 1. The present invention only searches for candidate linear additions, and while ensuring that a threshold implementation solution can be found, the search space is greatly reduced. The security feature of the threshold implementation is utilized to reduce the number of times the candidate linear additions are traversed, further reducing the search space and improving the search speed.

[0023] 2. The search implementation of the present invention is based on reading and writing of memory, so fast reading and writing operations improve the search speed of the algorithm.

[0024] Advantages of additional aspects of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings in the specification, which constitute a part of this application, are used to provide further understanding of this application. The illustrative embodiments of this application and their descriptions are used to explain this application and do not constitute improper limitations on this application.

[0026] Figure 1 A flow chart of a method is disclosed for an embodiment. DETAILED DESCRIPTION

[0027] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0028] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of the present application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the art to which the present application belongs.

[0029] Example 1

[0030] In this embodiment, a fast search method for a 3-component second-order threshold implementation is disclosed, such as Figure 1 As shown, including:

[0031] According to the incompleteness in the second-order security threshold realization characteristics, the component coordinate combination corresponding to the component function of the vector Boolean function threshold realization without adding protection is determined;

[0032] According to the correctness of the component coordinate combination and the second-order safety threshold realization characteristics, the component function expressions of the vector Boolean function threshold realization without adding protection are determined;

[0033] Determine the candidate linear additions for each component function based on the combination of component coordinates, the expressions of each component function, and the identical distribution and uniformity of the combined probabilities in the second-order safety threshold realization characteristics;

[0034] For each coordinate function, each candidate linear addition item is added to the component function, and it is determined whether the coordinate function after adding the candidate linear addition item satisfies the probability identical distribution and uniformity. The component function with the candidate linear addition item added corresponding to the coordinate function that satisfies the probability identical distribution and uniformity is placed in the memory unit space of the coordinate function.

[0035] A component function is extracted from the memory unit space corresponding to each coordinate function, and all the extracted component functions are combined into a whole to determine whether they meet the probability of identical distribution, uniformity and correctness. The whole that meets the probability of identical distribution, uniformity and correctness is the final threshold implementation solution.

[0036] The process of determining the component coordinate combination corresponding to the component function is:

[0037] The component coordinates of input variable a and input variable b are determined according to the nonlinear term ab in the Boolean function. Based on the incompleteness in the second-order safety threshold implementation characteristics, the component coordinates of a and b are assigned to different component functions. According to the component coordinates of a and b assigned to each component function, the component coordinates of the linear term c are determined, and then the component coordinate combinations corresponding to all component functions are obtained.

[0038] For a Boolean function containing only one nonlinear term, any input variable is selected from the nonlinear term and denoted as a, and the remaining input variables are denoted by b. For a component coordinate combination of a Boolean function containing two or more nonlinear terms, the input variable that appears most frequently in the nonlinear term is denoted as a, and the remaining input variables are denoted by b. According to the assignment order of variable a {a0,a0,a0,a1,a1,a1,a2,a2,a2} and the assignment order of variable b {b0,b1,b2,b0,b1,b2,b0,b1,b2}, the component coordinates of a and the component coordinates of b are assigned to different component functions.

[0039] The process of determining the function expression of each component is:

[0040] For a quadratic Boolean function containing three types of terms, the expression of its three-component second-order threshold realization contains a total of nine component functions, each of which contains a component expression of a nonlinear term; three component functions are selected from the nine component functions to place the three components of the linear term; and one of the component functions is randomly selected from all the component functions, and the constant term is XORed at the end of the component function to obtain the expression of each component function.

[0041] If two component functions in a set of three component functions contain the same linear component terms, then the two same linear components are removed; if in a set of three component functions, if the component coordinate combination contains an identical component, and this component appears only once as a linear term in this set of component functions, then this linear component term is moved to the other component functions in this set to determine the candidate linear additive terms of each component function.

[0042] Add the candidate linear additions of each component function to the table to obtain the candidate linear addition table. On the basis of the component function expression that satisfies the correctness, traverse the candidate linear addition table and add different candidate linear additions to the component function expression. Determine whether the coordinate function after adding the candidate linear additions satisfies the probability identical distribution and uniformity. If so, store the coordinate function corresponding to the coordinate function with the candidate linear additions added in the memory unit space corresponding to the coordinate function.

[0043] The final threshold implementation process is:

[0044] A component function is extracted from the memory unit space corresponding to each coordinate function, and all the extracted component functions are combined into a whole. For each whole, it is verified in turn whether the whole satisfies the combination probability identical distribution, uniformity and correctness. The whole that satisfies the combination probability identical distribution, uniformity and correctness is used as the final threshold implementation solution.

[0045] In this embodiment, lowercase italic letters (such as x) are used to represent Binary variables on , represented by uppercase italics (such as: X) The i-th component of the variable x is represented by x i Boolean functions are represented by lowercase sans serifs, such as: (.), Boolean vector functions are represented by uppercase sans serifs, such as: (.), and sets are represented by boldface, such as:. A Boolean function of n variables is represented as: Vector Boolean functions are represented as: The relationship between the coordinate function f(.) and the vector Boolean function F(.) is as follows:

[0046]

[0047] in,

[0048] Definition 1: Balance: If a Boolean function satisfy:

[0049] #{X|f(X)=1}=#{|X|f(X)=0|}, (2)

[0050] Then the Boolean function is balanced.

[0051] Definition 2: Glitch extension detection model: In the glitch extension detection model, a probe placed on the output of a logic gate circuit can propagate forward until it encounters a register, so that all inputs of the combinational logic circuit that drives the probed gate circuit can be detected by the extended probe.

[0052] Definition 3: Combinatorial probability is identically distributed: Taking the Boolean function x = f(a, b) = ab + b as an example, the four component functions corresponding to this Boolean function are as follows:

[0053]

[0054] Among them, a0, a1, b0 and b1 represent the components of the input variables, x0 and x1 represent the output components, and the result of the component function is stored in the register variable x′ i where i∈{0,1,2,3}. According to the glitch extension detection model, placing a probe at an output component x0 can extend detection to x′0 and x′1. P(x′0,x′1) represents the joint probability distribution factor when the probe is placed at x0. This factor is independent of the values of the input variables a and b (i.e., for any combination of a||b). The joint factor (0,0) appears twice, (1,0) appears once, and (0,1) appears once. This phenomenon is called the identical distribution of combined probabilities.

[0055] Threshold implementation is a commonly used hardware mask protection scheme. This scheme is also able to resist side channel energy attacks when glitches occur, so the hardware implementation is more secure. Threshold implementation is based on the ideas of secret sharing, threshold cryptography and secure multi-party computing protocols. Assume that F is a function The threshold is realized, The function can be expressed as: The input bits are divided into s x The output bits are divided into s y The component combination of the input variable x of the function y=F(x) is expressed as in The component combination of the output variable y is expressed as in Its threshold implementation function The i-th component of can be expressed as where i∈{1,…, y}. In order to ensure the security of threshold implementation, the function The components should satisfy the following characteristics:

[0056] Definition 4. Correctness: For all If the following equation is satisfied It represents the threshold realization function Satisfy correctness.

[0057] Definition 5. Incompleteness of order: function Any d components F i The combination of must be independent of at least one input component, i.e., at most x -1 input component related.

[0058] Definition 6. Uniformity: Threshold implementation function for y = F(x) The input components are distributed as follows:

[0059]

[0060] in X,X i Indicates a The specific value on the domain, i∈{1,…, x Based on the distribution conditions of the input components, if the distribution of the output components satisfies:

[0061]

[0062] in Y,Y i Indicates a The specific value on the domain, i∈{1,…, y}, then it is called the threshold realization function Satisfy uniformity.

[0063] The second-order safety threshold implementation characteristics include Definition 1 to Definition 6.

[0064] Based on the above-mentioned second-order security threshold implementation characteristics, this embodiment proposes a fast search method for a three-component second-order threshold implementation scheme. This search method greatly narrows the search space, thereby reducing the memory requirement of the search program. There is no need to store intermediate variables in a file, which reduces the search time and improves the search efficiency.

[0065] The fast search method for implementing the three-component second-order threshold disclosed in this embodiment mainly includes three steps, namely:

[0066] Step 1: In the preprocessing stage, based on the expressions of all coordinate functions contained in the Boolean vector function F, three aspects are determined:

[0067] (1) Determine the input component coordinate combination of the component function of the Boolean function threshold realization based on the incompleteness of the second-order safety threshold realization characteristics;

[0068] (2) Based on the correctness and component coordinate combination of the second-order safety threshold implementation characteristics, determine the component function expressions of the vector Boolean function threshold implementation without adding protection;

[0069] (3) According to the identical distribution and uniformity of the combined probability in the second-order safety threshold realization characteristics, the component coordinate combination and the component function expression that satisfies the correctness, the candidate linear addition items of each component function are determined, and a table of the candidate linear addition items is established.

[0070] The expression constructed in (2) and the table of candidate linear additions established in (3) in this step are the basis for searching for the second-order safety threshold of a single coordinate function in step 2.

[0071] Step 2: Search for an expression that satisfies second-order security for a single coordinate function. Based on the expression that satisfies correctness constructed in Step 1 (2), traverse the candidate linear additions in the table established in Step 1 (3). For each coordinate function, search for a second-order security threshold implementation expression that satisfies security property I (i.e., combined probability identical distribution, balance, uniformity, and correctness). The second-order security threshold implementation expression is the component function with the candidate linear addition added when the coordinate function satisfies probability identical distribution and uniformity. The component function with the candidate linear addition added for each coordinate function is stored in a separate memory unit space for each coordinate function.

[0072] The second-order security expression searched in Step 2 can satisfy the combination probability identical distribution, balance, and uniformity of the second-order glitch extension probe model of a single coordinate Boolean function and the correctness of the Boolean vector function, but it cannot guarantee the overall security and joint uniformity of the Boolean vector function.

[0073] Step 3: Search for a threshold implementation solution that satisfies the second-order security as a whole for the Boolean vector function; traverse all memory unit spaces in Step 2, and extract a component function corresponding to a single coordinate function from each space in turn. The component functions corresponding to all the extracted coordinate functions form a whole, and then check whether this whole expression satisfies the combination probability identical distribution and uniformity in Security Property II. Finally, verify the correctness of the whole expression to ensure the security and correctness of the second-order security threshold implementation expression of the Boolean vector function. So far, for the Boolean vector function, the threshold implementation expression searched satisfies the following as a whole: correctness, uniformity, second-order incompleteness and combination probability identical distribution, and can meet the security characteristics of the second-order glitch extension probe model.

[0074] Detailed explanation of the incompleteness of the second-order safety threshold implementation:

[0075] Probes are placed at any two nodes in the Boolean function threshold implementation circuit. Based on the second-order glitch extension probe model, all signals associated with the probe nodes are extended until a register is encountered. If all signals detected by the two probes do not contain all components corresponding to the original variables, the threshold implementation of the Boolean function is incomplete. This embodiment ensures incompleteness of the Boolean function by properly assigning coordinate combinations of the coordinate function input components in the Boolean function.

[0076] Next, we will take the unprotected vector Boolean function f(a, b, c) = ab + c as an example to describe the method of determining the coordinate combination of the input components. Contains 4 coordinate functions: f(·), g(·), h(·) and k(·).

[0077] like Figure 1 As shown, first determine the three component coordinates of a and the three component coordinates of b according to the nonlinear term ab in the Boolean function. In order to satisfy the second-order incompleteness, let (a i , b j )(i, j∈{0, 1, 2}) are evenly distributed in the 9-component function f i (0≤i≤8), with three component functions as a group, the component coordinate combination of input variables a and b (a i , b j )(i, j∈{0, 1, 2}) in fi There are 280 distribution cases in total in (0≤i≤8), and (1) in Equation (5) only gives one distribution case. Then, based on the nonlinear component coordinate combination of (1) in Equation (5), the three components of the linear term c are distributed, and the coordinate combination corresponding to the 9 components (a i , b j , c k ) There are 1680 cases, i, j, k∈{0, 1, 2}, and (2), (3), (4) and (5) in formula (5) list four different component coordinate combinations, and then the component coordinate combinations of all component functions are obtained, as shown in formula (5).

[0078]

[0079] Based on the number of nonlinear terms contained in the Boolean function, two features related to coordinate assignment are proposed. Based on these two features, the coordinate combination of the input components is determined and the second-order threshold expression is searched. This reduces the search space and rapidly improves the search efficiency.

[0080] Feature 1. The coordinate combinations of the input components of a Boolean function containing only one nonlinear term are determined as follows: For a quadratic Boolean function f(·) containing only one nonlinear term, arbitrarily select one variable from the nonlinear term and denote it as a, and assume that the remaining input variables are denoted by b. In the nine-component functions f0(·)-f8(·), the three components a0, a1, and a2 of variable a are assigned in the order {a0, a0, a0, a1, a1, a1, a2, a2, a2}, and the three components b are assigned in the order {b0, b1, b2, b0, b1, b2, b0, b1, b2}.

[0081] For quadratic Boolean functions containing only one nonlinear term, the component coordinate allocation method constructed based on Feature 1 shows that all tested Boolean functions can find a second-order secure threshold implementation solution. Therefore, the Feature 1 coordinate allocation scheme is a preferred basic solution for Boolean functions containing only one nonlinear term. Case (1) in Equation (5) is a case where the component coordinate combination is given based on this feature.

[0082] Feature 2. The coordinate combinations of the input components of a Boolean function containing n (n ≥ 2) nonlinear terms are determined as follows: For a Boolean function f(·) containing n nonlinear terms, the variable that appears most frequently among the n nonlinear terms is selected as a, and the remaining input variables are assumed to be b. In the nine-component functions f0(·)-f8(·), the three components of variable a are assigned in the order {a0, a0, a0, a1, a1, a1, a2, a2, a2}, and the three components of variable b are assigned in the order {b0, b1, b2, b0, b1, b2, b0, b1, b2}.

[0083] According to the correctness of the second-order safety threshold and the combination of the coordinates of each component, the process of determining the function expression of each component is as follows:

[0084] Quadratic Boolean functions contain three types of terms: quadratic nonlinear terms, linear linear terms, and a constant term of 1. When constructing a three-component second-order threshold implementation for quadratic Boolean functions, according to the threshold implementation correctness definition given in Definition 4, there are nine three-component expressions corresponding to the quadratic nonlinear terms, three component terms corresponding to the linear linear terms, and the constant term can be used directly. Property 3 provides the correctness characteristics of the three-component second-order safety threshold implementation for quadratic Boolean functions containing all types of terms (quadratic terms + linear terms + constant terms). Other Boolean functions containing some types of terms can be derived based on some aspects of Property 3.

[0085] Feature 3. Correctness of the three-component second-order threshold implementation for quadratic Boolean functions containing three types of terms. For quadratic Boolean functions containing three types of terms, the expression for their three-component second-order threshold implementation contains a total of nine component functions. The component expressions for the nine nonlinear terms, f0(·), f1(·), …f8(·), appear simultaneously and are evenly distributed among the component functions f0(·), f1(·), …f8(·), ensuring that each component function contains a component expression for one nonlinear term. The component expressions for the three linear terms appear simultaneously, and three component functions are selected from the nine component functions based on the coordinate combinations of their input components to place the three components of the linear terms. For the constant term 1, any one of the nine component functions is randomly selected and XORed with the constant term at the end of the component function to obtain the expressions for each component function.

[0086] Taking the Boolean function f = ab + c + 1 as an example, the component coordinate combination of (1) in equation (5) and characteristic 3 are used to construct the expressions of the component functions of the second-order threshold implementation as follows:

[0087]

[0088] In formula (6), the component expressions of the nine quadratic terms of the nonlinear term ab are:

[0089] a0b0, a0b1, a0b2, a1b0, a1b1, a1b2, a2b0.

[0090] a2b1, a2b2 are distributed in the 9 component functions f i In (·)(0≤i≤8), each component function contains a quadratic component expression; the three components c0, c1, and c2 of the linear term c are distributed in the component functions f0(·), f4(·), and f8(·) respectively; the constant term 1 is distributed in the component function f3(·).

[0091] The threshold implementation expression (6) constructed based on Property 3 can meet the correctness requirement, but cannot simultaneously guarantee the safety requirement. The safety requirement refers to the combination of identically distributed probabilities, balance, uniformity, and correctness. In order to ensure that the component function expressions meet the safety requirement, it is necessary to add some component terms to the component function expressions constructed based on Property 3.

[0092] According to the identical distribution and uniformity of the combined probability achieved by the second-order safety threshold and the expressions of each component function and the combination of each coordinate, the process of determining the candidate linear addition items of each component function and storing the candidate linear addition items in the table is as follows:

[0093] Considering three component functions as a group, removing or repositioning a linear component term within a group does not affect the combined probability identity and uniformity of the entire threshold implementation. Properties 4 and 5 define the conditions under which changing a linear component term does not alter the joint identity and uniformity properties. These properties are used to determine candidate linear addition terms for each component function.

[0094] Property 4. Removing linear components does not affect the identical distribution and uniformity of the combined probabilities. If two component functions in a group contain the same linear components, removing these two linear components does not affect the identical distribution and uniformity of the combined probabilities.

[0095] To better understand characteristic 4, equations (7) and (8) are used as examples for further explanation.

[0096]

[0097] Among them, this group (tuple) contains three component functions f0(·), f1(·) and f2(·). The output of the compression layer is expressed as: f1(·) and f2(·) contain the same linear component term d0. Assume If the combination of the outputs of the other compression layers satisfies uniformity, and the component functions in this group and the combinations of the detections of other probes (f0(·), f1(·), f2(·), ..., ...) satisfy the same distribution of the combined probabilities, then removing the term d0 from f1 and f2 yields Equation (8). For the overall threshold implementation, the uniformity and the same distribution of the combined probabilities will be maintained.

[0098]

[0099] In the above example, both equations (7) and (8) satisfy the identical distribution and uniformity properties of the combined probabilities. In this embodiment, equation (8) is selected as the basis for searching for candidate linear additions to reduce the search space and obtain an implementation with a lower hardware area.

[0100] Property 5. Changing the position of a linear component term does not affect the identical distribution and uniformity of the combined probability. In a set of three-component functions, if the component coordinate combination contains an identical component, and this component appears only once as a linear term in the set of component functions, then moving this linear component term to another component function in the set does not change the identical distribution and uniformity of the combined probability.

[0101] The following further illustrates characteristic 5 using equations (9) and (10), which are as follows:

[0102]

[0103] Here, d0 is the common component in the component functions f0(·), f1(·), and f2(·). It appears as a linear component term in f0(·). For a threshold implementation scheme that includes this set of component functions, moving d0 from f0(·) to f2(·) yields Equation (10). The entire threshold implementation scheme still maintains the properties of identically distributed and uniform combined probabilities.

[0104]

[0105] In the above example, both equations (9) and (10) satisfy the characteristics of identical distribution and uniformity of combined probabilities. In the search method of this embodiment, only one of equations (9) and (10) is selected as the search criterion, which can reduce the search space.

[0106] The fast search method for the three-component second-order threshold implementation scheme disclosed in this embodiment can quickly search for the three-component second-order threshold implementation scheme for the quadratic vector Boolean function. The input of the algorithm is the vector Boolean function f without adding protection. i (·)(i∈{0,...,n-1}), the output of the algorithm is a Boolean function f i(·)(i∈{0, ..., n-1}) with protection function threshold implementation scheme.

[0107] As shown in Table 1, this method mainly includes the following three stages:

[0108] (1) Preprocessing in lines 1-3. In the preprocessing stage, the coordinate combinations of the input components are determined, the expressions of the component functions that meet the correctness requirements are constructed, and a table containing candidate linear additions is created.

[0109] The component coordinate allocation type, i.e., the component coordinate combination, is listed using the characteristics 1 and 2 proposed in this embodiment; based on the component coordinate allocation type and characteristic 3, each coordinate function f is derived. i Nine component function expressions satisfying correctness for (·)(i∈{0,...,n-1}) can be constructed. Based on the component coordinate assignment type, a table containing candidate linear term additions can be created. Furthermore, to improve search speed and take correctness into account, several features, such as Features 3 and 4, are used to reduce the number of table traversals.

[0110] (2) Search operation for each coordinate function in lines 4-15. The 3-component second-order threshold implementation scheme for each coordinate function contains 9 component functions. The component function expression constructed in line 2 of Table 1 can only meet the correctness, and other security features (such as: combination probability identical distribution or uniformity) cannot be guaranteed. Therefore, at this stage, for each coordinate function, its security implementation scheme that meets all features is searched. First, in lines 5-7, the table is traversed to determine the candidate linear addition items for the nine component functions corresponding to each coordinate function. Then, based on the determined linear items, in lines 8-14, the 9 component functions are checked to see whether they meet the combination probability identical distribution, uniformity and correctness. Finally, in line 15, the security scheme that meets the combination probability identical distribution, uniformity and correctness is searched for each coordinate function and stored in the memory unit space.

[0111] (3) Lines 16-29 perform a search operation for the entire vector Boolean function. The security of each coordinate function cannot guarantee the security of the vector Boolean function as a whole. The nonlinear component S-box of a cryptographic algorithm usually contains multiple coordinate functions. In order to construct an S-box security threshold implementation scheme, a security implementation scheme should be searched from a holistic perspective. Lines 16-28 provide the operational flow of how to search for a security implementation scheme from a holistic perspective. At this stage, the security implementation scheme corresponding to each coordinate function is read directly from the memory cell space, so the reading speed is very fast and the time consumption is short. If a threshold solution corresponding to the vector Boolean function is found, these solutions will be printed out to the file 'TIScheme.txt' in line 29. The solutions stored in the file all meet the requirements of incompleteness, identical distribution of combination probability, uniformity, and correctness.

[0112] Compared with the work of Shahmirzadi et al. in 2021, the algorithm proposed in this embodiment searches for valid solutions dozens to thousands of times faster. The reasons for the improved search speed are as follows:

[0113] (1) Establishing a candidate table containing only linear additions greatly reduces the search space while ensuring that an implementation solution can be found.

[0114] (2) By utilizing correctness, properties 3 and 4, we can reduce the number of times we traverse the linear items in the table, thereby reducing the search space.

[0115] (3) The algorithm's search implementation is based on memory reading and writing, so fast reading and writing operations improve the algorithm's search speed.

[0116] In order to verify the effectiveness of the search method of this patent, the search scheme is applied to the search of the three-component second-order threshold implementation scheme of S-box in multiple cryptographic algorithms (namely: Keccak, SKINNY, Midori, PRESENT, and PRINCE). Table 2 shows the time taken to search for effective solutions for the search method disclosed in this embodiment and the search scheme proposed by Shahmirzadi et al. in 2021. The experimental results show that our search method is much faster than the search scheme proposed by Shahmirzadi et al. Taking Midori G as an example, the time taken by Shahmirzadi et al. to search for an effective solution is 2885 seconds, and the time taken by the search method disclosed in this embodiment is 2 seconds. The rate is

[0117] Table 1 Search algorithm

[0118]

[0119]

[0120] Table 2 The time it takes to find a valid solution

[0121]

[0122] Example 2

[0123] In this embodiment, a fast search system for implementing a three-component second-order threshold solution is disclosed, including:

[0124] A component coordinate combination determination module is used to determine the component coordinate combination corresponding to the component function of the vector Boolean function threshold implementation without adding protection based on the incompleteness in the second-order safety threshold implementation characteristics;

[0125] A component function expression determination module is used to determine the component function expressions of the unprotected vector Boolean function threshold implementation based on the correctness of the component coordinate combination and the second-order safety threshold implementation characteristics;

[0126] A candidate linear addition item determination module is used to determine the candidate linear addition items of each component function based on the combination of component coordinates, the expression of each component function and the same distribution and uniformity of the combination probability in the second-order safety threshold realization characteristic;

[0127] A component function determination module is configured to, for each coordinate function, add each candidate linear addition item to the component function, determine whether the coordinate function after adding the candidate linear addition item satisfies the probability identical distribution and uniformity, and place the component function with the candidate linear addition item added corresponding to the coordinate function that satisfies the probability identical distribution and uniformity in the memory unit space of the coordinate function;

[0128] The threshold implementation scheme determination module is used to extract a component function from the memory unit space corresponding to each coordinate function, combine all the extracted component functions into a whole, and judge whether they meet the probability of identical distribution, uniformity and correctness. The whole that meets the probability of identical distribution, uniformity and correctness is the final threshold implementation scheme.

[0129] Example 3

[0130] In this embodiment, an electronic device is disclosed, including a memory and a processor, and computer instructions stored in the memory and running on the processor. When the computer instructions are executed by the processor, the steps described in the fast search method for the three-component second-order threshold implementation solution disclosed in Example 1 are completed.

[0131] Example 4

[0132] In this embodiment, a computer-readable storage medium is disclosed for storing computer instructions. When the computer instructions are executed by a processor, the steps of the fast search method for the three-component second-order threshold implementation solution disclosed in Example 1 are completed.

[0133] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents. Any modification or equivalent replacement that does not depart from the spirit and scope of the present invention should be covered by the scope of protection of the claims of the present invention.

Claims

1. 3 A fast search method for a second-order threshold implementation scheme of a component, characterized in that: include: According to the incompleteness of the second-order security threshold implementation characteristics, the component coordinate combination corresponding to the component function of the vector Boolean function threshold implementation without adding protection is determined; According to the correctness of the component coordinate combination and the second-order safety threshold realization characteristics, the component function expressions of the vector Boolean function threshold realization without adding protection are determined; Determine the candidate linear additions for each component function based on the combination of component coordinates, the expressions of each component function, and the identical distribution and uniformity of the combined probabilities in the second-order safety threshold realization characteristics; For each coordinate function, each candidate linear addition item is added to the component function, and it is determined whether the coordinate function after adding the candidate linear addition item satisfies the probability identical distribution and uniformity. The component function with the candidate linear addition item added corresponding to the coordinate function that satisfies the probability identical distribution and uniformity is placed in the memory unit space of the coordinate function. A component function is extracted from the memory unit space corresponding to each coordinate function, and all the extracted component functions are combined into a whole to determine whether they meet the probability of identical distribution, uniformity and correctness. The whole that meets the probability of identical distribution, uniformity and correctness is the final threshold implementation solution.

2. The fast search method for implementing a three-component second-order threshold as claimed in claim 1, characterized in that: Determine the component coordinates of input variable a and input variable b according to the nonlinear term ab in the Boolean function, and assign the component coordinates of a and b to different component functions based on the incompleteness of the second-order safety threshold implementation characteristics; According to the component coordinates of a and b assigned to each component function, the component coordinates of the linear term c are determined, and then the component coordinate combinations corresponding to all component functions are obtained.

3. The fast search method for implementing a three-component second-order threshold as claimed in claim 2, characterized in that: For a Boolean function containing only one nonlinear term, any input variable selected from the nonlinear term is denoted as a, and the remaining input variables are denoted as b. For a component coordinate combination of a Boolean function containing two or more nonlinear terms, the input variable that appears most frequently in the nonlinear term is denoted as a, and the remaining input variables are denoted as b. According to the allocation order of variable a {a0,a0,a0,a1,a1,a1,a2,a2,a2} and the allocation order of variable b {b0,b1,b2,b0,b1,b2,b0,b1,b2}, the component coordinates of a and the component coordinates of b are allocated to different component functions.

4. The fast search method for implementing a three-component second-order threshold as claimed in claim 1, characterized in that: For a quadratic Boolean function containing three types of terms, the expression of its three-component second-order threshold realization contains a total of nine component functions, each of which contains a component expression of a nonlinear term; three component functions are selected from the nine component functions to place the three components of the linear term; and one of the component functions is randomly selected from all the component functions, and the constant term is XORed at the end of the component function to obtain the expression of each component function.

5. The fast search method for implementing a three-component second-order threshold as claimed in claim 1, characterized in that: If two component functions in a set of three component functions contain the same linear component terms, then the two same linear components are removed; if in a set of three component functions, if the component coordinate combination contains an identical component, and this component appears only once as a linear term in this set of component functions, then this linear component term is moved to the other component functions in this set to determine the candidate linear additive terms of each component function.

6. The fast search method for implementing a three-component second-order threshold as claimed in claim 1, characterized in that: Add the candidate linear addition items of each component function to the table to obtain the candidate linear addition item table. On the basis of the component function expression that satisfies the correctness, traverse the candidate linear addition item table and add different candidate linear addition items to the component function expression to determine whether the coordinate function after adding the candidate linear addition items satisfies the probability identical distribution and uniformity. If so, store the coordinate function corresponding to the coordinate function with the candidate linear addition items added in the memory unit space corresponding to the coordinate function.

7. The fast search method for implementing a three-component second-order threshold as claimed in claim 1, characterized in that: A component function is extracted from the memory unit space corresponding to each coordinate function, and all the extracted component functions are combined into a whole. For each whole, it is verified in turn whether the whole satisfies the combination probability identical distribution, uniformity and correctness. The whole that satisfies the combination probability identical distribution, uniformity and correctness is used as the final threshold implementation solution. A fast search system for a 3-component second-order threshold implementation scheme, characterized by comprising: A component coordinate combination determination module is used to determine the component coordinate combination corresponding to the component function of the vector Boolean function threshold implementation without adding protection based on the incompleteness in the second-order safety threshold implementation characteristics; A component function expression determination module is used to determine the component function expressions of the unprotected vector Boolean function threshold implementation based on the correctness of the component coordinate combination and the second-order safety threshold implementation characteristics; A candidate linear addition item determination module is used to determine the candidate linear addition items of each component function based on the combination of component coordinates, the expression of each component function and the same distribution and uniformity of the combination probability in the second-order safety threshold realization characteristic; A component function determination module is configured to, for each coordinate function, add each candidate linear addition item to the component function, determine whether the coordinate function after adding the candidate linear addition item satisfies the probability identical distribution and uniformity, and place the component function with the candidate linear addition item added corresponding to the coordinate function that satisfies the probability identical distribution and uniformity in the memory unit space of the coordinate function; The threshold implementation scheme determination module is used to extract a component function from the memory unit space corresponding to each coordinate function, combine all the extracted component functions into a whole, and judge whether they meet the probability of identical distribution, uniformity and correctness. The whole that meets the probability of identical distribution, uniformity and correctness is the final threshold implementation scheme.

9. An electronic device, characterized in that: The invention comprises a memory and a processor and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the steps of the fast search method of the three-component second-order threshold implementation scheme according to any one of claims 1 to 7 are completed.

10. A computer-readable storage medium, characterized in that Used to store computer instructions, which, when executed by a processor, complete the steps of the fast search method for the three-component second-order threshold implementation solution according to any one of claims 1 to 7.

Images