Data operation implementation method, system on chip and computing equipment

Abstract

The invention relates to the technical field of information security, and discloses a data operation implementation method, a system on chip and computing device.At least two different elliptic curve point operations are combined to obtain a combined operation instruction; secondly, considering the power consumption difference between the first-class modular operation step and the second-class modular operation step, reversely deducing a private key in order to prevent the situation that the power consumption of the first-class modular operation step and the power consumption of the second-class modular operation step are analyzed, and designing the junction of the current operation operation and the next operation operation in the combined operation instruction as an operation junction; and finally, the calculation unit executes the first type of modular operation step in the current operation and the second type of modular operation step in the next operation in parallel at the operation connection position, so that the power consumption characteristics of the first type of modular operation step and the second type of modular operation step are prevented from being leaked on the premise of not losing the data operation performance, and the effect of protecting SPA attacks is achieved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to a method for implementing data operations, a system on a chip, and a computing device. Background Art

[0002] The SM2 algorithm is an elliptic curve public key cryptography algorithm. In the point multiplication operation of the SM2 algorithm, protecting against SPA (Simple Power Analysis) attacks is an important aspect of improving the algorithm's ability to resist side channel attacks.

[0003] In the related art, by adding pseudo modular multiplication operations in the point addition and point doubling calculation process, the number of modular multiplications for each point addition or point doubling is made the same, thereby confusing the power consumption characteristics of the two and achieving the purpose of protecting against SPA attacks.

[0004] However, the method of adding pseudo modular multiplication operations to protect against SPA attacks requires additional time overhead, resulting in performance loss of point multiplication operations. Therefore, it is urgent to propose a new data operation implementation method. Summary of the invention

[0005] The present application provides a data computing implementation method, a system on chip, and a computing device, which achieve the technical effect of protecting against SPA attacks without losing data computing performance.

[0006] In order to achieve the above objectives, the main technical solutions adopted in this application include:

[0007] In a first aspect, an embodiment of the present application provides a method for implementing data operation, which is applied to a cryptographic engine, wherein the cryptographic engine includes a control unit, a computing unit, and a storage unit; the method includes:

[0008] The control unit reads a combination operation instruction from the storage unit, and sends the combination operation instruction to the computing unit; wherein the combination operation instruction is obtained by combining at least two different elliptic curve point operations, and the combination operation instruction includes a current operation and a next operation, and there is an operation connection between the current operation and the next operation, and the operation connection is a junction where the current operation transitions to the next operation;

[0009] The computing unit executes, at the operation connection, a first type of modular operation step in the current operation and a second type of modular operation step in the next operation in parallel; wherein the power consumption of the first type of modular operation step is less than the power consumption of the second type of modular operation step.

[0010] In the implementation method of data operation proposed in the embodiment of the present application, first, at least two different elliptic curve point operations are combined to obtain a combined operation instruction; secondly, considering the power consumption difference between the first type of modular operation step and the second type of modular operation step, in order to prevent the private key from being deduced by analyzing the power consumption of the first type of modular operation step and the second type of modular operation step, the junction of the current operation operation and the next operation operation in the combined operation instruction is designed as an operation connection; finally, the computing unit executes the first type of modular operation step in the current operation operation and the second type of modular operation step in the next operation operation in parallel at the operation connection, so that there is a second type of modular operation step with high power consumption in each operation step of the computing unit. It can be seen that the first type of modular operation step and the second type of modular operation step are executed in the data operation process by pipeline and combined operation instructions, so as to avoid leaking the power consumption characteristics of the first type of modular operation step and the second type of modular operation step without losing the data operation performance, and achieve the effect of protecting against SPA attacks.

[0011] Optionally, the current operation is a point addition operation or a point doubling operation, and the next operation is a point addition operation or a point doubling operation; the parallel execution of the first type of modular operation steps in the current operation and the second type of modular operation steps in the next operation includes: the parallel execution of the modular addition and subtraction operation steps in the current operation and the specified modular multiplication operation steps in the next operation.

[0012] In an embodiment of the present application, on the premise that point addition operation and point doubling operation are combined to obtain a combined operation instruction, taking into account the power consumption difference between the modular addition and subtraction operation steps and the modular multiplication operation steps, in order to prevent power consumption analysis through modular addition and subtraction operation steps and modular multiplication operation steps, it is set at the operation connection of the combined operation instruction that the computing unit executes the modular addition and subtraction operation steps in the current operation operation and the modular multiplication operation steps in the next operation operation in parallel, so that there is a modular multiplication operation step in each operation step of the computing unit, and the modular multiplication operation step will be continuously executed from the beginning to the end without any pause in between, thereby avoiding the leakage of the point doubling power consumption characteristics.

[0013] Optionally, the operation connection point is the end of the current operation; the parallel execution of the first type of modular operation step in the current operation and the second type of modular operation step in the next operation includes: the computing unit executes the first type of modular operation step at the end of the current operation and the second type of modular operation step in the next operation in parallel.

[0014] In an embodiment of the present application, the first type of modular operation step in the current operation and the second type of modular operation step in the next operation are executed in parallel at the end of the current operation, and the power consumption of the first type of modular operation step in the current operation is confused by the power consumption of the second type of modular operation step, so as to avoid leaking the power consumption characteristics of the first type of modular operation step and the second type of modular operation step.

[0015] Optionally, the combined operation instruction adopts a combination of doubling operations and doubling operations, the current operation is the current doubling operation, and the next operation is the next doubling operation; the computing unit executes in parallel the first type of modular operation step at the end of the current operation and the second type of modular operation step in the next operation, including: the computing unit executes in parallel the modular addition and subtraction operation step at the end of the current doubling operation and the specified modular multiplication operation step in the next doubling operation.

[0016] In an embodiment of the present application, a computing unit executes in parallel the modular addition and subtraction operation step at the end of the current doubling operation and the specified modular multiplication operation step in the next doubling operation, thereby connecting the specified modular multiplication operation step in the next doubling operation in parallel to the modular addition and subtraction operation step at the end of the current doubling operation. In this way, during the dot multiplication operation, the modular multiplication operation is continuously executed from the beginning to the end, thereby avoiding leakage of the power consumption characteristics of the current doubling operation and the next doubling operation.

[0017] Optionally, the combined operation instruction adopts a combination of dot doubling operation and dot addition operation, the current operation is the current dot doubling operation, and the next operation is the next dot addition operation; the computing unit executes the first type of modular operation step at the end of the current operation and the second type of modular operation step in the next operation in parallel, including: the computing unit executes the modular addition and subtraction operation step at the end of the current dot doubling operation and the specified modular multiplication operation step of the next dot addition operation in parallel.

[0018] In an embodiment of the present application, a computing unit executes in parallel the modular addition and subtraction operation step at the end of the current doubling operation and the specified modular multiplication operation step in the next dot addition operation, thereby connecting the specified modular multiplication operation step in the next dot addition operation in parallel to the modular addition and subtraction operation step at the end of the current doubling operation. In this way, during the dot multiplication operation, the modular multiplication operation is continuously executed from the beginning to the end, thereby avoiding leakage of the power consumption characteristics of the current doubling operation and the next dot addition operation.

[0019] Optionally, the combined operation instruction adopts a combination of point addition operation and point doubling operation, the current operation is the current point addition operation, and the next operation is the next point doubling operation; the computing unit executes in parallel the first type of modular operation step at the end of the current operation and the second type of modular operation step in the next operation, including: the computing unit executes in parallel the modular addition and subtraction operation step at the end of the current point addition operation and the specified modular multiplication operation step of the next point doubling operation.

[0020] In an embodiment of the present application, a computing unit executes in parallel the modular addition and subtraction operation step at the end of the current point addition operation and the specified modular multiplication operation step in the next point doubling operation, thereby connecting the specified modular multiplication operation step in the next point doubling operation in parallel to the modular addition and subtraction operation step at the end of the current point addition operation. In this way, during the point multiplication operation, the modular multiplication operation is continuously executed from the beginning to the end, thereby avoiding leakage of the power consumption characteristics of the current point addition operation and the next point doubling operation.

[0021] Optionally, the parallel execution of the modular addition and subtraction operation steps in the current operation and the specified modular multiplication operation steps in the next operation includes: parallel execution of the modular addition and subtraction operation steps in the current operation and a pseudo modular multiplication operation step added to the next operation.

[0022] In an embodiment of the present application, at the operation connection, the computing unit executes the modular addition and subtraction operation steps in the current operation and the pseudo-modular multiplication operation steps added to the next operation in parallel. It can be seen that the added pseudo-modular multiplication operation is executed in parallel with other operations, thereby introducing no additional time overhead.

[0023] Optionally, the storage unit stores a binary representation of a scalar k; the control unit reads a combination operation instruction from the storage unit, including: the control unit reads the values ​​of the binary representation at adjacent bits from the storage unit, and determines the combination operation instruction according to the values ​​at the adjacent bits.

[0024] In the embodiment of the present application, by reading the values ​​of the binary representation at adjacent bits, it is possible to determine in advance the value of the next bit of the current bit, so that the next operation after the current operation can be predetermined in advance, so that the separate dot dot operation or dot addition operation in the related technology is transformed into a combined operation instruction in a combined form in this embodiment.

[0025] Optionally, the at least two different elliptic curve point operations include point addition operation and point doubling operation; the adjacent bits include a current bit and a next bit; if the value of the current bit is a first value, a point doubling operation is performed; if the value of the current bit is a second value, a point doubling operation and a point addition operation are performed; if the value of the next bit is the first value, a point doubling operation is performed; if the value of the next bit is the second value, a point doubling operation and a point addition operation are performed.

[0026] In the embodiment of the present application, according to the values ​​of the current bit and the next bit, the doubling operation is combined with the doubling operation and the dot addition operation to obtain three combinations of doubling point and doubling point, dot addition and doubling point, and doubling point and dot addition.

[0027] In a second aspect, an embodiment of the present application provides a system on chip, including a processor and a cryptographic engine, wherein the processor is connected to the cryptographic engine, and the cryptographic engine is used to receive a call instruction from the processor to execute the method described in the first aspect.

[0028] In a third aspect, an embodiment of the present application provides a computing device, comprising the system on chip as described in the second aspect.

[0029] According to a fourth aspect, a computer program product is provided, the computer program product comprising: a computer program code, when the computer program code is run on a computer, the computer executes the method in the first aspect.

[0030] In a fifth aspect, a computer-readable medium is provided, wherein the computer-readable medium stores a program code, and when the computer program code is executed on a computer, the computer executes the method in the first aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the specific implementation methods of the present application or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0032] Figure 1 A schematic diagram of the architecture of a cryptographic engine provided in an embodiment of the present application;

[0033] Figure 2 A flowchart of a method for implementing data calculation provided in an embodiment of the present application;

[0034] Figure 3 A schematic diagram of the hardware architecture of a system on a chip provided in an embodiment of the present application;

[0035] Figure 4 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0037] Ellipse Curve Ctyptography (ECC) is a public key encryption technology based on elliptic curve theory to achieve information encryption and decryption and digital signature and signature verification. SM2 elliptic curve public key cryptography algorithm is a type of ECC algorithm. The SM2 series of algorithms are not only an important part of the national secret algorithm, but also one of the core technologies of my country's cyberspace security.

[0038] First, let’s briefly introduce the elliptic curve encryption algorithm. The elliptic curve encryption algorithm is an asymmetric encryption algorithm based on the mathematical theory of elliptic curves. 2 =x 2 +ax+b, where a and b are the parameters of the elliptic curve. Point multiplication is the core operation of the elliptic curve encryption algorithm and is widely used in protocols such as public key generation, key exchange, and digital signatures. Point multiplication is also vulnerable to SPA side channel attacks.

[0039] The following is an introduction to the point multiplication operation on the elliptic curve. Point multiplication operation refers to multiplying a point P on the elliptic curve by an integer k to obtain another point Q on the elliptic curve. Mathematically expressed as: Q = k*P. It can be understood that the multiplication here is not the multiplication of scalars (numbers) in the usual sense, but refers to the result of k addition operations on the points on the elliptic curve. Specifically, the point multiplication operation can be decomposed into the following steps:

[0040] 1) Initialize and set A to the point at infinity (a special point on the elliptic curve)

[0041] 2) Binary decomposition: perform binary conversion on the integer k to obtain the binary representation of the integer k

[0042] 3) Point addition and dot multiplication operations, starting from the lowest bit of the binary representation of the integer k, perform corresponding operations according to the value of the current bit. For example, if the current bit is 0, perform dot multiplication operation; if the current bit is 1, perform point addition operation.

[0043] 4) Repeat step 3) and continue processing the next bit until all the binary bits of the above binary representation are processed.

[0044] It can be understood that the above process uses two elliptic curve point operations, point addition and point doubling, and reads the value of one bit in the binary representation each time. The point addition operation on the elliptic curve can represent the point addition of point A and point B on the elliptic curve, represented by the operation A+B; the point doubling operation on the elliptic curve can represent the point addition of point A and point A on the elliptic curve, represented by the operation A+A. These operations are all performed on specific finite fields.

[0045] Generally speaking, when calculating points on an elliptic curve, the number of modular multiplications performed by point addition and point doubling operations is different. For attackers, the power consumption curve of modular multiplication can be used to find the characteristic curves of point addition and point doubling operations to infer the integer k. When the SM2 algorithm is decrypted, the integer k corresponds to the private key. Therefore, attackers can analyze the power consumption characteristic curves of point addition and point doubling operations during decryption. It can be seen that this will cause a huge security threat, so it is necessary to protect against SPA attacks in the point multiplication operation of the SM2 algorithm.

[0046] In the related art, pseudo modular multiplication operations are added to the point addition and point doubling calculation process, so that the number of modular multiplications for each point addition or point doubling is the same, thereby confusing the power consumption characteristics of the two. Therefore, during the SPA attack, it is difficult to distinguish the power consumption characteristic curves of the point addition operation and the point doubling operation, thereby achieving the purpose of protecting against SPA attacks. However, adding pseudo modular multiplication will lead to additional time overhead, which will reduce the speed of the SM2 point multiplication operation and cause a loss in computing performance.

[0047] In order to protect against SPA attacks without losing the performance of point multiplication operations and to improve the speed at which the cryptographic engine performs point multiplication operations, the embodiments of the present application provide a method for implementing data operations, a system on a chip, and a computing device, which will be introduced below in conjunction with specific embodiments.

[0048] Figure 1 Shown is a schematic diagram of the architecture of a cryptographic engine provided in an embodiment of the present application. Figure 1The cryptographic engine 100 shown can be arranged in a system on chip. The cryptographic engine 100 includes a control unit 110, a computing unit 120 and a storage unit 130. The control unit 110 is connected to the computing unit 120 and the storage unit 130 respectively. Among them, the control unit 110 is responsible for managing the scheduling of operation instructions and the control of instruction flow, and can be used to send instructions to the computing unit 120. The computing unit 120 can be used to perform the operation tasks specified by the instructions, including elliptic curve point operations, etc., to execute the calculation process of the SM2 algorithm. The storage unit 130 can be used to store the binary representation of the integer k, and can also store the operation instructions and the intermediate results generated during the operation.

[0049] Different from the single point addition operation or single point doubling operation mentioned above, the embodiment of the present application proposes a variety of combinations of point addition operation and point doubling operation, so as to be able to execute point addition operation and point doubling operation in a pipeline, confuse the boundary between point addition operation and point doubling operation, and avoid leakage of point addition power consumption characteristics and point doubling power consumption characteristics. Specifically, the control unit 110 reads the combination operation instruction from the storage unit 130, and sends the combination operation instruction to the computing unit 120. The combination operation instruction is obtained by combining the point doubling operation and the point addition operation. The combination operation instruction includes the current operation operation and the next operation operation. The operation connection is the junction where the current operation operation transitions to the next operation operation. At the operation connection, the computing unit 120 executes the modular addition and subtraction operation steps in the current operation operation and the specified modular multiplication operation steps in the next operation operation in parallel.

[0050] In the embodiment of the present application, under the premise of proposing a combined operation instruction, considering the power consumption difference between the modular addition and subtraction operation step and the modular multiplication operation step, in order to prevent the integer k from being inferred by analyzing the power consumption of the modular addition and subtraction operation step and the modular multiplication operation step, the operation connection of the combined operation instruction is set, that is, the junction of the current operation operation and the next operation operation in the combined operation instruction. At the operation connection, the computing unit executes the modular addition and subtraction operation step in the current operation operation and the modular multiplication operation step in the next operation operation in parallel, so that there is a modular multiplication operation step in each operation step of the computing unit, and the modular multiplication operation step will be executed continuously from the beginning to the end without a pause in between, thereby avoiding the leakage of the point doubling power consumption feature.

[0051] See also Figure 2 , Figure 2 A flowchart of a method for implementing data computing provided in an embodiment of the present application is provided. Figure 2 The implementation process of the data operation shown can be executed by the cryptographic engine 100. The implementation method of the data operation includes:

[0052] S210. The control unit reads a combination operation instruction from the storage unit, and sends the combination operation instruction to the computing unit.

[0053] The combined operation instruction is obtained by combining at least two different elliptic curve point operations. The combined operation instruction includes a current operation and a next operation. There is an operation connection between the current operation and the next operation, and the operation connection is the junction where the current operation transitions to the next operation.

[0054] In this embodiment, the combined operation instruction may be an instruction that can simultaneously perform multiple operations or calculations in a system on chip or a computing device. Different from a single point addition operation or a single point multiplication operation in the related art, the combined operation instruction is obtained by combining multiple elliptic curve point operations. Elliptic curve point operations may refer to the process of performing mathematical operations on points on an elliptic curve in elliptic curve cryptography, such as point addition operations, point multiplication operations, scalar multiplication, etc.

[0055] In this embodiment, the operation connection point can be understood as the switching point between the current operation and the next operation, realizing the transition from the current operation to the next operation. The current operation and the next operation are connected through the transition, so that in the process of switching the current operation to the next operation, the power consumption characteristic change between the current operation and the next operation is eliminated, and the characteristic curves of different elliptic curve point operations cannot be analyzed through the power consumption characteristics, thereby effectively resisting SPA attacks.

[0056] Specifically, the control unit 110 reads a combined operation instruction from the storage unit 130, and the combined operation instruction includes a current operation and a next operation. The current operation of the combined operation instruction may be a specific operation task completed by the computing unit 120 at the current moment or the current stage during the execution of the combined operation instruction. The next operation of the combined operation instruction may be a specific operation task to be completed by the computing unit 120 next after the current operation is completed. Some operation steps in the next operation may depend on the operation result of the current operation, or the next operation may also be an independent operation task. Therefore, the control unit 110 sends the combined operation instruction to the computing unit 120.

[0057] In some embodiments, the storage unit may store a binary representation of the scalar k. Accordingly, the control unit reads the combination operation instruction from the storage unit, including: the control unit reads the values ​​of the binary representation on adjacent bits from the storage unit, and determines the combination operation instruction according to the values ​​on the adjacent bits.

[0058] Among them, the scalar k can be understood as the integer k mentioned above. Specifically, since the binary representation of the scalar k is stored in the storage unit, the value of each bit in the binary representation is used to determine the operation in the combined operation instruction. Different from the related art in which the value of one bit of the binary representation is read each time, the control unit in this embodiment reads the value of the binary representation on the adjacent bit from the storage unit. The combined operation instruction is determined according to the value on the adjacent bit. It can be seen that by reading the value of the binary representation on the adjacent bit, the value of the next bit of the current bit can be determined in advance, so that the next operation after the current operation can be predetermined in advance, which lays the foundation for converting the separate dot dot operation or dot addition operation in the related art into the combined operation instruction in the form of a combination in this embodiment.

[0059] In one example, at least two different elliptic curve point operations may include point addition and point doubling operations. Adjacent bits may include a current bit and a next bit. If the value of the current bit is a first value, a point doubling operation is performed; if the value of the current bit is a second value, a point doubling operation and a point addition operation are performed. If the value of the next bit is a first value, a point doubling operation is performed; if the value of the next bit is a second value, a point doubling operation and a point addition operation are performed.

[0060] In this example, the first value and the second value may be different. Specifically, the first value may be equal to 0, and the second value may be equal to 1. If the value of the current bit is equal to 0, a dot-double operation is performed; if the value of the current bit is equal to 1, a dot-double operation and a dot-add operation are performed. If the value of the next bit is equal to 0, a dot-double operation is performed; if the value of the next bit is equal to 1, a dot-double operation and a dot-add operation are performed. For example, if the control unit reads a binary value of 00 on adjacent bits in the storage unit, the combined operation instruction adopts a combination of dot-double operation and dot-double operation. In this example, according to the values ​​of the current bit and the next bit, the dot-double operation is combined with the dot-double operation and the dot-add operation respectively, and three combinations of dot-double and dot-double, dot-add and dot-double, and dot-double and dot-add can be obtained.

[0061] S220. The computing unit executes, at the computing connection, the first type of modular computing steps in the current computing operation and the second type of modular computing steps in the next computing operation in parallel.

[0062] Among them, the power consumption of the first type of modular operation step is less than the power consumption of the second type of modular operation step. Both the current operation operation and the next operation operation can be gradually disassembled into specific operation steps. For example, the current operation operation is gradually decomposed to generate multiple modular operation operations (such as modular addition and subtraction, modular multiplication, etc.), and the multiple modular operation operations may include the first type of modular operation steps and multiple second type modular operation steps. In the data operation process, the power consumption of the first type of modular operation steps and the second type of modular operation steps is different. For another example, the next operation operation is gradually decomposed to generate multiple modular operation operations (such as modular addition and subtraction, modular multiplication, etc.), and the multiple modular operation operations may also include the first type of modular operation steps and multiple second type of modular operation steps with different power consumption.

[0063] In some cases, as mentioned above, the current operation can be decomposed into a first type of modular operation step and multiple second type of modular operation steps with different power consumption, and the next operation can also be decomposed into a first type of modular operation step and multiple second type of modular operation steps with different power consumption. Then, through power consumption analysis, it is easy to identify the dividing line between the current operation and the next operation. Therefore, an operation connection is proposed in this embodiment, and the computing unit executes the first type of modular operation step in the current operation and the second type of modular operation step in the next operation in parallel at the operation connection.

[0064] Specifically, since the combined operation instruction includes the current operation and the next operation, the next operation is already known during the process of the computing unit executing the current operation. Therefore, the computing unit executes the modular operation step in the current operation, and when executing the first type of modular operation step in the current operation, the computing unit synchronously executes the second type of modular operation step in the next operation. This embodiment realizes connecting the second type of modular operation step with high power consumption in the next operation in parallel to the first type of modular operation step with low power consumption in the current operation. In this way, during the data operation process, the second type of modular operation step with high power consumption is always executed, and is continuously executed from the beginning to the end.

[0065] In some embodiments, the current operation may be a point addition operation or a point doubling operation, and the next operation may be a point addition operation or a point doubling operation. Accordingly, executing the first type of modular operation step in the current operation and the second type of modular operation step in the next operation in parallel includes: executing the modular addition and subtraction operation step in the current operation and the specified modular multiplication operation step in the next operation in parallel.

[0066] In this embodiment, the storage unit 130 stores the combined operation instructions, operation data and intermediate operation results. The storage unit 130 provides the operation instructions and related data to the control unit 110 and the calculation unit 120. The combined operation instruction can be obtained by combining the point addition operation and the point multiplication operation. The calculation process of the point multiplication operation is realized by the cryptographic engine. The control unit 110 reads the combined operation instruction in the storage unit 130, and schedules the calculation unit 120 to perform the modular addition and subtraction operation steps and the modular multiplication operation steps according to the requirements of the combined operation instruction. The calculation unit 120 implements the specific calculation steps in the cryptographic operation, including the point addition operation, the point multiplication operation, etc., and the intermediate calculation results of the calculation unit can be stored in the storage unit 130.

[0067] In this embodiment, the current operation is decomposed step by step to obtain multiple modular operation steps. The next operation is decomposed step by step to obtain multiple modular operation steps. It is understandable that in the process of step-by-step decomposition, the dependency between the current operation and the next operation needs to be considered to ensure that after an intermediate calculation result is obtained, the intermediate calculation result can be used immediately to reduce waiting time. The specified modular multiplication operation step can be an operation step that needs to rely on the calculation results of some modular operation steps in the current operation in the next operation. The specified modular multiplication operation step can also be an operation step that needs to rely on the calculation results of some modular operation steps in the next operation in the next operation.

[0068] In some cases, although point addition and doubling operations have been used to combine to obtain a combined operation instruction, in order to prevent power consumption analysis through modular addition and subtraction operation steps and modular multiplication operation steps, it is necessary to further consider the power consumption difference between the modular addition and subtraction operation steps and the modular multiplication operation steps. Therefore, an operation connection of the combined operation instruction is set, and the computing unit executes the modular addition and subtraction operation steps in the current operation operation and the modular multiplication operation steps in the next operation operation in parallel at the operation connection, so that there is a modular multiplication operation step in each operation step of the computing unit, and the modular multiplication operation step will be continuously executed from the beginning to the end without a pause in between, thereby avoiding the leakage of the point doubling power consumption characteristics.

[0069] Specifically, since the combined operation instruction includes the current operation and the next operation, the next operation is already known during the process of the computing unit executing the current operation. Therefore, the computing unit executes the modular operation step in the current operation, and when executing the modular addition and subtraction operation step in the current operation, the computing unit synchronously executes the specified modular multiplication operation step in the next operation. Although the power consumption of modular multiplication operation is different from that of modular addition and subtraction operation, in this embodiment, the specified modular multiplication operation step in the next operation is connected in parallel to the modular addition and subtraction operation step in the current operation, so that during the dot multiplication operation, the modular multiplication operation is always executed, and is continuously executed from the beginning to the end.

[0070] In the embodiment of the present application, firstly, at least two different elliptic curve point operations are combined to obtain a combined operation instruction; secondly, considering the power consumption difference between the first type of modular operation step and the second type of modular operation step, in order to prevent the private key from being inferred by analyzing the power consumption of the first type of modular operation step and the second type of modular operation step, the junction of the current operation operation and the next operation operation in the combined operation instruction is designed as an operation connection; finally, the computing unit executes the first type of modular operation step in the current operation operation and the second type of modular operation step in the next operation operation in parallel at the operation connection, so that there is a second type of modular operation step with high power consumption in each operation step of the computing unit. It can be seen that the first type of modular operation step and the second type of modular operation step are executed in the data operation process by pipeline and combined operation instructions, so as to avoid leaking the power consumption characteristics of the first type of modular operation step and the second type of modular operation step without losing the data operation performance. Furthermore, executing different operation steps at the operation connection at the same time can improve the computing efficiency without increasing the computing cycle.

[0071] In some embodiments, the operation connection point may be the end of the current operation. Accordingly, executing the first type of modular operation step in the current operation and the second type of modular operation step in the next operation in parallel may include: the computing unit executing the first type of modular operation step at the end of the current operation and the second type of modular operation step in the next operation in parallel.

[0072] Among them, the first type of modular operation step with low power consumption is usually performed at the end of the elliptic curve point operation (such as point addition operation and point doubling operation). Therefore, in order to confuse the dividing line between the current operation and the next operation, the end of the current operation is set as the operation connection corresponding to the combined operation instruction. Specifically, the computing unit executes the modular operation step in the current operation, and when executing the first type of modular operation step at the end of the current operation, the computing unit synchronously executes the second type of modular operation step in the next operation.

[0073] In some examples, the combined operation instruction may adopt a combination of a doubling operation and a doubling operation, the current operation is the current doubling operation, and the next operation is the next doubling operation. Accordingly, the computing unit executes the first type of modular operation step at the end of the current operation and the second type of modular operation step in the next operation in parallel, including: the computing unit executes the modular addition and subtraction operation step at the end of the current doubling operation and the specified modular multiplication operation step in the next doubling operation in parallel.

[0074] Among them, the doubling operation is composed of modular multiplication and modular addition and subtraction, and the power consumption of modular multiplication operation is different from that of modular addition and subtraction operation. Modular addition and subtraction operation is usually performed at the end of the doubling operation. Therefore, in order to confuse the dividing line between the current doubling operation and the next doubling operation, the end of the current doubling operation is set as the operation connection corresponding to the combined operation instruction. Specifically, the calculation unit executes the modular operation step in the current doubling operation, and when executing the modular addition and subtraction operation step at the end of the current doubling operation, the calculation unit synchronously executes the specified modular multiplication operation step in the next doubling operation. It can be seen that the specified modular multiplication operation step in the next doubling operation is connected in parallel to the modular addition and subtraction operation step at the end of the current doubling operation. In this way, during the dot multiplication operation, the modular multiplication operation is always executed, and it is continuously executed from the beginning to the end, avoiding the leakage of the power consumption characteristics of the current doubling operation and the next doubling operation.

[0075] Please refer to Table 1, and the operation connection between the doubling point operations and the doubling point operations is introduced by way of example in combination with Table 1.

[0076]

[0077]

[0078] Please continue to refer to Table 1. The current doubling operation is decomposed into steps FM1 to FM10. The next doubling operation is decomposed into steps SM1 to SM10. The calculation unit sequentially executes steps FM1 to FM9 in the current doubling operation and step SM1 in the next doubling operation; when the calculation unit executes step FM10 in the current doubling operation, the calculation unit synchronously executes step SM2 in the next doubling operation.

[0079] It can be understood that in step FM10, Y3=T1-T2 and Y1=Y3 belong to the modular addition and subtraction operation steps at the end of the current doubling operation. In step SM2, T5=Y1+Y1 and T1=T6 belong to the modular addition and subtraction operation steps in the next doubling operation. In step SM2, T8=X1*X1 belongs to the specified modular multiplication operation step in the next doubling operation. The computing unit executes step FM10 and step SM2 in parallel, and there is a modular multiplication operation T8=X1*X1 in step SM2, so that when the computing unit executes step FM10 in the current doubling operation, the computing unit is also executing the modular multiplication operation, so that the power consumption characteristic curves of the current doubling operation and the next doubling operation are similar, and the dividing line between the current doubling operation and the next doubling operation is confused.

[0080] Further, it can be seen from Table 1 that, except for the clock cycle number of step FM1 in the current dot multiplication operation being 35, the clock cycle numbers of the other steps are 19. In the calculation process of the dot multiplication operation, modular multiplication operations are performed one after another until the dot multiplication operation is completed. Therefore, it is impossible to analyze the power consumption characteristic curve of the current dot multiplication operation or the next dot multiplication operation based on the power consumption.

[0081] It should be noted that Tn (T1, T2, etc.) in Table 1 is an intermediate variable, and the temporary results of the calculation are stored in the static random access memory (SRAM). X1, Y1, Z1, etc. are the Jacobian coordinates of the points on the elliptic curve.

[0082] In some other examples, the combined operation instruction may be in the form of a combination of a dot doubling operation and a dot addition operation, the current operation is the current dot doubling operation, and the next operation is the next dot addition operation. Accordingly, the computing unit executes the first type of modular operation step at the end of the current operation and the second type of modular operation step in the next operation in parallel, including: the computing unit executes the modular addition and subtraction operation step at the end of the current dot doubling operation and the specified modular multiplication operation step of the next dot addition operation in parallel.

[0083] Among them, both the doubling operation and the point addition operation are composed of modular multiplication and modular addition and subtraction, and the power consumption of modular multiplication operation is different from that of modular addition and subtraction operation. Modular addition and subtraction operation is usually performed at the end of the point addition operation or the doubling operation. Therefore, in order to confuse the dividing line between the current doubling operation and the next dot addition operation, the end of the current doubling operation is set as the operation connection corresponding to the combined operation instruction. Specifically, the calculation unit executes the modular operation step in the current doubling operation, and when executing the modular addition and subtraction operation step at the end of the current doubling operation, the calculation unit synchronously executes the specified modular multiplication operation step in the next dot addition operation. It can be seen that the specified modular multiplication operation step in the next dot addition operation is connected in parallel to the modular addition and subtraction operation step at the end of the current doubling operation. In this way, during the dot multiplication operation, the modular multiplication operation is always executed, and it is continuously executed from the beginning to the end, avoiding the leakage of the power consumption characteristics of the current doubling operation and the next dot addition operation.

[0084] Please refer to Table 2, and the operation connection between the doubling operation and the point addition operation is introduced in combination with Table 2 as an example.

[0085]

[0086]

[0087] Please continue to refer to Table 2. The current doubling operation is decomposed into steps GM1 to GM10. The next dot addition operation is decomposed into steps DM1 to DM14. The calculation unit sequentially executes steps GM1 to GM9 in the current doubling operation and step DM1 in the next doubling operation; when the calculation unit executes step GM10 in the current doubling operation, the calculation unit synchronously executes step DM2 in the next dot addition operation.

[0088] It can be understood that T1=T4-T5 and Y3=T1-T2 in step GM10 belong to the modular addition and subtraction operation steps at the end of the current doubling operation. T7=y2*Z1 in step DM2 belongs to the modular multiplication operation step in the next dot addition operation. T7=y2*Z1 in step DM2 belongs to the specified modular multiplication operation step in the next dot addition operation. The computing unit executes step GM10 and step DM2 in parallel, and there is a modular multiplication operation T7=y2*Z1 in step DM2, so that when the computing unit executes step GM10 in the current doubling operation, the computing unit is also executing the modular multiplication operation, so that the power consumption characteristic curves of the current dot addition operation and the next dot addition operation are similar, and the dividing line between the current dot addition operation and the next dot addition operation is confused.

[0089] Further, it can be seen from Table 2 that, except for the clock cycle number of step GM1 in the current dot multiplication operation, which is 35, the clock cycle number of step DM13 in the next dot addition operation, which is 35, and the clock cycle number of step DM18 in the next dot addition operation, which is 8, the clock cycle numbers of the other steps are 19. In the calculation process of the dot multiplication operation, modular multiplication operations are performed one after another until the dot multiplication operation is completed. Therefore, it is impossible to analyze the power consumption characteristic curve of the current dot multiplication operation or the next dot multiplication operation based on the power consumption. For the next dot addition operation step DM18 in Table 2, the modular multiplication operation step in the next operation operation can also be connected in parallel.

[0090] It should be noted that Tn (T1, T2, etc.) in Table 2 is an intermediate variable, and the temporary results of the calculation are stored in the static random access memory (SRAM). X1, Y1, Z1, etc. are the Jacobian coordinates of the points on the elliptic curve.

[0091] In other examples, the combined operation instruction may be in the form of a combination of a point addition operation and a point doubling operation, the current operation is the current point addition operation, and the next operation is the next point doubling operation. Accordingly, the computing unit executes the first type of modular operation step at the end of the current operation and the second type of modular operation step in the next operation in parallel, including: the computing unit executes the modular addition and subtraction operation step at the end of the current point addition operation and the specified modular multiplication operation step of the next point doubling operation in parallel.

[0092] Among them, both the doubling point operation and the dot addition operation are composed of modular multiplication and modular addition and subtraction, and the power consumption of modular multiplication operation is different from that of modular addition and subtraction operation. Modular addition and subtraction operation is usually performed at the end of the dot addition operation or the doubling point operation. Therefore, in order to confuse the dividing line between the current dot addition operation and the next doubling point operation, the end of the current dot addition operation is set as the operation connection corresponding to the combined operation instruction. Specifically, the calculation unit executes the modular operation step in the current dot addition operation, and when executing the modular addition and subtraction operation step at the end of the current dot addition operation, the calculation unit synchronously executes the specified modular multiplication operation step in the next doubling point operation. It can be seen that the specified modular multiplication operation step in the next doubling point operation is connected in parallel to the modular addition and subtraction operation step at the end of the current dot addition operation. In this way, during the dot multiplication operation, the modular multiplication operation is always executed, and it is continuously executed from the beginning to the end, avoiding the leakage of the power consumption characteristics of the current dot addition operation and the next doubling point operation.

[0093] Please refer to Table 3, and the operation connection between the point addition operation and the point doubling operation is introduced by way of example in combination with Table 3.

[0094]

[0095]

[0096] Please continue to refer to Table 3. The current point addition operation is decomposed into steps KM1 to KM14. The next doubling operation is decomposed into steps HM1 to HM10. The calculation unit sequentially executes steps KM1 to KM13 in the current point addition operation and step HM1 in the next doubling operation; when the calculation unit executes step KM14 in the current point addition operation, the calculation unit synchronously executes step HM2 in the next doubling operation.

[0097] It can be understood that in step KM14, Y3=T1-T2, Y1=Y3, T5=Y1+Y1 belong to the modular addition and subtraction operation steps at the end of the current point addition operation. In step HM2, T8=X1*X1 belongs to the specified modular multiplication operation step in the next doubling point operation. The computing unit executes step KM14 and step HM2 in parallel, and there is a modular multiplication operation T8=X1*X1 in step HM2, so that when the computing unit executes step KM14 in the current point addition operation, the computing unit is also executing the modular multiplication operation, so that the power consumption characteristic curves of the current point addition operation and the next doubling point operation are similar, and the dividing line between the current point addition operation and the next doubling point operation is confused.

[0098] Further, it can be seen from Table 3 that, except for the clock cycle number of step KM1 in the current dot multiplication operation, which is 35, the clock cycle numbers of other steps are 19. In the calculation process of the dot multiplication operation, modular multiplication operations are performed one after another until the dot multiplication operation is completed. Therefore, it is impossible to analyze the power consumption characteristic curve of the current dot addition operation or the next dot multiplication operation based on the power consumption.

[0099] It should be noted that Tn (T1, T2, etc.) in Table 3 is an intermediate variable, and the temporary results of the calculation are stored in the static random access memory (SRAM). X1, Y1, Z1, etc. are the Jacobian coordinates of the points on the elliptic curve.

[0100] In an embodiment of the present application, the first type of modular operation step in the current operation and the second type of modular operation step in the next operation are executed in parallel at the end of the current operation, and the power consumption of the first type of modular operation step in the current operation is confused by the power consumption of the second type of modular operation step, so as to avoid leaking the power consumption characteristics of the first type of modular operation step and the second type of modular operation step.

[0101] In some embodiments, the modular addition and subtraction operation steps in the current operation and the specified modular multiplication operation steps in the next operation are executed in parallel, including: the modular addition and subtraction operation steps in the current operation and the pseudo modular multiplication operation steps added to the next operation are executed in parallel.

[0102] Specifically, if the current operation is the current doubling operation and the next operation is the next doubling operation, the modular addition and subtraction operation steps in the current doubling operation and the pseudo modular multiplication operation step added to the next doubling operation are executed in parallel. For example, please continue to refer to Table 1, T8=X1*X1 in step SM2 is the pseudo modular multiplication operation step added to the next doubling operation. It can be seen from Table 1 that the pseudo modular multiplication operation step is executed in parallel with the modular addition and subtraction operation step in the current doubling operation, which shows that the pseudo modular multiplication operation step does not add additional time overhead.

[0103] If the current operation is a current point addition operation and the next operation is a next point doubling operation, the modular addition and subtraction operation steps in the current point addition operation and the pseudo modular multiplication operation step of adding the next point doubling operation are executed in parallel.

[0104] For example, please continue to refer to Table 3. In step HM2, T8=X1*X1 is a pseudo modular multiplication operation step added to the next doubling operation. As can be seen from Table 3, the pseudo modular multiplication operation step is executed in parallel with the modular addition and subtraction operation step in the current doubling operation, which shows that the pseudo modular multiplication operation step does not add additional time overhead.

[0105] It should be noted that T8=X1*X1 and T3=x2*T1 in step DM4 in Table 2 are pseudo modular multiplication operation steps with the addition operation of the next point added, and the pseudo modular multiplication operation steps also do not increase additional time overhead. T8=X1*X1 in step KM4 in Table 3 is a pseudo modular multiplication operation step with the addition operation of the current point added, and the pseudo modular multiplication operation steps also do not increase additional time overhead.

[0106] In an embodiment of the present application, at the operation connection, the computing unit executes the modular addition and subtraction operation steps in the current operation and the pseudo-modular multiplication operation steps added to the next operation in parallel. It can be seen that the added pseudo-modular multiplication operation is executed in parallel with other operations, thereby introducing no additional time overhead.

[0107] Figure 3 A schematic diagram of the hardware architecture of a system on a chip provided in an embodiment of the present application. Figure 3 The system on chip 300 shown includes a processor 310 and a cryptographic engine 320. The processor 310 is connected to the cryptographic engine 320, and the cryptographic engine 320 is used to receive a call instruction from the processor 310 to execute any of the above data operation implementation methods. Among them, the cryptographic engine 320 is equipped with one or more cryptographic operation algorithms.

[0108] Figure 4 A schematic diagram of the structure of a computing device provided in an embodiment of the present application. Figure 4 The computing device 400 shown includes a system on chip 410, which may be the system on chip mentioned above. The computing device 400 may be a computer device, which may be a server for performing cryptographic operations, for example.

[0109] The embodiment of the present application provides a data operation implementation device, which is applied to a cryptographic engine. The cryptographic engine includes a control unit, a computing unit, and a storage unit. The device includes:

[0110] an instruction reading and sending module, configured in the control unit, for reading a combination operation instruction from the storage unit, and sending the combination operation instruction to the computing unit; wherein the combination operation instruction is obtained by combining at least two different elliptic curve point operations, the combination operation instruction includes a current operation and a next operation, and there is an operation connection between the current operation and the next operation, and the operation connection is a junction where the current operation transitions to the next operation;

[0111] A parallel operation execution module is configured in the computing unit and is used to execute in parallel, at the operation connection, a first type of modular operation step in the current operation and a second type of modular operation step in the next operation; wherein the power consumption of the first type of modular operation step is less than the power consumption of the second type of modular operation step.

[0112] In some embodiments, the current operation is a point addition operation or a point doubling operation, and the next operation is a point addition operation or a point doubling operation; the parallel operation execution module is also used to parallelly execute the modular addition and subtraction operation steps in the current operation and the specified modular multiplication operation steps in the next operation.

[0113] In some embodiments, the operation connection is at the end of the current operation; the parallel operation execution module is also used to parallelly execute the first type of modular operation step at the end of the current operation and the second type of modular operation step in the next operation.

[0114] In some embodiments, the combined operation instruction adopts a combination of doubling operations and doubling operations, the current operation is the current doubling operation, and the next operation is the next doubling operation; the parallel operation execution module is also used to parallelly execute the modular addition and subtraction operation steps at the end of the current doubling operation and the specified modular multiplication operation steps in the next doubling operation.

[0115] In some embodiments, the combined operation instruction adopts a combination of dot doubling operation and dot addition operation, the current operation is the current dot doubling operation, and the next operation is the next dot addition operation; the parallel operation execution module is also used to parallelly execute the modular addition and subtraction operation steps at the end of the current dot doubling operation and the specified modular multiplication operation steps of the next dot addition operation.

[0116] In some embodiments, the combined operation instruction adopts a combination of point addition operation and point doubling operation, the current operation is the current point addition operation, and the next operation is the next point doubling operation; the parallel operation execution module is also used to parallelly execute the modular addition and subtraction operation steps at the end of the current point addition operation and the specified modular multiplication operation steps of the next point doubling operation.

[0117] In some embodiments, the parallel operation execution module is further used to execute in parallel the modular addition and subtraction operation steps in the current operation and the pseudo modular multiplication operation steps added to the next operation.

[0118] In some embodiments, the storage unit stores a binary representation of a scalar k; the instruction reading and sending module is further used to read the values ​​of the binary representation at adjacent bits from the storage unit, and determine the combination operation instruction according to the values ​​at the adjacent bits.

[0119] In some embodiments, the at least two different elliptic curve point operations include point addition operation and point doubling operation; the adjacent bits include a current bit and a next bit; if the value of the current bit is a first value, a point doubling operation is performed; if the value of the current bit is a second value, a point doubling operation and a point addition operation are performed; if the value of the next bit is the first value, a point doubling operation is performed; if the value of the next bit is the second value, a point doubling operation and a point addition operation are performed.

[0120] The further functional description of each of the above modules is the same as that of the above corresponding embodiments and will not be repeated here.

[0121] The implementation device of the data calculation method in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0122] The embodiment of the present application also provides a computer-readable storage medium. The above method according to the embodiment of the present application can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0123] The embodiment of the present application provides a computer program product, which includes computer instructions, which are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method of any embodiment of the present application.

[0124] Although the embodiments of the present application are described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present application, and such modifications and variations all fall within the scope defined by the appended claims. The systems, devices or units described in the above embodiments may be implemented by computer chips or entities, or by products having certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0125] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing the present application, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0126] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0127] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems) and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0128] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0129] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0130] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0131] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0132] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

[0133] Although the embodiments of the present application have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present application, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for implementing data computing, characterized in that: Applied to a cryptographic engine, the cryptographic engine includes a control unit, a computing unit and a storage unit; the method includes: The control unit reads a combination operation instruction from the storage unit, and sends the combination operation instruction to the computing unit; wherein the combination operation instruction is obtained by combining at least two different elliptic curve point operations, and the combination operation instruction includes a current operation and a next operation, and there is an operation connection between the current operation and the next operation, and the operation connection is a junction where the current operation transitions to the next operation; The computing unit executes, at the operation connection, a first type of modular operation step in the current operation and a second type of modular operation step in the next operation in parallel; wherein the power consumption of the first type of modular operation step is less than the power consumption of the second type of modular operation step.

2. The method according to claim 1, characterized in that The current operation is a point addition operation or a point doubling operation, and the next operation is a point addition operation or a point doubling operation; The step of executing the first type of modular operation step in the current operation and the second type of modular operation step in the next operation in parallel includes: The modular addition and subtraction operation steps in the current operation and the specified modular multiplication operation steps in the next operation are performed in parallel.

3. The method according to claim 1, characterized in that The operation connection point is the end of the current operation; The step of executing the first type of modular operation step in the current operation and the second type of modular operation step in the next operation in parallel includes: The computing unit executes in parallel a first type of modular operation step at the end of the current operation and a second type of modular operation step in the next operation.

4. The method according to claim 3, characterized in that The combined operation instruction adopts a combination of doubling operation and doubling operation, the current operation is the current doubling operation, and the next operation is the next doubling operation; The computing unit performs in parallel the first type of modular operation step at the end of the current operation and the second type of modular operation step in the next operation, including: The computing unit executes the modular addition and subtraction operation steps at the end of the current doubling operation and the specified modular multiplication operation steps in the next doubling operation in parallel.

5. The method according to claim 3, characterized in that: The combined operation instruction adopts a combination of dot doubling operation and dot addition operation, the current operation is the current dot doubling operation, and the next operation is the next dot addition operation; The computing unit performs in parallel the first type of modular operation step at the end of the current operation and the second type of modular operation step in the next operation, including: The computing unit executes the modular addition and subtraction operation step at the end of the current doubling operation and the specified modular multiplication operation step of the next dot addition operation in parallel.

6. The method according to claim 3, characterized in that The combined operation instruction adopts a combination of point addition operation and point doubling operation, the current operation is the current point addition operation, and the next operation is the next point doubling operation; The computing unit performs in parallel the first type of modular operation step at the end of the current operation and the second type of modular operation step in the next operation, including: The computing unit executes the modular addition and subtraction operation step at the end of the current point addition operation and the specified modular multiplication operation step of the next point multiplication operation in parallel.

7. The method according to claim 2, characterized in that The step of executing the modular addition and subtraction operation steps in the current operation and the designated modular multiplication operation steps in the next operation in parallel includes: The modular addition and subtraction operation steps in the current operation and the pseudo modular multiplication operation step added to the next operation are executed in parallel.

8. The method according to any one of claims 1 to 7, characterized in that: The storage unit stores a binary representation of a scalar k; The control unit reads a combined operation instruction from the storage unit, including: The control unit reads the values ​​of the binary representation at adjacent bits from the storage unit, and determines the combined operation instruction according to the values ​​at the adjacent bits.

9. The method according to claim 8, characterized in that The at least two different elliptic curve point operations include point addition and point doubling operations; the adjacent bits include a current bit and a next bit; If the value of the current bit is the first value, a doubling operation is performed; if the value of the current bit is the second value, a doubling operation and a dot addition operation are performed; If the value of the next bit is the first value, a dot-double operation is performed; if the value of the next bit is the second value, a dot-double operation and a dot-add operation are performed.

10. A system on chip, characterized in that: It comprises a processor and a cryptographic engine, wherein the processor is connected to the cryptographic engine, and the cryptographic engine is used to receive a calling instruction from the processor to execute the method as described in any one of claims 1-9.

11. A computing device, characterized in that: Comprising the system on chip as claimed in claim 10.

Images