Ring circuit and low-random-number-source and low-area combinable hardware mask assembly

Abstract

The invention belongs to the field of mask components, and provides a ring circuit and a low-random-number-source and low-area combinable hardware mask component. Wherein the loop circuit comprises a first register, a selector, an input operation combination circuit, a common operation combination circuit, a feedback operation combination circuit and an output operation combination circuit; the input operation combination circuit is used for processing an input signal and then is connected to a first input end of the selector; a signal output by the output end of the selector is processed by the common operation combination circuit and then is connected to the input end of the first register; a signal output by the output end of the first register is connected to the second input end of the selector after being processed by the feedback operation combination circuit; and the signal output by the output end of the first register is processed by the output operation combination circuit and then is used as the output of the loop circuit.

Description

Technical Field

[0001] This invention belongs to the field of mask components, and particularly relates to a ring circuit and a low random number source, low area composable hardware mask component. Background Technology

[0002] The statements in this section are merely background information related to the present invention and do not necessarily constitute prior art.

[0003] To combat side-channel attacks, researchers have proposed numerous countermeasures, among which masking schemes are the most widely used. Masking schemes allow intermediate values ​​of the algorithm to be independent of secret variables, thereby breaking the relationship between secret data and device power consumption. Considering the actual physical characteristics of hardware circuits, such as glitches, flips, and leakage, hardware masking component design presents even greater challenges, prompting research into composable components. However, previous inventions often relied heavily on using registers to block glitches, resulting in significant register area consumption and ultimately increased production costs. Furthermore, previous designs often focused solely on utilizing the statistical characteristics of random numbers to ensure security, then reusing the random number source through pipelines, leading to a waste of random number resources.

[0004] In summary, traditional composable component designs are characterized by a large number of registers and multiple random number sources, resulting in significant area overhead and increased production costs. Summary of the Invention

[0005] To address the technical problems existing in the background art, the present invention provides a ring circuit and a low random number source with a low area composable hardware mask component, which ultimately achieves the goal of reducing component area and realizing lower production costs.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: The first aspect of the present invention provides a ring circuit.

[0007] A ring circuit includes: a first register, a selector, an input operational combinational circuit, a common operational combinational circuit, a feedback operational combinational circuit, and an output operational combinational circuit; The input arithmetic combination circuit processes the input signal and connects it to the first input terminal of the selector; the signal output from the output terminal of the selector is processed by the common arithmetic combination circuit and connected to the input terminal of the first register; the signal output from the output terminal of the first register is processed by the feedback arithmetic combination circuit and connected to the second input terminal of the selector; the signal output from the output terminal of the first register is also processed by the output arithmetic combination circuit and used as the output of the loop circuit.

[0008] In one implementation, one input terminal of the shared operational combinational circuit is also directly connected to a random number source that generates new random numbers every set period.

[0009] In one implementation, the input terminal of any one of the input arithmetic combination circuit, the common arithmetic combination circuit, the feedback arithmetic combination circuit, and the output arithmetic combination circuit is connected to a random number generated in the historical period by the random number source stored in the second register.

[0010] In one implementation, the input operational combination circuit, the common operational combination circuit, the feedback operational combination circuit, and the output operational combination circuit are all corresponding preset logic combination circuits.

[0011] A second aspect of the invention provides a composable hardware masking component with low random number source and low area.

[0012] A low-random-number-source, low-area composable hardware masking component includes the ring circuit described above.

[0013] As one implementation, when the low random number source, low area composable hardware mask component is a first-order composable AND gate, the first-order composable AND gate includes two sets of input variables.

[0014] As one implementation, in the first-order composable AND gate: In the first stage, a set of input variables are selected by control signals and stored in registers Rb0 and Rb1 using random numbers generated by a random number source, with the values ​​recorded as b0 and b1. In the second stage, another set of input variables is multiplied by b0 and b1 respectively, and refreshed by random numbers generated by the same random number generator in the first stage. The results are then stored in registers Ra0 and Ra1. The third stage involves XORing the values ​​in register Ra0 and register Rb1 and outputting them directly; and XORing the values ​​in register Rb0 and register Ra1 and outputting them directly.

[0015] As one implementation, when the low random number source, low area composable hardware mask component is a second-order composable AND gate, the second-order composable AND gate contains three identical branches.

[0016] As one implementation, the low-random-number-source, low-area composable hardware mask component is applied in a pipeline circuit.

[0017] As one implementation, the low-random-number-source, low-area composable hardware mask component is applied in the auxiliary module circuit.

[0018] The beneficial effects of this invention are: (1) The present invention uses an input operation combination circuit to process the input signal and connects it to the first input terminal of the selector. The signal output from the output terminal of the selector is processed by a common operation combination circuit and then connected to the input terminal of the first register. The signal output from the output terminal of the first register is processed by a feedback operation combination circuit and then connected to the second input terminal of the selector. The signal output from the output terminal of the first register is also processed by an output operation combination circuit and then used as the output of the loop circuit. In this way, the signal of the output terminal of the first register is reused, the number of registers is reduced, and the component area is reduced, thereby achieving the goal of lower production cost.

[0019] (2) One input terminal of the common operational combination circuit of the present invention is also directly connected to a random number source that generates new random numbers every set period. In this way, the random numbers generated by the random number source at different times can be reused and directly input into the logic gate device, reducing the use of the random number source and reducing the component area overhead and production cost.

[0020] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0021] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0022] Figure 1 This is the register chain circuit of an embodiment of the present invention; Figure 2 This is a ring circuit according to an embodiment of the present invention; Figure 3 This is a first-order combinable AND gate in an embodiment of the present invention; Figure 4 It is a single branch of the second-order composable design in this embodiment of the invention; Figure 5 This is an example of a masked random number derivation method according to an embodiment of the present invention; Figure 6 This is Example 2 of the masked random number derivation method according to an embodiment of the present invention; Figure 7 This is an example of the Tovellman branch structure in an embodiment of the present invention; Figure 8 This is Example 2 of the Tovellman branch structure in the embodiments of the present invention; Figure 9 These are different Toffee gate structures in the first-order circuit of this invention; Figure 10 This is a schematic diagram of the lower domain multiplication gate of a second-order circuit according to an embodiment of the present invention; Figure 11 This is a schematic diagram of the pipeline circuit according to an embodiment of the present invention; Figure 12 This is a schematic diagram of a clock gating circuit according to an embodiment of the present invention; Figure 13 This is a freezing technology construction method according to an embodiment of the present invention; Figure 14 This is a schematic diagram of the frozen clock gating circuit according to an embodiment of the present invention; Figure 15 This is an auxiliary circuit construction method according to an embodiment of the present invention; Figure 16 This describes the relationship between different levels of circuits in an embodiment of the present invention. Detailed Implementation

[0023] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0024] It should be noted that the following detailed description is illustrative and intended to provide further explanation of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0025] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0026] In this invention, terms such as "upper," "lower," "left," "right," "front," "back," "vertical," "horizontal," "side," and "bottom" indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. These terms are used only to facilitate the description of the structural relationships of the various components or elements of this invention and do not specifically refer to any component or element in this invention. They should not be construed as limiting the invention.

[0027] In this invention, terms such as "fixed connection," "connected," and "linked" should be interpreted broadly, indicating a fixed connection, an integral connection, or a detachable connection; a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can determine the specific meaning of these terms in this invention based on the specific circumstances, and they should not be construed as limitations on the invention.

[0028] In composable mask design, random numbers (such as...) Figure 1When ra, rb, r0`, r1` are input into a combinational circuit, they often need to be generated by an independent random number source.

[0029] like Figure 2 As shown, a ring circuit is provided, including: a first register, a selector, an input operational combinational circuit, a common operational combinational circuit, a feedback operational combinational circuit, and an output operational combinational circuit; The input arithmetic combination circuit processes the input signal and connects it to the first input terminal of the selector; the signal output from the output terminal of the selector is processed by the common arithmetic combination circuit and connected to the input terminal of the first register; the signal output from the output terminal of the first register is processed by the feedback arithmetic combination circuit and connected to the second input terminal of the selector; the signal output from the output terminal of the first register is also processed by the output arithmetic combination circuit and used as the output of the loop circuit.

[0030] For the random number required in each register stage (i.e.) Figure 1 In this embodiment, ra and rb are used, and fewer random number sources are reused (such as ra and rb). Figure 2 The random numbers generated by the random number source R at different times are directly input.

[0031] In some alternative embodiments, one input terminal of the shared operational combinational circuit is also directly connected to a random number source that generates new random numbers every set period.

[0032] In some optional embodiments, the input terminal of any one of the input arithmetic combinational circuit, common arithmetic combinational circuit, feedback arithmetic combinational circuit, and output arithmetic combinational circuit is connected to a random number generated in the historical period by a random number source stored in the second register. This allows for the processing of random numbers used only in a specific register phase. Figure 1 (r0` and r1` in the text), reusing fewer random number sources (such as r0` and r1` in the text). Figure 2 The R's (R') is used as input, and some random numbers generated in the historical period are saved.

[0033] It should be noted here that the input operational combination circuit, the common operational combination circuit, the feedback operational combination circuit, and the output operational combination circuit are all corresponding preset logic combination circuits.

[0034] In one or more embodiments, a low-random-number-source, low-area composable hardware masking component includes the ring circuit described above.

[0035] When the low-random-number-source, low-area composable hardware mask component is a first-order composable AND gate, such as Figure 3 As shown, the first-order combinable AND gate includes two sets of input variables.

[0036] In the first-order composable AND gate: In the first stage, a set of input variables are selected by control signals, and random numbers generated by a random number source are masked and stored in registers Rb0 and Rb1, with values ​​recorded as b0 and b1. In the second stage, another set of input variables is multiplied by b0 and b1 respectively, and refreshed by random numbers generated by the same random number generator in the first stage. The results are then stored in registers Ra0 and Ra1. The third stage involves XORing the values ​​in register Ra0 and register Rb1 and outputting them directly; and XORing the values ​​in register Rb0 and register Ra1 and outputting them directly.

[0037] like Figure 4 As shown, when the low random number source, low area composable hardware mask component is a second-order composable AND gate, the second-order composable AND gate contains three identical branches.

[0038] Each branch of a second-order combinatorial AND gate includes two sets of input variables: For the x-th branch (x can be 0, 1, 2), in the first stage, a set of input variables (denoted as B_x) is selected using the control signal ctrl (ctrl=1 in this stage), and a random number generated by a random number source in this stage is masked and stored in register Rb_x, with the value denoted as b*_x; other settings for this random number source are as follows. Figure 5 As shown.

[0039] In the second stage, another set of input variables (denoted as A_x) is multiplied by b*_x and b*_((x+1)%3) from different branches, as shown in the diagram. The result is then refreshed using random numbers generated by the same random number generator used in the first stage, and stored in a register. Furthermore, the result of multiplying A_x by b*_((x+2)%3) is processed using... Figure 6 The random numbers derived from the random number source derivation structure shown are masked.

[0040] In the third stage, the values ​​in the register are XORed as shown in the figure and then output directly.

[0041] Based on the aforementioned first-order and second-order combinable AND gates, Toffoligates can be extended to form the Toffoligate, which functionally refers to atomic operation gates that implement multiply-add functions. Utilizing the characteristics of ring circuits, to implement Toffoligates while minimizing the number of synchronization registers, the following approach is proposed: Figure 7 and Figure 8 These two methods process addition signals that arrive at different times.

[0042] When the additive variable C and variable A enter simultaneously (i.e., enter one cycle later than signal B), the signals are directly processed as follows: Figure 7 This is called "alignment"; when the addition variable C and variable B enter simultaneously, the addition variable needs to be stored for one cycle. This is achieved by using a multiplexed register, such as Rax. Figure 8 The alignment shown is completed, further reducing the synchronization area (referred to as the "synchronization method"). The specific branch inclusion within the composable AND gate is as follows: Figure 9 As shown.

[0043] Based on the aforementioned first-order and second-order combinable AND gates, combinable multiplication gates can be extended to form, which functionally refer to atomic operation gates that implement corresponding multiplication functions in different domains. To implement a multiplication gate, the AND gate components in the combinable AND gate are replaced with multiplication logic circuits in the corresponding domain, and the XOR gate components are replaced with addition logic circuits in the corresponding domain, such as... Figure 10 As shown.

[0044] In other embodiments, the low-random-number-source, low-area composable hardware mask component is applied in pipeline circuits or auxiliary module circuits.

[0045] The assembly of pipelined circuits can be based on the COMPRESS masked pipelined circuit generation tool, by simply replacing their HPC2(o) composable components with the design. Furthermore, it is necessary to layer the components according to the number of register layers at which they execute to the output. New components in even-numbered layers need to use the normal Ctrl signal, while those in odd-numbered layers need to be driven by the inverted Ctrl signal. To further reduce area, we can replace part of the register chain with a ring circuit, as detailed below. Figure 11 As shown in the diagram. All composable components are represented as black boxes with inputs A and B (and ctrl) and output Out; registers are considered as D-input, Q-output boxes, with dashed boxes indicating that the register can be ignored if the input is one step ahead.

[0046] The basic assembly of the clock gating circuit can be based on the AGEMA mask pipeline circuit generation tool, by replacing their HPC2(o) components with the design and adding an identical control signal. The specific structure is as follows: Figure 12 As shown.

[0047] However, such a design still suffers from periodicity and a significant waste of random numbers. Therefore, we consider introducing a freezing technique to optimize the components in a targeted manner, taking a second-order design as an example. Figure 13 Please provide an explanation.

[0048] To achieve complete circuit functionality, the aforementioned two types of mask circuits still lack necessary control signals. Therefore, we introduced some auxiliary modules as control circuits, specifically as follows: Figure 14 and Figure 15 As shown. Figure 14 As a control circuit, when the rst signal is pulled high, all output control signals are at a high level. At the start of the next cycle after the rst signal is pulled low, the two control signals operate sequentially at a frequency divided by two of the clock, thus generating the control signals. In a clock gating circuit using freeze-time technology, it is also necessary to generate a gating clock signal and a corresponding enable signal, such as... Figure 15 As shown. The relationship between the auxiliary circuit, the combinational circuit, and the internal combinatorial components is as follows. Figure 16 As shown.

[0049] The comparison results for AND gates are shown in Table 1 below.

[0050] Table 1. Area cost (GE) of AND gate components under different security orders for different schemes.

[0051] It can be observed that, compared to other solutions, the new component surpasses HPC2o in terms of randomness requirements and achieves the smallest total area relative to first-order HPC3o (at least 27%) and HPC1 (at least 23% to 41%), making the new design particularly attractive in area-constrained environments. Furthermore, the OBS gadget area is reduced by 52% compared to first-order HPC2.

[0052] Our optimization results for multiplication gates in finite fields are as follows: Table 2. Area Cost (GE) of Multiplicative Gadgets under Different Safety Orders (F4 and F16) in Each Scheme

[0053] As can be seen, our new design is also superior to other solutions at the multiplication gate level.

[0054] For the S-box circuit, a performance comparison was made between pipelined and clock-gated implementations of the S-box for AES, and Boolean gates and tower domain representations were used for comparison in the pipelined implementation.

[0055] In a pipelined implementation, we compared the circuit generated by the COMPRESS tool (referred to as the old circuit) with the circuit generated after replacing our tool (referred to as the new circuit), and the results are as follows.

[0056] Table 3. Area Comparison of Old and New Implementations at the Boolean Gate Level (GE)

[0057] Table 4. Area comparison between the old and new implementations at the tower domain level (kGE)

[0058] We can see that our results are all better than those of COMPRESS.

[0059] The clock-gated implementation is compared with other solutions, and the results are as follows.

[0060] Table 5. Area Comparison under Clock Gating Implementation (GE)

[0061] In this embodiment of the invention, one input of the logic gate device is connected to the output of the selector, and the other input of the logic gate device is directly connected to the first random number source. In this way, by reusing the random numbers generated by the first random number source at different times, the random numbers are directly input to the logic gate device. Moreover, by feeding back the output of the first register to one of the inputs of the selector to form a loop circuit, the signal of the output of the first register is reused, reducing the number of registers and random number sources, and ultimately achieving the goal of reducing component area and achieving lower production costs.

[0062] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A ring circuit, characterized by The ring circuit comprises a first register, a selector, an input operation combination circuit, a common operation combination circuit, a feedback operation combination circuit and an output operation combination circuit. The input operation combination circuit is connected to a first input end of the selector after processing an input signal; a signal output by an output end of the selector is connected to an input end of the first register after being processed by the common operation combination circuit; a signal output by an output end of the first register is connected to a second input end of the selector after being processed by the feedback operation combination circuit; and the signal output by the output end of the first register is processed by the output operation combination circuit and then output as an output of the ring circuit. An input end of the common operation combination circuit is also directly connected to a random number source configured to generate a new random number in a set period.

2. The ring circuit of claim 1, wherein An input end of any one of the input operation combination circuit, the common operation combination circuit, the feedback operation combination circuit and the output operation combination circuit is connected to a random number generated by a random number source in a history period and stored in a second register.

3. The ring circuit of claim 1, wherein The input operation combination circuit, the common operation combination circuit, the feedback operation combination circuit and the output operation combination circuit are respectively corresponding preset logic combination circuits.

4. The ring circuit of claim 1, wherein The ring circuit comprises the ring circuit according to any one of claims 1-4.

5. A low-random source low-area combinable hardware masking component, comprising: When the low-area combinable hardware masking component with a low random number source is a first-order combinable AND gate, the first-order combinable AND gate comprises two groups of input variables.

6. The low-random-source, low-area composable hardware masking component of claim 5, wherein, In the first-order combinable AND gate:

7. The low-random-source, low-area composable hardware mask component of claim 6, wherein, In a first stage, one group of input variables is selected by a control signal and stored in registers Rb0 and Rb1 by being masked by a random number generated by a random number source, and the values are denoted as b0 and b1; In a second stage, another group of input variables is multiplied by b0 and b1 respectively, and the result is stored in registers Ra0 and Ra1 by being refreshed by a random number generated by the same random number generator in the first stage; In a third stage, the values in the register Ra0 and the register Rb1 are directly output by being XORed, and the values in the register Rb0 and the register Ra1 are directly output by being XORed. When the low-area combinable hardware masking component with a low random number source is a second-order combinable AND gate, the second-order combinable AND gate comprises three identical branches.

8. The low-random-source low-area composable hardware masking component of claim 5, wherein, The low-area combinable hardware masking component with a low random number source is applied to a pipeline circuit.

9. The low-random-source low-area composable hardware masking component of claim 5, wherein, The low-area combinable hardware masking component with a low random number source is applied to an auxiliary module circuit.

10. The low-random-source low-area composable hardware masking component of claim 5, wherein, ​

Images