Mask circuit design method implemented based on unbalanced shared threshold

Abstract

The invention provides a mask circuit design method implemented based on an unbalanced shared threshold, which comprises the following steps: constructing an initial circuit model which comprises a multi-input AND gate structure; performing hierarchical decomposition processing on the multi-input AND gate structure based on preset distribution combination operation to obtain multi-layer binary operation so as to complete hierarchical construction; based on a coverage design, compressing a middle layer cross product generated in the layered construction process to complete the design of an initial share allocation structure; according to the design process of the initial share allocation structure, based on the combination of coverage design and a preset unbalanced sharing allocation strategy, performing brand new share allocation design to complete the design of a target share allocation structure; and based on the design process of the target share allocation structure, performing circuit design on the Boolean circuit with the high algebraic depth to obtain a target mask circuit.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of mask circuit design, and particularly relates to a mask circuit design method based on non-balance shared threshold implementation. BACKGROUND

[0002] Side-Channel Attack (SCA) is an attack mode against the physical implementation of cryptographic devices, which obtains sensitive data by analyzing the physical information leaked by the device when executing cryptographic algorithms. In the face of SCA threat, the industry has developed various protection technologies. Threshold Implementation (TI) is a protection technology against SCA specially for hardware circuits. The core idea of this technology is to decompose sensitive variables (such as keys, intermediate states, etc.) into multiple shares that are mathematically related but physically independent of each other. Through a carefully designed segmentation and reorganization mechanism, it is ensured that the power consumption or electromagnetic leakage at any single moment cannot directly reveal the complete sensitive information. The security of TI technology is based on two key attributes: incompleteness and uniformity. Incompleteness requires that any combination of t-1 shares cannot leak information about the original sensitive variable, where t is the security threshold; uniformity ensures that all possible share combinations appear with equal probability statistically, thereby eliminating the statistical basis of power analysis attacks.

[0003] Although the existing Threshold Implementation (TI) and its improved methods (such as Low Latency Threshold Implementation, LLTI) have achieved certain results in the design of mask circuits against SCA, there are still the following problems: TI and HTI schemes require a large number of shares and cross products in protection, leading to exponential increase in hardware area and power consumption, high hardware cost, and difficulty in application in resource-constrained chips; the calculation of TI scheme usually has sequential dependency, which cannot be fully parallelized, resulting in large delay and significantly reduced processing speed, which cannot meet the application requirements of high-speed encryption operations; in the HTI scheme, the share allocation, subset division, uniformity and incompleteness conditions are difficult to satisfy simultaneously, the design process is complicated, the circuit implementation is complex, and the trade-off between security and performance is easy to occur; although the LLTI scheme has obvious improvement in parallelization and delay compared with the traditional TI, its circuit structure still relies on a large number of logic operations such as AND gates and OR gates, and the number of logic gates and power consumption still have further optimization space, and the energy efficiency has not been optimized. SUMMARY

[0004] The application provides a mask circuit design method based on a non-equilibrium sharing threshold implementation, comprising: constructing an initial circuit model, the circuit model comprising a multi-input AND gate structure; based on a preset allocation combination operation, performing hierarchical decomposition processing on the multi-input AND gate structure to obtain a multi-layer binary operation, so as to complete hierarchical construction; based on coverage design, compressing the intermediate layer cross product generated in the process of hierarchical construction, so as to complete the design of the initial share allocation structure; based on the design process of the initial share allocation structure, performing new share allocation design based on the joint of coverage design and a preset non-equilibrium sharing allocation strategy, so as to complete the design of the target share allocation structure; based on the design process of the target share allocation structure, performing circuit design on the Boolean circuit with high algebraic depth, to obtain the target mask circuit.

[0005] In the above scheme, based on the preset allocation combination operation, the multi-input AND gate structure is subjected to hierarchical decomposition processing to obtain a multi-layer binary operation, so as to complete hierarchical construction, comprising: using the associative law of Boolean algebra, decomposing the multi-variable operation of the multi-input AND gate structure into a multi-layer binary operation, wherein the algebraic depth of each intermediate layer is less than or equal to 2.

[0006] In the above scheme, based on coverage design, the intermediate layer cross product generated in the process of hierarchical construction is compressed, comprising: under the condition that hierarchical construction meets the output correctness, non-completeness and uniformity, constructing a coverage set; based on the coverage set, selecting a target subset capable of covering all necessary input share combinations from the full set of intermediate layer cross products, and taking the target subset as the effective cross product item of the intermediate layer.

[0007] In the above scheme, the coverage set needs to meet each of the three conditions, and the three conditions comprise: a full coverage requirement that all necessary input share combinations are covered by at least one effective cross product item; the number of effective cross product items used is a target value that meets the full coverage requirement, and the target value is lower than a preset threshold; and the effective cross product item set corresponding to any single output share does not contain all shares of any input variable.

[0008] In the above scheme, the non-equilibrium sharing allocation strategy comprises: allocating different numbers of shares to a plurality of input variables, wherein the number of shares allocated to each input variable meets a safety lower limit greater than or equal to td + 1, and the number of shares allocated to at least two input variables is not equal; wherein t represents the algebraic depth, and d represents the security order.

[0009] In the above scheme, the non-equilibrium sharing allocation strategy is configured to: in a circuit comprising at least two layers of operations, by allocating more shares than the safety lower limit to at least one input variable, the number of output shares of the intermediate layer is less than or equal to the number of shares of the at least one input variable.

[0010] In the scheme, the unbalanced shared allocation strategy further comprises: dynamically adjusting according to specific function structure and performance requirements, and finding corresponding configurations at different algebraic depths and security levels.

[0011] In the scheme, the target mask circuit is a threshold implementation security model.

[0012] The technical scheme of the embodiment of the application has at least the following beneficial effects:

[0013] (1) The method realizes accurate control of the cross product quantity by designing corresponding unbalanced share allocation strategies for the importance and sensitivity of different sensitive variables in the threshold implementation framework, eliminates the influence of cross product explosion in the balanced sharing mechanism on the circuit performance, significantly reduces the circuit gate complexity, power consumption overhead and timing delay on the premise of maintaining the core security properties of incompleteness and uniformity, and further meets the comprehensive requirements of high performance, low power consumption and strong security of encryption chips and embedded systems.

[0014] (2) The method combines coverage design with unbalanced allocation and proposes unbalanced coverage optimization, finds the minimum combination set through coverage design when the input shares are not equal, and realizes the maximum compression of cross products. BRIEF DESCRIPTION OF DRAWINGS

[0015] Figure 1 The flowchart of the mask circuit design method based on unbalanced shared threshold implementation according to the embodiment of the application is schematically shown;

[0016] Figure 2 The sharing and allocation combined operation sharing comparison diagram of the three-input AND gate y=abc according to the embodiment of the application is schematically shown;

[0017] Figure 3 The recursive decomposition diagram of high-order combined operation sharing according to the embodiment of the application is schematically shown;

[0018] Figure 4 The sharing effect diagram of the three-input AND gate y=abc based on coverage design according to the embodiment of the application is schematically shown;

[0019] Figure 5 The unbalanced sharing design and coverage joint optimization effect diagram of the four-input AND gate y=abcd according to the embodiment of the application is schematically shown;

[0020] Figure 6 The unbalanced sharing structure diagram of 5 algebraic depths according to the embodiment of the application is schematically shown;

[0021] Figure 7 The unbalanced sharing structure diagram of 6 algebraic depths according to the embodiment of the application is schematically shown;

[0022] Figure 8 A non-equilibrium sharing structure diagram of 7 algebraic depths is schematically shown according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the objects, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to specific embodiments and drawings.

[0024] Figure 1 A flowchart of a mask circuit design method based on non-equilibrium sharing threshold value implementation is schematically shown according to an embodiment of the present application.

[0025] For a more complete understanding of the present application, reference is made to the following description taken in conjunction with the accompanying drawings. Figure 1 In an embodiment of the present application, the specific flow of the mask circuit design method based on non-equilibrium sharing threshold value implementation includes operations S110-S150.

[0026] In operation S110, an initial circuit model is constructed, and the circuit model includes a multi-input AND gate structure.

[0027] In an embodiment of the present application, in order to complete the threshold value implementation security model design and solve the anti-side channel attack of the hardware circuit, first, an initial circuit model is constructed, which is a common circuit including a multi-input AND gate structure, and the initial circuit model is designed to be converted into a secure threshold value implementation circuit.

[0028] In operation S120, based on a preset distribution combination operation, the multi-input AND gate structure is processed by hierarchical decomposition to obtain a multi-layer binary operation to complete hierarchical construction.

[0029] In an embodiment of the present application, based on a preset distribution combination operation, the multi-input AND gate structure is processed by hierarchical decomposition to obtain a multi-layer binary operation to complete hierarchical construction, including: using the associativity of Boolean algebra, the multi-variable operation of the multi-input AND gate structure is decomposed into a multi-layer binary operation, wherein the algebraic depth of each intermediate layer is less than or equal to 2.

[0030] It can be understood that first, the multi-input AND gate structure is restructured, the complex multi-variable operation is decomposed into a multi-layer binary operation by using the associativity of Boolean algebra, and the maximum algebraic operation depth of each intermediate layer is limited to 2. This hierarchical decomposition can effectively control the explosive growth of cross products and provide a structural basis for subsequent non-equilibrium optimization.

[0031] Figure 2 A comparison diagram of a direct sharing of a three-input AND gate y=abc and a distribution combination sharing is schematically shown according to an embodiment of the present application.

[0032] Exemplarily, asFigure 2 As shown, first, the comparative analysis of the case of algebraic depth t = 3 low-order operation is carried out, and taking a three-input AND gate y = abc as an example, the difference between the direct sharing method and the distribution combined operation is compared and analyzed.

[0033] For the direct sharing method, the shares of all variables a, b, and c are directly shared and decomposed, and cross product operations are required between all the shares. All cross products directly participate in the distribution of the final output. If each variable is assigned 4 shares, there are , , The total number of cross products calculated by the direct sharing method is 4 × 4 × 4 = 64. The logic gate statistics show that 64 AND gates (2 AND gates in series for each three-input cross product) and 60 XOR gates (for the XOR merging of the final output shares) are required, and the total number of gates is 124.

[0034] For the distribution combined operation sharing, the associative law y = abc = (ab) c = wc is used to calculate in two layers. In the first layer, the shares of the intermediate result w = ab are calculated. The number of cross products is 4 × 4 = 16, which is compressed to 3 intermediate shares w 1 , w 2 , w 3 by overlay design. In the second layer, the shares of the final result y = wc are calculated. The number of cross products is 3 × 4 = 12, and 4 final shares y 1 , y 2 , y 3 , y 4 are output. The logic gate statistics show that the first layer requires 16 AND gates and 13 XOR gates, and the second layer requires 12 AND gates and 8 XOR gates, and the total number of gates is 49.

[0035] Based on the above comparison, the number of gates is reduced from 124 to 49, a reduction of 60.48%, the critical path delay is reduced from 3-stage AND gates to 2-stage AND gates, and the two-layer operation can be pipelined to improve parallelism.

[0036] Figure 3 The recursive decomposition diagram of the high-order combined operation sharing according to an embodiment of the application is schematically shown.

[0037] For high-order Boolean function operation with algebraic depth t > 3, the distribution combined operation is used for hierarchical decomposition, and the principle is that the maximum algebraic depth of each intermediate layer does not exceed 2. In the construction process, the high-order AND gate is split into multiple layers of low-order AND gate combination, and each layer only calculates the local cross term, avoiding the exponential cross product explosion in the direct sharing method. The recursive decomposition scheme of t > 3 is as follows Figure 3As shown.

[0038] Furthermore, such as Figure 3 As shown, for a function with t=4, taking y=abcd as an example, the direct sharing method requires handling the four-fold cross terms of all shares. First, it is assigned as w1=ab and w2=cd, both with an algebraic depth of 2. Then, in the second layer, y=w1w2 is calculated, maintaining an algebraic depth of 2. In this way, the output is gradually synthesized from two layers of sub-functions, avoiding the complexity of directly expanding the final layer.

[0039] Please continue reading. Figure 3 For the function y=abcde with t=5, the construction steps are as follows: the first layer calculates w1=ab and w2=cd; the second layer obtains w3=w1w2; and the third layer outputs y=w3e. Throughout the process, the local operations of each layer are second-order combinations, ensuring that the algebraic depth does not exceed 2.

[0040] Please continue reading. Figure 3 When t=6, the function y=abcdef can be calculated as follows: First layer: w1=ab, w2=de; Second layer: w3=w1c, w4=w2f. Then, in the third layer, y=w3w4 is calculated. Each layer consists of two-input AND gates, with the algebraic depth controlled to within 2.

[0041] Please continue reading. Figure 3 For the function y = abcdefg with t = 7, a multi-branch approach is adopted. The first layer yields w1 = ab and w2 = de; the second layer calculates w3 = w1c and w4 = w2f; the third layer synthesizes w5 = w3 w4; and finally, the fourth layer yields y = w5 g. Under this construction, higher-order operations are transformed into multi-layer second-order combinations, and the number of local cross terms is much smaller than that of the direct expansion method.

[0042] In operation S130, based on the overlay design, the intermediate layer cross-products generated during the hierarchical construction process are compressed to complete the design of the initial share allocation structure.

[0043] In an embodiment of the present invention, based on the covering design, the intermediate layer cross product generated during the hierarchical construction process is compressed, including: constructing a covering set under the condition that the hierarchical construction satisfies the output correctness, incompleteness and uniformity; based on the covering set, selecting a target subset from the full set of intermediate layer cross products that can cover all necessary input share combinations, and using the target subset as the effective cross product term of the intermediate layer.

[0044] Specifically, after the hierarchical construction of step one is completed, a cover design method is further introduced to compress and optimize the intermediate layer cross products to obtain an optimal share allocation structure (i.e., an initial share allocation structure). It can be understood that, under the premise of ensuring the correctness, incompleteness and uniformity conditions, the smallest subset capable of covering all necessary combinations is selected through mathematical cover set construction, thereby avoiding the calculation of redundant cross terms.

[0045] Further, in the embodiments of the present application, the cover set needs to satisfy each of the three conditions, including: a full coverage requirement that all necessary input share combinations are covered by at least one valid cross product term; a target value of the number of valid cross product terms used, which is lower than a preset threshold, satisfying the full coverage requirement; and a valid cross product term set corresponding to any single output share, which does not contain all shares of any input variable.

[0046] It can be understood that the cover design aims to cover all elements in the universal set with the smallest subset. In the threshold implementation of the sharing function construction, the full coverage requirement needs to be met: all possible share combinations must be covered by a certain output share; the minimality principle needs to be met: the least number of cross product terms is used to achieve complete coverage; and the non-overlapping constraint needs to be met: the incompleteness requirement is met, and any single output share cannot contain all shares of a variable.

[0047] Exemplarily, let the input variable set be , and each variable x i The corresponding share set is . The cover design problem can be formalized as finding the smallest cover set family , so as to satisfy the following formula.

[0048] (full coverage)

[0049] (incompleteness)

[0050] (minimality)

[0051] Figure 4 An illustrative diagram of a cover design-based sharing effect of a three-input AND gate y=abc according to an embodiment of the present application is shown.

[0052] For example, please refer to Figure 4 , take t=3 as an example, y=abc, and S≥4 is obtained according to the minimum share allocation lower limit formula. According to the hierarchical manner, the w1=ab share of the first layer is calculated first. According to , , the traditional method needs ai b j The number of required shares is theoretically bounded by the Schonheim bound. By using the cover design method, the candidate set is generated. Only three candidate sets are needed to cover the design. Thus, the first layer output can be represented as . In this way, each term in the first layer is the output of a two-input AND gate, and the result is compressed from 6 shares to 3 shares. The second layer combines the shares of w1 and c to obtain the final three-input product, thus completing the masked computation of y = abc.

[0053] In embodiments of the present application, please refer to Figure 4 and the following gate complexity table. In the case of algebraic depth T = 3, the sharing scheme based on the distribution of combination operations and cover design can effectively compress the number of shares and significantly reduce the computational overhead of cross terms. However, when the order is further raised to T = 4, the situation is different. Relying only on cover design is not enough to maintain the controllability of resources. Take the function y = abcd as an example. If all variables use the same minimum number of shares S, the first layer needs to calculate the share combinations of ab and cd, which will theoretically produce S 2 cross terms. Further multiplication in the second layer, the combination size expands rapidly to the order of S 4 . Even if the cover design is used for compression, the strict use of the lower bound share number in the high-order or high-algebraic-depth scenario often leads to a dramatic expansion of the size of the cross product set in the intermediate layer. The reason is that when the number of input shares is small, the first layer can generate insufficient cross terms to cover all necessary combinations, so more output shares must be introduced in subsequent layers to maintain coverage and incompleteness, resulting in a base set size in the intermediate layer far beyond the controllable range.

[0054]

[0055] In operation S140, according to the design process of the initial share allocation structure, a new share allocation design is performed based on the joint of cover design and the preset unbalanced sharing allocation strategy to complete the design of the target share allocation structure.

[0056] In embodiments of the present application, balanced sharing and unbalanced sharing are mainly used to describe the allocation strategy of shares, that is, whether to allocate the same number of shares to each input variable. That is, in embodiments of the present application, "balanced / unbalanced" specifically refers to the strategy difference at the level of share allocation.

[0057] ​Further, on the basis of the cover design, a non-balanced sharing allocation strategy is introduced, which breaks through the balance restriction that all variables must use the same number of shares followed by the traditional Threshold Implementation (TI) series. The non-balanced sharing is to allocate different numbers of shares to different input variables according to the importance, frequency of use and security threat level of the variables in the algorithm, so as to realize the optimization of resource configuration under the premise of meeting the security lower bound constraint, and complete the design of the target share allocation structure.

[0058] In an embodiment of the present application, the non-balanced sharing allocation strategy comprises: allocating different numbers of shares to a plurality of input variables, wherein the number of shares allocated to each input variable satisfies a security lower bound greater than or equal to td + 1, and the number of shares allocated to at least two input variables is not equal; wherein t represents the algebraic depth, and d represents the security order.

[0059] Figure 5 An effect diagram of non-balanced sharing design and cover joint optimization of a four-input AND gate y=abcd according to an embodiment of the present application is schematically shown.

[0060] Specifically, the non-balanced sharing allocation strategy is that the minimum number of shares of each input variable x i satisfies the security lower bound of , but different variables are allowed to use different s i values under this constraint. This non-uniform allocation strategy creates a new optimization space, and by reasonably adjusting the share distribution of each variable, the compression effect in the cover design can be further improved. Please refer to Figure 5 and the following gate complexity table, for example, in the case of t=4, if four operations are directly performed according to the hierarchical method, the first layer is two second times, each using 5 outputs are 10 shares. The second layer is compressed into 5 shares, and the result is . The problem with this structure is that the number of intermediate shares increases sharply (10), resulting in a large number of cross terms, which leads to a large number of AND / XOR gates. In order to solve this problem, one input share is added, that is, the number of inputs is changed from 5 to 6. In this way, the number of intermediate shares can be kept constant in the two-layer cover construction: .

[0061]

[0062] In the embodiments of the present application, the unbalanced sharing allocation strategy is further configured to: in a circuit containing at least two layers of operations, by allocating more shares than the safe lower limit to at least one input variable, so that the number of output shares of the intermediate layer is less than or equal to the number of shares of the at least one input variable.

[0063] Further, on the basis of maintaining balanced allocation, an unbalanced share allocation strategy is introduced. Specifically, all input variables are no longer required to be divided into the same number of shares, but are allocated differently according to their different roles. An unbalanced allocation of (5, 5, 6, 6) is constructed, in which two input variables still maintain 5 shares, and the other two input variables are expanded to 6 shares. This design is beneficial to the input on the critical path to obtain more shares, ensuring that the cover set can avoid exponential expansion of the intermediate layer when constructed; while for inputs with relatively less participation or lower importance, only the minimum number of shares is allocated, thereby effectively compressing the overall share number.

[0064] It can be understood that the unbalanced scheme takes advantage of the flexibility of cover design, by introducing redundant shares on part of the inputs, to exchange for global gate number reduction and structure balance, and finally further reduces the number of cross terms and circuit complexity under the premise of maintaining incompleteness.

[0065] In the embodiments of the present application, the unbalanced sharing allocation strategy further includes: dynamic adjustment according to specific function structure and performance requirements, and corresponding configurations can be found at different algebraic depths and security levels.

[0066] Specifically, the unbalanced sharing strategy also has adaptive characteristics, and can be dynamically adjusted according to specific function structure and performance requirements, and corresponding optimal configurations can be found at different algebraic depths and security levels, providing a flexible and efficient solution for the design of high-performance cryptographic chips.

[0067] In operation S150, based on the design process of the target share allocation structure, a circuit design is performed on the Boolean circuit with high algebraic depth, and a target mask circuit is obtained.

[0068] Figure 6 An unbalanced sharing structure diagram of 5 algebraic depth according to an embodiment of the present application is schematically shown. Figure 7 An unbalanced sharing structure diagram of 6 algebraic depth according to an embodiment of the present application is schematically shown. Figure 8 An unbalanced sharing structure diagram of 7 algebraic depth according to an embodiment of the present application is schematically shown.

[0069] It can be understood that the target share allocation structure obtained by combining the foregoing step of unbalanced sharing with the design of the overlay is applied to high algebraic depth nonlinear circuits in cryptographic implementation (such as AES S-box), so that a target mask circuit (that is, a threshold implementation security model) that meets the security requirement and has lower resource overhead is designed.

[0070] Specifically, in cryptographic implementation, a nonlinear component such as an S-box usually needs a large number of AND gates to be constructed, and these AND gates often have a very high algebraic depth. In the Boolean circuit implementation of the AES S-box, the algebraic depth of AND gates in some critical paths can reach 7 or more. These high algebraic depth AND gates are the main reason for the complexity explosion of traditional threshold implementation, and are also the application scenario in which the unbalanced sharing technology can best play an advantage. According to the parity feature of the algebraic depth, the high algebraic depth AND gates can be divided into two categories for analysis.

[0071] Please refer to Figures 6-8 It can be seen that in the scenario where the algebraic depth is further expanded to t=5, 6, 7, the unbalanced sharing threshold implementation shows more prominent optimization capability. With the increase in the number of input variables, the number of cross products of the threshold implementation increases exponentially, and the circuit size and gate consumption overhead quickly get out of control. The unbalanced sharing threshold implementation, by combining the flexible share configuration strategy with the hierarchical overlay design, effectively compresses this exponential growth into a hierarchical controllable linear or sub-linear growth. Specifically, the unbalanced sharing threshold implementation in the design of t=5, 6, 7 adopts a structure of multi-stage decomposition and multi-level overlay optimization as shown in Figures 6-8 .

[0072] In the embodiments of the present application, the traditional TI, LLTI and the method of the present embodiment are compared and analyzed. In the traditional TI and LLTI, with the increase in the algebraic depth t and the order d, the gate consumption overhead increases exponentially , which leads to the unfeasibility of circuit implementation. The present embodiment compresses the exponential expansion under the balanced structure into an approximate linear or sub-linear growth by combining the unbalanced sharing with the overlay design. Experimental results show that in the range of t=3~7, the gate consumption is reduced by 20%~40% on average compared with the LLTI, which greatly improves the realizability of the circuit.

[0073] In addition, compared with the traditional TI and LLTI which emphasize balance, all input variables must be allocated the same number of shares, which limits the optimization space. The present embodiment proposes an unbalanced sharing mechanism that allows different input variables to be allocated different numbers of shares , and guarantees security through the mathematical lower limit s≥dt+1. This mechanism provides a new optimization degree of freedom, which can be customized for circuit bottlenecks.

[0074] Through the embodiments of the present application, the mask circuit design method based on the unbalanced sharing threshold implementation is based on the distribution combination operation of Boolean algebra, combines the coverage design for compression sharing, and introduces the unbalanced sharing strategy. The scheme gives a systematic sharing scheme design method for the scene of high-order algebra depth (t=3,…, 7). Compared with the traditional TI direct sharing and the low-latency threshold implementation (Low-Latency Threshold Implementation, LLTI) method based on expansion implementation, the method changes the rigid requirement that all variables in the traditional TI must use the same number of shares, and provides more optimization space for practical applications through the non-uniform distribution strategy. Through the unbalanced sharing distribution strategy, while ensuring the security properties such as correctness, incompleteness and uniformity, the number of cross products and circuit resource consumption are significantly reduced, so as to realize the low-delay, low-consumption security circuit.

[0075] Those skilled in the art can understand that the features described in various embodiments of the present application can be combined and / or combined, even if such combinations or combinations are not explicitly described in the present application. In particular, the features described in various embodiments of the present application can be combined and / or combined without departing from the spirit and teachings of the present application. All these combinations and / or combinations fall within the scope of the present application.

[0076] The above specific embodiments further detail the purpose, technical solutions and advantages of the present application. It should be understood that the above is only a specific embodiment of the present application and is not intended to limit the present application. Any modification, equivalent replacement, improvement, etc. within the spirit and principles of the present application shall be included in the protection scope of the present application.

Claims

1. A method for designing a masking circuit based on a non-equilibrium sharing threshold implementation, characterized by, The method comprises the following steps: constructing an initial circuit model, the circuit model comprising a multi-input AND gate structure; based on a preset allocation combination operation, performing hierarchical decomposition processing on the multi-input AND gate structure to obtain a multi-layer binary operation, so as to complete hierarchical construction; based on coverage design, compressing the intermediate layer cross product generated in the process of the hierarchical construction, so as to complete the design of the initial share allocation structure; based on the coverage design and a preset unbalanced shared allocation strategy, performing new share allocation design according to the design process of the initial share allocation structure, so as to complete the design of a target share allocation structure; based on the design process of the target share allocation structure, performing circuit design on a Boolean circuit with high algebraic depth, so as to obtain a target mask circuit.

2. The mask circuit design method based on unbalanced sharing threshold implementation as claimed in claim 1, wherein, The method of performing hierarchical decomposition processing on the multi-input AND gate structure to obtain a multi-layer binary operation based on a preset allocation combination operation, so as to complete hierarchical construction, comprises the following steps: using the associative law of Boolean algebra, decomposing the multi-variable operation of the multi-input AND gate structure into a multi-layer binary operation, wherein the algebraic depth of each intermediate layer is less than or equal to 2.

3. The mask circuit design method based on unbalanced sharing threshold implementation as claimed in claim 1, wherein, The method of compressing the intermediate layer cross product generated in the process of the hierarchical construction based on coverage design comprises the following steps: under the condition that the hierarchical construction meets the output correctness, incompleteness and uniformity, constructing a coverage set; based on the coverage set, selecting a target subset capable of covering all necessary input share combinations from the full set of the intermediate layer cross product, and taking the target subset as the effective cross product item of the intermediate layer.

4. The mask circuit design method based on unbalanced sharing threshold implementation as claimed in claim 3, wherein, The coverage set needs to meet each of the following three conditions: a full coverage requirement that all necessary input share combinations are covered by at least one effective cross product item; the number of the effective cross product items used is a target value meeting the full coverage requirement, and the target value is lower than a preset threshold; and the effective cross product item set corresponding to any single output share does not contain all shares of any input variable.

5. The mask circuit design method based on unbalanced sharing threshold implementation as claimed in claim 1, wherein, The unbalanced shared allocation strategy comprises the following steps: allocating different numbers of shares to multiple input variables, wherein the number of shares allocated to each input variable meets a security lower limit greater than or equal to td + 1, and the number of shares allocated to at least two input variables is not equal, wherein t represents the algebraic depth and d represents the security order.

6. The mask circuit design method based on unbalanced sharing threshold implementation according to claim 1 or 5, characterized in that, The unbalanced shared allocation strategy is configured to: in a circuit comprising at least two layers of operations, by allocating more shares than the security lower limit to at least one input variable, the number of output shares of the intermediate layer is less than or equal to the number of shares of the at least one input variable.

7. The mask circuit design method based on unbalanced sharing threshold implementation according to claim 1 or 5, characterized in that, The unbalanced shared allocation strategy further comprises the following steps: dynamically adjusting according to specific function structure and performance requirements, and finding corresponding configurations under different algebraic depths and security levels.

8. The mask circuit design method based on unbalanced sharing threshold implementation as claimed in claim 1, wherein, The target mask circuit is a threshold implementation security model.

Images