Reconfigurable s-box hardware architecture design method and device based on cross-layer cooperative optimization

Abstract

The application relates to a reconfigurable S-box hardware architecture design method and device based on cross-layer collaborative optimization. The method comprises the following steps: determining a composite domain configurable parameter to support a multi-algorithm S-box and generating a corresponding linear transformation matrix; jointly optimizing the parameter and the matrix to obtain a globally optimal parameter configuration, a shared common basic matrix and an algorithm expansion matrix; constructing a parameterized nonlinear inverse unit and a hierarchical parallel linear transformation network unit according to the parameter configuration, the common basic matrix and the algorithm expansion matrix; and integrating the two units to form a unified hardware architecture. Through cross-layer collaborative optimization and parallel structure, the method can support dynamic switching of algorithms, significantly reduce hardware resource overhead and critical path delay, and achieve an excellent balance of flexibility, high performance and low cost.

Description

Technical Field

[0001] This application relates to the fields of cryptographic hardware design and integrated circuit design technology, and in particular to a reconfigurable S-box hardware architecture design method and apparatus based on cross-layer collaborative optimization. Background Technology

[0002] With the explosive growth of the Internet of Things (IoT) globally, providing lightweight, low-power hardware encryption support for resource-constrained terminal devices (such as wireless sensors and wearable devices) has become a key challenge. In modern block ciphers, the S-Box, as the only non-linear component, has its PPA efficiency as a core bottleneck in the entire security chip design. However, designing an S-Box for IoT faces two major issues. First, there is the problem of standard diversity versus hardware rigidity. In the IoT ecosystem, multiple protocols coexist, including international standards like AES, Chinese commercial cryptography SM4, and ISO standards like Camellia. This means that the cryptographic algorithms used by security protocols in different application scenarios will vary depending on the negotiation results. Furthermore, the ability to quickly switch to another encryption algorithm once one algorithm is attacked, ensuring the security of chip data in a timely manner, requires hardware with the flexible ability to support multiple encryption algorithms. Second, there is the issue of high performance versus low power consumption. IoT applications require high throughput to avoid communication bottlenecks while maintaining extremely low power consumption. Therefore, how to simultaneously resolve the conflict between flexibility, high performance, and low cost at the hardware level is a pressing research issue.

[0003] The hardware implementation of S-Boxes primarily follows two paths: lookup table (LUT)-based and combinational logic-based. While LUT-based schemes are easy to reconfigure, their area and power consumption increase dramatically with the number of supported algorithms. Therefore, this paper chooses the combinational logic route based on composite field arithmetic (CFA). However, existing CFA-based reconfigurable S-Box designs generally suffer from some problems in both the linear and nonlinear parts: There are two major drawbacks in the linear part. First, logic hybridity: simple combination fails to distinguish the switching activity characteristics of different computational paths, mixing high-frequency switching logic with low-frequency logic, which may lead to unnecessary increases in dynamic power consumption and deterioration of critical path timing. Second, local optima: existing works generally adopt a strategy of post-optimization combination, that is, first independently optimizing the multiplication matrix of each algorithm, and then superimposing it using multiplexers. This method ignores the inherent correlation between different algorithm matrices, resulting in significant overall resource redundancy. In the nonlinear part, there is a parameter rigidity problem. In order to share the inversion hardware, existing architectures generally fix a set of sufficiently good irreducible polynomial parameters. This design restricts the choice space of isomorphic matrices in the linear layer, making it impossible to co-optimize with the nonlinear part. Summary of the Invention

[0004] Therefore, it is necessary to provide a reconfigurable S-box hardware architecture design method and device based on cross-layer collaborative optimization to address the above-mentioned technical problems.

[0005] A reconfigurable S-box hardware architecture design method based on cross-layer collaborative optimization, the method comprising: By determining a set of configurable pre-parameters for the composite field of the S-box to support multiple cryptographic algorithms, and by determining the corresponding linear transformation matrix for each algorithm based on the pre-parameters; The pre-parameters and the linear transformation matrix are jointly optimized to minimize the overall hardware overhead, resulting in the globally optimal pre-parameter configuration, a shared common basic linear transformation matrix, and the extended linear transformation matrix corresponding to each cryptographic algorithm. Based on the aforementioned pre-configured parameters, a parameterized composite domain inversion hardware unit is constructed; the composite domain inversion hardware unit can dynamically configure its internal computational logic according to the aforementioned pre-configured parameters. Based on the common basic linear transformation matrix and the extended linear transformation matrix, a hierarchical parallel execution linear transformation network hardware unit is constructed; wherein the common basic linear transformation matrix is ​​computed in parallel with all extended matrices; The composite field inversion hardware unit is integrated with the linear transformation network hardware unit to form a reconfigurable S-box hardware architecture that supports multiple cryptographic algorithms.

[0006] In one embodiment, the composite domain can be configured with pre-parameters including at least coefficients for defining the structure of the pyramidal domain GF(((2²)²)²), which is constructed stepwise by the following irreducible polynomials: GF(2²) is derived from definition; GF((2²)²) is derived from definition, These are configurable parameters taken from GF(2²); GF(((2²)²)²) is derived from Define λ as a configurable parameter taken from GF((2²)²).

[0007] In one embodiment, the operation of the composite field inversion hardware unit on GF(((2²)²)²) is implemented based on the normal basis representation, and the inversion operation of the composite field inversion hardware unit is performed by decomposing the following modular formula: For input A∈GF(((2²)²)²), the inverse operation is performed. The computation is decomposed into multiplication, squaring and inversion operations in the GF((2²)²) field. The Boolean logic expressions involving operations in GF((2²)²) and GF(2²) are optimized using the common subexpression elimination technique.

[0008] In one embodiment, the method further includes setting an occurrence frequency threshold; Calculate the frequency of occurrence of each column vector in the linear transformation matrix corresponding to all cryptographic algorithms; The column vectors that appear with a frequency greater than or equal to a threshold are extracted and combined to form the shared common basic linear transformation matrix.

[0009] In one embodiment, after determining the common basic linear transformation matrix and each extended linear transformation matrix, a heuristic logic minimization algorithm combined with a pruning strategy is used to globally optimize the XOR logic network that implements the common basic linear transformation matrix and the extended linear transformation matrix, so as to minimize the total number of XOR gates.

[0010] In one embodiment, the structure of the hierarchical parallel execution linear transformation network hardware unit satisfies the following: the computation of linear transformation is decomposed into a shared path based on a common fundamental matrix and independent paths based on each extended linear transformation matrix. The shared path and the independent paths of the selected algorithm are operated in parallel, and the outputs of the two paths are combined into the final result through XOR logic.

[0011] In one embodiment, the overall hardware overhead is quantified by the product of area and latency.

[0012] A reconfigurable S-box hardware architecture design device based on cross-layer collaborative optimization, the device comprising: The parameter determination module is used to determine a set of configurable pre-parameters for the composite field of the S-box to support multiple cryptographic algorithms, and to determine the corresponding linear transformation matrix for each algorithm based on the pre-parameters. The joint optimization module is used to jointly optimize the preconditions and the linear transformation matrix to minimize the overall hardware overhead, and solve for the globally optimal precondition configuration, a shared common basic linear transformation matrix, and the extended linear transformation matrix corresponding to each cryptographic algorithm. A nonlinear unit construction module is used to construct a parameterized composite domain inversion hardware unit according to the pre-configured parameters; the composite domain inversion hardware unit can dynamically configure its internal operation logic according to the pre-configured parameters. The linear unit construction module is used to construct hierarchical parallel execution linear transformation network hardware units based on the common basic linear transformation matrix and the extended linear transformation matrix; wherein the common basic linear transformation matrix is ​​calculated in parallel with all extended matrices; An integration module is used to integrate the composite field inversion hardware unit with the linear transformation network hardware unit to form a reconfigurable S-box hardware architecture that supports multiple cryptographic algorithms.

[0013] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program performing the following steps: By determining a set of configurable pre-parameters for the composite field of the S-box to support multiple cryptographic algorithms, and by determining the corresponding linear transformation matrix for each algorithm based on the pre-parameters; The pre-parameters and the linear transformation matrix are jointly optimized to minimize the overall hardware overhead, resulting in the globally optimal pre-parameter configuration, a shared common basic linear transformation matrix, and the extended linear transformation matrix corresponding to each cryptographic algorithm. Based on the aforementioned pre-configured parameters, a parameterized composite domain inversion hardware unit is constructed; the composite domain inversion hardware unit can dynamically configure its internal computational logic according to the aforementioned pre-configured parameters. Based on the common basic linear transformation matrix and the extended linear transformation matrix, a hierarchical parallel execution linear transformation network hardware unit is constructed; wherein the common basic linear transformation matrix is ​​computed in parallel with all extended matrices; The composite field inversion hardware unit is integrated with the linear transformation network hardware unit to form a reconfigurable S-box hardware architecture that supports multiple cryptographic algorithms.

[0014] A computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor: By determining a set of configurable pre-parameters for the composite field of the S-box to support multiple cryptographic algorithms, and by determining the corresponding linear transformation matrix for each algorithm based on the pre-parameters; The pre-parameters and the linear transformation matrix are jointly optimized to minimize the overall hardware overhead, resulting in the globally optimal pre-parameter configuration, a shared common basic linear transformation matrix, and the extended linear transformation matrix corresponding to each cryptographic algorithm. Based on the aforementioned pre-configured parameters, a parameterized composite domain inversion hardware unit is constructed; the composite domain inversion hardware unit can dynamically configure its internal computational logic according to the aforementioned pre-configured parameters. Based on the common basic linear transformation matrix and the extended linear transformation matrix, a hierarchical parallel execution linear transformation network hardware unit is constructed; wherein the common basic linear transformation matrix is ​​computed in parallel with all extended matrices; The composite field inversion hardware unit is integrated with the linear transformation network hardware unit to form a reconfigurable S-box hardware architecture that supports multiple cryptographic algorithms.

[0015] The aforementioned reconfigurable S-box hardware architecture design method and device based on cross-layer collaborative optimization introduces configurable composite domain pre-parameters, providing freedom for subsequent collaborative optimization. Furthermore, it jointly searches and optimizes parameters affecting the nonlinear part with the transformation matrix of the linear part to find the globally optimal solution that minimizes overall hardware overhead, achieving true cross-layer collaboration. After obtaining the optimization results, parameterized nonlinear inversion units and hierarchically parallel linear transformation network units are constructed. The nonlinear unit can be dynamically configured according to the optimal parameters, while the linear network unit extracts common computational parts and executes them in parallel with personalized parts, shortening the critical path through parallelization. The final integrated hardware architecture, while supporting dynamic switching between multiple algorithms such as AES, SM4, and Camellia, simultaneously achieves significant savings in hardware resources, effective improvement in computing speed, and optimization of overall energy efficiency, thus achieving an excellent balance between flexibility, high performance, and low cost. It is particularly suitable for resource-constrained embedded security applications such as the Internet of Things. Attached Figure Description

[0016] Figure 1 This is an application scenario diagram of a reconfigurable S-box hardware architecture design method based on cross-layer collaborative optimization in one embodiment; Figure 2 This is a flowchart illustrating a reconfigurable S-box hardware architecture design method based on cross-layer collaborative optimization in one embodiment. Figure 3 This is a schematic diagram illustrating the classification steps implemented by CFA in one embodiment; Figure 4 This is a flowchart illustrating the comparison of the overall architecture of the reconfigurable S-box in one embodiment; Figure 5 This is a schematic diagram of the cross-layer collaborative optimization steps in one embodiment; Figure 6 The following is a pseudocode flowchart of the Paar algorithm combined with pruning in one embodiment of the optimization phase; Figure 7 This is a schematic diagram comparing global collaborative optimization and traditional optimization in one embodiment; Figure 8 This is a structural block diagram of a reconfigurable S-box hardware architecture design device based on cross-layer collaborative optimization in one embodiment; Figure 9 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0018] The reconfigurable S-box hardware architecture design method provided in this application can be applied to integrated circuit design automation toolchains to automatically generate optimized hardware code for specific algorithm sets. For example... Figure 1 In the application environment shown, designers use design software on terminal 102 to set target algorithms (such as AES, SM4, Camellia) and optimization constraints, and submit the task to server 104 via network or local means. Server 104 runs the method described in this application, completes cross-layer collaborative optimization and hardware description generation, and returns the results to terminal 102. Terminal 102 can be, but is not limited to, various personal computers, laptops, workstations, etc., and server 104 can be implemented using a standalone server or a server cluster composed of multiple servers.

[0019] In one embodiment, such as Figure 2 As shown, a reconfigurable S-box hardware architecture design method based on cross-layer collaborative optimization is provided, and this method is applied to... Figure 1 Taking the server in the example, the following steps are included: Step 202 involves determining a set of configurable pre-parameters for the composite field of the S-box to support multiple cryptographic algorithms, and determining the corresponding linear transformation matrix for each algorithm based on the pre-parameters.

[0020] In this step, hardware is designed to support S-boxes for various cryptographic algorithms, such as AES, SM4, and Camellia. First, a set of configurable preconditions is determined to construct the arithmetic foundation of the composite field. These parameters are primarily the coefficients of the irreducible polynomials used to define the tower field structure. Unlike existing technologies that fix these coefficients, this invention treats them as variable. Based on the initially selected or iterative candidate parameter values, mathematical calculations are used to derive the linear transformation matrix of the S-box for each cryptographic algorithm under the corresponding composite field representation. These matrices serve as the starting point for subsequent optimization processes.

[0021] Step 204: Perform joint optimization on the pre-parameters and the linear transformation matrix to minimize the overall hardware overhead, and solve for the globally optimal pre-parameter configuration, a shared common basic linear transformation matrix, and the extended linear transformation matrix corresponding to each cryptographic algorithm.

[0022] Traditional methods either fix the nonlinear parameters and optimize the linear part separately, or optimize them separately and then combine them, both of which are local optimizations. This step considers the preconditions obtained in S202 and the linear transformation matrices of each algorithm together. The optimization objective is to minimize the estimated overall hardware overhead, such as the number of gates, critical path delay, or their product. A search algorithm is used to find a specific set of precondition values, and based on these values, an optimal common fundamental linear transformation matrix and a unique extended linear transformation matrix for each algorithm are collaboratively selected and calculated from the matrices of all algorithms. This ensures that the configurations of the nonlinear and linear parts are matched to achieve global optimum, rather than simply concatenating the optimal values ​​of each algorithm.

[0023] Step 206: Based on the pre-configured parameters, construct a parameterized composite domain inversion hardware unit.

[0024] The composite field inversion hardware unit can dynamically configure its internal operation logic based on the pre-configured parameters.

[0025] Based on the pre-parameter configuration obtained in S204, a composite domain inversion hardware unit is constructed. The key feature of this composite domain inversion hardware unit lies in its parameterization. Its internal implementation performs logical synthesis and optimization based on the pre-parameter configuration, but the architecture retains interfaces or features for dynamic configuration or customization based on the pre-parameter configuration. Different but equally efficient nonlinear cores can be generated for different optimal parameter results.

[0026] Step 208: Construct a hierarchical parallel linear transformation network hardware unit based on the common basic linear transformation matrix and the extended linear transformation matrix.

[0027] The common fundamental linear transformation matrix and all extended matrices are computed in parallel.

[0028] Based on the common fundamental linear transformation matrix obtained from S204 and the extended linear transformation matrix corresponding to each cryptographic algorithm, the hardware for the linear transformation part is constructed. Its structure is hierarchical and parallel: the implementation of the common fundamental linear transformation matrix constitutes a shared computation path, used by all algorithms; the implementation of each extended linear transformation matrix constitutes its corresponding independent path. Crucially, for a single S-box operation, the shared path and the independent path corresponding to the currently selected algorithm are executed in parallel, not sequentially. This is thanks to the definitions of the common fundamental linear transformation matrix and the extended linear transformation matrix, which allow the total transformation result to be output by bitwise XORing the two paths.

[0029] Step 210: Integrate the composite field inversion hardware unit with the linear transformation network hardware unit to form a reconfigurable S-box hardware architecture that supports multiple cryptographic algorithms.

[0030] The composite domain inversion hardware unit constructed by S206 and the hierarchical parallel linear transformation network unit constructed by S208 are integrated according to the standard computation order of the cryptographic algorithm S-box. This ultimately forms a complete, reconfigurable S-box hardware module that supports dynamic selection of multiple algorithms.

[0031] The aforementioned reconfigurable S-box hardware architecture design method based on cross-layer collaborative optimization introduces configurable composite domain pre-parameters, providing freedom for subsequent collaborative optimization. Furthermore, it jointly searches and optimizes parameters affecting the nonlinear part and the transformation matrix of the linear part to find the globally optimal solution that minimizes overall hardware overhead, achieving true cross-layer collaboration. After obtaining the optimization results, parameterized nonlinear inversion units and hierarchically parallel linear transformation network units are constructed. The nonlinear unit can be dynamically configured according to the optimal parameters, while the linear network unit extracts common computational parts and executes them in parallel with personalized parts, shortening the critical path through parallelization. The final integrated hardware architecture, while supporting dynamic switching between multiple algorithms such as AES, SM4, and Camellia, simultaneously achieves significant savings in hardware resources, effective improvement in computing speed, and optimization of overall energy efficiency, thus achieving an excellent balance between flexibility, high performance, and low cost. This makes it particularly suitable for resource-constrained embedded security applications such as the Internet of Things.

[0032] In one embodiment, the algebraic structures of four S-Boxes—AES, AES inverse, SM4, and Camellia—are analyzed, as shown in Table 1. It is observed that although these four S-Boxes are defined... The irreducible polynomials, affine matrices and constant vectors used may differ, but they can all be uniformly described by formula (1).

[0033] (1)

[0034] Table 1. Statistical Table of Mathematical Formulas for S-Boxes in Symmetric Cryptography Algorithms

[0035] in, express The inverse operation in , and This represents a set of configurable parameter matrices and constant vectors. Because in Finding the inverse of a given domain is too complex and consumes a lot of logical resources, leading to the development of Composite Field Arithmetic (CFA). The core idea of ​​CFA is to... The inverse operation in the domain is performed by equivalently transforming the domain to its subfield through isomorphic mapping. Specific implementation methods are categorized as follows: Figure 3As shown. This invention employs a tower domain construction method, that is, through a series of irreducible polynomials, to... Decomposed into , and .

[0036] Based on formula (1), the reconfigurable S-box design can be carried out. In order to simplify the matrix multiplication operation in the process, the parameter matrix and constant vector of each S-box are integrated with their corresponding isomorphic matrix. Thus, the general formula for the reconfigurable S-box based on the tower domain is (2), where, and Let be the isomorphic matrix used in the process, denoted as . and These are multiplication matrix pairs.

[0037] (2) This traditional architecture involves implementing the S-boxes that need to be reconstructed separately, and then combining these S-boxes using a multiplexer. This leads to several problems. For the nonlinear part, to allow multiple S-boxes such as AES, SM4, and Camellia to share the same composite domain inversion hardware, existing works generally choose a fixed set of common CFA irreducible polynomial parameters that are good enough for all target S-boxes. While this simplifies the inversion process, it limits the choice space of isomorphic matrices in the linear layer. For the linear part, there are two main problems: First, there is a lack of distinction between primary and secondary computational paths. The traditional architecture fails to structurally differentiate between primary and secondary computational paths, mixing high-frequency core computational logic shared by all algorithm S-boxes with low-frequency personalized computational logic unique to specific algorithm S-boxes. This design lengthens the overall critical path latency, thus reducing the system's maximum operating frequency. Second, there is local optima. Existing works generally adopt a strategy of post-optimization combination, that is, first independently optimizing the mapping matrices of each algorithm, and then superimposing them using a multiplexer. This method ignores the inherent correlation between different algorithm matrices, leading to significant overall resource redundancy.

[0038] Therefore, this invention proposes a reconfigurable shared architecture that modifies both linearity and nonlinearity, specifically as follows: Figure 4 As shown. For linear architectures, a basic shared matrix is ​​used. and 8 extended matrices Instead of the original 4 pairs of multiplication matrices This replacement method brings multiple advantages, particularly in terms of performance, because... and It can be executed in parallel, decomposing deep serial logic chains into low-depth parallel paths, thus mitigating the problem of excessively deep combinational logic. This is especially true if a shared matrix is ​​used. When chosen appropriately, resource consumption can be reduced, and resources can be reused when processing continuously related data. The calculation result, that is, only needs to be calculated This yields a linear result for the data. For nonlinear architectures, the inversion based on fixed irreducible polynomials is transformed into an inversion with variable parameters, making the nonlinear architecture applicable to any inversion operation based on the tower domain.

[0039] In a specific embodiment, step S202 is further explained. The configurable pre-parameters of the composite domain are specifically used to construct a tower decomposition of an 8th-order extended domain GF((2²)²)²). This construction proceeds from bottom to top: the bottom layer is GF(2²), which is composed of irreducible polynomials Constructing is a fixed and optimal choice. When constructing GF((2²)²) over GF(2²), irreducible polynomials are used. ,in As a configurable parameter derived from GF(2²), it is used as the first configurable parameter in this embodiment. When constructing the final GF(((2²)²)²) on GF((2²)²), an irreducible polynomial is used. , where λ is a configurable parameter taken from GF((2²)²), serving as the second configurable parameter. This set of parameters Together, they determine the isomorphic mapping relationship between the standard polynomial basis and the normal basis of this specific pyramidal field. The process of determining the linear transformation matrix for each algorithm is, in selecting... Under the premise of [missing information], the affine transformation matrix of the standard algorithm S-box is combined with the positive and negative isomorphic mapping matrix entering and exiting the pyramidal domain to calculate the equivalent binary matrix in the composite domain, which can be directly implemented using XOR gates. By [missing information] By setting it as a configurable variable, this method generates multiple sets of equivalent linear transformation matrix candidates for each algorithm, greatly expanding the optimization search space, which is the foundation for achieving subsequent global collaborative optimization.

[0040] The beneficial effect of this embodiment is that by constructing a parameterized pyramidal domain, a rich and adjustable mathematical representation space is provided for linear transformations, enabling optimization algorithms to find highly common matrix representations for different algorithms within this space, thereby creating the possibility for hardware sharing.

[0041] In another embodiment, the operation of the composite field inversion hardware unit on GF(((2²)²)²) is implemented based on the normal basis representation. The inversion operation of the composite field inversion hardware unit is performed by the following modular formula decomposition: for input A∈GF(((2²)²)²), the inversion operation The computation is decomposed into multiplication, squaring and inversion operations in the GF((2²)²) field. The Boolean logic expressions involving operations in GF((2²)²) and GF(2²) are optimized using the common subexpression elimination technique.

[0042] Specifically, to achieve a compact design of the reconfigurable S-box, this paper then proposes a cross-layer collaborative optimization design method, which involves the following steps: Figure 5 The optimization is shown. For the nonlinear part, a parameterized nonlinear hardware optimization architecture is designed, pre-parameters are set, and a modular design is implemented for the inversion operation. Combined with CSE algorithm optimization, the irreducible polynomial parameters are optimized. It can be dynamically configured according to different S-Boxes; for the linear part, a shared hierarchical optimization strategy is proposed, focusing on the selection of the basic shared matrix based on the threshold and the centralized optimization of the extended matrix. Finally, the Paar optimization method combined with pruning is used to optimize the two types of matrices respectively.

[0043] For the design of nonlinear inversion architecture, the tower domain is based on the normal basis representation. Arithmetic. Regular bases are chosen due to their unique advantage of near-zero hardware cost for squaring operations. Because... Since both polynomial and normal bases have the simplest inverse multiplication circuit and multiplier circuit, this invention fixes the irreducible coefficients. Finally, the irreducible polynomials and normal bases in Table 2 will be used to... Decomposed into , and .

[0044] Table 2. Formulas for Irreducible Polynomials in the Tower Domain

[0045] Table 2 The value comes from The root has two possible values. The value comes from and The root has 8 possible values. Therefore, it can be represented by formula (3). Through calculation, each S-box isomorphic matrix based on this inverse architecture has Various combinations.

[0046] (3)

[0047] The core idea of ​​this invention's variable inversion architecture is to... This pair of composite domain parameters is treated as configurable free variables in order to find the globally optimal solution that minimizes the overall hardware cost of both the linear and nonlinear parts. Assume... ,So Then its multiplication is inverse It can be calculated using formula (4).

[0048] (4) Based on formula (4), the optimization is divided into three modules, namely: Superior Dharma Instruments , sum of squares and inverter .because ,so These two are in Multiplication and its inverse operation can be represented by formulas (5) and (6).

[0049] (5) (6)

[0050] Similarly Assuming The inverse of multiplication is , Then it can be done using formulas (7) and (8). The operations of inversion and multiplication in Chinese.

[0051] (7) (8) pass The operations in the code are expanded using Boolean expressions, and circuit optimization is performed using the Common Subexpression Elimination (CSE) technique. For The multiplier, through observation, has 8 common elements, which are set as formula (9).

[0052] (9) Using these 8 elements, we can obtain the simplified version. The multiplier is given by formula (10).

[0053] (10) for The sum of squares was found to be derived directly from the Boolean expression of the sum of squares and then logically optimized. Therefore, the eight common elements are denoted as formula (11), where...

[0054] (11)

[0055] Thus, the simplified version is obtained. The formula for the sum of squares is (12).

[0056] (12)

[0057] Similarly, for The inverter extracts a series of highly reusable intermediate terms, denoted as formula (13). This yields formula (14). Inverseer.

[0058] (13) (14) In summary, the parametric nonlinear architecture of the invention, through modular decomposition and common expression elimination (CSE) optimization, ultimately achieves... The hardware costs of the multiplier, sum of squares, and inverter are optimized to only 29 XOR gates and 20 AND gates, 16 XOR gates and 2 AND gates, and 16 AND gates and 30 XOR gates, respectively. The inverse implementation on top of this architecture combines compactness and high reusability. More importantly, this architecture breaks through the limitations of existing fixed inverse designs: it can implement any inverse implementation on top of this architecture. and Inverse operation for finite field of pre-parameters.

[0059] This paper elaborates on the joint optimization process in step S204, particularly how to solve for the common fundamental linear transformation matrix. This embodiment employs a threshold-based voting selection mechanism. Assume that through S202, N candidate linear transformation matrices were generated for each of the AES, SM4, and Camellia algorithms. First, a frequency threshold T is set. Then, the total number of occurrences of each possible column vector (256 possibilities, corresponding to 8-bit binary columns) in all columns of all candidate matrices is counted. Finally, a selection process is performed: if the frequency of a column vector in all statistics is greater than or equal to the set threshold T, the column is considered frequent or common and is selected. Combining all selected column vectors forms a candidate common fundamental linear transformation matrix. The columns of this common fundamental linear transformation matrix are the frequently occurring columns in all algorithm candidate matrices, thus naturally containing the common parts of different algorithm computations. For each algorithm, its corresponding extended linear transformation matrix can be constructed by comparing its optimal candidate matrix with the common fundamental linear transformation matrix, extracting those algorithm-specific columns not covered by the common fundamental linear transformation matrix.

[0060] The beneficial effect of this embodiment is that it provides an intuitive, efficient, and automated method for extracting shared computing cores from a massive number of candidate matrices. This mechanism ensures that the common basic linear transformation matrix itself is compact and efficient, and its selection process is directly aligned with subsequent hardware sharing targets, laying a solid foundation for building efficient hierarchical parallel linear networks.

[0061] In another embodiment, after initially determining the common basic linear transformation matrix and each extended linear transformation matrix through a threshold voting mechanism, the circuitry implementing these matrices is further optimized. This embodiment employs a heuristic logic minimization algorithm, such as the classic Paar algorithm, combined with a pruning strategy, to globally optimize the XOR logic network of the entire set of matrices implementing the common basic linear transformation matrix and the extended linear transformation matrices. The optimization process does not optimize each matrix individually and then concatenate them; instead, it treats all intermediate XOR signals required to achieve all these matrix outputs as a single resource pool. The algorithm iteratively searches for XOR operations that can simultaneously generate shared intermediate signals for multiple matrix outputs, thereby maximizing logic reuse. The pruning strategy is used to eliminate intermediate signals that contribute little or no to the final output during the search process, preventing circuit bloat. The optimization objective is to minimize the total number of XOR gates required to implement the entire linear transformation network.

[0062] The beneficial effect of this embodiment is that, based on architecture-level sharing, it further achieves logic sharing and optimization at the circuit level. This global optimization can discover deeper logical commonalities across different algorithms and across shared and extended parts, thereby further compressing area and reducing power consumption at the transistor level, which is something that the traditional strategy of optimizing separately and then reusing cannot achieve.

[0063] In a specific embodiment, the linear transformation network for the four types of S-boxes, i.e., the basic shared matrix, is used. and extended matrix The optimization employs a hierarchical collaborative computing strategy, mainly consisting of two steps. The first step is the selection of a common fundamental linear transformation matrix. For the four types of S-boxes, simply performing an OR operation on eight matrices results in a fragmented shared matrix. Therefore, this invention uses a threshold-based voting mechanism to select a common fundamental linear transformation matrix that is both efficient and compact. That is, setting a threshold. ,when hour, Then, based on the evaluation criteria, the best candidate is selected. The matrix is ​​used to derive the extended linear transformation matrix that constitutes each S-box. In the optimization phase, PaaS combined with pruning algorithms is used for processing. The specific algorithm process is as follows: Figure 6 As shown. Among them, For input Target binary matrix. The initial sequence generated for the heuristic construction phase. This is the final sequence after pruning and optimization. The set of all currently available signals during the algorithm iteration process. This is the set of survival signals that contribute to the final output. : represents the input signal. It indicates the circuit's... _ original inputs (of which ) From 0 to ). It is a constant signal. For the matrix of The target output vector set consists of rows of vectors. To find the optimal XOR operation with the greatest benefit in a single iteration. : The output signal generated by the operation.

[0064] After determining the optimal candidate combination, it is necessary to expand the matrix. ( ) will be optimized, specifically as follows Figure 7 As shown, the general method is for the extended matrix in different S-boxes. First, optimize, that is, select the matrix combination with the least resource consumption, and then combine these optimized matrices into a module. That is, optimize first and then combine. However, this method ignores the inherent relationship between different matrices of different algorithms. In addition, since the pre-affine and post-affine are executed serially, this paper will use 8 extended matrices. Stacked vertically into one The composite transformation matrix is ​​then subjected to a one-time global optimization, which is a global collaborative optimization method that combines and then optimizes.

[0065] In one embodiment, the optimization objectives and evaluation metrics involved in steps S204 and S210 are explained. In this method, overall hardware overhead (ADP) is a key optimization objective. A preferred quantitative evaluation metric is the area-delay product (ADP). The area can be estimated by the estimated number of equivalent gates after synthesis, the number of lookup tables, or the silicon area after actual placement and routing. The delay can be the critical path delay of combinational logic. A smaller ADP value indicates higher overall efficiency in terms of both area and speed. During joint optimization (S204), the algorithm evaluates the ADP value for different combinations of preconditions and the resulting matrix combinations, seeking the minimum value. When finally evaluating the generated hardware architecture (S210), the ADP can also be measured in the FPGA or ASIC design flow and compared with existing designs. The advantage of using ADP as an optimization and evaluation metric is that it forces the optimization process to simultaneously balance resource consumption and performance, avoiding the extremes of pursuing minimum area at the expense of slow speed, or pursuing speed at the expense of area expansion. It guides the design towards a truly efficient PPA balance point, which is particularly important for resource-constrained IoT chip designs.

[0066] It should be understood that, although Figure 2 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2 At least some of the steps in the process may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least some of the sub-steps or stages of other steps.

[0067] In one embodiment, such as Figure 8 As shown, a reconfigurable S-box hardware architecture design device based on cross-layer collaborative optimization is provided, including: a parameter determination module 802, a joint optimization module 804, a nonlinear unit construction module 806, a linear unit construction module 808, and an integration module 810, wherein: The parameter determination module 802 is used to determine a set of configurable pre-parameters for the composite field of the S-box to support multiple cryptographic algorithms, and to determine the corresponding linear transformation matrix for each algorithm based on the pre-parameters. The joint optimization module 804 is used to jointly optimize the pre-parameters and the linear transformation matrix to minimize the overall hardware overhead, and solve for the globally optimal pre-parameter configuration, a shared common basic linear transformation matrix, and the extended linear transformation matrix corresponding to each cryptographic algorithm. The nonlinear unit construction module 806 is used to construct a parameterized composite domain inversion hardware unit according to the pre-configured parameters; the composite domain inversion hardware unit can dynamically configure its internal operation logic according to the pre-configured parameters. The linear unit construction module 808 is used to construct hierarchical parallel execution linear transformation network hardware units based on the common basic linear transformation matrix and the extended linear transformation matrix; wherein the common basic linear transformation matrix is ​​calculated in parallel with all extended matrices; The integration module 810 is used to integrate the composite domain inversion hardware unit with the linear transformation network hardware unit to form a reconfigurable S-box hardware architecture that supports multiple cryptographic algorithms.

[0068] In one embodiment, the composite domain can be configured with pre-parameters including at least coefficients for defining the structure of the pyramidal domain GF((2²)²)²), which is constructed stepwise by the following irreducible polynomials: GF(2²) is derived from definition; GF((2²)²) is derived from definition, These are configurable parameters taken from GF(2²); GF(((2²)²)²) is derived from Define λ as a configurable parameter taken from GF((2²)²).

[0069] In one embodiment, the operation of the composite field inversion hardware unit on GF(((2²)²)²) is implemented based on the normal basis representation, and the inversion operation of the composite field inversion hardware unit is performed by the following modular formula decomposition: for input A∈GF(((2²)²)²), the inverse operation The computation is decomposed into multiplication, squaring and inversion operations in the GF((2²)²) field. The Boolean logic expressions involving operations in GF((2²)²) and GF(2²) are optimized using the common subexpression elimination technique.

[0070] In one embodiment, a frequency threshold is set; the frequency of occurrence of each column vector in the linear transformation matrix corresponding to all cryptographic algorithms is counted; and column vectors with a frequency greater than or equal to the threshold are extracted and combined to form the shared common basic linear transformation matrix.

[0071] In one embodiment, after determining the common basic linear transformation matrix and each extended linear transformation matrix, a heuristic logic minimization algorithm combined with a pruning strategy is used to globally optimize the XOR logic network that implements the common basic linear transformation matrix and the extended linear transformation matrix, so as to minimize the total number of XOR gates.

[0072] In one embodiment, the structure of the hierarchical parallel execution linear transformation network hardware unit satisfies the following: it decomposes the computation of linear transformation into a shared path based on the common fundamental matrix and independent paths based on each extended linear transformation matrix. The shared path and the independent paths of the selected algorithm are operated in parallel, and the outputs of the two paths are combined into the final result through XOR logic.

[0073] In one embodiment, the overall hardware overhead is quantified by the product of area and latency.

[0074] Specific limitations regarding the reconfigurable S-box hardware architecture design device based on cross-layer collaborative optimization can be found in the limitations of the reconfigurable S-box hardware architecture design method based on cross-layer collaborative optimization mentioned above, and will not be repeated here. Each module in the aforementioned reconfigurable S-box hardware architecture design device based on cross-layer collaborative optimization can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0075] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 9 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides the environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The database stores algorithm libraries, parameter candidates, matrix data, etc. The network interface communicates with external terminals via a network connection. When the computer program is executed by the processor, it implements a reconfigurable S-box hardware architecture design method based on cross-layer collaborative optimization.

[0076] Those skilled in the art will understand that Figure 9 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0077] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps of the method described above.

[0078] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the method described above.

[0079] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0080] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0081] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A reconfigurable S-box hardware architecture design method based on cross-layer collaborative optimization, characterized in that, The method includes: By determining a set of composite field configurable pre-parameters for supporting multiple cryptographic algorithms S-boxes, and determining the corresponding linear transformation matrix for each algorithm based on the composite field configurable pre-parameters; The pre-parameters and the linear transformation matrix are jointly optimized to minimize the overall hardware overhead, resulting in the globally optimal pre-parameter configuration, a shared common basic linear transformation matrix, and the extended linear transformation matrix corresponding to each cryptographic algorithm. Based on the aforementioned pre-configured parameters, a parameterized composite domain inversion hardware unit is constructed; the composite domain inversion hardware unit can dynamically configure its internal computational logic according to the aforementioned pre-configured parameters. Based on the common basic linear transformation matrix and the extended linear transformation matrix, a hierarchical parallel execution linear transformation network hardware unit is constructed; wherein the common basic linear transformation matrix is ​​computed in parallel with all extended linear transformation matrices; The composite field inversion hardware unit is integrated with the linear transformation network hardware unit to form a reconfigurable S-box hardware architecture that supports multiple cryptographic algorithms. The composite domain can be configured with pre-parameters including at least coefficients for defining the structure of the pyramidal domain GF(((2²)²)²), which is constructed stepwise using the following irreducible polynomials: GF(2²) is derived from definition; GF((2²)²) is derived from Define φ as a configurable parameter taken from GF(2²); GF(((2²)²)²) is derived from Define λ as a configurable parameter taken from GF((2²)²).

2. The method according to claim 1, characterized in that, The operation of the composite field inversion hardware unit on GF(((2²)²)²) is implemented based on the normal basis representation, and the inversion operation of the composite field inversion hardware unit is performed by decomposing the following modular formula: For input A∈GF(((2²)²)²), the inverse operation A - The computation of ¹ is decomposed into multiplication, squaring and inversion operations in the GF((2²)²) field. The Boolean logic expressions involving operations in GF((2²)²) and GF(2²) are optimized using the common subexpression elimination technique.

3. The method according to claim 1, characterized in that, Joint optimization of the preconditions and the linear transformation matrix includes: Set an occurrence frequency threshold; Calculate the frequency of occurrence of each column vector in the linear transformation matrix corresponding to all cryptographic algorithms; The column vectors that appear with a frequency greater than or equal to a threshold are extracted and combined to form the shared common basic linear transformation matrix.

4. The method according to claim 3, characterized in that, After determining the common basic linear transformation matrix and each extended linear transformation matrix, a heuristic logic minimization algorithm combined with a pruning strategy is used to globally optimize the XOR logic network that implements the common basic linear transformation matrix and the extended linear transformation matrix, so as to minimize the total number of XOR gates.

5. The method according to claim 1, characterized in that, The structure of the hardware unit of the hierarchical parallel linear transformation network satisfies the following: the computation of linear transformation is decomposed into a shared path based on a common basic linear transformation matrix and independent paths based on each extended linear transformation matrix. The shared path and the independent paths of the selected algorithm are operated in parallel, and the outputs of the two paths are combined into the final result through XOR logic.

6. The method according to claim 1, characterized in that, The overall hardware overhead is quantified by multiplying the area by the latency.

7. A reconfigurable S-box hardware architecture design device based on cross-layer collaborative optimization, characterized in that, The device includes: The parameter determination module is used to determine a set of composite field configurable pre-parameters for supporting multiple cryptographic algorithms S-boxes, and to determine the corresponding linear transformation matrix for each algorithm based on the composite field configurable pre-parameters. The joint optimization module is used to jointly optimize the preconditions and the linear transformation matrix to minimize the overall hardware overhead, and solve for the globally optimal precondition configuration, a shared common basic linear transformation matrix, and the extended linear transformation matrix corresponding to each cryptographic algorithm. A nonlinear unit construction module is used to construct a parameterized composite domain inversion hardware unit according to the pre-configured parameters; the composite domain inversion hardware unit can dynamically configure its internal operation logic according to the pre-configured parameters. The linear unit construction module is used to construct hierarchical parallel execution linear transformation network hardware units based on the common basic linear transformation matrix and the extended linear transformation matrix; wherein the common basic linear transformation matrix is ​​calculated in parallel with all extended matrices; An integration module is used to integrate the composite domain inversion hardware unit with the linear transformation network hardware unit to form a reconfigurable S-box hardware architecture that supports multiple cryptographic algorithms. The composite domain can be configured with pre-parameters including at least coefficients for defining the structure of the pyramidal domain GF(((2²)²)²), which is constructed stepwise using the following irreducible polynomials: GF(2²) is derived from definition; GF((2²)²) is derived from Define φ as a configurable parameter taken from GF(2²); GF(((2²)²)²) is derived from Define λ as a configurable parameter taken from GF((2²)²).

Images