Elliptic curve cryptography oriented acceleration method and near-memory computing architecture

Abstract

The application provides an acceleration method and near-memory computing architecture for elliptic curve cryptography, including: a plurality of storage banks for storing input parameters, intermediate results and final results in the process of elliptic curve cryptography operation; at least one computing unit deployed in a near-memory manner beside the banks; the computing unit includes: a selector module for reading slice data from a designated bank and selecting current operation input data; a multiplication module for receiving operation input data and performing required large-bit-width multiplication operation; an addition array module for receiving multiplication results and additional parameters read from the bank, performing parallel addition or accumulation operation, and writing results back to the bank; a modulo operation module for receiving multiplication results and performing fast modulo reduction operation on a modulus, outputting modulo operation results and writing back to the storage bank; an inverse module for receiving a number A to be inverted and a modulus p, and outputting the modular inverse of A.

Description

Technical Field

[0001] This application relates to the fields of cryptography and information security technology, and in particular to an acceleration method and near-memory computing architecture for elliptic curve cryptography. Background Technology

[0002] Elliptic Curve Cryptography (ECC), with its core advantages of short key length and high security, has become a widely used public-key cryptography technology in fields such as data encryption, key exchange, digital signatures, IoT communication, and e-health. The security of ECC is based on the computational complexity of the elliptic curve discrete logarithm problem over finite fields. In ECC signature algorithms (such as the Elliptic Curve Digital Signature Algorithm ECDSA), dot multiplication is the core and most complex operation, and its performance directly determines the overall processing efficiency of the ECC cryptosystem. Dot multiplication is achieved through continuous dot doubling and iterative dot addition, and it highly relies on low-level arithmetic operations such as large-bit-width integer modular arithmetic and modular multiplication.

[0003] With the rapid development of 5G communication, cloud computing, and large-scale IoT, the demand for ECC signature throughput in high-concurrency scenarios such as server-side applications continues to rise, requiring support for batch signing operations of multiple messages corresponding to the same private key. Simultaneously, embedded devices and edge computing nodes place stringent demands on the low latency and high energy efficiency of ECC hardware. Existing ECC hardware implementations are mostly based on traditional compute-centric architectures, improving performance through optimizing multiplier structures, pipeline scheduling, or algorithmic improvements (such as the Montgomery ladder algorithm and the residue system). However, the data migration latency and power consumption overhead caused by the separation of storage and compute units have become the core bottleneck restricting breakthroughs in ECC performance.

[0004] Specifically, the existing ECC hardware architecture has the following technical problems in practical applications: (1) High latency of dot product operation. In traditional architecture, storage and computation are separated. During the dot product iteration process, intermediate results need to be frequently read and written between storage and computation units via the system bus. The memory access latency can account for more than 50% of the total computation latency. In addition, constant-time algorithms such as Montgomery's ladder are mostly implemented serially, which further increases the clock cycle consumption.

[0005] (2) Insufficient throughput of batch signatures. Existing solutions lack specific design for the scenario of "same private key, batch base point". When multiple base point operations are performed, the private key and intermediate data need to be loaded repeatedly, which cannot meet the performance requirements of high-concurrency signature scenarios on the server side.

[0006] (3) Algorithm compatibility and security are difficult to balance. Some architectures only support a single type of dot product algorithm. Switching between constant-time algorithms (used to resist time-series side-channel attacks) and conventional algorithms requires refactoring the hardware logic. In addition, the general-purpose modular arithmetic unit has redundant calculations, resulting in low hardware resource utilization.

[0007] (4) Low energy efficiency. Data transfer power consumption is much higher than computing power consumption. In traditional architectures, the power consumption of data transfer across storage and computing modules can account for more than 60% of the total system power consumption, which is not in line with the development trend of green computing.

[0008] Therefore, how to design an elliptic curve cryptography acceleration method and architecture that can reduce data migration overhead, support batch signing, be compatible with multiple dot product algorithms, and have high energy efficiency has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0009] In view of this, this application provides a constant-time data processing method and apparatus to solve at least one of the aforementioned problems.

[0010] To achieve the above objectives, this application adopts the following approach: According to a first aspect of this application, a near-memory computation architecture for elliptic curve cryptography is provided, comprising: Multiple storage banks are used to store the input parameters, intermediate results and final results in the elliptic curve cryptography process; At least one computing unit is deployed in a near-memory manner next to the storage bank and directly coupled to the storage bank, forming a closed-loop data link that reads data from the storage bank, processes it through the computing unit, and writes it directly back to the storage bank; The computing unit includes: The selector module, whose input is connected to the output of the storage bank, is used to read fragmented data from the specified storage bank and select the current operation input data according to the operation steps of the elliptic curve cryptography algorithm. The multiplication module, connected to the output of the selector module, is used to receive the operation input data, perform the large-bit-width multiplication operation required by elliptic curve cryptography, and output the multiplication result; The addition array module is directly interconnected with the multiplication module and the storage bank, respectively. It is used to receive the multiplication result and additional parameters read from the storage bank, perform the addition or accumulation operations required for elliptic curve cryptography in parallel, and write the operation result directly back to the storage bank. The modulo operation module, whose input is connected to the output of the multiplication module, is used to receive the multiplication result and perform fast modulo reduction operation on the modulus of the elliptic curve secp256r1 standard, and output a 256-bit modulo operation result, which is directly written back to the storage bank. The inverse module has its input connected to the storage bank. It receives the inverse number A and its modulus p and outputs the modulo p inverse of A. The inverse has the same bit width as p.

[0011] In some embodiments of this application, the plurality of storage banks includes at least two independent storage banks, each storage bank having a storage bit width of 512 bits, and the selector module reads 256 bits of fragmented data from the storage bank as the operation input data.

[0012] In some embodiments of this application, the multiplication module is specifically used to decompose a 256-bit multiplication into multiple 64-bit multiplications, and call an external multiplication execution array to complete the multiple 64-bit multiplications in a pipeline manner, so that the operation delay of a 256-bit multiplication is 5 clock cycles.

[0013] In some embodiments of this application, the above-mentioned modulo operation module includes a left shift unit and a modulo addition unit; The left shift unit is used to perform three left shift operations of 96 bits, 96 bits, and 64 bits respectively on the low-order part of the multiplication result within a single clock cycle. The modulus unit employs a combination of adders, subtractors, and selectors to complete the modulus reduction of 512 bits of data within 3 clock cycles.

[0014] In some embodiments of this application, the above-mentioned adder array module further includes: A configurable 256-bit adder / subtractor and a modulus-p correction unit connected to the output of the 256-bit adder / subtractor are provided to perform modulus-p operations on the addition / subtraction results so that the output results fall within the range of 0 to p-1, where p is the modulus of the secp256r1 elliptic curve.

[0015] In some embodiments of this application, the above-mentioned storage Bank is configured to support the data arrangement when performing elliptic curve dot product operations: the coordinates of the base point of the elliptic curve are stored in the preset address of the first group of Banks, the private key is stored in the preset address of the second group of Banks, and the infinity point and intermediate variables are stored in the preset address of the third group of Banks. The selector module is also used to read private key bits and coordinate data from the corresponding storage bank, and drive the multiplication module and the addition array module to iteratively perform point addition and doubling operations, wherein the infinity point is used to initialize the iteration, and the intermediate variables generated during the iteration and the intermediate results of the iteration are directly written back to the storage bank.

[0016] In some embodiments of this application, the aforementioned storage Bank is configured to support constant-time dot product algorithms; The selector module enables the computing unit to be compatible with the Montgomery ladder algorithm and the Joye double-and-add algorithm by switching the direction of reading private key bits from the storage bank.

[0017] In some embodiments of this application, the aforementioned plurality of storage banks are divided into multiple independent partitions; The storage bank is used to store the same private key and multiple sets of different elliptic curve base points, with each set of base points stored in a different bank partition. The computing unit is configured to perform multiple base point multiplication operations in batches after reading the private key once, thereby achieving batch multiplication under the same private key.

[0018] In some embodiments of this application, the above-mentioned storage bank contains 8 banks, with a depth of 128 and a bit width of 512 bits. In the batch dot product, the x-coordinates and y-coordinates of each set of base points are stored in different addresses of the same bank or in different banks.

[0019] According to a second aspect of this application, an acceleration method for elliptic curve cryptography is provided, comprising: It provides multiple storage banks for storing input parameters, intermediate results, and final results during elliptic curve cryptography operations; At least one computing unit is provided, which is deployed in a near-memory manner next to the storage bank and directly coupled to the storage bank, forming a closed-loop data link that reads data from the storage bank, processes it through the computing unit, and writes it directly back to the storage bank; The selector module in the computing unit reads fragmented data from the specified storage bank and selects the current computation input data according to the operation steps of the elliptic curve cryptography algorithm. The multiplication module in the computing unit receives the input data, performs the large-width multiplication operation required for elliptic curve cryptography, and outputs the multiplication result. The addition array module in the computing unit receives the multiplication result and additional parameters read from the storage bank, performs the addition or accumulation operations required for elliptic curve cryptography in parallel, and writes the operation result directly back to the storage bank. The modular arithmetic module in the computing unit receives the multiplication result and performs a fast modular reduction operation on the modulus of the elliptic curve secp256r1 standard, outputting a 256-bit modular arithmetic result, which is then directly written back to the storage bank. The inverse module in the computing unit receives the inverse number A to be calculated and the modulus p, and outputs the modulo p inverse of A, wherein the modulo p inverse has the same bit width as the modulus p.

[0020] As can be seen from the above technical solutions, the acceleration method and near-memory computing architecture for elliptic curve cryptography provided in this application completely eliminates the latency and power consumption caused by frequent data movement across the bus due to the separation of storage and computing units in traditional architectures. This significantly reduces the overall latency of dot product operations and improves energy efficiency. Moreover, this application utilizes the multi-port parallel access capabilities of multiple storage banks, combined with the flexible scheduling of fragmented data by the selector module, the large-width multiplication operation of the multiplication module, and the parallel addition / accumulation operation of the multiplication result and additional parameters by the addition array module. This allows intermediate results to complete iterative processing without leaving the tightly coupled storage-computation link, greatly improving the parallelism of operations. This provides a hardware foundation for batch dot product / signature of multiple base points under the same private key, effectively improving the signature throughput in high-concurrency scenarios on the server side. Meanwhile, the architecture of this application integrates selectors, multiplication modules and addition arrays in a modular manner, which can be flexibly configured to support various constant-time dot multiplication algorithms such as the Montgomery ladder algorithm and the Joye double-and-add algorithm, taking into account both security against side-channel attacks and algorithm compatibility, and avoiding repeated reconstruction of hardware logic. Attached Figure Description

[0021] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. In the drawings: Figure 1 This is a schematic diagram of a near-memory computing architecture for elliptic curve cryptography provided in an embodiment of this application; Figure 2This is a hardware architecture diagram of the modular inverse function based on the binary extended Euclidean algorithm provided in the embodiments of this application; Figure 3 This is a schematic diagram of the actual structure of a near-memory computing architecture for elliptic curve cryptography provided in an embodiment of this application; Figure 4 This is a hardware architecture diagram of the 512-bit data fast modular arithmetic module of the ECC secp256r1 standard provided in the embodiments of this application; Figure 5 This is an internal data path diagram of the adder array module provided in the embodiments of this application; Figure 6 This is a flowchart illustrating an acceleration method for elliptic curve cryptography provided in an embodiment of this application. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the embodiments of this application will be further described in detail below with reference to the accompanying drawings. Here, the illustrative embodiments and descriptions of this application are used to explain this application, but are not intended to limit this application.

[0023] As indicated in this application and claims, unless the context clearly indicates otherwise, the words "a," "an," "an," and / or "the" are not specifically singular and may include plural forms. Generally speaking, the terms "comprising" and "including" only indicate the inclusion of explicitly identified steps and elements, which do not constitute an exclusive list, and the method or apparatus may also include other steps or elements.

[0024] Furthermore, it should be noted that the use of terms such as "first" and "second" to define related concepts is merely for the purpose of distinguishing the corresponding concepts. Unless otherwise stated, these terms have no special meaning and therefore should not be construed as limiting the scope of protection of this application. In addition, although the terminology used in this application is selected from commonly known and used terms, some terms mentioned in this application's specification may have been chosen by the applicant according to his or her judgment, and their detailed meanings are explained in the relevant sections of this description. Moreover, this application should be understood not only through the actual terms used, but also through the meaning implied by each term.

[0025] like Figure 1 The diagram shown is a schematic of a near-memory computing architecture for elliptic curve cryptography provided in an embodiment of this application. The architecture includes: multiple storage banks 10 and at least one computing unit 20.

[0026] Storage Bank 10 is used to store input parameters, intermediate results, and final results during elliptic curve cryptography operations. Input parameters may include pre-configured static data such as elliptic curve base point coordinates, private keys, and modulo. Intermediate results include transient data generated during point addition, doubling, modular multiplication, and modular addition / subtraction operations. Final results include output coordinates of point multiplication operations or signature results. By setting up multiple independent or parallel-accessible storage Banks 10, this architecture provides high-bandwidth data supply capabilities for subsequent computing units 20 and lays the hardware foundation for supporting parallel processing of multiple sets of data.

[0027] The computing unit 20 is a hardware logic module that performs the core operations of elliptic curve cryptography. Unlike traditional "computation-centric" architectures where the computing unit and storage unit are far apart and interact via a bus, the computing unit 20 in this application is deployed adjacent to the storage bank 10 in a near-memory manner and is directly coupled to the storage bank 10. This near-memory arrangement means that the computing unit 20 is physically located close to the storage bank 10, with a very short signal transmission path between them, eliminating the need for on-chip buses or cross-chip data transfer. This direct coupling means that the input and output terminals of the computing unit 20 are directly connected to the read / write ports of the storage bank 10 without going through intermediate caches or bus arbitration logic.

[0028] Through this close-to-memory, direct coupling, the computing unit 20 and the storage bank 10 together form a closed-loop data link that reads data from the storage bank 10, processes it, and writes it back directly to the storage bank 10. In this link, data can complete the entire computation process without leaving the tightly coupled storage-computing region, thus completely eliminating the memory access latency and power consumption overhead caused by data repeatedly crossing the bus in traditional architectures. This significantly reduces the overall latency of iterative operations such as elliptic curve multiplication and improves energy efficiency.

[0029] Furthermore, to fully support the various low-level operations required for elliptic curve cryptography (such as modular multiplication, modular addition / subtraction, data selection and routing, etc.), the computation unit 20 in this embodiment specifically includes a selector module 21, a multiplication module 22, an addition array module 23, a modular operation module 24, and an inversion module 25. These modules cooperate with each other to automatically complete the computation task in a data flow-driven manner according to the operation steps of the elliptic curve cryptography algorithm. Wherein: The input of selector module 21 is connected to the output of storage Bank 10. This module is used to read fragmented data from the specified storage Bank 10 and select the current operation input data according to the operation steps of the elliptic curve cryptography algorithm.

[0030] Specifically, since multiple storage banks 10 may simultaneously store various types of data (such as coordinates of different base points, different bits of the private key, intermediate variables, etc.), the selector module 21 can select a specified bank or group of banks from the multiple storage banks 10 according to the needs of the current operation stage (e.g., whether to perform point addition or doubling, whether to read private key bits or coordinate data), and read the corresponding data fragments from its output port. Simultaneously, the selector module 21 also has a data selection function. When there are multiple optional data sources for a certain operation step (e.g., an operand in an addition array can come from the multiplication result or directly from a storage bank), the selector module 21 selects the correct input data according to preset control logic and sends it to the subsequent operation unit. This module's configuration allows data scheduling to proceed without external processor intervention, realizing a streaming processing mode where computation is automatically triggered once the stored data is ready.

[0031] The multiplication module 22 is connected to the output of the selector module 21 and is used to receive the operation input data output by the selector module 21, perform the large-width multiplication operation required by elliptic curve cryptography, and output the multiplication result.

[0032] In elliptic curve cryptography, modular multiplication is a core and frequently used low-level operation, and its performance directly affects the efficiency of point addition and doubling. In this embodiment, the multiplication module 22 is specifically designed for multiplication of large-width integers (typically 256 bits or more) in the ECC algorithm. It can receive two large-width operands from the selector module 21, complete the multiplication operation, and output a multiplication result with double the width. This multiplication result will then be sent to the adder array module 23 or the modular operation unit 24 (in this embodiment, the modular reduction simple unit can be regarded as a functional module working in conjunction with the adder array module, but its specific implementation is not limited to this embodiment) for further processing. The direct connection between the multiplication module 22 and the selector module 21 avoids additional caching of intermediate results and further shortens the data path.

[0033] The addition array module 23 is directly interconnected with the multiplication module 22 and the storage Bank 10, respectively. It is used to receive the multiplication result and additional parameters read from the storage Bank 10, perform the addition or accumulation operations required for elliptic curve cryptography in parallel, and write the operation result directly back to the storage Bank 10.

[0034] Elliptic curve cryptography's point addition and doubling operations require not only multiplication but also numerous addition, subtraction, and accumulation operations, such as summing intermediate values ​​in affine or projective coordinate systems and simplifying multiplication results. The adder array module 23 is designed as an adder array with parallel processing capabilities, capable of simultaneously receiving multiple data sources (e.g., a multiplication result as one input and another parameter read from storage Bank 10 as another input), completing addition, subtraction, or accumulation operations within one or more clock cycles. Since the adder array module 23 is directly interconnected with storage Bank 10, its operation results can be directly written back to the designated storage Bank 10 without any buffering or bus arbitration, thus completing a full cycle of the "storage-computation-storage" closed-loop data link.

[0035] Modular operation module 24, whose input is connected to the output of multiplication module 22, is used to receive the multiplication result and perform fast modular reduction operation on the modulus of the elliptic curve secp256r1 standard, and output a 256-bit modular operation result, which is directly written back to the storage bank.

[0036] The input of the modulo operation module 24 is connected to the output of the multiplication module 22, and is used to directly receive the multiplication result output by the multiplication module 22 (for example, for a 256-bit multiplication, the multiplication result is a large-width data of 512 bits). The modulo operation module 24 is specifically configured for the modulus p (i.e., p=2) of the elliptic curve secp256r1 standard. 256 2 224 +2 192 +2 96 1) Perform fast modular reduction operation. By customizing the logic design of the mathematical structure of the specific modulus, the modular operation module 24 can replace the multiple division or trial division operations required for general modular reduction with a combination of simple operations such as shifting and addition, thereby completing the reduction with lower hardware overhead and fewer clock cycles.

[0037] After rapid modular reduction, the modular operation module 24 outputs a 256-bit modular operation result, which is the final modular multiplication result required in elliptic curve cryptography. Consistent with the design principles of other modules in the computing unit 20, this 256-bit modular operation result is directly written back to the storage Bank 10 without going through an external bus or intermediate cache. Through the above configuration, the modular operation module 24, together with the multiplication module 22, the selector module 21, and the adder array module 23, construct a complete near-memory modular multiplication data path: the operands provided by the storage Bank 10 are sent to the multiplication module 22 via the selector module 21 to complete the large-width multiplication, the multiplication result flows directly into the modular operation module 24 to complete the modular reduction, and the reduced result is then directly written back to the storage Bank 10. The entire process flows entirely within the storage-computation closed-loop link, further reducing the memory access latency and power consumption of the modular multiplication operation.

[0038] The inverse module 25, whose input is connected to the storage Bank 10, is used to receive the inverse number A to be calculated and the modulus p, and output the modulo p inverse of A, wherein the inverse has the same bit width as p.

[0039] The inversion module 25 is located inside the computing unit 20. Its input data path comes from storage Bank10: the inverse number A to be calculated (e.g., the denominator value in elliptic curve affine coordinates or an intermediate value in the signature process) and the modulus p of the secp256r1 curve. After being selected by the selector module 21, the data is sent to the input terminal of the inversion module. The inversion module 25 internally uses the binary extended Euclidean algorithm to implement large integer modular inversion operations. For details, please refer to [link to documentation]. Figure 2 This is a hardware architecture diagram of the modular inverse function implemented based on the binary extended Euclidean algorithm provided in this application embodiment. Since the inverse algorithm itself is prior art, for... Figure 2 I will not go into further detail. Since the modulus p is a prime number, the inversion module can utilize the mathematical structure of p to optimize the iterative process and reduce the computation cycle.

[0040] The output of the inverse module 25 can be directly written back to storage Bank10. The output inverse has the same bit width (256 bits) as the modulus p, ensuring that the data bit width is consistent with other operation modules of elliptic curve cryptography (multiplication module, modulus operation module, addition array module), without the need for additional bit width conversion logic.

[0041] By integrating the inversion module 25 into the computing unit 20 in a near-memory manner, this application avoids the significant latency and power consumption caused by the repeated data transfer to a dedicated coprocessor or software computation required in traditional architectures. Simultaneously, the direct coupling between the inversion module 25 and the storage Bank 10 allows intermediate results to be written back instantly without waiting for bus arbitration, thereby accelerating the inversion steps required in elliptic curve point operations. Those skilled in the art will understand that, although... Figure 2The inversion module 25 is shown as an independent module, but in some implementations, the inversion module 25 can also reuse the computing resources of the multiplication module and the addition array module to realize the modular inversion operation through microprogram control, so as to reduce the hardware area.

[0042] Through the collaborative operation of the selector module 21, multiplication module 22, addition array module 23, and modular operation module 24, the near-memory computing architecture provided in this embodiment can automatically complete low-level operations such as modular multiplication and modular addition / subtraction in elliptic curve cryptography in a data flow-driven manner, and on this basis, support the efficient execution of point addition, doubling, and even full point multiplication operations. All intermediate results flow in a closed-loop link between storage Bank 10 and computing unit 20 without the need for cross-bus transfer, thus fundamentally solving the technical problems of high memory access latency, high power consumption for data transfer, and limited parallelism in traditional solutions at the hardware architecture level.

[0043] It should be noted that this embodiment only describes the most basic architectural structure for implementing the technical solution of this application. In actual implementation, those skilled in the art can optimize or adjust the number and bit width of the storage Bank10, the specific implementation method of the internal modules of the computing unit, the pipeline depth of the data path, etc., without departing from the principles of this application, and these all fall within the protection scope of this application. Further preferred features (such as the specific storage bit width sharding method, the specific decomposition implementation of the multiplication module, the fast reduction of the modular arithmetic module, the modular correction unit in the addition array, the inversion module, the data arrangement of batch dot product, etc.) will be described in detail in subsequent embodiments.

[0044] As can be seen from the above technical solution, the near-memory computing architecture for elliptic curve cryptography provided in this application, by deploying the computing units near the storage bank and forming a closed-loop data link, completely eliminates the latency and power consumption caused by frequent data movement across the bus due to the separation of storage and computing units in traditional architectures. This significantly reduces the overall latency of dot product operations and improves energy efficiency. Moreover, this application also utilizes the multi-port parallel access capabilities of multiple storage banks, combined with the flexible scheduling of fragmented data by the selector module, the large-width multiplication operation of the multiplication module, and the parallel addition / accumulation operation of the multiplication result and additional parameters by the addition array module. This allows intermediate results to complete iterative processing without leaving the tightly coupled storage-computation link, greatly improving the parallelism of operations. This provides a hardware foundation for batch dot product / signature of multiple base points under the same private key, effectively improving the signature throughput in high-concurrency scenarios on the server side. Meanwhile, the architecture of this application integrates selectors, multiplication modules, addition arrays and modular operation modules in a modular manner, which can be flexibly configured to support various constant-time dot multiplication algorithms such as Montgomery ladder and Joye double addition, taking into account both security against side-channel attacks and algorithm compatibility, and avoiding repeated reconstruction of hardware logic.

[0045] In some embodiments of this application, the plurality of storage banks 10 include at least two independent storage banks, each storage bank having a storage bit width of 512 bits, and the selector module reads 256 bits of fragmented data from the storage bank as the operation input data.

[0046] Specifically, such as Figure 1 As shown, the aforementioned multiple storage banks 10 include at least two independent storage banks, such as, but not limited to, Bank0, Bank1, ..., Bank7, totaling eight independent storage banks. The storage bit width of each storage bank is set to 512 bits. The choice of a 512-bit bit width fully considers the typical large bit width operands of elliptic curve cryptography (such as the secp256r1 curve) and the demand for high-bandwidth data supply during dot product iteration. The wider storage bit width allows each storage bank to output 512 bits of continuous data in a single read operation, thereby providing sufficient data throughput for the computing unit.

[0047] On the other hand, to match the processing bit width of each module within the computing unit 20 (especially the multiplication module 22 and the addition array module 23), the selector module 21 reads 256 bits of fragmented data from the storage Bank 10 as the input data for the operation. Specifically, when the selector module 21 reads data from a 512-bit wide storage Bank 10, it can split the 512-bit data into a high 256-bit part and a low 256-bit part in a fragmented manner, and select one of the fragments (high 256 bits or low 256 bits) or send the two fragments of data as two independent 256-bit operands to the subsequent multiplication module 22 or addition array module 23, depending on the needs of the current operation step.

[0048] With the above configuration, on the one hand, the 512-bit wide storage width supports reading two 256-bit operands in a single operation, effectively utilizing the bandwidth resources of the storage bank, reducing the number of read operations, and simultaneously enabling a hardware parallelism of 2. On the other hand, the 256-bit slice processing width matches the typical ECC key length (256 bits), avoiding wasted computing unit bandwidth and simplifying the circuit design of the multiplication and addition array modules. Simultaneously, the existence of multiple independent storage banks allows the selector module to read different 256-bit slice data from different banks simultaneously, providing data source support for the parallel accumulation operation of the subsequent addition array module, further improving the throughput efficiency of the dot product iteration.

[0049] It should be noted that the specific number of storage banks (e.g., 2, 4, 8 or more) and the fragmentation method (e.g., splitting 512 bits into two 256-bit segments) in this embodiment are merely exemplary configurations. Those skilled in the art can adaptively adjust the bit width and fragmentation granularity of the storage banks according to the actual elliptic curve parameters (e.g., 192 bits, 384 bits, 521 bits, etc.) and the target hardware resource constraints. All such variations should fall within the protection scope of this application.

[0050] In some embodiments of this application, the multiplication module 22 is specifically used to decompose a 256-bit multiplication into multiple 64-bit multiplications, and call an external multiplication execution array to complete the multiple 64-bit multiplications in a pipeline manner, so that the operation delay of a 256-bit multiplication is 5 clock cycles.

[0051] In elliptic curve cryptography, modular multiplication involves multiplying two large 256-bit integers. Directly using a full-width multiplier would introduce extremely high logic gate overhead and critical path latency. This embodiment employs the Karatsuba algorithm or traditional shift-addition Schoolbook Multiplication to recursively decompose the 256-bit multiplication into several smaller 64-bit multiplication operations. For example, the 256-bit multiplication can be decomposed into a combination of multiple 64-bit multiplications using traditional shift-addition. Specific decomposition methods include, but are not limited to: splitting the 256-bit operand into 16 64-bit segments, and through multi-level decomposition and combination, finally calling the basic 64-bit multiplier to complete all sub-multiplication operations.

[0052] The external multiplication execution array (AE array) is a specially optimized small-bit-width multiplication hardware unit capable of pipelinedly receiving and executing multiple 64-bit multiplication tasks. Each 64-bit multiplication can be completed within one clock cycle. Through pipelined design, the multiplication module 22 can sequentially push the decomposed multiple 64-bit multiplications into the AE array, and the AE array outputs a 64-bit multiplication result each clock cycle. Combined with accumulation and recombination logic, the multiplication module 22 outputs a complete 512-bit multiplication result after an appropriate number of pipeline stages.

[0053] Through the above design, the overall operation latency of a 256-bit multiplication is stably controlled within 5 clock cycles. Compared with traditional full-width multipliers or serial decomposition schemes, the operation latency is significantly reduced, meeting the requirements of high-performance cryptographic operations for throughput and response speed. Moreover, the use of an external 64-bit multiplication execution array allows the small-width multiplier to be reused by multiple upper-layer operation modules, improving the utilization of hardware resources.

[0054] It should be noted that decomposing a 256-bit multiplication into multiple 64-bit multiplications is only one specific implementation of this embodiment. Depending on the target elliptic curve parameters (such as 192 bits, 384 bits, 521 bits) and the granularity of the underlying multiplier, those skilled in the art can adjust the bit width of the decomposition (such as decomposing it into 16-bit multiplication or 64-bit multiplication) and the pipeline depth accordingly, and these variations should all fall within the protection scope of this application.

[0055] The above structure can also be found in Figure 3 , Figure 3 This is a structural diagram of a near-memory computing architecture provided in an embodiment of this application. Multiple storage banks (e.g., Bank0 to Bank7) each provide a 512-bit data bus. The selector module extracts 256-bit operands a and b from the 512-bit data output from these banks, and routes a, b, or a constant c to the multiplication module or addition array module according to the operation steps of the elliptic curve cryptography algorithm. The modulus p is sent to the modulus p correction unit in the modulus operation module and the addition array module for modulus reduction and range correction. The entire architecture achieves seamless data flow between the storage banks and each computing unit through the flexible scheduling of the selector module. It should be noted that... Figure 3 The output of the modulo operation module 24 is connected not only to the storage Bank 10, but also to the input of the adder array module 23. Specifically, the 256-bit modulo reduction result output by the modulo operation module 24 is simultaneously routed in two directions: one path is written directly back to the storage Bank 10 for persistent storage or use in subsequent iterations; the other path is directly fed into the adder array module 23 as one of its input operands. The other input operand of the adder array module 23 is read directly from the storage Bank 10. The adder array module 23 performs the addition, subtraction, or accumulation operations required for elliptic curve point addition or doubling operations on these two inputs, and writes the result back to the storage Bank 10.

[0056] In some embodiments of this application, such as Figure 4 The diagram shows the hardware architecture of the fast modulo operation module for 512-bit data in the ECC secp256r1 standard. Through block processing and hardware parallelization, it can complete the modulo operation of 512-bit data with the secp256r1 modulus p in 3 clock cycles, and is naturally adapted to pipelining. The modulo operation module includes a left shift unit and a modulo addition unit. The left shift unit performs three left shift operations of 96 bits, 96 bits, and 64 bits respectively on the low-order part of the multiplication result in a single clock cycle. The modulo addition unit uses a combination of adders, subtractors, and selectors to complete the modulo reduction of 512-bit data in 3 clock cycles.

[0057] As can be seen, the above ECC modulo operation consists of two parts: left shift and modulo addition. The left shift part, through three left shift operations, can reduce 96 bits / 96 bits / 64 bits respectively within one cycle, realizing a fast modulo reduction algorithm; the modulo addition part accumulates the intermediate results. Taking the first left shift as an example, the input receives a 512-bit result from a 256-bit multiplier. Split it into high position (256 bits) and low-order bits (256 bits); for Perform a left shift operation and sum the results to obtain a 416-bit intermediate value. , and then Split into high position (256 bits) and low-order bits (160 bits), and the subsequent steps follow the same pattern. The mathematical principle is as follows: .

[0058] Compared to traditional ECC modular computing architecture, this application has the following core advantages: 1. High-speed operation: Through block processing and hardware parallelization design, the secp256r1 modulo operation of 512-bit data can be completed in 3 cycles, and the operation latency is only 1 / 5 to 1 / 8 of the traditional serial modulo reduction architecture. 2. Pipeline operation compatibility: The fixed 3-cycle operation cycle is naturally adapted to pipeline operation and can be used with the pipelined read and write of the storage bank in the memory-centric architecture to support seamless modular operation of multiple sets of data. 3. Modulus adaptability: The hardware logic is optimized for the mathematical structure of the modulus p of secp256r1, avoiding redundant calculations in general modular arithmetic, and reducing hardware resource overhead by more than 30% compared with general modular arithmetic units. 4. Proximity to storage: Adapts to the bit width and read / write cycle depth of the storage bank, eliminating data migration delays and improving the energy efficiency of the modular computing stage by more than 40%.

[0059] Those skilled in the art will understand that although this embodiment uses the secp256r1 curve as an example for illustration, for other elliptic curves with special structural moduli (such as secp256k1, SM2, etc.), by making corresponding adaptations and adjustments to the reduction logic of the modulo operation module 24, fast modulo reduction can also be achieved under the technical architecture of this application, and these variations should all fall within the protection scope of this application.

[0060] In some embodiments of this application, the above-mentioned adder array module 23 further includes: a configurable 256-bit adder / subtractor, and a modulus-p correction unit connected to the output of the 256-bit adder / subtractor, for performing modulus-p operations on the addition / subtraction results to ensure that the output results fall within the range of 0 to p-1, where p is the modulus of the secp256r1 elliptic curve. See details... Figure 5 The diagram illustrates the internal data path of the adder array module 23, with the red line indicating the ECC modulo addition / modulo subtraction data path. For example, data a and b are read from address 0 of bank0 and address 128 of bank1. a and b first pass through a configurable 256-bit adder / subtractor. After the operation, they undergo modulo operation via a modulo-p correction unit, ensuring the result falls within the range [0, p-1]. The calculation result can then be written to address 256 of bank2.

[0061] Figure 5 The diagram also illustrates the relationship between the multiplexer and the adder array. For example, the coeff_mode signal is used to control the coefficient multiplication mode. These control signals are generated by the upper-level state machine, and those skilled in the art can configure them according to the specific algorithm flow. This will not be elaborated further here.

[0062] In some embodiments of this application, the storage Bank 10 is configured to support the data arrangement when performing elliptic curve dot product operations: the coordinates of the elliptic curve base point are stored in a preset address of the first group of banks, the private key is stored in a preset address of the second group of banks, and the infinity point and intermediate variables are stored in a preset address of the third group of banks.

[0063] The aforementioned storage Bank10 is configured to support specific data arrangements for elliptic curve dot product operations, adapting to the data access patterns of dot product algorithms such as the Montgomery ladder or Joye double-and-add. Specifically: The coordinates of the elliptic curve base points are stored at preset addresses in the first group of banks. For example, the x-coordinate of base point P is stored at address 0 of Bank 0, and the y-coordinate is stored at address 50 of Bank 0. The coordinates of other base points can be stored sequentially in adjacent banks or different address regions within the same bank.

[0064] The private key k is stored at a preset address in the second group of banks. For example, the individual bits of the private key can be stored consecutively in a storage space starting at address 100 in Bank0, with each address storing 256 bits of data (containing multiple private key bits or the complete private key).

[0065] The point at infinity and intermediate variables are stored at a preset address in the third group of banks. The point at infinity serves as the initial value for the dot product iteration and is pre-stored at a specified address (e.g., address 256 in Bank2 and address 406 in Bank3). Intermediate variables generated during the iteration process are also stored in the corresponding address area of ​​this group of banks.

[0066] The selector module 21 is also used to read private key bits and coordinate data from the corresponding storage bank, and drive the multiplication module and the addition array module to iteratively perform point addition and doubling operations, wherein the infinity point is used to initialize the iteration, and the intermediate variables generated during the iteration and the intermediate results of the iteration are directly written back to the storage bank.

[0067] At the start of each iteration, selector module 21 reads the current bits of the private key (e.g., consecutive bits starting from address 100) from the second group of banks to determine whether to perform point addition or maintain the original path for this iteration. At the same time, selector module 21 reads the base point coordinates and the current intermediate variables from the first and third groups of banks as input operands for multiplication module 22 and addition array module 23.

[0068] After the multiplication module 22 and the addition array module 23 complete the point addition and doubling operations, the new intermediate results generated are directly written back to the third group of Banks (i.e., the preset address where the intermediate variables are located) of storage Bank10 through the output of the calculation unit 20 for use in the next iteration.

[0069] Crucially, at the start of each iteration, the infinity point is loaded as the initial value for the first iteration's initialization. As iterations progress, all intermediate variables and the intermediate results generated by each dot-multiplication / doubling operation follow a closed-loop data link of storage-computation-storage, being directly written back to the storage bank without needing external caches or bus relays. This design avoids the additional latency and power consumption caused by moving intermediate results to off-chip storage or waiting for bus arbitration after each iteration, as is common in traditional architectures, significantly improving the overall efficiency of dot-multiplication operations.

[0070] Those skilled in the art will understand that the above data arrangement is merely an exemplary configuration. In actual implementation, the address allocation of each Bank can be flexibly adjusted according to the number and depth of the storage Banks and the coordinate system (affine, projective, or hybrid coordinate system) selected by the algorithm, as long as the base point, private key, and intermediate variables are distributed in different Banks or Bank areas. All these variations should fall within the protection scope of this application.

[0071] In some embodiments of this application, the storage Bank 10 is also configured to support constant-time dot product algorithms; the selector module 21 enables the computing unit to be compatible with the Montgomery ladder algorithm and the Joye double-and-add algorithm by switching the direction of reading private key bits from the storage Bank.

[0072] Specifically, both the Montgomery ladder algorithm and the Joye double-and-add algorithm are constant-time dot multiplication algorithms. Their core idea is that regardless of whether the private key bits are 0 or 1, the same number and type of operations (dot addition and doubling) are performed in each iteration, thus preventing attackers from inferring private key information by analyzing the operation timing. The main difference between the two lies in the order and direction in which the private key bits are read during iteration: The Montgomery ladder algorithm typically scans from the most significant bit to the least significant bit of the private key (i.e., from left to right), and in each iteration, it selects which intermediate variable to update based on the current bit value.

[0073] The Joye double-and-add algorithm can scan from the least significant bit to the most significant bit (i.e., from right to left), or in other directions, and its data dependency differs from that of the Montgomery ladder.

[0074] This application achieves compatibility between two algorithms through the flexible configuration of the selector module 21. Specifically, the private key stored in Bank10 is stored as a continuous bit sequence (e.g., the complete 256-bit private key is stored at address 100 in Bank0). The selector module 21 internally contains a configurable address increment / decrement control logic: when configured in Montgomery ladder mode, the selector module 21 starts from the address of the most significant bit of the private key and automatically increments (or decrements) the address pointer after each iteration, reading the private key bits one by one. When configured in Joye double-and-add mode, the selector module 21 starts from the address of the least significant bit of the private key and reads the private key bits one by one in the opposite direction required by the algorithm.

[0075] Since the storage location of the private key remains unchanged, only the direction in which the selector module reads the private key bits (i.e., the direction of the address pointer movement) needs to be changed. The multiplication module 22, the addition array module 23, and the modular arithmetic module 24 in the computation unit 20 do not require any modifications to fully support the two constant-time dot product algorithms. This design allows the hardware logic to switch between different algorithms without requiring refactoring or reconfiguration of the computation unit; only the reading direction of the selector module needs to be modified via the control register.

[0076] Furthermore, the address space storing Bank10 is divided into multiple independently accessible regions, allowing the intermediate variables required by both algorithms to be stored in the Bank simultaneously without conflict. The selector module 21 selects the corresponding intermediate variable address based on the current algorithm type and sends it to the processing unit for processing.

[0077] With the above configuration, this application achieves hardware-level compatibility with two mainstream constant-time dot product algorithms while maintaining the high energy efficiency and low latency advantages of near-in-memory computing architecture. This provides flexible options for different security requirements and application scenarios, and avoids the hardware overhead of repeatedly instantiating computing units to support multiple algorithms in traditional designs.

[0078] In some embodiments of this application, the aforementioned multiple storage banks 10 are divided into multiple independent partitions; the aforementioned storage banks 10 are used to store the same private key and multiple sets of different elliptic curve base points, with each set of base points stored in a different bank partition; the aforementioned computing unit 20 is configured to perform batch multiplication operations on multiple sets of base points after reading the private key once, thereby realizing batch multiplication under the same private key.

[0079] As a specific implementation, this application employs eight storage banks (Bank0 to Bank7), each with a storage depth of 128 and a bit width of 512 bits. This configuration fully utilizes the parallel access capability of multiple banks, providing sufficient data bandwidth and storage capacity for batch multiplication.

[0080] The aforementioned storage Bank10 is configured to store the same private key and multiple sets of different elliptic curve base points. The same private key k is stored in a shared partition (e.g., address 100 of Bank0). Multiple sets of base points are stored in different Bank partitions or different address regions within the same Bank. The specific address mapping rules are as follows: the x-coordinate of each set of base points is stored at address x in a certain Bank (x ranges from 0 to 49), and the corresponding y-coordinate is stored at address x+50 in the same Bank. Since each address has a storage width of 512 bits, and each base point coordinate (x or y) is 256 bits, each 512-bit address can simultaneously store the x-coordinates (or y-coordinates) of two base points, occupying the high 256 bits and low 256 bits respectively. Therefore, each Bank's 50 addresses (addresses 0-49) can store the x-coordinates of 100 base points, and the corresponding addresses 50-99 store the y-coordinates of these 100 base points. By distributing multiple sets of base points across different addresses in 8 Banks, parallel loading of up to 100 sets of base points in a single batch can be achieved.

[0081] Based on the above data arrangement, the above computing unit 20 is configured to: after reading the private key once, perform batch multiplication operations on multiple sets of base points, thereby achieving batch multiplication under the same private key. Specifically: First, selector module 21 reads private key k from the partition where the private key is located (e.g., Bank0 address 100) and temporarily stores it in the register inside the selector module or directly latches it to the input of multiplication module 22.

[0082] Subsequently, for each set of base points Pi (i=1,2,...,100), computation unit 20 sequentially (or in a pipelined manner) performs the dot product operation Qi=kP. Since the private key kk does not change after the first read, there is no need to repeatedly load the private key during the dot product process of subsequent sets of base points; only the selector module 21 needs to switch the base point data source. Specifically, the selector module 21 reads the x and y coordinates of the current base point from the corresponding Bank address (for example, reads the x coordinate of base point 1 from Bank0 address 0, the y coordinate of base point 1 from Bank0 address 50, and so on), and drives the multiplication module 22, the addition array module 23 (and the modular arithmetic module 24, the inversion module, etc.) to complete the dot product operation according to the iterative process of the aforementioned Montgomery ladder or Joye double-and-add algorithm. The dot product result Qi generated by each set of base points is directly written back to the designated output partition of storage Bank10 for subsequent signature assembly or transmission.

[0083] In this way, this application achieves a highly efficient batch multiplication mode that loads a private key in a single operation and processes up to 100 base points. At a working frequency of 600MHz, it can perform up to 50,000 signatures per second, naturally matching the business characteristic of multiple message signatures using the same private key in server-side signature scenarios. Compared to traditional architectures that require repeatedly loading the private key and base points and initiating the multiplication process multiple times for each message signature, this architecture significantly reduces the number of private key reads and computational startup overhead. Simultaneously, by leveraging the ability to load base points in parallel across multiple banks, it avoids storage access bottlenecks.

[0084] Those skilled in the art will understand that the above-mentioned number of banks, depth, bit width, maximum number of base points per batch, and address mapping rules are all exemplary configurations. In actual implementation, they can be flexibly adjusted according to the target elliptic curve parameters, hardware resource constraints, and throughput requirements. All these variations fall within the protection scope of this application.

[0085] like Figure 6 The diagram shown is a flowchart illustrating an acceleration method for elliptic curve cryptography provided in an embodiment of this application. The method includes: Step S601: Provide multiple storage banks to store input parameters, intermediate results and final results during elliptic curve cryptography operations.

[0086] Step S602: Provide at least one computing unit, which is deployed in a near-memory manner next to the storage bank and directly coupled to the storage bank to form a closed-loop data link that reads data from the storage bank, processes it through the computing unit, and writes it back to the storage bank.

[0087] Step S603: The inverse module in the computing unit receives the inverse number A to be calculated and the modulus p, and outputs the modulus p inverse of A. The modulus p inverse has the same bit width as the modulus p. This step converts the original affine coordinates into Jacobian coordinates.

[0088] Step S604: Read the fragmented data from the specified storage Bank through the selector module in the computing unit, and select the current operation input data according to the operation steps of the elliptic curve cryptography algorithm.

[0089] Step S605: The multiplication module in the computing unit receives the input data, performs the large-width multiplication operation required for elliptic curve cryptography, and outputs the multiplication result.

[0090] Step S606: The addition array module in the computing unit receives the multiplication result and additional parameters read from the storage bank, performs the addition or accumulation operations required for elliptic curve cryptography in parallel, and writes the operation result directly back to the storage bank.

[0091] Step S607: The modular arithmetic module in the computing unit receives the multiplication result and performs a fast modular reduction operation on the modulus of the elliptic curve secp256r1 standard, outputting a 256-bit modular arithmetic result, which is then directly written back to the storage bank. This step can be performed in parallel with S606.

[0092] Step S608: The inverse module in the computing unit receives the inverse number A to be calculated and the modulus p, and outputs the modulus p inverse of A. The modulus p inverse has the same bit width as the modulus p. This step converts the Jacobian coordinates into affine coordinates.

[0093] Each step in the above method can be found in the corresponding description in the aforementioned architecture, and will not be repeated here.

[0094] As can be seen from the above technical solutions, the acceleration method for elliptic curve cryptography provided in this application completely eliminates the latency and power consumption caused by frequent data movement across the bus due to the separation of storage and computing units in traditional architectures by deploying the computing unit near the storage bank and forming a closed-loop data link. This significantly reduces the overall latency of dot product operations and improves energy efficiency. Moreover, this application also utilizes the multi-port parallel access capabilities of multiple storage banks, combined with the flexible scheduling of fragmented data by the selector module, the large-width multiplication operation of the multiplication module, and the parallel addition / accumulation operation of the multiplication result and additional parameters by the addition array module. This allows intermediate results to complete iterative processing without leaving the tightly coupled storage-computation link, greatly improving the parallelism of operations. This provides a hardware foundation for batch dot product / signature of multiple base points under the same private key, effectively improving the signature throughput in high-concurrency scenarios on the server side. Meanwhile, the architecture of this application integrates selectors, multiplication modules and addition arrays in a modular manner, which can be flexibly configured to support various constant-time dot multiplication algorithms such as Montgomery ladder and Joye double addition, taking into account both security against side-channel attacks and algorithm compatibility, and avoiding repeated reconstruction of hardware logic.

[0095] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A near-memory computing architecture for elliptic curve cryptography, characterized in that, include: Multiple storage banks are used to store the input parameters, intermediate results and final results in the elliptic curve cryptography process; At least one computing unit is deployed in a near-memory manner next to the storage bank and directly coupled to the storage bank, forming a closed-loop data link that reads data from the storage bank, processes it through the computing unit, and writes it directly back to the storage bank; The computing unit includes: The selector module, whose input is connected to the output of the storage bank, is used to read fragmented data from the specified storage bank and select the current operation input data according to the operation steps of the elliptic curve cryptography algorithm. The multiplication module, connected to the output of the selector module, is used to receive the operation input data, perform the large-bit-width multiplication operation required by elliptic curve cryptography, and output the multiplication result. The addition array module is directly interconnected with the multiplication module and the storage bank, respectively. It is used to receive the multiplication result and additional parameters read from the storage bank, perform the addition or accumulation operations required for elliptic curve cryptography in parallel, and write the operation result directly back to the storage bank. The modulo operation module, whose input is connected to the output of the multiplication module, is used to receive the multiplication result and perform fast modulo reduction operation on the modulus of the elliptic curve secp256r1 standard, and output a 256-bit modulo operation result, which is directly written back to the storage bank. The inverse module has its input connected to the storage bank. It receives the inverse number A and its modulus p and outputs the modulo p inverse of A. The modulo p inverse has the same bit width as the modulus p.

2. The near-memory computing architecture for elliptic curve cryptography according to claim 1, characterized in that, The plurality of storage banks includes at least two independent storage banks, each storage bank having a storage bit width of 512 bits. The selector module reads 256 bits of fragmented data from the storage banks as the operation input data.

3. The near-memory computing architecture for elliptic curve cryptography according to claim 2, characterized in that, The multiplication module is specifically used to decompose a 256-bit multiplication into multiple 64-bit multiplications, and call an external multiplication execution array to complete the multiple 64-bit multiplications in a pipeline manner, so that the operation delay of a 256-bit multiplication is 5 clock cycles.

4. The near-memory computing architecture for elliptic curve cryptography according to claim 1, characterized in that, The modular arithmetic module includes a left shift unit and a modular addition unit; The left shift unit is used to perform three left shift operations of 96 bits, 96 bits, and 64 bits respectively on the low-order part of the multiplication result within a single clock cycle. The modulus unit employs a combination of adders, subtractors, and selectors to complete the modulus reduction of 512 bits of data within 3 clock cycles.

5. The near-memory computing architecture for elliptic curve cryptography according to claim 1, characterized in that, The adder array module further includes: A configurable 256-bit adder / subtractor and a modulus-p correction unit connected to the output of the 256-bit adder / subtractor are provided to perform modulus-p operations on the addition / subtraction results so that the output results fall within the range of 0 to p-1, where p is the modulus of the secp256r1 elliptic curve.

6. The near-memory computing architecture for elliptic curve cryptography according to claim 1, characterized in that, The storage bank is configured to support the data arrangement when performing elliptic curve dot product operations: the coordinates of the elliptic curve base point are stored in the preset address of the first bank, the private key is stored in the preset address of the second bank, and the infinity point and intermediate variables are stored in the preset address of the third bank. The selector module is also used to read private key bits and coordinate data from the corresponding storage bank, and drive the multiplication module and the addition array module to iteratively perform point addition and doubling operations, wherein the infinity point is used to initialize the iteration, and the intermediate variables generated during the iteration and the intermediate results of the iteration are directly written back to the storage bank.

7. The near-memory computing architecture for elliptic curve cryptography according to claim 6, characterized in that, The storage bank is configured to support constant-time dot product algorithms; The selector module enables the computing unit to be compatible with the Montgomery ladder algorithm and the Joye double-and-add algorithm by switching the direction of reading private key bits from the storage bank.

8. The near-memory computing architecture for elliptic curve cryptography according to claim 1, characterized in that, The multiple storage banks are divided into multiple independent partitions; The storage bank is used to store the same private key and multiple sets of different elliptic curve base points, with each set of base points stored in a different bank partition. The computing unit is configured to perform multiple base point multiplication operations in batches after reading the private key once, thereby achieving batch multiplication under the same private key.

9. The near-memory computing architecture for elliptic curve cryptography according to claim 8, characterized in that, The storage bank contains 8 banks, each with a depth of 128 and a bit width of 512 bits. In the batch dot product, the x-coordinates and y-coordinates of each set of base points are stored in different addresses of the same bank or in different banks.

10. A method for accelerating elliptic curve cryptography, characterized in that, include: It provides multiple storage banks for storing input parameters, intermediate results, and final results during elliptic curve cryptography operations; At least one computing unit is provided, which is deployed in a near-memory manner next to the storage bank and directly coupled to the storage bank, forming a closed-loop data link that reads data from the storage bank, processes it through the computing unit, and writes it directly back to the storage bank; The selector module in the computing unit reads fragmented data from the specified storage bank and selects the current computation input data according to the operation steps of the elliptic curve cryptography algorithm. The multiplication module in the computing unit receives the input data, performs the large-width multiplication operation required for elliptic curve cryptography, and outputs the multiplication result. The addition array module in the computing unit receives the multiplication result and additional parameters read from the storage bank, performs the addition or accumulation operations required for elliptic curve cryptography in parallel, and writes the operation result directly back to the storage bank. The modular arithmetic module in the computing unit receives the multiplication result and performs a fast modular reduction operation on the modulus of the elliptic curve secp256r1 standard, outputting a 256-bit modular arithmetic result, which is then directly written back to the storage bank. The inverse module in the computing unit receives the inverse number A to be calculated and the modulus p, and outputs the modulo p inverse of A, wherein the modulo p inverse has the same bit width as the modulus p.

Images