Information processing device, inverse matrix calculation method, and program

Abstract

An information processing device for calculating an inverse matrix of a first matrix while the first matrix is partitioned, said device comprising a computation unit that acquires partitioned elements of a product of a second matrix, which is an inverse matrix of the first matrix, by performing processing for multiplying the first matrix partitioned into a sum by a random matrix the same number of times as the number of partitioned elements, and computes the inverse matrix partitioned into a sum from the second matrix partitioned into the product.

Description

Information processing device, inverse matrix calculation method, and program

[0001] This invention relates to a technique for calculating the inverse matrix of a matrix while keeping the matrix partitioned.

[0002] Masking implementations are known as countermeasures against side-channel attacks, which are implementation-based attacks that obtain confidential internal information by physically observing the hardware.

[0003] Currently, the most common masking implementation is the one defined as SNI security disclosed in Non-Patent Document 1, which guarantees security even if d pieces of information are taken by dividing the confidential information into d+1 parts.

[0004] In relation to the masking implementation described above, Non-Patent Document 2 discloses a linear refresh function.

[0005] Gilles Barthe, Sonia Belaid, Franois Dupressoir, Pierre-Alain Fouque, Benjamin Gregoire, Pierre-Yves Strub, Rebecca Zucchini, "Strong Non-Interference and Type-Directed Higher-Order Masking," CCS'16, October 24 - 28, 2016, Vienna, AustriaMatthieu Rivain, Emmanuel Prou, "Provably Secure Higher-Order Masking of AES," Full version of the paper published in the proceedings of CHES 2010. https: / / eprint.iacr.org / 2010 / 441.pdf

[0006] With the widespread use of IC cards and IoT devices, there are more situations where encryption devices can be directly accessed. To use encryption securely, measures are needed to prevent important information from being stolen through side-channel attacks. One basic measure is the masking implementation mentioned above.

[0007] Furthermore, with the current development of quantum computers, a new cryptographic method called post-quantum cryptography is being standardized. Among these methods, there is one that uses multivariable polynomials as the basis for security, and solving equations requires calculations such as inverse matrices. However, there is a challenge in that a secure implementation method for calculating inverse matrices, such as masking operations, has not yet been devised.

[0008] This invention has been made in view of the above points, and aims to provide a technique for finding the inverse matrix of a matrix while keeping the matrix partitioned.

[0009] According to the disclosed technology, an information processing device is provided that calculates the inverse matrix of a first matrix while the first matrix is ​​partitioned, and includes an arithmetic unit that obtains partition elements of the product of a second matrix which is the inverse matrix of the first matrix by multiplying the first matrix, which has been partitioned by a sum, by a random number matrix for the number of partition elements, and calculates the inverse matrix, which has been partitioned by a sum, from the second matrix which has been partitioned by the product.

[0010] According to the disclosed technology, it is possible to find the inverse of a matrix while keeping the matrix partitioned.

[0011] This is a diagram showing an example configuration of the information processing device 100. This is a diagram showing masked_Mat_inv. This is a diagram showing MatRefresh. This is a diagram showing Mat_M2A. This is a diagram showing masked_solve. This is a diagram showing an example of the hardware configuration of the device. This is a diagram showing an example of the system configuration in an application example. This is a diagram for explaining the overview of the system's operation.

[0012] Hereinafter, embodiments of the present invention (this embodiment) will be described with reference to the drawings. The embodiments described below are merely examples, and the embodiments to which the present invention is applied are not limited to the embodiments described below.

[0013] (Example of the configuration of the information processing device 100) In this embodiment, the information processing device 100 performs the calculation of the inverse matrix while keeping it divided by utilizing the conversion of sum masking and multiplication masking.

[0014] Figure 1 shows an example configuration of an information processing device 100 used as a signature device 100. As shown in Figure 1, the information processing device 100 includes an input unit 110, an arithmetic unit 120, an output unit 130, and a data storage unit 140.

[0015] Information necessary for the calculation (e.g., a partitioned matrix) is input from the input unit 110. The calculation unit 120 calculates the inverse matrix by executing the algorithm described later. Intermediate values ​​are stored in the data storage unit 140, for example, and the calculation unit 120 reads these values ​​from the data storage unit 140 and uses them to calculate the inverse matrix. The output unit 130 outputs the calculation result from the calculation unit 120.

[0016] The following explains the process in more detail.

[0017] (masked_Mat_inv) Figure 2 shows the algorithm for masked_Mat_inv, a function that calculates the inverse matrix of a matrix.

[0018] X (and partition element X) in step 1 of the algorithm shown in Figure 2 （ｉ） ) is an n x n invertible matrix. According to this algorithm, the arithmetic unit 120 performs the calculation of the inverse matrix while the matrix is ​​partitioned by utilizing the transformation of addition masking and multiplication masking.

[0019] In the loop of steps 3 to 10 from i=0 to d (processing for each partition element i), first, the arithmetic unit 120 calculates the random number n × n invertible matrix R in step 4. （ｉ） Obtain it.

[0020] In steps 5 to 7, the calculation unit 120 calculates each division element X （ｊ） ni R （ｉ） The result of multiplying by X （ｊ） Let's assume that.

[0021] In step 8, the calculation unit 120, R （ｉ） Let X be the result of applying the matrix's linear refresh function (MatRefresh) to X after multiplying by the given factor. In other words, MatRefresh shuffles the components of the partitioned elements.

[0022] In step 9, the arithmetic unit 120 holds R taken as a random number as a new division element Z. （ｉ） as （ｄ－ｉ） the new division element Z.

[0023] At the end of step 10, X = Π ０ ｉ＝ｄ R （ｉ） X (where the X on the right side is the original X at the time of input). In step 11, the arithmetic unit 120 sets Z （０） = X －１ · Z （０） = (Π R （ｉ） X) －１ R （ｄ） Thus, the product of Z （ｉ） from i = 0 to d becomes the inverse matrix of the original X. That is, the product of Z （ｉ） from i = 0 to d becomes masking that represents the inverse matrix of X by product division. In step 12, the arithmetic unit 120 obtains the division of the target inverse function Z by returning from product division to the original sum division using the Mat_M2A function. The reason why the product of Z （ｉ） becomes the inverse matrix of the original X is as follows.

[0024] "Z （０） = (Π ０ ｉ＝ｄ R （ｉ） X) －１ R （ｄ） [[ID=)44]] = X －１ Π ｄ ｉ＝０ R （ｉ）－１ R （ｄ） ", so "Π ｄ ｉ＝０ Z （ｉ） = X －１ Π ｄ ｉ＝０ R （ｉ）－１ R （ｄ） Π ０ ｉ＝ｄ－１ R （ｉ） = X －１ · I = X －１ " holds.

[0025] (MatRefresh) FIG. 3 is a diagram showing the algorithm of MatRefresh, which is a linear refresh function of a matrix.

[0026] The X in step 1 (and the division element X（ｉ） ) is an n x n square matrix. In step 3, the calculation unit 120 is "Z （ｄ） ←X （ｄ） "

[0027] In steps 4 to 8, the calculation unit 120 generates a random number matrix R for each division element i (i = 0 to d-1). （ｉ Using "Z （ｉ） ←X （ｉ） +R （ｉ） "Z （ｄ） ←X （ｄ） -R （ｉ） Perform the following operation. The calculation result is Z = X.

[0028] (Mat_M2A) Figure 4 shows the algorithm for Mat_M2A, a matrix multiplication-to-sum conversion function.

[0029] Step 1 X (and the division element X in the product) （ｉ） ) is an n x n square matrix. In step 3, the calculation unit 120 is "Z （０） ←X （０） "

[0030] In steps 4 to 9, the calculation unit 120 calculates the input X with respect to Z. （ｉ） The numbers are multiplied sequentially, and Matrefresh is used to randomly rearrange them by partitioning by sum. Specifically, X （１） Change it into a partition of two sums (MatRefresh), and then apply X to those two partitions. （２） By multiplying by this and then dividing it into three parts, the result is X （１） X （２） The calculation unit 120 converts this into a partition of three sums. By performing this process to the end, X （１） X （２） ...X （ｄ） Change it to a sum divided into d+1 parts.

[0031] (masked_solve) Figure 5 shows the algorithm of masked_solve, a function that solves simultaneous equations.

[0032] Step 1 A (and division element A) （ｉ） ) is a finite field F ｑThe above is an m x m matrix, where y (and partition element y) （ｉ） ) is a finite field F ｑ The above is an m-dimensional vector. As described in Step 2, masked_solve finds the solution x of the system of equations Ax = y while keeping A, y, and x separated.

[0033] In steps 3 to 5, the calculation unit 120 calculates x for i = 0 to d. （ｉ） Initialize it to 0.

[0034] In step 6, the calculation unit 120 uses masked_Mat_inv to calculate the inverse matrix A of A. －１ We seek.

[0035] In steps 7 to 13, for each i and each j, the calculation unit 120 calculates SecMult((A －１ [i, j]) ０≦ｋ≦ｄ , (y[j]) ０≦ｋ≦ｄ ) by A －１ The calculation of safely multiplying the i and j components of x by the j-th component of y is performed for each k (partition element) of 0 ≤ k ≤ d to find Tmp. Furthermore, the calculation unit 120 calculates for each k, "x[i] （ｋ） ←x[i] （ｋ） +Tmp （ｋ） This calculates the value of each component i of each partition element in solution x.

[0036] (Example Hardware Configuration) The information processing device 100 described in this embodiment can be realized, for example, by having a computer execute a program. This computer may be a physical computer or a virtual machine on the cloud.

[0037] In other words, the device can be realized by using hardware resources such as the CPU and memory built into a computer to execute a program corresponding to the processing performed by the device. The program can be recorded on a computer-readable recording medium (such as portable memory), saved, and distributed. It can also be provided via a network, such as the Internet or email.

[0038] Figure 6 shows an example of the hardware configuration of the computer described above. The computer in Figure 6 has a drive device 1000, an auxiliary storage device 1002, a memory device 1003, a CPU 1004, an interface device 1005, a display device 1006, an input device 1007, an output device 1008, etc., all of which are interconnected by bus B. The computer may also be equipped with a GPU.

[0039] The program that enables processing on the computer is provided on a recording medium 1001, such as a CD-ROM or memory card. When the recording medium 1001 containing the program is set in the drive device 1000, the program is installed from the recording medium 1001 to the auxiliary storage device 1002 via the drive device 1000. However, the program does not necessarily have to be installed from the recording medium 1001; it may also be downloaded from another computer via a network. The auxiliary storage device 1002 stores the installed program as well as necessary files and data.

[0040] The memory device 1003 reads and stores a program from the auxiliary storage device 1002 when a program startup command is received. The CPU 1004 implements the functions related to the memory device 1003 according to the program stored in the memory device 1003. The interface device 1005 is used as an interface for connecting to a network, etc. The display device 1006 displays a GUI (Graphical User Interface) etc., based on a program. The input device 1007 consists of a keyboard and mouse, buttons, or a touch panel, etc., and is used to input various operation commands. The output device 1008 outputs the calculation results.

[0041] More specifically, in each algorithm, the vector or matrix is ​​stored, for example, in memory (which may also be called a storage unit), and the CPU (which may also be called an arithmetic unit) reads the values ​​of the vector (or matrix) from that memory to execute the processing described in each algorithm. If the calculation result is a vector (or matrix), that calculation result is stored in memory as a vector (or matrix).

[0042] (Effects of the technology according to the embodiment) As described above, the technology according to this embodiment makes it possible to implement masking for calculating the inverse matrix. This technology makes it possible to calculate the inverse matrix with enhanced safety.

[0043] (Examples of application of the technology according to the embodiment) The application of the technology according to the present invention is not limited to a specific field, but for example, it can be applied to the masking implementation of signature QR-UOV, which is a candidate for standardization by the US NIST.

[0044] When solving linear equations for the coefficient matrix L of QR-UOV, if L is an invertible matrix (in the implementation of the fixed-salt version, L is selected to be full-rank), the linear equations can be solved by calculating the inverse matrix, and the masking of the inverse matrix, which is the technology according to this embodiment, can be used.

[0045] (System Configuration and Operation in Application Examples) Figure 7 shows an example of the system configuration in an application example. As shown in Figure 7, this system has an information processing device 100 (referred to here as a signature device 100) and a verification device 200 connected by a network 300.

[0046] The operation overview of this system will be explained with reference to the sequence diagram in Figure 8. In S101 (step 101), the signature device 100 generates a private key and a public key. In S102, the signature device 100 generates a signature s using message M and the private key, and sends message M, signature s, and the public key to the verification device 200. The public key may be sent in advance. Both the private key and the public key are matrices representing multivariable polynomials. The signature device 100 also performs processing while keeping the information divided. Furthermore, operations on polynomials and matrices are operations on the quotient ring.

[0047] The verification device calculates M from the public key and signature s, and determines that the verification is successful if the calculated M matches the M received from the signing device 100.

[0048] In this embodiment, the signature device 100 performs key generation and signature generation while splitting information based on the QR-UOV method. Since QR-UOV itself is a known technique, only an outline will be described here.

[0049] In key generation, the signature device 100 uses the following MF ｉ (i = 1,..., m) and MS as secret keys, and generates MP ｉ (i = 1,..., m) as public keys. m corresponds to the number of polynomials.

[0050] (1) Irreducible polynomial: f = x ｌ - ax ｉ - 1 (Note: l is the lowercase of L) W ∈ F ｑ ｌ×ｌ s.t. ∀g ∈ F ｑ [x] / (f), WΦ ｇ ｆ : Symmetric matrix (2) MF ｉ : block WΦ ｇ ｆ matrices (i = 1,..., m) MS: block Φ ｇ ｆ matrix (3) MP ｉ = MS Ｔ · MF ｉ · MS MP ｉ : block WΦ ｇ ｆ matrices The signature device 100 generates a signature s by s = (MS Ｔ · MF · MS) －１ (M). This calculation corresponds to solving a system of simultaneous polynomials. The verification device 200 verifies whether M = MP(s) holds.

[0051] Regarding the above embodiment, the following additional remarks are further disclosed.

[0052] <Notes> (Note 1) An information processing device that calculates the inverse matrix of a first matrix while keeping the first matrix partitioned, comprising: a memory; and at least one processor connected to the memory, wherein the processor obtains partition elements of the product of the second matrix which is the inverse matrix of the first matrix by multiplying the first matrix partitioned by a sum by a random number matrix as many times as there are partition elements, and calculates the inverse matrix partitioned by a sum from the second matrix partitioned by the product. (Note 2) The information processing device according to Note 1, wherein the processor multiplies the first matrix partitioned by a sum by a random number matrix and then applies a linear refresh function of the matrix to the first matrix multiplied by the random number matrix. (Note 3) Let X be the first matrix at input, let the number of partition elements be d+1, and let X be the partition elements of the first matrix. （ｉ） Let the partitioning element of the second matrix be Z （ｉ） Let the partitioning elements of the random number matrix be R （ｉ） In this case, the processor multiplies the first matrix, which has been divided by a sum, by a random number matrix, and performs this process as many times as there are division elements, Π ０ ｉ＝ｄ R （ｉ） Find X, R （ｉ） to Z （ｄ－ｉ） Perform the following process for i = i to d, ( Π ０ ｉ＝ｄ R （ｉ） X) －１ ・Z （０） to Z （０） An information processing device as described in Appendix 1, which performs the processing described herein. (Appendix 4) An inverse matrix calculation method executed by an information processing device that calculates the inverse matrix of a first matrix while the first matrix is ​​still partitioned, comprising the calculation step of multiplying the first matrix partitioned by a sum by a random number matrix as many times as there are partition elements, thereby obtaining the partition elements of the product of the second matrix which is the inverse matrix of the first matrix, and calculating the inverse matrix partitioned by a sum from the second matrix partitioned by the product. (Appendix 5) A non-temporary storage medium storing a program for causing a computer to function as an arithmetic unit in an information processing device as described in any one of Appendix 1 to 3.

[0053] Although this embodiment has been described above, the present invention is not limited to this specific embodiment, and various modifications and changes are possible within the scope of the gist of the invention as described in the claims.

[0054] 100 Signature device, information processing device 110 Input unit 120 Calculation unit 130 Output unit 140 Data storage unit 200 Verification device 1000 Drive device 1001 Recording medium 1002 Auxiliary storage device 1003 Memory device 1004 CPU 1005 Interface device 1006 Display device 1007 Input device 1008 Output device

Claims

1. An information processing device for calculating the inverse matrix of a first matrix while the first matrix is ​​partitioned, comprising: an arithmetic unit that obtains partition elements of the product of a second matrix which is the inverse matrix of the first matrix by multiplying the first matrix, which has been partitioned by a sum, by a random number matrix for the number of partition elements, and calculates the inverse matrix, which has been partitioned by a sum, from the second matrix which has been partitioned by the product.

2. The information processing apparatus according to claim 1, wherein the calculation unit multiplies the first matrix, which has been divided by a sum, by a random number matrix, and then applies a linear refresh function of the matrix to the first matrix obtained by multiplying by the random number matrix.

3. Let the first matrix at the time of input be X, the number of divided elements be d + 1, and the divided elements of the first matrix be X （０） Let the divided elements of the second matrix be Z （ｉ） Let the divided elements of the random number matrix be R （ｉ） In this case, the arithmetic unit performs the process of multiplying the first matrix divided by the sum by the random number matrix for the number of divided elements, to obtain Π ０ ｉ＝ｄ R （ｉ） X, and performs the process of setting R （ｉ） to Z （ｄ－ｉ） for i = i to d, and performs the process of setting (Π ０ ｉ＝ｄ R （ｉ） X) －１ ·Z （０） to Z （０） The information processing apparatus according to claim 1, which performs the process of setting to Z 4. An inverse matrix calculation method executed by an information processing device that calculates the inverse matrix of a first matrix while the first matrix is ​​partitioned, comprising the steps of: obtaining partition elements of the product of a second matrix which is the inverse matrix of the first matrix by multiplying the first matrix partitioned by a sum by a random number matrix as many times as there are partition elements; and calculating the inverse matrix partitioned by a sum from the second matrix partitioned by the product.

5. A program for causing a computer to function as an arithmetic unit in an information processing device according to any one of claims 1 to 3.

Images