Approximate Dot-Product Accumulator for LWE Error Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional implementations of cryptographic primitives based on Learning With Errors (LWE) face performance issues due to the use of hardware random or pseudo-random number generators, leading to complex and large digital circuits, and lack flexibility in controlling error probability.
Innovation Solution
A digital circuit designed to calculate a dot product between vectors with a control mechanism to perform additions approximately with a predetermined error probability, utilizing a single adder and FDSOI technology to dynamically control error distribution without needing TRNG or PRNG, and incorporating a multiplexer for exact or approximate adder selection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If hardware random or pseudo-random number generators (TRNG/PRNG) are used to generate errors for LWE cryptographic primitives, then error generation capability is provided, but device complexity and circuit footprint increase significantly
Solution Approach 1:
The patent extracts the error generation function from the complex TRNG/PRNG hardware and relocates it to the accumulator circuit. By modifying the accumulator to occasionally produce erroneous addition results through controlled mechanisms (such as randomized enable signals or deliberate error injection), the system generates the required errors for LWE without needing separate random number generation hardware, thereby significantly reducing device complexity while maintaining error generation capability
Solution Approach 2:
The patent merges the error generation function with the accumulator circuit that performs dot product calculations. The accumulator is designed to sometimes produce incorrect addition results through mechanisms like randomized clock gating or controlled signal inversion, thereby combining two functions (accumulation and error generation) into a single circuit component, reducing overall system complexity and eliminating the need for separate TRNG/PRNG modules
2Productivity
If multiple stages of parallel adders and register banks are used to implement LWE algorithm, then calculation capability is improved, but device footprint and area increase
Solution Approach 1:
The patent segments the dot product calculation into N sequential clock cycle steps, where each step processes one pair of vector components (a[j] × s[j]). This temporal segmentation allows the use of a single adder and single register to accumulate the dot product sum over time, rather than requiring parallel adders and register banks for simultaneous computation, thereby maintaining calculation capability while dramatically reducing circuit footprint
Solution Approach 2:
The patent employs dynamic control mechanisms where the accumulator circuit's behavior changes over time based on the current clock cycle index j. The circuit dynamically selects which multiplication result to accumulate and controls when approximate additions occur, allowing a single static adder to perform the work of multiple parallel adders through time-multiplexed operation, reducing area while maintaining productivity
3Measurement precision
If conventional digital circuits are used for dot product calculation, then exact calculation is achieved, but energy consumption increases and error resilience is reduced
Solution Approach 1:
The patent applies local quality by making only specific additions in the dot product calculation approximate rather than all additions. The control circuit selectively identifies which accumulator operations should be approximate based on the desired error distribution characteristics, applying approximation only where needed to achieve the target error probability while maintaining exact calculation for other operations, thereby reducing energy consumption while preserving sufficient calculation accuracy for cryptographic security
Solution Approach 2:
The patent changes the operational parameters of the adder circuit dynamically. The adder can switch between exact mode and approximate mode based on control signals generated by the control circuit. In approximate mode, the adder intentionally introduces errors with controlled probability to match the error distribution required by LWE, reducing energy consumption compared to always operating in exact mode, while the control circuit adjusts parameters to maintain overall calculation accuracy within security bounds
Data Source
Figure 1~2
Figure 3~4
Figure 5~6
AI summary
The invention relates to a digital circuit (10) for calculating a dot product between two vectors (a0, a1, ..., ai, ..., aN-1) and (s0, s1, ..., si, ..., sN-1). The digital circuit includes a multiplier (11), an accumulator (12) comprising at least one adder (13) and a register (14), as well as a control circuit (15) for the accumulator. At a clock cycle indexed i, the multiplier is configured to calculate the result ri of the multiplication ai × si, and the accumulator is configured to add ri to the current value of the register. The result of the addition is then stored in the register. The control circuit is configured to control the accumulator so as to perform the addition approximately for at least one of the N additions in the calculation of the dot product.The digital circuit is specifically intended for use in an electronic device implementing a cryptographic algorithm based on "error learning" (LWE) technology.