Inverse Element Arithmetic Apparatus for Constant-Time Secure Operations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing inverse element arithmetic methods in memory systems, such as those used for digital signature verification, face challenges in achieving high-speed operations due to increased arithmetic costs and potential errors in approximate calculations, which can prolong firmware startup times and compromise security against side-channel attacks.
Innovation Solution
An inverse element arithmetic apparatus that generates a number-of-times threshold based on the effective bit lengths of input variables, iterates through loops with approximate calculations, and terminates when errors in magnitude determination are likely, ensuring a constant number of processing times and reducing approximation errors, thus enabling high-speed and secure operations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If approximate calculation methods are used for inverse element arithmetic, then processing speed is improved, but calculation accuracy deteriorates due to potential errors in magnitude determination
Solution Approach 1:
The patent dynamically adjusts the calculation method based on the relationship between high-order bits and low-order bits. When the absolute difference between high-order bits (|r-s|) is greater than or equal to a subtraction threshold, the system uses approximate calculation (first loop). When the difference is smaller than the threshold, it switches to exact calculation (second loop) to avoid magnitude determination errors. This dynamic adaptation resolves the contradiction by selecting the appropriate calculation precision based on real-time conditions.
Solution Approach 2:
The patent changes the calculation parameter (approximation level) based on the bit difference threshold. By monitoring the parameter |r-s| and comparing it against a threshold, the system transitions between approximate and exact calculation modes. This parameter-based control allows the system to maintain high speed when approximation is safe and ensure accuracy when approximation might fail, thus resolving the speed-accuracy tradeoff.
2Measurement precision
If the number of iteration loops is increased to improve accuracy, then calculation precision is improved, but processing time increases
Solution Approach 1:
The patent applies partial action by using approximate calculation (first loop) when it suffices for the given input conditions, rather than always performing the complete exact calculation (second loop). The system performs only the necessary amount of calculation based on the |r-s| threshold condition, avoiding unnecessary iterations when approximate calculation is sufficient, thus reducing processing time while maintaining adequate precision.
Solution Approach 2:
The patent dynamically determines the number of loops to execute based on the input characteristics. Instead of fixed iteration counts, the system adapts the calculation depth to the specific input values, using fewer iterations (first loop) when approximate calculation is safe and more iterations (second loop) when higher precision is needed, optimizing the balance between precision and time.
3Adaptability or versatility
If variable iteration loops are used to adapt to different inputs, then adaptability is improved, but predictability of processing time deteriorates
Solution Approach 1:
The patent uses dynamic threshold comparison to adapt the calculation path based on input characteristics. By comparing |r-s| against a predetermined subtraction threshold, the system dynamically selects between two calculation modes, achieving adaptability to different inputs while maintaining predictable processing time through constant-time operations in each branch.
Solution Approach 2:
The patent changes the calculation parameter (which loop to execute) based on the threshold comparison result. This parameter change approach allows the system to adapt to different input values while maintaining structured, predictable control flow, as the decision is based on a clear threshold criterion rather than variable iteration counts.
4Measurement precision
If exact calculation methods are always used, then calculation accuracy is maintained, but processing speed decreases due to higher arithmetic costs
Solution Approach 1:
The patent applies partial action by using exact calculation (second loop) only when necessary, specifically when |r-s| is smaller than the subtraction threshold. For most cases where approximate calculation is sufficient, the system uses the faster first loop, thus reducing overall processing time while maintaining accuracy only when needed, resolving the speed-accuracy contradiction.
Solution Approach 2:
The patent changes the calculation method parameter based on the threshold condition. When |r-s| >= threshold, it uses approximate calculation for speed; when |r-s| < threshold, it switches to exact calculation for accuracy. This parameter-based selection optimizes the balance between speed and accuracy by adapting the calculation intensity to the specific input conditions.
Data Source
AI summary
According to one embodiment, in an inverse element arithmetic apparatus, a word unit processing unit, as approximate calculation loop for extended binary GCD process, iterates a first loop in a case where a value of |r−s| is a subtraction threshold or more, and is capable of iterating a second loop instead of the first loop in a case where the value of |r−s| is smaller than the subtraction threshold. In the first loop, values of r, s, a, b, m, and n is updated and an update matrix M is generated or updated. In the second loop, the values of m and n are updated without updating the values of r, s, a, b and the update matrix M. The control unit terminates the loop of the inverse element arithmetic process in a case where a loop number of times of the inverse element arithmetic process reaches a number-of-times threshold.