The invention relates to a calculating device, calculation system, a calculating method, a computer program, and a computer readable medium.
In computers calculations are performed for various tasks. As computers are finite, these calculations take place in finite rings. A common example of such rings is arithmetic modulo a number, in particular modulo a power of two. However, there are many other rings for various other applications. For example, polynomial rings are used in some cryptographic algorithms.
In some applications, there is a desire to hide information about the execution of the program from an attacker. In the so-called white box attack model, an attacker is assumed to have detailed access to a running computer program. There is a desire to hide as much as possible from the attacker, even in this model. In particular, sensitive applications, such as banking applications, content protection, and the like, that use cryptography to hide information from an attacker may be vulnerable in the white box model. If an attacker were to read, say, a secret key that was used to encrypt information, then the attacker may be able to decrypt said information himself, thus obtaining financials, plain content and the like.
In addition to protecting information, there is also, more generally, the desire to protect the calculation itself from an attacker. If an attacker knows exactly where certain algorithms are performed, he may be able to focus his attacks on the right spot in the program; he may be able to reverse engineer secret algorithms, say, proprietary encryption or decryption algorithms.
Protecting a general calculation flow is hard using current white box technology. For example, the paper ‘White-Box Cryptography and an AES Implementation’ by Chow, et al., shows how one particular algorithm (AES) may be protected in the white-box model. This technology may not be directly applied to protect general computer programs, that is, not without extensive human analysis of the program. For example, direct translation, say, of the addition or multiplication operations to tables or table networks of the type described in Chow, would still allow an attacker to deduce when an addition or multiplication is performed, simply by observing which table network is accessed.
It would be advantageous to have a calculation device with improved ring arithmetic.
A calculating device is provided arranged to perform calculations on elements of a ring, a ring addition, and a ring multiplication being defined on the ring. The calculating device comprises
an operand store arranged to store encoded ring elements, an encoded ring element representing an element of the ring in encoded form,
an operator module comprising multiple operator units, at least one of the operator units being dyadic,
a calculation manager arranged to
An attacker observing the operator module may obtain information on which operator is performed. As the sequence of operators for a ring addition is the same as the sequence of ring multiplication, the attacker cannot deduce from the sequence of operators whether a multiplication or whether an addition is performed. The attacker is thus forced to attack the underlying parameter calculation which is however much more complicated and harder to analyze.
In an embodiment, the operator units are implemented as tables or as a table network using white box cryptography. In such an implementation, the table accesses are often clearly visible. If an attacker were to know that a particular table stands for addition, and some other for multiplication, he may be able to deduce the computation, even without knowing the precise inputs and outputs. However, if the same sequence of operators may give an addition or a multiplication, the attacker cannot work out the algorithm being performed only from observing table accesses.
In an embodiment, one or more of the operator units is monadic. Monadic tables are smaller, thus reducing the size of the calculating device. In an embodiment, only monadic and dyadic operators are used, not triadic or higher.
The operators for up and down are indicating above as dyadic because they receive both a parameter and an encoded ring element. However, in an embodiment the number of allowed parameter is smaller than that of encoded ring elements.
In an embodiment, the calculating device comprises a combining unit, the combining unit being arranged to select two consecutive operations of the operator units, combine the selected operations into a single new operation unit, and combine the corresponding parameters accordingly. By combining operators, the attacker gains even less knowledge from observing the tables, even if he were to take parameters into account, as the tables correspond to multiple operations. In addition of reducing the number of operators, the number of operators may also be increased by inserting multiple operators for which the combination does not affect the end result.
A further aspect of the invention is a calculation system comprising
a calculation device according to any one of the preceding claims, and
a parameter unit, separate from the calculation manager, arranged to compute the parameters obtained at least from the second encoded ring element for performing the ring multiplication and ring addition by the calculation manager. The computation of the parameters and the execution of the operators may be split in a system. This allows the two parts to run in parallel, and also to be protected in parallel.
The calculating device is an electronic device, e.g., a set-top box, a computer, etc, in particular it may be a mobile electronic device, for example, mobile phone.
A method according to the invention may be implemented on a computer as a computer implemented method, or in dedicated hardware, or in a combination of both. Executable code for a method according to the invention may be stored on a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product comprises non-transitory program code stored on a computer readable medium for performing a method according to the invention when said program product is executed on a computer.
In a preferred embodiment, the computer program comprises computer program code adapted to perform all the steps of a method according to the invention when the computer program is run on a computer. Preferably, the computer program is embodied on a computer readable medium.
Another aspect of the invention provides a method of making the computer program available for downloading. This aspect is used when the computer program is uploaded into, e.g., Apple's App Store, Google's Play Store, or Microsoft's Windows Store, and when the computer program is available for downloading from such a store.
Further details, aspects, and embodiments of the invention will be described, by way of example only, with reference to the drawings. Elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. In the Figures, elements which correspond to elements already described may have the same reference numerals. In the drawings,
While this invention is susceptible of embodiment in many different forms, there are shown in the drawings and will herein be described in detail one or more specific embodiments, with the understanding that the present disclosure is to be considered as exemplary of the principles of the invention and not intended to limit the invention to the specific embodiments shown and described.
In the following, for the sake of understanding, elements of embodiments are described in operation. However, it will be apparent that the respective elements are arranged to perform the functions being described as performed by them.
Further, the invention is not limited to the embodiments, and the invention lies in each and every novel feature or combination of features described above or recited in mutually different dependent claims.
Calculating device 100 is arranged to perform calculations on elements of a finite ring R. A ring is a mathematical structure having a finite set of elements for which a ring addition and a ring multiplication is defined. The addition will be denoted as +, the multiplication as ·, or by concatenation. The set of elements together with the addition form an Abelian group, for which the identity is denoted as 0. The ring is a monoid under the multiplication, e.g., the multiplication is associative and there is an identity which is denoted as 1. Elements in R that have an inverse under the multiplication are called units. The units of a ring are not to be confused with the units of a device. The latter are operative parts that perform a certain function, the former are elements of a set that have a multiplicative inverse. The system described below is also suitable if all non-zero elements have a multiplicative inverse, e.g., fields.
There are many different rings known in the art. For example, the integers modulo a number n, e.g., n, is a ring. For example, n may be an integer such as 5, 17, etc. The elements x in this ring for which gcd(x,n)=1 are units. The set of square matrices with elements from a ring also form a ring. The set of polynomials modulo a number and a polynomial,
n [X]/f (x), also form a ring, or more general given a ring R, we have R[x]/f (x) as a new ring.
Calculations in various rings are important in many branches of computer sciences. In computers, it is in particular calculation in finite rings that is important. For many applications it is important that the calculations are hidden from an attacker on that system. For example, for a security application it may be desired that the exact calculations that are performed remain hidden, as for example, a secret key may be derived from knowing which calculations are performed. Hiding this information is particularly hard if an attacker has full access to the computer software code while it is executing. Although different obfuscation techniques are known in the art there remains a desire to further improve obfuscation of calculations in rings.
Calculating device 100 comprises an operand store 110 which is arranged to store encoded ring elements.
Operand store 110 may comprise constants. For example, constant ring elements that are used in some algorithm, say, in some cryptographic algorithm, such as an encryption, decryption, a MAC operation (message authentication code), signing, signature verification, and the like. Operand store 110 may also comprise ring elements that are input by a user, or are received from a computer, e.g., external to calculation device 100. Calculation device 100 may comprise an encoding unit to translate received plain ring elements to encoded ring elements and/or a decoding unit to translate encoded ring elements to plain ring elements, e.g., before sending them, e.g., to the external computer. Calculation device 100 may also receive external ring elements directly in encoded form. Outside calculation device 100 another encoding, say, encryption may be used, than inside of calculation device 100.
Calculation device 100 comprises an operator module 120. Operator module 120 comprises multiple operator units. At least one of the multiple operator units is a dyadic operator unit.
A dyadic operator unit such as dyadic operator unit 122 is arranged to
receive an encoded ring element and a parameter, and
perform a fixed calculation on said encoded ring element and the parameter, thus producing a new encoded ring element.
A monadic operator unit such as monadic operator unit 123 is arranged to
receive an encoded ring element, and
perform a fixed calculation on said encoded ring element, thus producing a new encoded ring element.
In both the dyadic and the monadic case the encoded ring element may be received from operand memory 110, e.g., through a calculation manager 130 (further discussed below). For the dyadic case, the parameter may also be received from operand memory 110, e.g., through a calculation manager 130. The parameter may also be computed, e.g., by calculation manager 130 or by a parameter unit 140 (further discussed below).
The calculation performed by an operator unit is fixed. If an operator is presented with a different parameter or encoded ring element it will execute the same set of computations, albeit with different imputes. For example, the calculation of an operator unit may comprise (or even consist of) ring arithmetic on the parameter or its inverse and elements of the encoded representation. For example, the calculation of an operator unit may comprise (or even consist of) ring multiplications and ring additions. The ring multiplication, including the latter, may be a multiplication with a fixed ring element (e.g., −1).
Calculation device 100 comprises a calculation manager 130. Calculation manager 130 is arranged to receive a first encoded ring element and a second encoded ring element. For example, calculation manager 130 may be arranged to fetch a first encoded ring element and a second encoded ring element from operand memory 110. For example, calculation manager 130 may fetch encoded ring elements 112 and 114.
Calculation device 100 can both perform a ring addition and a ring multiplication on the first encoded ring element and a second encoded ring element. Which operation is chosen, the addition or the multiplication, depends on the application for which calculation device 100 is adapted. For example, a cryptographic operation may be performed that requires a large number of arithmetical to be performed including both multiplications and additions.
Calculation manager 130 is arranged to perform a ring multiplication by applying a sequence of the multiple operator units to the first encoded ring element using parameters obtained at least from the second encoded ring element. For example, each operator unit may be applied to the first encoded ring element in some particular order, some of which may be applied multiple times. For example, the sequence may apply a first operator, then a second operator, then a third operator, then the third operator again, and so on.
Calculation manager 130 is also arranged to perform a ring addition by applying a sequence of the multiple operator units to the first encoded ring element using parameters obtained at least from the second encoded ring element. Interestingly, the sequence that calculation manager 130 may use for the ring multiplication is the same as the sequence for the ring addition. So, to perform the ring addition on the encoded elements, calculation manager may apply the same example sequence given above: the first operator, then the second operator, then the third operator, then the third operator again, and so on.
For example, calculation manager 130 may comprise or have access to a sequence of operators 132. The sequence of operators determines which operators are performed on which encoded ring elements. Sequence 132 may comprise sub-sequences that represent a ring addition and sub-sequences that represent a ring multiplication. The sub-sequences may be equal to each other. Sequence 132 may also include further applications of the multiple operators, or even other, possibly unrelated operators. Sequence 132 may be included in a program. Sequence 132 may be stored in a memory, say, in operand store 110.
An attacker who analyses the operation of operator module 120 will see the same sequence of operations regardless of the fact that an addition or a multiplication is performed. Thus the attacker cannot deduce information about the calculation that is performed from an analysis of the operations. In this way an important aspect of the running of the calculation device is hidden from the attacker.
In theory, the attacker may deduce information from the combination of the parameter and the operator. However, an attacker will typically not know how the ring addition and multiplications have been translated in to two equal sequences. Moreover, in an embodiment, obfuscation techniques may be applied to the system. In particular, the multiple operations may be executed as look-up tables. The encoded ring elements may have a random relationship, e.g., through encryption, or a random encoding, with the plain ring elements. Although an attacker may be able to see which tables are applied and which order to execute the various operator units, he cannot deduce information therefrom since the sequence for a ring addition and ring multiplication has become meaningless. At the same time the parameter has become less useful as well since the tables operate on encoded information.
Monadic operations are particularly suitable for implementation as a look-up table since the size of a table increases strongly with the number of inputs (1, 2, or even more). For example, calculating device 100 may comprise a storage that stores a look-up table implementing the box operator unit (see below).
In addition to ring multiplication and ring addition, the calculation device 100 may be arranged for other operations on ring elements. For example, calculation device may comprise a storage comprising a table that represents an operation that cannot be (easily) represented as a sequence of addition and multiplications.
In addition to ring addition and ring multiplication other operations may also be expressed using the same sequence of the same operators. For example, in an embodiment, calculation manager 130 is arranged to perform a ring subtraction by applying a sequence of the multiple operator units to the first encoded ring element using parameters obtained at least from the second encoded ring element, wherein the sequence for the ring subtraction is the same as the sequence for the ring addition and the sequence for the ring multiplication. For example, negation operations may also be expressed in this way.
Device 100 may during operation be used, e.g., as follows. Calculation device 130 fetches a first and a second encoded ring element from operand storage 110. Calculation device 130 selects operator units from operator module 120; for example according to sequence 132 and causes the selected operator unit to be applied to the first encoded ring elements. Intermediate results of the application may be stored in operator store 150, e.g., as encoded intermediate ring elements. Calculation device 130 may compute the required parameters, or may obtain them from another source, say, parameter unit 140.
Parameter unit 140 is optional. For example, parameters may be obtained, e.g., calculated by calculation manager 130. However, a parameter unit 140 separate from manager 130 and operator module 120 has the advantage that operator selection and parameter calculation is independent and can thus also be protected separately. Protection may use hardware security measures, but may in particular also be software protection such as obfuscation. Obfuscation is more effective if the operand selection of calculation manager 130 is independent from the parameter calculation. If calculation manager 130 is independent from parameter unit 140, and they are also obfuscated separately, it will be harder for an attacker to correlate information gleaned from the two subsystems with each other. Particular effective software protection includes the application of white box cryptography.
In an embodiment, a calculation system comprises
a calculation device such as calculation device 100, which may not have a parameter unit 140, and a
a parameter unit 140
Parameter unit 140 may thus be separate from the calculation manager, arranged to compute the parameters obtained at least from the second encoded ring element for performing the ring multiplication and ring addition by the calculation manager. For example, calculation device 100 and parameter unit 140 may be implemented as distinct and different circuits. Such a calculation system may be geographically distributed in which calculation device 100 and parameter units 140 are also geographically separated from each other. For example, the geographic separation may be more than some desired distance, more than say 10 km, etc.
Streams 150 and 160 may be implemented, e.g., using an appropriate structure, say, a stack, a queue etc, say stored in a storage, such as a memory.
Calculation device 100, 101 may be embodied in a virtual machine. In this case, sequence 132 may be part of the program that runs on the virtual machine.
Conventional virtual machines (VMs) provide basic operations amongst which the addition, subtraction, multiplication, mutual exclusion and so on. The objective of this is twofold: the virtual machine provides operations and primitives which are, as such, not provided by the underlying platform, and enables a compact instruction format which is particularly useful in memory constrained environments.
However, many of the instructions of the VM still are the basic ones like addition, subtraction, multiplication, et cetera, which are directly mapped onto instructions of the underlying platform. Since these are generally well understood a VM can be quite easily attacked through the analysis of the power consumption and the injection of faults. What is more, because of this mapping it is quite easy to add tracing instructions to individual operations.
A virtual machine according to an embodiment alleviates this situation. The virtual machine has instructions for the up, down and box operation, e.g., as part of the instruction set of the VM. The instructions may only be available in a special operation mode, e.g., a security mode.
The relationship between sequences of these operations and the actual functions being performed is less direct. In practice, code to perform the arithmetic could look like:
1. (optionally) changing the mode (for instance, by assigning some address), followed by
2. a sequence of up, down and box instructions implementing the arithmetic and
3. (optionally) ending with a mode change again.
Given the number of algebraic rings and the variations in the possible representations every virtual machine could have its own arithmetic.
The virtual machine may differentiate between the executions of the up, down, and box instructions and the computation of the index (the parameter). For example, these activities may be split.
For example, one activity may be the (pre-)fetch of the sequence of operations, the other activity may be the actual looking up of the outcome of instructions. The pipeline of these activities may in fact be the actual execution model.
The up, down and box operations may be implemented using tables, which also facilitates encoded implementation. The use of a table driven approach is even possible in memory constrained environments, since with the right choice of the underlying ring R the newly defined arithmetic needs only small tables.
The consecutive up and down instructions may be combined, for example, ΔrΔs=Δrs, ∇r∇s, Δr=∇r
An advantageous calculating device is arranged to perform calculations on elements of a ring (R), a ring addition and a ring multiplication being defined on the ring, the calculating device comprising an operand store 110 arranged to store encoded ring elements, an operator module 120 comprising multiple operator units, and a combining unit, the combining unit being arranged to select two consecutive operations of the operator units, combine the selected operations into a single new operation unit, and combine the corresponding parameters accordingly.
For example, in an embodiment, the encoded ring element is the difference between said two unit ring elements (x=a−b). A representation as a pair (a,b) may be further restricted, for example, it turns out that it is particularly convenient if at least one of the elements in the list that represents an encoded ring element are units of the ring. The latter implies that calculations can be performed on the elements of the ring element more easily. The difference representation has the further advantage that knowledge of one of the ring elements encoding a ring element gives no or little information on the ring that is encoded. In an embodiment, both elements of the list are units of the ring. Note that additional constraints imposed on the representation may be reflected in table operations. For example, the box operator may be represented as a table; if difference representations are used, the output of the box operator may be restricted in the same manner, e.g., having at least one unit, having at least two units etc.
For example, to encode an element r as a difference, one may choose a random unit x of R, after which r may be represented, e.g., as r=(r+x)−x, or r=x−(x−r), or as the tuples ((r+x, x) or (x, (x−r)). Many rings allow the more restricted representation in which r is written as the difference between two units. This has the advantage that tables for the operators are smaller. Encoding for the more restricted representation may be done may enumerating all differences between units and sorting the list.
In an embodiment, at least some of the parameters are computed without using all of the multiple ring elements in an encoded representation. For example, in an embodiment, at least one parameter is computed using at most a single value from each of the first and second encoded ring elements.
More in general, there is advantage to require the elements in the list are selected from a subset of the ring, or more in particular from a subset of the units of the ring. This restrict the number of different representations of a given ring element as an encoded ring elements. This in turn restricts the size of operator units if they are implemented as tables. Below one particular system will be described in more in detail which encodes ring elements as the difference between two units.
The ring elements in this list encoded ring representation need not be plain ring elements, but may themselves be encoded to further obfuscate the system.
In an embodiment, the two ring elements in a list encoding are represented as exponents ((α,β)). The two ring elements being the exponent of a common base element (u) of the ring raised to the power indicated by the exponent (x=uα−uβ). This means that the encoded ring element (α,β) corresponds to the plain ring element x=uα−uβ. This type of encoding may be referred to a log-form. To avoid confusion we may write (α,β)u, if we want to make it explicit that log-form is used. Also in this case the exponents may be restricted to a set, and/or encoded.
Although the representation may be complicated and/or encoded we will not include this below, so as to avoid confusing the discussion.
We will refer to the operator units 222, 224, and 226 in operator module 120 as: a (dyadic) up operator unit 222, also notated as Δ; a (dyadic) down operator unit 224, also notated as ∇; and a monadic box operator unit 226, also notated as □. The names up, down and box have been chosen for convenience, but do not carry meaning in themselves. The operators 222, 224, 226 may equally be referred to as a first operator unit, second operator unit and third operator unit. The parameter in a down and up operator may be indicated as a subscript.
Dyadic up operator unit 222, Δ is arranged to
receive a representation for a first ring element (a) and a second ring element (b), the encoded ring element (x) being the difference between the first ring element and the second ring element (x=a−b), and to receive a parameter ring element (c), and
calculate the first ring element ring multiplied with the inverse of the parameter (ac−1) and calculate the second ring element ring multiplied with the inverse of the parameter (bc−1), the new encoded ring element (y) being represented by the results of said two calculations (y=ac−1−bc−1).
Mathematically, the up operator is defined by Δc((a,b))=(ac−1,bc−1). In this formula, c is the parameter, and (a,b) is the first encoded ring element. The encoded ring element (a,b) encodes the ring element x=a−b. The output of the up operator is itself also in encoded form, thus, encoding the element ac−1−bc−1.
Dyadic down operator unit 224, ∇ is arranged to
receive a representation for a first ring element (a) and a second ring element (b), the encoded ring element (x) being the difference between the first ring element and the second ring element (x=a−b), and to receive a parameter ring element (c), and
calculate the first ring element ring multiplied with the parameter (ac) and calculate the second ring element ring multiplied with the parameter (bc), the new encoded ring element (y) being represented by the results of said two calculations (y=ac−bc).
Mathematically, the down operator is defined by ∇c((a,b))=(ac,bc), in this formula, c is the parameter, and (a,b) is the first encoded ring element. The encoded ring element (a,b) encodes the ring element x=a−b. The output of the up operator is itself also in encoded form, thus, encoding the element ac−bc.
Note that the parameter c for both the up and down operator is taken from the range of the ring R. The number of allowed parameter is thus much smaller than the number of allowed inputs for the up down operator. The number of allowed inputs may be equal to the number of units times the number of elements of R. For example, the number of allowed parameters may be less than half the number of allowed inputs.
Box operator unit 226, □ is arranged to
Mathematically, the box operator 226 is defined by □((a,b))=(k,l), in which k−l=−(x+1)=−x−1. Note that there may be multiple choices for (k,l). The box operator may always pick the same choice, which may be a random choice, or a choice within some restriction on the encoded representation. Below we will assume that (k,l) are both units of R. The box operator may be expressed as the map (a,b) to (b, a+1), using the ring addition. This monadic operation is suited for expression as a table. In a ring in which not all non-zero elements are units, a table can select a representation that satisfies any unit requirement (e.g., the first elements is unit, the second element is unit, or both elements are units). Moreover, a table need not follow any particular formula expressed as an elementary expression (involving only ring addition, subtraction, multiplication and multiplicative inverses) for all inputs; in particular, does not need to follow the expression given above.
All of the operators 222, 224 and 226 may be implemented as a table. For the box operator this is a natural choice. The up and down operators 222 and 224 could also be implemented using ring arithmetic, e.g., the same ring arithmetic that is obfuscated by the calculation device.
Given a first encoded ring element and a second encoded ring element represented as (a,b) and (c,d) respectively, below a sequence is given to ring add and ring multiply them. The elements of the first encoded ring element and a second encoded ring element may be referred to as the first first ring element (a), first second ring element (b), the second first ring element (c), and the second second ring element (d).
The ring addition may be represented as follows:
(a,b)+(c,d)=(∇d∘□∘Δd∘∇c∘□∘Δc)((a,b))
In this formula function composition is indicated with ∘. For example,
first the up operator unit 222 is applied to the first encoded ring element (a,b) using parameter c, then
the box operator 226 is applied to the result of the previous operator, then
the down operator unit 224 is applied to the result of the previous operator using parameter c, then
the up operator unit 222 is applied to the result of the previous operator using parameter d, then
the box operator 226 is applied to the result of previous operator, then
the down operator unit 224 is applied to the result of the previous operator using parameter d.
The sequence of operator references may be, e.g., 224, 226, 224, 222, 226, 222 (in this case the first operator is to the left). The sequence of parameters may be, e.g., c, −, c, d, −, d, in which no parameter is indicated with a hyphen.
The ring multiplication may be represented as follows:
(a,b)·(c,d)=(∇ad∘□∘Δad∘∇bd∘□∘Δcbd)((a,b))
For example,
first the up operator unit 222 is applied to the first encoded ring element (a,b) using parameter cbd, then
the box operator 226 is applied to the result of the previous operator, then
the down operator unit 224 is applied to the result of the previous operator using parameter bd, then
the up operator unit 222 is applied to the result of the previous operator using parameter ad, then
the box operator 226 is applied to the result of previous operator, then
the down operator unit 224 is applied to the result of the previous operator using parameter ad.
The sequence of operator references may be, e.g., 224, 226, 224, 222, 226, 222 (in this case the first operator is to the left). The sequence of parameters may be, e.g., cbd, −, bd, ad, −, ad, in which no parameter is indicated with a hyphen.
The ring subtraction may be represented as follows:
(a,b)−(c,d)=(∇c∘□∘Δc∘∇d∘□∘Δd)((a,b))
For example,
first the up operator unit 222 is applied to the first encoded ring element (a,b) using parameter d, then
the box operator 226 is applied to the result of the previous operator, then
the down operator unit 224 is applied to the result of the previous operator using parameter d, then
the up operator unit 222 is applied to the result of the previous operator using parameter c, then
the box operator 226 is applied to the result of previous operator, then
the down operator unit 224 is applied to the result of the previous operator using parameter c.
The sequence of operator references may be, e.g., 224, 226, 224, 222, 226, 222 (in this case the first operator is to the left). The sequence of parameters may be, e.g., d, −, d, c, −, c, in which no parameter is indicated with a hyphen.
Other sequences that have the property that they can both calculate an addition and a multiplication may be devised. For example, by substituting a new operator unit which is the combination of the box and up operator (□∘Δ) in the above formula's, new sequences are obtained. Many other possibilities exist.
In these formulas, the results of operator units as intermediate results may be in the form of an encoded ring element. Note that these formulas produce ring element encoded as the difference of ring units in case the inputs where ring units. That the above formulas are correct may be verified by substituting the corresponding definitions of the operator units and following the mathematical derivation.
Different encoding for the ring elements may give different formulas for the operators. For example, the above description for the up, down, and box operator may be adapted to similar formulas if the encoding is in log form. Another variant is to represent an element as x which has log form (α,β)u as the list of ring elements [β,δ] wherein δ=α−β, that is x=uβ+δ−uβ. Also in this form, the operators may be expressed. For example, the up operator would become Δγ([β,δ])=[β−γ,δ]. The down operator would be the same, except with +γ instead of −γ. The box operation may be defined using the same relation as before.
Other sequence of operators exist that may also be used to create a sequence of operators so that the sequence for the ring multiplication is the same as the sequence for the ring addition. For example, in an embodiment, 2, 3, or more operators are defined operating on the elements of a list representation of an element of R. Some of the operators, say 1 or more, or 2 or more, or all but one, are pre-defined sequence of ring-operations operating on the elements of the list representation of two elements of R. The pre-defined sequence of ring-operations may be expressed as an expression involving the ring multiplication and ring-multiplicative-inverse operations, and optionally also involving ring-addition and ring-subtracting. Some of the operators, say exactly 1, 1 or more, etc, are monadic and represent a fixed operation on the ring element, for example, a fixed expression involving ring addition and the additive-inverse (the minus, ‘−’, operation); this operation may be expressed as a table operation. Although that is not necessary. In an encoded embodiment, the elements of the list representation may be encoded. The ring operations, addition, multiplications, multiplicative and additive inverses etc, may be then be implemented as encoded tables, or table networks. The list representation may be defined as a sequence of elements of ring R, and a surjective map from the list representation to R. For example, the difference representation (a,b) mapping to (a−b), is one such list representation, other examples are given herein.
Below a further sequence of operators is given that may also be used to create a sequence of operators so that the sequence for the ring multiplication is the same as the sequence for the ring addition.
For example, let R by a ring and let a, b, c, d∈R. Two elements x and y are represented as the pairs (a,b) and (c,d) using the interpretation x=a−b; y=c−d. We assume that at least b is a unit; this may be achieved by using a difference representation in which each element is a unit; this would imply that also a, c and d are units. Note the following derivation
The latter may be written again a pair (heb, geb). In this example, we define the box operator □(a,b)=a+b−1=e−f. Wherein e is a unit. For the calculation (a,b)+(c,d), first we compute (x1,x2)=∇b□Δb((a,c)). From this the result of (a,b)+(c,d) is computed as −∇eb□Δeb((x2,d). Note that x1 is not used. The multiplication may be performed using the same operators, using the identity (a,b)·(c,d)=(ac,ad)+(bd,bc).
In an embodiment, elements of the ring R may be encoded using different encodings. In the following example, two different representations of ring elements are mixed. Let x=[α,Δ0]u=uα+Δ) as
(α,Δ0)=[β,Δ1]u, wherein uΔ
(σ − α, Δ0) = [β, Δ1]u
(τ − α − β, Δ1) = [γ, Δ2]u
(τ − α − β, Δ1)
Typically, the device 100 comprises a microprocessor which executes appropriate software stored at the device 100; for example, that software may have been downloaded and/or stored in a corresponding memory, e.g., a volatile memory such as RAM or a non-volatile memory such as Flash (not separately shown). Alternatively, the device 100 may, in whole or in part, be implemented in programmable logic, e.g., as field-programmable gate array (FPGA). Device 100 may be implemented, in whole or in part, as a so-called application-specific integrated circuit (ASIC), i.e. an integrated circuit (IC) customized for their particular use. For example, the circuits may be implemented in CMOS, e.g., using a hardware description language such as Verilog, VHDL etc.
In an embodiment, device 100 comprises an operator store circuit, an operator module circuit comprising multiple operator circuits, a calculation manager circuit, and a parameter circuit. The circuits implement the corresponding units described herein. The circuits may be a processor circuit and storage circuit, the processor circuit executing instructions represented electronically in the storage circuits. The circuits may also be, FPGA, ASIC or the like. The operand storage may be a memory circuit, and may be shared with storing program code. Part of the operand storage may be non-volatile storage, e.g., to store constants, part of operand storage may be volatile storage, e.g., to store inputs, intermediate results, output results and the like. Operand storage 110 may include one or more registers.
Calculating method 300 comprises
storing 310 encoded ring elements, an encoded ring element representing an element of the ring in encoded form.
Furthermore method 300 comprises multiple operations; shown in
Method 300 comprises performing a ring multiplication 321 by applying a sequence of the multiple operations to the first encoded ring element using parameters obtained at least from the second encoded ring element, and
performing a ring addition 323 by applying a sequence of the multiple operations to the first encoded ring element using parameters obtained at least from the second encoded ring element, wherein the sequence for the ring multiplication is the same as the sequence for the ring addition.
Method 300 may comprise computing parameters for use in the operations.
Many different ways of executing the method are possible, as will be apparent to a person skilled in the art. For example, the order of the steps can be varied or some steps may be executed in parallel. Moreover, in between steps other method steps may be inserted. The inserted steps may represent refinements of the method such as described herein, or may be unrelated to the method. For example, the operations may be executed, at least partially, in parallel. Moreover, a given step may not have finished completely before a next step is started. Indeed the operators may be pipelined.
A method according to the invention may be executed using software, which comprises instructions for causing a processor system to perform method 300. Software may only include those steps taken by a particular sub-entity of the system. The software may be stored in a suitable storage medium, such as a hard disk, a floppy, a memory, an optical disc, etc. The software may be sent as a signal along a wire, or wireless, or using a data network, e.g., the Internet. The software may be made available for download and/or for remote usage on a server. A method according to the invention may be executed using a bitstream arranged to configure programmable logic, e.g., a field-programmable gate array (FPGA), to perform the method.
It will be appreciated that the invention also extends to computer programs, particularly computer programs on or in a carrier, adapted for putting the invention into practice. The program may be in the form of source code, object code, a code intermediate source and object code such as partially compiled form, or in any other form suitable for use in the implementation of the method according to the invention. An embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the processing steps of at least one of the methods set forth. These instructions may be subdivided into subroutines and/or be stored in one or more files that may be linked statically or dynamically. Another embodiment relating to a computer program product comprises computer executable instructions corresponding to each of the means of at least one of the systems and/or products set forth.
It should be noted that the above-mentioned embodiments illustrate rather than limit the invention, and that those skilled in the art will be able to design many alternative embodiments.
Advantageous embodiments for calculating are set out in the following clauses. The Applicants hereby give notice that new claims may be formulated to such clauses and/or combinations of such clauses and/or features taken from the description, during prosecution of the present application or of any further application derived therefrom.
In the claims, any reference signs placed between parentheses shall not be construed as limiting the claim. Use of the verb “comprise” and its conjugations does not exclude the presence of elements or steps other than those stated in a claim. The article “a” or “an” preceding an element does not exclude the presence of a plurality of such elements. The invention may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In the device claim enumerating several means, several of these means may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.
In the claims references in parentheses refer to reference signs in drawings of embodiments or to formulas of embodiments, thus increasing the intelligibility of the claim. These references shall not be construed as limiting the claim.
Number | Date | Country | Kind |
---|---|---|---|
2015955 | Dec 2015 | NL | national |
Filing Document | Filing Date | Country | Kind |
---|---|---|---|
PCT/EP2016/079694 | 12/5/2016 | WO | 00 |