CN113255257B

CN113255257B - S box circuit optimization method and system based on process library

Info

Publication number: CN113255257B
Application number: CN202110579580.4A
Authority: CN
Inventors: 王美琴; 孙思维; 樊燕红; 吴立轩
Original assignee: Shandong University; Institute of Information Engineering of CAS
Current assignee: Shandong University; Institute of Information Engineering of CAS
Priority date: 2021-05-26
Filing date: 2021-05-26
Publication date: 2023-04-07
Anticipated expiration: 2041-05-26
Also published as: CN113255257A

Abstract

The invention belongs to the field of circuit optimization, and provides a process library-based S-box circuit optimization method and system, wherein the method comprises the following steps: taking the root node as an initial circuit, and performing single gate expansion on the source node according to each target node to build a search tree layer by layer; the circuit areas of the nodes on the same layer of the search tree are the same, and the difference between the areas of the nodes on the two adjacent layers is the greatest common divisor of the areas of all standard unit gate circuits in the set process library; and stopping constructing the search tree on the condition that the first-appearing node meets the circuit of the given Boolean function F to obtain the circuit of the Boolean function F with the minimum area.

Description

S box circuit optimization method and system based on process library

Technical Field

The invention belongs to the field of circuit optimization, and particularly relates to an S-box circuit optimization method and system based on a process library.

Background

The statements in this section merely provide background information related to the present disclosure and may not necessarily constitute prior art.

The importance of Application Specific Integrated Circuit (ASIC) design is becoming increasingly prominent in the digital information age. The key element logic synthesis in ASIC design optimizes high level function or digital circuit description language mapping to a representation of gate level circuits. The logic synthesis link plays a crucial role in generating ASICs with low implementation cost and high performance. Therefore, the development of logic synthesis techniques and tools is a fundamental issue in the field of digital design. In the field of lightweight symmetric cryptography, an effective logic synthesis tool can directly and indirectly influence the hardware implementation performance of a cryptographic algorithm. The synthesis tool can be used to guide the design of cryptographic components and to optimize existing cryptographic components.

And guiding the design of the password component. A typical lightweight cryptographic algorithm is designed as follows, i need to select some components like MDS matrix and S-box to instantiate the algorithm after the overall architecture of the cryptographic algorithm is determined. In the step of designing the selected components, under some constraints (such as security and time delay), some optimization strategies (such as area) are specified, and the password components of the selected targets are searched from some candidate components. How the performance of the search selection component depends to a large extent on the effectiveness of the integration technique. A good comprehensive tool can help designers select high-quality and low-implementation-cost password components.

Existing cryptographic components are optimized. For a given cryptographic algorithm, the synthesis tool is able to generate circuits that satisfy various area and delay constraints to meet the practical application requirements of the cryptographic algorithm product. One way to optimize a cryptographic algorithm is to optimize the performance of the implementation of the cryptographic component. For example, many documents focus mainly on the optimization of the areas of MDS matrices and S-boxes.

The final implementation circuit of the cryptographic algorithm depends on a specific process library to be constructed, but most synthesis tools cannot directly convert a given design into a unit circuit of a target library due to complexity problems. In contrast, the process of circuit synthesis is typically accomplished in a two-step approach, where the first step is process library independent, using an abstract mathematical representation, with only limited logic gates (e.g., AND, OR, NOT) in the process library. In this step, many CAD tools often employ techniques such as two-level logic optimization methods or multi-level logic optimization methods. The resulting process-independent optimization design may ultimately be used to implement gate-level circuits of cryptographic algorithms under any particular library of process cells via process mapping techniques. This method is very efficient for medium-scale building blocks and is widely used in practice. However, the inventors have found that splitting the process into these separate stages can result in performance loss, e.g., the output of the first stage may not match the target architecture.

Disclosure of Invention

In order to solve the technical problems in the background art, the invention provides an optimization method and system of an S-box circuit based on a process library, which can quickly and accurately optimize the S-box circuit.

In order to achieve the purpose, the invention adopts the following technical scheme:

the first aspect of the invention provides a process library-based optimization method for an S-box circuit, which comprises the following steps:

taking the root node as an initial circuit, and performing single gate expansion on the source node according to each target node to build a search tree layer by layer; the circuit areas of the nodes on the same layer of the search tree are the same, and the difference between the areas of the nodes on the two adjacent layers is the greatest common divisor of the areas of all standard unit gate circuits in the set process library;

and stopping building the search tree on the condition that the first node is generated and meets the circuit of the given Boolean function F, so as to obtain the circuit of the Boolean function F with the minimum area.

A second aspect of the invention provides a process library-based optimization system for an S-box circuit.

A system for optimization of S-box circuitry based on a process library, comprising:

the search tree building module is used for building a search tree layer by taking the root node as an initial circuit and performing single gate expansion on the source node according to each target node; the circuit areas of the nodes on the same layer of the search tree are the same, and the difference between the areas of the nodes on the two adjacent layers is the greatest common divisor of the areas of all standard unit gate circuits in the set process library;

and the minimum area circuit searching module is used for stopping building the search tree on the condition that the first occurrence node meets the circuit of the given Boolean function F to obtain the circuit of the Boolean function F with the minimum area.

A third aspect of the invention provides a computer-readable storage medium.

A computer-readable storage medium, having stored thereon a computer program which, when executed by a processor, carries out the steps in the optimization method of S-box circuits based on process libraries as described above.

A fourth aspect of the invention provides a computer apparatus.

A computer apparatus comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor when executing the program implementing the steps in the process library-based S-box circuit optimization method as described above.

Compared with the prior art, the invention has the beneficial effects that:

the method comprises the steps of constructing a search tree construction module, taking root nodes as initial circuits, performing single gate expansion on each target node by a source node to construct a search tree layer by layer, wherein the circuit areas of the same layer of nodes of the search tree are the same, the difference between the areas of two adjacent layers of nodes is the greatest common divisor of the areas of all standard unit gate circuits in a set process library, and finally stopping constructing the search tree by taking the circuit with the node appearing for the first time meeting a given Boolean function F as a condition to obtain the circuit with the Boolean function F with the smallest area, so that an S-box circuit is quickly and accurately optimized.

Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention.

Drawings

The accompanying drawings, which are incorporated in and constitute a part of this specification, are included to provide a further understanding of the invention, and are incorporated in and constitute a part of this specification, illustrate exemplary embodiments of the invention and together with the description serve to explain the invention and not to limit the invention.

FIG. 1 (a) is a three-input circuit depicting the definition of a signal sequence and a gate sequence;

FIG. 1 (b) is a four-input circuit depicting the definition of a signal sequence and a gate sequence;

FIG. 2 (a) is a representation of a circuit with various signal-gate sequences 1;

FIG. 2 (b) is a representation of a circuit with various signal-gate sequences 2;

FIG. 3 (a) is a simple circuit 1 illustrating a single gate extension;

FIG. 3 (b) is a simple circuit 2 illustrating a single gate extension;

FIG. 4 is a visualization of a search space of an embodiment of the present invention;

FIG. 5 is a process diagram of the optimization method of the S-box circuit based on the process library according to the embodiment of the invention;

FIG. 6 is a flowchart of a method for optimizing S-box circuitry based on a process library according to an embodiment of the present invention.

Detailed Description

The invention is further described with reference to the following figures and examples.

It is to be understood that the following detailed description is exemplary and is intended to provide further explanation of the invention as claimed. Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

It is noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of exemplary embodiments according to the invention. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, and it should be understood that when the terms "comprises" and/or "comprising" are used in this specification, they specify the presence of stated features, steps, operations, devices, components, and/or combinations thereof, unless the context clearly indicates otherwise.

Example one

The minimization of Boolean expressions is well known

The completely difficult problem. Circuit minimization is a problem that has been studied in the art of circuit synthesis and circuit optimization in general, but introduces another level of complexity because process-independent representations (such as boolean expressions and truth tables) are eventually converted to netlists of target process library cells during synthesis. To address these complexities, the industry typically divides the integrated process into two steps: process independent optimization and process mapping. At each step, this method simply attempts to find the current best solution and relies heavily on heuristic methods rather than systematic searching. However, for small S-boxes, the present embodiment can search the design space more systematically. For global optimization, the method provided by the embodiment can directly synthesize the truth table of the small S box into the netlist of the target process library unit. The method of the present embodiment produces superior circuit implementation results for many S-boxes compared to existing state-of-the-art synthesis tools. In particular, by applying the method of the present embodiment to AESInvolving in S-box tower domain implementation

Inverter, the present embodiment can achieve the lightest circuit implementation of AES S-box at present.

The embodiment can find the optimized implementation of the small S box under a specific process library according to the logic unit gate in the process library. We propose a synthesis algorithm that can guarantee that the area of the synthesized 3 x 3S-boxes is optimal. The algorithm can also be applied to the optimization implementation of 4 x 4S boxes, and the optimization performance is improved compared with other optimization tools. For in AES S box tower domain

A subassembly that the tool can optimize and generate an AES S box minimum area implementation circuit.

Specifically, as shown in fig. 5 and fig. 6, the method for optimizing the S-box circuit based on the process library of the present embodiment includes:

step S101: taking the root node as an initial circuit, and performing single gate expansion on the source node according to each target node to build a search tree layer by layer; the circuit areas of the same layer of nodes of the search tree are the same, and the difference between the areas of the two adjacent layers of nodes is the greatest common divisor of the areas of all standard unit gate circuits in the set process library.

Step S102: and stopping constructing the search tree on the condition that the first-appearing node meets the circuit of the given Boolean function F to obtain the circuit of the Boolean function F with the minimum area.

Specifically, an ordered set of n elements is defined as

In this embodiment, there are no allowed duplicate elements, so all elements in the ordered set are different. When the order is not important, we use

To represent the set z ₀ ，…，z _n-1 }。For an ordered or unordered set->

Represents->

Is->

An ordered subset of (c). E.g. to make->

Then all binary ordered subsets are combined as:

logic gates and combinational circuits:

logic gates are the basic building blocks of combinational logic circuits. A logic gate corresponds to a boolean function of one or more inputs. Logic gates in a frequently used CMOS process library are listed in table 1. The number of input bits of gate β is defined as # β. From table 1, # NOT =1, # NAND =2, and # OAI21=3 are derived. For a logic gate β, β (x) of # β = l ₀ ，…，x _l-1 ) Expressed as a Boolean expression with l input variables (x) ₀ ，…，x _l-1 ) Beta of (c) is related. For example, MUX (x) ₀ ，x ₁ ，x ₂ )＝x ₀ x ₁ +x ₀ x ₂ +x ₂ The order of the variables requires attention, MUX (x) ₀ ，x ₂ ，x ₁ )＝x ₀ x ₂ +x ₀ x ₁ +x ₁ And MUX (x) ₀ ，x ₁ ，x ₂ ) Different.

TABLE 1 logic gates commonly used in CMOS Process libraries

Logic synthesis is the process of combining a logic circuit that implements a given boolean function using a known set of basic logic gates. It is not hard to imagine that the design space of a moderately complex vector boolean function is very large, and how to determine the optimal implementation for a certain target is a fundamental problem in logic design. To facilitate our discussion, we introduce some definitions.

Definition of

Is a collection of logic gates, uses->

To construct a combined circuit, called->

An electrical circuit. With N-bit input (x) ₀ ，…，x _n-1 ) Is/are>

The electricity may be represented as a sequence of signals

A sequence of gate signal pairs:

thus, when 1. Ltoreq. I < t, the following expression x exists _n+i-1 ＝β _i-1 (x _i-1 ). Symbol x _j (n.ltoreq.j < n + t) represents a variable { x [) ₀ ，x ₁ ，…，x _j-1 A Boolean function of, in fact, also can be viewed as a variable of { x } ₀ ，x ₁ ，…，x _n-1 ) A boolean function of (a). Let us call x ₀ ，…，x _n-1 As an input signal, x _n ，…，x _n+t-1 Is the derivative signal. The signal sequence is

And a gate sequence of>

The corresponding circuit is defined as->

The detailed description is given by way of example. />

Example 1. Order

And is

Then

Circuit>

See fig. 1 (a), corresponding circuit in fig. 1 (b)

The expression of (c) is as follows:

it is noted that for a given circuitThe representation of the signal sequence and the gate sequence is not exclusive. Taking fig. 2 (a) and 2 (b) as an example, the circuit in the figure can be represented as

Or->

The specific expression mode is as follows:

or

Therefore, such repetitions need to be carefully excluded in the search algorithm.

Area:

given a set of doors

For each door>

The area of the gate is defined as beta, which is a positive value. E.g. to make->

Their absolute area is 0.532um ² ，0.798um ² ，1.064um ² ，0.798um ² And 2.394um ² . Converted to equivalent Gate (GE) units, they correspond to 0.67GE, 1.00GE, 1.33GE, 1.00GE, and 3.00GE, respectively. The relative implementation cost is the most fundamental in the algorithm, and the area of the gate is set to be:

||NOT||＝0.67×100＝67，||NAND||＝1.00×100＝100，

OR | =1.33 × 100=133, | | NOR | =1.00 × 100=100, and | | XOR | =3.00 × 100=300.

The algorithm principle is as follows:

order to

Is a collection of logic gates, is asserted>

Is a kind of>

Circuit->

If and only if the following conditions are met:

the circuit implements a vector Boolean function

Will (x) ₀ ，…，x _n-1 ) Is converted into

(f ₀ (x ₀ ，…，x _n-1 )，…，f _m-1 (x ₀ ，…，x _n-1 ))。

The goal of the algorithm is to Boolean function for a given vector

Search for a minimum area>

An electrical circuit. Initial circuit of the algorithm>

Can be expressed as: />

And &>

Subsequent algorithms are processed using single gate expander circuits.

Definitions 1. Given one

Circuit->

Signal sequence input with n bits>

And-gate sequence->

To indicate. We pick up by means of a door>

To the extension circuit, and gate circuit beta _t Associated is an ordered set>

Thus->

Generates a new circuit as an input>

Whose instruction sequence is->

The signal sequence is [ x ] ₀ ，x ₁ ，…，x _n-1 ，x _n ，…，x _n+t-1 ，x _n+t ]Are combined with each otherJ is more than or equal to 0 and less than or equal to n + t, and the following condition x is satisfied _n+t ≠x _j . Above slave->

Is derived to>

Is called using>

To circuit

The operation of single gate expansion is performed.

Use of

And &>

To mark the signal sequence->

And the instruction sequence->

The dependency of (2). For example, the following expression is found in definition 1:

and

FIG. 3 (a) shows a circuit

Can be expressed as:

FIG. 3 (b) shows a circuit

Can be expressed as:

a simple theory is given when introducing the following algorithmic framework.

Theory 1. Order

Is a set of gates and->

Is one>

-an electrical circuit. Then->

Is that

Multiples of (a). Therefore, for any->

A circuit, some non-negative integer k being present, so that the equation

This is true. Where gcd denotes the greatest common divisor.

For non-negative integer k, let

Is that all areas are->

Is/are>

-a set of circuits, wherein there is not one area less than ≧>

The circuit of (2). For a +>

By means of a single-gate expansion systematically generates ++>

In (a) all +>

-an electrical circuit. With k =1,2, \ 8230, increasing, our algorithm generates each layer of circuitry until the boolean function F is satisfied, which is the desired circuit.

The algorithm corresponding to the optimization method of the S-box circuit based on the process library in this embodiment is described by "algorithm 1" in the following table:

the "shape" of the search space, as shown in FIG. 4, invokes a circuit that explores the accesses during the search space nodes. For an n-bit input circuit, the search space of this embodiment is a tree structure with a circuit representation of the root node of the tree

And &>

The nodes are distributed in different layers, and the nodes in the same layer are respectively pairedThe area of the corresponding circuit is the same. Two nodes are connected directly by an edge, which means that the destination node is a single gate extension of the source node.

Algorithm 1 lines 1 through 5, a root node is created and placed in the list

In (1). Lines 9 through 19, the algorithm creates a list of nodes ≧ which>

So as to->

Each circuit in (a)>

All have>

And expanded by a single door, and>

is determined by>

Is formed by a number of nodes. This process is described in more detail below.

By selecting one of the satisfies

Conditional (see row 10) logic gates to create a ∑ or @>

And (c) a node of (c). Here ω ≧ 0 is required because ≧ 0>

New node on is->

A single gate extension of the upper node, whose area satisfies ^ or ^>

Then for +>

Each node in (see line 13), an ordered subset of the signal set for that node is selected->

And will>

Is connected to the input pin of the beta logic gate. And then adds the new node to the list->

In, this corresponds to &>

One single gate extension (see line 19). />

Due to the fact that

The logic gates in (1) are arranged from small to large in area, so that when the areas of the two logic gates are the same, their order is arbitrary. Let the set of ordered logic gates be [ beta ] ₀ ，β ₁ ，…，β _s-1 When selecting β _j If it is->

The remaining logic gates may be stopped from checking because, for any t > 0, there is a check in the order in which the logic gates are arranged

If->

And/or>

Instead of an empty set, logic gate β is used _j Make->

All possible single gate extension circuits are layered. All of these circuits have an area which is->

And will be stored in +>

In (1). In this process, the algorithm will return each time a circuit implementing the boolean function F is encountered (see lines 20 and 21).

With the ordered increase of k, the method of this embodiment systematically searches for an area of

The circuit space of (a). Thus, the first time a circuit meeting a given Boolean function F is encountered in the search is the circuit implementation of the Boolean function F of minimum area.

The rules that generate the search space may ensure that the in-degree of each node is one (except for the root node, which is zero). Furthermore, each node corresponds to a vector function, and a vector function has at most one node corresponding to it. For each node, there is a unique directional path from the root node to the node, from which we can obtain the circuit implementation of the minimum area of the node.

Any new node is obtained by performing a single gate expansion on the previous node. A new signal derived by using the single gate expansion is added to the signal sequence of the source node, thereby obtaining a signal sequence of the newly created node. The method retains all information of the intermediate signal of the building circuit in the whole searching process.

Example two

The embodiment provides an optimization system of an S-box circuit based on a process library, which specifically includes:

the search tree construction module is used for constructing a search tree layer by taking the root node as an initial circuit and performing single gate expansion on the source node according to each target node; the circuit areas of the nodes on the same layer of the search tree are the same, and the difference of the areas of the nodes on the two adjacent layers is the greatest common divisor of the areas of all standard unit gate circuits in the set process library;

and the minimum area circuit searching module is used for stopping building the search tree under the condition that the first occurrence node meets the circuit of the given Boolean function F to obtain the circuit of the Boolean function F with the minimum area.

It should be noted that, each module in the optimization system of the S-box circuit based on the process library in this embodiment corresponds to each step in the optimization method of the S-box circuit based on the process library in the first embodiment one by one, and the specific implementation process thereof is the same, and the description thereof is not repeated here.

EXAMPLE III

The present embodiment provides a computer-readable storage medium, on which a computer program is stored, which when executed by a processor implements the steps in the optimization method of the S-box circuit based on the process library as described in the first embodiment above.

Example four

The embodiment provides a computer device, which comprises a memory, a processor and a computer program stored in the memory and capable of running on the processor, wherein the processor executes the program to realize the steps in the optimization method of the S-box circuit based on the process library as described in the first embodiment.

As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of a hardware embodiment, a software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, optical storage, and the like) having computer-usable program code embodied therein.

The present invention is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.

These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by a computer program, which can be stored in a computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. The storage medium may be a magnetic disk, an optical disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), or the like.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A process library-based S-box circuit optimization method is characterized by comprising the following steps:

2. The method of claim 1, wherein the search tree has a node with an entry degree of one except for a root node.

3. The method for optimizing a S-box circuit based on a process library of claim 1, wherein each of the nodes from the root node to the search tree has a unique directional path.

4. The method for optimizing S-box circuits based on process libraries of claim 1, wherein each target node is single-gated by the source node using gates that are all standard cell gates in a given process library.

5. The method of claim 4, wherein all standard cell gates in the process library are configured as an ordered set of logic gates.

6. The process library-based S-box circuit optimization method of claim 5, wherein the standard cell gate circuits in the ordered set of logic gates are arranged from small to large in area.

7. The method of claim 5, wherein the order of two logic gates in the ordered set of logic gates is arbitrary when their areas are the same.

8. A process library-based S-box circuit optimization system, comprising:

the search tree construction module is used for constructing a search tree layer by taking the root node as an initial circuit and performing single gate expansion on the source node according to each target node; the circuit areas of the nodes on the same layer of the search tree are the same, and the difference between the areas of the nodes on the two adjacent layers is the greatest common divisor of the areas of all standard unit gate circuits in the set process library;

9. A computer-readable storage medium, on which a computer program is stored, which program, when being executed by a processor, carries out the steps of the method for optimization of a library-based S-box circuit according to any one of claims 1 to 7.

10. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, wherein the processor when executing the program implements the steps in the method for optimization of a library-based S-box circuit according to any one of claims 1-7.