KR20200107739A - Apparatus and method for performing matrix multiplication operation being secure against side channel attack - Google Patents

Abstract

Provided are a device for performing a matrix multiplication operation which is safe against side channel attacks and a method thereof. According to an embodiment of the present invention, the method, which is executed in a computing device including at least one processor and a memory for storing at least one program executed by the at least one processor, comprises the following steps of: shuffling an operation order of a multiplication operation between elements of a first matrix and elements of a second matrix for a matrix multiplication operation between a first matrix and a second matrix; and performing the matrix multiplication operation based on the shuffled operation order.

Description

Device and method for performing matrix multiplication operation that is safe for side channel attacks {APPARATUS AND METHOD FOR PERFORMING MATRIX MULTIPLICATION OPERATION BEING SECURE AGAINST SIDE CHANNEL ATTACK}

Embodiments of the present invention relate to techniques for preventing side channel attacks.

Currently used public key cryptography RSA (Rivest Shamir Adleman), ECC (Elliptic Curve Cryptography), etc. are based on mathematical difficulties such as large number of prime factorizations and discrete logarithm problems on rings or finite fields. However, through quantum computing technology, problems that are difficult to solve with currently used computing capabilities can be quickly solved. Moreover, the algorithm proposed by Shor in 1995 can solve prime factorization problems and discrete logarithm problems in polynomial time on quantum computers. This means that it can break most of the current public key cryptography systems, putting the public key infrastructure on which the web infrastructure depends at risk. As an alternative to this threat, there is an increasing demand for Post-Quantum Cryptography (PQC).

Currently, many algorithms proposed as PQC mainly use matrix operations. The reason why such matrix operations are mainly used is that the design of a cryptographic algorithm that is safe even for quantum computers can be constructed by performing matrix multiplication operations. However, matrix multiplication is vulnerable to side-channel attacks such as Simple Power Analysis (SPA) attacks, Differential Power Analysis (DPA) attacks, and collision attacks, so the currently proposed PQC algorithm using matrix multiplication They are all vulnerable to side-channel attacks.

Korean Patent Application Publication No. 10-2014-0054647 (registered on February 2, 2016)

Embodiments of the present invention are to provide an apparatus and method for performing a matrix multiplication operation that is safe for a subchannel attack.

A method according to an embodiment of the present invention is a method performed in a computing device having at least one processor and a memory for storing at least one program executed by the at least one processor, comprising: a first matrix and a second matrix Shuffling an operation order of a multiplication operation between elements of the first matrix and elements of the second matrix for a matrix multiplication operation of And performing the matrix multiplication operation based on the shuffled operation order.

The matrix multiplication operation may be performed for at least one of encryption and decryption based on a Post-Quantum Cryptography algorithm.

At least one of the first matrix and the second matrix may be repeatedly used to perform at least one of the encryption and the decryption.

The shuffling may include changing an operation order of a vector multiplication operation for the matrix multiplication operation, and shuffling an operation order of a multiplication operation between the elements of the first matrix and the elements of the second matrix. have.

The shuffling may include changing an operation order of a multiplication operation between an element of a row vector and an element of a column vector for at least one of the vector multiplication operations for the matrix multiplication operation, and the elements of the first matrix and the An operation order of a multiplication operation between elements of the second matrix may be shuffled.

The shuffling may include generating one or more sequences based on the sizes of the first matrix and the second matrix, and elements of the first matrix and elements of the second matrix based on the one or more sequences It is possible to shuffle the order of operations of multiplication operations between.

An apparatus according to an embodiment includes: one or more processors; And a memory storing one or more programs configured to be executed by the one or more processors, wherein the program includes elements of the first matrix for a matrix multiplication operation between a first matrix and a second matrix, and Shuffling an operation order of a multiplication operation between elements of the second matrix; And instructions for executing the step of performing the matrix multiplication operation based on the shuffled operation order.

The matrix multiplication operation may be performed for at least one of encryption and decryption based on a Post-Quantum Cryptography algorithm.

At least one of the first matrix and the second matrix may be secret information repeatedly used to perform at least one of the encryption and the decryption.

The shuffling may include changing an operation order of a vector multiplication operation for the matrix multiplication operation, and shuffling an operation order of a multiplication operation between elements of the first matrix and elements of the second matrix. have.

The shuffling may include changing an operation order of a multiplication operation between an element of a row vector and an element of a column vector for at least one of the vector multiplication operations for the matrix multiplication operation, and the elements of the first matrix and the An operation order of a multiplication operation between elements of the second matrix may be shuffled.

The shuffling may include generating one or more sequences based on the sizes of the first matrix and the second matrix, and elements of the first matrix and elements of the second matrix based on the one or more sequences It is possible to shuffle the order of operations of multiplication operations between.

According to embodiments of the present invention, when performing a matrix multiplication operation, by shuffling an operation order of multiplication operations that can be independently performed for a corresponding matrix multiplication operation, and performing a matrix multiplication operation according to the shuffled operation order, It is possible to reduce the probability of occurrence of the same intermediate value at a specific time, and accordingly, the number of power waveforms required for a side channel attack increases, so that side channel attacks can be effectively prevented

1 is a block diagram illustrating and describing a computing environment including a computing device suitable for use in example embodiments.
2 is a flowchart of a matrix multiplication operation method according to an embodiment of the present invention

Hereinafter, a specific embodiment of the present invention will be described with reference to the drawings. The following detailed description is provided to aid in a comprehensive understanding of the methods, devices, and/or systems described herein. However, this is only an example and the present invention is not limited thereto.

In describing the embodiments of the present invention, when it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, a detailed description thereof will be omitted. In addition, terms to be described later are terms defined in consideration of functions in the present invention and may vary according to the intention or custom of users or operators. Therefore, the definition should be made based on the contents throughout this specification. The terms used in the detailed description are only for describing embodiments of the present invention, and should not be limiting. Unless explicitly used otherwise, expressions in the singular form include the meaning of the plural form. In this description, expressions such as "comprising" or "feature" are intended to refer to certain features, numbers, steps, actions, elements, some or combination thereof, and one or more other than those described. It should not be construed to exclude the presence or possibility of other features, numbers, steps, actions, elements, any part or combination thereof.

1 is a block diagram illustrating and describing a computing environment 10 including a computing device suitable for use in example embodiments. In the illustrated embodiment, each component may have different functions and capabilities in addition to those described below, and may include additional components in addition to those not described below.

The illustrated computing environment 10 includes a computing device 12. In an embodiment, the computing device 12 may be a device for performing a method of performing a matrix multiplication operation according to embodiments of the present invention. The computing device 12 includes at least one processor 14, a computer-readable storage medium 16 and a communication bus 18. The processor 14 may cause the computing device 12 to operate according to the exemplary embodiments mentioned above. For example, the processor 14 may execute one or more programs stored in the computer-readable storage medium 16. The one or more programs may include one or more computer-executable instructions, and the computer-executable instructions are configured to cause the computing device 12 to perform operations according to an exemplary embodiment when executed by the processor 14 Can be.

The computer-readable storage medium 16 is configured to store computer-executable instructions or program code, program data, and/or other suitable form of information. The program 20 stored in the computer-readable storage medium 16 includes a set of instructions executable by the processor 14. In one embodiment, the computer-readable storage medium 16 includes memory (volatile memory such as random access memory, nonvolatile memory, or a suitable combination thereof), one or more magnetic disk storage devices, optical disk storage devices, flash It may be memory devices, other types of storage media that can be accessed by computing device 12 and store desired information, or a suitable combination thereof.

The communication bus 18 interconnects the various other components of the computing device 12, including the processor 14 and computer-readable storage medium 16.

Computing device 12 may also include one or more input/output interfaces 22 and one or more network communication interfaces 26 that provide interfaces for one or more input/output devices 24. The input/output interface 22 and the network communication interface 26 are connected to the communication bus 18. The input/output device 24 may be connected to other components of the computing device 12 through the input/output interface 22. The exemplary input/output device 24 includes a pointing device (such as a mouse or trackpad), a keyboard, a touch input device (such as a touch pad or a touch screen), a voice or sound input device, and various types of sensor devices and/or a photographing device. Input devices and/or output devices such as display devices, printers, speakers, and/or network cards. The exemplary input/output device 24 may be included in the computing device 12 as a component constituting the computing device 12, and may be connected to the computing device 12 as a separate device distinct from the computing device 12. May be.

In the following embodiment, the matrix is used as a concept including not only a matrix including a plurality of rows and a plurality of columns, but also a vector matrix (ie, a row vector or a column vector) including only one row or one column, respectively. do.

In addition, the following embodiments are based on a quantum resistant cryptography (Post-Quantum Cryptography, PQC) algorithm that requires a matrix multiplication operation to perform at least one of encryption and decryption, such as, for example, QcBits, Rainbow, UOV, Frodo, etc. It can be performed during encryption or decryption. Specifically, the computing device 12 may perform at least one of encryption and decryption using a quantum resistant encryption algorithm that requires a matrix multiplication operation, and when a matrix multiplication operation is required during encryption or decryption, the following implementation According to examples, the matrix multiplication operation may be performed.

2 is a flowchart of a matrix multiplication operation method according to an embodiment of the present invention.

Referring to FIG. 2, first, the computing device 12 shuffles the order of multiplication operations between elements of a first matrix and elements of a second matrix for a matrix multiplication operation between a first matrix and a second matrix. Shuffling (210).

In this case, the first matrix and the second matrix mean the left matrix and the right matrix of the matrix multiplication operation, respectively. Specifically, in the case of a matrix multiplication operation AB between a matrix A of size m×n and a matrix B of size n×r, the first matrix refers to the left matrix A, and the second matrix refers to the right matrix B. . Hereinafter, the first matrix and the second matrix are used with the same meaning.

According to an embodiment, at least one of the first matrix and the second matrix may be secret information repeatedly used to perform at least one of encryption and decryption based on a quantum resistant cryptographic algorithm, such as a secret key, for example. . In addition, the order of the multiplication operation between the elements of the first matrix and the elements of the second matrix for the matrix multiplication operation is randomly shuffled each time a matrix multiplication operation is performed using a matrix that is secret information among the first matrix and the second matrix. Can be.

Meanwhile, according to an embodiment, the computing device 12 changes the order of vector multiplication operations for matrix multiplication operations between the first matrix and the second matrix, so that the elements of the first matrix and the elements of the second matrix are changed. It is possible to shuffle the order of operations of multiplication operations between. In this case, the vector multiplication operation refers to a matrix multiplication operation between a row vector (ie, a 1×n matrix) and a column vector (ie, an n×1 matrix), and is hereinafter used with the same meaning.

Specifically, when the size of the first matrix is m×n and the size of the second matrix is n×r, a matrix multiplication operation between the first matrix and the second matrix may be performed according to Equation 1.

[Equation 1]

(이때, i∈{1, 2,..., m}, j∈{1, 2,..., n})는 제1 행렬 A의 원소,

(이때, k∈{1, 2,..., r})는 제2 행렬 B의 원소,

는 결과 행렬 X의 원소를 나타낸다. In Equation 1, A represents a first matrix, B represents a second matrix, and X represents a result matrix derived by a matrix multiplication operation between the first matrix and the second matrix. Also,

(In this case, i∈{1, 2,..., m}, j∈{1, 2,..., n}) are the elements of the first matrix A,

(In this case, k∈{1, 2,..., r}) is the element of the second matrix B,

Denotes the elements of the resulting matrix X.

각각은 아래의 수학식 2와 같이 제1 행렬 A에 포함된 행 벡터 중 i번째 행 벡터와 제2 행렬 B에 포함된 열 벡터 중 k번째 열 벡터 사이의 벡터 곱 연산을 통해 독립적으로 계산될 수 있다.Meanwhile, in Equation 1, the elements of the resulting matrix X

Each can be independently calculated through a vector multiplication operation between the i-th row vector of the row vectors included in the first matrix A and the k-th column vector of the column vectors included in the second matrix B as shown in Equation 2 below. have.

[Equation 2]

Accordingly, even if the operation order of the vector multiplication operation to be performed for the matrix multiplication operation between the first matrix A and the second matrix B is changed, the same result as before the change can be obtained.

와 k번째 열 벡터에 포함된 원소

사이의 곱셈 연산

와 곱셈 연산 결과 사이의 덧셈을 통해 수행된다. 따라서, 제1 행렬 A와 제2 행렬 B 사이의 행렬 곱 연산을 위해 수행되어야 할 벡터 곱 연산의 연산 순서가 변경되는 경우, 제1 행렬 A에 포함된 원소

와 제2 행렬 B에 포함된 원소

사이의 곱셈 연산

의 연산 순서 역시 변경된다.Meanwhile, as can be seen from Equation 2, the vector multiplication operation between the i-th row vector of the row vectors included in the first matrix A and the k-th column vector of the column vectors included in the second matrix B is performed on the i-th row vector. Elements included

And the elements in the kth column vector

Multiplication operation between

It is performed through the addition between the and the result of the multiplication operation. Therefore, when the order of vector multiplication operations to be performed for the matrix multiplication operation between the first matrix A and the second matrix B is changed, the elements included in the first matrix A

And the elements in the second matrix B

Multiplication operation between

The order of operations of is also changed.

Accordingly, the computing device 12 changes the order of vector multiplication operations for the matrix multiplication operation between the first matrix and the second matrix, so that the elements of the first matrix and the elements of the second matrix for the matrix multiplication operation are changed. It is possible to shuffle the operation order of the multiplication operation between them.

Meanwhile, according to an embodiment, the computing device 12 performs a multiplication operation between an element of a row vector and an element of a column vector for at least one of vector multiplication operations for a matrix multiplication operation between the first matrix and the second matrix. By changing the operation order, the operation order of the multiplication operation between the elements of the first matrix and the elements of the second matrix can be shuffled.

와 곱셈 연산 결과 사이의 덧셈을 통해 수행된다. 이때, 곱셈 연산

은 독립적으로 계산될 수 있는 연산으로 연산 순서가 변경되더라도

의 값은 변경되지 않는다.Specifically, as described above, the vector multiplication operation between the i-th row vector of the row vectors included in the first matrix A and the k-th column vector of the column vectors included in the second matrix B is a multiplication operation as shown in Equation 2.

It is performed through the addition between the and the result of the multiplication operation. In this case, the multiplication operation

Is an operation that can be calculated independently, even if the order of operations changes

The value of is not changed.

Accordingly, the computing device 12 changes the operation order of the multiplication operation between the elements of the row vector and the elements of the column vector for at least one of the vector multiplication operations for the matrix multiplication operation between the first matrix and the second matrix. An operation order of a multiplication operation between elements of the first matrix and elements of the second matrix for a matrix multiplication operation between the first matrix and the second matrix may be shuffled.

Thereafter, the computing device 12 performs a matrix multiplication operation between the first matrix and the second matrix according to the shuffled operation order (220).

On the other hand, when changing at least one of the order of the vector multiplication operation and the order of the multiplication operation between the element of the row vector and the element of the column vector for the vector multiplication operation each time the matrix multiplication operation between the first matrix and the second matrix is performed, When performing the matrix multiplication operation, the probability that the same intermediate value occurs at a specific time decreases to 1/ρ (here, ρ=m×n×r). Accordingly, in this case, since the number of power waveforms required for subchannel attack is increased by ρ ² , the subchannel attack can be effectively prevented.

Meanwhile, in the flowchart shown in FIG. 2, the method is described by dividing the method into a plurality of steps, but at least some of the steps are performed in a different order, combined with other steps, performed together, omitted, or divided into detailed steps. Or, one or more steps not shown may be added and performed.

와 크기가 3×2인 제2 행렬

사이의 행렬 곱 연산 AB에 대해 본 발명의 일 실시예에 따른 행렬 곱 연산 방법을 적용하는 구체적인 예를 설명한다. In the following, the size is a 2x3 first matrix

And a second matrix of size 3×2

A specific example of applying the matrix multiplication operation method according to an embodiment of the present invention to the matrix multiplication operation AB will be described.

Specifically, the matrix multiplication operation AB may be performed according to Equation 3 below.

[Equation 3]

In addition, the elements of the resultant matrix X are obtained through a vector multiplication operation between each row vector included in the first matrix A and each column vector included in the second matrix B, as shown in Equations 4 to 7 below. I can.

[Equation 4]

[Equation 5]

[Equation 6]

[Equation 7]

In this case, according to an embodiment, the computing device 12 generates one or more sequences based on the sizes of the first matrix A and the second matrix B, and the first matrix A and the first matrix based on the generated one or more sequences. The order of the multiplication operation between the elements of the first matrix and the elements of the second matrix for the matrix multiplication operation between the 2 matrices B may be shuffled.

Specifically, according to an embodiment, the computing device 12 includes a first random sequence having a length equal to the number of rows of the first matrix A (ie, 2) and the number of columns of the second matrix B (ie, 2). At least one of the second random sequences having the same length as is generated, and the order of vector multiplication operation may be changed according to the generated random sequence.

In this case, a number included in the first random sequence may indicate an index of a row vector included in the first matrix A, and a position of each number in the first random sequence may indicate an operation order. Similarly, each number included in the second random sequence may indicate an index of a column vector included in the second matrix B, and a position of each number in the second random sequence may indicate an operation order.

For example, when the first random sequence is S ₁ ={2, 1}, and the second random sequence is S ₂ ={1, 2}, the computing device 12 is Equation 6 => Equation 7 = > Equation 4 => Vector multiplication operation may be performed in the order of Equation 5.

Meanwhile, according to an embodiment, the computing device 12 may generate one or more third random sequences having a length equal to the number of columns of the first matrix A (ie, 3). In this case, the computing device 12 performs a multiplication operation order between the elements of the row vector and the elements of the column vector for at least one of the vector multiplication operations according to Equations 4 to 7 according to the generated one or more third random sequences. Can be changed.

In this case, the number included in the third random sequence may indicate an index of each element included in the row vector in the row vector, and a position of each number included in the third random sequence in the third random sequence may indicate an operation order.

=>

=>

로 변경, 수학식 5에 따른 벡터 곱 연산을 위한 곱셈 연산의 순서를

=>

=>

로 변경, 수학식 6에 따른 벡터 곱 연산을 위한 곱셈 연산의 순서를

=>

=>

로 변경, 수학식 7에 따른 벡터 곱 연산을 위한 곱셈 연산의 순서를

=>

=>

로 변경 중 적어도 하나를 수행할 수 있다. For example, when the third random sequence is S ₃ ={3, 2, 1}, the computing device 12 performs a multiplication operation for a vector multiplication operation according to Equation 4

=>

=>

Change to, the order of the multiplication operation for the vector multiplication operation according to Equation 5

=>

=>

Change to, the order of the multiplication operation for the vector multiplication operation according to Equation 6

=>

=>

Change to, the order of the multiplication operation for the vector multiplication operation according to Equation 7

=>

=>

At least one of the changes to can be performed.

=>

=>

로 변경하고, S_3,1에 기초하여 수학식 5에 따른 벡터 곱 연산을 위한 곱셈 연산의 순서를

=>

=>

로 변경할 수 있다.As another example, the computing device 12 generates a plurality of different third random sequences corresponding to one of the vector multiplication operations according to Equations 4 to 7, respectively, and equations according to the generated third random sequences. The order of multiplication operations may be changed for some of the vector multiplication operations according to 4 to 7. Specifically, the computing device 12 includes a third random sequence S _3,1 ={3, 2, 1} corresponding to the vector multiplication operation according to Equation 4, and a third random sequence S _3,1 ={3, 2, 1} corresponding to the vector multiplication operation according to Equation 5. A random sequence S _3,2 ={2, 1, 3} can be generated. In this case, the computing device 12 determines the order of the multiplication operation for the vector multiplication operation according to Equation 4 based on S _3,1 .

=>

=>

And the order of the multiplication operation for the vector multiplication operation according to Equation 5 based on S _3,1

=>

=>

Can be changed to.

Meanwhile, in the above-described example, it was exemplified that the operation order of the multiplication operation between the elements of the first matrix A and the elements of the second matrix B is shuffled using a random sequence, but the order of operations is shuffled. The method may be performed according to various methods in addition to the above-described examples, and is not necessarily limited to a specific method.

Although the present invention has been described in detail through the exemplary embodiments above, those of ordinary skill in the art to which the present invention pertains have found that various modifications can be made to the above embodiments without departing from the scope of the present invention. I will understand. Therefore, the scope of the present invention is limited to the described embodiments and should not be determined, and should not be determined by the claims to be described later, but also by those equivalents to the claims.

10: computing environment
12: computing device
14: processor
16: computer readable storage medium
18: communication bus
20: program
22: input/output interface
24: input/output device
26: network communication interface

Claims (12)

One or more processors, and
A method performed in a computing device having a memory storing one or more programs executed by the one or more processors,
Shuffling an operation order of a multiplication operation between elements of the first matrix and elements of the second matrix for a matrix multiplication operation between a first matrix and a second matrix; And
And performing the matrix multiplication operation based on the shuffled order of operations.
The method according to claim 1,
The matrix multiplication operation is performed for at least one of encryption and decryption based on a Post-Quantum Cryptography algorithm.
The method according to claim 2,
At least one of the first matrix and the second matrix is secret information repeatedly used to perform at least one of the encryption and the decryption.
The method according to claim 1,
The shuffling may include changing an operation order of a vector multiplication operation for the matrix multiplication operation, and shuffling an operation order of a multiplication operation between elements of the first matrix and elements of the second matrix. .
The method according to claim 1,
The shuffling may include changing an operation order of a multiplication operation between an element of a row vector and an element of a column vector for at least one of the vector multiplication operations for the matrix multiplication operation, and the elements of the first matrix and the A method of shuffling an operation order of a multiplication operation between elements of a second matrix.
The method according to claim 1,
The shuffling may include generating one or more sequences based on the sizes of the first matrix and the second matrix, and elements of the first matrix and elements of the second matrix based on the one or more sequences How to shuffle the order of operations of multiplication operations between.
One or more processors; And
An apparatus comprising a memory storing one or more programs configured to be executed by the one or more processors,
The above program,
Shuffling an operation order of a multiplication operation between elements of the first matrix and elements of the second matrix for a matrix multiplication operation between a first matrix and a second matrix; And
And instructions for performing the step of performing the matrix multiplication operation based on the shuffled order of operations.
The method of claim 7,
The matrix multiplication operation is performed for at least one of encryption and decryption based on a Post-Quantum Cryptography algorithm.
The method of claim 8,
At least one of the first matrix and the second matrix is secret information repeatedly used to perform at least one of the encryption and the decryption.
The method of claim 7,
The shuffling may include changing an operation order of a vector multiplication operation for the matrix multiplication operation, and shuffling an operation order of a multiplication operation between elements of the first matrix and elements of the second matrix .
The method of claim 7,
The shuffling may include changing an operation order of a multiplication operation between an element of a row vector and an element of a column vector for at least one of the vector multiplication operations for the matrix multiplication operation, and the elements of the first matrix and the An apparatus for shuffling an operation order of a multiplication operation between elements of a second matrix.
The method of claim 7,
The shuffling may include generating one or more sequences based on the sizes of the first matrix and the second matrix, and elements of the first matrix and elements of the second matrix based on the one or more sequences A device for shuffling the order of operations of multiplication operations between.

Images