Hardware Security System for Preventing Side Channel Attacks Based on Variable Radix

A hardware security system for prevent side channel attacks based on a variable radix, comprising:

• a security chip, including:
• a PUF processing module comprising a PUF array, an adaptive stabilization module, a true random number generator, and a PUF source controller, wherein the PUF array generates a digital fingerprint as a root of a key, the adaptive stabilization module extracts and stabilizes the digital fingerprint generated by the PUF array, and the PUF source controller is communicatively connected to the PUF array, the adaptive stabilization module, and the true random number generator to control overall operations of the PUF processing module, wherein some unstable PUF cells serve as entropy sources for the true random number generator;
• an encryption module communicatively connected to the PUF processing module via a top controller, the encryption module comprising hash functions, key and random number expansion functions, and both symmetric and asymmetric encryption/decryption mechanisms;
• and
• a communication interface communicatively connected to the encryption module via the top controller, for transmitting information between the security chip and an external user;
• and
• a variable radix elliptic curve multiplication module disposed within the security chip, comprising:
• a variable radix processor configured to decompose a private key into a set of symbols and radix values and convert the private key into an algorithm based on a variable radix system, thereby determining bit values for each digit as a basis for subsequent private key operations;
• an operation sequence module configured to convert the set of symbols and radix values into operation indicating elliptic curve multiplication, adopt a high-order-first strategy to process high-order symbol-radix values first, temporarily store intermediate results, and apply a distributive property during subsequent low-order operations so that only one multiplication is required to compute the result that includes high-order information;
• an insertion module configured to ensure a fixed length of the operation sequence such that the computation time for each public key generation remains nearly constant, wherein the insertion module checks the actual length of the sequence and randomly inserts dummy operations until a preset length is reached, and the dummy operations neither write to a register nor participate in subsequent operations to ensure that they do not affect the final elliptic curve computation result;
• and
• an elliptic curve module configured to perform point double and point addition operations on the elliptic curve according to the operations, wherein a base point P of the elliptic curve is defined as a generator point G, and the generator point G is continuously updated during the computation process using the distributive property and serves as the input parameter for the point addition operations.