BCH Code Based Multiple Bit Error Correction in Finite Field Multiplier Circuits
Total Page:16
File Type:pdf, Size:1020Kb
BCH Code Based Multiple Bit Error Correction in Finite Field Multiplier Circuits M. Poolakkaparambil1, J. Mathew2, A. M. Jabir1, Dhiraj K. Pradhan2 and S. P. Mohanty3 1Dept. of Comp. Sci. & Electronics, Oxford Brookes University, UK 2Department of Computer Science, University of Bristol, UK 3Department of Comp. Sci. & Engineering, University of North Texas Abstract— This paper presents a design methodology for mul- providing the correct information to the external world. Recent tiple bit error detection and correction in Galois field arithmetic research proposes various schemes to overcome such attacks. circuits such as the bit parallel polynomial basis (PB) multipliers The conventional approach for concurrent error detection over GF(2m). These multipliers are crucial in most of the cryptographic hardware designs and hence it is essential to ensure may be considered as a one-to-one mapping between the that they are not vulnerable to security threats. Security threats output of the functional unit, which is represented as a binary arising from injected soft (transient) faults into a cryptographic vector of length k, and a codeword which is a binary vector circuit can expose the secret information, e.g. the secret key, of length n [13]. Namely, a codeword represents a Boolean to an attacker. To prevent such soft or transient fault related expression that is a minterm. The Hamming distance between attacks, we consider fault tolerance as a method of mitigation. Most of the current fault tolerant schemes are only multiple bit the codewords must be greater than one, otherwise, it is error detectable but not multiple bit error correctable. Keeping impossible to detect an error. This restriction increases the this in view, we present a multiple bit error correction scheme implementation cost of the functional unit and the implemen- based on the BCH codes, with an efficient bit-parallel Chien tation cost of the checker [15]. The most commonly used search module. This paper details the design procedure as fault tolerant schemes for single error detection/correction well as the hardware implementation specs. Comparison with existing methods demonstrate improved area, and reduced delay are the error detection and recalculation methods, and the performances. error correcting designs [11] [9]. In the error detection and recalculation scheme, the concurrent error detection circuitry I. INTRODUCTION (CED) monitors for an error occurrence and, in case of an Online error detection and correction has received much error, it rolls backs and recalculate again. The drawback of this attention in recent years as a candidate for attack tolerant approach is that it often increases the time redundancy. An- cryptographic hardware design and to certain extent fault other commonly used approach is the N-modular redundancy tolerance as well [1]. With low operating voltage levels and (NMR). In NMR, the actual circuitry is replicated N times low noise margins, digital designs are often vulnerable to and the decision of whether the resultant output is correct is various faults [2]. In present day communication devices, cryp- decided by a voting circuitry. The main pitfall of this method is tographic hardware is an inevitable part. The cryptographic the increase in space redundancy depending upon the number hardware often needs to store some information hidden in of bit error corrections we need. In [5], a single error correction order to ensure high degree of information security. The (SEC) scheme based on the Hamming codes is proposed, while Faults resulting in incorrect output are mainly due to naturally in [10] this method has been extended to the LDPC codes and occurring faults or due to malicious attacks. The former the method in [6] used to synthesize efficient circuits. can be detected with various testing techniques, whereas the Motivation and Contribution: From the literature review latter cannot be detected with the testing schemes presently made, it is evident that efficient error correcting designs available. Clearly, this can result in catastrophe, if unde- for Galois field based arithmetic circuits are not fully ex- tected [8]. Attacks against such cryptography hardware are plored. Our proposed scheme overcomes most of the design often classified into two categories: invasive and non-invasive. drawbacks mentioned above. Firstly, this is the first known The invasive attacks are based on reverse engineering and approach for bit parallel multiple error correction based on hence require costly equipment. The non-invasive method, on BCH codes for the multipliers over GF(2m), where as all the other hand, exploits the implementation weakness of the the existing techniques considered only single bit error. As device and is also known as the side channel attacks [3]. It a part of the design, we also propose an efficient bit parallel is also noted that, hacking of information within the chip is implementation of the Chein search module within the error possible by introducing hardware Trojans within the process correcting circuitry. Secondly, most of the discussed error cor- variation allowance of the chip [4]. In these types of attacks, rection schemes impose much higher time redundancy where the attacker may try to acquire the hidden information by as our proposed multiple bit error correction scheme runs in injecting random events, e.g. through transient faults, into the parallel with the logic, hence requires less time overhead. The hardware [7]. To keep our information hidden, we need to added delay is only due to the decoding part of the proposed mask these injected faults and ensure that the devices keep scheme. In the parity based error correction schemes [1], [5], the error in the parity blocks can not be detected, where as bis, where 0 ≤ i ≤ m − 1, are the coordinates of A and B re- in the proposed scheme, the errors in the parity blocks are spectively. The formulation is based on three matrices namely, detected as well as the final outputs corrected. We have also an m×m reduction matrix Q, a lower triangular matrix L and derived the closed form expressions for the parity prediction an upper triangular matrix U. The matrix based multiplication block. is formulated as an inner product (IP) network with two vector → The remainder of this paper is organized as follows. Sec- outputs d~ and e respectively, where, tion II explains the basic fundamentals of the Galois field d~ L~b (1) arithmetic and Polynomial basis multiplication. In Section III, = we present the design methodologies of the BCH code based ~e = U~b, (2) multiple error correction scheme. Section IV presents the where~b = [b ,b ,b ,...,b ]T , a vector column of the coor- experimental results, and finally Section V concludes the paper 0 1 2 m−1 dinates and xT represents the x transpose. The matrices L and with future extensions of our research. U are defined in [12]. The multiplication outputs are given by the equation: II. PRELIMINARIES ~c = d~ + QT~e, (3) For completeness, this section presents the preliminaries of Galois field (GF) arithmetic, which is necessary for both the where the matrix Q, which is dependent on the irreducible multiplier as well as the BCH coding scheme. polynomials, can be derived as shown in [12] and ~c = T For every prime number p, there exists a Galois field, [c0,c1,c2,...,cm−1] is the output bits. For the sake of clarity, also known as the finite fields, over the set GF(p) having we depict a small example below. p elements with special elements 0 and 1 as the additive Example 1: Let A and B be two multiplicands over GF(23) and multiplicative identities respectively. It is possible to generated with the irreducible polynomial P(x) = x3 + x + 1 extend the fields over GF(p) to a field that consists of pm with A = [a0,a1,a2] and B = [b0,b1,b2]. Then, A and B can also 2 2 elements, where m is a nonzero positive integer. This extended be represented as A = a2x + a1x + a0 and B = b2x + b1x + field over the set GF(pm) is known as the extension of the b0 in the polynomial form. The product C(x) = A(x) · B(x) 2 2 field over GF(p). Let ‘+’ and ‘·’ represent the addition and mod P(x). Now, C(x) = (a2x +a1x+a0)·(b2.x +b1x+b0) = 4 3 2 multiplication operations on the field elements. Then GF(pm) (a2b2)x +(a1b2 +a2b1)x +(a0b2 +a1b1 +a2b0)x +(a0b1 + forms a finite field if it forms a commutative ring with identity a1b0)x+(a0b0). Let us consider the outputs of the IP networks over these two operations. The finite fields over GF(2), and d and e. In the GF(23) arithmetic, d and e are column vectors their extensions over GF(2m), have particular interest in digital having 3 and 2 elements respectively. Let d = [d0,d1,d2] and electronics owing to the field elements 0 and 1 only. e = [e0,e1]. Then C(x) can be rewritten as, The finite fields over GF 2m can be generated with monic ( ) C(x) = e x4 + e x3 + d x2 + +d x + d . (4) m−1 ∑m−2 i 1 0 2 1 0 irreducible polynomials of the form P(x) = x + i=0 ci.x , where ci ∈ GF(2) [14]. Other than elements 0 and 1 the field consists of elements that are multiples of the element α, also AB known as the primitive element, where α is the root of P(x) m m i.e. P(α) = 0. P(x) is also known as the primitive polynomial m m of the field. To make sure that the operations over the field are finite, any element in the field having power > 2m−1 is reduced m−bit PB GF Multiplier BCH Check−bit to an element with power < 2m−1 by using the primitive Generation polynomial P(x).