Compact Word-Serial Modular Multiplier Accelerator Structure for Cryptographic Processors in IoT Edge Nodes with Limited Resources

Abstract

IoT is extensively used in many infrastructure applications, including telehealth, smart homes, smart grids, and smart cities. However, IoT has the weakest link in system security since it often has low processing and power resources. It is important to implement the necessary cryptographic primitives in these devices using extremely efficient finite field hardware structures. Modular multiplication is the core of cryptographic operators. Therefore, we present, in this work, a word-serial modular multiplier accelerator structure that provides the system designer with the ability to manage areas, delays, and energy consumption through selecting the appropriate embedded processor word size l. The modularity and regularity of the suggested multiplier structure makes it more suitable for implementation in ASIC technology. The ASIC implementation results indicates that the offered multiplier structure achieves area reduction compared to the competitive existing multiplier structures that vary from 76.2% to 98.5% for $l=8$, from 73.1% to 98.1% for $l=16$, and from 82.9% to 98.3% for $l=32$. Moreover, the energy reduction varies from 61.2% to 98.8% for $l=8$, from 67.7% to 98.3% for $l=16$, and from 76.1% to 98.8% for $l=32$. These results indicate that the proposed modular multiplier structure significantly outperforms the competitive ones, in terms of area and consumed energy, making it more suitable for utilization in resource-constrained IoT edge devices.

1. Introduction and Related Work

The Internet of Things (IoT) is a broad network of physical devices that are equipped with sensors, software, electronics, and a network that allows them to share data and execute tasks. IoT is a promising technology that will shape our future by providing intelligent solutions in different applications, such as smart homes, smart cities, self-driven cars, smart farming, smart grids, and telehealth. To better understand how this system works, let us look at the IoT network topology in an IoT application, such as telehealth. It is one of the many emerging infrastructure applications that relay on IoT technology, to provide services to remote users, such as stay-at-home patients, and providing quality healthcare to remote communities [1,2]. Figure 1 shows a telehealth system that relies on IoT edge devices to deliver healthcare to remote locations.

The main entities of a telehealth system are: (a) A server that could be a hospital or medical center, and naturally considered a hardware root-of-trust (HRoT) due to the layered security measures implemented. (b) Internet cloud, which is, in general, an insecure communication medium. (c) A gateway that provides an interface between the IoT edge devices and the internet. (d) Edge IoT devices that comprise sensors and actuators to measure and deliver medications to remote patients. (e) Mobile devices that allow healthcare practitioners (doctors/nurses) to remotely connect to the telehealth system. It is clear from the figure that there are many opportunities for attacks due to the use of diverse hardware platforms, diverse operating systems, insecure wireless communication media, limited processing power for many system entities, and the sheer number of people involved in the operation of the system [3,4].

Securing any system (telehealth or otherwise) implies many features that include integrity, confidentiality, authentication, non-repudiation, and availability. These security features are implemented using fundamental encryption algorithms, such as elliptic curve cryptography (ECC) and Rivest—Shamir—Adleman (RSA) algorithms. Given the power and delay restrictions for most of the devices used in most IoT systems, elliptic curve cryptography (ECC) is the encryption technique of choice due to its high level of security with shorter key lengths compared to common approaches, such as RSA [5]. An essential operation in ECC arithmetic is modular multiplication. There is an extensive body of literature covering modular multiplications in both prime fields $GF\left(p\right)$ and binary extension fields $GF\left(2^m\right)$. Most of the proposed multipliers possess high area and delay complexities, which make them unsuitable for resource-constrained IoT edge devices [6,7,8]. To overcome these limitations, several authors developed word-serial modular multipliers [9,10,11,12]. Systolic approaches were reported in [9,13,14,15] and non-systolic designs were report in [16,17,18,19]. Other authors attempted to save power and area by merging the modular multiplication and modular squaring operations [7,8,20]. However, the resulting structures were not suitable for resource-constrained IoT devices due to their high area and power requirements.

Most of the reported modular multiplier structures are classified as one-of-a kind structures. Ad hoc approaches are adopted with no consideration on how the structure can be modified to optimize system performance parameters, such as latency, throughput, power, and area requirements. The authors of this article presented a systematic methodology for implementing the modular multiplication algorithm based on the algebraic approach first proposed by the first author [21]. The systematic methodology applied linear mappings to obtain modular multiplier structures. However, linear mappings have limited abilities, both in terms of the number of parallel processing elements (PE) and also the timing strategies that could be developed.

This paper proposes using nonlinear techniques for mapping the algorithm onto parallel PEs and to obtain more flexible timing strategies. The goal of the paper is to obtain a word-serial processor accelerator for modular multiplication operations. The resulting structure gives the designer the ability to control the PE workload and the algorithm latency. The experimental results confirm that the proposed multiplier outperforms the efficient word-serial ones previously reported on in the literature, in terms of area and consumed energy for various embedded word-sizes. These design features make the proposed design more suitable for embedded applications and other resource-constrained IoT applications.

The outlining of the paper is as follows. Section 2 briefly describes the adopted modular multiplication algorithm and exhibits the details of its dependency graph. Section 3 presents the followed approach to extract the modular multiplier word-serial accelerator structure with its related logic details. Section 4 shows the realized implementation results. Section 5 concludes the recommended work.

2. Algorithm of Interleaved Modular Multiplication

We can perform modular multiplication over $GF\left(2^m\right)$ by multiplying two polynomials $P\left(\gamma \right)$ and $Q\left(\gamma \right)$ and reducing the result using the reduction polynomial $T\left(\gamma \right)$ as:

$$\begin{array}{ccc}\hfill S\left(\gamma \right)& =& P\left(\gamma \right)Q\left(\gamma \right)modT\left(\gamma \right)\hfill \end{array}$$

(1)

the general polynomial format of $P\left(\gamma \right)$, $Q\left(\gamma \right)$, and $T\left(\gamma \right)$ can be given as:

$$\begin{array}{c}\hfill P\left(\gamma \right)=\sum _{j=0}^{m-1}{p}_j{\gamma }^j=(p_0+p_1{\gamma }^1+\cdots +p_{m-1}{\gamma }^{m-1})\end{array}$$

(2)

$$\begin{array}{c}\hfill Q\left(\gamma \right)=\sum _{j=0}^{m-1}{q}_j{\gamma }^j=(q_0+q_1{\gamma }^1+\cdots +q_{m-1}{\gamma }^{m-1})\end{array}$$

(3)

$$\begin{array}{c}\hfill T\left(\gamma \right)=\sum _{j=0}^m{t}_j{\gamma }^j=(t_0+t_1{\gamma }^1+\cdots +t_m{\gamma }^m)\end{array}$$

(4)

with $p_j,q_j,t_j\in GF\left(2\right)$.

By replacing $Q\left(\gamma \right)$ in Equation (1) with its polynomial format given in Equation (3), Equation (1) can be represented as follows:

$$\begin{array}{c}\hfill S\left(\gamma \right)=P\left(\gamma \right)(q_0+q_1{\gamma }^1+\cdots +q_{m-1}{\gamma }^{m-1})modT\left(\gamma \right)\end{array}$$

(5)

we can arrange Equation (1) in the interleaved form as:

$$\begin{array}{lll}S\left(\gamma \right)& =& q_0[P\left(\gamma \right)modT\left(\gamma \right)]+q_1[{\gamma }^{1}P\left(\gamma \right)modT\left(\gamma \right)]\\ & & +\cdots +q_{m-1}[{\gamma }^{m-1}P\left(\gamma \right)modT\left(\gamma \right)]\end{array}$$

(6)

We choose to drop $\gamma$ from polynomials $P\left(\gamma \right)$, $Q\left(\gamma \right)$, $S\left(\gamma \right)$, and $T\left(\gamma \right)$ to simplify the upcoming expressions. Investigating Equation (6), we notice that the multiplication product can be produced by accumulating the terms $q_i[P{\gamma }^{i}modT]$, with $0\le i\le m-1$.

Suppose $P^i=P{\gamma }^{i}modT$, we can represent $P^{i+1}$ in terms of $P^i$ as $P^{i+1}=P{\gamma }^{i+1}modT=\left[P{\gamma }^i\right]\gamma modT=P^i\gamma modT$. Thus, the recursive form of $P^{i+1}$ can be represented as:

$$\begin{array}{lll}{P}^{i+1}& =& P^i\gamma modT\\ \sum _{j=0}^{m-1}{p}_j^{i+1}{\gamma }^j& =& \left(\sum _{j=0}^{m-1}{p}_j^i{\gamma }^j\right)\gamma modT\\ & =& \sum _{j=0}^{m-1}\left(p_j^i{\gamma }^{j+1}\right)modT\\ & =& p_{m-1}^i[{\gamma }^{m}modT]+\sum _{j=0}^{m-2}{p}_j^i{\gamma }^{j+1}\\ & =& p_{m-1}^i\sum _{j=0}^{m-1}{t}_j{\gamma }^j+\sum _{j=0}^{m-1}{p}_{j-1}^i{\gamma }^j\end{array}$$

(7)

with the initialization condition $P^0=P$. The term ${\gamma }^{m}modT$ in Equation (7) is equivalent to ${\sum }_{j=0}^{m-1}{t}_j{\gamma }^j$ as proved by [7]. Moreover, the term ${\sum }_{j=0}^{m-2}{p}_j^i{\gamma }^{j+1}$ represents a polynomial of order less than m.

The recursive Equation (7) can be expressed in the bit-level form as:

$$\begin{array}{c}\hfill p_j^{i+1}=p_{j-1}^i+p_{m-1}^i{t}_j,0\le j\le m-1\end{array}$$

(8)

with $p_{-1}^i=0$ for $0\le i\le m-1$.

The recursive form of partial product $S^{i+1}$, $0\le i\le m-1$ can be given from accumulating $P^i$ terms as:

$$\begin{array}{ccc}{S}^{i+1}& =& S^i+q_i{P}^i\\ \sum _{j=0}^{m-1}{s}_j^{i+1}{\gamma }^j& =& \sum _{j=0}^{m-1}{s}_j^i{\gamma }^j+q_i\sum _{j=0}^{m-1}{p}_j^i{\gamma }^j\end{array}$$

(9)

with $S^0=0$ and $S^m$ represents the final result S. Recursive Equation (9) can be expressed in the bit-level form as:

$$\begin{array}{c}\hfill s_j^{i+1}=s_j^i+q_i{p}_j^i\end{array}$$

(10)

with $0\le i\le m-1$, $0\le j\le m-1$, and $s_j^0=0$ for $0\le j\le m-1$.

Dependency Graph

Using reference [21], the dependence graph DG describing the modular multiplication can be obtained from Equations (8) and (10). The indices i and j in the two equations designate that the DG can be defined in a two-dimensional integer domain. Index i denotes the rows, and index j denotes the columns. Figure 2 presents the DG for the field size $m=5$. The circled nodes compute the operations depicted by Equations (8) and (10). The vertical lines represent the partial product signal $s_j^i$, the multiplier signal $p_j^i$, and the irreducible polynomial coefficient $t_j$. The horizontal lines represent the broadcast multiplicand signal $q_i$. The diagonal lines represent the signal $p_{j-1}^i$. Signals $p_j^{i+1}$ and $s_j^{i+1}$ requires signals $p_{j-1}^i$ and $p_j^i$ to be computed. The last column nodes produce signal $p_{m-1}^i$, which is used inside the column nodes, and broadcasted to the remaining row nodes as indicated in Figure 2.

As we observe from Figure 2, the input signals $s_j^0$, $p_j^0$ are fed at the upper row of the DG, and the output signals $s_j^m$ are produced from the lower row.

3. Word-Serial Accelerator Structure Exploration

We will follow a formal and systematic methodology that we previously developed in [19,21,22,23] to map the recursive–iterative multiplier algorithm to a processor array and assign an execution schedule to each processing element (PE) in the resulting array.

3.1. Scheduling Function

Consider the two-dimensional dependence graph for the polynomial modular multiplication algorithm shown in Figure 2. We assume the processor array we would like to develop has l-bit digit or word size.

A valid nonlinear scheduling function assigns an execution time value to each node or point $\mathbf{P}$ in Figure 2 according to the nonlinear expression:

$$\begin{array}{ccc}\hfill \Gamma \left(\mathbf{P}\right)& =& i⌈\frac{m}{l}⌉+⌊\frac{m-1-j}{l}⌋+1\hfill \end{array}$$

(11)

$\Gamma \left(\mathbf{P}\right)$ is the function that assigns a time instance to node $\mathbf{P}(i,j)$ in the DG.

Figure 3 shows the time index values after applying the nonlinear scheduling function in Equation (11) for the case when $m=5$ and $l=3$. The figure shows the DG points are being grouped horizontally in l-bit groups having the same execution time value. This ensures that all the bits in a single processor word are executed at the same time. An extra column of nodes is added at the left side of the DG to ensure that the number of columns in the DG is an integer multiple of l. For the general case, we need to add extra $\theta =l⌈\frac{m}{l}⌉-m$ columns, with zero inputs, at the left side of the DG. As we notice from Figure 3, the output of the multiplier will be available after $m⌈\frac{m}{l}⌉$ computation steps.

An important feature of the proposed scheduling function is to provide the system designer with the ability to control the workload of the entire processor array system. For the nonlinear scheduling formula in Equation (11), we note that only one group of l bits is active at any given time instance. Therefore, the PE workload is equal in that case to the system workload. Of course, the system designer could choose another scheduling function to choose a different system workload.

3.2. Projection Function

The projection function approach discussed in [21] projects several nodes in the DG of Figure 3 to a single node. This operation is necessary since each l group of nodes in Figure 3 operates only once. Therefore, to reuse the processing elements, we map several groups into one PE. The system workload in Figure 3 implies that we need to map all the nodes of the DG into one PE only. We propose the following nonlinear projection function to map a node $\mathbf{P}(i,j)$ to a new node $\overline{\mathbf{P}}(x,y)$:

$$\begin{array}{ccc}\hfill \overline{\mathbf{P}}(x,y)& =& {\mathbf{P}}_{serial}\mathbf{P}(i,j)\hfill \end{array}$$

(12)

$$\begin{array}{ccc}\hfill x& =& i\hfill \end{array}$$

(13)

$$\begin{array}{ccc}\hfill y& =& m-1-jmodl\hfill \end{array}$$

(14)

$$\begin{array}{ccc}\hfill {\mathbf{P}}_{serial}& =& \left[\begin{array}{cc}1& .modl\end{array}\right]\hfill \end{array}$$

(15)

where “·” is a place holder for the argument [21].

Figure 4 shows the resulting word-serial accelerator structure after applying the assumed projection function to Figure 3. The system consists of the following components:

• A processor array block whose word size is l;
• Three input registers T, P and $PL$;
• One output register S;
• Three shift-right registers SHR-S, SHR-pd and SHR-P (which is inside the processor array block);
• Rotate-right register ROR-T;
• Four three-input MUXes (two of them inside the processor array block) to select between the inputs and partial results of variables P and T.

Register P passes bit values starting from bit $p_{m-1}^0$, while register $PL$ passes the bit values of the word variable starting from bit $p_{m-2}^0$.

The partial results stored in S and P are cycled through the shift registers SHR-S and SHR-P, respectively. The fixed words of T are rotated through the rotate-right register ROR-T.

Observation of Figure 3 and Figure 4 indicates that the rightmost bit $p_d$ of register P is transferred diagonally to the following node after delayed by $r-1$ time steps, where $r=⌈m/l⌉$, while the remaining vertical and slanted word bits of P are transferred to the following bottom nodes after being blocked by r time steps. Therefore, bit $P_d$ should be passed through the shift-right register, SHR-pd, that has depth size $r-1$ as shown in Figure 4. Shift-right registers SHR-P and SHR-S, and rotate-register RoT-T all have the same width and depth sizes of l and r, respectively.

Figure 5 displays the details of the processor array block for the case $l=3$ bits. The processor array contains two types of PEs. Figure 6 and Figure 7 depict the design details of the PEs. All the PEs are interconnected in a pipeline structure to perform computing at the same time. The yellow PE in Figure 3 has two more tri-state buffers managed by the control signal e. We will discuss below the role of these extra buffers.

The operation details of the explored multiplier accelerator can be summarized for generic filed size m and word size l as follows:

• Control signal C, controlling the selection of all MUXes, activates ($C=1$) during the the first $⌈m/l⌉$ clock cycles to feed the input words of operands T, P, and $PL$ to all PEs of the processor array block. The words are fed starting with the most significant words. Moreover, the most significant bit $p_{m-1}^0$ is passed to the last PE, $P{E}_l$, and broadcasted to the remaining PEs. At the first clock cycle, SHR-S is cleared to initialize the S variable with zero values.
• Control signal C of all MUXes deactivates ($C=0$) during the remaining clock cycles to feed the resulted intermediate words of P and fixed words of T to all PEs of the processor array block. These words are passed through shift-registers SHR-P, SHR-pd, and RoT-T, respectively. Moreover, the resulted intermediate words of S are fed to all PEs of the processor array block through the shift-register SHR-S.
• Control signal e activates ($e=1$) at the clock cycles $T=\left(i\right)\lceil \frac{m}{l}\rceil +1$, $0\le i\le m$, to enable the tri-state buffer $T{r}_1$ shown in Figure 6 to horizontally feed the bits of $p_{m-1}^i$, $0\le i\le m$, to the remaining PEs. Moreover, $q_i$ input bits are broadcasted during the same clock cycles to all PEs in the processor array block. The control signal e deactivates ($e=0$) during the remaining clock cycles to enable the tri-state buffer $T{r}_2$, displayed in Figure 6, to feed the bits of $p_d$ through the shift-register SHR-pd to the input of the processor array block as shown in Figure 4.
• Control signal v, shown in Figure 5, deactivates ($v=0$) at clock cycles $T=(i+1)\lceil \frac{m}{l}\rceil$, $0\le i\le m$, to force zero bit values to the P words shown at the leftmost side of the DG, Figure 3. Control signal v activates ($v=1$) at the remaining clock cycles to feed the $P_d$ signal through the leftmost MUX of the processor array shown in Figure 5.
• The resulting output words S are available at the output bus, through register S shown in Figure 4, during clock cycles $T\ge (m-1)⌈\frac{m}{l}⌉+1$.

4. Complexities Analysis

The area, delay, and consumed energy complexities of the proposed multiplier are reported and compared to other efficient word-serial multipliers reported in [9,10,11,12].

Table 1. Estimation of area and delay for the adopted word-serial multipliers.

Multiplier	Tri-State	AND	XOR	MUXes	Flip-Flops	Latency	CPD
Xie [10]	0	$2ml$	$2ml+6m-6\frac{m}{l}+6$	0	$4ml+4m+2l$	$2\lceil m/l\rceil +2\lceil {log}_{2}l\rceil$	$2D_X$
Pan [9]	0	$m\sqrt{m}$	$\sqrt{ml}(2+l)+l$	0	$R_1$	$2\lceil \sqrt{m/l}\rceil$	${\eta }_1$
Hua [11]	0	$l^2$	$l^2+4-5l+1^{\left(1\right)}$	0	$R_2$	$6l{\lceil m/l\rceil }^2$	${\eta }_2$
Chen [12]	0	$l^2+l$	$l^2+2l$	$2l^{\left(2\right)}$	$R_3$	$D_1$	${\eta }_3$
Proposed	2	$3l+2$	$3l$	$2l$	$4l(\lceil m/l\rceil +1)-1$	$m\lceil m/l\rceil$	${\eta }_4$

(1) The three-input logic XOR area is estimated as 1.5× the area of the two-input logic XOR. (2) The switches in Multiplier of [12] have the same area as the 2-to-1 MUX as it has the same number of transistors.

summarizes the area and delay complexities of recommended multiplier and the previously reported efficient word-serial ones. The total count of logic gates/components in the accelerator structure estimates the area complexity. The entire number of clock cycles needed to produce the product represents the latency (L) of the multiplier. The whole gate delays in the longest path of the logic circuit represent the critical path delay (CPD) of the multiplier structure. The product of latency and critical path delay (CPD) estimates the delay complexity. We can represent the delays of the 2-input AND, 2-input XOR, and 2-to-1 MUX by ${\tau }_A$, ${\tau }_X$, and ${\tau }_{MUX}$ symbols, respectively.

The following formulas describe the remaining notations in Table 1:

• $R_1=7m+m\left(\lceil logm\rceil \right)+l+3$
• $R_2=2l^2+2l\left(\lceil m/l\rceil \right)+4l+1$
• $R_3=2l^2+3l\left(\lceil m/l\rceil \right)+2l$
• $D_1=l+{\lceil m/l\rceil }^2+\lceil m/l\rceil$
• ${\eta }_1={\tau }_A+(\lceil {log}_{2}l\rceil +1){\tau }_X$
• ${\eta }_2={\tau }_A+2{\tau }_X$
• ${\eta }_3={\tau }_A+{\tau }_X$
• ${\eta }_4=2{\tau }_A+{\tau }_X+{\tau }_{MUX}$

Input and output flip-flops of each multiplier structure are added to the total estimated number of its flop-flops. As we notice from Table 1, the proposed multiplier structure has a significant reduction in the area compared to other multiplier structures due to having area complexity of order $\mathcal{O}\left(l\right)$.

To quantify the results obtained in Table 1, we modeled the proposed multiplier structure and the adopted ones using VHDL hardware language and synthesized them for the recommended field size $n=409$ and embedded word sizes of $l=8$, $l=16$, and $l=32$. The synthesis was performed using NanGate Open Cell Library (15nm, 0.8V) and Synopsys tools version 2005.09-SP2. The following describes the synthesis design parameters obtained in

Table 2. Performance parameters of the adopted word-serial multipliers for $n=409$ and different values of l.

Multiplier	l	A	T	P	E	AT	%A	%AT	%P	%E
		[Kgates]	[ns]	[mW]	[fJ]
Xie [10]	8	92.9	18.3	225.6	4.1	1698.7	97.9	31.8	99.5	76.5
	16	147	9.7	375.5	3.6	1425.9	98.1	15.0	99.4	75
	32	195.1	5.5	477.4	2.6	1078.9	98.3	31.8	99.4	76.1
Pan [9]	8	130.5	9.9	252.9	2.5	1291.6	98.5	−27.3	99.6	61.2
	16	153.9	8.8	320.1	2.8	1354.6	98.2	10.5	99.3	67.7
	32	194.3	6.8	425.1	2.9	1317.6	98.3	44.2	99.3	78.1
Hua [11]	8	7.9	19,053.5	4.4	82.9	152,237.2	76.2	98.9	74.3	98.8
	16	10.4	9526.7	5.9	55.7	99,077.9	73.1	98.8	64.1	98.4
	32	19.9	4763.3	11.2	53.1	94,838.7	82.9	99.2	73.9	98.8
Chen [12]	8	10.2	659.4	5.1	3.4	6699.7	81.3	75.5	78.1	71.2
	16	13.5	203.0	8.4	1.7	2742.9	79.3	55.8	74.9	46.5
	32	26.6	86.8	15.9	1.4	2306.3	87.2	68.1	81.8	54.3
Proposed	8	1.9	865.6	1.1	0.97	1644.6	-	-	-	-
	16	2.8	432.8	2.1	0.91	1211.8	-	-	-	-
	32	3.4	216.4	2.9	0.6	735.8	-	-	-	-

:

• Area (A) results are obtained in terms of the two-input NAND gate and are represented in units of kilo-gates $kgates$.
• Total computation time (T) is represented in nano-second $ns$ time unit.
• Consumed power (P) is obtained at a frequency of 1 KHz in units of milliwatt $mW$.
• Consumed energy (E) is obtained as the product of P and T in units of femtojoule $fJ$
• Area–time product (AT) is obtained as the product of A and T in units of kgates–nanosecond $Kgates.ns$

Charts of Figure 8, Figure 9, Figure 10 and Figure 11 compare the obtained results of area (A), area–time product (AT), consumed power (P), and consumed energy (E), respectively, of the proposed multiplier structure with the adopted ones.

Figure 8 depicts that the proposed multiplier structure saves a significant amount of area ranging from 76.2% to 98.5% at $l=8$, 73.1% to 98.1% at $l=16$, and 82.9% to 98.3% at $l=32$ compared with the adopted word-serial multipliers. As we mentioned before, the saving in the area is due to the lower area complexity $\mathcal{O}\left(l\right)$ of the proposed design compared to the other designs. It is worth noting that the area of the proposed design has a slight difference at the different word sizes. This is due to the reverse relationship between the number of flip-flops and the word size l as indicated in Table 1. Therefore, as l increase, the number of flip-flops decrease and the number of basic logic components increase as it is directly proportional to the word-size l. The area complexity of the flip-flop is much higher than that of the other gates. As a result, the area reduction of flip-flops will have a significant impact on the overall area reduction of the proposed multiplier. Thus, the net result is a slight increase in the proposed design area as its word size increases. The proposed multiplier structure saves a significant amount of area ranging from 76.2% to 98.5% at $l=8$, 73.1% to 98.1% at $l=16$, and 82.9% to 98.3% at $l=32$ compared with the adopted word-serial multipliers.

Figure 9 displays the obtained area–time (AT) results of the proposed design and the adopted word-serial ones. We can read the results based on the different word-sizes l as follows:

(i)

At word-size $l=8$, the multiplier that achieves the lowest AT is the multiplier of Pan [9]. It outperforms the proposed design by %27.8 at this word size. On the other hand, the proposed multiplier outperforms the other multipliers in AT at this word size, achieving a maximum reduction of 98.9% over the design of Hua [11].

(ii)

At word-sizes $l=16$ and $l=32$, the proposed multiplier achieves the lowest AT than the other multiplier structures due to the significant reduction of its latency and computation time at these word sizes. As we notice from Table 1, the latency of the proposed multiplier is inversely proportional to the word size l. As a result, the latency significantly decreases as the word size l increases.

Figure 10 shows that proposed multiplier structure achieves a significant reduction in power consumption ranging from 74.3% to 99.6% at $l=8$, 64.1% to 99.44% at $l=16$, and 73.9% to 99.4% at $l=32$ compared to the other multiplier designs. The reduction of power is attributed to the lower area complexity of the proposed design over the other designs. The reduction in area reduces the total amount of parasitic capacitances, resulting in a significant reduction in switching activities, which is one of the primary sources of consuming power.

Figure 11 shows that the proposed multiplier structure achieves a magnified reduction in energy ranging from 61.2% to 98.8% at $l=8$, 67.7% to 98.3% at $l=16$, and 76.1% to 98.8% at $l=32$ compared to the adopted word-serial multipliers. The energy reduction is mainly attributed to the magnified reduction of the consumed power of the proposed design over the adopted ones.

From the previous analysis, we can conclude that the recommended word-serial multiplier structure outperforms the other competitor multiplier structures in terms of area and consumed energy for the different embedded word sizes. This indicates that the proposed multiplier is suitable for IoT devices in resource-constrained IoT applications.

5. Summary and Conclusions

This paper proposes a word-serial accelerator multiplier structure that performs multiplication in GF($2^m$). The multiplier was extracted based on a systematic methodology that uses non-linear scheduling and projection functions to map the nodes of the algorithm dependency graph on to parallel processing elements. The main features of the proposed multiplier involve its flexibility in managing the accelerator workload and the required total computation time steps to produce the output results. The regularity and modularity of the extracted processor array block of the multiplier accelerator make it more suitable for implementation using ASIC technology. The experimental results confirm that the proposed multiplier outperforms the efficient word-serial ones previously reported on in the literature, in terms of area and consumed energy for various embedded word sizes, making it more suitable for embedded applications and other resource-constrained IoT applications. In the future, we will use the obtained multiplier structure as a building block for the ECC cryptographic processor to evaluate the overall reduction of the cryptographic processor in terms of area and consumed energy.