Let $p=4q-1$ be a prime with $q\ge3$ also prime. Let $G=\{0,1,\dots,p-1,\infty\}$. The following law $*$ makes $(G,*)$ a commutative group of order $4q$ with neutral element $\infty$:
$$a*b=\begin{cases}
a&\text{if }b=\infty\\
b&\text{if }a=\infty\\
\infty&\text{if }a\ne\infty\text{ and }b\ne\infty\text{ and }a+b\equiv 0\pmod p\\
{a\,b-1\over a+b}\bmod p&\text{otherwise}\end{cases}$$
The inverse of $a$ for law $*$ is $p-a$, with the exceptions of $0$ and $\infty$ which are their own inverse. Proof of associativity requires care, and uses $p\equiv3\bmod4$ at some point.

Computation can be simplified by keeping an element of $G$ as an integer fraction $x\over y$ with $x$ and $y$ integers modulo $p$, and the neutral element $\infty$ represented as $x\over0$ with $x\not\equiv0\pmod p$. The group law becomes, without any special case:
$${x_a\over y_a}*{x_b\over y_b}={(x_a\,x_b-y_a\,y_b)\bmod p\over(x_a\,y_b+y_a\,x_b)\bmod p}$$
and we need only 4 multiplications, 1 addition, 1 subtraction, and 2 modular reductions for $a*b$; down to 2 squarings, 1 multiplication, 1 doubling, 1 subtraction, and 2 modular reductions for $a*a$.

Since we have a group law, we can define exponentiation. Exponents can be reduced modulo $4q$, the order of the group.

Let $g$ be an element of order $q$. It can be found heuristically, perhaps starting from $g=2$ incrementally and checking $g^4\ne\infty$ and $g^q=\infty$.

**Question**: How hard is the Discrete Logarithm Problem in the cyclic subgroup of prime order $q$ generated by $g$? Is that an Elliptic Curve group for some well known (supersingular?) curve?

  [1]: https://en.wikipedia.org/wiki/Group_(mathematics)#Definition