A data encryption system based on storage and computing integrated architecture

Abstract

The present invention discloses a data encryption system based on a storage-computing integrated architecture, and relates to the field of data encryption. The data encryption system based on the storage-computing integrated architecture includes: a data receiving subsystem, a storage subsystem, an encryption subsystem, and an output subsystem; the data receiving subsystem is used to receive data to be encrypted and perform preprocessing; the storage subsystem is used to pre-store static parameters in the encryption algorithm, specifically a rotation factor array and a modulus; the encryption subsystem is used to call the static parameters in the encryption algorithm pre-stored in the storage subsystem to perform number theory transformation encryption processing on the pre-processed data to be encrypted. The present invention uses the storage-computing integrated architecture adopted by the encryption subsystem to perform the polynomial multiplication calculation with the largest overhead in the cryptographic algorithm at high speed and low power consumption, and combines number theory transformation and modular reduction operations at the same time, thereby solving the speed and power consumption bottleneck problems caused by data handling in the traditional cryptographic hardware architecture.

Description

Technical Field

[0001] The present invention relates to the field of data encryption, and specifically to a data encryption system based on a storage-computing integrated architecture. Background Art

[0002] With the rapid development of information technology and the popularization of information transmission, data security issues have received increasing attention. In the process of data transmission and storage, protecting the security and integrity of data has become an important task. Although traditional encryption systems can encrypt and protect data, they often show certain limitations when faced with large-scale data processing and high-efficiency encryption requirements.

[0003] In the prior art, common data encryption hardware architectures mostly adopt pipeline architectures or reconfigurable architectures. These two architectures are essentially storage-computation separation architectures, that is, data storage and calculation are completed by different circuits. During the execution of the algorithm, data needs to be repeatedly transferred between the storage circuit and the operation circuit, which leads to large bit-width operands, resulting in huge time and power consumption overhead for data transfer. Summary of the invention

[0004] In view of the shortcomings of the prior art, the present invention provides a data encryption system based on a storage-computing integrated architecture, which solves the problem that most common data encryption hardware architectures adopt a pipeline architecture or a reconfigurable architecture. These two architectures are essentially storage-computing separated architectures, that is, data storage and calculation are performed by different circuits. During the execution of the algorithm, data needs to be repeatedly transferred between the storage circuit and the operation circuit, which leads to large bit-width operands, resulting in huge time and power consumption overhead for data transfer.

[0005] To achieve the above objectives, the present invention is implemented through the following technical solutions: a data encryption system based on a storage and computing integrated architecture, comprising: a data receiving subsystem, a storage subsystem, an encryption subsystem, and an output subsystem; the data receiving subsystem is used to receive the data to be encrypted and perform preprocessing; the storage subsystem is used to pre-store the static parameters in the encryption algorithm, specifically the rotation factor array and the modulus; the encryption subsystem is used to call the static parameters in the encryption algorithm pre-stored in the storage subsystem to perform number theory transformation encryption processing on the pre-processed data to be encrypted; the output subsystem is used to post-process the encrypted data and output the post-processing results.

[0006] Furthermore, the data receiving subsystem includes a data receiving module and a preprocessing module; the data receiving module is used to receive data to be encrypted, and the data to be encrypted is specifically text data to be encrypted and image data to be encrypted; the preprocessing module is used to perform data unpacking and verification processing on the text data to be encrypted and the image data to be encrypted, and the specific process is as follows: respectively identify the data packet formats of the text data to be encrypted and the image data to be encrypted; determine the encoding format of the text data to be encrypted through a text editor, and based on the data packet format of the text data to be encrypted, read the original byte data in the text data to be encrypted and convert it into character data, and save the decoded character data as the original text data, analyze the text check value of the original text data through a hash function, and compare the text check value with the set text check threshold. If the text check value is equal to the set text check threshold, it is marked as text decoding success. Tag, if the text check value is not equal to the set text check threshold, the text data to be encrypted is re-decoded until the text check value meets the set text check threshold; the image data format of the image data to be encrypted is determined based on the file header information in the image data to be encrypted, the image data part in the file is read, and the image data is converted into original pixel data according to the image data format of the image data to be encrypted, and the original pixel data is represented in the form of a pixel matrix, a hash analysis is performed on the entire converted image data to obtain an image hash value of the image data, and the image hash value is compared with the set image hash threshold, if the image hash value is equal to the set image hash threshold, it is marked as an image unpacking success tag, if the image hash value is not equal to the set image hash threshold, the image data to be encrypted is re-unpacked until the image hash value meets the set image hash threshold.

[0007] Furthermore, the encryption subsystem includes a storage and computing module, a data allocation module, a number theory transformation module, an addition tree module, a modular reduction module, and a main processor; the storage and computing module is specifically a storage and computing integrated array composed of a plurality of storage and computing units, and the array can perform matrix-vector multiplication operations inside the memory; the data allocation module is used to receive the pre-processed data to be encrypted and distribute it to each storage and computing unit of the storage and computing integrated array; the number theory transformation module is used to retrieve the rotation factor array and the modulus in the pre-stored encryption algorithm in each storage and computing unit to perform number theory transformation processing on the pre-processed data to be encrypted; the addition tree module is used to merge the number theory transformation processing results of each storage and computing unit; the modular reduction module is used to perform modular reduction processing on the merged processing results of the addition tree module; the main processor is used to control the execution order of the scheduling storage and computing module, the data allocation module, the number theory transformation module, the addition tree module, and the modular reduction module, and at the same time process the branches and conditions in the algorithm, and complete the operation analysis except the number theory transformation.

[0008] Furthermore, the output subsystem includes a data post-processing module and a sending module; the data post-processing module is used to encapsulate and package the encrypted data; and the sending module is used to output the encapsulation and packaging results to a set storage device.

[0009] Furthermore, the specific steps of pre-storing the static parameters in the encryption algorithm are as follows: determine the modulus q based on the set transformation order n and the modulus discrimination model, specifically by selecting any positive integers and bringing them into the modulus discrimination model for analysis and judgment, until the modulus q with a prime value is obtained, and the modulus discrimination model is specifically q=1+kn; determine the primitive root s based on the set transformation order n and the modulus q; determine the unit root ω based on the primitive root s; calculate the rotation factor array based on the unit root; store the set transformation order n, the determined modulus q and the rotation factor array.

[0010] Furthermore, the specific steps of receiving the data to be encrypted after preprocessing and distributing it to each storage and computing unit of the storage and computing integrated array are as follows: obtaining the size information of the storage and computing integrated array, specifically m*m storage and computing units; for the text data to be encrypted, encoding each character in the original text data into ASCII code, and arranging them into a complete text vector, and using the ASCII code as the polynomial coefficient of the complete text vector; for the image data to be encrypted, linearly processing the original pixel data represented in the form of a pixel matrix to obtain a complete image vector, and using each pixel value element in the pixel matrix as the polynomial coefficient of the complete image vector; respectively judging whether the lengths of the complete text vector and the complete image vector satisfy m 2 , if the vector length does not satisfy m 2 , then fill the corresponding vector; divide the complete text vector and the complete image vector into m text sub-vectors and m image sub-vectors respectively, and the length of each sub-vector is m; and allocate each sub-vector to the storage unit of the storage-computation integrated array.

[0011] Furthermore, in each storage and computing unit, the rotation factor array and modulus in the pre-stored encryption algorithm are retrieved to perform number theoretic transformation on the pre-processed data to be encrypted. Specifically, when polynomial multiplication calculation needs to be performed in the cryptographic algorithm, the main processor writes the vector into the storage and computing module, and then performs positive number theoretic transformation on each sub-vector to obtain the representation of each sub-vector in the positive NTT field; performs element-by-element multiplication on each sub-vector; and performs inverse number theoretic transformation on the element-by-element product result of each sub-vector.

[0012] Furthermore, the number-theoretic transformation processing results of each storage and computing unit are merged by reading the number-theoretic transformation or inverse number-theoretic transformation processing results of each sub-vector and performing addition and merging item by item, specifically performing addition and merging on elements with the same position index to obtain the accumulated value of the number-theoretic transformation or inverse number-theoretic transformation processing results of the complete vector of each storage and computing unit.

[0013] Furthermore, the modular reduction processing is performed on the merged processing result of the addition tree module as follows: the accumulated value of the number-theoretic transformation or inverse number-theoretic transformation processing result of the complete vector is read to perform the modular reduction operation, specifically taking the modulus of the accumulated value under the modulus q to ensure that the result is within the range of the modulus q; and determining whether an overflow occurs during the modular reduction process, that is, the result is greater than or equal to the modulus q. If an overflow occurs, overflow processing is performed.

[0014] Furthermore, the specific process of encapsulating and packaging the encrypted data and outputting it to the set storage device is: reading the encryption result output by the main processor, and encapsulating it based on the set data format; outputting the encapsulated and packaged data to the set storage device based on the secure transmission protocol HTTPS; at the same time, ensuring that the output storage device has sufficient storage space and good access performance to meet the needs of subsequent data access and processing; and during the output process, real-time monitoring is performed based on the error handling mechanism, and related operations and events in the output process are recorded; after the output is completed, confirmation of the completion of the output is performed.

[0015] The present invention has the following beneficial effects:

[0016] (1) The data encryption system based on the integrated storage and computing architecture uses the integrated storage and computing architecture adopted by the encryption subsystem to perform the polynomial multiplication calculation with the highest cost in the cryptographic algorithm at high speed and low power consumption. At the same time, it combines number theory transformation and modular reduction operations, thereby solving the speed and power consumption bottleneck problems caused by data transfer in traditional cryptographic hardware architectures.

[0017] (2) The data encryption system based on the storage and computing integrated architecture ensures the integrity of the encrypted data through the preprocessing of the data receiving subsystem, including the unpacking and verification of text and image data. The number theory transformation processing operation of the encryption subsystem further consolidates the security of the data. The accuracy and integrity of the data during the encryption process can be verified through the inverse number theory transformation operation. Such a mechanism effectively prevents the risk of accidental destruction or tampering of data during transmission and ensures the reliability of the data.

[0018] (3) The data encryption system based on the storage and computing integrated architecture has the ability to independently perform addition, multiplication and modular reduction operations through the storage and computing module. The addition tree module can efficiently merge the processing results of each storage and computing unit. This parallel processing and merging processing mechanism greatly improves the system's data processing capability and efficiency, allowing the system to quickly and efficiently encrypt large amounts of data while ensuring the security and integrity of the data.

[0019] Of course, any product implementing the present invention does not necessarily need to achieve all of the advantages described above at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a block diagram of a data encryption system based on a storage-computing integrated architecture according to the present invention.

[0021] Figure 2 This is a flowchart of the specific steps of performing number theory transformation processing on the encrypted data after preprocessing in a data encryption system based on a storage and computing integrated architecture of the present invention.

[0022] Figure 3 This is a structural diagram of a storage-computing integrated array in a data encryption system based on a storage-computing integrated architecture of the present invention. DETAILED DESCRIPTION

[0023] The embodiment of the present application solves the problem that most common data encryption hardware architectures adopt a pipeline architecture or a reconfigurable architecture through a data encryption system based on an integrated storage and computing architecture. These two architectures are essentially storage and computing separated architectures, that is, data storage and computing are performed by different circuits. During the execution of the algorithm, data needs to be repeatedly transferred between the storage circuit and the operation circuit, which leads to large bit-width operands resulting in huge time and power consumption overhead for data transfer.

[0024] The overall idea of ​​the problem in the embodiment of this application is as follows:

[0025] First, the data receiving subsystem receives the data to be encrypted and performs preprocessing, including data unpacking and verification, to ensure the integrity and reliability of the data. Then, the encryption subsystem calls the static parameters in the storage subsystem and performs number-theoretic transformation encryption processing on the preprocessed data, including number-theoretic transformation, element-by-element multiplication, inverse number-theoretic transformation and other operations. Then, the addition tree module merges the processing results of each storage unit to obtain the cumulative value of the inverse number-theoretic transformation processing results of the complete text vector and the complete image vector. Then, the modular reduction module performs modular reduction operation on the merged processing result to ensure that the result is within the modulus range and handles possible overflow. Finally, the output subsystem encapsulates and packages the result after modular reduction processing and outputs it to the set storage device to ensure the safe storage and transmission of data.

[0026] See also Figure 1 The embodiment of the present invention provides a technical solution: a data encryption system based on a storage-computing integrated architecture, comprising: a data receiving subsystem, a storage subsystem, an encryption subsystem, and an output subsystem; the data receiving subsystem is used to receive data to be encrypted and perform preprocessing; the storage subsystem is used to pre-store static parameters in the encryption algorithm, specifically a rotation factor array and a modulus; the encryption subsystem is used to call the static parameters in the encryption algorithm pre-stored in the storage subsystem to perform number theory transformation encryption processing on the pre-processed data to be encrypted; the output subsystem is used to post-process the encrypted data and output the post-processing results.

[0027] Specifically, the data receiving subsystem includes a data receiving module and a preprocessing module; the data receiving module is used to receive the data to be encrypted, and the data to be encrypted is specifically text data to be encrypted and image data to be encrypted; the preprocessing module is used to perform data unpacking and verification processing on the text data to be encrypted and the image data to be encrypted, and the specific process is as follows: respectively identify the data packet formats of the text data to be encrypted and the image data to be encrypted; determine the encoding format of the text data to be encrypted through the text editor Emacs, and based on the data packet format of the text data to be encrypted, read the original byte data in the text data to be encrypted and convert it into character data, and save the decoded character data as the original text data, and analyze the text check value of the original text data through the hash function, specifically perform hash calculation on the extracted original text data, and compare the text check value with the set text check threshold. If the text check value is equal to the set text check threshold, it is marked as a text decoding success label. If the text check value is not equal to the set text check threshold, the text data to be encrypted is re-decoded until the text check value meets the set text check threshold; the image data format of the image data to be encrypted is determined based on the file header information in the image data to be encrypted, the file header information is a part of data located at the beginning of the image file, the image data part in the file is read, and the image data is converted into original pixel data according to the image data format of the image data to be encrypted, and the original pixel data is represented in the form of a pixel matrix, a hash analysis is performed on the entire converted image data to obtain an image hash value of the image data, and the image hash value is compared with the set image hash threshold, if the image hash value is equal to the set image hash threshold, it is marked as an image unpacking success label, if the image hash value is not equal to the set image hash threshold, the image data to be encrypted is re-unpacked until the image hash value meets the set image hash threshold.

[0028] In this embodiment, by identifying the data packet format, the system can accurately understand the organizational form of the text data to be encrypted, so as to better perform subsequent processing operations. Determining the encoding format helps the system to correctly interpret the text data, avoid confusion or errors in the data parsing process, convert the original byte data into character data, retain the original information of the text, and provide a correct data basis for subsequent processing. By calculating the check value of the text data through the hash function, the integrity and authenticity of the data can be verified to prevent the data from being tampered with or damaged during transmission, thereby ensuring the accuracy and integrity of the text data to be encrypted, and providing a reliable data source for subsequent encryption processing. At the same time, through data packet format identification and encoding format determination, the system can adapt to text data of different formats and encodings, improving the flexibility and versatility of the system. By analyzing the file header information, the system can accurately determine the format of the image data to be encrypted, ensuring the accuracy of subsequent processing, converting the image data into original pixel data, retaining the basic information and structure of the image, and providing a correct data basis for subsequent processing. By performing hash analysis on the image data, the integrity and authenticity of the image data can be verified to ensure that the image will not be erroneous or damaged during transmission and processing, thereby ensuring the integrity and reliability of the image data to be encrypted, and providing a reliable data basis for subsequent encryption processing. By determining the image data format and converting pixel data, the system can process image data of different formats and structures, enhancing the applicability and versatility of the system.

[0029] Specifically, the encryption subsystem includes a storage and computing module, a data allocation module, a number theory transformation module, an addition tree module, a modular reduction module, and a main processor; the storage and computing module is specifically a storage and computing integrated array composed of a number of storage and computing units, and the array can perform matrix-vector multiplication operations inside the memory; the data allocation module is used to receive the pre-processed data to be encrypted and distribute it to each storage and computing unit of the storage and computing integrated array; the number theory transformation module is used to retrieve the rotation factor array and the modulus in the pre-stored encryption algorithm in each storage and computing unit to perform number theory transformation processing on the pre-processed data to be encrypted; the addition tree module is specifically an addition tree circuit, which is used to merge the number theory transformation processing results of each storage and computing unit; the modular reduction module is specifically a modular reduction circuit, which is used to perform modular reduction processing on the merged processing results of the addition tree module; the main processor, that is, the CPU, is used to control the execution order of the scheduling storage and computing module, the data allocation module, the number theory transformation module, the addition tree module, and the modular reduction module, and at the same time process the branches and conditions in the algorithm, and complete the operation analysis except number theory transformation.

[0030] In this implementation, the storage and computing integrated array composed of storage and computing units enables the system to have a high degree of parallel processing capabilities. Each storage and computing unit can independently perform addition, multiplication and modular reduction operations, thereby improving the efficiency and speed of encryption processing. Each storage and computing unit can independently perform addition, multiplication and modular reduction operations, which means that the system can process multiple data blocks at the same time, speeding up the encryption processing speed, receiving and distributing the data to be encrypted. The module receives the pre-processed data to be encrypted and distributes it to each storage and computing unit of the storage and computing integrated array, realizing the effective management and distribution of data. In each storage and computing unit, the module calls the pre-stored encryption algorithm parameters, including the rotation factor array and the modulus, and performs number theory transformation processing on the encrypted data. Such a processing flow ensures the security and reliability of the data. Through the addition tree circuit, the number theory transformation processing results of each storage and computing unit are merged and processed to obtain the encrypted data. This parallel merging processing method improves the efficiency and speed of data processing. The module performs modular reduction operations to ensure that the merging processing results of the addition tree module are within the modulus range, and detects and handles overflow conditions to ensure the correctness and stability of the encryption processing results. Such an encryption subsystem structure and process ensures the efficiency, reliability and security of data during the encryption processing process. In addition, the independent operation and parallel processing capabilities of each module in the system improve the overall performance and efficiency of the system, providing effective technical support for solving large-scale data encryption and processing problems.

[0031] Specifically, the output subsystem includes a data post-processing module and a sending module; the data post-processing module is used to encapsulate and package the encrypted data; the sending module is used to output the encapsulation and packaging results to a set storage device.

[0032] In this implementation scheme, the data post-processing module is responsible for encapsulating and packaging the encrypted data. This processing method helps to improve the security and integrity of the data and prevent the data from being stolen or tampered with during transmission. The data post-processing module can format the encrypted data according to the set data format requirements to make it comply with specific standards and specifications to facilitate subsequent data storage and processing. The sending module is responsible for outputting the encapsulated and packaged encrypted data to the set storage device, such as a server, cloud storage, etc. This design allows the encrypted data to be securely stored in a specified location to facilitate subsequent access and use.

[0033] Specifically, the specific steps of pre-storing the static parameters in the encryption algorithm are as follows: determine the modulus q based on the set transformation order n and the modulus discrimination model, specifically by selecting any positive integers and bringing them into the modulus discrimination model for analysis and judgment, until the modulus q with a prime value is obtained, and the modulus discrimination model is specifically q=1+kn; determine the primitive root s based on the set transformation order n modulus q, specifically by traversing all integers from 2 to q-1, and looking for an integer s such that all q-1 powers of s cover all integers from 1 to q-1; determine the unit root ω based on the primitive root s, specifically by calculating This q should satisfy ω n =1modq; Based on the unit root, calculate the rotation factor array, specifically calculate from ω 0 to n-1 The power of is to calculate each ω i ω i modq, where i ranges from 0 to n-1; stores the set transformation order n, the determined modulus q, and the rotation factor array.

[0034] In this implementation scheme, a suitable prime modulus can be automatically determined through the modulus discrimination model without manual input, avoiding the influence of human factors on the modulus selection, and improving the reliability and security of the system. The modulus selected is a prime number, which can ensure that the properties of the modular operation in the encryption algorithm are good, ensuring the correctness and effectiveness of the encryption algorithm. The algorithm automatically finds primitive roots and unit roots, reducing the time and workload of manual search, and improving the efficiency and reliability of the algorithm. After the primitive roots and unit roots are determined, the correctness and effectiveness of the number theory transformation process can be guaranteed, and the reliability and security of the encryption algorithm can be improved. According to the determined modulus and unit roots, a rotation factor array can be automatically generated, reducing the complexity of manual calculations and improving the accuracy and efficiency of calculations. The generated rotation factor array can be used to optimize the number theory transformation process, making the transformation process more efficient and faster, and improving the execution efficiency of the encryption algorithm.

[0035] Specifically, the specific steps of receiving the data to be encrypted after preprocessing and distributing it to each storage and computing unit of the storage and computing integrated array are as follows: obtaining the size information of the storage and computing integrated array, specifically m*m storage and computing units; for the text data to be encrypted, encoding each character in the original text data into ASCII code, and arranging them into a complete text vector, and using the ASCII code as the polynomial coefficient of the complete text vector; for the image data to be encrypted, linearly processing the original pixel data represented in the form of a pixel matrix to obtain a complete image vector, and using each pixel value element in the pixel matrix as the polynomial coefficient of the complete image vector; respectively judging whether the lengths of the complete text vector and the complete image vector satisfy m 2, if the vector length does not satisfy m 2 , then fill the corresponding vector with 0 to make the length of the vector reach m 2 , to meet the requirements of NTT; the complete text vector and the complete image vector are divided into m text sub-vectors and m image sub-vectors respectively, and the length of each sub-vector is m; each sub-vector is respectively allocated to the storage unit of the storage-computation integrated array;

[0036] The specific steps for segmenting the complete image vector are as follows: For grayscale images, row-by-row and column-by-column traversal can be used; row-by-row traversal: starting from the first row of the pixel matrix, read the value of each pixel from left to right, then move to the next row, and repeat this process until the last row; column-by-column traversal: starting from the first column of the pixel matrix, read the value of each pixel from top to bottom, then move to the next column, and repeat this process until the last column. For color images, separate processing is first performed and then converted to grayscale; separate processing: linearize the values ​​of the three RGB channels in the color image separately, which will produce three independent vectors, each of which has a length equal to the total number of pixels in the image; conversion to grayscale: convert the RGB value to a single grayscale value, the specific formula is: Hd = 0.299R + 0.578G + 0.114B, and then linearize according to the above method.

[0037] In this implementation, by obtaining the size information of the storage-computing integrated array, the number of each storage-computing unit can be accurately understood, so as to reasonably allocate the data to be encrypted, make full use of system resources, improve the efficiency and performance of the system, and encode the original text data into ASCII. I code is generated and a complete text vector is formed, which is convenient for processing and encryption in the number theory transformation module, which improves the encryptability and processing efficiency of text data. For text vectors that do not meet the length requirements, they are filled to ensure that the length of each text sub-vector is consistent, so that text data can be effectively transformed in the NTT domain, which improves the stability and consistency of the system. For grayscale images, the pixel matrix can be traversed by row or column, and the pixel values ​​can be linearized into a complete image vector, which is convenient for number theory transformation and encryption processing, and improves the processing efficiency and encryptability of image data. The color image is first separated into RGB channels, and then converted into grayscale image processing so that each channel can be processed independently, ensuring the integrity and accuracy of the color image data. The size information of the storage and computing integrated array is obtained in an automated manner, making data allocation more intelligent and efficient, improving the overall performance of the data encryption system, and vectorizing the text and image data so that the data can be effectively processed and encrypted in the number theory transformation module, providing reliable technical support for data encryption and secure transmission.

[0038] Specifically, Figure 2As shown, in each storage and computing unit, the rotation factor array and modulus in the pre-stored encryption algorithm are retrieved to perform number theoretic transformation processing on the pre-processed data to be encrypted. Specifically, when polynomial multiplication calculation needs to be performed in the cryptographic algorithm, the main processor writes the vector into the storage and computing module, and then performs positive number theoretic transformation on each sub-vector to obtain the representation of each sub-vector in the positive NTT domain; performs element-by-element multiplication on each sub-vector; and performs inverse number theoretic transformation on the element-by-element product result of each sub-vector.

[0039] For example, for two polynomials A, B∈Z on a polynomial ring p / (X n ±1), calculate C = A·B∈Z p / X n ±1. Currently, the most efficient method for calculating polynomial multiplication on a polynomial ring is the number-theoretic transformation NTT. The calculation process is divided into the following three steps: first, perform a number-theoretic transformation on A and B to obtain their representations NTT(A), NTT(B) on the NTT field; second, calculate the element-by-element product NTT(C) = NTT(A)·NTT(B); finally, perform an inverse number-theoretic transformation on NTT(C) to obtain C. For A, B∈Z p / (X n -1), the above number theory transformation adopts positive cycle NTT, and the formula of its positive transformation is as follows: The formula for its inverse transformation is as follows: in, represents the sequence of the NTT domain, a represents the coefficient of the polynomial, q is a fixed prime number, n is the number of NTT points, that is, the maximum supported polynomial order, ω ij is called the rotation factor, s is a finite field Z q A primitive root.

[0040] For A,B∈Z p / (X n +1), the above number theory transformation adopts negative cycle NTT, and the formula of its positive transformation is as follows: The formula for its inverse transformation is as follows: in, represents the sequence of the NTT domain, a represents the coefficient of the polynomial, q is a fixed prime number, n is the number of NTT points, that is, the maximum supported polynomial order, ψ 2ij+i is called the rotation factor, s is a finite field Z q A primitive root.

[0041] In this implementation scheme, the rotation factor array and modulus in the pre-stored encryption algorithm are read in each storage and calculation unit to provide necessary parameter support for subsequent number theoretic transformation processing, ensure the accuracy and reliability of number theoretic transformation, perform number theoretic transformation on the sub-vectors to obtain their representations on the NTT domain, use the properties on the NTT domain to perform efficient data processing, improve the speed and efficiency of data encryption, perform element-by-element multiplication on each sub-vector, achieve simultaneous processing of encrypted data, reduce processing time and resource consumption, perform inverse number theoretic transformation on the result of the element-by-element multiplication, restore the data from the NTT domain to its original form, ensure the integrity and accuracy of the data, and provide a reliable basis for subsequent processing. By adopting the number theoretic transformation NTT method, efficient processing of encrypted data is achieved, the speed and performance of the encryption algorithm are improved, and effective technical support is provided for the implementation of the data encryption system. With the help of the characteristics of number theoretic transformation, efficient multiplication operations can be performed on the NTT domain, which greatly speeds up the data processing speed while improving the stability and reliability of the system.

[0042] Specifically, the number-theoretic transformation processing results of each storage and computing unit are merged by reading the number-theoretic transformation or inverse number-theoretic transformation processing results of each sub-vector and performing addition and merging item by item, specifically performing addition and merging on elements with the same position index to obtain the accumulated value of the number-theoretic transformation or inverse number-theoretic transformation processing results of the complete vector of each storage and computing unit.

[0043] For example, if there are two storage and calculation units, and their inverse number theory transformation results are [a1, a2, a3, ...] and [b1, b2, b3, ...] respectively, the addition tree circuit will perform the following operations: Step 1: calculate a1+b1 to obtain the merged result at the first position; Step 2: calculate a2+b2 to obtain the merged result at the second position; and so on, performing addition operations on the results at each position.

[0044] In this implementation scheme, the inverse number theoretic transformation processing results of each sub-vector are added and merged item by item to ensure that the data at each position is accurately merged, thereby obtaining the cumulative value of the inverse number theoretic transformation processing results of the complete vector. The method of adding and merging elements with the same position index is adopted to ensure that each element of the vector participates in the operation during the merging process, and there will be no data loss or misalignment, thereby ensuring the consistency and integrity of the data. Through the item-by-item addition and merging, the number theoretic transformation processing results of each storage and calculation unit are effectively merged, providing a reliable foundation for subsequent data processing and ensuring the accuracy and integrity of the encrypted data. The method of position index addition is adopted to simplify the logic of the merging process, improve the efficiency of the merging, and reduce the complexity of the processing process, providing technical support for the efficient operation of the data encryption system.

[0045] Specifically, the modular reduction is performed on the merged processing result of the addition tree module as follows: the accumulated value of the number-theoretic transformation or inverse number-theoretic transformation processing result of the complete vector is read to perform a modular reduction operation, specifically taking the modulus of the accumulated value under the modulus q to ensure that the result is within the range of the modulus q; and determining whether an overflow occurs during the modular reduction process, that is, the result is greater than or equal to the modulus q. If an overflow occurs, overflow processing is performed. A common overflow processing method is to subtract the modulus q from the result until the result is less than the modulus q.

[0046] In this implementation scheme, by performing a modulus operation on the accumulated value under the modulus, it is ensured that the result is within the range of the modulus, and the situation where the result exceeds the expected range is avoided, thereby ensuring the validity and reliability of the encryption result. When performing a modulus reduction operation, it is timely determined whether an overflow occurs, that is, the result is greater than or equal to the modulus. If an overflow occurs, a corresponding overflow processing method is adopted, such as subtracting the modulus from the result until the result is less than the modulus to ensure that the result is within the range of the modulus. The modulus reduction processing ensures the correctness and stability of the encryption result, effectively avoids the occurrence of data overflow, and improves the reliability and security of the data encryption system. The overflow processing mechanism effectively responds to abnormal situations, improves the robustness and stability of the system, and provides technical support for the reliable operation of the data encryption system.

[0047] Specifically, the specific process of encapsulating and packaging the encrypted data and outputting it to the set storage device is as follows: reading the encryption result output by the main processor, and encapsulating it based on the set data format, which can be any format suitable for storage and transmission, such as binary format, JSON format, XML format, etc.; in the encapsulation and packaging process, some metadata information can be added, such as data type, size, version number, etc., for subsequent processing and identification; based on the secure transmission protocol HTTPS, the encapsulated and packaged data is output to the set storage device, and the storage device can be a hard disk, flash memory, cloud storage, etc.; at the same time, it is ensured that the output storage device has sufficient storage space and has good access performance to meet the needs of subsequent data access and processing; and in the output process, real-time monitoring is performed based on the error handling mechanism, such as storage device write failure, network transmission interruption, etc., and related operations and events in the output process are recorded to handle possible errors; after the output is completed, confirmation of the completion of the output is performed to ensure that the data has been successfully output to the specified storage device and can be used for subsequent processing and access.

[0048] In this implementation scheme, the encrypted data is encapsulated and packaged according to the set data format, and a format suitable for storage and transmission, such as binary, JSON, XML, etc., can be selected, which improves the flexibility and versatility of the data, making the processing and transmission of data in different environments more convenient and efficient. Metadata information, such as data type, size, version number, etc., is added during the encapsulation and packaging process, which is helpful for subsequent processing and identification, improves the manageability and traceability of the data, and makes the data easier to understand and use. The encapsulated and packaged data is output to the set storage device based on the secure transmission protocol HTTPS, ensuring the security of the data transmission process, effectively preventing the risk of malicious tampering or theft of data, and improving the confidentiality and integrity of the data. During the output process, real-time monitoring is performed based on the error handling mechanism to record related operations and events, such as storage device write failure, network transmission interruption, etc., to promptly discover and handle possible errors, and ensure the reliability and stability of data transmission. Confirmation is performed after the output is completed to ensure that the data is successfully output to the specified storage device and can be used for subsequent processing and access, thereby improving the reliability and integrity of data output and providing a reliable basis for subsequent data processing.

[0049] For example, for a cell array with m rows and m columns, the maximum supported precision of each cell is w, and the data bit width of the polynomial coefficient in the cryptographic algorithm is W, then we define The storage-computation-in-one unit of a column is a group. For the storage-computation-in-one unit of the jth row and the kth column of the i-th group, the bits of storage or, for example, the [32:24] bits stored in the 1st row and the 4th column of the 2nd group with a unit precision of 8 bits, each column storage-computation-in-one unit is provided with an addition tree circuit, which is used to sum the operation results of each storage-computation-in-one unit of the column. For each group of storage-computation-in-one units, each column shares a bit merging circuit and a modular reduction circuit. The bit merging circuit is used to merge the sum results of different columns of the same group, that is, for each column of the group, the column number within the group is set to i, and the output result of the addition tree is shifted left by i*w bits and then accumulated. The modular reduction circuit is used to perform modular reduction on the operation result of the bit merging circuit, that is, calculate its remainder with respect to q.

[0050] The workflow of the data encryption system based on the storage-computing integrated architecture is as follows: S1. The main processor writes weights or bits into each storage-computing integrated unit. When the polynomial ring used by the calculated cryptographic algorithm is , the former is written, and when the polynomial ring used is , the latter is written. Since the cryptographic algorithm is determined, the weights stored in each storage-computing integrated unit are also fixed. They can be written once before running without repeated updates; S2. The main processor executes the required cryptographic algorithm and calls the storage-computing integrated array for calculation when polynomial multiplication calculation is required; S3. For the polynomial coefficients with a bit width of W, Input array, for the i-th input, input coefficients of [iw, (i-1)*w] bits, until the input is completed; S4, at the same time of each input, the storage and calculation integrated array calculates the product of the rotation factor matrix and the input polynomial coefficient vector, that is, the product of some bits, the product result is calculated by the storage and calculation integrated array and the addition tree circuit, and output to the bit merging circuit; S5, the bit merging circuit merges the input segments to obtain the rotation factor matrix and the input polynomial coefficient vector, that is, the matrix-vector multiplication result of all bits; S6, multiply the matrix-vector multiplication result by n, if n is a power of 2, this step can be simplified to left shift; S7, the modular reduction module performs modular reduction on the calculation results of each group to obtain the The result after the polynomial NTT transformation; S8, the results after the two polynomial NTT transformations are output to the main processor, the main processor multiplies the two operation results element by element, and takes the modulus of q to obtain the polynomial multiplication result on the NTT domain; S9, the polynomial multiplication result on the NTT domain is input into the storage and calculation integrated array, the calculations from S3 to S5 are repeated once, and then directly input into the modular reduction circuit for modular reduction without multiplying by n; S10, the result of the S9 operation is output to the main processor, the main processor rearranges it, the 0th component of the operation result vector remains unchanged, and the remaining components are reversed to obtain the final polynomial multiplication result; S11, the main processor continues with subsequent calculations.

[0051] In summary, this application has at least the following effects:

[0052] The encryption subsystem uses an integrated storage and computing architecture to perform the most expensive polynomial multiplication calculations in cryptographic algorithms at high speed and low power consumption. It also combines number theory transformations and modular reduction operations, thus solving the speed and power consumption bottlenecks caused by data transfer in traditional cryptographic hardware architectures.

[0053] The integrity of the data to be encrypted is ensured through the preprocessing of the data receiving subsystem, including the unpacking and verification of text and image data, while the number theory transformation processing operation of the encryption subsystem further consolidates the security of the data, and the accuracy and integrity of the data during the encryption process can be verified through the inverse number theory transformation operation. Such a mechanism effectively prevents the risk of accidental destruction or tampering of data during transmission and ensures the reliability of the data.

[0054] Because the storage and computing module has the ability to independently perform addition, multiplication and modular reduction operations, the addition tree module can efficiently merge the processing results of each storage and computing unit. This parallel processing and merge processing mechanism greatly improves the system's data processing capability and efficiency, enabling the system to quickly and efficiently encrypt large amounts of data while ensuring the security and integrity of the data.

[0055] Although the preferred embodiments of the present invention have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention.

[0056] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A data encryption system based on a storage and computing integrated architecture, characterized in that: include: Data receiving subsystem, storage subsystem, encryption subsystem, output subsystem; The data receiving subsystem is used to receive the data to be encrypted and perform pre-processing; The storage subsystem is used to pre-store static parameters in the encryption algorithm, specifically the rotation factor array and the modulus; The encryption subsystem is used to call the static parameters of the encryption algorithm pre-stored in the storage subsystem to perform number theory transformation encryption processing on the pre-processed data to be encrypted; The output subsystem is used to post-process the encrypted data and output the post-processing results; The encryption subsystem includes a storage and calculation module, a data allocation module, a number theory transformation module, an addition tree module, a modular reduction module, and a main processor; The storage and computing module is specifically a storage and computing integrated array composed of a plurality of storage and computing units, and the array can perform matrix-vector multiplication operations inside the memory; The data distribution module is used to receive the pre-processed data to be encrypted and distribute it to each storage and computing unit of the storage and computing integrated array; The number theory transformation module is used to call the rotation factor array and modulus in the pre-stored encryption algorithm in each storage and calculation unit to perform number theory transformation processing on the polynomial multiplication operation in the pre-processed data to be encrypted; The addition tree module is used to merge the number theory transformation processing results of each storage and calculation unit; The modular reduction module is used to perform modular reduction processing on the merging processing result of the addition tree module; The main processor is used to control the execution order of the scheduling storage and calculation module, the data allocation module, the number theory transformation module, the addition tree module, and the modular reduction module, while processing the branches and conditions in the algorithm and completing the operation analysis except the number theory transformation.

2. The data encryption system based on the storage and computing integrated architecture according to claim 1 is characterized in that: The data receiving subsystem includes a data receiving module and a preprocessing module; The data receiving module is used to receive data to be encrypted, wherein the data to be encrypted is specifically text data to be encrypted or image data to be encrypted; The preprocessing module is used to perform data unpacking and verification processing on the encrypted text data and the encrypted image data, and the specific process is as follows: Respectively identifying the data packet formats of the text data to be encrypted and the image data to be encrypted; Determine the encoding format of the text data to be encrypted through a text editor, read the original byte data in the text data to be encrypted and convert it into character data based on the data packet format of the text data to be encrypted, save the decoded character data as the original text data, analyze the text check value of the original text data through a hash function, and compare the text check value with the set text check threshold. If the text check value is equal to the set text check threshold, mark it as a text decoding success label. If the text check value is not equal to the set text check threshold, re-decode the text data to be encrypted until the text check value meets the set text check threshold. Based on the file header information in the image data to be encrypted, the image data format of the image data to be encrypted is determined, the image data part in the file is read, and the image data is converted into original pixel data according to the image data format of the image data to be encrypted, and the original pixel data is represented in the form of a pixel matrix, a hash analysis is performed on the entire converted image data to obtain an image hash value of the image data, and the image hash value is compared with a set image hash threshold. If the image hash value is equal to the set image hash threshold, it is marked as an image unpacking success label. If the image hash value is not equal to the set image hash threshold, the image data to be encrypted is re-unpacked until the image hash value meets the set image hash threshold.

3. The data encryption system based on the storage and computing integrated architecture according to claim 1 is characterized in that: The output subsystem includes a data post-processing module and a sending module; The data post-processing module is used to encapsulate and package the encrypted data; The sending module is used to output the encapsulation and packaging result to a set storage device.

4. The data encryption system based on the storage and computing integrated architecture according to claim 1 is characterized in that: The specific steps of pre-storing the static parameters in the encryption algorithm are as follows: Determine the modulus q based on the set transformation order n and the modulus discrimination model by selecting any positive integer and bringing it into the modulus discrimination model for analysis and judgment until the modulus q with a prime value is obtained. The modulus discrimination model is specifically: ; Determine the primitive root s based on the set transformation order n modulo q; Determine the root of unit based on the primitive root s ; Computes an array of rotation factors based on the unity root; The set transformation order n, the determined modulus q and the rotation factor array are stored.

5. The data encryption system based on the storage and computing integrated architecture according to claim 1 is characterized in that: The specific steps of receiving the pre-processed data to be encrypted and distributing it to each storage and computing unit of the storage and computing integrated array are as follows: Get the size information of the storage and computing integrated array, specifically A storage unit; For the text data to be encrypted, encode each character in the original text data into ASCII code and arrange them into a complete text vector, and use the ASCII code as the polynomial coefficient of the complete text vector; For the image data to be encrypted, the original pixel data represented in the form of a pixel matrix is ​​linearly processed to obtain a complete image vector, and each pixel value element in the pixel matrix is ​​used as a polynomial coefficient of the complete image vector; Determine whether the length of the complete text vector and the complete image vector meets , if the vector length does not satisfy , then fill the corresponding vector; The complete text vector and the complete image vector are divided into m text sub-vectors and m image sub-vectors respectively, and the length of each sub-vector is m; Each sub-vector is assigned to a storage unit of the storage-computation integrated array.

6. The data encryption system based on the storage and computing integrated architecture according to claim 5 is characterized in that: In each storage unit, the rotation factor array and modulus in the pre-stored encryption algorithm are retrieved to perform number theory transformation on the pre-processed data to be encrypted. Specifically, the following is done: When polynomial multiplication calculations need to be performed in the cryptographic algorithm, the main processor writes the vector into the storage and calculation module, and then performs positive number theory transformation on each sub-vector to obtain the representation of each sub-vector in the positive NTT field; Perform element-wise multiplication for each subvector; Perform an inverse number-theoretic transformation on the result of the element-wise product of each subvector.

7. The data encryption system based on the storage and computing integrated architecture according to claim 6 is characterized in that: The specific method of merging the number-theoretic transformation results of each storage and computing unit is to read the number-theoretic transformation or inverse number-theoretic transformation results of each sub-vector and perform addition merging item by item, specifically, perform addition merging on the elements with the same position index to obtain the accumulated value of the number-theoretic transformation or inverse number-theoretic transformation results of the complete vector of each storage and computing unit.

8. The data encryption system based on the storage and computing integrated architecture according to claim 7 is characterized in that: The modular reduction process is performed on the merged processing result of the addition tree module as follows: Read the accumulated value of the result of the number-theoretic transformation or the inverse number-theoretic transformation of the complete vector and perform a modular reduction operation, specifically, taking the accumulated value modulo the modulus q to ensure that the result is within the range of the modulus q; And determine whether an overflow occurs during the modular reduction process, that is, the result is greater than or equal to the modulus q. If an overflow occurs, overflow processing is performed.

9. The data encryption system based on the storage and computing integrated architecture according to claim 8 is characterized in that: The specific process of encapsulating and packaging the encrypted data and outputting it to the specified storage device is as follows: Read the encryption result output by the main processor and encapsulate it based on the set data format; The encapsulated and packaged data is output to the specified storage device based on the secure transmission protocol HTTPS; At the same time, ensure that the output storage device has sufficient storage space and good access performance; In addition, during the output process, real-time monitoring is performed based on the error handling mechanism, and related operations and events in the output process are recorded; After the output is completed, confirm that the output is completed.

Images