Hardware implementation methods, devices, and security chips for number theory transformations

Abstract

The present invention relates to the technical field of number theory transformation calculation, and specifically discloses a hardware implementation method, device and security chip for number theory transformation, including: obtaining polynomial data to be calculated, and calculating the rotation factors and inverse rotation factors required for number theory transformation of the polynomial data to be calculated; writing the rotation factors and inverse rotation factors into different storage spaces respectively, and the storage address of the storage space of the inverse rotation factor is determined by adding 1 to the storage address of the storage space of the rotation factor; preprocessing the polynomial data to be calculated; calling a number theory transformation hardware calculation unit, reading the rotation factors, inverse rotation factors and the preprocessed polynomial data to be calculated for number theory transformation calculation, and the calculation results of each two adjacent calculation stages are stored in two storage spaces with adjacent storage addresses in a circular manner. The hardware implementation method for number theory transformation provided by the present invention can reduce the hardware storage space occupancy rate without increasing the cost.

Description

Technical Field

[0001] The present invention relates to the field of number theory transformation calculation technology, and in particular to a hardware implementation method for number theory transformation, a hardware implementation device for number theory transformation and a security chip. Background Art

[0002] Homomorphic encryption (HE) allows specific algebraic calculations to be performed on encrypted data without decryption, which ensures data security even when the cloud server is untrusted. Therefore, HE is becoming a powerful privacy protection solution in cloud computing environments. However, HE libraries such as Microsoft SEAL are not specifically designed for resource-constrained platforms, and they are usually expensive in terms of computing resources and memory consumption, which limits their use in edge devices. The prior art has developed an embedded-oriented derivative library, namely SEAL-Embedded (SE), which implements a specific HE scheme called CKKS. The CKKS encryption algorithm is a homomorphic encryption algorithm based on polynomial theory, and all polynomial operations used for ciphertext require time and resources to execute. In order to quickly calculate polynomial multiplication, the SE library uses number theoretic transformations to reduce the complexity of polynomial calculations and improve computational efficiency. Number theoretic transformations, as an important operator, undertake most of the computational functions. Therefore, accelerating number theoretic transformations is of great significance for encryption and decryption calculations.

[0003] In the current hardwareization of number theory transformation, in order to give full play to the parallel characteristics of FPGA, it is necessary to harden multiple number theory transformations in the project to speed up data processing and improve the acceleration ratio. However, as the number of items and bit width of the calculated data increase, the resource usage in the FPGA also increases sharply, especially the overhead of storage resources. In FPGA, there are two types of storage resources, one is distributed memory (LUT RAM) and the other is block memory (BRAM). Compared with LUT RAM, BRAM is more concentrated, and the data routing will not have a long path after the hardware is laid out and routed, which is conducive to faster data transmission and better timing generation. However, for a certain model of FPGA board, the total amount of its BRAM resources is fixed, which will make it impossible to place a larger amount of number theory transformation modules and more number theory transformation modules in it, which greatly limits the performance of the hardware. If you want an FPGA with a larger amount of resources to implement the corresponding design, it will cost more.

[0004] Therefore, how to reduce the BRAM resource occupancy rate of the hardware to improve the hardware performance without increasing the cost has become a technical problem that needs to be solved urgently by those skilled in the art. Summary of the invention

[0005] The present invention provides a hardware implementation method for number theoretic transformation, a hardware implementation device for number theoretic transformation and a security chip, which solve the problem existing in the related art that the storage resource occupancy rate of the hardware cannot be reduced without increasing the cost.

[0006] As a first aspect of the present invention, a hardware implementation method for number theoretic transformation is provided, which comprises: obtaining polynomial data to be calculated, and calculating the rotation factors and inverse rotation factors required for number theoretic transformation of the polynomial data to be calculated; writing the rotation factors and inverse rotation factors into different storage spaces respectively, wherein the storage address of the storage space of the inverse rotation factor is determined by adding 1 to the storage address of the storage space of the rotation factor; preprocessing the polynomial data to be calculated to write the polynomial data to be calculated into a corresponding storage space, wherein the addressing address of the storage space of the polynomial data to be calculated matches the storage address of the storage space of the rotation factors and the inverse rotation factors; calling a number theoretic transformation hardware calculation unit, and reading the rotation factors, inverse rotation factors and the preprocessed polynomial data to be calculated respectively to perform number theoretic transformation calculation to obtain number theoretic transformation calculation results, wherein the number theoretic transformation calculation comprises a plurality of calculation stages, and the calculation results of each two adjacent calculation stages are stored cyclically using two storage spaces with adjacent storage addresses.

[0007] Furthermore, a number-theoretic transformation hardware calculation unit is called, and the rotation factors, inverse rotation factors and the preprocessed polynomial data to be calculated are read respectively to perform number-theoretic transformation calculations to obtain number-theoretic transformation calculation results, including: calling a number-theoretic transformation hardware calculation unit, and reading respectively the rotation factors, inverse rotation factors and the preprocessed polynomial data to be calculated; inputting the rotation factors, inverse rotation factors and the preprocessed polynomial data to be calculated into the number-theoretic transformation hardware calculation unit for number-theoretic transformation calculations; determining the storage space for the number-theoretic transformation calculations, and alternately storing the calculation results of each two adjacent calculation stages of the number-theoretic transformation calculations into the storage space for the number-theoretic transformation calculations.

[0008] Furthermore, the storage space of the number theoretic transformation calculation is determined, and the calculation results of each two adjacent calculation stages of the number theoretic transformation calculation are alternately stored in the storage space of the number theoretic transformation calculation, including: determining the first storage space of the number theoretic transformation calculation according to the storage space where the data read in the first calculation stage of the number theoretic transformation calculation is located; determining the second storage space of the number theoretic transformation calculation according to the maximum value of the storage address of the first storage space of the number theoretic transformation calculation plus 1; and alternately storing the calculation results of each two adjacent calculation stages of the number theoretic transformation calculation in the first storage space of the number theoretic transformation calculation and the second storage space of the number theoretic transformation calculation.

[0009] Furthermore, the rotation factors, inverse rotation factors and the pre-processed polynomial data to be calculated are read respectively, including: for each calculation stage of the number theory transformation calculation, the rotation factors and inverse rotation factors required for the calculation stage are read respectively; according to the storage address of the storage space of the rotation factors and inverse rotation factors of the calculation stage, the addressing address of the pre-processed polynomial data to be calculated that matches them is determined; according to the addressing address, the pre-processed polynomial data to be calculated is searched, and the pre-processed polynomial data to be calculated is read.

[0010] Further, the polynomial data to be calculated is preprocessed so as to write the polynomial data to be calculated into a corresponding storage space, including: determining the number of terms N of the polynomial data to be calculated; dividing the polynomial data to be calculated into two polynomial sub-data to be calculated, each with a number of terms N / 2, according to the number of terms of the polynomial data to be calculated; and storing the two N / 2 polynomial sub-data to be calculated in a storage space with an odd storage address and a storage space with an even storage address, respectively.

[0011] Furthermore, the rotation factor and the inverse rotation factor are written into different storage spaces respectively, including: determining the storage space of the rotation factor and the inverse rotation factor respectively according to the number of processing units; and writing the rotation factor and the inverse rotation factor into different storage spaces respectively according to the number of processing units.

[0012] Furthermore, the storage address range of the storage space of the rotation factor is: 0 to (N / P+log 2 P-2); the storage address interval of the storage space of the reverse rotation factor is: (N / P+ log 2 P -1) to (2*(N / P+ log 2 P)-3); where P represents the number of processing units and N represents the number of items of the polynomial data to be calculated.

[0013] Furthermore, the number theory transformation hardware computing unit includes two NTT hardware computing modules or two INTT hardware computing modules, and the two NTT hardware computing modules or the two INTT hardware computing modules implement number transformation calculation based on a ping-pong operation mode.

[0014] As another aspect of the present invention, a hardware implementation device for number theoretic transformation is provided, which is used to implement the hardware implementation method for number theoretic transformation described above, and includes: an acquisition module, which is used to acquire polynomial data to be calculated, and calculate the rotation factors and inverse rotation factors required for the polynomial data to be calculated to perform number theoretic transformation; a writing module, which is used to write the rotation factors and inverse rotation factors into different storage spaces respectively, wherein the storage address of the storage space of the inverse rotation factor is determined by adding 1 to the storage address of the storage space of the rotation factor; a preprocessing module, which is used to preprocess the polynomial data to be calculated to write the polynomial data to be calculated into a corresponding storage space, wherein the addressing address of the storage space of the polynomial data to be calculated matches the storage address of the storage space of the rotation factors and the inverse rotation factors; a number theoretic transformation calculation module, which is used to call a number theoretic transformation hardware calculation unit, and respectively read the rotation factors, inverse rotation factors and the preprocessed polynomial data to be calculated to perform number theoretic transformation calculation to obtain number theoretic transformation calculation results, wherein the number theoretic transformation calculation includes multiple calculation stages, and the calculation results of each two adjacent calculation stages are stored in a circular manner using two storage spaces with adjacent storage addresses.

[0015] As another aspect of the present invention, a security chip is provided, which includes a chip carrier and the hardware implementation device for number theory transformation described above arranged on the chip carrier.

[0016] The hardware implementation method for number theory transformation provided by the present invention calculates the rotation factors and inverse rotation factors required for number theory transformation of the polynomial data to be calculated in advance, and writes the rotation factors and inverse rotation factors into different storage spaces respectively. When writing the rotation factors and inverse rotation factors, the storage address of the storage space of the inverse rotation factor is determined as the storage address of the storage space of the rotation factor plus 1, so that the rotation factors and inverse rotation factors can be stored in different storage spaces with continuous storage addresses, thereby realizing effective use of the storage space; in addition, when the number theory transformation calculation is performed on the polynomial data to be calculated, the polynomial data to be calculated is preprocessed, and the number theory transformation hardware calculation unit is called to realize the number theory transformation calculation, and the storage of the calculation results in the number theory transformation calculation process is stored by recycling two storage spaces with adjacent storage addresses to store the number theory transformation calculation results, thereby achieving effective use of the storage space and reducing the storage resource overhead. Therefore, the hardware implementation method for number theory transformation provided by the present invention can reduce the resource overhead of the storage space, thereby providing the possibility for hardware to integrate multiple hardware resources or increase the number of calculation items to speed up the system operation time, and the hardware implementation method for number theory transformation of the present invention does not increase the cost overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The accompanying drawings are used to provide further understanding of the present invention and constitute a part of the specification. Together with the following specific embodiments, they are used to explain the present invention, but do not constitute a limitation of the present invention.

[0018] Figure 1 The present invention provides a flowchart of a method for hardware implementation of number theory transformation.

[0019] Figure 2 A flow chart of a method for writing a rotation factor and a derotation factor into different storage spaces respectively provided by the present invention.

[0020] Figure 3 A schematic diagram of the storage addresses of the rotation factors and the inverse rotation factors provided by the present invention.

[0021] Figure 4 A flow chart of the method provided by the present invention for writing a polynomial to be calculated into a corresponding storage space.

[0022] Figure 5 A flow chart of calling a number theory transformation hardware computing unit to perform number theory transformation calculations provided by the present invention.

[0023] Figure 6 A flow chart for storing number theory transformation calculation results provided by the present invention.

[0024] Figure 7 A schematic diagram of address allocation for storing calculation results in multiple calculation stages of number theory transformation calculations provided by the present invention.

[0025] Figure 8 A schematic diagram of the NTT calculation principle for a polynomial data to be calculated provided by the present invention with the number of items being 8.

[0026] Fig. 9 A schematic diagram of the flow operation of two NTTs provided by the present invention.

[0027] Fig.10a A schematic diagram of storage space resource occupancy in the prior art.

[0028] Fig.10b It is a schematic diagram of storage space resource occupation of the present invention.

[0029] Fig.11 The diagram is a comparison diagram of BRAM resource occupancy between the solution of the present invention and the prior art in number-theoretic transformation calculations of polynomial data to be calculated with different numbers of terms.

[0030] Fig.12 A structural block diagram of a hardware implementation device for number theory transformation provided by the present invention.

[0031] Fig.13 This is a structural block diagram of the security chip provided by the present invention. DETAILED DESCRIPTION

[0032] It should be noted that, in the absence of conflict, the embodiments of the present invention and the features in the embodiments may be combined with each other. The present invention will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0033] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiment of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiment of the present invention. Obviously, the described embodiment is only a part of the embodiment of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work should fall within the scope of protection of the present invention.

[0034] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so as to describe the embodiments of the present invention described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0035] The current number theory transformation hardware has the problem of high storage resource utilization, and if an FPGA with a larger amount of resources is implemented, it will cost more.

[0036] Based on this, a hardware implementation method for number theory transformation is provided in this embodiment. Figure 1 is a flowchart of a hardware implementation method for number theory transformation according to an embodiment of the present invention, such as Figure 1 As shown, it includes: S100, obtaining the polynomial data to be calculated, and calculating the rotation factors and inverse rotation factors required for the number-theoretic transformation of the polynomial data to be calculated; specifically, for the polynomial data to be calculated, the rotation factors and inverse rotation factors required for the number-theoretic transformation are calculated in advance, so that the storage space is planned in advance according to the calculated rotation factors and inverse rotation factors, thereby realizing effective use of the storage space.

[0037] S200. Write the rotation factor and the inverse rotation factor into different storage spaces respectively, wherein the storage address of the storage space of the inverse rotation factor is determined by adding 1 to the storage address of the storage space of the rotation factor.

[0038] It should be understood that in an embodiment of the present invention, the rotation factors and inverse rotation factors required for the number-theoretic transformation of the polynomial data to be calculated are written into different storage spaces respectively. Specifically, the rotation factors are first written into a storage space that matches it, and then the storage address of the storage space of the rotation factor is determined as the storage address of the storage space of the inverse rotation factor after adding 1 to the storage address of the storage space of the rotation factor, and the inverse rotation factor is written into the corresponding storage space according to the determined storage address.

[0039] After determining the storage space of the rotation factor, the embodiment of the present invention determines the storage address of the storage space of the inverse rotation factor by adding 1 to the storage address of the storage space of the rotation factor. Therefore, the storage of the rotation factor and the inverse rotation factor of the present invention can be stored based on actual needs, thereby effectively utilizing the storage space and reducing the resource consumption of the storage space.

[0040] S300, preprocessing the polynomial data to be calculated to write the polynomial data to be calculated into a corresponding storage space, wherein the addressing address of the storage space of the polynomial data to be calculated matches the storage address of the storage space of the rotation factor and the inverse rotation factor.

[0041] In the embodiment of the present invention, when performing number theory transformation calculation on the polynomial data to be calculated, it is first preprocessed, and the preprocessed polynomial data to be calculated is written into the corresponding storage space.

[0042] It should be understood that the addressing address of the storage space of the polynomial data to be calculated matches the storage address of the storage space of the rotation factor and the inverse rotation factor, that is, the addressing address of the storage space of the polynomial data to be calculated can be determined based on the storage address of the storage space of the pre-written rotation factor and the inverse rotation factor.

[0043] S400, calling a number-theoretic transformation hardware computing unit, and respectively reading the rotation factor, the inverse rotation factor, and the preprocessed polynomial data to be calculated to perform number-theoretic transformation calculations to obtain number-theoretic transformation calculation results, wherein the number-theoretic transformation calculations include multiple calculation stages, and the calculation results of each two adjacent calculation stages are cyclically stored in two storage spaces with adjacent storage addresses.

[0044] In an embodiment of the present invention, when the rotation factors and inverse rotation factors required for the number-theoretic transformation of the polynomial data to be calculated are calculated and stored in advance, and the polynomial data to be calculated is also stored accordingly, the number-theoretic transformation hardware calculation unit can be called to perform the number-theoretic transformation calculation process on the pre-stored rotation factors, inverse rotation factors and preprocessed polynomial data to be calculated, and finally obtain the number-theoretic transformation calculation result.

[0045] It should be noted here that the number theory transformation calculation can specifically include multiple calculation stages, and the storage of the calculation results of each calculation stage can be recycled and stored in two storage spaces with adjacent storage addresses. This can effectively utilize the storage space and reduce the overhead of storage space resources.

[0046] In summary, the hardware implementation method for number theoretic transformation provided by the present invention calculates in advance the rotation factors and inverse rotation factors required for number theoretic transformation of the polynomial data to be calculated, and writes the rotation factors and inverse rotation factors into different storage spaces respectively. When writing the rotation factors and inverse rotation factors, the storage address of the storage space of the inverse rotation factor is determined as the storage address of the storage space of the rotation factor plus 1, so that the rotation factors and inverse rotation factors can be stored in different storage spaces with continuous storage addresses, thereby achieving effective use of the storage space; in addition, when number theoretic transformation calculation is performed on the polynomial data to be calculated, the polynomial data to be calculated is preprocessed, and the number theoretic transformation hardware calculation unit is called to implement the number theoretic transformation calculation. For the storage of the calculation results in the number theoretic transformation calculation process, the number theoretic transformation calculation results are stored by cyclically utilizing two storage spaces with adjacent storage addresses, thereby achieving effective use of the storage space and reducing the storage resource overhead. Therefore, the hardware implementation method for number theoretic transformation provided by the present invention can reduce the resource overhead of storage space, thereby making it possible to integrate multiple hardware resources into the hardware or increase the number of calculation items to speed up the system operation time, and the hardware implementation method for number theoretic transformation provided by the present invention does not increase the cost overhead.

[0047] In an embodiment of the present invention, the rotation factor and the inverse rotation factor are written into different storage spaces respectively, such as Figure 2 As shown, it includes: S210, determining the storage space of the rotation factor and the inverse rotation factor according to the number of processing units; S220, writing the rotation factor and the inverse rotation factor into different storage spaces according to the number of processing units.

[0048] As a specific implementation, when the storage space of the rotation factor and the storage space of the inverse rotation factor are determined based on the number of processing units, specifically, the storage address range of the storage space of the rotation factor is: 0 to (N / P+log 2 P-2); the storage address interval of the storage space of the reverse rotation factor is: (N / P+ log 2 P -1) to (2*(N / P+log 2 P)-3); where P represents the number of processing units and N represents the number of items of the polynomial data to be calculated.

[0049] Specifically, for example, the number of terms of the polynomial data to be calculated includes N groups of polynomials, and the rotation factors and inverse rotation factors required for the number theory transformation of the N groups of polynomials are calculated in advance. The address space of the rotation factors and inverse rotation factors is allocated based on the number of different processing units currently.

[0050] In the embodiment of the present invention, the rotation factor and the inverse rotation factor are distributed in different storage spaces in sequence according to the number of processing units, wherein the rotation factor is written first, and the storage address of the storage space of the inverse rotation factor is determined by adding 1 to the storage address of the storage space of the rotation factor, for example Figure 3 As shown, the left side is the storage address of the rotation factor W, and the right side is the storage address of the inverse rotation factor WINV. The storage address of the left rotation factor is a-1 at most, and the storage address on the right side starts the inverse rotation factor from a. Compared with the storage method of directly jumping into the address N / 2 when storing the inverse rotation factor in the prior art, the storage space of the rotation factor and the inverse rotation factor in different storage spaces but continuous storage addresses in the embodiment of the present invention can avoid the waste of storage space, realize the effective use of storage space, and thus achieve the purpose of reducing the storage space resource overhead.

[0051] In the embodiment of the present invention, the polynomial data to be calculated is preprocessed to write the polynomial data to be calculated into a corresponding storage space, such as Figure 4 As shown, it includes: S310, determining the number of terms N of the polynomial data to be calculated; S320, dividing the polynomial data to be calculated into two polynomial sub-data to be calculated, both of which have N / 2 terms, according to the number of terms of the polynomial data to be calculated; S330, storing the two N / 2 polynomial sub-data to be calculated in a storage space with an odd storage address and a storage space with an even storage address, respectively.

[0052] It should be understood that, for the polynomial data to be calculated, when the number of terms is determined to be N, the polynomial data to be calculated can be specifically divided into two parts with equal number of terms, that is, divided into two polynomial sub-data to be calculated with two terms of N / 2, and then the two polynomial sub-data to be calculated with two terms of N / 2 are respectively stored in the corresponding parity address space.

[0053] In the embodiment of the present invention, the number theory transformation hardware calculation unit is called, and the rotation factor, the inverse rotation factor and the pre-processed polynomial data to be calculated are read respectively to perform number theory transformation calculation to obtain the number theory transformation calculation result, such as Figure 5As shown, it includes: S410, calling a number theory transformation hardware computing unit, and respectively reading the rotation factor, the inverse rotation factor and the pre-processed polynomial data to be calculated; S420, inputting the rotation factor, the inverse rotation factor and the pre-processed polynomial data to be calculated into the number theory transformation hardware computing unit for number theory transformation calculation.

[0054] It should be understood that when calling the number theoretic transformation hardware computing unit for calculation, the rotation factors and inverse rotation factors calculated and stored in advance are used as part of the input of the number theoretic transformation hardware computing unit, and the preprocessed polynomial data to be calculated, that is, the two polynomial sub-data to be calculated with the number of items N / 2 stored in the parity address space are used as the other part of the input of the number theoretic transformation hardware computing unit, and the number theoretic transformation calculation is performed through the number theoretic transformation hardware computing unit.

[0055] S430, determining a storage space for the number-theoretic transformation calculation, and alternately storing calculation results of every two adjacent calculation stages of the number-theoretic transformation calculation in the storage space for the number-theoretic transformation calculation.

[0056] It should be noted that when the number theory transformation hardware computing unit performs the number theory transformation calculation, it can be divided into multiple calculation stages according to the number of terms of the polynomial data to be calculated. The relationship between the number of calculation stages and the number of terms of the polynomial data to be calculated is specifically N=2 m , where N represents the number of terms of the polynomial data to be calculated, and m represents the number of calculation stages. For example, if N is 8, then m is 3, that is, when the number of terms of the polynomial data to be calculated is 8, the number theory transformation calculation can be divided into 3 calculation stages. The calculation results of each two adjacent calculation stages can be alternately stored in the storage space of the number theory transformation calculation.

[0057] Specifically, the storage space of the number-theoretic transformation calculation is determined, and the calculation results of each two adjacent calculation stages of the number-theoretic transformation calculation are alternately stored in the storage space of the number-theoretic transformation calculation, such as Figure 6 As shown, it includes: S431, determining the first storage space of the number theory transformation calculation according to the storage space where the data read in the first calculation stage of the number theory transformation calculation is located.

[0058] It should be understood that since there are multiple calculation stages in the number theoretic transformation calculation, for the first calculation stage, the polynomial data to be calculated is read from the original address of the polynomial data to be calculated and then the calculation of the first calculation stage is performed, and the storage space corresponding to the original address of the polynomial data to be calculated is determined as the first storage space for the number theoretic transformation calculation.

[0059] S432: Determine a second storage space for number theory transformation calculation according to the maximum value of the storage address of the first storage space for number theory transformation calculation plus 1.

[0060] It should be understood that the calculation result of the first calculation stage obtained after the first calculation stage is performed on the polynomial data to be calculated read from the first storage space is stored in another address space, and the first address of the address space is not determined by inverting the high bit of the original address, but is determined by adding 1 to the maximum value of the storage address of the first storage space, that is, the second storage space is used to store the calculation result of the polynomial data to be calculated read from the first storage space after being calculated through number theory transformation.

[0061] S433, alternately storing the calculation results of every two adjacent calculation stages of the number-theoretic transformation calculation in the first storage space of the number-theoretic transformation calculation and the second storage space of the number-theoretic transformation calculation.

[0062] It should be understood that, as described above, the calculation result of the first calculation stage obtained after the calculation of the first calculation stage for the polynomial data to be calculated stored in the first storage space is stored in the second storage space, and when the second calculation stage is calculated, the calculation result of the first calculation stage in the second storage space is read as input and then the calculation result of the second calculation stage is obtained by the second calculation stage, and the calculation result of the second calculation stage is stored in the first storage space to cover the original polynomial data to be calculated stored in the first storage space. Similarly, when the third calculation stage is calculated, the calculation result of the second calculation stage in the first storage space is read to perform the calculation of the third calculation stage, and the calculation result of the third calculation stage is stored in the second storage space to cover the calculation result of the first calculation stage stored in the second storage space, such as Figure 7 As shown, the first calculation stage data stage 1 reads the original data from the first storage space (0, 1, 2, 3, 4...) and stores the calculation result obtained after calculation in the second storage space (b, b+1, b+2, b+3, b+4...), the second calculation stage data stage 2 reads the storage data of the second storage space (b, b+1, b+2, b+3, b+4...) to perform the calculation in the second calculation stage and stores the calculation result obtained in the first storage space (0, 1, 2, 3, 4...) to cover the original data, and the third calculation stage data stage 3 reads the data currently stored in the first storage space to perform the calculation in the third calculation stage. By analogy, for multiple calculation stages of number theory transformation calculation, the first storage space and the second storage space are used alternately, so there is no need to develop the corresponding storage space for each calculation stage to store the calculation result, so that the current storage space can be effectively used to store the calculation result, thereby achieving the purpose of reducing storage resource overhead.

[0063] For example, Figure 8As shown, it is a schematic diagram of the NTT calculation principle when the number of terms of the polynomial data to be calculated is 8. The number theory transformation calculation of the polynomial data to be calculated with the number of items being 8 specifically includes three calculation stages. The first calculation stage is to read the polynomial data to be calculated a[0], a[4], a[2] and a[6] stored at the even addresses of the first storage space, and the polynomial data to be calculated a[1], a[5], a[3] and a[7] stored at the odd addresses of the first storage space respectively. The calculation results obtained after entering the first calculation stage are stored in the second storage space. In the second calculation stage, the calculation results of the first calculation stage stored in the second storage space are read to obtain the calculation results of the second calculation stage. The calculation results of the second calculation stage are stored in the first storage space to cover the initial polynomial data to be calculated a[0], a[4], a[2], a[6], a[1], a[5], a[3] and a[7]. In the third calculation stage, the calculation results of the second calculation stage in the first storage space are read to perform the calculation of the third calculation stage, and the calculation results of the third calculation stage (i.e., the final calculation results) A[0], A[1], A[5] are obtained. A[2], A[3], A[4], A[5], A[6] and A[7] are all stored in the second storage space to cover the calculation results of the second calculation stage.

[0064] In an embodiment of the present invention, the rotation factors, the inverse rotation factors and the pre-processed polynomial data to be calculated are read respectively, including: for each calculation stage of number theory transformation calculation, the rotation factors and inverse rotation factors required for the calculation stage are read respectively; according to the storage address of the storage space of the rotation factors and inverse rotation factors of the calculation stage, the addressing address of the pre-processed polynomial data to be calculated that matches them is determined; according to the addressing address, the pre-processed polynomial data to be calculated is searched, and the pre-processed polynomial data to be calculated is read.

[0065] It should be understood that when performing number theoretic transformation calculations, for each calculation stage of the number theoretic transformation calculation, when calculating data, it is necessary to read the rotation factors and inverse rotation factors required for the calculation stage respectively, and the reading of the polynomial data to be calculated required for the calculation stage needs to be obtained based on the addressing address difference. Therefore, the addressing address of the polynomial data to be calculated matches the storage address of the storage space of the rotation factors and the inverse rotation factors, so that after reading the rotation factors and the inverse rotation factors of the calculation stage, the addressing address of the preprocessed polynomial data to be calculated that matches it can be determined according to the storage address of the storage space of the rotation factors and the inverse rotation factors of the calculation stage.

[0066] In an embodiment of the present invention, in order to improve the computing efficiency of the number theory transformation hardware computing unit, specifically, the number theory transformation hardware computing unit includes two NTT hardware computing modules or two INTT hardware computing modules, and the two NTT hardware computing modules or two INTT hardware computing modules implement quantity transformation calculations based on a ping-pong operation method.

[0067] It should be understood that the way of integrating two NTT hardware computing modules or two INTT hardware computing modules in the number theory transformation hardware computing unit to perform ping-pong operation is to load the data of the two NTT hardware computing modules or two INTT hardware computing modules into the number theory transformation hardware computing unit in turn, so that the two NTTs or two INTTs can work together at the same time, the input end continuously transmits data into the number theory transformation hardware computing unit, and the output end continuously outputs data, so that there is always data from the input end to the output end in the number theory transformation hardware computing unit to form a pipeline operation, such as Fig. 9 shown.

[0068] In the embodiment of the present invention, taking the number of items of the polynomial data to be calculated as 16384 as an example, Fig.10a and Fig.10b The figure shows the storage space resource occupancy of hardware using different address allocation strategies implemented on Vivado through two NTT hardware computing modules. Fig.10a It is a schematic diagram of storage space resource occupation in the prior art. Fig.10b This is a schematic diagram of the storage space resource occupancy of the present invention. It can be clearly seen that after adopting the hardware implementation method for number theoretic transformation of the present invention, the resource occupancy of the storage space is greatly reduced, from 52.24% in the prior art to 26.12%. Therefore, the hardware implementation method for number theoretic transformation of the present invention can reduce the storage space by about half compared with the prior art, greatly improving the upper limit of hardware performance.

[0069] Fig.11 The figure shows that polynomial data with different numbers of items to be calculated are implemented on vivado through a single NTT. The solution of the embodiment of the present invention is compared with the BRAM resource occupancy of the prior art. It can be seen that the hardware implementation method for number theory transformation of the embodiment of the present invention for polynomial data with different numbers of items to be calculated can reduce the resource overhead of BRAM by half, and can provide the possibility of integrating multiple NTTs in hardware or increasing the number of NTT calculation items, thereby speeding up the system operation time.

[0070] As another embodiment of the present invention, a hardware implementation device 100 for number theory transformation is provided, which is used to implement the hardware implementation method for number theory transformation described above, wherein: Fig.12As shown, it includes: an acquisition module 110, which is used to acquire the polynomial data to be calculated, and calculate the rotation factors and inverse rotation factors required for the polynomial data to be calculated to perform number theory transformation; a writing module 120, which is used to write the rotation factors and inverse rotation factors into different storage spaces respectively, wherein the storage address of the storage space of the inverse rotation factor is determined by adding 1 to the storage address of the storage space of the rotation factor; a preprocessing module 130, which is used to preprocess the polynomial data to be calculated so as to write the polynomial data to be calculated into a corresponding storage space, and the addressing address of the storage space of the polynomial data to be calculated matches the storage address of the storage space of the rotation factors and the inverse rotation factors; a number theory transformation calculation module 140, which is used to call the number theory transformation hardware calculation unit, and read the rotation factors, inverse rotation factors and the preprocessed polynomial data to be calculated respectively to perform number theory transformation calculation to obtain number theory transformation calculation results, wherein the number theory transformation calculation includes multiple calculation stages, and the calculation results of each two adjacent calculation stages are stored in a circular manner using two storage spaces with adjacent storage addresses.

[0071] The hardware implementation device for number theory transformation provided by the present invention calculates the rotation factors and inverse rotation factors required for number theory transformation of the polynomial data to be calculated in advance, and writes the rotation factors and inverse rotation factors into different storage spaces respectively. When writing the rotation factors and inverse rotation factors, the storage address of the storage space of the inverse rotation factor is determined as the storage address of the storage space of the rotation factor plus 1, so that the rotation factors and inverse rotation factors can be stored in different storage spaces with continuous storage addresses, thereby realizing effective use of the storage space; in addition, when the number theory transformation calculation is performed on the polynomial data to be calculated, the polynomial data to be calculated is preprocessed, and the number theory transformation hardware calculation unit is called to realize the number theory transformation calculation, and the storage of the calculation results in the number theory transformation calculation process is stored by recycling two storage spaces with adjacent storage addresses to store the number theory transformation calculation results, thereby achieving effective use of the storage space and reducing the storage resource overhead. Therefore, the hardware implementation device for number theory transformation provided by the present invention can reduce the resource overhead of the storage space, thereby providing the possibility for hardware to integrate multiple hardware resources or increase the number of calculation items to speed up the system operation time, and the hardware implementation method for number theory transformation of the present invention does not increase the cost overhead.

[0072] The specific working principle of the hardware implementation device for number theoretic transformation provided by the present invention can be referred to the description of the hardware implementation method for number theoretic transformation in the foregoing text, which will not be repeated here.

[0073] As another embodiment of the present invention, a security chip 10 is provided. Fig.13As shown, it includes a chip carrier 200 and the hardware implementation device 100 for number theory transformation described above, which is arranged on the chip carrier 200.

[0074] In the embodiment of the present invention, the chip carrier 200 may specifically include FPGA or ASIC.

[0075] The security chip provided by the present invention, because it adopts the hardware implementation device for number theory transformation mentioned above, can reduce the storage space occupancy rate of the hardware without increasing the cost, thereby improving the hardware performance of the chip and further enhancing the market competitiveness.

[0076] The specific working principle of the security chip provided by the present invention can be referred to the description of the hardware implementation method for number theory transformation in the above text, which will not be repeated here.

[0077] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present invention, but the present invention is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and essence of the present invention, and these modifications and improvements are also considered to be within the scope of protection of the present invention.

Claims

1. A hardware implementation method for number theory transformation, characterized in that: include: Acquire the polynomial data to be calculated, and calculate the rotation factors and inverse rotation factors required for number theory transformation of the polynomial data to be calculated; Writing the rotation factor and the inverse rotation factor into different storage spaces respectively, wherein the storage address of the storage space of the inverse rotation factor is determined by adding 1 to the storage address of the storage space of the rotation factor; Preprocessing the polynomial data to be calculated to write the polynomial data to be calculated into a corresponding storage space, wherein the addressing address of the storage space of the polynomial data to be calculated matches the storage address of the storage space of the rotation factor and the inverse rotation factor; Calling a number theory transformation hardware calculation unit, and respectively reading the rotation factor, the inverse rotation factor, and the preprocessed polynomial data to be calculated to perform number theory transformation calculation to obtain a number theory transformation calculation result, wherein the number theory transformation calculation includes a plurality of calculation stages, and the calculation results of each two adjacent calculation stages are cyclically stored in two storage spaces with adjacent storage addresses; Among them, calling the number theory transformation hardware calculation unit, and reading the rotation factor, the inverse rotation factor and the pre-processed polynomial data to be calculated respectively to perform number theory transformation calculation to obtain the number theory transformation calculation result, including: Calling a number theory transformation hardware calculation unit, and respectively reading the rotation factor, the inverse rotation factor, and the preprocessed polynomial data to be calculated; Inputting the rotation factor, the inverse rotation factor and the pre-processed polynomial data to be calculated into the number theory transformation hardware calculation unit for number theory transformation calculation; Determining a storage space for the number-theoretic transformation calculation, and alternately storing calculation results of every two adjacent calculation stages of the number-theoretic transformation calculation in the storage space for the number-theoretic transformation calculation; The step of determining the storage space of the number theory transformation calculation and alternately storing the calculation results of each two adjacent calculation stages of the number theory transformation calculation in the storage space of the number theory transformation calculation comprises: Determine the first storage space of the number theory transformation calculation according to the storage space where the data read in the first calculation stage of the number theory transformation calculation is located; Determine a second storage space for number theory transformation calculation according to the maximum value of the storage address of the first storage space for number theory transformation calculation plus 1; The calculation results of every two adjacent calculation stages of the number-theoretic transformation calculation are alternately stored in the first storage space of the number-theoretic transformation calculation and the second storage space of the number-theoretic transformation calculation.

2. The hardware implementation method for number theory transformation according to claim 1, characterized in that: Respectively reading the rotation factor, the inverse rotation factor, and the preprocessed polynomial data to be calculated, including: For each calculation stage of the number theory transformation calculation, the rotation factor and the inverse rotation factor required for the calculation stage are read respectively; Determine the addressing address of the pre-processed polynomial data to be calculated that matches the storage address of the storage space of the rotation factor and the inverse rotation factor of the calculation stage; The preprocessed polynomial data to be calculated is searched according to the addressing address, and the preprocessed polynomial data to be calculated is read.

3. The hardware implementation method for number theory transformation according to claim 1 or 2, characterized in that: Preprocessing the polynomial data to be calculated to write the polynomial data to be calculated into a corresponding storage space includes: Determine the number of terms N of the polynomial data to be calculated; Dividing the polynomial data to be calculated into two polynomial sub-data to be calculated, each with N / 2 terms, according to the number of terms of the polynomial data to be calculated; Two N / 2 polynomial sub-data to be calculated are stored in a storage space with an odd storage address and a storage space with an even storage address respectively.

4. The hardware implementation method for number theory transformation according to claim 1 or 2, characterized in that: The rotation factor and the inverse rotation factor are written into different storage spaces respectively, including: Determine the storage space of the rotation factor and the inverse rotation factor respectively according to the number of processing units; The rotation factors and the inverse rotation factors are written into different storage spaces according to the number of processing units.

5. The hardware implementation method for number theory transformation according to claim 4, characterized in that: The storage address range of the storage space of the rotation factor is: 0 to (N / P + log2P-2); the storage address range of the storage space of the inverse rotation factor is: (N / P + log2P -1) to (2*(N / P + log2P)-3); Wherein, P represents the number of processing units, and N represents the number of items of polynomial data to be calculated.

6. The hardware implementation method for number theory transformation according to claim 1 or 2, characterized in that: The number theory transformation hardware computing unit includes two NTT hardware computing modules or two INTT hardware computing modules, and the two NTT hardware computing modules or the two INTT hardware computing modules implement number transformation calculation based on a ping-pong operation mode.

7. A hardware implementation device for number theory transformation, used to implement the hardware implementation method for number theory transformation according to any one of claims 1 to 6, characterized in that: include: An acquisition module, used to acquire the polynomial data to be calculated, and calculate the rotation factors and inverse rotation factors required for number theory transformation of the polynomial data to be calculated; A writing module, used to write the rotation factor and the inverse rotation factor into different storage spaces respectively, wherein the storage address of the storage space of the inverse rotation factor is determined by adding 1 to the storage address of the storage space of the rotation factor; A preprocessing module, used to preprocess the polynomial data to be calculated so as to write the polynomial data to be calculated into a corresponding storage space, wherein the addressing address of the storage space of the polynomial data to be calculated matches the storage address of the storage space of the rotation factor and the inverse rotation factor; The number-theoretic transformation calculation module is used to call the number-theoretic transformation hardware calculation unit, and respectively read the rotation factor, the inverse rotation factor and the preprocessed polynomial data to be calculated to perform number-theoretic transformation calculation to obtain the number-theoretic transformation calculation result, wherein the number-theoretic transformation calculation includes multiple calculation stages, and the calculation results of each two adjacent calculation stages are cyclically stored in two storage spaces with adjacent storage addresses.

8. A security chip, characterized in that: The invention comprises a chip carrier and a hardware implementation device for number theory transformation as claimed in claim 7 arranged on the chip carrier.

Images