GPU (Graphics Processing Unit) parallel acceleration method and device for on-lattice fast number-theory transformation based on thread bundle replacement

Abstract

The invention discloses a GPU (Graphics Processing Unit) parallel acceleration method and device for on-lattice fast number-theory transformation based on thread bundle replacement, and the method comprises the following steps: decomposing a dimensional polynomial; wherein the value of N1 is 210; aiming at a dimensional polynomial; taking an integer index sum, and storing the polynomial in the SMEM in a matrix form; taking each row of the matrix, taking the row as a row index, and executing 32 NTT of 32 points; the result is transposed; s5, multiplying each number of the transposed matrix by a 1024-order unit root: respectively; taking each row of the matrix, taking the row as a row index, and executing 32 NTT: of 32 points; returning a calculation result, wherein each coefficient is included; obtaining a result of the dimension polynomial; and calculating the NTT of the points to obtain a result of the dimension polynomial so as to complete the calculation of the dimension polynomial. In the invention, for the basic module, the advantages of fixed implementation are adopted: the size of the pre-calculation table is reduced, separate calculation is not needed, and the caching of the pre-calculation table in the shared memory is facilitated by the unit root under the two conditions; the calculation complexity is lowest theoretically; modularization and uniformity can be maintained, and the code size can be reduced.

Description

Technical Field

[0001] This invention relates to the field of cryptography, and in particular to a GPU parallel acceleration method and apparatus for lattice-based fast number-theoretic transformations based on thread bundle permutation. Background Technology

[0002] In the current field of cryptography research, lattice cryptography has attracted much attention due to its ability to maintain security even in the post-quantum era, gradually becoming a research hotspot in both academia and industry. However, despite the many advantages that lattice cryptography exhibits in theory, its practical application still faces significant challenges. Among these challenges, polynomial multiplication, as the core operation in lattice cryptography algorithms, directly impacts the performance of the entire encryption system due to its computational efficiency, becoming a key bottleneck restricting the widespread application of lattice cryptography.

[0003] To overcome this bottleneck, researchers have proposed and implemented various optimization strategies. Among them, the application of Fast Number Theory Transformation (NTT) is particularly noteworthy. This mathematical tool can reduce the computational complexity of polynomial multiplication from the traditional... Significantly reduced to ,in The degree of the polynomial is represented by this. This reduction in complexity means that computational efficiency can be improved by orders of magnitude when processing large-scale data, paving the way for the deployment of lattice cryptography in practical systems.

[0004] Meanwhile, with the advancement of parallel computing technology, the powerful computing capabilities of graphics processing units (GPUs) have also been incorporated into lattice cipher computation. The highly parallel architecture of GPUs enables them to process massive amounts of data simultaneously, a characteristic perfectly suited to the large-scale matrix and polynomial operations involved in lattice cipher. Through carefully designed GPU acceleration algorithms, researchers have successfully further improved the computational speed of polynomial multiplication, enabling lattice cipher to achieve performance comparable to traditional cryptographic systems in certain application scenarios.

[0005] However, the complexity of the problem increases when applying applications with higher security levels. While the introduction of high-order polynomials enhances system security, it also introduces new challenges. First, these high-order polynomials and their associated pre-computed tables require significant storage space, increasing hardware costs and potentially causing memory bandwidth to become a new performance bottleneck. Second, despite optimization techniques such as NTT and GPU acceleration, processing such high-order polynomials still consumes substantial computational resources, which can impact the system's real-time responsiveness, especially in resource-constrained environments such as mobile platforms. Summary of the Invention

[0006] The purpose of this invention is to provide a GPU parallel acceleration method and apparatus based on lattice fast number-theoretic transformations using thread bundle permutation, so as to overcome the shortcomings of the prior art.

[0007] To achieve the above objectives, the present invention provides the following technical solution: This application discloses a GPU parallel acceleration method based on fast number-theoretic transformations on lattices using thread bundle permutation, comprising the following steps: S1, will Factor the dimensional polynomial so that The value of N1 is 2. 10 ; S2, targeting dimensional polynomial ; Get integer index and , polynomial Stored in SMEM in matrix form: ; S3. Take each row of the matrix from step S2 and let... For row index, Execute 32 NTTs of 32 points each: ;in, This refers to 32 NTT points. It is a 32nd order unity root; S4. Transpose the result of step S3: ; S5. Multiply each number of the transposed matrix by the root of unity of order 1024: ,in, Pre-calculation table for the 1024th order unit root; S6. Take each row of the matrix obtained in step S5, and let... For row index, Execute 32 NTTs of 32 points each: ; S7. Return the calculation results , where each coefficient ;get Results of the dimensional polynomial; S8, Calculation Point NTT, get The result of the dimensional polynomial, thus completing Calculation of dimensional polynomials.

[0008] As a preferred option, when in the ring When calculating on the ring, the 1024th order root of unity and pre-calculation table The calculation method is as follows: take the unit root. Generate a pre-calculation table ,in, , , , ;in, Represents integers To carry out Bit flipping operation based on the base.

[0009] As a preferred option, when in the ring When calculating on the ring, the 32nd order root of unity and pre-calculation table The calculation method is as follows: , , ;in, Represents integers To carry out Bit flipping operation based on the base.

[0010] Preferably, the The value is The powers of 2 between them.

[0011] Preferably, in step S8, the traditional number theory transformation calculation method is used for direct calculation. Point NTT.

[0012] As a preferred embodiment, it is characterized by, The calculation process is as follows: S31. Defining Variables And set initial values ; S32. Define variables Used to represent the thread index within a thread bundle. ; S33, Define variables To represent the index spacing of the polynomial coefficients, and to set initial values. ; S34, Order ,when At that time, the threads within each thread bundle execute the following steps in a loop: S341. Use the substitution function __shfl_xor_sync to read the in-thread coefficient values ​​for the corresponding interval: S342. Calculate the selection factor : ; S343, Calculate intermediate variables : ; S344, Calculate intermediate variables : ; S345. Calculate the result of the butterfly transformation operation: ; ; S346. Calculate the result of writing back to the register: S347, Update variables: , Enter the next cycle. S348. After the loop is complete, write the calculation result back to SMEM from the register.

[0013] The present invention also discloses a GPU parallel acceleration device based on thread beam permutation for fast number-theoretical transformations on lattice, comprising a memory and one or more processors. The memory stores executable code, and when the one or more processors execute the executable code, they are used to implement the above-described GPU parallel acceleration method based on thread beam permutation for fast number-theoretical transformations on lattice.

[0014] The present invention also discloses a computer-readable storage medium storing a program thereon, which, when executed by a processor, is used to implement the above-described GPU parallel acceleration method for lattice-based fast number-theoretic transformations based on thread bundle permutation.

[0015] The beneficial effects of this invention are: This invention discloses a GPU parallel acceleration method based on lattice-based fast number-theoretic transformations using thread bundle permutations, for... Basic modules, using fixed Advantages of implementation: (1) Reduce the size of the pre-computation table, eliminating the need to calculate the unit root in both cases separately, which is beneficial for caching the pre-computation table in shared memory; (2) Theoretically, it has the lowest computational complexity; (3) It helps to maintain the modularity and uniformity of the implementation and reduce code size.

[0016] The features and advantages of the present invention will be described in detail through embodiments and in conjunction with the accompanying drawings. Attached Figure Description

[0017] Figure 1 This is a schematic diagram of the number theory transformation calculation steps of a GPU parallel acceleration method for fast number theory transformations on lattices based on thread bundle permutation; Figure 2 This is a schematic diagram of the structure of a GPU parallel acceleration device based on lattice fast number theory transformation using thread beam permutation according to the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. However, it should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of the invention. Furthermore, descriptions of well-known structures and technologies are omitted in the following description to avoid unnecessarily obscuring the concept of the invention.

[0019] for For dimensional polynomials, traditional number theory transformations are used for direct computation. The NTT of the points needs to be pre-calculated. Long units are stored as pre-computed tables. When When the polynomial is large, storing the polynomial and the pre-computation table can introduce significant storage overhead; to address this, this invention employs a structured decomposition approach, which... Decomposed into Thus The NTT decomposition of points is as follows Point and The NTT of the point is used for calculation, when It has the lowest computational complexity and reduces the size of the pre-computation table from Reduce to .

[0020] Considering the fully homomorphic encryption algorithm The value is usually Between To ensure compatibility with multiple implementations, this invention first addresses the powers of [the powers of the ... The underlying basic modules are proposed with an optimized implementation design. Then, other parameters can be obtained through... After decomposition, the above modules are called, and combined with traditional methods. The NTT of the point is calculated.

[0021] Based on this, the present invention uses GPU to accelerate the algorithm; in the specific implementation, a calculation method based on thread bundle permutation is designed, which can keep the polynomial coefficients in the register with the fastest memory access speed, avoid the time-consuming shared memory and global memory access, and greatly improve the overall performance. GPU storage units involved: (1) GMEM (Global Memory): Readable and writable, all thread blocks can interact with it, it has the largest storage space, but the slowest memory access speed; (2) SMEM (Shared Memory): Read and write, all thread bundles in a single thread block can access it, and the storage space and read / write speed are moderate; (3) RF (register): Read and write, shared by all 32 threads in each thread bundle, with the smallest storage space and the fastest memory access speed.

[0022] GPU thread beam replacement instruction characteristics used: __shfl_xor_sync(): Each thread copies data from other threads by a bitwise XOR operation on the index in the thread bundle. Input values ​​include: (a) mask, a mask representing the threads in the thread bundle participating in this operation; (b) reg, the register to be read; and (c) width, the interval between neighboring threads being accessed.

[0023] The optimized number theory transformation is in hour, The value of the unit root needs to be selected based on the structure of the underlying ring. For example, when in a ring... When performing calculations on the ring, the values ​​of the unit roots and the calculation methods for the pre-calculation table are as follows: (1) Root of unity and pre-calculation table Take the unit root Generate a pre-calculation table ,in, , , , (2) Root of unity and pre-calculation table : , , in, Represents integers To carry out Bit flipping operation based on the base.

[0024] See Figure 1 The calculation process is as follows: Input: polynomial Pre-calculation table , ; Output: The result after number-theoretic transformation ; (1) Take the integer index and , polynomial Stored in SMEM in matrix form: (2) Take each row of the matrix and let For row index, Execute 32 NTTs of 32 points each: .in, Refers to 32 NTT points here (3) Transpose the calculation results: (4) For each number, multiply by the 1024th root of unity: ,in, Pre-calculation table for the 1024th order root of unity (5) Take each row of the matrix and let For row index, Execute 32 NTTs of 32 points each: (6) Return the calculation results , where each coefficient , In the above process, based on thread bundle replacement The module implements the calculation process as follows: (1) Define variables And set initial values (2) Define variables Used to represent the thread index within a thread bundle, (3) Define variables To represent the index spacing of the polynomial coefficients, and to set initial values. (4) Order ,when At that time, the threads within each thread bundle execute the following steps in a loop: (a) Use the substitution function __shfl_xor_sync to read the in-thread coefficient values ​​for the corresponding interval: (b) Calculate the selection factor : (c) Calculate intermediate variables : (d) Calculate intermediate variables : (e) Calculate the result of the butterfly transformation operation: (f) Calculate the result of writing back to the register: (g) Update variables: , Enter the next cycle. (5) After the loop is complete, write the calculation result back to SMEM from the register. Given The value is usually Between, for others In this case, the calculation method is as follows: (1) Decomposed into (2) Using the module designed in this invention, calculate NTT (3) Transpose the calculation results (4) For each number, multiply by... Root of unity (5) Calculate using the general NTT calculation method. Point NTT.

[0025] An embodiment of the GPU parallel acceleration device based on lattice-based fast number-theoretic transformation using thread beam permutation, as described in this invention, can be applied to any device with data processing capabilities, such as a computer. The device embodiment can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by the processor of any data-processing device loading the corresponding computer program instructions from non-volatile memory into memory for execution. From a hardware perspective, such as... Figure 2 The diagram shown is a hardware structure diagram of any data processing-capable device, including a GPU parallel acceleration device based on thread beam permutation and fast number theory transformation on a lattice, according to the present invention. Except for... Figure 2 In addition to the processor, memory, network interface, and non-volatile memory shown, any data processing device in the embodiment may also include other hardware depending on the actual function of that data processing device, which will not be elaborated further. The specific implementation process of the functions and roles of each unit in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0026] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of the present invention according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0027] This invention also provides a computer-readable storage medium storing a program thereon, which, when executed by a processor, implements a GPU parallel acceleration device based on thread beam permutation and fast number theory transformation on lattice in the above embodiments.

[0028] The computer-readable storage medium can be an internal storage unit of any data processing device as described in any of the foregoing embodiments, such as a hard disk or memory. The computer-readable storage medium can also be an external storage device of any data processing device, such as a plug-in hard disk, smart media card (SMC), SD card, flash card, etc., equipped on the device. Furthermore, the computer-readable storage medium can include both internal storage units and external storage devices of any data processing device. The computer-readable storage medium is used to store the computer program and other programs and data required by the data processing device, and can also be used to temporarily store data that has been output or will be output.

[0029] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions or improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A GPU parallel acceleration method based on fast number-theoretic transformations on lattices using thread bundle permutation, characterized in that, Includes the following steps: S1, will Factor the dimensional polynomial so that The value of N1 is 2. 10 ; S2, targeting dimensional polynomial ; Get integer index and , polynomial Stored in SMEM in matrix form: ; S3. Take each row of the matrix from step S2 and let... For row index, Execute 32 NTTs of 32 points each: ;in, This refers to 32 NTT points. It is a 32nd order unity root; S4. Transpose the result of step S3: ; S5. Multiply each number of the transposed matrix by the root of unity of order 1024: ,in, Pre-calculation table for the 1024th order unit root; S6. Take each row of the matrix obtained in step S5, and let... For row index, Execute 32 NTTs of 32 points each: ; S7. Return the calculation results , where each coefficient ;get Results of the dimensional polynomial; S8, Calculation Point NTT, get The result of the dimensional polynomial, thus completing Calculation of dimensional polynomials.

2. The GPU parallel acceleration method based on lattice-based fast number-theoretic transformation using thread beam permutation as described in claim 1, characterized in that, When in the ring When calculating on the ring, the 1024th order root of unity and pre-calculation table The calculation method is as follows: take the unit root. Generate a pre-calculation table ,in, , , , ;in, Represents integers To carry out Bit flipping operation based on the base.

3. The GPU parallel acceleration method based on lattice-based fast number-theoretic transformation using thread bundle permutation as described in claim 1, characterized in that, When in the ring When calculating on the ring, the 32nd order root of unity and pre-calculation table The calculation method is as follows: , , ;in, Represents integers To carry out Bit flipping operation based on the base.

4. The GPU parallel acceleration method based on lattice-based fast number-theoretic transformation using thread bundle permutation as described in claim 1, characterized in that, The The value is The powers of 2 between them.

5. The GPU parallel acceleration method based on lattice-based fast number-theoretic transformation using thread beam permutation as described in claim 1, characterized in that: In step S8, the traditional number theory transformation calculation method is used to directly calculate... Point NTT.

6. The GPU parallel acceleration method based on lattice-based fast number-theoretic transformation using thread bundle permutation as described in claim 1, characterized in that, The calculation process is as follows: S31. Defining Variables And set initial values ; S32. Define variables Used to represent the thread index within a thread bundle. ; S33, Define variables To represent the index spacing of the polynomial coefficients, and to set initial values. ; S34, Order ,when At that time, the threads within each thread bundle execute the following steps in a loop: S341. Use the substitution function __shfl_xor_sync to read the in-thread coefficient values ​​for the corresponding interval: S342. Calculate the selection factor : ; S343, Calculate intermediate variables : ; S344, Calculate intermediate variables : ; S345. Calculate the result of the butterfly transformation operation: ； ； S346. Calculate the result of writing back to the register: S347, Update variables: , Enter the next cycle. S348. After the loop is complete, write the calculation result back to SMEM from the register.

7. A GPU parallel acceleration device based on lattice-based fast number-theoretic transformations using thread bundle permutations, characterized in that: The device includes a memory and one or more processors, wherein the memory stores executable code, and the one or more processors execute the executable code to implement the GPU parallel acceleration method for lattice-based fast number-theoretic transformations based on thread bundle permutation as described in any one of claims 1 to 6.

8. A computer-readable storage medium, characterized in that: It stores a program that, when executed by a processor, implements a GPU parallel acceleration method for lattice-based fast number-theoretic transformations based on thread bundle permutation, as described in any one of claims 1 to 6.

Images