Co-processor, hardware acceleration method, device and medium for post-quantum cryptography algorithm

Abstract

This application discloses a coprocessor, hardware acceleration method, device, and medium for post-quantum cryptography algorithms, applied to cloud chips and relating to the field of chip design technology. It includes: a register set divided into a first storage area and a second storage area; a parameter memory for storing auxiliary calculation parameters; multiple parallel butterfly operation units for performing butterfly operations in number-theoretical transformations or inverse number-theoretical transformations to obtain the calculation results; and an access control module connected to the register set, parameter memory, and butterfly operation units, used to simultaneously read the target coefficients of the data to be calculated from the first and second storage areas, and read the corresponding auxiliary calculation parameters from the parameter memory; distribute the target coefficients and auxiliary calculation parameters to multiple butterfly operation units for calculation, and write the calculation results back to the first and second storage areas to update the coefficients. This approach reduces resource consumption and improves computational efficiency while maintaining high parallelism.

Description

Technical Field

[0001] This invention relates to the field of chip design technology, and in particular to coprocessors, hardware acceleration methods, devices and media for post-quantum cryptography algorithms. Background Technology

[0002] Dilithium, a post-quantum cryptography algorithm released by the National Institute of Standards and Technology (NIST) in 2024, is a next-generation signature verification standard based on lattice-hard problems. It boasts advantages such as resistance to quantum attacks, high signature verification speed, and low hardware resource consumption, making it a current research hotspot in the cryptography field. In the Dilithium algorithm, polynomial multiplication is the core step, consuming the majority of computation time and hardware resources. Currently, butterfly operations based on Number Theoretic Transform (NTT) are widely used to quickly implement polynomial multiplication. However, NTT computation requires multiple butterfly operations, each involving modular addition, subtraction, multiplication, and reduction, and the control logic involves multiple nested loops, resulting in low computational efficiency and high resource consumption in hardware implementation. Furthermore, the storage and scheduling of polynomial coefficients are complex, requiring high communication bandwidth.

[0003] To improve NTT's processing speed, existing solutions typically employ multiple butterfly arithmetic units for parallel processing, coupled with multiple true dual-port random access memory (RAM) blocks for data storage and scheduling. For example, each butterfly arithmetic unit requires multiple RAM blocks for reading and writing coefficients. During seven rounds of butterfly operations, these RAM blocks are continuously occupied, preventing the simultaneous execution of other operations. Furthermore, the large number of RAM blocks and their small individual capacity easily lead to storage resource fragmentation, failing to fully leverage the high storage density and small area advantages of RAM, thus limiting the overall performance improvement of the hardware.

[0004] In summary, optimizing the coprocessor's storage structure and data scheduling to reduce resource consumption and improve computational efficiency while ensuring high parallelism remains a key technical challenge in the hardware acceleration of the Dilithium algorithm. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a coprocessor, hardware acceleration method, device, and medium for post-quantum cryptography algorithms, which can optimize the storage structure and data scheduling of the coprocessor, reduce resource consumption, and improve computational efficiency while ensuring high parallelism. The specific solution is as follows: In a first aspect, this application discloses a coprocessor for post-quantum cryptography algorithms, applied to cloud chips, comprising: The register group is divided into a first storage area and a second storage area; wherein, the first storage area stores the preset low-order coefficients of the data to be processed, and the second storage area stores the preset high-order coefficients of the data to be processed; Parameter storage is used to store auxiliary calculation parameters; Multiple parallel butterfly operation units are used to perform butterfly operations in number-theoretic transformation operations or inverse number-theoretic transformation operations to obtain the operation results; The access control module, which is connected to the register group, the parameter memory, and the butterfly operation unit respectively, is used to simultaneously read the target coefficients of the data to be operated from the first storage area and the second storage area respectively, and read the corresponding auxiliary calculation parameters from the parameter memory; distribute the target coefficients and the auxiliary calculation parameters to multiple butterfly operation units for operation, and write the operation results back to the first storage area and the second storage area respectively according to the coefficient reading address, so as to update the preset low-order coefficients and preset high-order coefficients.

[0006] Optionally, the number of butterfly arithmetic units is four, and correspondingly, the access control module includes: The access control unit is configured to read four target coefficients from the first storage area and the second storage area respectively within the same clock cycle, and read four auxiliary calculation parameters from the parameter memory. Then, the four target coefficients and the four auxiliary calculation parameters are sent to four butterfly operation units so that each butterfly operation unit can perform parallel operations.

[0007] Optionally, the butterfly arithmetic unit includes: A multiplier is used to multiply the target coefficient by the auxiliary calculation parameter to obtain the multiplication result; A modular reducer connected to the multiplier is used to perform modular reduction on the multiplication result to obtain a reduced result. An adder is used to perform a modular addition operation on the target coefficient and the reduction result, and to use the resulting modular addition result as the operation result; The subtractor is used to perform a modulo subtraction operation on the target coefficient and the reduction result, and use the resulting modulo subtraction result as the operation result.

[0008] Optionally, if the butterfly operation unit performs number theory transformation operations, the access control module accordingly includes: The first parameter transmission unit is used to read the target high-order coefficient from the second storage area in the first clock cycle and transmit the target high-order coefficient to the multiplier; The first buffer unit is used to buffer the multiplication result output by the multiplier in the second clock cycle; The second parameter transmission unit is used to transmit the multiplication result to the modulo reducer in the third clock cycle; The second buffer unit is used to buffer the reduction result output by the modulo reducer in the fourth clock cycle; The third parameter transmission unit is used to read the target low-order coefficient from the first memory area in the fifth clock cycle, and send the target low-order coefficient and the reduction result to the adder and / or the subtractor. The third cache unit is used to cache the operation results output by the adder and / or the subtractor in the sixth clock cycle; The first result write-back unit is used to write the modulo addition result back to the first storage area and the modulo subtraction result back to the second storage area in the seventh clock cycle.

[0009] Optionally, if the butterfly arithmetic unit performs inverse number theory transformation operations, the access control module accordingly includes: The fourth parameter transmission unit is used to read the target low-order coefficient and the target high-order coefficient from the first storage area and the second storage area in the first clock cycle, and to transmit the target low-order coefficient and the target high-order coefficient to the adder and the subtractor; The fourth cache unit is used to cache the modulo addition result output by the adder in the second clock cycle and write the modulo addition result back to the first storage area, and to cache the modulo subtraction result output by the subtractor; The fifth parameter transmission unit is used to transmit the modulo-subtraction result to the multiplier in the third clock cycle, and multiply the modulo-subtraction result with the auxiliary calculation parameters read from the parameter memory to obtain the multiplication result; The fifth buffer unit is used to buffer the multiplication result output by the multiplier in the fourth clock cycle; The sixth parameter transmission unit is used to transmit the multiplication result to the modulo reducer during the fifth clock cycle; The sixth buffer unit is used to buffer the reduction result output by the modulo reducer in the sixth clock cycle; The second result write-back unit is used to write the reduction result back to the second storage area in the seventh clock cycle.

[0010] Optionally, the coprocessor for post-quantum cryptography algorithms further includes: A control module connected to the access control module and the multiple butterfly operation units respectively is used to respond to the operation instructions sent by the cloud chip to schedule the butterfly operation units to perform number theory transformation operations or inverse number theory transformation operations; The bus interface connected to the control module is used to mount the coprocessor to the system bus of the cloud chip.

[0011] Optionally, the coprocessor for post-quantum cryptography algorithms further includes: The iterative update module is used to use the updated preset low-order coefficient and the updated preset high-order coefficient as the new preset low-order coefficient and the new preset low-order coefficient in the first storage area and the second storage area, respectively, so as to control the multiple parallel butterfly operation units to execute the next round of parallel operation until the iterative operation ends.

[0012] Secondly, this application discloses a hardware acceleration method based on a coprocessor, applied to any of the coprocessors disclosed above, comprising: Receive the calculation instructions sent by the cloud chip, and read the target coefficients of the data to be calculated from the first storage area and the second storage area of ​​the register group respectively according to the calculation instructions; Based on the operation instructions, the corresponding auxiliary calculation parameters are read from the parameter memory; Control multiple parallel butterfly operation units and perform butterfly operations in number theory transformation or inverse number theory transformation based on the target coefficients and the auxiliary calculation parameters to obtain the operation results; The calculation results are written back to the first storage area and the second storage area according to the coefficient read address, respectively, to update the coefficients.

[0013] Thirdly, this application discloses an electronic device, including: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the aforementioned disclosed coprocessor-based hardware acceleration method.

[0014] Fourthly, this application discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the aforementioned disclosed coprocessor-based hardware acceleration method.

[0015] As can be seen, this application discloses a coprocessor for post-quantum cryptography algorithms, applied to a cloud chip, comprising: a register group, divided into a first storage area and a second storage area; wherein the first storage area stores preset low-order coefficients for data to be computed, and the second storage area stores preset high-order coefficients of the data to be computed; a parameter memory, for storing auxiliary calculation parameters; multiple parallel butterfly operation units, for performing butterfly operations in number-theoretical transformation operations or inverse number-theoretical transformation operations to obtain calculation results; an access control module connected to the register group, the parameter memory, and the butterfly operation units respectively, for simultaneously reading target coefficients of the data to be computed from the first storage area and the second storage area respectively, and reading corresponding auxiliary calculation parameters from the parameter memory; distributing the target coefficients and the auxiliary calculation parameters to the multiple butterfly operation units for computation, and writing the computation results back to the first storage area and the second storage area respectively according to the coefficient read address to update the preset low-order coefficients and the preset high-order coefficients. Therefore, by dividing the register's logical address into a first storage area and a second storage area, the low-order and high-order coefficients of the data to be calculated are partitioned and stored. This achieves the replacement of multiple RAM blocks with a single register group, and the separation of coefficient storage through logical partitioning solves the RAM fragmentation problem, leveraging the advantages of registers' fast access speed and lack of fragmentation. Secondly, storing auxiliary calculation parameters separately in the parameter memory solves the storage resource contention problem. Parameter reading and coefficient reading can be performed in parallel, improving bandwidth utilization. Then, parallel computation through butterfly units solves the computation speed problem, increasing the computation throughput per unit time. Utilizing the partitioning characteristics of registers, the two input coefficients required for butterfly operations are obtained simultaneously within one clock cycle, solving the problem of complex data scheduling. There is no need for complex address rearrangement and switching between multiple RAM blocks, simplifying the control logic. At the same time, while reading coefficients, the corresponding auxiliary calculation parameters are read from the parameter RAM, solving the communication bandwidth bottleneck problem. This enables the simultaneous acquisition of coefficients and parameters in the same cycle, reducing waiting time. Finally, the calculation result directly overwrites the original coefficient position, achieving in-situ update and supporting continuous multi-round butterfly operations without additional caching or data movement. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0017] Figure 1 This is a schematic diagram of a coprocessor architecture for post-quantum cryptography algorithms disclosed in this application; Figure 2 This is a schematic diagram of an NTT operation structure disclosed in this application; Figure 3 This is a schematic diagram of a butterfly arithmetic register access mode disclosed in this application; Figure 4 This application discloses an NTT butterfly computing pipeline operation flowchart; Figure 5 This application discloses an INTT four-butterfly pipeline operation flowchart; Figure 6 This is a design block diagram of a resource reuse method disclosed in this application; Figure 7 This is a block diagram of the overall design of Dilithium disclosed in this application; Figure 8 This is a flowchart of a hardware acceleration method based on a coprocessor disclosed in this application; Figure 9 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0019] Dilithium, a post-quantum cryptography algorithm released by the National Institute of Standards and Technology (NIST) in 2024, is a next-generation signature verification standard based on lattice-hard problems. It boasts advantages such as resistance to quantum attacks, high signature verification speed, and low hardware resource consumption, making it a current research hotspot in the cryptography field. In the Dilithium algorithm, polynomial multiplication is the core step, consuming the majority of computation time and hardware resources. Currently, butterfly operations based on Number Theoretic Transform (NTT) are widely used to quickly implement polynomial multiplication. However, NTT computation requires multiple butterfly operations, each involving modular addition, subtraction, multiplication, and reduction, and the control logic involves multiple nested loops, resulting in low computational efficiency and high resource consumption in hardware implementation. Furthermore, the storage and scheduling of polynomial coefficients are complex, requiring high communication bandwidth.

[0020] To improve NTT's processing speed, existing solutions typically employ multiple butterfly arithmetic units for parallel processing, coupled with multiple true dual-port random access memory (RAM) blocks for data storage and scheduling. For example, each butterfly arithmetic unit requires multiple RAM blocks for reading and writing coefficients. During seven rounds of butterfly operations, these RAM blocks are continuously occupied, preventing the simultaneous execution of other operations. Furthermore, the large number of RAM blocks and their small individual capacity easily lead to storage resource fragmentation, failing to fully leverage the high storage density and small area advantages of RAM, thus limiting the overall performance improvement of the hardware.

[0021] To address this, the present invention provides a coprocessor for post-quantum cryptography algorithms, which can optimize the storage structure and data scheduling of the coprocessor while ensuring high parallelism, thereby reducing resource consumption and improving computational efficiency.

[0022] like Figure 1 As shown, this invention discloses a coprocessor for post-quantum cryptography algorithms, applied to cloud chips, comprising: Register group 11 is used to divide into a first storage area and a second storage area; wherein, the first storage area stores the preset low-order coefficients of the data to be processed, and the second storage area stores the preset high-order coefficients of the data to be processed; Parameter memory 12 is used to store auxiliary calculation parameters; Multiple parallel butterfly operation units 13 are used to perform butterfly operations in number theory transformation operations or inverse number theory transformation operations to obtain the operation results; The access control module 14, which is connected to the register group 11, the parameter memory 12, and the butterfly operation unit 13 respectively, is used to simultaneously read the target coefficients of the data to be operated from the first storage area and the second storage area respectively, and read the corresponding auxiliary calculation parameters from the parameter memory 12; distribute the target coefficients and the auxiliary calculation parameters to multiple butterfly operation units 13 for operation, and write the operation results back to the first storage area and the second storage area according to the coefficient reading address respectively, so as to update the preset low-order coefficients and preset high-order coefficients.

[0023] For data operations in the Dilithium algorithm, the polynomial of the data to be operated on has 256 coefficients. Decomposing it into two 128th degree polynomials for butterfly operations requires a total of 7 rounds of butterfly operations. Each butterfly operation includes 3 multipliers, making RAM access more complex. Current designs mostly employ true dual-port multi-RAM interleaved operations, with multiple butterfly units operating in parallel. Each butterfly unit uses 4 true dual-port RAM blocks, and the entire process involves 7 rounds of butterfly operations. However, this results in a large number of RAM blocks, a large total RAM size, and very small block size, leading to RAM fragmentation and failing to leverage the advantages of large RAM storage capacity and small area. Furthermore, these RAM blocks are continuously occupied during these 7 rounds of butterfly operations, preventing parallel use for other operations and limiting performance. Therefore, this solution uses 4 butterfly operation units operating in parallel. Specifically… The number of butterfly-shaped arithmetic units 13 is four, and correspondingly, the access control module 14 includes: The access control unit is configured to read four target coefficients from the first storage area and the second storage area respectively, and read four auxiliary calculation parameters from the parameter memory within the same clock cycle. Then, it transmits the four target coefficients and the four auxiliary calculation parameters to four butterfly operation units so that each butterfly operation unit can perform parallel operations. Figure 2 As shown, for NTT operations, it is necessary to ensure the parallelism of its own operations and that other operations can also be performed in parallel simultaneously. A 256x23 (depth 256, bit width 23-bit) register group 11 and a 64x96 (depth 64, bit width 96-bit) RAM0 (parameter memory 12) are used to complete the entire NTT operation. Here, RAM0 is used to store the zeta parameters required for the NTT operation. The 256 polynomial coefficients of the data to be operated on are sequentially read from the original RAM storage into the 256x23 (depth 256, bit width 23-bit) register group 11, and a 96-bit zeta data is read from RAM0 (parameter memory 12). Here, four data points are sent to four butterfly operation units per clock cycle for the target coefficients in register group 11, and the results are stored back in register group 11. This process is repeated 64 times, i.e., 64 clock cycles, 7 rounds, for a total of 112 clock cycles. Finally, the results are written back to the original RAM.

[0024] The process of reading and writing target coefficients in the first and second storage areas within register group 11 is as follows: The 256x23 (depth 256, bit width 23bit) register is divided into two 128x23 (depth 128, bit width 23bit) areas: reg0 (first storage area) and reg1 (second storage area). After the polynomial coefficients are sequentially stored in reg0 and reg1, under the control of the access control unit, data from reg0 to reg1 is read simultaneously from addresses 0 to 128, reading four 23-bit data values ​​at a time. A 96-bit wide zeta data value (four 23-bit wide zeta parameters) is also read from ram0 and sent to the four butterfly operation units. The result of the operation is stored back at the same address in reg0 and reg1. In the next operation, data is again read simultaneously from reg0 and reg1 and sent to the four butterfly operation units, with the result again stored back in reg0 and reg1. This iterative process, using alternating operations on a single register, ensures ordered access to parameters in each round. For the Dilithium algorithm, the polynomial has 256 coefficients. Since it's split into two 128th-degree polynomials, a total of seven rounds of butterfly operations are required. The butterfly operation register access pattern is as follows: Figure 2 As shown.

[0025] The Inverse NTT (Inverse Number Theory Transformation) of the Dilithium algorithm is designed as eight butterfly operations. The INTT operation needs to ensure its own parallelism while simultaneously allowing other operations to run in parallel. A 256x23 (depth 256, bit width 23-bit) register and a 64x96 (depth 64, bit width 96-bit) RAM0 are used to complete the entire INTT operation. RAM0 stores the zeta parameters required for the INTT operation. The 256x23 (depth 256, bit width 23-bit) register is divided into two 128x23 (depth 128, bit width 23-bit) registers, reg0 and reg1, for storing intermediate results. The initial raw parameters are read sequentially into reg0 and reg1 in two parts. Then, starting from addresses 0 to 127, data from reg0 and reg1 is read simultaneously, four 23-bit data segments at a time. A 96-bit wide zeta data segment (combining the four 23-bit zeta parameters) is also read from ram0 and sent to four butterfly arithmetic units, requiring one clock cycle. The result is stored back at the corresponding addresses in reg0 and reg1. The next operation then reads data from reg0 and reg1 simultaneously, sends it to the butterfly arithmetic units, and stores the result back in reg0 and reg1. This cycle repeats.

[0026] Furthermore, the butterfly operation unit 13 includes: a multiplier for multiplying the target coefficient with the auxiliary calculation parameter to obtain a multiplication result; a modular reduction unit connected to the multiplier for performing modular reduction on the multiplication result to obtain a reduced result; an adder for performing modular addition on the target coefficient and the reduced result, and using the obtained modular addition result as the operation result; and a subtractor for performing modular subtraction on the target coefficient and the reduced result, and using the obtained modular subtraction result as the operation result. An iterative update module is used to use the updated preset low-order coefficient and the updated preset high-order coefficient as the new preset low-order coefficient and the new preset low-order coefficient in the first storage area and the second storage area, respectively, to control the multiple parallel butterfly operation units to execute the next round of parallel operation until the iterative operation ends. It is understood that the butterfly operation unit 13 is the core of NTT, INTT, and CWM calculations. The butterfly operation unit 13 for NTT / INTT operations in this invention is implemented using a pipelined structure. The multiplier has its first input connected to the access control module 12 to receive the target coefficients read from the second storage area of ​​the register group 11; its second input is connected to the parameter memory 12 to receive the corresponding auxiliary calculation parameters (i.e., spin factor parameters). The multiplier multiplies the target coefficients by the auxiliary calculation parameters, performing an intermediate step of modular multiplication to obtain the multiplication result. This multiplication result is the original product without modular reduction, and its bit width may exceed the original bit width of the target coefficients (e.g., 23 bits), requiring subsequent modular reduction processing. The modular subtractor has its input connected to the output of the multiplier to receive the multiplication result output by the multiplier and perform modular reduction on the multiplication result. The purpose of modular reduction is to constrain the value of the multiplication result within a preset modulus range, restoring it to a value with the same bit width (e.g., 23 bits) as the target coefficient, so that subsequent addition and subtraction operations can be performed. The modular reducer outputs the reduced result. The adder, with its first input connected to the access control module 14, is used to receive the target coefficient read from the first storage area of ​​register group 11; its second input is connected to the output of the modular reducer to receive the reduced result. The adder performs a modular addition operation on the target coefficient read from the first storage area and the reduced result, generating a modular addition result. This modular addition result, as part of the operation result, is written back to the original address of the first storage area via the access control module 14. The subtractor, with its first input also connected to the access control module 14, is used to receive the target coefficient read from the first storage area; its second input is connected to the output of the modular reducer to receive the reduced result. The subtractor performs a modular subtraction operation on the target coefficient read from the first storage area and the reduced result, generating a modular subtraction result. The result of the subtraction is written back to the original address of the second storage area as another part of the calculation result via the access control module 14.

[0027] If the butterfly operation unit 13 performs number theory transformation operations, the corresponding access control module 14 includes: a first parameter transmission unit, configured to read the target high-order coefficient from the second storage area in the first clock cycle and transmit the target high-order coefficient to the multiplier; a first cache unit, configured to cache the multiplication result output by the multiplier in the second clock cycle; a second parameter transmission unit, configured to transmit the multiplication result to the modulo reducer in the third clock cycle; a second cache unit, configured to cache the reduction result output by the modulo reducer in the fourth clock cycle; a third parameter transmission unit, configured to read the target low-order coefficient from the first storage area in the fifth clock cycle and transmit both the target low-order coefficient and the reduction result to the adder and / or the subtractor; a third cache unit, configured to cache the operation result output by the adder and / or the subtractor in the sixth clock cycle; and a first result write-back unit, configured to write the modulo addition result back to the first storage area and the modulo subtraction result back to the second storage area in the seventh clock cycle. Figure 4 As shown, the specific operation flow of NTT's four butterfly arithmetic pipelines is as follows: In the first clock cycle, four 23-bit data bits from reg1 are input to the multiplier, and four zeta parameters (96 bits each, 24 bits each) are read from ram0 and input to the multiplier. The second clock cycle buffers the multiplied data. In the third clock cycle, the data buffered in the second clock cycle is input to the modulo-reducing unit. The fourth clock cycle buffers the modulo-reducing data. In the fifth clock cycle, four 23-bit data bits from reg0 are input to the adder and subtractor, performing modulo addition and subtraction simultaneously. In the sixth clock cycle, the data from the fifth clock cycle is buffered. In the seventh clock cycle, the data is simultaneously written back to reg0 and reg1.

[0028] If the butterfly operation unit 13 performs an inverse number theory transformation operation, the corresponding access control module 14 includes: a fourth parameter transmission unit, used to read the target low-order coefficient and the target high-order coefficient from the first storage area and the second storage area in the first clock cycle, and send the target low-order coefficient and the target high-order coefficient to the adder and the subtractor; a fourth cache unit, used to cache the modulo addition result output by the adder in the second clock cycle and write the modulo addition result back to the first storage area, and cache the modulo subtraction result output by the subtractor; a fifth parameter transmission unit; and a fourth cache unit. A first unit is used to send the modulo-subtraction result to the multiplier in the third clock cycle and multiply the modulo-subtraction result by auxiliary calculation parameters read from the parameter memory to obtain the multiplication result; a fifth cache unit is used to cache the multiplication result output by the multiplier in the fourth clock cycle; a sixth parameter transmission unit is used to send the multiplication result to the modulo-reducer in the fifth clock cycle; a sixth cache unit is used to cache the reduction result output by the modulo-reducer in the sixth clock cycle; and a second result write-back unit is used to write the reduction result back to the second memory area in the seventh clock cycle. Figure 5 As shown, in the first clock cycle, four 23-bit data bits from the corresponding addresses of reg0 and reg1 are input to the modulo-addition / modulo-subtraction module, performing both addition and subtraction simultaneously. In the second clock cycle, the data after modulo-addition is written back to reg0, and the data after modulo-subtraction is buffered. In the third clock cycle, the data from the modulo-subtraction of the second clock cycle is input to the multiplier, and four zeta parameters (96 bits, 24 bits each) are read from ram0 and input to the multiplier. In the fourth clock cycle, the data from the third clock cycle is buffered; in the fifth clock cycle, modulo-simplification / subtraction is performed; in the sixth clock cycle, the data from the fifth clock cycle is buffered; and in the seventh clock cycle, the data is written back to reg1.

[0029] Therefore, the multiplier, modulo reducer, adder, and subtractor are inter-stage buffered via pipelined registers to achieve pipelined operation. Specifically, after the multiplier completes its operation in the first clock cycle, its result is buffered in the second clock cycle; the modulo reducer processes the buffered data in the third clock cycle and buffers the reduction result in the fourth clock cycle; the adder and subtractor read the buffered data in the fifth clock cycle and perform operations with the coefficients in the first memory area, buffer the result in the sixth clock cycle, and complete the write-back in the seventh clock cycle. Through this pipelined design, the butterfly arithmetic unit can start a new butterfly operation in each clock cycle, improving the computational throughput of NTT / INTT.

[0030] Furthermore, the NTT and INTT operations of the Dilithium algorithm are multiplexed using register and ram0, allowing the operations to utilize a 256x23 (256-bit depth, 23-bit width) register and ram0. The modulo addition, modulo subtraction, multiplication, and modulo reduction / subtraction operation units are also multiplexed, further reducing hardware resource consumption and cost. The specific design is as follows: Figure 6 As shown.

[0031] The coprocessor further includes: a control module connected to the access control module and the plurality of butterfly arithmetic units respectively, used to respond to arithmetic instructions sent by the cloud chip to schedule the butterfly arithmetic units to perform number-theoretical transformation operations or inverse number-theoretical transformation operations; and a bus interface connected to the control module for mounting the coprocessor to the system bus of the cloud chip. It can be understood that the control module is used to control the invocation of NTT and INTT operators, Dilithium_core is the arithmetic module for the Dilithium algorithm, and the bus interface is an AHB bus, which can be directly connected to the AHB bus. The overall design is as follows. Figure 7 As shown.

[0032] Through the above design, a high-performance Dilithium general-purpose coprocessor for post-quantum cryptography algorithms was implemented. This processor utilizes eight butterfly-shaped operation units in parallel implementation for high-speed applications. Furthermore, the reuse of internal operation units within NTT and INTT, as well as the reuse of registers, further reduces hardware resource consumption, making it well-suited for cloud-based chip applications.

[0033] As can be seen, this application discloses a coprocessor for post-quantum cryptography algorithms, applied to a cloud chip, comprising: a register group, divided into a first storage area and a second storage area; wherein the first storage area stores preset low-order coefficients for data to be computed, and the second storage area stores preset high-order coefficients of the data to be computed; a parameter memory, for storing auxiliary calculation parameters; multiple parallel butterfly operation units, for performing butterfly operations in number-theoretical transformation operations or inverse number-theoretical transformation operations to obtain calculation results; an access control module connected to the register group, the parameter memory, and the butterfly operation units respectively, for simultaneously reading target coefficients of the data to be computed from the first storage area and the second storage area respectively, and reading corresponding auxiliary calculation parameters from the parameter memory; distributing the target coefficients and the auxiliary calculation parameters to the multiple butterfly operation units for computation, and writing the computation results back to the first storage area and the second storage area respectively according to the coefficient read address to update the preset low-order coefficients and the preset high-order coefficients. Therefore, by dividing the register's logical address into a first storage area and a second storage area, the low-order and high-order coefficients of the data to be calculated are partitioned and stored. This achieves the replacement of multiple RAM blocks with a single register group, and the separation of coefficient storage through logical partitioning solves the RAM fragmentation problem, leveraging the advantages of registers' fast access speed and lack of fragmentation. Secondly, storing auxiliary calculation parameters separately in the parameter memory solves the storage resource contention problem. Parameter reading and coefficient reading can be performed in parallel, improving bandwidth utilization. Then, parallel computation through butterfly units solves the computation speed problem, increasing the computation throughput per unit time. Utilizing the partitioning characteristics of registers, the two input coefficients required for butterfly operations are obtained simultaneously within one clock cycle, solving the problem of complex data scheduling. There is no need for complex address rearrangement and switching between multiple RAM blocks, simplifying the control logic. At the same time, while reading coefficients, the corresponding auxiliary calculation parameters are read from the parameter RAM, solving the communication bandwidth bottleneck problem. This enables the simultaneous acquisition of coefficients and parameters in the same cycle, reducing waiting time. Finally, the calculation result directly overwrites the original coefficient position, achieving in-situ update and supporting continuous multi-round butterfly operations without additional caching or data movement.

[0034] like Figure 8 As shown, the present invention also discloses a hardware acceleration method based on a coprocessor, applied to the coprocessor disclosed above, comprising: Step S11: Receive the operation instructions sent by the cloud chip, and read the target coefficients of the data to be operated from the first storage area and the second storage area of ​​the register group respectively according to the operation instructions.

[0035] In this embodiment, the coprocessor receives arithmetic instructions from the cloud chip via a bus interface. These instructions carry an operation type identifier, indicating whether the operation is a Number Theory Transform (NTT) or Inverse Number Theory Transform (INTT) operation. Upon receiving the instruction, the access control module parses the operation type and generates corresponding address control signals and read / write timing sequences. The register set is logically divided into a first storage area and a second storage area. The first storage area pre-stores the low-order coefficients of the polynomial (addresses 0-127), and the second storage area pre-stores the high-order coefficients of the polynomial (addresses 128-255). At the start of the first round of the NTT or INTT operation, the access control module generates read addresses for the first and second storage areas according to a preset butterfly operation pattern. Within the same clock cycle, the access control module simultaneously sends read enable signals to both the first and second storage areas, reading two target coefficients participating in the same butterfly operation from each storage area. For example, in a radix-2 butterfly operation, coefficient 'a' is read from the first storage area, and coefficient 'b' is read from the second storage area. This dual-zone simultaneous reading mechanism ensures that each clock cycle can provide complete input operand pairs for subsequent butterfly arithmetic units, avoiding the waiting cycles caused by single-port RAM read conflicts in traditional solutions.

[0036] Step S12: Read the corresponding auxiliary calculation parameters from the parameter memory based on the operation instructions.

[0037] In this embodiment, the read address of the parameter memory is generated according to the transformation type indicated by the operation instruction and the current operation round. The parameter memory is set up independently of the register group. In specific implementations, a random access memory (RAM) with a depth of 64 and a bit width of 96 bits can be used to pre-store all zeta parameters required for NTT and INTT operations. Each memory cell compactly stores four parallel 23-bit or 24-bit zeta parameters to accommodate the needs of parallel computation by multiple butterfly operation units. After generating the read address, the access control module sends a read enable signal to the parameter memory and reads a 96-bit data word containing four zeta parameters within one clock cycle. The read zeta parameters are time-aligned with the target coefficients and sent together to the subsequent butterfly operation units.

[0038] In this way, since the parameter memory and register set are independent of each other, coefficient reading and parameter reading can be performed in parallel, effectively avoiding the interruption of coefficient data flow due to parameter reading, thus improving the continuity of data supply and overall computational efficiency. For different computation rounds, the access control module automatically adjusts the read address of the parameter memory according to the number of butterfly operation levels, ensuring that the correct rotation factor is used in each operation.

[0039] Step S13: Control multiple parallel butterfly operation units and perform butterfly operations in number theory transformation or inverse number theory transformation based on the target coefficients and the auxiliary calculation parameters to obtain the operation results.

[0040] In this embodiment, the target coefficients and auxiliary calculation parameters are distributed to multiple parallel butterfly operation units. In this embodiment, there are four butterfly operation units, each with a pipelined architecture. For the NTT operation, the butterfly operation units perform the following pipelined operations: the coefficients read from the second storage area are first multiplied by the zeta parameter in the multiplier; the multiplication result is buffered and then sent to the modular reducer for modular reduction; the reduced result and the coefficients read from the first storage area are subjected to modular addition and modular subtraction operations in parallel in the adder and subtractor, respectively generating modular addition and modular subtraction results. For the INTT operation, the data flow is reversed: the coefficients read from the first and second storage areas are first subjected to modular addition and modular subtraction; the modular subtraction result is then multiplied by the zeta parameter in the multiplier and output after modular reduction.

[0041] In this way, the data flow and control timing within the butterfly arithmetic unit are automatically switched according to the operation type identifier in the arithmetic instruction, achieving compatibility between NTT and INTT modes. The four butterfly arithmetic units work in parallel, with each unit independently processing a pair of coefficients and a spin factor, enabling four sets of butterfly operations to be completed per clock cycle, thus improving computational throughput.

[0042] Step S14: Write the calculation results back to the first storage area and the second storage area according to the coefficient read address, respectively, to update the coefficients.

[0043] In this embodiment, after the butterfly operation unit completes the operation, it generates a modulo addition result and a modulo subtraction result. Based on the target coefficient read address generated in the process, these two operation results are written back to the corresponding storage areas of the register group. Specifically, the modulo addition result is written back to the first storage area according to the original read address, and the modulo subtraction result is written back to the second storage area according to the original read address. This in-place write-back mechanism ensures that after one round of butterfly operation is completed, the coefficients stored in the register group are updated in a timely manner, preparing new operands for the next round of butterfly operation. Throughout the seven rounds of butterfly operation, the coefficients are iteratively updated between the first and second storage areas of the register group, without the need to move intermediate results to external memory or other temporary caches. After each round of operation is completed, the access control module adjusts the read address mode of the next round (such as bit reversal order or fixed step) according to the series pattern of the butterfly operation, and repeats steps S11 to S14 until all rounds of operation are completed. After all operations are completed, the final transformation result is still stored in the register group, which can be directly called by subsequent multiplication, addition or other cryptographic operations, or sent back to the cloud chip through the bus interface.

[0044] Therefore, by simultaneously reading from both register banks and parallel fetching from parameter memory, a complete operand pair is provided to the butterfly arithmetic unit every clock cycle, eliminating data waiting cycles. Combined with parallel computing and pipelined design of multiple butterfly arithmetic units, the ability to initiate multiple operations in a single cycle is achieved, improving the computational throughput per unit time of NTT / INTT. The in-situ write-back mechanism eliminates the need to move intermediate results to external memory, reducing dynamic power consumption and additional cache requirements caused by data migration. Furthermore, the entire method relies solely on a lightweight storage structure of register banks and parameter RAM, avoiding the fragmentation waste caused by multiple RAM blocks in traditional solutions, achieving high-performance acceleration at a lower hardware cost. Finally, a unified access control module coordinates the reading and writing of coefficients and parameters, adapting to both NTT and INTT operation modes, resulting in high hardware reuse. Ultimately, it can be directly integrated into the cloud chip system bus, providing efficient hardware acceleration support for post-quantum cryptography algorithms.

[0045] Furthermore, embodiments of this application also disclose an electronic device, Figure 9 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0046] Figure 9 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the coprocessor-based hardware acceleration method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0047] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0048] The processor 21 may include one or more processing cores, such as a quad-core processor or an octa-core processor. The processor 21 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field-Programmable Gate Array), and PLA (Programmable Logic Array). The processor 21 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, the processor 21 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, the processor 21 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0049] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0050] The operating system 221 manages and controls the various hardware devices and computer programs 222 on the electronic device 20 to enable the processor 21 to perform calculations and processing on the massive amounts of data 223 in the memory 22. The operating system 221 can be Windows Server, Netware, Unix, Linux, etc. The computer program 222, in addition to including a computer program capable of performing the coprocessor-based hardware acceleration method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, may further include computer programs capable of performing other specific tasks. The data 223 may include data received by the electronic device from external devices, as well as data collected by its own input / output interface 25.

[0051] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned coprocessor-based hardware acceleration method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0052] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0053] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application. The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly in hardware, software modules executed by a processor, or a combination of both. The software module may be located in random access memory (RAM), memory, read-only memory (ROM), electrically programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), registers, hard disks, removable disks, CD-ROMs (Compact Disc-Read Only Memory), or any other form of storage medium known in the art.

[0054] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0055] The solution provided by the present invention has been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only for helping to understand the method and core ideas of the present invention. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of the present invention. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. A coprocessor for post-quantum cryptography algorithms, characterized in that, Applications in cloud-based chips include: The register group is divided into a first storage area and a second storage area; wherein, the first storage area stores the preset low-order coefficients of the data to be processed, and the second storage area stores the preset high-order coefficients of the data to be processed; Parameter storage is used to store auxiliary calculation parameters; Multiple parallel butterfly operation units are used to perform butterfly operations in number-theoretic transformation operations or inverse number-theoretic transformation operations to obtain the operation results; The access control module, which is connected to the register group, the parameter memory, and the butterfly operation unit respectively, is used to simultaneously read the target coefficients of the data to be operated from the first storage area and the second storage area respectively, and read the corresponding auxiliary calculation parameters from the parameter memory; distribute the target coefficients and the auxiliary calculation parameters to multiple butterfly operation units for operation, and write the operation results back to the first storage area and the second storage area respectively according to the coefficient reading address, so as to update the preset low-order coefficients and preset high-order coefficients.

2. The coprocessor for post-quantum cryptography algorithms according to claim 1, characterized in that, The number of butterfly-shaped arithmetic units is four, and correspondingly, the access control module includes: The access control unit is configured to read four target coefficients from the first storage area and the second storage area respectively within the same clock cycle, and read four auxiliary calculation parameters from the parameter memory. Then, the four target coefficients and the four auxiliary calculation parameters are sent to four butterfly operation units so that each butterfly operation unit can perform parallel operations.

3. The coprocessor for post-quantum cryptography algorithms according to claim 1, characterized in that, The butterfly arithmetic unit includes: A multiplier is used to multiply the target coefficient by the auxiliary calculation parameter to obtain the multiplication result; A modular reducer connected to the multiplier is used to perform modular reduction on the multiplication result to obtain a reduced result. An adder is used to perform a modular addition operation on the target coefficient and the reduction result, and to use the resulting modular addition result as the operation result; The subtractor is used to perform a modulo subtraction operation on the target coefficient and the reduction result, and use the resulting modulo subtraction result as the operation result.

4. The coprocessor for post-quantum cryptography algorithms according to claim 3, characterized in that, If the butterfly arithmetic unit performs number theory transformation operations, the corresponding access control module includes: The first parameter transmission unit is used to read the target high-order coefficient from the second storage area in the first clock cycle and transmit the target high-order coefficient to the multiplier; The first buffer unit is used to buffer the multiplication result output by the multiplier in the second clock cycle; The second parameter transmission unit is used to transmit the multiplication result to the modulo reducer in the third clock cycle; The second buffer unit is used to buffer the reduction result output by the modulo reducer in the fourth clock cycle; The third parameter transmission unit is used to read the target low-order coefficient from the first memory area in the fifth clock cycle, and send the target low-order coefficient and the reduction result to the adder and / or the subtractor. The third cache unit is used to cache the operation results output by the adder and / or the subtractor in the sixth clock cycle; The first result write-back unit is used to write the modulo addition result back to the first storage area and the modulo subtraction result back to the second storage area in the seventh clock cycle.

5. The coprocessor for post-quantum cryptography algorithms according to claim 3, characterized in that, If the butterfly arithmetic unit performs inverse number theory transformation operations, the corresponding access control module includes: The fourth parameter transmission unit is used to read the target low-order coefficient and the target high-order coefficient from the first storage area and the second storage area in the first clock cycle, and to transmit the target low-order coefficient and the target high-order coefficient to the adder and the subtractor; The fourth cache unit is used to cache the modulo addition result output by the adder in the second clock cycle and write the modulo addition result back to the first storage area, and to cache the modulo subtraction result output by the subtractor; The fifth parameter transmission unit is used to transmit the modulo-subtraction result to the multiplier in the third clock cycle, and multiply the modulo-subtraction result with the auxiliary calculation parameters read from the parameter memory to obtain the multiplication result; The fifth buffer unit is used to buffer the multiplication result output by the multiplier in the fourth clock cycle; The sixth parameter transmission unit is used to transmit the multiplication result to the modulo reducer during the fifth clock cycle; The sixth buffer unit is used to buffer the reduction result output by the modulo reducer in the sixth clock cycle; The second result write-back unit is used to write the reduction result back to the second storage area in the seventh clock cycle.

6. The coprocessor for post-quantum cryptography algorithms according to any one of claims 1 to 5, characterized in that, Also includes: A control module connected to the access control module and the multiple butterfly operation units respectively is used to respond to the operation instructions sent by the cloud chip to schedule the butterfly operation units to perform number theory transformation operations or inverse number theory transformation operations; The bus interface connected to the control module is used to mount the coprocessor to the system bus of the cloud chip.

7. The coprocessor for post-quantum cryptography algorithms according to claim 1, characterized in that, Also includes: The iterative update module is used to use the updated preset low-order coefficient and the updated preset high-order coefficient as the new preset low-order coefficient and the new preset low-order coefficient in the first storage area and the second storage area, respectively, so as to control the multiple parallel butterfly operation units to execute the next round of parallel operation until the iterative operation ends.

8. A hardware acceleration method based on a coprocessor, characterized in that, Applied to the coprocessor as described in any one of claims 1 to 7, comprising: Receive the operation instructions sent by the cloud chip, and read the target coefficients of the data to be operated from the first storage area and the second storage area of ​​the register group respectively according to the operation instructions; Based on the operation instructions, the corresponding auxiliary calculation parameters are read from the parameter memory; Control multiple parallel butterfly operation units and perform butterfly operations in number theory transformation or inverse number theory transformation based on the target coefficients and the auxiliary calculation parameters to obtain the operation results; The calculation results are written back to the first storage area and the second storage area according to the coefficient read address, respectively, to update the coefficients.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing the computer program to implement the steps of the coprocessor-based hardware acceleration method as described in claim 8.

10. A computer-readable storage medium, characterized in that, Used to store a computer program; wherein, when the computer program is executed by a processor, it implements the steps of the coprocessor-based hardware acceleration method as described in claim 8.

Images