A parallel generation method and hardware structure of discrete Gaussian noise

Abstract

The present invention provides a parallel generation method and hardware structure of discrete Gaussian noise, which belongs to the field of cryptographic algorithm hardware design, and includes: a true random number buffer, a random bit register, a bit search module, a result output processing module, a control state machine, and a result buffer. The present invention proposes a generation method and hardware structure of discrete Gaussian noise based on the Knuth-Yao algorithm, which can generate discrete Gaussian noise required in lattice cryptography. While ensuring the cryptographic security of noise distribution, the present invention reduces sampling delay, improves parallelism, reduces the space complexity of search, and improves the operating efficiency of the lattice cryptographic algorithm.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptography hardware implementation, and in particular to a parallel generation method and hardware structure of discrete Gaussian noise. Background Art

[0002] In modern cryptography, the Ring Learning With Errors (RLWE) problem is an important technology. Discrete Gaussian Distribution (DGD) is an important part of the RLWE problem. The RLWE problem is based on the solution of Y=A*s+e in the polynomial space. The polynomial e is called an RLWE instance, and its coefficients conform to the DGD. Therefore, fast sampling of discrete Gaussian noise is very important in the hardware acceleration of cryptographic algorithms based on RLWE.

[0003] Due to the characteristics of discrete Gaussian distribution in the integer domain, it cannot be generated directly. Usually, an algorithm is used to convert the uniform distribution into a discrete Gaussian distribution. Commonly used algorithms include: Cumulative Distribution Table (CDT), Rejection Sampling Algorithm and Knuth-Yao Algorithm. Among them, the Knuth-Yao algorithm has the characteristics of early stopping and random walk, and the pre-stored data is less than the CDT algorithm, which makes it have a performance advantage in generating non-uniform integer distribution.

[0004] In the existing hardware implementation of discrete Gaussian noise based on the Knuth-Yao algorithm, a discrete distribution generating (DDG) tree is not constructed as described in the algorithm, but a random walk algorithm is directly executed on the binarized probability density table.

[0005] In the existing hardware implementation of Knuth-Yao algorithm, the focus is mainly on the compression and efficient storage of binary matrices, but the frequency of scanning process is not analyzed and optimized. Experiments have found that there is a serious imbalance problem in the traversal process of binary matrices.

[0006] In summary, how to design a discrete Gaussian noise generation method and hardware implementation with fast generation speed, high parallelism and small storage size is an urgent problem to be solved in the existing cryptographic hardware technology research. Summary of the invention

[0007] Purpose of the invention: The present invention provides a method for parallel generation of discrete Gaussian noise, and further proposes a hardware structure for implementing the above method, which can generate discrete Gaussian noise required in lattice cryptography. While ensuring the cryptographic security of noise distribution, the present invention reduces sampling delay, improves parallelism, reduces the search area, and improves the operating efficiency of the lattice cryptographic algorithm, thereby effectively solving the technical problems existing in the above background technology.

[0008] Technical solution: A parallel generation method for discrete Gaussian noise is proposed. The steps of the method are as follows:

[0009] Step 1: Use the random bits generated by a true random number generator as input to the algorithm

[0010] Step 2: Define the standard deviation, precision and truncation range of the discrete Gaussian distribution as needed, construct a binary probability matrix, and calculate the Hamming weight of each column of the matrix;

[0011] Step 3: Execute the Knuth-Yao algorithm in matrix form to scan the entire binary probability matrix until the corresponding point is hit;

[0012] Step 4: Return the value corresponding to the hit point and use a random bit as the sign bit of the value. The result is the discrete Gaussian noise value sampled by the algorithm.

[0013] In the above step 1, each random bit conforms to an independent uniform distribution, with a probability value of 0 of 0.5 and a probability value of 1 of 0.5.

[0014] In the process of scanning the binary probability matrix in step 3 above, the Hamming weight of the column is compared with the current scan value d. When the Hamming weight of the column is less than the scan value d, the random bits in the column will not be hit, the scan of the column is skipped and the scan value d minus the Hamming weight of the column. When the Hamming weight of the column is greater than the scan value d, the random bits in the column will be hit. At this time, only the 1 value in the column is scanned, and the invalid 0 value is ignored.

[0015] In the above step 3, during the scanning of the binary probability matrix, the scanning process of the first few columns is replaced by a lookup table. The scanning of the first n columns requires a total of n random bits r, using an address space of 2 n The lookup table directly finds the result of the column scan, including the column number of the hit bit or the remaining scan value d in the case of a miss.

[0016] According to the above-mentioned parallel generation method of discrete Gaussian noise, the present invention proposes its hardware implementation, including a true random number buffer, a random bit register, a bit search module, a result output processing module, a result buffer, and a control state machine.

[0017] The true random number buffer and the random bit register are electrically connected to each other to provide random bit input for the algorithm; the bit search module, the random bit register and the result output processing module are electrically connected to each other to execute the generation algorithm; the output processing module and the result buffer are electrically connected to each other for outputting the result; the control state machine and other modules are electrically connected to each other for scheduling tasks and connecting data streams.

[0018] The true random number buffer can receive and store input from an external true random number generator.

[0019] The random bit register can read random bits of required length from the true random number generator and provide them to the bit search module.

[0020] Preferably, the bit search module includes three submodules: a high-parallelism pre-lookup table, a parallel bit search module, and a high-precision bit search module. The high-parallelism pre-lookup table and the parallel bit search module are interconnected, and the parallel bit search module and the high-precision bit search module are interconnected.

[0021] The high-parallelism pre-lookup table performs high-parallel searches on the first n columns with the highest access frequency of the binary probability matrix. When the pre-lookup table does not hit, the parallel bit search module performs parallel column scans on the n+1 to n+1+m columns of the binary probability matrix. When the high-precision bit search module does not hit, the high-precision bit search module performs column scans on the n+1+m+1 to the last column of the binary probability matrix. The high-parallelism pre-lookup table has a higher parallelism than the parallel bit search module. The parallel bit search module has a higher parallelism than the high-precision bit search module.

[0022] Preferably, the parallel bit search module and the high-precision bit search module have the same structure, including a search value register, a search value update module, a Hamming weight comparator, and a hit column search module.

[0023] After receiving the result output by the bit search module, the output processing module uses a random bit to determine the positive or negative sign and outputs it to the result storage module.

[0024] Beneficial effects: The discrete Gaussian parallel generation method and hardware structure of the present invention can effectively improve the parallelism of the discrete Gaussian generator, reduce the amount of data storage, and increase the generation speed. Compared with the existing discrete Gaussian noise generator scheme, it has the advantages of parallelism and speed, and can meet the accuracy requirements at the same time, thereby improving the performance of the entire encryption system. The present invention optimizes the binary probability matrix bit search process according to the access frequency, and uses a three-level, decreasing parallelism bit search structure to achieve lightweight hardware parallel design. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 It is a schematic diagram of the hardware structure for parallel generation of discrete Gaussian noise of the present invention.

[0026] Figure 2 It is the probability matrix access frequency graph when σ=4.52M=24N=50 and the sampling is 100 million times.

[0027] Figure 3 It is a structural diagram of the bit search module in the present invention.

[0028] Figure 4 It is a distribution diagram of the three-level bit search in the present invention.

[0029] Figure 5 It is a structural diagram of the output processing module in the present invention. DETAILED DESCRIPTION

[0030] In the following description, a large number of specific details are provided to provide a more thorough understanding of the present invention. However, it is apparent to those skilled in the art that the present invention can be implemented without one or more of these details. In other examples, in order to avoid confusion with the present invention, some technical features well known in the art are not described.

[0031] Discrete Gaussian distribution is a distribution obtained by sampling Gaussian distribution in the integer ring space. Gaussian distribution is a very common continuous probability distribution, a Gaussian distribution with a center of 0 and a standard deviation of σ, and its probability density function is:

[0032]

[0033] After sampling in the integer domain, the probability density function of a discrete Gaussian distribution with a center of 0 and a standard deviation of σ is defined as:

[0034]

[0035]

[0036] At the same time, due to the accuracy of the implementation, for example, the probability density after k is greater than 12 times the standard deviation is less than 2 -100 , which is considered impossible. Therefore, in actual use, the range k of the discrete Gaussian distribution is constrained. Usually the range of k can be calculated by the safety factor and the standard deviation.

[0037] Due to the characteristics of discrete Gaussian distribution in the integer domain, it cannot be generated directly. Usually, an algorithm is used to convert the uniform distribution into a discrete Gaussian distribution. Commonly used algorithms include: Cumulative Distribution Table (CDT), Rejection Sampling Algorithm and Knuth-Yao Algorithm. Among them, the Knuth-Yao algorithm has the characteristics of early stopping and random walk, and the pre-stored data is less than the CDT algorithm, which makes it have a performance advantage in generating non-uniform integer distribution.

[0038] In the existing hardware implementation of discrete Gaussian noise based on the Knuth-Yao algorithm, a discrete distribution generating (DDG) tree is not constructed as described in the algorithm, but a random walk algorithm is directly executed on the binary probability density table. The process of the column scanning Knuth-Yao algorithm is as follows, which mainly calculates the elements in the hit probability matrix of the search value d, and the row number of the row where the element is located is the sampling result:

[0039] Input: probability matrix with M rows and N columns

[0040] Output: Sampling results

[0041] 1.for j=0to N

[0042] 2.d=0

[0043] 3. Sample random uniform bits r

[0044] 4.d=2*d+r

[0045] 5.for i=M-1to 0

[0046] 6. d=d–M[i][j]

[0047] 7.if d=-1return i

[0048] 8.endfor

[0049] 9.endfor

[0050] As long as the number of columns in the binary probability matrix is ​​large enough, the accuracy and hit rate of the algorithm can be guaranteed at the same time. Analysis shows that when the number of columns exceeds 64, the probability of the algorithm missing is less than 2 -64 , misses can be considered impossible.

[0051] In the existing hardware implementation of Knuth-Yao algorithm, the focus is mainly on the compression and efficient storage of binary matrices, but the frequency of scanning process is not analyzed and optimized. Experiments have found that there is a serious imbalance problem in the traversal process of binary matrices.

[0052] To this end, this embodiment proposes a hardware structure for parallel generation of discrete Gaussian noise to solve the above problem.

[0053] Embodiment 1:

[0054] This embodiment discloses a hardware structure for parallel generation of discrete Gaussian noise, such as Figure 1 As shown, the hardware structure includes a true random number buffer, a random bit register, a bit search module, a result output processing module, a result buffer, and a control state machine.

[0055] The true random number buffer and the random bit register are electrically connected to each other to provide random bit input for the algorithm; the bit search module, the random bit register and the result output processing module are electrically connected to each other to execute the generation algorithm; the output processing module and the result buffer are electrically connected to each other for outputting the result; the control state machine and other modules are electrically connected to each other for scheduling tasks and connecting data streams.

[0056] like Figure 1 As shown in FIG. 1 , the true random number buffer is a first-in first-out (FIFO) memory structure. When the buffer is not full, random bits are continuously written into the buffer through an external true random number generator. The written random bits conform to independent uniform distribution, that is, the value of each bit is 0 or 1 with equal probability.

[0057] When the algorithm is running, the random bit register takes out the random bits in the true random number buffer and fills them into the register. The true random number buffer and the random bit register are connected to each other.

[0058] When designing the hardware bit search module, we first experimented with the hit frequency of each column and obtained the following results: Figure 2 And the data shown in Table 1. In the data analysis, the hit rate of the first 7 columns of the matrix is ​​99.8%. In other words, the vast majority of the hit bits are concentrated in the first 7 columns.

[0059] Table 1 Knuth-Yao algorithm simulation data

[0060] Standard Deviation 4.51915 Accuracy 50 Truncation range 35 Sampling times 100000000 Average hit column number 3.15 The furthest hit column number 34

[0061] At the same time, in 100 million samples, the furthest hit column number is 34, which is hit only once, and there is a certain distance from the total number of columns of the matrix 50. The analysis shows that although the columns at the back of the probability matrix provide a higher accuracy for the Knuth-Yao algorithm, the access frequency is extremely low and the utilization rate is not high. In order to improve the utilization rate of the stored probability matrix, the present invention designs a three-level bit search module.

[0062] like Figure 3 As shown, the bit search module includes three submodules: a high-parallelism pre-lookup table, a parallel bit search module, and a high-precision bit search module. The high-parallelism pre-lookup table is interconnected with the parallel bit search module, and the parallel bit search module is interconnected with the high-precision bit search module.

[0063] The high-parallelism pre-lookup table performs high-parallel searches on the top n columns with the highest access frequency of the binary probability matrix. The input of the high-parallelism pre-lookup table is connected to the random bit register with a bit width of 7 bits. There are two types of outputs of the lookup table: if it hits, it returns the row number of the hit bit; if it misses, it returns the remaining d values ​​of the search.

[0064] When there is a cell miss in the front lookup table, the parallel bit search module processes in parallel according to the queue and performs parallel column scanning on the n+1 to n+1+m columns of the binary probability matrix. When there is a cell miss in the parallel bit search module, the high-precision bit search module performs column scanning on the n+1+m+1 to the last column of the binary probability matrix.

[0065] The parallel bit search module and the high-precision bit search module have the same structure, including a search value register, a search value update module, a Hamming weight comparator, and a hit column search module. The search value register stores the search value d in the algorithm flow. The search value update module updates the d value. When the d value is greater than the Hamming weight, it is updated to d-the Hamming weight of the column; when the d value is less than the Hamming weight, a column search is performed to search for a random bit with a value of 1 in the column and update it to d-1. The Hamming weight comparator determines the size relationship between the d value and the Hamming weight. When performing a column search, the hit column search module updates the temporarily stored column value to skip the bit with a value of 0. Suppose the value after binary merging of the column vector is a signed number x, then the position of the last 1 is x^(-x). At the same time, the last 1 is erased from x, and the update method is x=x&(x-1).

[0066] like Figure 4As shown in the figure, there are three levels of bit search modules, and the parallelism of the three levels is different. The first level is a high-parallelism pre-lookup table with a parallelism of 64. The second level is a parallel bit search module with a parallelism of 8. The third level is a high-precision bit search module with a parallelism of 1. When a miss occurs in the high-parallelism pre-lookup table, the parallel bit search module is started; when a miss occurs in the parallel bit search module, the high-precision bit search module is started.

[0067] After analysis, the parallelism mismatch in the three-level bit search module is less than 2 -100 , it can be considered impossible. At the same time, the hardware handles this exception, which will directly interrupt the generation process and restart the generation.

[0068] At the same time, in the implementation of cryptographic algorithms, it is necessary to consider the ability to resist side-channel attacks. A typical attack method against discrete Gaussian noise is to use execution time to attack. Since the bit search speed of the Knuth-Yao algorithm is not constant, the common practice is to extend the sampling time of each time to the worst case, which greatly reduces the performance. The three-level bit search method used in this example only requires 64 parallel sampling to end at the same time. Most of the time, there is no need to start the precision bit search module, which provides a performance improvement of more than 10 clock cycles. At the same time, 64-way high-parallel sampling brings confusion capabilities, making it difficult to conduct side-channel attacks on discrete Gaussian noise sampled by hardware from the time dimension.

[0069] like Figure 5 As shown, the output processing module receives the output sampled by the bit search module. Since the discrete Gaussian distribution is a centrally symmetrical distribution, and the method of the present invention only considers half of it when sampling, it is necessary to add a sign bit to the sampled value to determine its positive or negative when outputting. The output processing module inputs a 1-bit random bit of the random bit register and the sampled value output by the bit search module, which is output to the result buffer after being selected by a multiplexer for positive and negative, completing a parallel sampling of discrete Gaussian noise.

[0070] This embodiment can be implemented in the form of a dedicated integrated circuit or a field programmable gate array.

[0071] The above schematically describes the invention and its implementation methods, which is not restrictive. Without departing from the spirit or basic features of the invention, the invention can be implemented in other specific forms. What is shown in the accompanying drawings is only one of the implementation methods of the invention. The actual structure is not limited to this, and any figure mark in the claims should not limit the claims involved. Therefore, if a person of ordinary skill in the art is inspired by it, without departing from the purpose of the invention, a structural method and an embodiment similar to the technical solution are designed without creativity, which should all fall within the scope of protection of this patent. In addition, the word "including" does not exclude other elements or steps, and the word "one" before the element does not exclude the inclusion of "multiple" elements. The multiple elements stated in the product claim can also be implemented by one element through software or hardware. The words first, second, etc. are used to indicate names, and do not indicate any specific order.

Claims

1. A method for parallel generation of discrete Gaussian noise, characterized in that The steps include: Step 1: Use the random bits generated by a true random number generator as input to the algorithm; Step 2: Define the standard deviation, precision and truncation range of the discrete Gaussian distribution as needed, construct a binary probability matrix, and calculate the Hamming weight of each column of the matrix; Step 3: Execute the Knuth-Yao algorithm in matrix form to scan the entire binary probability matrix until the corresponding point is hit; Step 4: Return the value corresponding to the hit point and use a random bit as the sign bit of the value. The result is the discrete Gaussian noise value sampled by the algorithm.

2. The parallel generation method according to claim 1, characterized in that: The input random number of the algorithm is a random bit generated by a true random number generator, and each bit conforms to an independent uniform distribution.

3. The parallel generation method according to claim 1, characterized in that: Step 3: During the scanning of the binary probability matrix, the columns that will not be hit are skipped by comparing the Hamming weight of the column with the current scan value.

4. The parallel generation method according to claim 1, characterized in that: Step 3: During the scanning of the binary probability matrix, in the columns that will be hit, only the 1 values ​​in the columns are scanned, and the invalid 0 values ​​are ignored.

5. The method for parallel generation of discrete Gaussian noise according to claim 4, characterized in that: In step 3, during the process of scanning the binary probability matrix, the scanning process of the predetermined columns is replaced by a lookup table.

6. A hardware structure for parallel generation of discrete Gaussian noise, characterized in that: It includes a true random number buffer, a random bit register, a bit search module, a result output processing module, a result buffer, and a control state machine; The true random number buffer and the random bit register are electrically connected to each other to provide random bit input for the algorithm; The bit search module is electrically connected to the random bit register and the result output processing module to execute the generation algorithm; The output processing module is electrically connected to the result buffer and is used to output the result; The control state machine is electrically connected to other modules for scheduling tasks and connecting data streams; The true random number buffer can receive and store input from an external true random number generator; The random bit register can read random bits of required length from the true random number generator and provide them to the bit search module; The bit search module includes: a high-parallelism pre-lookup table, a parallel bit search module, and a high-precision bit search module; The high parallelism pre-lookup table is interconnected with the parallel bit search module, and the parallel bit search module is interconnected with the high-precision bit search module; The high-parallelism pre-lookup table has a higher parallelism than the parallel bit search module; The parallelism of the parallel bit search module is higher than that of the high-precision bit search module; The parallel bit search module and the high-precision bit search module have the same structure, including a search value register, a search value update module, a Hamming weight comparator, and a hit column search module; The output processing module uses a random bit to determine the positive or negative of the output and outputs it to the result storage module.

Images