Implementation method of polynomial multiplication on a ring on a GPU

Abstract

The application relates to a method for implementing polynomial multiplication on a ring on a GPU, using a GPU to optimize a KNTT algorithm, and making the thread blocks in a GPU thread model correspond to low-degree polynomials split in the KNTT algorithm one by one, so that each thread block is responsible for the NTT parallel operation of a low-degree polynomial. Meanwhile, multiple thread blocks in the GPU are scheduled to complete the parallel processing between the low-degree polynomials, thereby improving the implementation efficiency of the KNTT algorithm on the GPU. Moreover, the GPU version of the NTT algorithm uses shared memory for read-write efficiency optimization during implementation. When the polynomial degree is large, the in-block threads under the hardware limitation cannot effectively allocate data for processing, resulting in subsequent result errors or efficiency reduction. The GPU version implementation of the KNTT algorithm can solve the problem to the greatest extent.

Description

Technical Field

[0001] This invention belongs to the field of cryptographic algorithm technology, specifically relating to a method for implementing polynomial multiplication on a ring on a GPU. Background Technology

[0002] With the rapid popularization of computer networks and the continuous development of internet technology, computers have become an important medium in our daily lives for data transmission and sharing. However, this also brings a series of information security issues. Digital signatures and encryption technologies provide authentication and confidentiality for both parties in network communication, which can guarantee network security to a certain extent.

[0003] However, with the rapid development of quantum theory, cryptographic algorithms based on traditional number theory may be broken within a certain timeframe, while lattice-based cryptosystems are generally considered resistant to attacks from quantum computers. Since many current applications require efficient signature and encryption algorithms, such as the Internet of Things, cloud computing, and big data, which have high requirements for real-time performance, latency, and response time, implementing more efficient lattice-based cryptographic algorithms and integrating them into existing business systems has become a top research priority.

[0004] As a core component of lattice cryptography algorithms, ring polynomial multiplication is one of the most commonly used fundamental operations in cryptography. It has wide applications in many encryption / decryption and digital signature algorithms, and the efficiency and accuracy of ring polynomial multiplication are crucial to the practicality and security of lattice cryptographic schemes. Existing ring polynomial multiplication algorithms such as NTT and KNTT have high parallelism, but their advantages are difficult to fully realize when running on a CPU. The KNTT algorithm involves a large number of parallel structures, but existing CPU versions simply process them serially, resulting in low computational efficiency. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, this invention provides a method for implementing polynomial multiplication on a ring on a GPU.

[0006] This invention provides a method for implementing polynomial multiplication on a ring on a GPU, including:

[0007] Step 1: On the CPU, split the two polynomials that need to be processed by the KNTT algorithm into a set of polynomials that include multiple low-degree polynomials. After rearranging the coefficients of each set of polynomials, copy them to the GPU.

[0008] Step 2: On the GPU, for the coefficients of multiple low-degree polynomials in each set of polynomials, the NTT transformation is performed in parallel through multiple thread blocks. After the operation is completed, the data stored in the shared memory corresponding to each thread block is copied to the global memory.

[0009] Step 3: Based on the point values ​​of the two sets of polynomials stored in global memory after NTT transformation, perform dot product operation using the Pointwise kernel function and the KNTTMul kernel function to obtain the dot product result;

[0010] Step 4: Perform parallel inverse NTT transformation on the dot product result through multiple thread blocks. After the operation is completed, copy the data stored in the shared memory corresponding to each thread block to the global memory.

[0011] Step 5: Copy the coefficients after the inverse NTT transformation stored in global memory to the CPU. Rearrange the coefficients on the CPU to obtain the final result of the KNTT algorithm.

[0012] Specifically, during NTT transformation and inverse NTT transformation operations, the number of thread blocks is configured to be the number of low-order polynomials. Within a thread block, one thread processes two sets of data, and the number of threads within each thread block is configured to be half the length of the low-order polynomial. During dot product operations, one thread is used within a thread block to process two sets of data.

[0013] In one embodiment of the present invention, step 1 includes:

[0014] Step 1.1: On the CPU side, the two polynomials f(x) and g(x) to be processed by the KNTT algorithm are decomposed into two sets of polynomials, each containing multiple low-degree polynomials. The two decomposed polynomials f(x) and g(x) are expressed as follows:

[0015]

[0016]

[0017] In the formula, f (i) G represents a low-degree polynomial of polynomial f(x). (i) f represents a lower-degree polynomial of polynomial g(x). (i) and g (i) All ∈ Ring γ is Let q be a prime number satisfying 2n|(q-1), and let q be an nth-order primitive root of unity. α This indicates the number of lower-degree polynomials into which a polynomial is partitioned.

[0018] Step 1.2: Rearrange the coefficients of each polynomial by sequentially overwriting the coefficients of the corresponding original polynomials f(x) and g(x), and copy the rearranged coefficients to the GPU.

[0019] In one embodiment of the present invention, step 2 includes:

[0020] Step 2.1: Use the system's built-in functions to obtain the thread model when the kernel function is configured, and calculate the global ID and thread block ID of the currently running thread based on the thread model;

[0021] Step 2.2: Divide the input rearranged coefficients into blocks according to the global id and the thread block id, and store the coefficients of each low-degree polynomial into the shared memory of the corresponding thread block;

[0022] Step 2.3: For each thread block, calculate the data index j of the current thread operation using the id within the thread block, determine the data to be operated on based on the data index j, and combine the data according to the following formula to complete one round of calculation:

[0023]

[0024] in, Let brv(i) represent the result of the j-th coefficient after the i-th transformation, and let brv(i) represent the result after bit flipping of the number i. The polynomial in the ring... The above is selected, where n represents the modular polynomial x. n +1 times;

[0025] Step 2.4: Repeat step 2.3 until the log2n group of operations are completed, then copy the data stored in the shared memory corresponding to each thread block to the global memory.

[0026] In one embodiment of the present invention, step 3 includes:

[0027] Step 3.1: Call the Pointwise kernel function to perform P i,i The calculation,

[0028]

[0029] In the formula, This represents the result of the NTT operation. Dot product;

[0030] Step 3.2: Call the Pointwise kernel function to perform P i,j The calculation,

[0031]

[0032] In the formula, 0≤i <j≤2 α-1,

[0033] Step 3.3: Call the Pointwise kernel function to perform additional dot multiplication operations.

[0034]

[0035] In the formula, k = 2 α -1,

[0036] Step 3.4: Based on the calculated P i,j and Z k The KNTTMul kernel function is called to calculate the dot product result.

[0037] In one embodiment of the present invention, step 4 includes:

[0038] Step 4.1: Use the system's built-in functions to obtain the thread model when the kernel function is configured, and calculate the global ID and thread block ID of the currently running thread based on the thread model;

[0039] Step 4.2: Divide the input dot product operation result into blocks according to the global ID and the thread block ID, and distribute the parallel calculation of multiple sets of inverse NTTs into different thread blocks;

[0040] Step 4.3: For each thread block, calculate the data index j of the current thread operation using the id within the thread block, determine the data to be operated on based on the data index j, and combine the data according to the following formula to complete one round of calculation:

[0041]

[0042] in, brv(i) represents the result of the j-th coefficient after the i-th transformation, and brv(i) represents the result of bit flipping the number i.

[0043] Step 4.4: Repeat step 4.3 until the log2n group of operations are completed, then copy the data stored in the shared memory corresponding to each thread block to the global memory.

[0044] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0045] 1. The method for implementing ring polynomial multiplication on a GPU in this invention realizes parallel operation of the KNTT algorithm through a large number of parallel computing units of the GPU, which can perform more calculations in the same amount of time, speed up the calculation, and improve the calculation performance.

[0046] 2. The method for implementing ring polynomial multiplication on a GPU according to the present invention can improve computing performance by simply increasing the number of computing units on the GPU, and makes the ring polynomial multiplication implemented on the GPU more scalable when processing large amounts of data or performing large-scale calculations.

[0047] 3. The implementation method of ring polynomial multiplication on GPU of the present invention can save a lot of costs compared with dedicated FPGA, can be implemented by programming, and can flexibly adjust the parameters and implementation method of the algorithm, making it more flexible.

[0048] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described in detail below with reference to the accompanying drawings. Attached Figure Description

[0049] Figure 1 This is a schematic diagram of a method for implementing polynomial multiplication on a ring on a GPU according to an embodiment of the present invention;

[0050] Figure 2 This is an embodiment of the present invention providing a computational process for representing point values ​​of a polynomial;

[0051] Figure 3 This is a flowchart of a 2-KNTT algorithm provided in an embodiment of the present invention; Detailed Implementation

[0052] To further illustrate the technical means and effects adopted by the present invention to achieve the intended purpose, the following describes in detail, with reference to the accompanying drawings and specific embodiments, a method for implementing polynomial multiplication on a ring on a GPU according to the present invention.

[0053] The foregoing and other technical contents, features, and effects of the present invention will be clearly presented in the following detailed description of specific embodiments in conjunction with the accompanying drawings. Through the description of the specific embodiments, a more in-depth and concrete understanding can be gained of the technical means and effects adopted by the present invention to achieve its intended purpose. However, the accompanying drawings are for reference and illustration only and are not intended to limit the technical solutions of the present invention.

[0054] First, a brief explanation of the KNTT algorithm is provided. The KNTT algorithm mainly involves three components: the NTT number-theoretical transformation, the INTT inverse number-theoretical transformation, and the dot product operation used when combining intermediate results. GPUs, due to their unique "many-core" characteristics, excel in parallel data processing. The essence of implementing KNTT ring polynomial multiplication using a GPU is to utilize the high parallelism of multiple GPU cores to process the data involved in the algorithm in parallel, thereby improving the algorithm's running efficiency. Based on this, this invention proposes a method for implementing ring polynomial multiplication on a GPU.

[0055] Example 1

[0056] Please see Figure 1 , Figure 1 This is a schematic diagram of a method for implementing polynomial multiplication on a ring on a GPU according to an embodiment of the present invention. As shown in the figure, the method for implementing polynomial multiplication on a ring on a GPU according to this embodiment includes:

[0057] Step 1: On the CPU, split the two polynomials that need to be processed by the KNTT algorithm into a set of polynomials that include multiple low-degree polynomials. After rearranging the coefficients of each set of polynomials, copy them to the GPU.

[0058] In one optional implementation, step 1 includes:

[0059] Step 1.1: On the CPU side, the two polynomials f(x) and g(x) to be processed by the KNTT algorithm are decomposed into two sets of polynomials, each containing multiple low-degree polynomials. The two decomposed polynomials f(x) and g(x) are expressed as follows:

[0060]

[0061]

[0062] In the formula, f (i) G represents a low-degree polynomial of polynomial f(x). (i) f represents a lower-degree polynomial of polynomial g(x). (i) and g (i) All ∈ Ring γ is Let q be a prime number satisfying 2n|(q-1), and let q be an nth-order primitive root of unity. α This indicates the number of lower-degree polynomials into which a polynomial is partitioned.

[0063] Step 1.2: Rearrange the coefficients of each polynomial by sequentially overwriting the coefficients of the corresponding original polynomials f(x) and g(x), and copy the rearranged coefficients to the GPU.

[0064] Step 2: On the GPU, for the coefficients of multiple low-degree polynomials in each set of polynomials, the NTT transformation is performed in parallel through multiple thread blocks. After the operation is completed, the data stored in the shared memory corresponding to each thread block is copied to the global memory.

[0065] In this embodiment, during the NTT transformation operation, the number of thread blocks is configured to be the number of low-order polynomials; that is, one thread block corresponds to one NTT transformation operation of a low-order polynomial. Within a thread block, one thread processes two sets of data, and the number of threads within each thread block is configured to be half the length of the low-order polynomial.

[0066] In an optional implementation, step 2 includes:

[0067] Step 2.1: Use the system's built-in functions to obtain the thread model when the kernel function is configured, and calculate the global ID and thread block ID of the currently running thread based on the thread model;

[0068] Step 2.2: Divide the passed-in rearranged coefficients into blocks according to the global ID and the ID within the thread block, and store the coefficients of each low-degree polynomial into the shared memory of the corresponding thread block;

[0069] Step 2.3: For each thread block, calculate the data index j of the current thread operation using the id within the thread block, determine the data to be operated on based on the data index j, and combine the data according to the following formula to complete one round of calculation:

[0070]

[0071] in, Let brv(i) represent the result of the j-th coefficient after the i-th transformation, and let brv(i) represent the result after bit flipping of the number i. The polynomial in the ring... The above is selected, where n represents the modular polynomial x. n +1 times;

[0072] Step 2.4: Repeat step 2.3 until the log2n group of operations are completed, then copy the data stored in the shared memory corresponding to each thread block to the global memory.

[0073] Step 3: Based on the point values ​​of the two sets of polynomials stored in global memory after NTT transformation, perform dot product operation using the Pointwise kernel function and the KNTTMul kernel function to obtain the dot product result;

[0074] In this embodiment, in order to adapt to the NTT algorithm, during the dot product operation, a single thread is used within a thread block to process the two sets of data, ensuring the correctness of the algorithm operation when the configuration is the same.

[0075] In an optional implementation, step 3 includes:

[0076] Step 3.1: Call the Pointwise kernel function to perform P i,i The calculation,

[0077]

[0078] In the formula, This represents the result of the NTT operation. Dot product;

[0079] Step 3.2: Call the Pointwise kernel function to perform P i,j The calculation,

[0080]

[0081] In the formula, 0≤i <j≤2 α -1, P j,j and P i,i Both are variables used to store intermediate results;

[0082] Step 3.3: Call the Pointwise kernel function to perform additional dot multiplication operations.

[0083]

[0084] In the formula, k = 2 α -1,

[0085] Step 3.4: Based on the calculated P i,j and Z k The KNTTMul kernel function is called to calculate the dot product result.

[0086] Step 4: Perform parallel inverse NTT transformation on the dot product result through multiple thread blocks. After the operation is completed, copy the data stored in the shared memory corresponding to each thread block to the global memory.

[0087] The inverse NTT algorithm is the inverse transformation of the NTT algorithm, which converts the point-value representation of the polynomial into a coefficient representation. Its divide-and-conquer process is similar in principle to the NTT algorithm, but the flow is reversed. In this embodiment, one thread processes two sets of data within a thread block.

[0088] In an optional implementation, step 4 includes:

[0089] Step 4.1: Use the system's built-in functions to obtain the thread model when the kernel function is configured, and calculate the global ID and thread block ID of the currently running thread based on the thread model;

[0090] Step 4.2: Divide the input dot product result into blocks based on the global ID and the ID within the thread block, and distribute the parallel calculation of multiple sets of inverse NTTs into different thread blocks;

[0091] Step 4.3: For each thread block, calculate the data index j of the current thread operation using the id within the thread block, determine the data to be operated on based on the data index j, and combine the data according to the following formula to complete one round of calculation:

[0092]

[0093] in, brv(i) represents the result of the j-th coefficient after the i-th transformation, and brv(i) represents the result of bit flipping the number i.

[0094] Step 4.4: Repeat step 4.3 until the log2n group of operations are completed, then copy the data stored in the shared memory corresponding to each thread block to the global memory.

[0095] Step 5: Copy the coefficients after the inverse NTT transformation stored in global memory to the CPU. After rearranging the coefficients on the CPU, the final result of the KNTT algorithm is obtained.

[0096] In this embodiment, the coefficients after the inverse NTT transformation stored in global memory are copied to the CPU. The reverse process of step 1 is performed on the CPU to rearrange the coefficients and obtain the final result of the KNTT algorithm.

[0097] It's important to note that NTT primarily utilizes GPU shared memory for acceleration, but shared memory can only be shared within the same block. In the NTT algorithm, one thread can process two sets of data, and a maximum of 1024 threads can exist within a block. When the polynomial degree is too large, issues arise such as data not being efficiently allocated to threads and reduced parallelism during allocation. The KNTT algorithm effectively addresses this problem by splitting the polynomial, which effectively reduces the polynomial degree.

[0098] Furthermore, taking α=2 as an example, the steps and algorithm code for completing a GPU version implementation of the 2-KNTT algorithm are explained in detail. The specific configuration and calling process of the 2-KNTT algorithm are as shown in Algorithm 4.1, and the algorithm code is as follows:

[0099]

[0100]

[0101] In the 2-KNTT algorithm, the two polynomials f(x) and g(x) are each decomposed into four lower-order polynomials, each with a degree equal to 1 / 4 of the original degree, denoted as length. The NTT algorithm uses one thread to compute both sets of data; therefore, four thread blocks are used, with the number of threads within each block configured to be half the degree of the lower-order polynomial, i.e., length / 2, to achieve parallel processing of the lower-order polynomial NTT and INTT algorithms. The Pointwise kernel function configuration must be consistent with NTT to avoid errors when the polynomial degree is large. The configuration of the 2KNTTMul kernel function in the 2-KNTT algorithm is relatively flexible, but it is essential to ensure that a total of length threads participate in the computation.

[0102] The core of the KNTT algorithm lies in the switching between point-value representation and coefficient representation of the polynomial, namely, the NTT transform operation and the inverse NTT transform operation.

[0103] Please refer to the above. Figure 2 and Figure 3 , Figure 2 This invention provides a computational process for representing point values ​​of polynomials. Figure 3 Yes, this invention provides an algorithm flowchart for 2-KNTT.

[0104] In the point-value representation of polynomials, i.e., the NTT operation, each round of transformation requires processing n / 2 sets of data. Data outside these sets does not interfere with each other, thus the NTT algorithm inherently possesses parallelism. The n / 2 cores of the GPU can be allocated to different data for parallel processing, and the powers of the 2n roots of unity involved in each round of the NTT algorithm can be stored in a pre-defined table, further reducing the overhead of recalculating these roots during algorithm execution.

[0105] The specific steps of the NTT algorithm implemented on the GPU are shown in Algorithm 4.2, and the code for the algorithm is as follows:

[0106]

[0107]

[0108] Each low-degree polynomial needs to perform NTT operations. Since shared memory is introduced in the GPU version implementation to optimize the read and write overhead of global memory, the NTT calculation of a polynomial needs to be carried out within a block, and the parallel calculation of multiple NTTs can be distributed in different blocks. Lines 1 and 2 in Algorithm 4.2 use the built-in functions of the system to obtain the thread model when configuring the kernel function, thereby calculating the global id and the id within the thread block of the currently running thread, and using them to block the incoming data, and storing the polynomial coefficients that need to be calculated for the point value representation during the operation of this thread block in the shared memory, achieving the effect that one polynomial corresponds to one thread block as described above. Each round of transformation of NTT only requires n / 2 groups of parallel calculations. To avoid wasting threads, the number of threads within the block is configured to n / 2 when configuring the thread model, so that each thread is responsible for reading and writing two data, as shown in Lines 5 and 6. The loop in Line 7 is the main part of the NTT algorithm. First, the data index j operated by the current thread is calculated using the id within the thread block, and then the data is combined using formula (3) to complete one round of calculation. After log2n groups of operations are completed, the data in the shared memory needs to be copied to the global memory for subsequent data interaction with the CPU.

[0109] After the point value representation operations of all low-degree polynomials are completed, the Pointwise kernel function is called to perform the calculation of P i,i and The calculation of, and the 2KNTTMul kernel function is called to perform the final calculation.

[0110] Specifically, the 2-KNTT algorithm performs the dot product operation on the intermediate results, including the following steps: First, calculate the following 4 dot product operations For the remaining subscripts 0 ≤ i < j ≤ 3, calculate the following 6 dot product operations respectively Finally, for each Q (k) , k ∈ [0, 3], an additional dot product operation needs to be performed A total of 3 dot product calculations. According to the calculated P i,j and Z k Call the KNTTMul kernel function to calculate the result of the dot product operation [[ID=2,6]]At this time, the calculation part of the dot product operation is completed. When configuring the above steps for the kernel function, it needs to be consistent with NTT to avoid running errors when the polynomial degree is large.

[0111] The specific steps of the Pointwise dot product operation and the 2KNTTMul algorithm implemented on the GPU are shown in Algorithms 4.3 and 4.4, and the code of the algorithms is as follows:

[0112]

[0113]

[0114]

[0115] The specific steps of implementing the inverse NTT (INTT) algorithm on the GPU are shown in Algorithm 4.5, and the code for the algorithm is as follows:

[0116]

[0117]

[0118] In the inverse NTT algorithm, a single thread is used to compute both sets of data. Therefore, the number of threads within the block is configured to be half the degree of the lower-order polynomial, i.e., length / 2. The INTT algorithm is the inverse transformation of the NTT algorithm, converting the point-value representation of the polynomial to its coefficient representation. The prefab stores the powers of the inverses of the 2n-th root of unity involved. Its divide-and-conquer process is similar to the NTT algorithm in principle, but the flow is reversed. Since the multiple of 2 in the intermediate results is not processed during each round of computation, this value accumulates to n in shared memory. As shown in lines 20 and 21, when finally copying the result to global memory, it needs to be multiplied by n. -1 To eliminate that multiple.

[0119] The implementation of on-ring polynomial multiplication on a GPU in this embodiment achieves parallel computation of the KNTT algorithm through the GPU's numerous parallel computing units. This allows for more computations to be performed in the same amount of time, accelerating computation and improving computational performance. Moreover, computational performance can be improved simply by increasing the number of GPU computing units, making the GPU-implemented on-ring polynomial multiplication more scalable when processing large amounts of data or performing large-scale calculations.

[0120] The implementation method of ring polynomial multiplication on a GPU in this embodiment can save a lot of costs compared with a dedicated FPGA. It can be implemented by programming and the parameters and implementation methods of the algorithm can be flexibly adjusted, making it more flexible.

[0121] It should be noted that, in this document, the terms "comprising," "including," or any other variations are intended to cover non-exclusive inclusion, such that an article or device that comprises a list of elements includes not only those elements but also other elements not expressly listed. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the article or device that includes said element.

[0122] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for implementing polynomial multiplication on a ring on a GPU, characterized in that, include: Step 1: On the CPU, split the two polynomials that need to be processed by the KNTT algorithm into a set of polynomials that include multiple low-degree polynomials. After rearranging the coefficients of each set of polynomials, copy them to the GPU. Step 2: On the GPU, for the coefficients of multiple low-degree polynomials in each set of polynomials, the NTT transformation is performed in parallel through multiple thread blocks. After the operation is completed, the data stored in the shared memory corresponding to each thread block is copied to the global memory. Step 3: Based on the point values ​​of the two sets of polynomials stored in global memory after NTT transformation, perform dot product operation using the Pointwise kernel function and the KNTTMul kernel function to obtain the dot product result; Step 4: Perform parallel inverse NTT transformation on the dot product result through multiple thread blocks. After the operation is completed, copy the data stored in the shared memory corresponding to each thread block to the global memory. Step 5: Copy the coefficients after the inverse NTT transformation stored in global memory to the CPU. Rearrange the coefficients on the CPU to obtain the final result of the KNTT algorithm. Specifically, during NTT transformation and inverse NTT transformation operations, the number of thread blocks is configured to be the number of low-order polynomials. Within a thread block, one thread processes two sets of data, and the number of threads within each thread block is configured to be half the length of the low-order polynomial. During dot product operations, one thread is used within a thread block to process two sets of data.

2. The method for implementing polynomial multiplication on a ring on a GPU according to claim 1, characterized in that, Step 1 includes: Step 1.1: On the CPU side, the two polynomials f(x) and g(x) to be processed by the KNTT algorithm are decomposed into two sets of polynomials, each containing multiple low-degree polynomials. The two decomposed polynomials f(x) and g(x) are expressed as follows: In the formula, f (i) Let g be a low-degree polynomial representing the polynomial f(x). (i) f represents a lower-degree polynomial of polynomial g(x). (i) and g (i) All ∈ Ring γ is Let q be a prime number satisfying 2n|(q-1), and let q be an nth-order primitive root of unity. α This indicates the number of lower-degree polynomials into which a polynomial is partitioned. Step 1.2: Rearrange the coefficients of each polynomial by sequentially overwriting the coefficients of the corresponding original polynomials f(x) and g(x), and copy the rearranged coefficients to the GPU.

3. The method for implementing polynomial multiplication on a ring on a GPU according to claim 2, characterized in that, Step 2 includes: Step 2.1: Use the system's built-in functions to obtain the thread model when the kernel function is configured, and calculate the global ID and thread block ID of the currently running thread based on the thread model; Step 2.2: Divide the input rearranged coefficients into blocks according to the global id and the thread block id, and store the coefficients of each low-degree polynomial into the shared memory of the corresponding thread block; Step 2.3: For each thread block, calculate the data index j of the current thread operation using the id within the thread block, determine the data to be operated on based on the data index j, and combine the data according to the following formula to complete one round of calculation: in, Let brv(i) represent the result of the j-th coefficient after the i-th transformation, and let brv(i) represent the result after bit flipping of the number i. The polynomial in the ring... The above is selected, where n represents the modular polynomial x. n +1 times; Step 2.4: Repeat step 2.3 until the log2n group of operations are completed, then copy the data stored in the shared memory corresponding to each thread block to the global memory.

4. The method for implementing polynomial multiplication on a ring on a GPU according to claim 3, characterized in that, Step 3 includes: Step 3.1: Call the Pointwise kernel function to perform P i,i The calculation, In the formula, This represents the result of the NTT operation. Dot product; Step 3.2: Call the Pointwise kernel function to perform P i,j The calculation, In the formula, 0≤i <j≤2 α -1, Step 3.3: Call the Pointwise kernel function to perform additional dot multiplication operations. In the formula, k = 2 α -1, Step 3.4: Based on the calculated P i,j and Z k The KNTTMul kernel function is called to calculate the dot product result.

5. The method for implementing polynomial multiplication on a ring on a GPU according to claim 4, characterized in that, Step 4 includes: Step 4.1: Use the system's built-in functions to obtain the thread model when the kernel function is configured, and calculate the global ID and thread block ID of the currently running thread based on the thread model; Step 4.2: Divide the input dot product operation result into blocks according to the global ID and the thread block ID, and distribute the parallel calculation of multiple sets of inverse NTTs into different thread blocks; Step 4.3: For each thread block, calculate the data index j of the current thread operation using the id within the thread block, determine the data to be operated on based on the data index j, and combine the data according to the following formula to complete one round of calculation: in, brv(i) represents the result of the j-th coefficient after the i-th transformation, and brv(i) represents the result of bit flipping the number i. Step 4.4: Repeat step 4.3 until the log2n group of operations are completed, then copy the data stored in the shared memory corresponding to each thread block to the global memory.

Images