Data processing method and device, equipment and storage medium

Abstract

The application provides a data processing method and device, equipment and a storage medium, and belongs to the technical field of computers. The application determines the estimated number of bits of the processing result generated by each calculation unit in the step of the number theory transformation through parameters, determines the calculation unit responsible for the reduction processing based on the same, so that the value of the processing result is reduced at a suitable position without introducing a logical branch statement, thereby reducing the number of bits of the processing result, preventing the number of bits of the processing result from exceeding the upper limit of the number of bits that can be represented by the calculation device, and avoiding overflow. Compared with the way of introducing a logical branch statement for reduction processing, the method can remove the logical branch statement, optimize the structure of the number theory transformation, and thereby improve the efficiency of running the number theory transformation.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer, in particular to a data processing method and device, equipment and storage medium. BACKGROUND

[0002] In many encryption and decryption schemes, polynomial multiplication is a major part. Number theoretic transform helps to more efficiently implement polynomial multiplication, thereby improving the efficiency of the encryption and decryption scheme.

[0003] In the classical number theoretic transform algorithm, in order to avoid overflow, some logical branching statements are introduced in the number theoretic transform algorithm. The computing device executes the logical branching statements in the process of running the number theoretic transform algorithm, thereby reducing the data to make the value of the data smaller, thereby avoiding overflow.

[0004] However, the execution of the logical branching statements consumes a long time, resulting in low efficiency of running the number theoretic transform. SUMMARY

[0005] The embodiments of the present application provide a data processing method, device, equipment and storage medium, which can improve the efficiency of running the number theoretic transform. The technical solution is as follows.

[0006] In a first aspect, a data processing method is provided, which is executed by a computing device, the computing device being configured to run a number theoretic transform of data, the steps of the number theoretic transform of the data comprising a plurality of computing units, comprising:

[0007] Based on a parameter of the data, determining an estimated bit number of a processing result generated by each of the computing units, the parameter indicating a bit number of the data;

[0008] Based on the estimated bit number, determining a first computing unit from the plurality of computing units, the first computing unit being a computing unit configured to perform reduction processing on a processing result of a second computing unit, the estimated bit number of the processing result of the second computing unit satisfying a preset bit number.

[0009] In the method provided by the first aspect, the estimated bit number of the processing result generated by each of the computing units in the steps of the number theoretic transform is determined by the parameter, and the computing unit responsible for the reduction processing is determined based on this, so that the value of the processing result can be reduced at a suitable position without introducing the logical branching statements, thereby reducing the bit number of the processing result, preventing the bit number of the processing result from exceeding the upper limit of the bit number that can be represented by the computing device, and avoiding overflow. Compared with the way of introducing the logical branching statements for reduction processing, this method can remove the logical branching statements, optimize the structure of the number theoretic transform, and thereby improve the efficiency of running the number theoretic transform.

[0010] In some embodiments, the reduction processing comprises:

[0011] performing a redundant modular multiplication processing on the processing result of the second computing unit.

[0012] In the above embodiments, since the reduction processing is implemented by using the redundant modular multiplication, on the one hand, the reduction processing does not have to be bound to the Montgomery algorithm, and the representation form of the data does not have to be kept as the Montgomery representation form, in other words, the scheme is applicable regardless of whether the representation form of the data is the Montgomery representation form or the non-Montgomery representation form, thereby improving the flexibility and practicability of the scheme. On the other hand, the speed of the reduction processing is also improved, thereby improving the efficiency, especially in the scene of large number operation, which helps to significantly speed up the operation process of the computing device.

[0013] In some embodiments, the performing a redundant modular multiplication processing on the processing result of the second computing unit comprises:

[0014] performing a redundant modular multiplication processing on the processing result of the second computing unit based on a rotation factor, the rotation factor having the same representation form as the data.

[0015] Through the above embodiments, the representation form of the data can be dynamically adjusted according to the requirements of specific computing tasks.

[0016] In some embodiments, the representation form is the Montgomery representation form or the non-Montgomery representation form.

[0017] In some embodiments, the method further comprises:

[0018] performing an encryption processing or a decryption processing on the processing result of the second computing unit after the reduction processing.

[0019] In some embodiments, the parameters comprise a modulus used by each computing unit in the plurality of computing units when performing the modular operation, a redundancy multiple of the data relative to the modulus, and a polynomial dimension of the data.

[0020] In the above embodiments, considering that the input data can have a certain size of redundancy, the redundancy size of the input data is described by the modulus and the redundancy multiple, so that in the case where the data has redundancy, the computing unit that needs to be subjected to the reduction processing can be accurately located, thereby reducing the redundant reduction processing.

[0021] In some embodiments, the preset bit number is determined based on the bit number of a processor in the computing device, and the preset bit number is 1 or 2 less than the bit number of the processor.

[0022] In the above embodiment, compared with setting the preset bit number according to experience, the preset bit number is determined by the bit number of the processor, a hardware aspect, so that the preset bit number can adapt to the capability of the hardware, different preset bit numbers can be determined for hardware with different capabilities, the calculation unit that needs to be reduced is found based on the preset bit number, the calculation unit that needs to be reduced can be more accurately located, and unnecessary reduction processing is reduced.

[0023] Taking 63 as an example of the preset bit number, if it is estimated that the bit number of the input data of a calculation unit reaches 62 or 63, reduction processing is performed on the calculation unit, and the calculation unit before the calculation unit does not need to perform reduction processing. In this way, while avoiding overflow, the restriction on the value of the data is relaxed as much as possible, the capability of the hardware is fully utilized, the resource utilization rate is improved, and the number of reduction processing is reduced.

[0024] In some embodiments, each of the plurality of calculation units is further configured to perform subtraction processing based on a redundant value, the redundant value being a value greater than or equal to a minuend in the subtraction processing.

[0025] The number theoretic transform function includes a positive number theoretic transform function and an inverse number theoretic transform function, the subtraction processing of the positive number theoretic transform function is x-y*w mod 2q or x mod 2q-y*w mod 2q, the subtraction processing of the inverse number theoretic transform function is x-y, x and y each represent data, q represents a modulus used when the data is subjected to a modulus operation in the number theoretic transform function, w represents a rotation factor, mod represents a modulus operation, * represents multiplication, and - represents subtraction.

[0026] In the above embodiment, since the subtraction processing is performed on the redundant value, the value of the minuend is enlarged by adding the redundant value to the minuend, so that the processing result of the subtraction processing can be prevented from being negative, and the operation accuracy is improved. In addition, compared with setting the redundant value according to experience, the redundant value is determined based on the data-related parameter, so that the determined redundant value can adapt to the value of the parameter, and the accuracy is improved. In addition, the redundant value is not bound to a single parameter, but can be adjusted according to the value of the parameter, so that the scheme can be used for more parameters, and the expansibility and practicability are improved.

[0027] In some embodiments, the number theoretic transform includes a positive number theoretic transform, and the redundant value is equal to 2q, q represents a modulus used when each of the plurality of calculation units is subjected to a modulus operation, and q is a positive integer.

[0028] In the above embodiment, since the positive number theory transformation is characterized by performing the modulo multiplication processing first and then performing the addition processing and the subtraction processing. The value range of the modulo multiplication processing is controllable, for example, when the multiplication operation is implemented by using the redundant modulo multiplication, the value range of the modulo multiplication processing is within [0, 2q), when the multiplication operation is implemented by using the non-redundant modulo multiplication, the value range of the modulo multiplication processing is within [0, q), where q is the modulus. Therefore, by substituting 2q into the subtraction processing, since the minuend in the subtraction processing is the output result of the modulo multiplication processing, the value range of the minuend is within [0, 2q), and therefore the redundant value is necessarily greater than the minuend, so as to ensure that the result generated by performing the subtraction processing is not a non-negative number, and therefore it is helpful to the operation correctness. In addition, the redundant value used is as small as possible, so as to avoid that the processing overhead and the storage overhead are excessively large due to the excessively large redundant value.

[0029] In some embodiments, the number theory transformation includes an inverse number theory transformation, the redundant value is equal to (t+n)*q, the q represents the modulus used when each computing unit in the plurality of computing units performs the modulo operation, the t represents the redundant multiple of the data relative to the modulus, the n represents the polynomial dimension of the data, and the t, the n and the q are positive integers.

[0030] In the above embodiment, since in the case that the data does not have redundancy, the input data of any computing unit does not exceed n*q, considering the possibility that the data has redundancy, t*q is added to n*q as the redundant value, so as to support the data with any redundant multiple as the input, while ensuring that the result generated by performing the subtraction operation is not a non-negative number, which is helpful to the operation correctness.

[0031] In some embodiments, each computing unit in the plurality of computing units is configured to generate k processing results based on k data, where k is a positive integer.

[0032] In the above embodiment, the number theory transformation is split into the computing units that need to be reduced and the computing units that do not need to be reduced in the unit of cross, which is helpful to more finely positioning the positions that need to be reduced.

[0033] In a second aspect, a data processing apparatus is provided, which has the functions of the above-mentioned first aspect or any of the optional modes of the first aspect. The apparatus includes at least one module configured to implement the method provided in the above-mentioned first aspect or any of the optional modes of the first aspect.

[0034] In some embodiments, the modules in the apparatus are implemented by software, and the modules in the apparatus are program modules. In other embodiments, the modules in the apparatus are implemented by hardware or firmware. The specific details of the apparatus provided in the second aspect can be referred to the above-mentioned first aspect or any of the optional modes of the first aspect, which will not be described here again.

[0035] In a third aspect, a computing device is provided, which includes a processor coupled with a memory, and at least one computer program instruction is stored in the memory and loaded and executed by the processor, so that the computing device implements the method provided in the first aspect or any of the optional manners of the first aspect. The specific details of the computing device provided in the third aspect can be referred to the first aspect or any of the optional manners of the first aspect, which will not be described here.

[0036] In a fourth aspect, a computer readable storage medium is provided, which stores at least one instruction, and when the instruction is run on a computer, the computer executes the method provided in the first aspect or any of the optional manners of the first aspect.

[0037] In a fifth aspect, a computer program product is provided, which includes one or more computer program instructions, and when the computer program instructions are loaded and run on a computer, the computer executes the method provided in the first aspect or any of the optional manners of the first aspect.

[0038] In a sixth aspect, a chip is provided, which includes a programmable logic circuit and / or program instructions, and when the chip is run, it is used to implement the method provided in the first aspect or any of the optional manners of the first aspect. BRIEF DESCRIPTION OF DRAWINGS

[0039] Figure 1 is a flowchart of an NTT provided by an embodiment of the present application;

[0040] Figure 2 is a flowchart of an INTT provided by an embodiment of the present application;

[0041] Figure 3 is a schematic diagram of a calculation process of a cross in a butterfly in a Radix-2 NTT provided by an embodiment of the present application;

[0042] Figure 4 is a schematic diagram of a calculation process of a cross in a butterfly in a Radix-2 INTT provided by an embodiment of the present application;

[0043] Figure 5 is a schematic diagram of a principle of calculating a polynomial multiplication provided by an embodiment of the present application;

[0044] Figure 6 is a flowchart of a data processing method provided by an embodiment of the present application;

[0045] Figure 7is a schematic diagram of the change of the number of bit positions of data when running NTT provided by an embodiment of the present application;

[0046] Figure 8 is a schematic diagram of the change of the number of bit positions of data when running INTT provided by an embodiment of the present application;

[0047] Figure 9 is an architecture diagram of NTT provided by an embodiment of the present application;

[0048] Figure 10 is an architecture diagram of an NTT precomputation module provided by an embodiment of the present application;

[0049] Figure 11 is an architecture diagram of an NTT generation module provided by an embodiment of the present application;

[0050] Figure 12 is an architecture diagram of INTT provided by an embodiment of the present application;

[0051] Figure 13 is an architecture diagram of an INTT precomputation module provided by an embodiment of the present application;

[0052] Figure 14 is an architecture diagram of an INTT generation module provided by an embodiment of the present application;

[0053] Figure 15 is a schematic diagram of a calculation manner of redundant growth crossover in Radix-2 NTT provided by an embodiment of the present application;

[0054] Figure 16 is a schematic diagram of a calculation manner of redundant reduction crossover in Radix-2 NTT provided by an embodiment of the present application;

[0055] Figure 17 is a schematic diagram of a calculation manner of redundant growth crossover in Radix-2 INTT provided by an embodiment of the present application;

[0056] Figure 18 is a schematic diagram of a calculation manner of redundant reduction crossover in Radix-2 INTT provided by an embodiment of the present application;

[0057] Figure 19 is a structural schematic diagram of a data processing apparatus 800 provided by an embodiment of the present application;

[0058] Figure 20 is a structural schematic diagram of a computing device 900 provided by an embodiment of the present application. DETAILED DESCRIPTION

[0059] For the purposes of the present application, the technical solutions and advantages will be more apparent, the embodiments of the present application will be described in further detail below with reference to the drawings.

[0060] Some terms and concepts related to the embodiments of the present application are explained below.

[0061] (1) Number theoretic transform (NTT)

[0062] Let positive integer be a power of 2, and given a prime number q satisfying q≡1 mod 2n. Let ω be an n-th primitive root of unity on , then ω n ≡1 mod q, and the power terms of ω mod q have ω 0 ≠ω≠…≠ω n-1 mod q. Define the polynomial ring Polynomial a(x)∈R q , where is the coefficient of a(x).

[0063] Substitute ω 0 , ω…, ω n-1 mod q into the polynomial a(x), we have:

[0064]

[0065] Let be the coefficient of the polynomial , then define NTT as

[0066] (2) Inverse NTT (inverse transform of NTT, INTT)

[0067] INTT is defined as a(x)=INTT(NTT(a(x))).

[0068] (3) Primitive root of unity

[0069] Define as a finite field; given positive integer g and positive integer q (g, q≥2), g and q are coprime; if there is a smallest integer n>1 such that g n ≡1 mod q holds, that is, for any integer k (1≤k<n-1), g k ≠1 mod q, then g is called an n-th primitive root of unity on .

[0070] (4) Twiddle factor

[0071] The twiddle factor originally refers to a complex constant multiplied in the butterfly operation of the Cooley-Tukey fast Fourier transform algorithm. Because the constant is located on the unit circle in the complex plane, it has a rotating effect on the multiplicand in the complex plane, so the constant is named as the twiddle factor. Later, the twiddle factor will also be used to refer to any constant multiplication in the FFT, including any FFT variant algorithm. The name of the twiddle factor comes from W. M. Gentleman and G. Sande, "Fast Fourier transforms-for fun and profit," Proc. AFIPS 29, pp. 563-578, 1966. It has been widely used in tens of thousands of documents since then. For the number theory transform, in combination with the formula of the NTT introduced in (1) above, the twiddle factor is, for example, ω k mod q (k = 0, 1,..., n-1).

[0072] (5) Stage

[0073] A stage is all processing steps in the same time period in the index theory transform.

[0074] Figure 1 is a flowchart of an NTT provided by an embodiment of the present application, Figure 1 The NTT shown in the figure is divided into three stages. In the order of time periods from the first to the last (i.e., from left to right), the three stages are respectively called the first stage, the second stage, and the third stage. The first stage includes all processing steps of the NTT in the first time period, the second stage includes all processing steps of the NTT in the second time period, and so on.

[0075] Figure 2 is a flowchart of an INTT provided by an embodiment of the present application, Figure 2 The INTT shown in the figure is divided into three stages. In the order of time periods from the first to the last, the three stages are respectively called the first stage, the second stage, and the third stage. The first stage includes all processing steps of the INTT in the first time period, the second stage includes all processing steps of the INTT in the second time period, and so on.

[0076] (6) Butterfly

[0077] Input a polynomial with n coefficients (n≥2, usually equal to a power of 2), each stage of the number theoretic transform presents a regular processing between m (2≤m≤n, usually equal to a power of 2) disjoint data, which is called a butterfly, also called a butterfly computation unit or a butterfly operation. The butterfly is usually the main computation unit in the number theoretic transform. A stage in the number theoretic transform includes one or more butterflies. For example, Figure 1 In the illustrated NTT, the first stage includes 4 butterflies, the second stage includes 2 butterflies, and the third stage includes 1 butterfly. Figure 2 In the illustrated INTT, the first stage includes 1 butterfly, the second stage includes 2 butterflies, and the third stage includes 4 butterflies.

[0078] (7) Cross

[0079] A cross refers to a computation unit that inputs k data and outputs k data. A butterfly that processes m data includes multiple crosses. Here, 2≤m≤n, usually m is equal to a power of 2, 2≤k≤m, and usually k is equal to a power of 2. If k=2 and m is a power of k, the NTT / INTT can be divided into log2n stages, respectively, and such NTT / INTT can be called Radix-2 NTT / INTT. Unless otherwise specified, the NTT / INTT in this specification usually refers to Radix-2 NTT / INTT.

[0080] Different butterflies in the same NTT or INTT can include different numbers of crosses. For example, Figure 1 As shown, each butterfly in the first stage of the NTT includes 1 cross, each butterfly in the second stage of the NTT includes 2 crosses, and one butterfly in the third stage of the NTT includes 4 crosses.

[0081] Figure 3 is a calculation process of a cross in a butterfly in a Radix-2 NTT provided by an embodiment of the present application. The calculation formula of the cross in the butterfly in the Radix-2 NTT is: Figure 4 is a calculation process of a cross in a butterfly in a Radix-2 INTT provided by an embodiment of the present application. The calculation formula of the cross in the butterfly in the Radix-2 INTT is

[0082] (8) Logical Branching

[0083] A logical branch generally includes one or more judgment conditions and a processing step corresponding to each judgment condition. When a computing device is to execute a logical branch during the running of the computing device, the computing device determines whether the judgment conditions in the logical branch are satisfied according to the current running state. When the computing device determines that the running state satisfies a judgment condition in the logical branch, the computing device executes the processing step corresponding to the judgment condition.

[0084] (9) Overflow

[0085] Overflow refers to a situation in which the number of bits of a processing result generated by a computing device exceeds the machine word length of the computing device. For example, the machine word length of a computing device is 32, and a processing result generated is 33-bit data. This is an overflow. When an overflow occurs, the computing device transforms the processing result to obtain data with a number of bits within the range of the machine word length, and continues to perform processing based on the transformed data, resulting in a running error. Therefore, it is necessary to avoid overflow.

[0086] (10) Precomputation

[0087] Precomputation is a way to speed up a processing task. Precomputation refers to performing some processing steps in advance before executing a processing task, and storing the processing result generated to a location. The location for storing the processing result of precomputation is generally referred to as a look-up table (LUT). In this way, during the execution of a processing task, the precomputed processing result can be obtained by querying the LUT, and the processing task is executed based on the precomputed processing result, without the need to temporarily perform the precomputed processing steps during the execution of the processing task, thereby speeding up the time to complete the processing task and improving the efficiency of completing the processing task.

[0088] (11) Instant computation

[0089] Instant computation is a concept opposite to precomputation. Instant computation refers to the process of executing a processing task.

[0090] (12) Modulus and modulo operation

[0091] Given a and q, a and q are both integers, and q ≥ 1. Calculate a ÷ q (also written as a / q). If the remainder is equal to r (0 ≤ r < q), r is called the remainder of a divided by q, and q is called the modulus. The processing process of r can be written as r≡a mod q (or written as r = a % q), where mod and % are modulus operators. This processing process is called modulo operation, also known as modulus operation or modulus calculation.

[0092] (13) Modulus multiplication processing

[0093] Given a, b and q (q≥1), a, b and q are all integers. The process of calculating a*b mod q (also written as ab mod q, a*b%q, ab%q) is called modular multiplication, abbreviated as modular multiplication.

[0094] (14) Redundancy

[0095] If an integer a and an integer b are congruent with respect to a modulus q, i.e. b≡a mod q, where 0≤a<q and b≥a, then a is the remainder of b modulo q (i.e. the remainder of b divided by q is equal to a), and b is numerically redundant with respect to the modulus q, abbreviated as b is redundant.

[0096] (15) Redundancy multiple

[0097] Redundancy multiple is used to indicate the size of the numerical redundancy of data with respect to the modulus. In mathematical terms, if an integer b, an integer a and a modulus q satisfy b=(k-1)*q+a, where 0≤a<q and integer k≥1, it is said that the integer b has k times numerical redundancy with respect to the modulus q, abbreviated as b has k times redundancy, i.e. the redundancy multiple is k. When b has 1 times redundancy, it is equivalent to b=a.

[0098] (16) Reduction processing

[0099] Reduction processing is the general term for modulus operation and congruence operation.

[0100] Modulus operation refers to determining the remainder of a data with respect to a modulus. In mathematical terms, given an integer a and an integer q, modulus operation determines the remainder of integer a divided by integer q. By performing modulus processing on input data with a value greater than the modulus, the computer can reduce the input data to fall within the range of the modulus, thereby limiting the size of the data value and avoiding overflow caused by excessively large data values. Modulus operation includes modulus addition, modulus multiplication, modulus subtraction and modulus division. Modulus addition refers to determining the remainder of the sum of two data with respect to a modulus, i.e. a+b mod q. Modulus subtraction refers to determining the remainder of the difference of two data with respect to a modulus, i.e. a-b mod q. Modulus multiplication refers to determining the remainder of the product of two data with respect to a modulus, i.e. a*b mod q. Modulus division refers to determining the remainder of the ratio of two data with respect to a modulus.

[0101] Congruence refers to the fact that two integers have the same remainder when divided by the same modulus. In mathematical terms, integer a and integer b are congruent with respect to modulus q, usually written as b≡a mod q, where 0≤a<q and b≥a. Congruence operation refers to determining a data that has a congruence relationship with a data and has a value less than the data. In mathematical terms, given an integer a and an integer q, the process of determining the value of integer a that is congruent with respect to integer q (this value is less than or equal to integer a) is called congruence operation.

[0102] For number-theoretic transformations, the integer 'a' mentioned above is the input data for the number-theoretic transformation, and the integer 'q' mentioned above is the modulus (i.e., the parameter corresponding to the data).

[0103] (17) Redundant modular multiplication (also known as lazy modular multiplication)

[0104] Redundant modular multiplication is a specific implementation of modular multiplication. Redundant modular multiplication refers to determining the modular multiplication result of x and y with respect to the modulus q using the following formula.

[0105]

[0106] Where r represents the modular multiplication result, x and y represent the input data, both of which are positive integers, β is a positive integer, q represents the modulus, q < β / 2, and y <q。

[0107] Based on the above formula, we can deduce that: r = x * y mod 2q.

[0108] Compared to the ordinary modular multiplication method (i.e., x*y mod q), redundant modular multiplication has two main characteristics. First, because the calculation formula of redundant modular multiplication utilizes some characteristics of computers, the computer can implement redundant modular multiplication faster than ordinary modular multiplication, thus improving the efficiency of modular multiplication. Second, the result of redundant modular multiplication has twice the redundancy compared to the result of ordinary modular multiplication; that is, the value range of the result of ordinary modular multiplication is [0, q), while the value range of redundant modular multiplication is [0, 2q). It can be understood that redundant modular multiplication may sacrifice some accuracy, but in exchange for increased computational speed.

[0109] For number-theoretic transformations, in implementing redundant modular multiplication, x and y in the above formula can both be input data; or, one of x and y can be input data and the other can be a rotation factor. Redundant modular multiplication is typically applied before the immediate computation stage of number-theoretic transformations, when the value of the multiplicand is known and the multiplicand is less than the modulus.

[0110] (18) Montgomery Algorithm

[0111] Montgomery's algorithm is a commonly used, fast algorithm for calculating the modular multiplication of positive integers. The basic idea of ​​Montgomery's algorithm is to transform the calculation of xy mod q into the calculation of xyr. -1 mod q, where r>q, gcd(r,q)=1, rr -1 ≡1 mod q. According to the extended Euclidean algorithm, there exists a positive integer q′ such that the equation rr = 1 mod q. -1 -qq′=1 holds true, therefore rr -1 ≡1 mod q, qq′≡-1 mod r.

[0112] (19) Montgomery representation

[0113] Montgomery algorithm can compute a positive integer x multiplied by r -1 mod q to get x'≡x r -1 mod q. Therefore, when x mod q needs to be computed, by choosing a proper r value, modifying the value of x to x*r, and then calling Montgomery algorithm, the value of x mod q can be output. The value of x*r is called Montgomery representation of x. The Montgomery representation of x can be redundant, for example, it can be equal to x*r+i*q (integer i≥0).

[0114] (20) Word length

[0115] Word refers to a group of binary numbers that are accessed, transmitted, processed as a whole in a computer. The number of binary digits in a word is called word length.

[0116] (21) Machine word length

[0117] Machine word length refers to the number of bits of binary data that can be processed by a processor for one integer operation, and is usually the width of the internal data channel of the processor. For example, the machine word length of a 32-bit processor is 32, and the machine word length of a 64-bit processor is 64.

[0118] (22) Instruction word length

[0119] Instruction word length refers to the total number of bits of binary code in a machine instruction. Instruction word length depends on the length of the operation code, the length of the operand address, and the number of operand addresses. The word length of different instructions is different.

[0120] (23) Data word length

[0121] Data word length refers to the number of bits occupied by stored data.

[0122] (24) Polynomial dimension

[0123] Polynomial dimension is related to the degree (i.e. order) of a polynomial. Some lattice-based cryptography algorithms are built on algorithms involving polynomials with coefficients in finite fields, which define a polynomial ring R q The degree of a polynomial in R q is n-1, and the dimension is set to n (n is a power of 2), and the prime number q≡1 mod 2n. In the embodiments of the present application, the coefficients of the polynomials involved in NTT and INTT calculation are all in the ring R q after modulo q.

[0124] (25) Anti-quantum computing cryptography (PQC)

[0125] Anti-quantum computing cryptography is a special study of encryption algorithms that can resist quantum computers, especially public key encryption (asymmetric encryption) algorithms. Some PQC algorithms, such as lattice-based cryptography, study lattices, i.e. n-dimensional spaces R n discrete subgroups of additive groups in the field of mathematics, which has many applications, and there are several difficult problems called "lattice problems" such as the shortest vector problem and the closest vector problem. Many lattice-based cryptographic systems take advantage of these difficult problems. Lattice-based cryptographic algorithms require a large number of polynomial calculations, of which the number theoretic transform is one of the most important calculations.

[0126] (26) Homomorphic encryption

[0127] Homomorphic encryption is a form of encryption that allows users to perform calculations on encrypted data without first decrypting it. The results of homomorphic encryption calculations are preserved in encrypted form, and when decrypted, the resulting calculations are the same as the output produced by calculating on unencrypted data.

[0128] Homomorphic encryption schemes focus on the security of data processing and provide a function for processing encrypted data. The characteristic of homomorphic encryption schemes is to allow mathematical or logical operations on data in encrypted form. Homomorphism refers to homomorphism in algebra, and encryption and decryption functions can be considered as homomorphisms between plaintext and ciphertext spaces.

[0129] (27) Fully homomorphic encryption (FHE)

[0130] Fully homomorphic encryption is used to perform any operation on encrypted data that can be performed on plaintext without decryption, so fully homomorphic encryption can be run by an untrusted party without revealing its input and internal state. Based on the characteristics of fully homomorphic encryption, it can be used for privacy-preserving outsourced storage and computation, and for operations such as searching and comparing in encrypted data, resulting in correct results without the need to decrypt the data during the entire processing process. Its significance lies in solving the problem of data security when data and its calculations are delegated to a third party, for example, in the cloud computing scenario.

[0131] In a classical number theoretic transform algorithm, the computing device needs to run some logical branching statements, resulting in low efficiency of running the number theoretic transform.

[0132] For example, if the number theoretic transform is compared to a road, and the computing device running the number theoretic transform is compared to driving on the road, then introducing some logical branching statements is equivalent to building a road containing some intersections, resulting in the need to pause and determine which direction to continue and which branch to enter when driving to an intersection on the road, thus slowing down the driving process. Similarly, if logical branching statements are introduced in the number theoretic transform, the computing device running the number theoretic transform will take too long. After research, it is found that when running a classical number theoretic transform on a central processing unit (CPU), the running time of any logical branching statement accounts for about 15% of the total running time of the number theoretic transform. Obviously, the existence of logical branching statements will cause the computing device to take too long to run the number theoretic transform, greatly affecting the efficiency of the computing device running the number theoretic transform.

[0133] The main reason for introducing logical branching statements in traditional number theoretic transforms is that the number theoretic transform usually contains a large number of addition and multiplication processes. As the number theoretic transform runs, the data values will become larger, and the number of bits used by the computing device to represent the data will also increase, increasing the risk of overflow. Therefore, some logical branching statements are introduced, and the judgment condition in the logical branching statements is to determine whether the value of the current processed data exceeds the set upper limit. If so, the data is reduced, and the subsequent processing steps are performed based on the reduced data. In this way, the computing device reduces the data value during the running of the number theoretic transform by performing reduction processing at the appropriate location, thereby reducing the number of bits used by the computing device to represent the data, preventing the number of bits of the data from exceeding the upper limit of the number of bits of the data that can be represented by the computing device, and avoiding overflow.

[0134] Based on the above research and analysis, in some embodiments provided by the present application, a data processing method is provided, which supports a number theoretic transform without logical branching statements. In the method provided in this embodiment, the position where the running of the number theoretic transform may cause overflow is found through data-related parameters, and the computing unit corresponding to the position is taken as the computing unit that needs to be reduced. Then, during the running of the number theoretic transform, the reduction processing is performed by the pre-found computing unit, so that the reduction processing can be performed in time during the running of the number theoretic transform without introducing logical branching statements, and overflow is avoided.

[0135] For example, still taking the number theory transformation as a road, the method provided in this embodiment is equivalent to planning in advance which positions need to perform the reduction process before building the road, so as to build a road without crossroads, so that in the process of running the number theory transformation of the computing device, it is equivalent to not pausing to consider whether the reduction process needs to be performed at the moment when the crossroads are encountered in the process of driving, but performing the reduction process at the pre-planned positions, which obviously speeds up the running of the number theory transformation. As can be seen, the method provided in this embodiment solves the problem of low operation efficiency caused by the introduction of the logical branching statement in the prior art, improves the way of running the number theory transformation of the computing device, improves the performance of the computing device running the number theory transformation, saves the time of the computing device running the number theory transformation, improves the efficiency of the computing device running the number theory transformation, and expands the applicable scenarios of the number theory transformation.

[0136] The application scenarios of the embodiments of the present application are exemplified below.

[0137] The embodiments of the present application can be applied in the scene of data encryption and decryption, such as encrypted transmission of data, privacy calculation, generation of keys, identity authentication, etc. Optionally, the embodiments of the present application are applied in the scene of encryption and decryption based on PQC or FHE. The scheme of data encryption and decryption is usually implemented based on a cryptography algorithm, and the cryptography algorithm, especially the PQC algorithm, usually needs to use the number theory transformation. Through the method provided in the embodiments of the present application, the running of the number theory transformation can be accelerated, thereby improving the overall speed of the encryption and decryption scheme.

[0138] For example, in the scene of data encryption transmission, the sending end obtains plaintext data to be encrypted, encrypts the plaintext data through the PQC algorithm to obtain ciphertext data, and sends the ciphertext data to the receiving end. The receiving end of the data receives the ciphertext data, decrypts the ciphertext data through the PQC algorithm to obtain the plaintext data. Since the data is transmitted in the form of ciphertext from the sending end to the receiving end on the link, the security is improved.

[0139] In the above-mentioned scene, the number theory transformation is, for example, a module in the PQC algorithm. In the process of encrypting the plaintext data through the PQC algorithm, the sending end performs the method provided in this embodiment to perform the number theory transformation on the plaintext data, and performs other steps of the PQC algorithm through the transformed plaintext data to obtain the ciphertext data. In the process of decrypting the ciphertext data through the PQC algorithm, the receiving end performs the method provided in this embodiment to perform the number theory transformation on the ciphertext data, and performs other steps of the PQC algorithm through the transformed ciphertext data to obtain the plaintext data. Through the method provided in this embodiment, the speed of the number theory transformation can be improved, thereby improving the speed of the PQC algorithm.

[0140] In particular, in the scenario of encrypted transmission of data in some latency-sensitive networks, the running speed of many current cryptography algorithms is slow, resulting in large latency of encrypted transmission of data, which is difficult to meet the demand of both parties for latency. Through the method provided in the embodiment, the latency of encryption and decryption of data at the sending end and the receiving end can be reduced, which helps to meet the demand of both parties for latency.

[0141] In one exemplary scenario, according to some international standards, public key signature algorithms can be used between different nodes of a power grid to ensure the security of data transmission. However, the latency of existing public key signature algorithms is large, which cannot meet the latency requirement of the standards. If the lattice-based public key signature algorithm becomes a new generation of cryptography standard algorithm in the future, through the method provided in some embodiments of the present application, the performance of running the number theory transformation can be improved, thereby improving the speed of running the lattice-based public key signature algorithm, so that these public key signature algorithms can meet the communication latency requirement of the relevant international standards, and thus can be adopted by the relevant international standards for protecting power grid data.

[0142] Among them, the product form of the number theory transformation includes many kinds. In one possible implementation, the product form of the number theory transformation is software, such as a program code. In the encryption and decryption process, the CPU (such as in a 32-bit CPU or a 64-bit CPU) reads and executes the program code to run the number theory transformation.

[0143] In another possible implementation, the product form of the number theory transformation is hardware, such as a dedicated processor for performing the number theory transformation. For example, the dedicated processor is a processor dedicated to encryption and decryption, such as an encryption chip (also known as an encryption coprocessor or a security chip). The dedicated processor performs the number theory transformation in the encryption and decryption process. For another example, a dedicated processor assists the CPU in encrypting and decrypting data, and the encryption and decryption operation is completed by the dedicated processor and the CPU together. In one possible implementation, when the CPU needs to encrypt and decrypt data, the CPU transmits data-related parameters to the dedicated processor, and the dedicated processor performs the number theory transformation on the data based on the parameters transmitted by the CPU, and returns the data after the number theory transformation to the CPU, and then the CPU continues to perform the encryption and decryption steps based on the data after the number theory transformation. In this way, the number theory transformation is offloaded from the CPU to the dedicated processor, thereby reducing the computational burden of the CPU and improving the speed of the CPU for encryption and decryption.

[0144] Figure 5is a principle diagram of calculating polynomial multiplication by using number theory transform (NTT) and inverse number theory transform (INTT) provided by an embodiment of the present application. Some encryption and decryption schemes, such as PQC and FHE, can express data such as keys, ciphertexts, plaintexts and the like by polynomials, and thus by using number theory transform, the processing process in the encryption and decryption scheme, such as key generation, encryption, decryption and processing of ciphertexts, can be accelerated.

[0145] As shown in Figure 5 , let a positive integer be a power of 2, and let a prime number q satisfy q≡1 mod 2n. Let ω be an n-th primitive root of unity on , then is a 2n-th primitive root of unity on . Define a polynomial ring and two polynomials a, b∈R q ; let a=(a[0], a[1], …, a[n-1]), be a vector composed of the coefficient items of a and b, and define two other vectors Calculating polynomial multiplication c=ab is equivalent to calculating the negative wrapped convolution of a and b, that is, , which represents Hadamard product. Wherein, a, b and c are polynomial coefficients, such as keys, ciphertexts, plaintexts and the like in PQC and FHE schemes.

[0146] Figure 6 is a flowchart of a data processing method provided by an embodiment of the present application. Figure 6 The method shown is executed by a computing device, which is used to run number theory transform of data, and the steps of the number theory transform of data include a plurality of computing units, Figure 6 The method shown includes the following steps S201 to S202.

[0147] Step S201, the computing device determines the estimated bit number of the processing result generated by each computing unit based on the parameters of the data.

[0148] The above data is the input data of the number theory transform. The number theory transform includes at least one of the positive number theory transform (NTT) or the inverse number theory transform (INTT). The above data is, for example, polynomial coefficients. The above data is, for example, data to be encrypted or data to be decrypted. Alternatively, the above data is plaintext, ciphertext or data required for generating a key.

[0149] The parameter indicates the bit number of the data. For example, the data is internally represented in the computing device in a binary sequence, and the parameter indicates the length of the binary sequence.

[0150] The parameter is used to determine the bit number of the input data of the number theoretic transform, and to estimate the bit number of the result generated by each computing unit in the number theoretic transform, so as to determine the computing unit that needs to be reduced.

[0151] In some embodiments, the parameter includes the modulus used by each computing unit in the modulo operation, the redundancy multiple of the data relative to the modulus, and the polynomial dimension of the data. Optionally, the parameter further includes the bit number of the processor.

[0152] The redundancy multiple indicates the redundancy degree of the data relative to the modulus. For example, if the redundancy multiple is 1, it indicates that the value range of the data is between 0 and the modulus, which means that the data value has no redundancy. If the redundancy multiple is 2, it indicates that the value range of the data is between 0 and twice the modulus. If the redundancy multiple is k, it indicates that the value range of the data is between 0 and k times the modulus, where k is a positive integer.

[0153] The polynomial dimension indicates the number of stages included in the number theoretic transform. For example, if the polynomial dimension is n, it indicates that the number theoretic transform has log2n stages in total.

[0154] The processor is the hardware used to run the number theoretic transform, for example, a CPU. The bit number of the processor is used to indicate the value range of the data that can be represented by the processor. For example, the bit number of the processor is the word length of the processor, such as the machine word length, the instruction word length, the data word length, or the storage word length.

[0155] Alternatively, the parameter includes the bit number of the data. Alternatively, the parameter is the maximum value of the data or the value range of the data.

[0156] There are several ways to obtain the above parameters. In one possible implementation, the user provides the parameters. For example, if the computing device is a terminal, the user inputs the parameters on the terminal, and then the terminal executes subsequent processes based on the user's input. Alternatively, if the computing device is a server, the user inputs the parameters on the terminal, and then the terminal sends the user's input parameters to the server, which then executes subsequent processes based on the parameters received from the terminal. In another possible implementation, the parameters are pre-stored in the computing device. For example, the parameters are pre-programmed into the processor responsible for running number-theoretic transformations.

[0157] The aforementioned computational unit is equivalent to a component or a data processing unit in number theory transformations. For example, a computational unit might perform addition, subtraction, and modular multiplication, with the modular multiplication including modulo operations. Optionally, each of the multiple computational units might process k data points to produce k processing results, where k is a positive integer.

[0158] The granularity of a computing unit can vary. In some embodiments, a computing unit is one or more stages. In other embodiments, a computing unit is one or more butterflies. In still other embodiments, a computing unit is one or more crosses.

[0159] Taking a computational unit as an example, such as Figure 3 As shown, for NTT, one computation unit is used to first perform modular multiplication, then addition and subtraction, to produce the processing result. Figure 4 As shown, for INTT, a computation unit is used to first perform addition and subtraction, then perform modular multiplication, and produce the processing result.

[0160] Optionally, the aforementioned computational unit is software. For example, if a number-theoretical transformation is a piece of code, the computational unit is a statement within that code. Alternatively, the aforementioned computational unit is hardware. For example, if a number-theoretical transformation is a chip, the computational unit is a processing circuit within that chip.

[0161] The estimated bit depth indicates the number of bits in the processing result generated by the computing unit based on the data. (Assuming the input data is 2...) 16 For example, 58 polynomial coefficients, each with 58 bits. Figure 7 As shown, after each computing unit in NTT's first stage processes this data, the resulting processing output has 59 bits, meaning the estimated number of bits for each computing unit in the first stage is 59. Figure 8As shown, the bit number of the processing result generated by each computing unit of the first stage of the INTT is 62 bits or 60 bits after the data is processed, i.e., the estimated bit number corresponding to each computing unit of the first stage is 62 or 60.

[0162] In a possible implementation, the computing device determines the bit number of the data based on the modulus and the redundancy multiple; and determines the estimated bit number of each computing unit based on the bit number of the data and the bit number increment corresponding to each computing unit.

[0163] In a possible implementation of determining the bit number of the data, if the redundancy multiple is 1, the bit number of the modulus is determined as the bit number of the data; and if the redundancy multiple is greater than 1, the bit number of the product of the modulus and the redundancy multiple is determined as the bit number of the data. For example, if the modulus is q and the redundancy multiple is 1, it indicates that the value of the data is less than the modulus, and log2q is determined as the bit number of the data; if the modulus is q and the redundancy multiple is n (n is a positive integer greater than 1), it indicates that the value of the data is less than n times of the modulus, and log2qn is determined as the bit number of the data; and the bit number of the data is determined. The effect of this manner is that, since the value range of the data is between 0 and the product of the modulus and the redundancy multiple, the bit number of the product of the modulus and the redundancy multiple is the maximum value of the bit number of the data in theory, and the bit number of the processing result is estimated based on the maximum value of the bit number of the data in theory, which is equivalent to considering the worst-case to ensure that no overflow occurs.

[0164] The bit number increment refers to the increment of the bit number of the data after the data is processed by the computing unit, i.e., the difference between the bit number of the output result generated by the computing unit and the bit number of the input data obtained by the computing unit. For example, if the computing unit is an addition unit for adding data x and data y, since the result is theoretically at most 1 bit more than the data after the two data are added, 1 is taken as the bit number increment of the addition unit. In a possible implementation, the correspondence between the computing unit and the bit number increment is preset and saved, and the bit number increment is determined by querying the correspondence.

[0165] The effect of step S201 is equivalent to estimating the bit number of the processing result theoretically generated by each computing unit after the actual input data is substituted into the number theoretic transform, given the parameters related to the actual input data, so as to find the computing unit that will cause overflow in theory.

[0166] In step S202, the computing device determines the first computing unit from the plurality of computing units based on the estimated bit number.

[0167] The first computing unit is a computing unit for reduction processing of a processing result of the second computing unit.

[0168] The second computing unit is one of the plurality of computing units. The estimated bit number of the processing result of the second computing unit satisfies the preset bit number. The processing result generated by the second computing unit is used as input data of the first computing unit. The second computing unit corresponds to the last computing unit of the first computing unit, and the output of the second computing unit corresponds to the input of the first computing unit.

[0169] Optionally, the preset bit number is a threshold, and the estimated bit number of the processing result of the second computing unit is greater than or equal to the threshold. Alternatively, the preset bit number is a numerical value, and the estimated bit number of the processing result of the second computing unit is equal to the numerical value.

[0170] In some embodiments, the preset bit number is a bit number of data satisfying an overflow condition. The preset bit number functions as an upper limit. If it is found that the estimated bit number of the processing result generated by a certain computing unit reaches the upper limit, it is determined that the next computing unit of the certain computing unit needs to perform reduction processing when actually performing the NTT, so as to avoid the bit number of the processing result generated by performing the number theoretic transform exceeding the upper limit.

[0171] Optionally, the preset bit number is determined based on the bit number of a processor in the computing device. Compared with setting the preset bit number based on experience, the preset bit number is determined based on the bit number of the processor, which is a hardware factor. The preset bit number can adapt to the capability of the hardware, and different preset bit numbers can be determined for different hardware (such as CPUs with different bit numbers) according to the preset bit number. The computing unit that needs to perform reduction processing can be more accurately located, and unnecessary reduction processing can be reduced.

[0172] In some embodiments, the preset bit number is less than the bit number of the processor by 1. For example, if the processor responsible for performing the number theoretic transform is a 64-bit CPU, the preset bit number is set to 63. If the processor responsible for performing the number theoretic transform is a 32-bit CPU, the preset bit number is set to 31. Taking the preset bit number of 63 as an example, if it is estimated that the input data of a computing unit reaches 63 bits, reduction processing is performed in the computing unit, and the computing units before the computing unit do not need to perform reduction processing. In this way, while avoiding overflow, the limit on the value of the data is relaxed as much as possible, the capability of the hardware is fully utilized, the resource utilization rate is improved, and the number of reduction processing is reduced.

[0173] In some embodiments, the preset bit number is less than the bit number of the processor. For example, if the processor responsible for running the number theoretic transform is a 64-bit CPU, the preset bit number is set to 62; if the processor responsible for running the number theoretic transform is a 32-bit CPU, the preset bit number is set to 30.

[0174] In this way, while avoiding overflow, the next module of the number theoretic transform is left room to continue to grow the processing result by one bit, reducing the risk of overflow in the next module; in addition, the limits on the value of the data are relaxed to some extent, improving resource utilization.

[0175] In some embodiments, during the running of the number theoretic transform based on the data, the computing device performs reduction processing on the processing result of the second computing unit by the first computing unit.

[0176] The reduction processing by the first computing unit serves to reduce the value of the processing result, and thus the bit number of the processing result. Therefore, by performing reduction processing by the first computing unit, the bit number of the processing result of the second computing unit is reduced, avoiding overflow of the processing result of the first computing unit exceeding the preset bit number. On the other hand, other computing units other than the first computing unit do not need to perform reduction processing, so the value of the data is allowed to remain redundant when the data is processed by other computing units, until the data is input to the first computing unit, i.e., the bit number of the data reaches the preset bit number, and then the data is subjected to reduction processing. Therefore, the redundant reduction processing is reduced, and the number theoretic transform is as much as possible to avoid containing redundant computation, improving processing efficiency.

[0177] Please refer to Figure 7 , Figure 7In the illustrated scenario, the NTT running process is divided into 16 stages, and the bit number of the data satisfying the overflow condition in the NTT running process is 63. According to the parameters corresponding to the data, the computing device estimates that the bit number of the processing result of each cross in the 15th stage is 63, that is, the bit number of the input data of each cross in the 16th stage reaches 63. In this scenario, the computing device takes each cross in the 16th stage as the first computing unit. In the running of the NTT, the computing device performs reduction processing on each cross in the 16th stage, so that the bit number of the processing result is reduced from 63 to 60, and finally the bit number of the output result of the entire NTT running process is controlled within 60, thereby avoiding overflow.

[0178] Please refer to Figure 8 , Figure 8 In the illustrated scenario, the INTT running process is divided into 4 stages, and the bit number of the data satisfying the overflow condition in the NTT running process is 62. According to the parameters corresponding to the data, the computing device estimates that the bit number of the input data of 5 crosses in the INTT is 62, and the 5 crosses are the 1st cross of the 1st butterfly in the 2nd stage, the 1st cross of the 2nd butterfly in the 2nd stage, the 1st cross of the 3rd butterfly in the 2nd stage, the 1st cross of the 4th butterfly in the 2nd stage, and the 2nd cross of the 1st butterfly in the 4th stage. Therefore, the computing device takes each of the 5 crosses as the first computing unit. In the running of the NTT, the computing device performs reduction processing through the 5 crosses, so that the bit number of the processing result is reduced from 62 to 60, and finally the bit number of the output result of the entire INTT running process is controlled within 62, thereby avoiding overflow.

[0179] After the reduction processing, the computing device can perform other processing steps on the processing result after the reduction processing through the first computing unit, and then continue processing through the next computing unit of the first computing unit until all computing units are processed, thereby converting the data into data after the number theory transformation.

[0180] The application of the data after the number theory transformation in the encryption and decryption scheme includes various scenarios. For example, in the encryption scenario, the above-mentioned data is plaintext, and the computing device performs positive number theory transformation on the plaintext, and then performs encryption based on the plaintext after the positive number theory transformation to obtain part of the ciphertext. In the decryption scenario, the above-mentioned data is ciphertext, and the computing device performs inverse number theory transformation on the ciphertext, and then performs decryption based on the ciphertext after the inverse number theory transformation to obtain part of the plaintext. For another example, in the key generation scenario, the above-mentioned data is data required for generating a key (public key or private key), and the computing device performs number theory transformation on the data, and then generates the key based on the data after the number theory transformation. For example, the computing device performs encryption processing or decryption processing on the processing result after the reduction processing of the second computing unit.

[0181] In Figure 6In the illustrated embodiment, since the calculation unit responsible for the reduction processing is determined by the parameter, the data is reduced by the determined calculation unit during the process of the number theoretic transform, so that the value of the data is reduced at the appropriate position without introducing a logical branching statement, thereby reducing the number of bits used by the computing device to represent the data, preventing the number of bits of the data from exceeding the upper limit of the number of bits that can be represented by the computing device, and avoiding overflow. Compared with the method of introducing a logical branching statement for reduction processing, this method can remove the logical branching statement, optimize the structure of the number theoretic transform, and thus improve the efficiency of running the number theoretic transform.

[0182] In addition, by estimating the number of bits of the processing result generated by the calculation unit, the calculation unit that may overflow (the first calculation unit) can be accurately located according to the estimated number of bits, so that the calculation unit that may overflow performs reduction processing, while other calculation units do not need to perform reduction processing, thereby reducing the number of calls for reduction processing in the number theoretic transform, minimizing the amount of redundant calculation in the number theoretic transform, and improving efficiency.

[0183] In Figure 6 In the illustrated embodiment, there are various implementation methods for how to perform reduction processing, and some implementation methods of reduction processing are described below.

[0184] In some embodiments, the first calculation unit performs reduction processing on the processing result of the second calculation unit by using a modulo operation. The modulo operation has two functions: one is to ensure correct calculation, and the other is to reduce the value of the data. In other embodiments, the computing device uses addition and subtraction instead of the modulo operation to reduce the value of the data by using subtraction.

[0185] In some embodiments, the first calculation unit performs reduction processing on the processing result of the second calculation unit by using Montgomery modular multiplication. For example, the processing result of the second calculation unit is first converted into Montgomery form, and then Montgomery modular multiplication is performed on the processing result in Montgomery form, thereby achieving reduction processing. For example, the data includes x and y, a parameter r is introduced, x is converted into x*r (i.e., x in Montgomery form) according to the parameter r, y is converted into y*r (i.e., y in Montgomery form), and then Montgomery modular multiplication is performed according to x*r and y*r.

[0186] By using Montgomery modular multiplication to perform reduction processing, the value of the processing result can be reduced to achieve the purpose of reduction, and the speed of reduction processing can be improved.

[0187] In the above embodiments, since the reduction processing is implemented by using Montgomery modular multiplication, the data needs to be kept in Montgomery representation, and the reduction processing needs to bind the Montgomery algorithm, which results in strong limitations and cannot meet the requirement of adjusting the data representation in the running of the number theoretic transform.

[0188] Based on this, in some other embodiments, the first computing unit performs a redundant modular multiplication processing on the processing result of the second computing unit, thereby implementing the reduction processing. The redundant modular multiplication processing is a modular multiplication processing with a value range of [0, 2q), where q represents a modulus, and q is a positive integer.

[0189] Since the reduction processing is implemented by using the redundant modular multiplication, on the one hand, the reduction processing does not need to bind the Montgomery algorithm, and the data representation does not need to be kept in the Montgomery representation. In other words, the scheme is applicable regardless of whether the data representation is in the Montgomery representation or in the non-Montgomery representation, thereby improving the flexibility and practicability of the scheme. On the other hand, the scheme can also improve the speed of the reduction processing, thereby improving the efficiency, especially in the scene of large number operation, which helps to significantly speed up the operation process of the computing device.

[0190] In an exemplary scenario, without using the redundant modular multiplication, the reduction algorithm is usually limited to the barrett reduction and the Montgomery modular multiplication (which requires that the polynomial coefficients must be in the Montgomery representation). By using the redundant modular multiplication, the modular multiplication of the coefficients in the non-Montgomery representation can be calculated, and the redundant modular multiplication can share the same calculation module with the Montgomery modular multiplication.

[0191] To support the dynamic adjustment of the data representation, in some embodiments of the present application, the computing device generates a rotation factor in the same representation as the data according to the representation of the data, and the first computing unit performs a redundant modular multiplication processing on the processing result of the second computing unit based on the rotation factor. Optionally, the representation is in the Montgomery representation or in the non-Montgomery representation.

[0192] Exemplarily, in the pre-computation phase, the computing device determines the representation of the data, generates a rotation factor in the Montgomery representation if the data representation is in the Montgomery representation, generates a rotation factor in the non-Montgomery representation if the data representation is in the non-Montgomery representation, and saves the generated rotation factor to a pre-computation table. In the real-time computation phase, the computing device obtains the rotation factor from the pre-computation table and performs a redundant modular multiplication processing based on the obtained rotation factor and the data.

[0193] Optionally, if the representation of the input data is adjusted, the computing device adjusts the rotation factor stored in the pre-computation table to keep the representation of the rotation factor consistent with the representation of the data. For example, if the representation of the data is adjusted from Montgomery representation to non-Montgomery representation, the computing device adjusts the rotation factor stored in the pre-computation table from Montgomery representation to non-Montgomery representation; if the representation of the data is adjusted from non-Montgomery representation to Montgomery representation, the computing device adjusts the rotation factor stored in the pre-computation table from non-Montgomery representation to Montgomery representation.

[0194] With the above embodiments, if the requirement of the task is that the data has Montgomery representation, the rotation factor with Montgomery representation is used for operation, and if the requirement of the task is that the data has non-Montgomery representation, the rotation factor with non-Montgomery representation is used for operation, so that the representation of the value in the NTT / INTT operation can be dynamically adjusted according to the requirement of the specific computing task, and in addition, the structure of the butterfly operation in the NTT / INTT operation is not affected, no additional algorithm is introduced, the Montgomery algorithm is not bound, and the computing amount is not increased.

[0195] In some embodiments, considering that the number theoretic transform includes subtraction processing, if the minuend is greater than the subtrahend, the result of the subtraction processing is a negative number. For the computing device, the occurrence of a negative number in the processing result can cause a running error, resulting in incorrect computation.

[0196] Based on this, in some embodiments of the present application, the computing device determines a redundant value based on the parameter; in the process of running the number theoretic transform based on the data, each computing unit in the plurality of computing units performs subtraction processing based on the redundant value. The redundant value is a value greater than or equal to the minuend in the subtraction processing. Optionally, the redundant value is greater than or equal to the maximum value of the data.

[0197] The subtraction processing in the positive number theoretic transform includes the subtraction processing in the redundant increment operation and the subtraction processing in the redundant reduction operation. In the subtraction processing of the redundant increment operation, the subtrahend is the data, and the minuend is the result of the redundant modulus multiplication of the data. In the subtraction processing of the redundant reduction operation, the subtrahend is the result of the redundant modulus multiplication of the data, and the minuend is the result of the redundant modulus multiplication of the data and the rotation factor. In a mathematical way, the subtraction processing of the redundant increment operation is, for example, x minus y*w mod 2q, where x and y are both data, w is a rotation factor, and q is a modulus. The subtraction processing of the redundant reduction operation is, for example, x mod 2q minus y*w mod 2q, where x and y are both data, w is a rotation factor, and q is a modulus. The subtraction processing in the inverse number theoretic transform is the subtraction between two data, for example, x minus y, where x and y are both data.

[0198] The effect of the subtraction processing based on the redundancy value is that, since the data itself and the redundancy value are both substituted during the subtraction processing, the redundancy value is added to the minuend, and the value of the minuend is amplified, so that the processing result of the subtraction processing is prevented from being a negative number, thereby improving the operation accuracy. In addition, compared with setting the redundancy value according to experience, the redundancy value is determined based on the parameter related to the data, so that the determined redundancy value can adapt to the value of the parameter, thereby improving the accuracy. In addition, the redundancy value does not need to be bound to a single parameter, but can be adjusted according to the value of the parameter, so that more parameters can be used in the scheme, thereby improving the expansibility and practicability.

[0199] For how to design the value of the redundancy value, in some embodiments of the present application, the characteristics of the positive number theory transformation and the inverse number theory transformation are analyzed, and an optimal value of the redundancy value is provided.

[0200] Optionally, for the positive number theory transformation, the redundancy value is equal to 2q, q represents the modulus, and q is a positive integer.

[0201] The effect of selecting 2q as the redundancy value is that, since the positive number theory transformation is characterized by performing the modulus multiplication processing first, and then performing the addition processing and the subtraction processing, and the value range of the modulus multiplication processing is controllable, for example, when the multiplication operation is implemented by using the redundancy modulus multiplication, the value range of the modulus multiplication processing is within [0, 2q), and when the multiplication operation is implemented by using the modulus multiplication without redundancy, the value range of the modulus multiplication processing is within [0, q), wherein q is the modulus. Therefore, by substituting 2q into the subtraction processing, since the minuend in the subtraction processing is the output result of the modulus multiplication processing, the value range of the minuend is within [0, 2q), and therefore the redundancy value is necessarily greater than the minuend, so that the result generated by performing the subtraction processing is prevented from being a non-negative number, thereby improving the operation accuracy. In addition, the redundancy value used is as small as possible, so that the processing overhead and the storage overhead caused by the redundancy value being too large are avoided.

[0202] Optionally, for the inverse number theory transformation, the redundancy value is equal to (t+n)*q, t represents the redundancy multiple, n represents the polynomial dimension, and q represents the modulus, and t, n and q are positive integers.

[0203] The effect of selecting (t+n)*q as the redundancy value is that, in the case where the data does not have redundancy, the input data of any calculation unit does not exceed n*q, and considering the possibility that the data has redundancy, t*q is added to n*q as the redundancy value, so that the data with any redundancy multiple can be supported as the input, and at the same time, the result generated by performing the subtraction operation is prevented from being a non-negative number, thereby improving the operation accuracy.

[0204] Figure 6The illustrated embodiment describes the case of reduction processing on data. In other embodiments, for a forward number theoretic transform, if the computing device determines that the parameters satisfy the condition, it determines that there is no computation unit that needs to be subjected to reduction processing. During the process of running the number theoretic transform based on the data, reduction processing on the data is omitted. For an inverse number theoretic transform, if the computing device determines that the parameters satisfy the condition, it determines that the computation unit of the last stage is the computation unit that needs to be subjected to reduction processing. During the process of running the number theoretic transform based on the data, reduction processing on the data is performed by the computation unit of the last stage.

[0205] In the case of a redundancy multiple of 1 or no redundancy of input data, the parameters satisfy the condition, for example, the sum of the bit length of the modulus and the number of stages is less than the preset bit length, for example, the condition is satisfied log2n + log2q < 60. Wherein, n represents the polynomial dimension, and q represents the modulus. In the case of a redundancy multiple greater than 1, the parameters satisfy the condition, for example, the bit length of the product of the modulus and the redundancy multiple and the number of stages is less than the preset bit length.

[0206] The effect of the above-mentioned method is that the bit length of the product of the modulus and the redundancy multiple is equivalent to the maximum bit length of the data in theory, and in the case of no reduction processing, the bit length of the data increases by one bit after each stage of processing. Therefore, the number of stages is equivalent to the maximum bit length of the data after all stages of processing in the number theoretic transform. Therefore, the parameters satisfy the above-mentioned condition, which means that overflow will not occur in the worst case, and there is no need to reduce the data. Therefore, by the above-mentioned method, the reduction processing and the logical branching statement can be completely removed while ensuring that there is no overflow, thereby improving the performance and efficiency of running the number theoretic transform.

[0207] The implementation of the illustrated method is illustrated below in some code and formulas. Figure 6 The implementation of the illustrated method is illustrated below in some code and formulas.

[0208] In some embodiments, when constructing the NTT or INTT algorithm, each is divided into two parts: pre-computation and on-the-fly computation.

[0209] Figure 9 is an architecture diagram of an NTT provided by the present embodiment. As shown in Figure 9 The NTT includes a rotation factor generation module, an NTT pre-computation module, an NTT generation module, and an NTT running module. The flowchart of the NTT generation module is as followsFigure 11 as shown.

[0210] Figure 12 is an architecture diagram of the INTT provided by the embodiment. The INTT internally includes a rotation factor generation module, an INTT precomputation module, an INTT generation module, and an INTT running module. A flowchart of the INTT precomputation module is as shown in Figure 13 Figure 14

[0211] The precomputation process and the instant computation process of the NTT and the INTT are respectively illustrated below.

[0212] NTT

[0213] The crossover in the butterfly in the NTT is divided into two kinds, one is a redundant growth crossover, and the other is a redundant reduction crossover.

[0214] In an exemplary embodiment, the coefficients of each term in the input polynomial a of the NTT are sorted in ascending order according to the degree, with the term of the lowest degree at the front and the term of the highest degree at the back, to obtain a sequence. x and y are respectively the coefficients of the terms of degrees j and j+t. w is a rotation factor used in the calculation of the crossover, and w is obtained from a precomputation table.

[0215] In this embodiment, the code of the redundant growth crossover in the Radix-2 NTT is as shown below.

[0216] x = a[j], y = a[j+t];

[0217] tx = x;

[0218] ty = FastModMultiLazy(y, w, q); / / Note: ty = y * w mod 2q;

[0219] a[j] = tx + ty;

[0220] a[j+t] = 2*q-ty+tx;

[0221] The meaning of the code of the NTT redundant growth crossover shown above is that the coefficient x (i.e. a[j]) is assigned to the intermediate variable tx, the result of the redundant modulus multiplication of the coefficient y and the rotation factor w is assigned to the intermediate variable ty, then the coefficient x (i.e. a[j]) is modified to tx+ty, and the coefficient y (i.e. a[j+t]) is modified to 2*q-ty+tx. After such calculation, the value of the coefficient x will be larger, which is the meaning of growth.

[0222] In this embodiment, the code of the redundant reduction crossover in the Radix-2 NTT is as shown below. ​​

[0223] x = a[j], y = a[j+t];

[0224] tx = FastModMultiLazy(x, 1, q); / / Note: tx = x mod 2q;

[0225] ty = FastModMultiLazy(y, w, q); / / Note: ty = y*w mod 2q;

[0226] a[j] = tx+ty;

[0227] a[j+t] = 2*q-ty+tx;

[0228] The meaning of the NTT redundancy reduction crossover shown above is that the result of the redundancy module multiplication of the coefficient x and the integer 1 is assigned to the intermediate variable tx, the result of the redundancy module multiplication of the coefficient y and w is assigned to the intermediate variable ty, then the coefficient x (i.e. a[j]) is modified to tx+ty, and the coefficient y (i.e. a[j+t]) is modified to 2*q-ty+tx. After such calculation, the value of the coefficient x may be reduced, which is the meaning of reduction.

[0229] Figure 15 A schematic diagram showing the calculation manner of the redundancy growth crossover in Radix-2 NTT is shown. The calculation formula of the Radix-2 NTT redundancy growth crossover is the following formula A.

[0230]

[0231] Figure 16 A schematic diagram showing the calculation manner of the redundancy reduction crossover in Radix-2 NTT is shown. The calculation formula of the Radix-2 NTT redundancy reduction crossover is the following formula B.

[0232]

[0233] Pre-computation:

[0234] As shown in Figure 10 , the NTT pre-computation module receives input parameters, then calculates the position of overflow occurring in NTT according to the parameters, generates a sequence S, the length of the sequence S is equal to the number of NTT stages in which overflow occurs, and the sequence value is the identification of the NTT stage in which overflow occurs. The specific process is as follows.

[0235] Let n (n≥4) be a power of 2, n = 2 m , the number of NTT stages is log2n, the modulus is log2q bits, the maximum redundancy value allowed by NTT (derived according to the machine word length, instruction word length or data word length) is 2 max , and the minimum redundancy value min = 2q.

[0236] The embodiment of the present application supports any size of redundancy as the input of NTT, so the value of the input coefficient input satisfies 2 h -1 <input<2 h (h is a positive integer, h If the following condition is satisfied at the s1-1th stage (s1 is a positive integer, 1 ), it means that the s1th stage needs to be reduced.

[0237] The derivation process of the above implementation is as follows: according to the formula A, after the first stage is calculated, the theoretical maximum value of the X term and the Y term is less than or equal to 2 h +2q, after the second stage is calculated, the theoretical maximum value of the X term and the Y term is less than or equal to (2 h +2q)+2q=2 h +2*2q; then after the s th stage is calculated, if there is still no overflow of any coefficient at this time, the theoretical maximum value of the X term and the Y term is less than or equal to 2 h +s*2q, and 2 h +s*2q<2 max In other words, if the s th stage is successfully executed, the coefficient will not overflow, which means that the value of s is brought into the formula C.

[0238]

[0239] Therefore, when the s1th stage is executed, if the s1 is brought into the formula C and it is not true, that is, q≥(2 max-1 -2 h-1 ) / s1 is obtained after s1 is brought in, which means that in the worst-case scenario, the s1th stage will theoretically overflow after being calculated, and the s1th stage needs to be reduced, that is, the redundant reduction crossover is used.

[0240] If the NTT is not executed, continue to execute the NTT. Let log24q=g-1, if at the s2th stage (s2 is a positive integer, 1 , it means that the s2th stage needs to be reduced. In this way, until all stages of the NTT are run, a sequence S=[s1, s2, …] of a stage number that may theoretically overflow the coefficient is obtained.

[0241] The derivation process of the above determination of the stage number sequence is as follows.

[0242] Since the redundant reduction crossover is used in the s1 stage, according to formula B, after the calculation in the s1 stage, the theoretical maximum values of both the X term and the Y term are less than or equal to 4q. Let log24q = g - 1, then 2 g-1 <4q < 2 g , that is, after the calculation in the s1 stage, all coefficients are less than 2 g . Assuming that there is no coefficient overflow in the subsequent stages, after the calculation in the s1 + 1 stage, the theoretical maximum values of both X and Y are less than or equal to 2 g + 2q. After the calculation in the s1 + 2 stage, the theoretical maximum values of both X and Y are less than or equal to (2 g + 2q) + 2q = 2 g + 2 * 2q; then after the calculation in the s1 + s stage, if there is still no numerical out-of-bounds of any coefficient at this time, the theoretical maximum values of both X and Y will not be greater than 2 g + s * 2q, that is, 2 g + s * 2q < 2 max . In other words, if the coefficients still do not overflow after successfully executing the s1 + s stage, it means that substituting the value of s satisfies the following formula.

[0243]

[0244] Therefore, when executing to the s2 stage (s2 is a positive integer, 1 ≤ s1 < s2 ≤ m), if substituting s = s2 - s1 into formula D does not hold, that is, substituting s1 and s2 gives q ≥ (2 max-1 - 2 g-1 ) / (s2 - s1), it means that there will be an overflow theoretically after the calculation in the s2 stage, and the s2 stage needs reduction processing, that is, switch to the redundant reduction crossover. After the s2 stage, if the NTT has not been completed yet, repeat this part of the calculation until the NTT is completed.

[0245] Instant calculation (constructing the NTT algorithm)

[0246] As Figure 11 shown, if the sequence S is empty, construct an NTT whose butterflies in all stages only need to call the redundant growth crossover; otherwise, construct an NTT according to the sequence S such that it calls the redundant reduction crossover in the s1, s2, etc. stages and only calls the redundant growth crossover in the remaining stages.

[0247] INTT

[0248] The crossovers in the butterflies of the INTT are divided into two types, one is the redundant growth crossover and the other is the redundant reduction crossover.

[0249] In one exemplary embodiment, each term of the input polynomial a of the INTT is sorted in ascending order of its degree, with the lowest degree term first and the highest degree term last, to obtain a sequence. x and y are the coefficients of the terms of degrees j and j+t, respectively. w is a rotation factor used in this cross-over calculation, and the rotation factor is obtained from a pre-computed table. A minimum redundancy value min is defined, where min is a positive integer; the minimum redundancy value is used to ensure that the minimum redundancy value is greater than Y, regardless of the value of Y.

[0250] In this embodiment, the code for the redundancy-increasing cross-over in Radix-2 INTT is shown below.

[0251] x = a[j], y = a[j+t];

[0252] tx = x + y;

[0253] ty = min - y + x;

[0254] a[j] = tx;

[0255] a[j+t] = FastModMultiLazy(ty, w, q); / / Note: a[j+t] = ty*w mod 2q;

[0256] The meaning of the code for the redundancy-increasing cross-over in INTT shown above is that the sum of x and y is assigned to tx, and the result of min - y + x is assigned to ty, and then the coefficient x (i.e., a[j]) is modified to tx, and the coefficient y (i.e., a[j+t]) is modified to the result of the redundancy modulo multiplication of ty and w. After this calculation, the value of the coefficient x is increased, which is the meaning of increasing.

[0257] In this embodiment, the code for the redundancy-reducing cross-over in Radix-2 INTT is shown below.

[0258] x = a[j], y = a[j+t];

[0259] tx = FastModMultiLazy(x + y, 1, q); / / Note: tx = x + y mod 2q;

[0260] ty = min - y + x;

[0261] a[j] = tx;

[0262] a[j+t] = FastModMultiLazy(ty, w, q); / / Note: a[j+t] = ty*w mod 2q;

[0263] The code of the INTT redundancy reduction cross shown above means that the result of the redundancy modulo multiplication of x+y and 1 is assigned to tx, and the result of min-y+x is assigned to ty, then the coefficient x (i.e. a[j]) is modified to the result of the redundancy modulo multiplication of tx and ty and w. After such calculation, the value of the coefficient x can be smaller, which is the meaning of reduction.

[0264] Figure 17 A schematic diagram showing the calculation method of the redundancy growth cross in Radix-2 INTT is shown. The calculation formula of the Radix-2 INTT redundancy growth cross is the following equation E.

[0265]

[0266] Figure 18 A schematic diagram showing the calculation method of the redundancy reduction cross in Radix-2 INTT is shown. The calculation formula of the Radix-2 INTT redundancy reduction cross is the following equation F.

[0267]

[0268] An algorithm is needed for INTT to accurately find which stage, which butterfly, and which cross need to be reduced. The algorithm for determining the need for reduction in INTT is as follows.

[0269]

[0270]

[0271] The pre-computation algorithm shown above is used to calculate the specific position of the cross that needs to be reduced in INTT, and the logic of the algorithm is as follows.

[0272] According to formula E, which follows the principle of multiplication before addition and subtraction, the change in term X is an increase of 1 bit in the number of bits. This is because term X involves addition, where the sum of x and y is theoretically at most 1 bit larger than the maximum value of x and y. The change in term Y is that the number of bits is 1 bit larger than the number of bits in the modulus q. Since the output of redundant modular multiplication is always in the range [0, 2q), the number of bits in term Y is always less than or equal to 2q. Considering the worst-case scenario, we directly set the number of bits in the calculated result of term Y to be equal to 2q. Then, in the next stage, terms X and Y may swap positions. Therefore, we obtain the number of bits in terms X and Y and substitute them into formula E to calculate how the number of bits in terms X and Y will change after formula E is completed. If it is found that the number of bits in term X is already equal to the number of bits in the maximum redundancy value before substituting into formula E, it means that term X needs to be reduced to ensure that there is no overflow after the cross-calculation. In this case, formula F needs to be used to call the redundancy reduction cross-calculation. The number of bits in term Y does not need to be considered because term Y involves modular multiplication with redundancy. As long as term Y does not exceed the machine word length, term Y will not be equal to or exceed the number of bits for the maximum redundancy value. Since the maximum redundancy value is less than or equal to the machine word length, modular multiplication with redundancy can complete the calculation and output a value with the same number of bits as 2q in the worst-case scenario. Therefore, term Y does not have an overflow problem. In summary, in the above algorithm, given the parameters, INTT is simulated once according to the aforementioned logic. The number of bits for each cross is calculated to find all crosses that theoretically would cause term X to be equal to the number of bits for the maximum redundancy value at input. These positions are recorded and stored in a pre-calculation table for the INTT generation module to customize the generation of INTT.

[0273] Pre-calculation

[0274] like Figure 13 As shown, the INTT pre-computation module receives the input parameters, then calculates the position where overflow occurs in INTT based on the parameters, generates a sequence T, the length of which is equal to the number of intersections where overflow occurs in INTT, and the sequence value is the identifier of the intersection in INTT where overflow occurs. The sequence T is then saved to the pre-computation table. The specific process is as follows.

[0275] Let n (n≥4) be a power of 2, the number of INTT stages be log₂n, the modulus be log₂q bits, and the maximum allowable redundancy of INTT (derived from the machine word length) be 2. maxInput the above parameters and the polynomial a, and return a mapred_position containing all the cross positions that need to be reduced by the above algorithm; by traversing the red_position, the position [t, <s, b, c>] that needs to be reduced can be accurately found, where t represents the tth cross of this INTT, and <s, b, c> represents the specific position where the reduction occurs, which is the s th stage of the butterfly b th cross of the INTT, and these positions are stored in the sequence T, as shown in Figure 13 .

[0276] Instantaneous calculation (constructing the INTT algorithm):

[0277] As shown in Figure 14 , if the sequence T is empty, an INTT is constructed, and all the stages of the butterfly of the INTT only need to call the redundant growth cross; otherwise, an INTT is constructed according to the sequence T (see Figure 13 ), so that it only calls the redundant reduction cross at the cross positions contained in the red_position, and the rest of the cross only calls the redundant growth cross.

[0278] The implementation mode of the present application will be described below in combination with a specific application scenario, see the following example 1.

[0279] Example 1

[0280] For post-quantum cryptography algorithms based on ideal lattices (such as NewHope and Kyber), NTT and INTT are the main calculations. The parameters of such algorithms are relatively fixed, and the parameter size satisfies log2n+log2q<60, so only the redundant modular multiplication is called on the butterfly, and all the reduction processing and all the logical branching statements on the NTT and INTT butterflies are completely removed, thereby improving the performance of polynomial multiplication.

[0281] Based on the above basic idea, example 1 is as follows:

[0282] NTT

[0283] (1) The output result of all the calculations of the NTT without logical branching statements is a non-negative integer.

[0284] (2) The NTT butterfly calculates multiplication first and then calculates addition and subtraction, so the restriction on the value of X needs to be relaxed to make the output more redundant.

[0285] (3) When calculating integer modular multiplication, the modular multiplication output can be controlled within the range [0, 2q) by using redundant modular multiplication.

[0286] (4) The redundant numerical value output after integer addition and subtraction can be processed according to the specific calculation task.

[0287] (5) Enter the next butterfly of the current stage. If all butterflies of the current stage have finished calculation, enter the next stage, repeat steps (2)-(5) until the calculation of all stages is completed. In this way, the overall output is redundant, but within the allowable range.

[0288] The algorithm of NTT is as follows.

[0289]

[0290] INTT

[0291] (1) All calculation outputs of INTT without logical branching statements are non-negative integers. Let n (n≥4) be a power of 2, and the total number of stages of this INTT is log2n; the butterfly of the last stage is separated out, so the INTT can be divided into main stages (the number of stages is less than log2n) and the last stage (the log2n stage).

[0292] (2) Since the INTT needs to support the input of polynomial coefficients of any redundant size, the minimum redundancy value is min=(t+n)*q, where t is the redundancy multiple of the input data.

[0293] (3) The butterfly of the INTT calculates addition and subtraction first and then multiplication, so the redundant values output after integer addition and subtraction do not need to be processed; when calculating the integer modular multiplication, use redundant modular multiplication to control the value of the output result in the range [0, 2q).

[0294] (4) Enter the next butterfly of the current stage. If all butterflies of the current stage have finished calculation, enter the next stage, repeat steps (2)-(3) until the calculation of the main stage is completed.

[0295] (5) Enter the last stage calculation, and the calculation process is the same as the butterfly of the main stage. The main purpose is to control the redundancy of the output result, so although the coefficient does not appear value out of range, redundant reduction crossover can also be considered. By using the characteristics of the INTT butterfly that multiplies first and then adds, only when the butterfly calculates the integer modular multiplication, the redundant modular multiplication function is called, so that the overall output can be controlled in the range [0, 2q).

[0296] The algorithm of INTT is as follows.

[0297]

[0298] In summary, the above examples construct more efficient NTT / INTT by pre-computation; after removing all logical branching statements, only the necessary reduction processing is retained, and the value of the output result remains within the range allowed by the data type or instruction set without going out of range; the modular multiplication is handled by using redundant modular multiplication, which is more efficient.

[0299] The effects achieved by the above example 1 include, but are not limited to, the following four points.

[0300] First, by introducing the redundant representation of the numerical value, the value of the output result remains within the range allowed by the instruction set after all the logical branching statements are removed.

[0301] Second, there is no additional reduction process in the NTT and INTT processes, and the performance of polynomial calculation is improved.

[0302] Third, the calculation process is not bound to the Montgomery algorithm, and the representation form of the polynomial coefficient can be adjusted at will according to the specific calculation task.

[0303] Fourth, it can be used in combination with other NTT and INTT algorithms.

[0304] Example 2

[0305] When the parameter is large (for example, on a 64-bit CPU, log2 n + log2 q ≥ 60), the NTT / INTT needs to be split at this time, the NTT is split according to the stage, and the INTT is split according to the cross, and the basis for splitting is the pre-computed position to be reduced.

[0306] For example, for NTT calculation, assuming that on a 64-bit CPU, the maximum redundancy value allowed by NTT is 2 62 , that is, max = 62, the maximum redundancy value 2 62 The number of bits is 63 bits, that is, the theoretical number of bits of each coefficient in the NTT calculation process needs to be less than or equal to 63 bits. n = 2 16 , log2 q = 57, that is, the number of bits of q is 58 bits. The coefficients of the input polynomial a are in the interval [0, q-1), that is, log2 a i The maximum value is 57, that is, the polynomial coefficient is determined as 58-bit data. The minimum redundancy value is 2q; by pre-computation, that is, by bringing the necessary parameters and the number of stages into the formula C and the formula D, it can be known that NTT only needs to call the redundancy reduction branch in the last stage, that is, the 16th stage, and the redundancy growth branch in the remaining stages; finally, the polynomial coefficient output by NTT is controlled within 60 bits. Figure 7 The calculation process of NTT in example 2 is shown.

[0307] For INTT calculation, assuming that on a 64-bit CPU, the maximum redundancy value allowed by INTT is 2 62(i.e. max = 62), n = 16, log2 q = 58, i.e. the bit number of q is 59 bits. The redundant multiple of the input polynomial coefficient is 4 times. Through pre-computation, it is known that the INTT needs to calculate 5 times of reduction in total, and the positions are:

[0308] [9, <2, 1, 1>] / / the 9th cross needs reduction, and the position is the 1st cross of the 1st butterfly of the 2nd stage;

[0309] [11, <2, 2, 1>] / / the 11th cross needs reduction, and the position is the 1st cross of the 2nd butterfly of the 2nd stage;

[0310] [13, <2, 3, 1>] / / the 13th cross needs reduction, and the position is the 1st cross of the 3rd butterfly of the 2nd stage;

[0311] [15, <2, 4, 1>] / / the 15th cross needs reduction, and the position is the 1st cross of the 4th butterfly of the 2nd stage;

[0312] [26, <4, 1, 2>] / / the 26th cross needs reduction, and the position is the 2nd cross of the 1st butterfly of the 4th stage;

[0313] Therefore, when the INTT algorithm is constructed, the redundant reduction cross is called only for the cross at the above position, and the redundant growth cross is called for the rest of the cross. The minimum redundancy value can be min = (4 + 16)q = 20q. The coefficient of the output polynomial of the final INTT is controlled within 62 bits, within the allowable range.

[0314] The derivation process of the minimum redundancy value is as follows: when the redundant multiple of the input polynomial coefficient is 1 times (equivalent to no redundancy of the polynomial coefficient), the minimum redundancy value is n*q; if the redundant multiple of the input polynomial coefficient is 4 times, it indicates that the maximum value of the input polynomial coefficient does not exceed 4q, and when the minimum redundancy value min is set to (4 + n)q, the minimum redundancy value min is greater than Y. Figure 8 The INTT calculation process of Example 2 is shown.

[0315] The above Example 2 relaxes the redundant multiple of the value of the polynomial coefficient on the basis of the same effect as Example 1, supports a larger redundancy range for the input data and output results within the instruction set allowed range; accurately locates the position of the reduction processing, removes unnecessary reduction processing, and the reduction processing is not bound to the Montgomery algorithm; and more parameter groups are available.

[0316] Figure 19 is a structural schematic diagram of a data processing apparatus 800 provided by an embodiment of the present application. The apparatus 800 comprises a first determination module 801 and a second determination module 802.

[0317] in combination Figure 6 As can be seen from the method flow shown in FIG. 8, the apparatus 800 is arranged on a computing device Figure 6 The first determining module 801 is configured to perform S201, and the second determining module 802 is configured to perform S202.

[0318] Figure 19 The apparatus embodiments described above are merely illustrative. For example, the division of the above modules is merely a logical function division, and in actual implementation, another division manner can be used, for example, a plurality of modules or components can be combined or integrated into another system, or some features can be omitted or not executed. The function modules in each embodiment of the present application can be integrated into one module, or each module can exist physically, or two or more modules can be integrated into one module.

[0319] Each module in the data processing apparatus 800 is implemented by software, hardware, firmware, or any combination thereof, in whole or in part.

[0320] Some possible implementation manners of using hardware or software to implement each function module in the data processing apparatus 800 are described below in combination with the computing device 900 described below.

[0321] In the case of software implementation, for example, the first determining module 801 and the second determining module 802 are implemented by software function modules generated by at least one processor 901 in the computing device 900 reading program codes stored in the memory 902. Figure 20

[0322] In the case of hardware implementation, for example, Figure 19 Each module described above is implemented by different hardware in the computing device, for example, the first determining module 801 is implemented by a part of processing resources (for example, one core or two cores in a multi-core processor) in at least one processor 901 in the computing device 900, and the second determining module 802 is implemented by the remaining part of processing resources (for example, other cores in a multi-core processor) in at least one processor 901 in the computing device 900, or by using a programmable device such as a field-programmable gate array (FPGA) or a coprocessor. Figure 20 Figure 20

[0323] Figure 20 FIG. 9 is a structural schematic diagram of a computing device 900 provided by an embodiment of the present application. The computing device 900 is configured to perform the method shown in FIG. 8. The computing device 900 includes a processor 901, a memory 902, and a network interface 903. Figure 6

[0324] ​​​​The processor 901 is, for example, a general central processing unit (CPU), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits used to implement the schemes of the present application. For example, the processor 901 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD is, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0325] The memory 902 is, for example, a read-only memory (ROM) or other type of static storage device that can store static information and instructions, a random access memory (RAM) or other type of dynamic storage device that can store information and instructions, an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disk storage, a magnetic disk storage or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto. Alternatively, the memory 902 exists independently and is connected to the processor 901 through the internal connection 904. Alternatively, the memory 902 and the processor 901 are integrated together.

[0326] Network interface 903 uses any transceiver-like device for communicating with other devices or communication networks. Network interface 903 includes, for example, at least one of a wired network interface or a wireless network interface. The wired network interface is, for example, an Ethernet interface. The Ethernet interface is, for example, an optical interface, an electrical interface, or a combination thereof. The wireless network interface is, for example, a wireless local area network (WLAN) interface, a cellular network interface, or a combination thereof.

[0327] In some embodiments, processor 901 includes one or more CPUs, such as Figure 20 CPU0 and CPU1 are shown in the diagram.

[0328] In some embodiments, the computing device 900 may optionally include a plurality of processors, such as Figure 20 The processors 901 and 905 are shown. Each of these processors is, for example, a single-core processor (CPU) or a multi-core processor (CPU). A processor here may optionally refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0329] In some embodiments, the computing device 900 further includes an internal connection 904. The processor 901, memory 902, and at least one network interface 903 are connected via the internal connection 904. The internal connection 904 includes pathways for transmitting information between the aforementioned components. Optionally, the internal connection 904 is a single board or a bus. Optionally, the internal connection 904 may be divided into an address bus, a data bus, a control bus, etc.

[0330] In some embodiments, the computing device 900 further includes an input / output interface 906. The input / output interface 906 is connected to an internal connection 904.

[0331] In some embodiments, the input / output interface 906 is used to connect to an input device to receive commands or data, such as modulus, redundancy factor, polynomial dimension, etc., inputted by the user through the input device. Input devices include, but are not limited to, keyboards, touchscreens, microphones, mice, or sensing devices.

[0332] In some embodiments, the input / output interface 906 is also used to connect to an output device. The input / output interface 906 outputs the processing results generated by the processor 301 performing the above methods, such as data after number theory transformation, through the output device. The output device includes, but is not limited to, a display, printer, projector, etc.

[0333] Optionally, the processor 901 implements the method in the above embodiments by reading the program code 910 stored in the memory 902, or the processor 901 implements the method in the above embodiments by internally stored program code. When the processor 901 implements the method in the above embodiments by reading the program code 910 stored in the memory 902, the memory 902 stores program code that implements the method provided in the embodiments of this application.

[0334] Combination Figure 6 As shown in the method, in one possible implementation, processor 901 is used to instruct input / output interface 906 or network interface 903 to execute S201, and processor 901 is also used to execute S202 to S204. In another possible implementation, processor 901 is used to instruct input / output interface 906 or network interface 903 to execute S201, and processor 901 is also used to execute S202 to S203. Processor 905 is used to execute S204. For more details on how processor 901 implements the above functions, please refer to the descriptions in the previous method embodiments, which will not be repeated here.

[0335] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

[0336] A references B, which means that A is the same as B or A is a simple variation of B.

[0337] The information (including but not limited to user device information, user personal information, etc.), data (including but not limited to data used for analysis, stored data, displayed data, etc.) and signals involved in the embodiments of this application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions. For example, the data to be encrypted and decrypted and the corresponding parameters involved in this application were obtained with full authorization.

[0338] In this application, unless otherwise stated, "at least one" means one or more, and "multiple" means two or more. For example, multiple computing units refer to two or more computing units.

[0339] The above-described embodiments can be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, the embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions described in the embodiments of the present application are wholly or partially generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transferred from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) manner. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a DVD), or a semiconductor medium (for example, a solid state disk (SSD)), etc.

[0340] The above embodiments are only used to illustrate the technical solutions of the present application, but not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A data processing method, characterized by, The method is executed by a computing device for performing a number theoretic transform of data, the steps of the number theoretic transform of the data comprising a plurality of computing units, the method comprising: determining, based on parameters of the data, an estimated bit number of a processing result generated by each of the computing units, the parameters indicating a bit number of the data; determining, based on the estimated bit number, a first computing unit from the plurality of computing units, the first computing unit being a computing unit for performing a reduction processing on a processing result of a second computing unit, an estimated bit number of the processing result of the second computing unit satisfying a preset bit number.

2. The method of claim 1, wherein, The reduction processing comprises: performing a redundant modular multiplication processing on the processing result of the second computing unit.

3. The method of claim 2, wherein, The redundant modular multiplication processing on the processing result of the second computing unit comprises: performing a redundant modular multiplication processing on the processing result of the second computing unit based on a rotation factor, the rotation factor having a same representation as the data.

4. The method of claim 1, wherein, The method further comprises: performing an encryption processing or a decryption processing on the processing result of the second computing unit after the reduction processing.

5. The method according to any one of claims 1 to 4, characterized in that, The parameters comprise a modulus used by each of the plurality of computing units when performing a modulo operation, a redundancy multiple of the data relative to the modulus, and a polynomial dimension of the data.

6. The method according to any one of claims 1 to 5, characterized in that, The preset bit number is determined based on a bit number of a processor in the computing device, the preset bit number being less than the bit number of the processor by 1 or 2.

7. The method according to any one of claims 1 to 6, characterized in that, Each of the plurality of computing units is further configured to perform a subtraction processing based on a redundancy value, the redundancy value being greater than or equal to a subtrahend in the subtraction processing.

8. The method of claim 7, wherein, The number theoretic transform comprises a positive number theoretic transform, and the redundancy value is equal to 2q, the q representing a modulus used by each of the plurality of computing units when performing a modulo operation, the q being a positive integer.

9. The method of claim 7, wherein, The number theoretic transform comprises an inverse number theoretic transform, and the redundancy value is equal to (t+n)*q, the q representing a modulus used by each of the plurality of computing units when performing a modulo operation, the t representing a redundancy multiple of the data relative to the modulus, the n representing a polynomial dimension of the data, the t, the n, and the q being positive integers.

10. The method according to any one of claims 1 to 9, characterized in that, Each of the plurality of computing units is configured to generate k processing results based on k data, the k being a positive integer.

11. A data processing apparatus, characterized by The apparatus is configured to perform a number theoretic transform of data, the steps of the number theoretic transform of the data comprising a plurality of computing units, the apparatus comprising: a first determining module configured to determine, based on parameters of the data, an estimated bit number of a processing result generated by each of the computing units, the parameters indicating a bit number of the data; a second determining module configured to determine, based on the estimated bit number, a first computing unit from the plurality of computing units, the first computing unit being a computing unit for performing a reduction processing on a processing result of a second computing unit, an estimated bit number of the processing result of the second computing unit satisfying a preset bit number.

12. The apparatus of claim 11, wherein, The first computing unit is configured to perform a redundant modular multiplication processing on the processing result of the second computing unit.

13. The apparatus of claim 12, wherein, The first computing unit is configured to perform a redundant modular multiplication on a processing result of the second computing unit based on a rotation factor, the rotation factor having a same representation as the data.

14. The apparatus of claim 11, wherein, The apparatus further includes a processing module configured to perform an encryption or decryption on the processing result of the second computing unit after the reduction.

15. The apparatus of any one of claims 11 to 14, wherein, The parameters include a modulus used by each of the plurality of computing units for a modulo operation, a redundancy multiple of the data relative to the modulus, and a polynomial dimension of the data.

16. The apparatus of any one of claims 11 to 15, wherein, The preset number of bits is determined based on a number of bits of a processor in the computing device, and the preset number of bits is less than the number of bits of the processor by 1 or 2.

17. The apparatus of any one of claims 11 to 16, wherein, Each of the plurality of computing units is further configured to perform a subtraction based on a redundancy value, the redundancy value being greater than or equal to a minuend in the subtraction.

18. The apparatus of claim 17, wherein, The number theoretic transform includes a positive number theoretic transform, and the redundancy value is equal to 2q, the q representing a modulus used by each of the plurality of computing units for a modulo operation, the q being a positive integer.

19. The apparatus of claim 17, wherein, The number theoretic transform includes an inverse number theoretic transform, and the redundancy value is equal to (t+n)*q, the q representing a modulus used by each of the plurality of computing units for a modulo operation, the t representing a redundancy multiple of the data relative to the modulus, the n representing a polynomial dimension of the data, the t, the n, and the q being positive integers.

20. The apparatus of any one of claims 11-19, wherein, Each of the plurality of computing units is configured to generate k processing results based on k data, the k being a positive integer.

21. A computing device, comprising: The computing device includes a processor coupled with a memory, the memory storing at least one computer program instruction, the at least one computer program instruction being loaded and executed by the processor to cause the computing device to implement the method of any one of claims 1-10.

22. A computer-readable storage medium, characterized in that, The storage medium stores at least one instruction, which, when executed on a computer, causes the computer to perform the method of any one of claims 1-10.

23. A computer program product, characterised in that, The computer program product includes one or more computer program instructions, which, when loaded and executed on a computer, cause the computer to perform the method of any one of claims 1-10.

Images