Method and system for improving throughput of montgomery modular multiplication by using dsp cascade structure

Abstract

This invention discloses a method for improving the throughput of Montgomery modular multiplication using a cascaded DSP structure, comprising: storing the multipliers X and Y and the modulus M of the modular multiplication input in the circular queue memory of the operand input and storage module, and storing the pre-calculated input M'; initializing the outer loop counter i to 0; entering the outer loop, and outputting X from the circular queue of X. (i) The inner loop counter j is initialized to 0; upon entering the inner loop, the circular queues of Y and M output Y respectively. (j) and M (j) The inner loop uses the parallel grouped cascaded digital signal processing unit (DSP) in the pipelined multiplication module to calculate X. (i) Y (j) +p (i) M (j) After the inner loop finishes, the intermediate result Z is obtained. (i+1) =(Z (i) +X (i) Y+p (i) M) >> m; Calculate the p required for the next outer loop using the multi-cycle multiply-accumulate operator in the p-value multiply-accumulate module. (i+1) The value of Z-M is calculated using the multi-cycle subtractor in the comparison correction and output module after the outer loop ends, and Z-M or Z is output according to the sign of the result.

Description

Technical Field

[0001] This invention belongs to the field of large integer arithmetic acceleration technology, and relates to a method and system for improving the throughput of Montgomery modular multiplication using a DSP cascade structure. Background Technology

[0002] Large integer modular multiplication, as a fundamental algorithm, plays a crucial role in various fields, particularly in privacy computing. Many encryption algorithms involved in privacy computing incorporate large integer modular multiplication operations, such as the encryption, decryption, and ciphertext operations of the Paillier homomorphic encryption algorithm, and encryption and decryption in the RSA cryptosystem. Therefore, the performance of large integer modular multiplication directly impacts the speed of privacy computing. Montgomery modular multiplication is a widely used algorithm that transforms large integers into the Montgomery field and uses Montgomery reduction to replace complex modular operations with multiplication and shift operations. High-radix Montgomery modular multiplication is a variant that further reduces the bit width of multiplication and addition. In recent years, FPGA technology has developed rapidly and is widely used in large-scale parallel computing, data center acceleration, and high-performance computing. FPGAs are programmable hardware devices with advantages such as high efficiency, security, and programmability, making them ideal for accelerating algorithms in privacy computing. Recent studies (e.g., [1] Zhang B, Cheng Z, Pedram M. An Iterative Montgomery Modular Multiplication Algorithm With Low Area-Time Product [J]. IEEE Transactions on Computers, 2022.) have shown that the Montgomery modular multiplication algorithm implemented on FPGA can outperform the CPU in speed, and with the support of FPGA parallel capabilities, the throughput can be several times that of the CPU by increasing the number of instances. Therefore, in addition to computational latency, reducing resource consumption is also an important indicator for FPGA-based modular multiplication implementation. However, the current FPGA-based modular multiplication implementation has the following problems:

[0003] FPGAs contain various resources, including LUTs, DSPs, BRAMs, and I / O. LUTs offer greater flexibility and programmability, enabling most computational logic, including mathematical operations and flow control, through lookup tables. DSPs can be considered as fixed LUTs, with only partial configurability, limited to multiplication, addition, and shift calculations, but offering faster computation compared to LUTs. Existing implementations primarily focus on optimizing specific resources to reduce resource consumption, often neglecting the utilization of other resources. Or, only LUTs are used, ignoring DSPs (e.g., [1] Zhang B, Cheng Z, Pedram M. An Iterative Montgomery Modular Multiplication Algorithm With Low Area-Time Product[J].IEEE Transactions on Computers, 2022.); or a large number of DSPs are used, and LUTs are hardly used (e.g., [2] Mohammad-Hossein F, Siavash B, Hatameh M, et al. Hardware Architecture for Supersingular Isogeny Diffie-Hellman and Key Encapsulation Using a Fast Montgomery Multiplier[J].IEEE Transactions on Circuits and Systems I: Regular Papers, 2021.). This situation will lead to uneven resource allocation, or idle and underutilized resources, causing the FPGA performance to degrade. Summary of the Invention

[0004] To address the shortcomings of existing technologies, the present invention aims to provide a method for improving the throughput of Montgomery modular multiplication using a cascaded DSP (Digital Signal Processing Unit) structure. This solution reduces computational latency and improves DSP utilization by optimizing the Montgomery modular multiplication algorithm and using parallel grouped cascaded DSPs. The parallel grouped cascaded structure implements an asymmetric multiplier, applicable to carry-preserving multipliers of arbitrary bit widths, and suitable for word-based high-radix Montgomery modular multiplication.

[0005] The implementation of this invention is entirely based on the FPGA platform, and all modules and components are implemented based on the LUT resources and DSP resources in the FPGA.

[0006] This invention utilizes the Montgomery modular multiplication algorithm, employing loops and conditional branches to process computational steps for efficient execution of large integer multiplication. This is achieved through an operand input and storage module, a loop controller module, a pipelined multiplication module, a p-value multiplication-addition module, and a comparison, correction, and output module. A first aspect of this invention is an optimization of the Montgomery modular multiplication algorithm.

[0007] The original implementation of the Montgomery algorithm is as follows:

[0008] Step 1: Initialization. Initialize variable Z to 0 as the initial value for the result;

[0009] Step 2: Repeat the operation

[0010] Step 2.1: For each i, from 0 to d m -1 is used for looping;

[0011] Step 2.2, Calculate the value of p: Calculate p according to the formula. (i) The value;

[0012] Step 2.3: Calculate and update the intermediate result Z: Calculate Z according to the formula. (i+1) The value;

[0013] Step 3: Set the final Z value to

[0014] Step 4: If Z ≥ M, then subtract M from Z to correct Z to a value within the range [0, M).

[0015] The specific algorithms involved are as follows:

[0016]

[0017]

[0018] The optimization of the Montgomery algorithm in this invention lies in advancing the calculation of the p-value and further splitting the calculation process of the Z-value to better suit the bit width of the DSP.

[0019] Due to Z (i+1) The calculation depends on p (i) , and p (i) The calculation depends only on Z. (i) The lower m bit, therefore, in this invention, p (i) The calculation is moved to the previous outer iteration, when the inner loop outputs Z. (i) After the lower m-bit, p can be performed. (i) The calculation, i.e., the inner loop and p (i) The computation can be processed in parallel.

[0020] Meanwhile, the base and word length are selected based on the DSP bit width. For a DSP with a multiplication bit width of u×v (where the bit widths of the two integers in the multiplication operation are u and v respectively), the selected base bit width is m = uk. m Word length w = vk w Compared to the traditional power-of-2 base bit width and word length, the choice in this invention avoids the extra DSP overhead caused by the mismatch between the multiplication bit width and the DSP multiplication bit width because the bit width of the multiplication operation can be divided by the multiplication bit width of the DSP, thus increasing the utilization rate of the DSP.

[0021] The optimizations described above can eliminate data dependencies within loops, improve parallel efficiency, and are applicable to DSP hardware implementations with specific bandwidths. These optimizations can accelerate the execution of the Montgomery modular multiplication algorithm, improving its efficiency and performance.

[0022] The specific implementation is as follows:

[0023] Step 1: Initialization

[0024] Step 1.1: Initialize variable Z to 0 as the initial value for the result;

[0025] Step 1.2: Calculate and prepare the p value required for the outer loop in advance;

[0026] Step 2: Loop through the loop. For each i, from 0 to d... m -1 is used for looping;

[0027] Step 2.1: Initialize the inner loop variable cy (0) and re (0) If the value is 0, the initialization steps of the inner loop are completed;

[0028] Step 2.2: For each j, from 0 to d w -1 is used for looping;

[0029] Step 2.2.1: Calculate the sum of the steps. (j) Calculate and store the value of the single-step sum according to the formula;

[0030] Step 2.2.2: Perform branching judgment based on the conditions;

[0031] If j = 0, then perform the following operation:

[0032] sum (j) Shift right by m bits, and store the lower wm bits of the shifted result in re. (j+1) ;

[0033] Store the high m+1 bits of the right-shifted result into cy. (j+1) ;

[0034] If j is not equal to 0, then perform the following operation:

[0035] sum (j) with re (j) Assemble by position.

[0036] The lowest 'w' bits of the concatenated result are Z. (i+1)(j-1) The value of is written into the circular queue memory of Z;

[0037] Store the middle wm bit of the concatenated result into re. (j+1) ;

[0038] Store the high m+1 bits of the concatenated result into cy. (j+1) .

[0039] Step 2.3, Update Calculate and update according to the formula. The value;

[0040] Step 2.4: Calculate and update p (i+1) : Calculate and store the p value required for the next outer loop based on the formula;

[0041] Step 3: Set the final Z value to

[0042] Step 4: If Z ≥ M, then subtract M from Z and correct Z to a value within the range [0, M).

[0043] The specific algorithms involved are as follows:

[0044]

[0045]

[0046] Among them, Z (i)(j) X is an intermediate result variable, representing a partial product result generated during the loop; (i) Y is the input parameter, representing the i-th slice of the large integer X; (i) p is the input parameter, representing the j-th slice of the large integer Y; (i) is an intermediate result variable used to calculate the p value of the i-th outermost loop; M is the modulus, representing the modulus of a large integer; r is the base, which is 2. m m is the base bit width; w is the word length; d m d represents the number of iterations in the outer loop. w cy is the number of iterations in the inner loop; (j) The carry variable is used to handle carry operations; re (j) This is a temporary variable used to store and concatenate the results; sum (j)For single steps and variables, represent the intermediate results of a single step.

[0047] In the above algorithm, the result of the modular multiplication operation is Z = XYP. -1 mod M, where M must be odd; take M' satisfying rr -1 -MM' = 1, where r = 2 m m is the base width, r -1 Satisfy rr -1 mod M = 1, that is, r -1 Let M' be the modular inverse of r modulo M, and M' be the negative modular inverse of M modulo r. Since M is odd, r is 2. m M and r are coprime, therefore r -1 M' must exist; take R -1 Satisfy RR -1 mod M = 1, that is, R -1 Let r be the modular inverse of R modulo M. In actual computation, r -1 It will replace R -1 Participating in the computation, R -1 For reference only, R is generated by r and N and is an intermediate constant; the modular multiplication operation is a large integer modular multiplication, requiring the bit width N of the modular multiplication input operands X, Y and M to be greater than or equal to 1024.

[0048] The output bit width of the circular queue memory storing X is the base bit width m, and the bit width of the circular queue memory storing Y, M and intermediate results Z is the word length w. That is, X is divided according to the base bit width, and Y, M and Z are divided according to the word length.

[0049] The outer loop iterates the following number of times: The inner loop iterates the following number of times:

[0050] The base bit width m and word length w depend on the DSP's multiplier bit width, i.e., m = uk m w = vk w Where u and v are the bit widths of the two input ports of the DSP multiplier, respectively, and k m and k w All are integers.

[0051] When calculating a single-step sum, two multiplications with a bit width of m×w need to be calculated, namely X. (i) Y (j) and p (i) M (j) The number of DSPs required for a single multiplication is Choosing the base bit width *m* and word length *w* based on the DSP's multiplication bit width improves DSP utilization compared to the traditional power-of-two approach. Taking the DSP48E1 as an example, its multiplication bit width *u×v* = 24×17. If the traditional power-of-two base bit width *m* = 32 and word length *w* = 32 were chosen, then 4 DSPs would be required, the total number of DSPs would be 8, and the total number of loops would be *d*. m ×d w =1024; however, if the selection is based on the DSP bit width, the required number of DSPs is k. m ×k w One, when k m =1,k w When the value is 4, i.e., m=24, w=68, the required number of DSPs is the same as the traditional method, but the total number of loops is d. m ×d w =688. That is, using the same number of DSPs, the present invention requires fewer loops. Correspondingly, with the same number of loops, the present invention requires fewer DSPs. Generally, the product of the required number of DSPs and the total number of loops is...

[0052]

[0053] This formula represents DSP utilization; the lower the product, the higher the utilization. Let... Easy to obtain f N,u (x) is monotonically non-increasing in the interval ((k-1)u, ku), where k is a positive integer. The original product can be written as f N,u (m)f N,v (w), therefore when m = k m u, w = k w When v is reached, a minimum value can be obtained, meaning that the DSP utilization rate is relatively high at this time.

[0054] The parallel group cascaded DSP used is k w Composed of DSPs; k w In this DSP, three DSPs are grouped together, and the DSPs within a group are directly cascaded. Only the last DSP in each group simultaneously uses both the multiplication register and the accumulation register; the remaining DSPs only use the multiplication register. Each group of DSPs generates a partial product and a carry, and the carry generated by each group is retained. Therefore, u×vk can be calculated in two cycles. wPartial product and carry in bitwise multiplication; furthermore, parallel grouped cascaded DSPs can be fully pipelined. In ordinary cascaded structures, the current DSP needs to wait for the previous DSP to complete its calculation and generate a carry before it can calculate, so the latency is proportional to the number of DSPs. Even with a grouped cascaded structure, the latency can only be reduced by a constant factor. However, the parallel grouped cascaded structure of this invention is independent of the number of DSPs, and the latency is a fixed two cycles. Because the parallel grouped cascaded structure retains the carry, it is mainly suitable for calculations such as Montgomery modular multiplication, which still require summation of multiple numbers after multiplication.

[0055] X (i) Y (j) and p (i) M (j) Each uses k m A parallel grouped cascaded DSP is used to shift the partial product generated by the i-th parallel grouped cascaded DSP and the carry left by ui bits; then, within one cycle, the 2k bits are converted by a carry-retaining adder. m 4k generated by a parallel grouped cascaded DSP m The addition of one addend is compressed into the addition of two numbers, while Z (i)(j) The value is also compressed simultaneously; in the next cycle, the two compressed numbers are added together to obtain Z. (i)(j) +X (i) Y (j) +p (i) M (j) The result.

[0056] Z in the j-th inner iteration (i)(j) +X (i) Y (j) +p (i) M (j) The lower wm bits in the result will be concatenated with the middle m bits of the result of the (j-1)th inner iteration to obtain Z. (i)(j-1) The result is then written into the circular queue of Z, which is the process of right-shifting the result by m bits.

[0057] The inner loop requires 4 cycles per iteration: two cycles for parallel grouping and cascading DSP calculations, one cycle for compressing partial products, and one cycle for calculating the final addition; the inner loop iterates the following number of times. The inner loop can be fully pipelined, meaning the j-th iteration does not need to wait for the (j-1)-th iteration to finish, and the start-cycle interval between each iteration is 1. Due to the right shift of m bits, an additional cycle is needed for writing after the inner loop finishes. An additional cycle is needed for the initialization of the inner loop, therefore the total clock cycle consumption of the inner loop is d. w +5.

[0058] p(i+1) The calculation formula is:

[0059] p (i+1) =(Z (i+1) mod 2 m +X (i+1) Y (0) M'mod 2 m ,

[0060] Among them, 2 m Modulo can be replaced by bit truncation, then the original calculation is transformed into a multiply-add operation and a multiplication operation, which can be achieved by reusing the same multi-cycle multiplier.

[0061] Before entering the outer loop, pre-calculate the p required for the first loop. (0) The value; and in the i-th outer iteration, calculate the p required for the next iteration. (i+1) Because p (i) Depends only on Z (i) In the same outer iteration, after the lower m bits of Z are calculated in the inner loop, the calculations of p and Z can be completely parallel.

[0062] The circular queue storing M is reused to store the result ZM of the multi-cycle subtractor in the circular queue.

[0063] A second aspect of the present invention provides a Montgomery modular multiplication implementation system based on a parallel grouped cascaded DSP structure, comprising: an operand input and storage module, a loop controller module, a pipelined multiplication operation module, a p-value multiplication and addition operation module, and a comparison correction and output module;

[0064] The specific explanation is as follows:

[0065] The operand input and storage module manages operand input, stores operands and intermediate results, and provides the data required for each loop. A fixed-size, first-in-first-out (FIFO) storage structure is implemented using a circular queue memory. Dual read / write queues are implemented within the same storage space using read and write pointers. The following functions can be configured: 1) When the memory is not full, data can be input to the end of the write queue; 2) When the memory is not empty, data at the head of the read queue can be output; 3) Each time data is output, it remains valid in the storage space and can be considered as being stored at the end of a queue with the same length as the memory; 4) When the memory is full, input data will overwrite data at the head of the write queue. As described in the algorithm above, input operands need to be read cyclically, and intermediate results need to be read and written cyclically. Therefore, an external loop controller can be used to control read and write operations without causing invalid reads or write conflicts.

[0066] The loop controller module includes an outer loop controller and an inner loop controller. The outer loop controller controls the output of the circular queue memory for the input operand X. The inner loop controller controls the input and output of the circular queue memory for the input operands Y and M, and the intermediate result Z. The inner loop controller is also used to control the pipeline for single-step computation.

[0067] The pipelined multiplication module is used to calculate single-step sums. Through the carry-save adder (CSA) and the adder, it can achieve partial accumulation and summation of the final result in multiplication operations. This invention achieves efficient pipelined multiplication by efficiently utilizing DSPs. DSPs in FPGAs can perform fast multiplication or multiply-add operations, such as P = A × B or P = A × B + C, where A and B are the input multipliers, C is the input addend, and P is the output result. Since the bit width of its multiplication input operands is fixed and low, multiple DSPs need to be cascaded to achieve high-bit-width multiplication. When multiple DSPs are cascaded, the carry output of the previous DSP is used to input the carry input of the next DSP to achieve the carry in multiplication. This invention uses a parallel grouped cascaded DSP structure to combine multiple DSP units that can only perform low-bit-width multiplication to achieve high-bit-width multiplication. For a DSP with a multiplication bit width of u × v, if it is combined into u × vk... w The multiplier can multiply k w The DSPs are grouped into groups of three, with each group internally cascaded. Only the last DSP uses its accumulator register. Each group can implement a u×3v multiplier. Each group produces a partial product and a carry propagated to the next group. In the parallel grouped cascaded DSP structure, this carry is retained and not directly added to the next group. Concatenating multiple partial products yields u×vk. w The carry of a multiplier can be obtained by concatenating the partial products of the multipliers and the carry. Let k... m u×vk w The result of adding parts and carry-overs is uk. m ×vk w The result of the multiplier. The accumulation process uses a carry-preserving adder to compress it into the addition of two numbers. This parallel grouped cascaded DSP structure fully considers the different processing speeds of different processing stages of the DSP, and realizes partial product generation and carry in 2 cycles. The compression of the accumulation requires one cycle, and the final addition requires one cycle. Therefore, the overall multiplication unit requires 4 cycles and can be fully pipelined, that is, each cycle can output the multiplication result from 4 cycles ago.

[0068] The p-value multiply-add module requires one multiply-add operation with a bit width of m×w+m and one multiplication of m×w. Since these operations are data-dependent, they must be performed sequentially. This invention uses a single m×w+m multiply-adder to implement both operations. When performing the multiplication, simply setting the addend input in the multiply-adder unit to 0 is sufficient. This approach achieves resource reuse.

[0069] The comparison correction and output module is used to correct the final output. Since the result Z obtained after the double loop is in the range [0, 2M), and the modular multiplication needs to be restricted to [0, M), it is necessary to compare the result Z of the double loop with the modulus M. If Z is greater than or equal to M, then output ZM; otherwise, output M.

[0070] This invention can be applied to domains where multiple modular multiplications are required in asymmetric key algorithms or other encryption algorithms, and the modulus of each multiplication is the same. This invention also provides a method for accelerating the application of accelerated Montgomery modular multiplication to a logistic regression model encrypted using the Paillier homomorphic encryption algorithm.

[0071] This invention has the following innovative features and beneficial effects:

[0072] 1) This invention proposes an optimization of the algorithm, which advances the calculation of the p-value to the previous outer loop, eliminates the data dependency in the same outer loop, and allows the inner loop and the calculation of the p-value to be performed in parallel.

[0073] 2) Unlike common methods that use powers of 2 as the base bit width or word length, this invention innovatively determines the base bit width and word length based on the DSP bit width, improving the utilization of the DSP. More Montgomery modular multiplication instances can be generated in a single FPGA, thereby increasing the throughput of Montgomery modular multiplication. Compared with existing methods using DSP, this invention can improve throughput by 52.24% for 1024-bit modular multiplication and by 87.94% for 2048-bit modular multiplication.

[0074] 3) This invention proposes a parallel grouped cascaded DSP architecture, which fully utilizes the different speeds of different processing stages of the DSP, for a bit width of u×vk. w For multiplication, using a regular direct cascade structure requires k w +1 cycle, while the parallel grouped cascaded DSP structure proposed in this invention reduces the required number of cycles to 2 cycles without losing chip frequency. Attached Figure Description

[0075] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0076] Figure 1 This is a block diagram of a high-throughput Montgomery modular multiplication implementation based on FPGA.

[0077] Figure 2 This is a schematic diagram of the pipelined multiplication unit architecture.

[0078] Figure 3 This is a simplified structural diagram of a DSP.

[0079] Figure 4 This is a schematic diagram of a typical cascaded DSP structure with a bit width of u×5v.

[0080] Figure 5 This is a schematic diagram of a grouped cascaded DSP structure with a bit width of u×9v.

[0081] Figure 6 This is a schematic diagram of a parallel grouped cascaded DSP structure with a bit width of u×9v. Detailed Implementation

[0082] The present invention will be further described in detail below with reference to the specific embodiments and accompanying drawings. Except for the contents specifically mentioned below, the processes, conditions, and experimental methods for implementing the present invention are all common knowledge and general knowledge in the art, and the present invention does not have any particular limitations.

[0083] The first aspect of this invention provides a method for improving the throughput of Montgomery modular multiplication using a cascaded DSP structure. The second aspect provides a Montgomery modular multiplication implementation system based on a parallel grouped cascaded DSP structure. The system includes five modules: an operand input and storage module, a loop controller module, a pipelined multiplication operation module, a p-value multiplication and addition operation module, and a comparison correction and output module.

[0084] The implementation of the method of the present invention includes the following steps:

[0085] Step 1: Through the operand input and storage module, store the multipliers X and Y and the modulus M of the modular multiplication input in the circular queue memory of the operand input and storage module, and store the pre-calculated input M'. The outer loop counter i is initialized to 0.

[0086] Step 2: Enter the outer loop, and output X from X's circular queue. (i) The inner loop counter j is initialized to 0;

[0087] Step 3: Enter the inner loop, and the circular queues of Y and M output Y (j) and M (j) ;

[0088] Step 4: In the inner loop, use the parallel grouped cascaded digital signal processing unit DSP in the pipelined multiplication operation module to calculate X (i) Y (j) +p (i) M (j) After the inner loop ends, the intermediate result Z (i+1) =(Z (i) +X (i) Y + p (i) M)>>m;

[0089] Step 5: Calculate the p value required for the next outer loop through the multi - cycle multiplier - adder in the p - value multiply - add operation module (i+1) value;

[0090] Step 6: After the outer loop ends, use the multi - cycle subtractor in the comparison correction and output module to calculate the value of Z - M, and output Z - M or Z according to the result sign

[0091] The method for improving the throughput of Montgomery modular multiplication using a DSP cascaded structure in the present invention first stores the multiplier X and Y and the modulus M input for modular multiplication in the circular queue memory through the operand input and storage module, and stores the pre - calculated input M', where M' needs to satisfy rr -1 - MM' = 1. Since M is the radix and r is a power of 2, r and M are relatively prime, and the value of M' is unique; where r = 2 m , r -1 is the modular inverse of r with respect to M, that is, rr -1 mod M = 1, and satisfies r -1 <M, which can be calculated by the extended Euclidean algorithm. These calculations are obtained outside the FPGA (can be calculated simultaneously when generating M). The outer - loop counter i is initialized to 0, and then enters the outer loop. The circular queue of X outputs X (i) , the inner - loop counter j is initialized to 0, and then enters the inner loop. The circular queues of Y and M output Y (j) and M (j) , and in the inner loop, use the parallel grouped cascaded DSP to calculate X (i) Y (j) +p (i) M (j) , after the inner loop ends, the intermediate result Z (i+1) =(Z (i) +X (i) Y + p (i)M)>>m, while calculating the inner loop, calculate the p value required for the next outer loop. After the outer loop ends, use a multi-cycle subtractor. If the sign of the corrected result ZM is less than 0, it indicates that Z is less than M, and output Z; otherwise, output ZM.

[0092] This invention provides an accelerated implementation of Montgomery modular multiplication, optimizing the algorithm by advancing the calculation of the p-value to the previous loop and calculating the p-value required for the first loop before the start of the first loop. This eliminates the data dependency between the inner loop and the p-value calculation, allowing the inner loop and p-value calculation to be performed in parallel. Furthermore, unlike the traditional method of using powers of 2 as the base bit width and word length, this invention determines the base bit width and word length based on the DSP's multiplication bit width, fully utilizing the low-width multipliers in the digital signal processing unit to achieve efficient DSP utilization. Specifically, for a DSP with a multiplication bit width of u×v, the base bit width selected in this invention is m = uk. m The character length is w = vk w , where k m and k w They are all positive integers.

[0093] A second aspect of the present invention provides a Montgomery modular multiplication implementation system based on a parallel grouped cascaded DSP structure, comprising five modules: an operand input and storage module, a loop controller module, a pipelined multiplication operation module, a p-value multiplication and addition operation module, and a comparison, correction, and output module. The overall structure is as follows: Figure 1 As shown:

[0094] Operand Input and Storage Module: This module handles the input operands X, Y, and M. Each operand has a bit width of N, typically greater than or equal to 1024. The input operands are stored in a circular queue memory, a fixed-depth, first-in-first-out (FIFO) storage structure. It uses dual pointers for reading and writing to implement dual queues within the same storage space. The following functions can be configured: 1) Data can be input to the end of the write queue when the memory is not full; 2) Data can be output from the head of the read queue when the memory is not empty; 3) When the memory is full, input data will overwrite the data at the head of the write queue; 4) Each time data is output, it remains valid in the memory space. That is, after outputting data the same number of times as the memory depth, if no data is written in between, the output data will begin to cycle. Since write operations on the same operand or intermediate result based on word-based high-radix Montgomery modular multiplication always follow read operations and require cyclic reading and writing, a loop controller can be used to control reading and writing without causing invalid reads or write conflicts. The circular queue memory storing the input operand X and the intermediate result Z has a bit width of m and a depth of... The circular queue memory storing the input operands Y and M has a bit width of w and a depth of [missing information]. Where m is the base bit width and w is the word length;

[0095] The loop controller module includes an outer loop controller and an inner loop controller. The outer loop controller controls the input of the circular queue memory for the input operand X. The inner loop controller controls the input and output of the circular queue memory for the input operands Y and M and the intermediate result Z. The inner loop controller is also used to control the pipeline of the pipelined multiplication unit.

[0096] The structure of the pipelined multiplication module is as follows: Figure 2 As shown: This module is used to calculate the single-step sum in the inner loop (formula (1)), and concatenates the single-step sum with the result of the previous round of calculation, shifts it to the right, and outputs the intermediate result Z. (i+1)(j-1) ;

[0097] sum (j) =Z (i)(j) +X (i) Y (j) +p (i) M (j) +cy (i) (1)

[0098] Where X (i) Y (j) and p (i) M (j) The computing unit structures are identical, all composed of multiple parallel grouped cascaded DSP structures, such as... Figure 6 As shown, for a DSP with a multiplication bit width of u×v, it needs to be combined into u×vk. w The multiplier can multiply k w The DSPs are grouped into groups of three, with each group directly cascaded. Only the last DSP uses its accumulator register; the remaining DSPs complete the accumulation within a single cycle. Each group of DSPs can then implement a u×3v multiplier. Each group also generates a partial product and a carry propagating to the next group. In this parallel grouped cascaded DSP structure, the carry is retained instead of being directly accumulated to the next group of DSPs. Concatenating the partial products of multiple groups yields u×vk. w The carry of a multiplier can be obtained by concatenating the carry bits of its partial product. m u×vk w The partial product and carry accumulation of the parallel grouped cascaded DSPs can be used to obtain uk. m ×vk wThe result of the multiplier. The accumulation is compressed into the addition of two numbers using a carry-preserving adder. The parallel grouped cascaded DSP structure fully considers the different processing speeds of different processing stages of the DSP, and realizes the generation of partial product and carry in 2 cycles. In addition, the compression of the accumulation requires one cycle, and the addition of two numbers requires one cycle. Therefore, the overall multiplication unit requires 4 cycles, and the multiplication unit can be fully pipelined, that is, each cycle can output the multiplication result from 4 cycles ago;

[0099] The p-value multiplication and addition module requires a multiplication and addition operation with a bit width of m×w+m and a multiplication operation with a bit width of m×w. The input operand of the multiplication operation is the output of the multiplication and addition operation, so the two need to be calculated in sequence.

[0100] p (i+1) =(Z (i+1) modr+X (i+1) Y (0) M'mod r (2)

[0101] The comparison correction and output module is used to correct the final output. Since the result Z obtained after the double loop is in the range [0, 2M), and the modular multiplication needs to be restricted to [0, M), it is necessary to compare the result Z of the double loop with the modulus M. If Z is greater than or equal to M, then output ZM; otherwise, output M.

[0102] This invention uses an m×w+m multiply-adder to perform multiplication and addition calculations, and controls the input selection of the multiply-adder through a controller. When calculating multiplication, simply setting the addend input in the multiply-adder unit to 0 is sufficient. This method achieves resource reuse and improves resource utilization.

[0103] Example

[0104] This embodiment uses a specific encryption algorithm as an example:

[0105] In cloud computing scenarios, Paillier homomorphic encryption can be used to perform computations on data while protecting user privacy. Considering logistic regression, a machine learning algorithm, homomorphic encryption allows for user classification using encrypted data. Logistic regression requires calculating the vector dot product of input features and parameters; to protect user privacy, the input feature vector is a ciphertext vector encrypted using Paillier homomorphic encryption. The parameter vector is the plaintext vector *a*, where the bit width of the plaintext is *l* = 32 and the bit width of the ciphertext is *N* = 2048. The homomorphic vector dot product is... The public key for the Paillier encryption algorithm consists of two positive integers (n, g), where the bit width of n is... The number of features (number of vector elements) is C = 1024. This embodiment specifically describes a method for accelerating the application of the accelerated Montgomery modular multiplication to a logistic regression model encrypted using the Paillier homomorphic encryption algorithm. The detailed steps of the method are described below:

[0106] Step 1: Parameter Configuration

[0107] First, confirm the required parameters for the Montgomery modular multiplication of this invention. Taking the Xilinx Virtex-7xc7v585tffg1157-3 FPGA as an example, its DSP model is DSP48E1. The bit widths of the unsigned multiplication input operands of this DSP are 17 and 24, i.e., u = 24 and v = 17. Select the base bit width coefficient k according to the speed and area requirements. m The coefficient k of the sum word length w The larger the coefficient, the faster the calculation speed, but the more LUT and DSP resources are consumed. Here, we choose coefficients k. m =1,k w =9, this configuration is one of the more efficient configurations found in the experiment. Therefore, the base bit width m = uk m =24, word length w=vk w =153. Additionally, since the public key n has a bit width of 1024, therefore n 2 The bit width is 2048, meaning the modular operand bit width for modular multiplication is N = 2048. Let b represent the number of instances that can be implemented in a single FPGA chip; in this configuration, experimental results show b = 854. Let t represent the time required for a single Montgomery modular multiplication; in this configuration, experimental results show t = 2.10 μs.

[0108] Step 2: Calculate M'

[0109] Since the modulus of all Montgomery modular multiplications in this scenario is M = n 2 Therefore, the caller is required to calculate and provide M' at the CPU. The calculation method is as follows: first, calculate the basis r = 2. m =2 24 Then, the modular inverse r of the basis with respect to the modulus M is calculated using the extended Euclidean algorithm. -1 Simulated element r -1 Satisfy rr -1 mod M = 1, and r -1 ∈[1,M); since M' needs to satisfy rr -1 -MM' = 1, therefore

[0110] Step 3: Modular Multiplication Unit Allocation

[0111] The input feature vector needs to be The vector dot product of (ciphertext) and parameter vector a (plaintext) is transformed into a modular multiplication. In Paillier homomorphic encryption, the ciphertext... With ciphertext The formula for addition between them is: Cipher The formula for multiplication between plaintext 'a' and plaintext 'a' is: Therefore, the ciphertext vector The formula for calculating the dot product with the plaintext vector a is:

[0112]

[0113] Note that this requires C multiplications of the ciphertext and plaintext, i.e., modular exponentiation. Furthermore, there are no data dependencies between the modular exponentiation operations, allowing for complete parallelism. The modular exponentiation operation uses a fast exponentiation algorithm, requiring two modular multiplication units for each exponentiation. Since the bit width of plaintext 'a' is l, iterations of l are required. Therefore, the total time required for the modular exponentiation part of the vector dot product is...

[0114]

[0115] After obtaining all the modular exponentiation results, the ciphertext results need to be summed, that is, the modular accumulation operation of C ciphertexts. Accumulation can achieve maximum parallelism through a tree structure, and the required number of modular multiplication units can be represented by a recursive formula. Let P... i Let represent the number of operations in the i-th level of the tree structure. Then, the number of modular multiplication units required in the i-th level is: Then we can obtain the recurrence relation. Where P0 = C, P k =2, where k is the number of levels in the tree structure. Therefore, the total modular multiplication time required for the modular multiplication part of the vector dot product is:

[0116] The total time required for vector dot product is:

[0117] Performance Result Comparison

[0118] The table below shows the performance improvement of the present invention compared to the existing Montgomery modular multiplication design in vector dot product based on Paillier homomorphic encryption. The total time required for the dot product can represent the throughput of the Montgomery modular multiplication design. Compared to design ① ([1] Zhang B, Cheng Z, Pedram M. An Iterative Montgomery Modular Multiplication Algorithm With Low Area-Time Product[J].IEEE Transactions on Computers, 2022.), the present invention can improve performance by 35.9%. Compared to design ② ([2] Mohammad-Hossein F, Siavash B, Hatameh M, et al. Hardware Architecture for Supersingular Isogeny Diffie-Hellman and Key Encapsulation Using a Fast Montgomery Multiplier[J].IEEE Transactions on Circuits and Systems I: Regular Papers, 2021.), the present invention can improve performance by 42.3%.

[0119]

[0120] The scope of protection of this invention is not limited to the above embodiments. Any variations and advantages that can be conceived by those skilled in the art without departing from the spirit and scope of this invention are included in this invention and are protected by the appended claims.

Claims

1. A method for improving the throughput of Montgomery modular multiplication using a cascaded DSP structure, characterized in that, The method utilizes an operand input and storage module, a loop controller module, and a pipelined multiplication operation module. The value multiplication and addition operation module and the comparison, correction and output module are implemented, including: Step 1: Using the operand input and storage module, convert the modular multiplication input multiplier... and and modulus The pre-computed inputs are stored in the circular queue memory of the operand input and storage module. Outer loop counter Initialize to 0; Step 2: Enter the outer loop. Circular queue output Inner loop counter Initialize to 0; Step 3: Enter the inner loop. and The circular queues output respectively and ; Step 4: The inner loop uses the parallel grouped cascaded digital signal processing unit (DSP) in the pipelined multiplication module for calculation. The intermediate result is obtained after the inner loop finishes. ; The base bit width; This is an intermediate result variable used to calculate the p value of the i-th outermost loop. Step 5: Calculate the required multi-cycle multiply-accumulate operation for the next outer loop using the multi-cycle multiply-accumulate operation module for the p-value. value; Step 6: After the outer loop finishes, use the multi-cycle subtractor in the Compare Correction and Output module to calculate... The value is output based on the result sign. or .

2. The method as described in claim 1, characterized in that, The result obtained from the modular multiplication operation is: ,in The requirement is that the number is odd, so take... satisfy ,in , For the base width, satisfy ,Right now for In the model Modular inverse, for In the model Negative modular inverse; take , This represents the number of iterations in the outer loop. satisfy ,Right now for In the model Modular inverse, Depend on and The generation is jointly determined and serves as an intermediate constant; the modular multiplication operation is a large integer modular multiplication, requiring the operands of the modular multiplication input to be... , and bit width Greater than or equal to .

3. The method as described in claim 1, characterized in that, Storage The output bit width of the circular queue memory for storage 、 and intermediate results is the word length. That is it is divided by the base bit width, 、 and by the word length; the base bit width and the word length depend on the multiplier bit width of the DSP, that is where and are the bit widths of the two input ports of the DSP's multiplier respectively, and are both integers.

4. The method as described in claim 1, characterized in that, In step two, the outer loop iterates the following number of times. The inner loop iterates the following number of times: , For bit width.

5. The method as described in claim 1, characterized in that, In step four, the parallel grouped cascaded DSP used is... Composed of DSPs; In each DSP, three DSPs are grouped together, and the DSPs within a group are directly cascaded. Only the last DSP in each group simultaneously enables both the multiplication register and the accumulation register; the remaining DSPs only enable the multiplication register. Each group of DSPs generates a partial product and a carry, and the carry generated by each group of DSPs is retained. The coefficient is the word length.

6. The method as described in claim 5, characterized in that, and Each use The first parallel group cascaded DSP will... Partial product and carry-left shift generated by parallel grouped cascaded DSPs The bit; then within one cycle, the carry-holding adder will... A parallel grouped cascaded DSP generated The addition of one addend is compressed into the addition of two numbers, while... The value is also compressed simultaneously; in the next cycle, the two compressed numbers are added together to obtain the final value. The result; the Inner iteration low in the results The position and the first The intermediate result of the next inner iteration Bit splicing is obtained and write The circular queue implements the handling of results. Right shift; This is the coefficient for the base bit width.

7. The method as described in claim 1, characterized in that, In step five, the inner loop requires 4 cycles per iteration: two cycles to calculate the parallel grouped cascaded DSP, one cycle for compressing partial products, and one cycle for calculating the final addition; the inner loop iterates the following number of times. , For bit width; the first in the inner loop The next iteration does not need to wait for the first... After the iteration ends, the start cycle interval for each iteration is 1; due to the right shift of m bits, an additional cycle is needed for writing after the inner loop ends. Additionally, one cycle is needed for the initialization of the inner loop, therefore the total clock cycle consumption of the inner loop is... .

8. The method as described in claim 1, characterized in that, In step five, The calculation formula is: ； Bit truncation is used instead of pair Modulo operation is transformed into a multiply-add operation and a multiplication operation, which is achieved by reusing the same multi-cycle multiplier. Before entering the outer loop, pre-calculate the requirements of the first loop. value; and in the first The outermost iteration calculates the computation required for the next iteration. ,because Only depend on low In the same outer iteration, the value is calculated in the inner loop. low After that, and The computations are completely parallel.

9. The method as described in claim 1, characterized in that, In step six, reuse storage A circular queue holds the results of multi-cycle subtractors. Stored in this circular queue.

10. A system for implementing the method as described in any one of claims 1-9, characterized in that, The system includes: an operand input and storage module, a loop controller module, and a pipelined multiplication operation module. The module for multiplying and adding values, as well as the module for comparison, correction, and output; The operand input and storage module is used to manage operand input, store operands and intermediate results, and provide the data required for each loop. The loop controller module includes an outer loop controller and an inner loop controller, wherein the outer loop controller controls the input operands. The output of the circular queue memory; the inner loop controller controls the input operands. and Intermediate results The input and output of the circular queue memory, as well as the pipeline for controlling single steps and computation; The pipelined multiplication module is used to calculate the single-step sum. It achieves partial accumulation and summation of the final result in the multiplication operation by using the carry-retaining adder CSA and the adder Adder. The The value multiplication and addition module uses a single The multiply-adder implements a bit width of Multiplication and addition and one Multiplication, calculation value; For the base width, For the length of the character; The comparison correction and output module is used to correct the final output. By comparing the result Z of the double loop with the modulus M, if Z is greater than or equal to M, then output ZM; otherwise, output M.

Images