Method and device for modular reduction operation

Abstract

The embodiments of the present specification provide a method and apparatus for modular reduction operation. In a business processing process based on secure computing, when a modular operation is performed on a given value x for the involved modulus (prime number), in the multiplication operation involved, the other multiplier can be processed by shifting, adding, etc. based on the redundant bits in one multiplier, and only the continuous non-overlapping bits in one multiplier are used as valid bits to implement the multiplication operation with the other multiplier through the DSP unit, thereby greatly reducing the online usage of the DSP unit and improving the efficiency of modular reduction.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of secure computing technology, and more particularly, to a method and apparatus for modular reduction operations in secure computing. Background Art

[0002] Operations involving privacy protection include privacy computing technologies such as homomorphic encryption, secret sharing, and post-quantum cryptography. Modular reduction algorithms are often used in privacy computing. Since the computing performance of privacy computing is lower than that of plaintext computing (such as a decrease of 4 to 5 orders of magnitude), in order to enable full homomorphic encryption to be used in actual scenarios, appropriate hardware is needed to accelerate its algorithms and applications.

[0003] Taking fully homomorphic encryption as an example, homomorphic operations of fully homomorphic encryption can include homomorphic addition, homomorphic multiplication, rescaling, relinearization, and rotation. Various homomorphic applications can be realized through the combination of these homomorphic operations, including homomorphic matrix multiplication, homomorphic neural networks, etc. Homomorphic operations are also composed of more basic operations at a lower level, which are performed on a polynomial in the ciphertext. Basic operations include modular multiplication, modular addition, modular subtraction, automorphism, fast number-theoretic transform (NTT) and its inverse transform (INTT).

[0004] Optimizing the underlying basic operations can produce more significant acceleration effects on homomorphic operations and homomorphic applications. Modular operations are the underlying operations in homomorphic encryption operations, among which modular reduction operations are widely used in modular multiplication, NTT / INTT and other operations. Modular reduction is a commonly used operation in modular operations, which is used to obtain the remainder after dividing a large number by a modulus. The purpose of modular reduction is to limit the result to a specific range, usually the range of non-negative integers, and is usually completed by polynomial long division. Conventional modular reduction algorithms include, for example, Montgomery modular reduction and Barrett modular reduction.

[0005] It can be understood that the essence of computer calculation is implemented by hardware circuits. For example, the modular reduction algorithm involves the use of resources such as DSP (digital signal processing), LUT (lookup table), and FF (Flip Flop, trigger). Taking Barrett modular reduction as an example, two multiplications (modular multiplication or multiplication and modular) operations are required. Among them, two multiplications require DSP resources, and other operations may only require LUT and FF resources. The DSP unit is a specific hardware unit in the FPGA dedicated to high-performance digital signal processing, which usually includes multipliers, accumulators and other digital signal processing related functions. The number of DSPs used in a single multiplication calculation is related to the number of data bits calculated. For example, for a DSP unit that supports 27×18-bit multiplication, 6 DSP units are required to calculate the multiplication of a 54-bit value by a 54-bit value. In the process of cryptographic calculation (such as homomorphic encryption operation), a large number of modular reduction operations may be involved. Optimizing the DSP resources used in modular reduction operations can improve the efficiency of business processing for secure computing based on fully homomorphic encryption, post-quantum cryptography, etc. Summary of the invention

[0006] One or more embodiments of the present specification describe a method and apparatus for a modular reduction operation to solve one or more problems mentioned in the background technology.

[0007] According to a first aspect, a method for a modular reduction operation is provided, which is used in a secure calculation, and for a given value x, a modular operation is performed on a first modulus, the method comprising: obtaining a modular reduction factor r1 corresponding to the first modulus; detecting at least one group of valid bits in the modular reduction factor r1, the valid bits being multiple consecutive bits including non-overlapping bits, and the non-overlapping bits being adjacent but different bits; calculating a first product of each group of valid bits and the given value x; merging the first product with each second product in sequence, and right-shifting the fusion result by a first number of bits to obtain a first reference factor, wherein a single second product is determined based on the given value x by performing a corresponding bit operation according to a corresponding single group of redundant bits, and the single group of redundant bits includes multiple consecutive overlapping bits; obtaining a second reference factor by subtracting a difference between the first reference factor and the third product of the first modulus from the given value x; and comparing the second reference factor with the first modulus to determine a modular reduction result of the given value x on the first modulus according to the comparison result.

[0008] In one embodiment, the modular reduction factor r1 is obtained by rounding down the quotient of 2 raised to the power of 2k divided by the first modulus, wherein the preset value k satisfies the following first condition: 2 raised to the power of k is greater than the first modulus.

[0009] In one embodiment, the calculation of the first product of each group of valid bits and the given value x is implemented by calling a DSP unit.

[0010] In one embodiment, the sequentially fusing the first product with each second product includes: respectively determining each bit position of the first product and the second product relative to the modular reduction factor r1; concatenating and adding the first product and the second product according to each bit position to obtain a fusion result.

[0011] In one embodiment, the first number is 2k.

[0012] In one embodiment, when a single group of redundant bits is s consecutive 1s, the corresponding single second product is determined by the following bit operation: shift the given value x to the left by s+1 bits in binary representation and fill the vacated bits with 0s, then subtract the given value x; when a single group of redundant bits is s consecutive 0s, the corresponding single second product is determined by the following bit operation: set each bit to 0; when a single group of redundant bits includes the dth bit 1 and several 0s, the corresponding single second product is determined by the following bit operation: shift the given value x to the left by d bits.

[0013] In one embodiment, the third product is determined by: detecting at least one group of valid bits in the first modulus, and calculating the fourth product of each group of valid bits and the given numerical value x; merging the fourth product with each fifth product in sequence, and shifting the fusion result right by a first number of bits in binary representation to obtain the third product, wherein a single fifth product is determined based on the given numerical value x by performing corresponding bit operations according to a corresponding single group of redundant bits of the first modulus.

[0014] In one embodiment, comparing the second reference factor with the first modulus to determine the modulus reduction result of the given value x to the first modulus according to the comparison result includes: when the second reference factor is less than the first modulus, determining the second reference factor as the modulus reduction result; when the second reference factor is greater than or equal to the first modulus, determining the difference between the second reference factor and the first modulus as the modulus reduction result.

[0015] According to a second aspect, a device for a modular reduction operation is provided, for use in a secure calculation, for performing a modular operation on a first modulus for a given value x, the device comprising:

[0016] An acquisition unit configured to acquire a modular reduction factor r1 corresponding to the first modulus;

[0017] A detection unit configured to detect at least one group of valid bits in the modular reduction factor r1, wherein the valid bits are a plurality of consecutive bits including non-overlapping bits, and the non-overlapping bits are adjacent different bits;

[0018] A first calculation unit is configured to calculate a first product of each group of valid bits and the given value x; and

[0019] Merge the first product with each second product in sequence, and right-shift the fusion result by a first number of bits to obtain a first reference factor, wherein a single second product is determined by performing a corresponding bit operation according to a corresponding single group of redundant bits based on the given value x, and the single group of redundant bits includes a plurality of consecutive overlapping bits;

[0020] A second calculation unit is configured to obtain a second reference factor by subtracting a difference between the first reference factor and a third product of the first modulus from the given value x;

[0021] The determination unit is configured to compare the second reference factor with the first modulus to determine a modular reduction result of the given value x to the first modulus according to the comparison result.

[0022] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in the first aspect.

[0023] According to a fourth aspect, a computing device is provided, comprising a memory and a processor, wherein an executable code is stored in the memory, and when the processor executes the executable code, the method described in the first aspect is implemented.

[0024] Through the method and device provided in the embodiments of this specification, in the process of business processing based on secure computing, for the modulus (prime number) involved, when a modulus operation is performed on a given value x, in the multiplication operation involved, bit processing such as shifting and adding can be performed on another multiplier based on the redundant bits in one multiplier, and only the continuous non-overlapping bits in one multiplier are used as valid bits to implement multiplication operations with another multiplier through a DSP unit, thereby greatly reducing the online usage of the DSP unit and improving the efficiency of modular reduction, thereby improving the business processing efficiency based on secure computing such as fully homomorphic encryption or post-quantum cryptography. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] To more clearly illustrate the technical solutions of the embodiments of the present invention, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0026] Figure 1 Shows a modulus schematic diagram in a specific implementation scenario;

[0027] Figure 2 Shows a flowchart of a modular reduction operation according to an embodiment;

[0028] Figure 3 Shows a schematic block diagram of a device for modular reduction operation according to an embodiment. Detailed implementation manners

[0029] The following describes the technical solutions provided in this specification with reference to the drawings.

[0030] The embodiments of this specification optimize computing resources based on the Barrett modular reduction algorithm. First, the Barrett modular reduction principle in the conventional technology is described.

[0031] Given a modulus n, where n is a natural number greater than or equal to 3 and n is not a multiple of 2 (for example, n is a prime number). Select a natural number k such that 2 k > n (that is, the minimum value of k can be the ceiling of log2n ). Thus, for a given modulus n, the modular reduction factor r = can be pre-computed. For a given number x (assuming 0 ≤ x < n 2 ), perform modular reduction of x modulo n, that is, calculate the remainder of x divided by n. At this time, t = can be calculated online. Usually, through r = and two floor operations, it can be determined how many moduli n are contained in x at most. However, since a critical value may be obtained in the first floor operation, the integer obtained in the second floor operation is not the maximum number of moduli contained in x. Therefore, the sizes of t and n can also be determined. Specifically, when t < n, t is the modulo result of x modulo n; otherwise, when t ≥ n, t - n is the modulo result of x modulo n. The proof process can refer to the records of common knowledge such as "https: / / blog.csdn.net / qq_57502075 / article / details / 130052118", and will not be elaborated here.

[0032] In the above process, the online calculation of a single modular reduction involves x×r and Two multiplication operations. Among them, Can be used It is implemented by cyclic shifting 2k bits to the right. Since one of the two multipliers in both multiplications is a pre-known number, namely the prime modulus (or modulus) n and the pre-calculated modulus reduction factor r, their values ​​depend on the parameters selected for a given homomorphic application. In homomorphic matrix multiplication, the number of values ​​of the prime modulus n is usually 1 to 2. In more complex businesses, the number of values ​​of the prime modulus n may be larger, such as more than 30. At this time, the prime modulus n can be generated in a predetermined regular pattern. For example, in a fully homomorphic encryption operation, a small prime modulus can be generated in the following way: ,in, represents the number of terms in the fully homomorphic encryption polynomial, represents the number of bits defined for the coefficients of the polynomial, and t represents the current prime number generation seed. The pre-calculated modular reduction factor is: .exist During the generation process, the value of t starts from 0 and increases by 1 successively, checking whether the generated value under a single t value is a prime number, until a predetermined number L of prime numbers are found. The predetermined number L is the number of times the modular reduction is performed, that is, the number of multiplication operations performed, and a single multiplication operation includes two multiplication processes. The execution efficiency of fully homomorphic encryption is closely related to the number of DSPs used for L multiplications. If you need to calculate the multiplication of L 54-bit numbers by 54-bit numbers, you need to use 6 DSP units to perform L corresponding multiplication operations.

[0033] like Figure 1 As shown, it is a =54, =2 16 Given the business need to improve the efficiency of multiplication operations, the multipliers in online multiplication operations are and Observe that the prime number of fully homomorphic encryption is Under the generation mechanism, the generated prime numbers are closer, and the prime numbers The binary representation of has a large number of consecutive "0" and "1" bits. Figure 1 In the example, the upper 30 bits of the 10 prime numbers are all 1, and the lower 15 bits are all 14 0s and the lowest bit is 1. In other words, the difference between the 10 prime numbers lies only in the middle 9 bits. Indicates the number of prime numbers contained in a given value. In practical applications, it is observed that modular reduction The binary representation of also has a large number of consecutive "0" and "1" bits.

[0034] Those skilled in the art will appreciate that if the binary form of a number n is split into multiple groups of consecutive bits, then: n = a·2 y + b·2 z +c, where c can be 0, coefficients a and b are the values ​​of the corresponding single group of bits, 2 y , 2 z are the multiples of the difference between the lowest bit of a single group of bits and the lowest bit in the binary representation of n, or in other words, y and z are the number of bits that the binary bits are shifted left relative to the lowest bit of n. As an example, the binary number m = "11110001" can be split into a = 1111 = 10000-00001 (the binary number 10000 is 2 5 ), y=4, b=0001, z=0, c=0, so the product of a number x and n can be expressed as: xn=ax·2 y + bx·2 z +cx. That is, in binary, the product of x and n can be split into multiple groups of bits and multiplied with x respectively. Among them, the operation of a and x is performed by shifting x to the left by the corresponding number of bits (such as 5 bits) and subtracting, and the multiplication of b and x is x itself.

[0035] Furthermore, combined with the characteristics of binary multiplication, at least Figure 1 The high 30 bits and low 15 bits of each prime number shown are calculated separately. For example, the value of the high 30 bits is 30 consecutive 1s, which can be regarded as 2 31 -1. The product of a number x and a number with all 1s on 30 bits is: x×2 31 -x, that is, shift the binary representation of x left by 31 bits and then subtract x. The lower 15 bits contain multiple consecutive 0s and a 1 (or 14 consecutive 0 bits and a 1 bit), so the product of a number x and the lower 15 bits is itself. The product of the upper 30 bits and the lower 15 bits and another multiplier x is, for example, each recorded as a second product. For the middle 9 bits, the multiplication calculation with another multiplier x can be implemented using a DSP unit to obtain the corresponding product result. Let the calculation result be recorded as the first product, then the first product can be fused between the two second products in the bit corresponding order, and the multiplication result of the value x and the prime number n can be obtained.

[0036] That is to say, the continuous multiple bits (continuous non-overlapping bits) that are different between single prime numbers can be used as valid bits for multiplication operations, and other continuous identical bits (redundant bits) can be split out and operated through shifting and subtraction, thereby greatly saving the bit width occupied by multiplication operations. For example, Figure 1The multiplication operation of the 54-bit value shown can be converted into the multiplication operation of the 9-bit value. When using a DSP unit that supports 27 * 18-bit wide multiplication (such as the DSP48E2 used by Xilinx's FPGA development board), 2 DSP units can be used to process a 54-bit number multiplied by a 9-bit number, which is less than the 6 DSP units required to multiply two 54-bit wide numbers. Finally, the Barrett modular reduction process can only require 4 DSP units instead of the original 12 (two multiplications, 6×2) DSP units, which can greatly reduce the number of DSP units used.

[0037] The following is combined with Figure 2 , Attachment Figure 3 The technical concept of this specification is described in detail with reference to the embodiments shown in the figure.

[0038] Figure 2 The process of a modular reduction operation according to an embodiment is shown. The execution subject of the process can be any computer, device, or server with certain computing capabilities, such as a single data party in a multi-party secure computing architecture. The process can be an online modular reduction process.

[0039] As a specific example, the modular reduction process provided in the embodiments of this specification can be used in secure computing to use any one of the L moduli (hereinafter referred to as the first modulus) to perform a modular operation on a given value x. The L moduli can be prime numbers generated based on a predetermined rule in secure computing. For example, in fully homomorphic encryption computing, according to the size of the polynomial and the number of digits of the polynomial coefficients The generated prime numbers are as follows. . In the process of generating prime numbers, t is used as a seed to detect whether the value generated according to the predetermined rules is prime. If so, it is retained, otherwise it is discarded. By changing the value of t, a predetermined number (not less than L) of prime numbers are generated. In practice, when t changes continuously (such as increasing by 1 each iteration based on the initial value), the generated prime numbers are closer. In each prime number represented in binary, the values ​​on multiple bits may be similar, and the values ​​on some bits may be different. Each prime number can be generated in advance or online, which is not limited here. The L moduli are part or all of the prime numbers generated under the unified rule.

[0040] like Figure 2As shown, according to an embodiment, the process of the modular reduction operation may include the following steps: step 201, obtaining a modular reduction factor r1 corresponding to a first modulus; step 202, detecting at least one group of valid bits in the modular reduction factor r1, where the valid bits are multiple continuous bits including non-overlapping bits, and the non-overlapping bits are adjacent but different bits; step 203, calculating the first product of each group of valid bits and a given value x; step 204, merging the first product with each second product in sequence, and right shifting the fusion result by a first number of bits to obtain a first reference factor, wherein a single second product is determined based on the given value x by performing a shift operation according to a corresponding single group of redundant bits, and the single group of redundant bits includes multiple continuous and consistent bits; step 205, using the given value x to subtract the difference between the first reference factor and the third product of the first modulus to obtain a second reference factor; step 206, comparing the second reference factor with the first modulus to determine the modular reduction result of the given value x to the first modulus according to the comparison result.

[0041] First, in step 201, a modular reduction factor r1 corresponding to a first modulus is obtained.

[0042] Here, the first modulus may be any modulus for performing a modular reduction operation, such as one of the moduli in a fully homomorphic encryption calculation process. More specifically, Figure 1 The first modulus may generally be a prime number, such as n1.

[0043] The modular reduction factor is a factor used to determine the multiple relationship between a given value and the current modulus during the modular reduction process. The modular reduction factor corresponding to the first modulus is denoted as r1. According to the modular reduction principle, r1 is determined by, for example, 2k The ratio of the first modulus n is rounded down, such as r1= . Where k is a pre-set natural number, usually 2 k >n1, so that 2 2k Much larger than n1, so that the modular reduction factor r1 can have non-zero values ​​on multiple bits and produce significant differences for different n1, and can adapt to a wider range of numerical values ​​x. The modular reduction factor r1 can be calculated using conventional calculation methods, such as calling a corresponding multiplication operator for calculation.

[0044] In order to save computing resources for online business processing and improve computing efficiency, the modular reduction factor r1 can be pre-calculated before the modular reduction operation is performed, or calculated by other devices. Thus, in this step 201, the modular reduction factor r1 can be directly obtained.

[0045] Next, through step 202, at least one group of valid bits in the modular reduction factor r1 is detected, where the valid bits are a plurality of continuous bits including non-overlapping bits, and the non-overlapping bits are adjacent but different bits.

[0046] According to the technical concept of this specification, when the modular reduction factor r1 is used as a multiplier for multiplication calculation, the modular reduction factor r1 can be bit-split. The bit-split of the modular reduction factor r1 can refer to Figure 1 The modulus shown is based on overlapping bits and continuous non-overlapping bits. For ease of description, non-overlapping bits may be referred to as valid bits. Specifically, valid bits in the modulus reduction factor r1 may be detected first. Generally, when there are different values ​​on adjacent bits, they may be referred to as non-overlapping bits.

[0047] according to Figure 1 As can be seen from the specific example shown, non-overlapping bits and overlapping bits may be distributed at intervals. Therefore, in order to better utilize computing resources, the bits within a predetermined length of bits where non-overlapping bits are concentrated can be determined as a group of continuous non-overlapping bits, and the valid bits can include one or more groups of continuous non-overlapping bits. Here, the predetermined number can be related to the bit width processed by the DSP unit. For example, for a DSP unit supporting a 27×18 bit width, the predetermined length can be 9. Figure 1 As shown, among the middle 9 bits of the numerical value represented by the first row, the values ​​of the 9 bits include both 0 and 1. When the predetermined length is 9, the bits included therein may also include adjacent identical values, such as multiple consecutive 1s (consecutive overlapping bits).

[0048] It is understandable that, when the current service requires continuous modular reduction operations on multiple moduli, according to the moduli generation rules, there may be adjacent moduli with similar values, and the non-overlapping bits of each modulus are distributed more concentratedly. Therefore, in some embodiments, multiple (such as L) moduli can be divided into continuous non-overlapping bits. Figure 1 As shown, it is found that the non-overlapping bits of each modulus are concentrated on the middle 9 bits shown in the figure, so the 9 bits can be regarded as a group of continuous non-overlapping bits.

[0049] In addition, other bits separated by continuous non-overlapping bits can be used as redundant bits. Redundant bits can be bits containing multiple continuous overlapping bits. Figure 1 As shown, the two groups of redundant bits can be the first 30 bits and the last 15 bits. Similar to the modulus, the reduction factor can also be used Figure 1 In the case of similar moduli, the modulus reduction factors determined based on the moduli may also be similar. In this case, the modulus reduction factors of each modulus can also be used to separate the continuous non-overlapping bits and the redundant bits.

[0050] Then, in step 203, first products of each group of valid bits and a given value x are calculated.

[0051] According to the technical concept of this specification, when the effective bits are used as multipliers, it is difficult to implement multiplication operations through simple bit operations such as shift or addition. Therefore, the DSP unit can be used to calculate the product of the effective bits in the first modular reduction factor and the given value x. A single group of effective bits can correspond to a single product, hereinafter referred to as the first product. When there are multiple groups of consecutive non-overlapping bits in the effective bits, multiple first products can be obtained, which will not be repeated here.

[0052] Next, in step 204, the first product is fused with each second product, and the fused result is right-shifted by a first number of bits to obtain a first reference factor.

[0053] The single second product may be based on the product of a given value x and a single group of redundant bits. It is understood that a single group of redundant bits may include a plurality of consecutive bits of 0 or 1. For a plurality of consecutive 0s, the product thereof and the value x is still 0, and the product of a single 1 and the value x is 1. The product of h consecutive 1s and the value x can be obtained by using x×(2 h+1 -1) is determined, and x×2 h+1 This can be achieved by shifting h+1 bits to higher bits. Therefore, in the case where a single group of redundant bits is a plurality of consecutive 0s, a single second product can be a plurality of bits of 0s. In the case where a single group of redundant bits is a plurality of consecutive 1s, a single second product can be achieved by shifting and subtracting, which will not be described in detail here. In an optional embodiment, a single group of redundant bits can also include a plurality of 0s and a 1 on the dth bit from low to high bits. In this case, the given value x can be shifted d bits to the left in binary representation to obtain the corresponding single second product. Figure 1 As shown, the single group of redundant bits corresponding to the last 15 bits includes 14 high bits of 0 and 1 of the 0th bit (the lowest bit), then the single second product of the single group of redundant bits and the value x is the binary representation of x (left shifted by 0 bits).

[0054] Generally, the number of binary bits of a single second product obtained by shifting a group of redundant bits and a value x may be less than, equal to, or greater than the group of redundant bits. Similarly, the number of bits of the first product may also be less than, equal to, or greater than the corresponding group of continuous non-overlapping bits. In the case where both the first product and the second product are less than the corresponding group of redundant bits or the corresponding group of continuous non-overlapping bits, the first products and the second products may be fused in a splicing manner according to the arrangement order of the corresponding group of redundant bits or the corresponding group of continuous non-overlapping bits. In the case where there is a product of the number of bits in the first product and the second product that exceeds the product of the corresponding group of redundant bits or the corresponding group of continuous non-overlapping bits, the bit positions of the first product and the second product corresponding to the modulo reduction factor may be determined first, and then the first products and the second products may be added according to the corresponding bit positions. Optionally, the first product and the second product may be bit-filled, that is, the low-order bits are filled with 0 according to the positions of the corresponding group of redundant bits or the corresponding group of continuous non-overlapping bits in the modular reduction factor. In this way, it is equivalent to setting r1=a·2 y + b·2 z +c, xr1=ax·2 y + bx·2 z +cx multiplies the corresponding term by the coefficient 2 by shifting y and 2 z .

[0055] For example, x=68, which is 1000100 in binary form, and r1 is Figure 1The values ​​in the first row of , include 30 redundant bits with bit value 1 (such as the first group of redundant bits), 9 valid bits (11010111, such as a group of continuous non-overlapping bits), 14 redundant bits with bit value 0 and one bit with value 1 (such as the second group of redundant bits), then the products of x and r1 include: the second product of the first group of redundant bits and x; the first product of the second product of continuous non-overlapping bits and x; the second product of the second group of redundant bits and x. The single second product of the first group of redundant bits and x is determined by shifting x left by 31 bits and then subtracting x, such as: 1000100 00 0000 0000 0000 0000 0000 0000 0000 0000-1000100=100001111 1111 1111 1111 1111 1111 1101 1100 (greater than 30 bits). The first product of the consecutive non-overlapping bits 11010111 (decimal number 215) and x is: 11 1001 0001 1100 (greater than 9 bits). The single second product of the second group of redundant bits and x is x itself (000 0000 0100 0100). When merging, bit alignment is considered. In a specific example, the upper 5 bits "11 100" of the second product and the lower 5 bits "1 1100" of the single second product of the first group of redundant bits and x can be aligned and added (for example, 1000011 11 1111 1111 1111 1111 1111 1111 1000 1 00011100), and then concatenated with the single second product of the second group of redundant bits and x, 000 0000 0100 0100. The fusion result is 1000011 11 1111 1111 1111 1111 1111 1000 1 0001 1100 000 0000 0100 0100. In another specific example, 15+9=24 zeros may be added after the single second product of the first group of redundant bits and x, and 15 zeros may be added after the first product, which is then added to the single second product of the second group of redundant bits and x to obtain a fused result.

[0056] The fusion result of the first product and the second product is the product of x and r1. Further, according to the modular reduction principle, a first number (such as 2k) of bits can be shifted rightward for the fusion result, and the overflowed bits are discarded to achieve The first reference factor r is obtained by rounding down 11 = In the above example, assuming k=55, the last 55*2 bits are discarded to get: 0. This is because x is much smaller than n1, and the number of integers n1 contained in x is 0. Usually, when x>n1, a first reference factor greater than 0 can be obtained.

[0057] In a possible design, each first product and second product may be right-shifted by 2k bits and then merged together. Before right-shifting, the coefficients during splitting need to be considered and the corresponding number of bits of 0 are supplemented in the low position, which will not be elaborated here.

[0058] In summary, in the calculation During the process, only the multiplication of x and a group of consecutive non-overlapping bits (such as 9 bits) is calculated, which is much smaller than the number of bits of the modular reduction factor (such as 54), thereby saving the usage of online DSP units.

[0059] Further, according to step 205, the second reference factor is obtained by subtracting the difference obtained by multiplying the first reference factor and the first modulus from the given value x.

[0060] It can be understood that the presence of a large number of redundant bits in the modular reduction factor corresponding to the modulus usually selected for fully homomorphic encryption is related to the presence of a large number of redundant bits in the first modulus. In the process of determining the third product of the first reference factor and the first modulus, the first modulus can be predetermined data, and the first reference factor is data determined in the current process (such as in step 204). In the case where there are a large number of redundant bits in the first modulus, they can be grouped to divide them into several consecutive non-overlapping bits and redundant bits. For the redundant bits in the first modulus, the corresponding product with the first reference factor can be determined by shifting, adding, etc. For the consecutive non-overlapping bits in the first modulus, the DSP unit can be used to calculate the corresponding product with the first reference factor, and then the products of each part are fused. In a possible design, the calculation of the first reference factor r 11 The process of calculating the third product with the first modulus n1 is similar to the process of calculating the product of x and r1 in the previous text, and will not be repeated here. In this way, the consumption of DSP resources can be greatly reduced.

[0061] According to the modular reduction principle, the second reference factor (denoted as r 12 ) is the subtraction of the given value x and the third product, which is equivalent to subtracting an integer number of n1. According to the previous description, the first reference factor can describe the number of first moduli n1 contained in the given value x. However, due to the two roundings involved, the number of n1 may be undercounted (at most 1), so the subtraction of the given value x and the third product can be used as a reference value rather than a modular reduction result.

[0062] Then, through step 206, the second reference factor is compared with the first modulus to determine the modular reduction result of the given value x to the first modulus according to the comparison result.

[0063] As described above, the second reference factor r 12 A comparison is performed with the first modulus n1 to determine a modular reduction result of the given value x on the first modulus according to the comparison result.

[0064] Specifically, when the second reference factor is smaller than the first modulus, the second reference factor r 12 Determined as a modular reduction result, when the second reference factor is greater than or equal to the first modulus, the second reference factor r 12 The difference minus the first modulus n1 is determined as the modular reduction result.

[0065] Reviewing the above process, the method provided in the embodiments of this specification, in the business processing process of privacy-preserving computing based on homomorphic encryption, for the modulus (prime number) involved, when performing a modulus operation on a given value x, in the multiplication operation involved, the redundant bits in one multiplier can be used to perform bit processing such as shifting and adding on another multiplier, and only the continuous non-overlapping bits in one multiplier are used as valid bits to implement multiplication operations with another multiplier through a DSP unit, thereby greatly reducing the online usage of the hardware DSP unit, improving the efficiency of modular reduction, and improving computing performance and business processing efficiency.

[0066] According to another embodiment, a modular reduction operation device is also provided, which is used in secure computing to perform a modular operation on a first modulus for a given value x. The modular reduction operation device can be provided on any computer, device, or server with a certain computing capability.

[0067] like Figure 3 As shown, the apparatus 300 for performing a modular reduction operation may include:

[0068] An acquisition unit 301 is configured to acquire a modular reduction factor r1 corresponding to the first modulus;

[0069] A detection unit 302 is configured to detect at least one group of valid bits in the modular reduction factor r1, where the valid bits are a plurality of consecutive bits including non-overlapping bits, where the non-overlapping bits are adjacent but different bits;

[0070] A first calculation unit 303 is configured to calculate a first product of each group of valid bits and a given value x; and

[0071] Merge the first product with each second product in sequence, and right-shift the fusion result by a first number of bits to obtain a first reference factor, wherein the single second product is determined by performing a corresponding bit operation according to a corresponding single group of redundant bits based on a given value x, and the single group of redundant bits includes a plurality of consecutive and consistent bits;

[0072] The second calculation unit 304 is configured to obtain a second reference factor by subtracting a difference between the first reference factor and the third product of the first modulus from a given value x;

[0073] The determination unit 305 is configured to compare the second reference factor with the first modulus to determine a modular reduction result of the given value x to the first modulus according to the comparison result.

[0074] The modular reduction factor r1 is obtained by rounding down the quotient of 2 raised to the power of 2k divided by the first modulus, and the preset value k satisfies the following first condition: 2 raised to the power of k is greater than the first modulus.

[0075] According to one embodiment, the first calculation unit 303 may implement the first product calculation of each group of effective bits and a given value x by calling a DSP unit.

[0076] In one embodiment, the first calculation unit 303 may be configured to sequentially fuse the first product with each second product in the following manner:

[0077] Determine the bit positions of the first product and the second product relative to the modular reduction factor r1 respectively;

[0078] The first product and the second product are concatenated and added according to each bit position to obtain a fusion result.

[0079] In one embodiment, the first number is 2k.

[0080] It is understandable that:

[0081] In the case where a single group of redundant bits is s consecutive 1s (s is a natural number greater than or equal to 2), the corresponding single second product is determined by: shifting the given value x to the left by s+1 bits in binary representation and filling the vacated bits with 0s, then subtracting the given value x;

[0082] In the case where a single group of redundant bits is s consecutive 0s, the corresponding single second product is determined by the following bit operations: each bit is set to 0;

[0083] In the case where a single group of redundant bits includes the d-th bit 1 and several 0s, the corresponding single second product is determined by the following bit operation: shifting the given value x to the left by d bits in binary representation.

[0084] According to a possible design, the second calculation unit 304 may be configured to determine the third product in the following manner:

[0085] Detect at least one group of valid bits in the first modulus, and calculate fourth products of each group of valid bits and a given value x;

[0086] The fourth product is sequentially merged with each fifth product, and the fusion result is right-shifted by a first number of bits in binary representation to obtain a third product, wherein a single fifth product is determined based on the first reference factor by performing corresponding bit operations (such as shifting, adding, etc.) according to a corresponding single group of redundant bits of the first modulus.

[0087] According to some optional implementations, the determining unit 305 may be further configured to:

[0088] In the case where the second reference factor is less than the first modulus, determining the second reference factor as a modulus reduction result;

[0089] When the second reference factor is greater than or equal to the first modulus, a difference between the second reference factor and the first modulus is determined as a modulus reduction result.

[0090] It is worth mentioning that Figure 3 The device 300 shown is Figure 2 The method described corresponds to Figure 2 The corresponding description in the illustrated method embodiment is also applicable to the device 300 and will not be repeated here.

[0091] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 2 The method described by et al.

[0092] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 2 The method described by et al.

[0093] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the embodiments of this specification can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0094] The specific implementation methods described above further explain in detail the purpose, technical solutions and beneficial effects of the technical concept of this specification. It should be understood that the above description is only the specific implementation method of the technical concept of this specification, and is not used to limit the protection scope of the technical concept of this specification. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the embodiments of this specification should be included in the protection scope of the technical concept of this specification.

Claims

1. A method for a modular reduction operation, for use in secure computing, for a given value x, performing a modular operation on a first modulus, the method comprising: Obtaining a modular reduction factor r1 corresponding to the first modulus, wherein the modular reduction factor r1 is obtained by rounding down a quotient of 2 to the power of 2k divided by the first modulus, wherein a preset value k satisfies the following first condition: 2 to the power of k is greater than the first modulus; Detecting at least one group of valid bits in the modular reduction factor r1, wherein the valid bits are a plurality of consecutive bits including non-overlapping bits, and the non-overlapping bits are adjacent but different bits; Calculate the first product of each group of valid bits and the given value x respectively by calling the DSP unit; Merge the first product with each second product in sequence, and right-shift the fusion result by a first number of bits to obtain a first reference factor, wherein a single second product is determined by performing a corresponding bit operation according to a corresponding single group of redundant bits based on the given value x, and the single group of redundant bits includes a plurality of consecutive overlapping bits; subtracting a difference between the first reference factor and a third product of the first modulus from the given value x to obtain a second reference factor; The second reference factor is compared with the first modulus to determine a modular reduction result of the given value x to the first modulus according to the comparison result.

2. The method of claim 1, wherein: The sequentially fusing the first product with each second product comprises: Respectively determine bit positions of the first product and the second product relative to the modular reduction factor r1; The first product and the second product are concatenated and added according to each bit position to obtain a fusion result.

3. The method of claim 1, wherein: The first number is 2k.

4. The method of claim 1, wherein: In the case where a single group of redundant bits is s consecutive 1s, the corresponding single second product is determined by the following bit operation: shifting the given value x to the left by s+1 bits in binary representation and filling the vacated bits with 0s, and then subtracting the given value x; In the case where a single group of redundant bits is s consecutive 0s, the corresponding single second product is determined by the following bit operations: each bit is set to 0; In the case where a single group of redundant bits includes the dth bit 1 and several 0s, the corresponding single second product is determined by the following bit operation: the given value x is shifted left by d bits in binary representation.

5. The method of claim 1, wherein: The third product is determined by: Detect at least one group of valid bits in the first modulus, and calculate fourth products of each group of valid bits and the given value x; The fourth product is sequentially merged with each fifth product, and the fusion result is right-shifted by a first number of bits in binary representation to obtain the third product, wherein a single fifth product is determined based on the first reference factor by performing corresponding bit operations according to a corresponding single group of redundant bits of the first modulus.

6. The method of claim 1, wherein: The step of comparing the second reference factor with the first modulus to determine the modular reduction result of the given value x to the first modulus according to the comparison result includes: In the case where the second reference factor is less than the first modulus, determining the second reference factor as the modulus reduction result; When the second reference factor is greater than or equal to the first modulus, a difference between the second reference factor and the first modulus is determined as the modulus reduction result.

7. A device for modular reduction operation, used in secure computing, for performing a modular operation on a first modulus for a given value x, the device comprising: an acquisition unit, configured to acquire a modular reduction factor r1 corresponding to the first modulus, wherein the modular reduction factor r1 is obtained by rounding down a quotient of 2 to the power of 2k divided by the first modulus, wherein a preset value k satisfies the following first condition: 2 to the power of k is greater than the first modulus; A detection unit configured to detect at least one group of valid bits in the modular reduction factor r1, wherein the valid bits are a plurality of consecutive bits including non-overlapping bits, and the non-overlapping bits are adjacent different bits; A first calculation unit, configured to calculate the first product of each group of valid bits and the given value x by calling the DSP unit; and Merge the first product with each second product in sequence, and right-shift the fusion result by a first number of bits to obtain a first reference factor, wherein a single second product is determined by performing a corresponding bit operation according to a corresponding single group of redundant bits based on the given value x, and the single group of redundant bits includes a plurality of consecutive overlapping bits; A second calculation unit is configured to obtain a second reference factor by subtracting a difference between the first reference factor and a third product of the first modulus from the given value x; The determination unit is configured to compare the second reference factor with the first modulus to determine a modular reduction result of the given value x to the first modulus according to the comparison result.

8. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 6.

9. A computing device comprising a memory and a processor, characterized in that: The memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 6 is implemented.

Images