Multi-scalar multiplication operation method, device, equipment and storage medium

Abstract

A multi-scalar multiplication operation method, device, equipment and storage medium are disclosed, and belong to the technical field of cryptography. The method comprises the following steps: dividing an original operation task into a plurality of sub-operation tasks, each sub-operation task comprising a plurality of point multiplication operations, and an elliptic curve point in each point multiplication operation corresponding to a sub-scalar; filling a plurality of elliptic curve points into a plurality of bucket points, and in the case that two elliptic curve points both need to be filled into a first bucket point, adding the two elliptic curve points as one to-be-point-addition operation into a first-level storage sequence; when there are N to-be-point-addition operations in the first-level storage sequence, executing the N to-be-point-addition operations in parallel based on a SIMD instruction to obtain N first point addition results; writing the N first point addition results back to the corresponding bucket points; performing bucket point aggregation on each sub-task, and based on the result of the bucket point aggregation, obtaining an operation result of the original operation task. The method can accelerate the operation process of multi-scalar multiplication on a CPU platform.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of cryptography, and particularly relates to a multi-scalar multiplication method and device, equipment and storage medium. BACKGROUND

[0002] Multi-scalar multiplication is an important part of zero-knowledge proof. In the related art, multi-scalar multiplication is usually performed on an FPGA (Field-Programmable Gate Array) or GPU (Graphics Processing Unit) platform. However, the cost of such hardware as FPGA or GPU is high, and it is difficult to popularize to all users. SUMMARY

[0003] The present disclosure provides a multi-scalar multiplication method, device, equipment and storage medium, which can implement multi-scalar multiplication on a CPU (Central Processing Unit) platform. The technical solution at least includes the following solutions:

[0004] In a first aspect, a multi-scalar multiplication method is provided for accelerating the operation process of the multi-scalar multiplication on a CPU (Central Processing Unit) platform, comprising: dividing a large-scale elliptic curve multi-scalar multiplication original operation task into a plurality of sub-operation tasks, each of the sub-operation tasks including a plurality of point multiplication operations, each of the point multiplication operations including a sub-scalar and an elliptic curve point, and the elliptic curve point in each of the point multiplication operations corresponding to the sub-scalar; based on the sub-scalars corresponding to the plurality of elliptic curve points, filling the plurality of elliptic curve points into a plurality of bucket points, wherein, in the case that two elliptic curve points both need to be filled into a first bucket point, the two elliptic curve points are added to a first storage sequence as a to-be-point-added operation, and the first bucket point is any one of the plurality of bucket points; when there are N to-be-point-added operations in the first storage sequence, performing the N to-be-point-added operations in parallel based on a SIMD (Single Instruction, Multiple Data) instruction to obtain N first point-added results; writing the N first point-added results back to the corresponding bucket points; after the elliptic curve points in the plurality of point multiplication operations of any one of the sub-operation tasks are all filled into the bucket points, performing bucket point aggregation; based on the results of the bucket point aggregation of each of the sub-operation tasks, obtaining an operation result of the original operation task.

[0005] Optionally, the writing back the N first point addition results into corresponding bucket points comprises: for a second point addition result, adding a point addition operation of the second point addition result and a second bucket point as a to-be-point-added operation into the secondary storage sequence, the second point addition result being any one of the N first point addition results, and the second bucket point being a bucket point corresponding to the second point addition result; when there are at least N to-be-point-added operations in the secondary storage sequence, performing the first N to-be-point-added operations in the secondary storage sequence in parallel based on a SIMD instruction to obtain N third point addition results; and updating values of corresponding bucket points based on the N third point addition results to realize the writing back of the N first point addition results into the corresponding bucket points.

[0006] Optionally, in the secondary storage sequence, performing the first N to-be-point-added operations in the secondary storage sequence once indicates that a round of operations of the secondary storage sequence is completed, and if a bucket point in the at least two to-be-point-added operations in the secondary storage sequence in the Ith round of operations is a third bucket point, the third bucket point being any one of the plurality of bucket points, the writing back of the N first point addition results into the corresponding bucket points comprises: when the bucket point in the K to-be-point-added operations in the secondary storage sequence in the Ith round of operations is the third bucket point, K being greater than or equal to 2 and K being an even number, taking every two first point addition results in the K to-be-point-added operations as a to-be-point-added operation to construct 0.5K to-be-point-added operations in the secondary storage sequence in the Ith round of operations; after the Ith round of operations is performed, adding operation results of the 0.5K to-be-point-added operations and the third bucket point as a to-be-point-added operation into the secondary storage sequence respectively, and waiting for an (I+1)th round of operations; wherein I is a positive integer.

[0007] Optionally, the writing back of the N first point addition results into the corresponding bucket points further comprises: when the bucket point in the K to-be-point-added operations in the secondary storage sequence in the Ith round of operations is the third bucket point, K being greater than or equal to 2 and K being an odd number, taking every two first point addition results in the first K-1 to-be-point-added operations as a to-be-point-added operation to construct 0.5(K-1) to-be-point-added operations in the secondary storage sequence in the Ith round of operations; after the Ith round of operations is performed, adding operation results of the 0.5(K-1) to-be-point-added operations and the third bucket point as a to-be-point-added operation into the secondary storage sequence respectively, and waiting for the (I+1)th round of operations.

[0008] Optionally, after the elliptic curve points in the plurality of point multiplication operations of any one of the sub-operation tasks are all filled into the bucket points, the bucket points are aggregated, comprising: aggregating the bucket points of the jth sub-operation task by using the following formula:

[0009]

[0010] wherein G j is the jthsub-operation task, B l denotes the lthbucket point, and l is an integer.

[0011] In a second aspect, a multi-scalar multiplication operation device is provided for accelerating the operation process of the multi-scalar multiplication on a central processing unit (CPU) platform. The device comprises a splitting module configured to split an original operation task of a large-scale elliptic curve multi-scalar multiplication into a plurality of sub-operation tasks, each of the sub-operation tasks comprising a plurality of point multiplication operations, each of the point multiplication operations comprising a sub-scalar and an elliptic curve point, and the elliptic curve point in each of the point multiplication operations corresponding to the sub-scalar; a first bucket filling module configured to fill a plurality of elliptic curve points into a plurality of bucket points based on sub-scalars corresponding to the plurality of elliptic curve points, wherein, in a case where two elliptic curve points both need to be filled into a first bucket point, the two elliptic curve points are added into a primary storage sequence as one pending point addition operation, and the first bucket point is any one of the plurality of bucket points; a point addition operation module configured to, when there are N pending point addition operations in the primary storage sequence, perform the N pending point addition operations in parallel based on a SIMD instruction to obtain N first point addition results; a second bucket filling module configured to write the N first point addition results back to corresponding bucket points; a bucket point aggregation module configured to, after the elliptic curve points in the plurality of point multiplication operations of any one of the sub-operation tasks are all filled into bucket points, perform bucket point aggregation; and an operation module configured to obtain an operation result of the original operation task based on a result of the bucket point aggregation of each of the sub-operation tasks.

[0012] Optionally, the second bucket filling module is further configured to, for a second point addition result, add a point addition operation of the second point addition result and a second bucket point into a secondary storage sequence as one pending point addition operation, the second point addition result being any one of the N first point addition results, and the second bucket point being a bucket point corresponding to the second point addition result; when there are at least N pending point addition operations in the secondary storage sequence, perform the first N pending point addition operations in the secondary storage sequence in parallel based on a SIMD instruction to obtain N third point addition results; and update values of corresponding bucket points based on the N third point addition results to realize writing the N first point addition results back to the corresponding bucket points.

[0013] Optionally, in the secondary storage sequence, the first N point addition operations in the secondary storage sequence are performed in parallel, indicating that a round of operations of the secondary storage sequence is completed, and if the bucket point of at least two point addition operations in the Ith round of operations of the secondary storage sequence is a third bucket point, the third bucket point being any one of the plurality of bucket points, the second bucket filling module is further configured to: when there are K point addition operations in the Ith round of operations of the secondary storage sequence, the bucket point of which is a third bucket point, K being greater than or equal to 2 and K being an even number, the first point addition result in the K point addition operations is taken as one point addition operation every two first point addition results to construct 0.5K point addition operations in the Ith round of operations of the secondary storage sequence; after the Ith round of operations is completed, the operation results of the 0.5K point addition operations are added to the secondary storage sequence as one point addition operation with the third bucket point respectively, and the (I+1)th round of operations is waited; wherein I is a positive integer.

[0014] Optionally, the second bucket filling module is further configured to: when there are K point addition operations in the Ith round of operations of the secondary storage sequence, the bucket point of which is a third bucket point, K being greater than or equal to 2 and K being an odd number, the first point addition result in the first K-1 point addition operations is taken as one point addition operation every two first point addition results to construct 0.5(K-1) point addition operations in the Ith round of operations of the secondary storage sequence; after the Ith round of operations is completed, the operation results of the 0.5(K-1) point addition operations are added to the secondary storage sequence as one point addition operation with the third bucket point respectively, and the (I+1)th round of operations is waited.

[0015] Optionally, the bucket point aggregation module is further configured to implement the bucket point aggregation of the jth sub-operation task by using the following formula:

[0016]

[0017] wherein G j is the jth sub-operation task, B l represents the lth bucket point, and l is an integer.

[0018] In a third aspect, a computer device is also provided, which includes a memory and a processor, and at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor, so as to execute the multi-scalar multiplication operation method described in the above embodiments.

[0019] In a fourth aspect, a computer readable storage medium is also provided, and at least one computer program is stored in the computer readable storage medium, and the at least one computer program is loaded and executed by a processor, so as to execute the multi-scalar multiplication operation method described in the above embodiments.

[0020] In a fifth aspect, a computer program product is provided, comprising computer programs / instructions which, when executed by a processor, implement the method of the first aspect.

[0021] The technical scheme provided by the embodiments of the present disclosure has at least the following beneficial effects:

[0022] In the embodiments of the present disclosure, the N-point addition operation in the multi-scalar multiplication is implemented in parallel through the SIMD instruction set, effectively improving the running efficiency of the multi-scalar multiplication. In addition, the architecture in the embodiments of the present disclosure is applicable to the CPU platform, so that the multi-scalar multiplication is not limited to the hardware such as FPGA or GPU, effectively improving the universality of the multi-scalar multiplication.

[0023] The multi-scalar multiplication is usually operated in the projective coordinates. When the point addition operation is performed in the projective coordinates, the values of the z coordinates of the two points to be added will affect the minimum number of operations in a single point addition. Assuming that the coordinates of the two points to be added are (x1, y1, z1) and (x2, y2, z2), then when z1 = z2 = 1, the two points need at least 7 modular multiplication operations when performing the point addition operation; when z1 ≠ 1, z2 = 1, the two points need at least 11 modular multiplication operations when performing the point addition operation; and when z1 ≠ 1, z2 ≠ 1, the two points need at least 12 modular multiplication operations when performing the point addition operation.

[0024] If the two sub-scalar corresponding elliptic curve points that need to be written into the first bucket point are sequentially added to the first bucket point, that is, the first bucket point is first added to one elliptic curve point to update the value of the first bucket point, and then the updated first bucket point is added to another elliptic curve point, this operation process is equivalent to performing two z1 ≠ 1, z2 = 1 operations, that is, a total of 22 modular multiplication operations are needed. In the embodiments of the present disclosure, the two sub-scalar corresponding elliptic curve points that need to be written into the first bucket point are first added, which is equivalent to performing one z1 = z2 = 1 operation, and then the result of adding the two elliptic curve points is added to the first bucket point, which is equivalent to performing one z1 ≠ 1, z2 ≠ 1 operation, so the total number of modular multiplication operations is 7 plus 12, that is, 19 modular multiplication operations, which is less than 22 modular multiplication operations. Therefore, the method in the embodiments of the present disclosure can reduce the number of modular multiplication operations in the point addition operation in the multi-scalar multiplication, thereby speeding up the operation process of the multi-scalar multiplication. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure, the drawings needed to be used in the embodiments description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and for those skilled in the art, other drawings can be obtained based on these drawings without creative labor.

[0026] Figure 1 A flow chart of a multi-scalar multiplication method provided by an example embodiment of the present disclosure is shown;

[0027] Figure 2 A flow chart of a multi-scalar multiplication method provided by another example embodiment of the present disclosure is shown;

[0028] Figure 3 An operation process diagram of the multi-scalar multiplication method is shown;

[0029] Figure 4 A diagram of a tree structure is shown;

[0030] Figure 5 A structural diagram of a multi-scalar multiplication device provided by an example embodiment of the present disclosure is shown;

[0031] Figure 6 A structural diagram of a computer device provided by an example embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0032] Unless otherwise defined, the technical terms or scientific terms used herein should be understood as the common meanings understood by those skilled in the art to which the present disclosure belongs. The words "first", "second", "third", and the like used in the specification and claims of the present patent application do not indicate any order, number, or importance, but are only used to distinguish different components. Similarly, the words "one" or "a" and the like do not indicate a quantity limitation, but indicate that at least one exists. The words "include" or "contain" and the like mean that the elements or objects appearing before "include" or "contain" cover the elements or objects listed after "include" or "contain" and their equivalents, and do not exclude other elements or objects. The words "connect" or "connected" and the like are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect.

[0033] In order to make the purposes, technical solutions, and advantages of the present disclosure clearer, the embodiments of the present disclosure will be described in further detail below with reference to the drawings.

[0034] Figure 1A flow chart of a multi-scalar multiplication method provided by one example embodiment of the present disclosure is shown, which can be executed by a CPU, referring to FIG. 1. Figure 1 The method comprises:

[0035] In step 101, the original operation task of the large-scale elliptic curve multi-scalar multiplication is divided into a plurality of sub-operation tasks.

[0036] Each sub-operation task comprises a plurality of point multiplication operations, each point multiplication operation comprises a sub-scalar and an elliptic curve point, and the elliptic curve point in each point multiplication operation corresponds to the sub-scalar. Each sub-operation task is a small multi-scalar multiplication operation.

[0037] For example, the original operation task can be represented by formula (1)

[0038]

[0039] In formula (1), Q is the original operation task, n is the scale of the multi-scalar multiplication, i.e. the total number of calculations, k i is the i-th scalar, each scalar belongs to a finite field, P i represents the i-th elliptic curve point, and the elliptic curve points are on an elliptic curve. Wherein, i is an integer, 1≤i≤n.

[0040] In this case, step 101 comprises: under the premise of binary, assuming that each scalar is a λ-bit scalar (λ is usually 256 or 512, etc.), each scalar can be divided into parts, each part is a sub-scalar of the scalar value. Wherein, s is the size of the window of the Pippenger algorithm, and the value of s is usually 4, that is, for any scalar, every 4 bits of the scalar is divided into a sub-scalar.

[0041] For example, a scalar is 234, the binary representation of 234 is 11101010, and the value of λ is 8, so in the case of s=4, the scalar value can be divided into 2 sub-scalars, that is, 1110 and 1010, which are converted into decimal numbers, that is, 14 and 10.

[0042] In this case, each sub-operation task can be represented by formula (2).

[0043]

[0044] In formula (2), G j is the j-th sub-operation task, m ij is the j-th sub-scalar of the i-th scalar, wherein j is an integer The other parameters in formula (2) have the same meanings as in formula (1), and details are omitted here.

[0045] As can be seen from formula (2), each sub-operation task includes multiple point multiplication operations, for example, m 1j P1, m 2j P2, …, m nj P n Each of the multiple point multiplication operations includes a sub-scalar and an elliptic curve point, and therefore, the sub-scalar and the elliptic curve point in each point multiplication operation correspond to each other.

[0046] In step 102, based on the sub-scalars corresponding to the multiple elliptic curve points, the multiple elliptic curve points are filled into multiple bucket points.

[0047] If two elliptic curve points are filled into a first bucket point, the two elliptic curve points are added to the primary storage sequence as one to-be-point-addition operation, and the first bucket point is any one of the multiple bucket points.

[0048] Here, the bucket point is a name for a storage unit of an elliptic curve point.

[0049] In the multiple point multiplication operations of a certain sub-operation task, each bucket point corresponds to the decimal value of a sub-scalar, and if the decimal value of a sub-scalar in a certain point multiplication operation is a, then the elliptic curve point in the point multiplication operation needs to be filled into the bucket point B a For example, in a certain point multiplication operation, the decimal value of the sub-scalar corresponding to a certain elliptic curve point is 1, and then the elliptic curve point needs to be filled into the bucket point B1.

[0050] When performing operations, operations are performed in the order of sub-operation tasks, and each sub-operation task includes multiple point multiplication operations, and therefore, the actual operation order is the order of the multiple point multiplication operations in the multiple sub-operation tasks.

[0051] In step 103, when there are N to-be-point-addition operations in the primary storage sequence, the N to-be-point-addition operations are executed in parallel based on the SIMD instruction, and N first point addition results are obtained.

[0052] The SIMD (Single Instruction Multiple Data) instruction set is an operation instruction set on a CPU platform. Based on the instructions in the SIMD instruction set, a plurality of groups of data can be operated in parallel by using one group of instructions. Therefore, based on the SIMD instruction, a plurality of point addition operations can be executed in parallel on the CPU platform. Exemplarily, the SIMD instruction set in the embodiments of the present disclosure can be the AVX-512 (Advanced Vector Extensions-512) instruction set.

[0053] The implementation of parallel operation based on the SIMD instruction is relatively common in the related art, and thus is not described in detail herein.

[0054] In the embodiments of the present disclosure, N can be 4 or 8.

[0055] In step 104, the N first point addition results are written back to the corresponding bucket points.

[0056] In step 105, after the elliptic curve points in the plurality of point multiplication operations of any one sub-operation task are filled into the bucket points, the bucket points are aggregated.

[0057] The bucket point aggregation means that after all the elliptic curve points involved in a certain sub-operation task are filled into the bucket points, the operation result of the sub-operation task is determined based on the values of the current plurality of bucket points.

[0058] In step 106, based on the result of the bucket point aggregation of each sub-operation task, the operation result of the original operation task is obtained.

[0059] In the embodiments of the present disclosure, the N point addition operations in the multiple scalar multiplication are implemented in parallel by using the SIMD instruction set, which effectively improves the operation efficiency of the multiple scalar multiplication. In addition, the architecture in the embodiments of the present disclosure is applicable to the CPU platform, so that the multiple scalar multiplication is not limited to the hardware such as FPGA or GPU, and the universality of the multiple scalar multiplication is effectively improved.

[0060] The multiple scalar multiplication is usually operated in the projection coordinates. When the point addition operation is performed in the projection coordinates, the values of the z coordinates of the two points to be added will affect the minimum number of operations in a single point addition. Assuming that the coordinates of the two points to be added are (x1, y1, z1) and (x2, y2, z2), when z1=z2=1, the two points need to perform at least 7 modular multiplication operations when the point addition operation is performed; when z1≠1 and z2=1, the two points need to perform at least 11 modular multiplication operations when the point addition operation is performed; and when z1≠1 and z2≠1, the two points need to perform at least 12 modular multiplication operations when the point addition operation is performed.

[0061] If the two sub-scalars corresponding to the elliptic curve points that need to be written into the first bucket point are directly added to the first bucket point in turn, that is, the first elliptic curve point is added to the first bucket point to update the value of the first bucket point, and then the other elliptic curve point is added to the updated first bucket point, the operation process is equivalent to performing two z1≠1, z2=1 operations, that is, a total of 22 times of modular multiplication operations are needed. In the embodiment of the present disclosure, the two sub-scalars corresponding to the elliptic curve points that need to be written into the first bucket point are first added, which is equivalent to performing one z1=z2=1 operation, and then the result of adding the two elliptic curve points is added to the first bucket point, which is equivalent to performing one z1≠1, z2≠1 operation, so the total number of modular multiplication operations is 7 plus 12, that is, 19 times of modular multiplication operations, which is less than 22 times of modular multiplication operations. Therefore, the method in the embodiment of the present disclosure can reduce the number of point addition operations in the multi-scalar multiplication, thereby speeding up the operation process of the multi-scalar multiplication.

[0062] Figure 2 A flowchart of a multi-scalar multiplication method provided by another example embodiment of the present disclosure is shown, which can be executed by a CPU, as shown in Figure 2 The method comprises:

[0063] In step 201, the original operation task of the large-scale elliptic curve multi-scalar multiplication is divided into a plurality of sub-operation tasks.

[0064] The related content of step 201 is described in the foregoing step 101, which is omitted here.

[0065] In step 202, based on the sub-scalars corresponding to the plurality of elliptic curve points, the plurality of elliptic curve points are filled into the plurality of bucket points.

[0066] In implementing step 202, a scalar-elliptic curve point table can be established based on the sequence of the plurality of point multiplication operations in each sub-operation task.

[0067] Exemplarily, there can be a plurality of scalar-elliptic curve point tables, each of which is used to represent the plurality of point multiplication operations in a sub-operation task.

[0068] The scalar-elliptic curve point table comprises two data types, one of which is a scalar used to store the value of the sub-scalar in the point multiplication operation, and the other of which is an elliptic curve point used to store the elliptic curve point in the point multiplication operation. In the scalar-elliptic curve point table, if the value of a certain sub-scalar and a certain elliptic curve point are located in the same row, it means that the sub-scalar and the elliptic curve need to perform point multiplication operation.

[0069] Exemplarily, for example, a certain scalar-elliptic curve point table is used to represent the plurality of point multiplication operations in the sub-operation task G1, then m 11P1, m 21 P2... m n1 P n are filled into the scalar-elliptic curve point table in sequence.

[0070] In the presence of the scalar-elliptic curve point table, a Bucket table and a Double Point table can be established, wherein the Bucket table is used to store the values of all bucket points, and the Double Point table is used to store two elliptic curve points that need to be filled into the Bucket table.

[0071] In the Bucket table, three data types of bucket point labels, bucket points and Link pointers are included. In the Double Point table, three data types of bucket point labels, counts and two elliptic curve points are included.

[0072] The bucket point label corresponds to the bucket point. The bucket point label of a certain bucket point is the value of the sub-scalar corresponding to the bucket point. For example, the bucket point label of the bucket point B1 is 1, indicating that the elliptic curve points of the point multiplication operation of the sub-scalar 1 need to be written into the bucket point B1.

[0073] The Link pointer is used to link a row in the Double Point table. When a certain bucket point does not have an elliptic curve point that needs to be written, the Link pointer of the bucket point is empty.

[0074] In the case that the Link pointer of the bucket point is empty, if the bucket point adds an elliptic curve point A that needs to be written, an empty table entry is found in the Double Point table, and the elliptic curve point A is written into the corresponding data type in the empty table entry, which is used to store the elliptic curve point A that needs to be written and the bucket point label of the bucket point. Here, the empty table entry is a row in the Double Point table that has not been filled with data. In the Double Point table, the number of table entries is fixed, and a suitable number of table entries in the Double Point table can be set according to the size of the multi-scalar multiplication, so that there is always an empty table entry in the Double Point table, avoiding the situation that no empty table entry can be found in the Double Point table.

[0075] In the case that the Link pointer of the bucket point is not empty, and the Link pointer points to a row in the Double Point table that contains only one elliptic curve point A, if the bucket point adds another elliptic curve point B that needs to be written, the elliptic curve point B is also written into the corresponding data type in the row, and the Link pointer of the bucket point is cleared at this time, and the elliptic curve point A and the elliptic curve point B in the row form a to-be-added operation.

[0076] The count in the Double Point table is used to count the number of elliptic curve points that need to be written to a certain bucket point. The count can be named cnt, for any row in the Double Point table, if there is only one elliptic curve point in the row, then cnt is 1, if there are two elliptic curve points in the row, then cnt is 2.

[0077] When an elliptic curve point needs to be written to the first bucket point, the conventional method is to directly add the value of the first bucket point to the elliptic curve point; in the embodiment of the present disclosure, when an elliptic curve point needs to be written to the first bucket point, first determine whether there is another elliptic curve point to be written in the first bucket point (it can be determined by whether the Link pointer is empty), if there is another elliptic curve point to be written (that is, the Link pointer is not empty), then the elliptic curve point and the other elliptic curve point constitute a pending point addition operation, which can be added to the first-level storage sequence later.

[0078] The two data types for storing elliptic curve points in the Double Point table are P1 and P2, if the two elliptic curve points are in the same row in the Double Point table, the data type P1 and the data type P2, then the two elliptic curve points are a pending point addition operation.

[0079] The following will be combined Figure 3 The data changes of the scalar-elliptic curve point table, the Bucket table and the Double Point table in the operation process are described.

[0080] Figure 3 The operation process diagram of the multi-scalar multiplication operation method is shown in Figure 3 In the operation process, the elliptic curve points are filled into the bucket points in order according to the order of the scalar-elliptic curve point table. It is assumed that the Figure 3 The scalar-elliptic curve point table in the

[0081] Since the sub-scalar corresponding to the elliptic curve point P1 is 1, the elliptic curve point P1 is first filled into the bucket point B1, when filling, first determine whether the Link pointer corresponding to the bucket point B1 is empty, which must be empty in the initial state, so at this time a Link pointer is created, which points to the first row in the Double Point table (the first row is also blank), and the bucket point label in the first row is set to 1, the count cnt is set to 1, and the elliptic curve point P1 is filled into the data type P1 in the Double Point table.

[0082] Then for the fourth row (the second and third rows are omitted) of the scalar-elliptic curve point table, at this time the sub-scalar corresponding to the elliptic curve point P4 is also 1, that is, the elliptic curve point P4 also needs to be filled into the bucket point B1. When filling the elliptic curve point P4, first determine whether the Link pointer corresponding to the bucket point B1 is empty. Since the elliptic curve point P1 exists, at this time the Link pointer corresponding to the bucket point B1 is not empty, at this time the count cnt in the row (that is, the first row) of the Link pointer can be set to 2, the elliptic curve point P4 is filled into the data type P2 in the Double Point table, and then the Link pointer corresponding to B1 is emptied.

[0083] The primary storage sequence can be named L1_Input, and the primary storage sequence is an array with a length of N, that is, the primary storage sequence includes N pointers. When the count cnt in a row in the Double Point table is 2, a certain idle pointer in the primary storage sequence is pointed to the row, that is, a pending point addition in the row is added to the primary storage sequence.

[0084] When the N numbers in the primary storage sequence respectively point to the N rows in the Double Point table, that is, there are N pending point additions in the primary storage sequence, step 203 is executed. The value of N is related to the aforementioned step 103, and detailed description is omitted here.

[0085] In step 203, N pending point additions are executed in parallel based on the SIMD instruction, and N first point addition results are obtained.

[0086] The way of adding two elliptic curve points that need to be written into the same bucket point first and then writing the addition result back to the bucket point in the embodiments of the present disclosure can be called a tree structure in point addition operation.

[0087] Figure 4 For a schematic diagram of the tree structure, as shown in Figure 4 The first row is a sub-scalar, the second row is an elliptic curve point corresponding to the sub-scalar, and the last row is a bucket point. As can be seen, this operation mode is similar to the shape of a binary tree, and therefore can be called a tree structure. By adopting the tree structure, the number of operations in the operation process of the multi-scalar multiplication can be reduced, and the operation process of the multi-scalar multiplication can be accelerated.

[0088] Optionally, the tree structure can also be applied between the scalar-elliptic curve point table and the Bucket table. For example, Figure 3For example, the scalar-elliptic curve point table in the above table, elliptic curve points P2 and P3 need to be written into the bucket point B3, then the tree structure can be used to first perform one point addition on P2 and P3 by using the SIMD instruction, and then fill the result of the point addition of P2 and P3 into the bucket point B3, that is, fill the result of the point addition of P2 and P3 into the data type P1 in the second row in the Double Point table; similarly, elliptic curve points P5 and P6 also need to be written into the bucket point B3, then the tree structure can be used to first perform one point addition on P5 and P6 by using the SIMD instruction, and then fill the result of the point addition of P5 and P6 into the bucket point B3, that is, fill the result of the point addition of P5 and P6 into the data type P2 in the second row in the Double Point table. Then, the following is executed in the manner of step 202.

[0089] The N first point addition results in step 203 also need to be written back to the bucket point, that is, the N first point addition results need to be added to the corresponding bucket point respectively. Therefore, the N first point addition results need to be temporarily stored first, and then the N first point addition results are added to the corresponding bucket point.

[0090] The N first point addition results can be temporarily stored in the first output queue, which can be named L1_Output. The first output queue is also an array with a length of N. Each first point addition result in the first output queue corresponds to one to-be-point-added operation in the first-level storage sequence.

[0091] In step 204, the N first point addition results are written back to the corresponding bucket point.

[0092] Optionally, step 204 includes the following steps a-c:

[0093] In step a, for the second point addition result, the point addition operation of the second point addition result and the second bucket point is added to the second-level storage sequence as one to-be-point-added operation.

[0094] The second point addition result is any one of the N first point addition results, and the second bucket point is the bucket point corresponding to the second point addition result.

[0095] In the embodiments of the present disclosure, the second-level storage sequence is a circular queue with an undetermined size, which can be represented by L2_Input. The second-level storage sequence includes four data types of bucket point label, op1, op2 and out. The bucket point label is used to indicate that the elliptic curve point in op1 is used to write into which bucket point; op1 is used to store the elliptic curve point, and op2 is used to store the elliptic curve point or the bucket point; if the two values are in the same column of op1 and op2, it means that the two values need to be added.

[0096] out includes 1 and 0, when the out of a column is 1, it means that the value of the op1 and the op2 of the column after point addition needs to be updated to the bucket point indicated by the bucket point label of the column; when the out is 0, it means that the value of the op1 and the op2 of the column after point addition needs to be added to the secondary storage sequence.

[0097] When the first step is executed, there may be at least two bucket points in N first point addition results, which are the same third bucket point in the to-be-point-added operation, indicating that a bucket point conflict occurs, and the following first step to the second step or the third step to the fourth step is used for processing. The third bucket point is any one of the plurality of bucket points:

[0098] In the first step, when there are K bucket points in the secondary storage sequence in the Ith round of operation, which are the third bucket point in the to-be-point-added operation, K is greater than or equal to 2 and K is an even number, the first point addition result in the K to-be-point-added operation is taken as a to-be-point-added operation every two first point addition results to construct 0.5K to-be-point-added operations in the secondary storage sequence in the Ith round of operation.

[0099] In the embodiment of the present disclosure, the first N to-be-point-added operations in the secondary storage sequence are executed in parallel once in the secondary storage sequence, indicating that a round of operation of the secondary storage sequence is completed.

[0100] The Ith round of operation here can be any round of operation in the secondary storage sequence. I is a positive integer, and the present disclosure does not limit the value range of I.

[0101] Exemplarily, in the Ith round of operation, K is equal to 4, that is, there are 4 first point addition results that need to be written back to the third bucket point, and it is assumed that the 4 first point addition results are C, D, E and F. According to the first step, there should be 4 to-be-point-added operations, which are the to-be-point-added operations of C, D, E and F with the third bucket point, but this will simultaneously exist 4 values that need to be updated to the third bucket point in the subsequent operation, that is, a bucket point conflict occurs. At this time, the original 4 to-be-point-added operations are changed into two to-be-point-added operations, that is, C and D constitute a to-be-point-added operation, and E and F constitute a to-be-point-added operation. Thus, 0.5K (that is, 2) to-be-point-added operations are constructed in the Ith round of operation.

[0102] In the second step, after the Ith round of operation is executed, the operation results of the 0.5K to-be-point-added operations are added to the secondary storage sequence as a to-be-point-added operation with the third bucket point, waiting for the (I+1)th round of operation.

[0103] Here, the second step also constructs 0.5K pending point addition operations with the third bucket point, if 0.5K is not 1, then in the I+1th round of operation, the 0.5K pending point addition operations with the third bucket point also need to repeat the first step, and so on, until there is only one pending point addition operation with the third bucket point in a round of operation.

[0104] When the bucket point of K pending point addition operations in the Ith round of operation is the third bucket point, K is greater than or equal to 2 and K is an odd number, the following third step to the fourth step are executed.

[0105] The third step is to take every two first point addition results in the first K-1 pending point addition operations as a pending point addition operation to construct 0.5(K-1) pending point addition operations in the secondary storage sequence of the Ith round of operation.

[0106] The essence of the third step is to process the first K-1 pending point addition operations as the case when K is even, and the last pending point addition operation is kept unchanged.

[0107] The fourth step is to add the operation results of the 0.5(K-1) pending point addition operations and the third bucket point as a pending point addition operation to the secondary storage sequence after the Ith round of operation is executed, and wait for the I+1th round of operation.

[0108] The principles of the third step to the fourth step are similar to those of the first step to the second step, which are omitted here.

[0109] For example, K is equal to 3, that is, there are 3 first point addition results that need to be written back to the third bucket point, and suppose the 3 first point addition results are C, D, and E. According to the first step, there should be 3 pending point addition operations, which are the pending point addition operations of C, D, and E with the third bucket point, then E and the third bucket point can be kept unchanged, and for the pending point addition operations of C and D with the third bucket point, it is equivalent to K being even, then the first step to the second step can be executed.

[0110] In summary, when the bucket point of K pending point addition operations is the third bucket point, if K is even, the K pending point addition operations in the current secondary storage sequence are divided into 0.5K pending point addition operations; if K is odd, the K pending point addition operations in the secondary storage sequence are divided into 0.5(K-1)+1 pending point addition operations. Here, +1 is the last one of the K pending point addition operations.

[0111] Alternatively, whether there is a bucket point conflict phenomenon can be determined by querying whether there is the same label in the secondary storage sequence.

[0112] Step b, when there are at least N pending point addition operations in the secondary storage sequence, performing the first N pending point addition operations in the secondary storage sequence in parallel based on the SIMD instruction, to obtain N third point addition results.

[0113] The length of the secondary storage sequence is not fixed, when the length of the pending point addition operation in the secondary storage sequence is greater than or equal to N, the second step is executed to perform the first N pending point addition operations.

[0114] Step c, based on the N third point addition results, updating the value of the corresponding bucket point to realize writing back the N first point addition results to the corresponding bucket point.

[0115] In implementation, the N third point addition results can be stored in the second output queue, which can be named as L2_Output. The second output queue is also an array with a length of N.

[0116] In the embodiments of the present disclosure, when updating the value of the corresponding bucket point, only the third point addition result corresponding to the column with out being 1 in the secondary storage sequence can be updated to the corresponding bucket point.

[0117] The following will be described in combination with Figure 3 The running process of the primary storage sequence and the secondary storage sequence will be described. Figure 3 In the example, N is equal to 8. When there are 8 pending point addition operations in the primary storage sequence L1_Input, the 8 pending point addition operations are performed in parallel based on the SIMD instruction, to obtain R 1 , R 2 , R 3 , R 4 , R 5 , R 6 , R 7 and R 8 The 8 first point addition results are stored in the first output queue L1_Output.

[0118] Then the 8 first point addition results are filled in the secondary storage sequence L2_Input. When filling, since R 1 is the point addition result of P1 and P4 in the first row of the Double Point table, when filling the first point addition result R 1 in the secondary storage sequence L2_Input, the bucket point label in the column (that is, the first column) where the first point addition result R 1 is located is 1, op1 is R 1 , and since only the first point addition result R 1 needs to be written back to the bucket point B1 among the 8 first point addition results, op2 is B1, out is 1, and the third point addition result of the column is T 1 when subsequent operations are performed.

[0119] R 2 is the point-addition result of P2 and P3 in the i-th row of the Double Point table, R 3 is the point-addition result of P5 and P6 in the i-th row of the Double Point table, thus R 2 and R 3 both need to be written back to the bucket point B3. At this time, the second column and the third column in the secondary storage sequence originally have a bucket point conflict, the second column and the third column originally are deleted, and a to-be-point-added operation is constructed at the position of the second column originally, which is composed of R 2 and R 3 In the second column, the bucket point label is 3, op1 is R 2 , op2 is R 3 , and out is 0, indicating that the output result of the second column cannot be updated to the bucket point, but needs to be filled into the secondary storage sequence for subsequent processing.

[0120] Here, R 2 and R 3 both indicate that K is equal to 2, that is, 0.5K is equal to 1, so after the to-be-point-added operation of R 2 and R 3 is executed, the third point addition result T 2 obtained can form a to-be-point-added operation with the bucket point B3 and be added to the secondary storage sequence. When T 2 and B3 are added to the secondary storage sequence, the bucket point label is still 3, op1 is T 2 , op2 is B3, and out is 1, indicating that the output result of the to-be-point-added operation can update the bucket point B3.

[0121] In the embodiments of the present disclosure, for the Double Point table, when the operation in a row is executed in the primary storage sequence, the content in the row can be emptied, so as to save the storage space of the Double Point table. For the primary storage sequence, when the N to-be-point-added operations in the primary storage sequence are all executed, and the N first operation results are all filled into the first output queue, the primary storage sequence can be emptied. For the first output queue, when the N first operation results in the first output queue are all filled into the secondary storage sequence, the first output queue can be emptied. For the secondary storage sequence, the column in which the to-be-point-added operation is completed can be emptied. For the second output queue, after the N third operation results are all processed (for example, part of the third operation results update the bucket point, and part of the third operation results are filled into the secondary storage sequence), the second output queue can be emptied.

[0122] For the bucket filling operation of a sub-operation task, the above steps 202 to 204 are repeated, so that the elliptic curve points involved in the sub-operation task are filled into the bucket points corresponding to the sub-scalars.

[0123] When the elliptic curve points involved in the sub-operation task are all filled into the bucket points, there may be a case that the number of pending point addition operations in the primary storage sequence and the secondary storage sequence is less than N. Since the elliptic curve points involved in the sub-operation task have been filled into the bucket points, no more pending point addition operations will be added to the primary storage sequence and the secondary storage sequence in the future. At this time, it is in the tailing phase of the sub-operation task. In the tailing phase, for the primary storage sequence and the secondary storage sequence whose number of pending point addition operations is less than N, the above steps 202 to 204 are also executed, and the insufficient part is empty, so as to complete the tailing phase of the sub-operation task.

[0124] After the completion of the tailing phase of the sub-operation task, the value of each bucket point will not change. At this time, step 205 can be performed on the sub-operation task.

[0125] In step 205, after the elliptic curve points in the multiple point multiplication operations of any sub-operation task are filled into the bucket points, the bucket points are aggregated.

[0126] The related content of the bucket point aggregation is described in the foregoing step 105, and is omitted here. The process of the bucket point aggregation of the jth sub-operation task can be represented by formula (3).

[0127]

[0128] In formula (3), B l represents the lth bucket point, l is an integer, 1≤l≤2 s -1. The meanings of other parameters in formula (3) are the same as those in formula (2), and are omitted here.

[0129] The aggregation result of the bucket points of the jth sub-operation task is also the operation result of the jth sub-operation task.

[0130] By executing the above steps 201 to 205 on each sub-operation task, the operation result of each sub-operation task can be obtained.

[0131] In step 206, based on the operation result of each sub-operation task, the operation result of the original operation task is obtained.

[0132] Step 206 can be implemented by the following formula (4) to formula (5).

[0133]

[0134] In formula (4), Mj For the intermediate quantity, it is calculated by formula (5). The meanings of other parameters in formula (4) are the same as those of the related parameters in formula (1) and step 101, and details are omitted here.

[0135] M j = 2 (j-1)s G j (5)

[0136] The meanings of the parameters in formula (5) are the same as those of the related parameters in formula (3) and step 101, and details are omitted here.

[0137] The multi-scalar multiplication in the embodiments of the present disclosure can be applied to zero-knowledge proof, thereby improving the efficiency of zero-knowledge proof and having wide application prospects in the fields of digital currency, privacy protection, smart contract and the like.

[0138] In the embodiments of the present disclosure, the tree structure is used to improve the operation efficiency of the multi-scalar multiplication. Moreover, the architecture in the embodiments of the present disclosure is suitable for a CPU platform, so that the multi-scalar multiplication is not limited to hardware such as FPGA or GPU, and the universality of the multi-scalar multiplication is effectively improved.

[0139] The following is a device embodiment of the present application. For details not described in detail in the device embodiment, reference can be made to the above method embodiments.

[0140] Figure 5 FIG. 5 shows a structure schematic diagram of a multi-scalar multiplication operation device provided by one example embodiment of the present disclosure, referring to Figure 5 The multi-scalar multiplication operation device 500 includes a splitting module 501, a first bucket filling module 502, a point addition operation module 503, a second bucket filling module 504, a bucket point aggregation module 505, and an operation module 506.

[0141] The splitting module 501 is configured to split the original operation task of large-scale elliptic curve multi-scalar multiplication into a plurality of sub-operation tasks, each of which includes a plurality of point multiplication operations, each of which includes a sub-scalar and an elliptic curve point, and the elliptic curve point in each point multiplication operation corresponds to the sub-scalar.

[0142] The first bucket filling module 502 is configured to fill a plurality of elliptic curve points into a plurality of bucket points based on the sub-scalars corresponding to the plurality of elliptic curve points, wherein in the case that two elliptic curve points both need to be filled into a first bucket point, the two elliptic curve points are added to a first-level storage sequence as a to-be-point-added operation, and the first bucket point is any one of the plurality of bucket points.

[0143] The point addition operation module 503 is configured to perform N point addition operations in parallel based on the SIMD instruction when there are N point addition operations to be performed in the first storage sequence, to obtain N first point addition results.

[0144] The second bucket filling module 504 is configured to write the N first point addition results back to the corresponding bucket points.

[0145] The bucket point aggregation module 505 is configured to aggregate the bucket points after the elliptic curve points in the point multiplication operations of any sub-operation task are filled into the bucket points.

[0146] The operation module 506 is configured to obtain the operation result of the original operation task based on the result of the aggregation of the bucket points of each sub-operation task.

[0147] Optionally, the second bucket filling module 504 is further configured to add, for a second point addition result, a point addition operation between the second point addition result and a second bucket point as a point addition operation to be performed in the second storage sequence, the second point addition result being any one of the N first point addition results, and the second bucket point being a bucket point corresponding to the second point addition result; when there are at least N point addition operations to be performed in the second storage sequence, perform the first N point addition operations to be performed in the second storage sequence in parallel based on the SIMD instruction, to obtain N third point addition results; and update the value of the corresponding bucket point based on the N third point addition results, to write the N first point addition results back to the corresponding bucket points.

[0148] Optionally, performing the first N point addition operations to be performed in the second storage sequence in parallel in the second storage sequence indicates that one round of operation of the second storage sequence is completed, and if the bucket point in the at least two point addition operations to be performed in the Ith round of operation is a third bucket point, the third bucket point being any one of the plurality of bucket points, the second bucket filling module 504 is further configured to: when the bucket point in the K point addition operations to be performed in the Ith round of operation is the third bucket point, K being greater than or equal to 2 and K being an even number, add, as a point addition operation, every two of the first point addition results in the K point addition operations to be performed, to construct 0.5K point addition operations to be performed in the second storage sequence in the Ith round of operation; after the Ith round of operation is performed, add the operation results of the 0.5K point addition operations to be performed and the third bucket point as a point addition operation to be performed in the second storage sequence, and wait for the (I+1)th round of operation; wherein I is a positive integer.

[0149] Optionally, the second bucket filling module 504 is further configured to, when the K bucket points in the Ith round of operation are all third bucket points, and K is greater than or equal to 2 and K is an odd number, take the first K-1 point addition results as one point addition operation, to construct 0.5(K-1) point addition operations in the secondary storage sequence of the Ith round of operation; after the Ith round of operation is executed, add the operation results of the 0.5(K-1) point addition operations and the third bucket points as one point addition operation to the secondary storage sequence, and wait for the (I+1)th round of operation.

[0150] Optionally, the bucket point aggregation module 505 is further configured to implement the bucket point aggregation of the jth sub-operation task by using the following formula:

[0151]

[0152] wherein, G j is the jth sub-operation task, B l represents the lth bucket point, and l is an integer.

[0153] It should be noted that, when the multi- scalar multiplication operation device provided in the above embodiments performs the multi- scalar multiplication operation, only the division of the above functional modules is taken as an example for illustration, and in actual application, the above functions can be distributed to different functional modules to be completed according to needs, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the multi- scalar multiplication operation device and the multi- scalar multiplication operation method provided in the above embodiments belong to the same concept, and the specific implementation process is described in the method embodiments, which will not be repeated here.

[0154] The division of the modules in the embodiments of the present disclosure is illustrative, and is only a logical function division. In actual implementation, there can be another division manner. In addition, each functional module in each embodiment of the present disclosure can be integrated in one processor, or can be a separate physical existence, or two or more modules can be integrated into one module. The integrated module can be realized in the form of hardware or in the form of a software functional module.

[0155] The integrated module, if implemented in the form of a software function module and sold or used as an independent product, can be stored in a computer readable storage medium. Based on such an understanding, the technical solutions of the present disclosure, essentially or in the part that contributes to the prior art, or all or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, and includes several instructions for making a terminal device (which can be a personal computer, a mobile phone, or a communication device, etc.) or a processor execute all or part of the steps of the methods according to the embodiments of the present disclosure. The foregoing storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), magnetic disk or optical disk, and various media that can store program codes.

[0156] Figure 6 is a structural schematic diagram of a computer device provided by an embodiment of the present disclosure. As shown in Figure 6 the computer device 600 includes a processor 601 and a memory 602.

[0157] The processor 601 can include one or more processing cores, such as a 4-core processor, an 8-core processor, etc. The processor 601 can also include a main processor and a coprocessor. The main processor is a processor for processing data in a wake-up state, also known as a CPU. The coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 601 can also include an AI (Artificial Intelligence) processor for processing machine learning-related computing operations.

[0158] The memory 602 can include one or more computer readable storage media, which can be non-transitory. The memory 602 can also include a high-speed random access memory, and a non-volatile memory such as one or more disk storage devices, flash storage devices. In some embodiments, the non-transitory computer readable storage medium in the memory 602 is used to store at least one instruction for being executed by the processor 601 to implement the multi-scalar multiplication operation method provided in the embodiments of the present disclosure.

[0159] Those skilled in the art can understand that Figure 6 the structure shown in the figure does not constitute a limitation on the computer device 600, and can include more or fewer components than the figure, or combine certain components, or use different component arrangements.

[0160] The embodiment of the present disclosure further provides a non-transitory computer readable storage medium, when instructions in the storage medium are executed by a processor of a computer device, the computer device is enabled to perform the multi-scalar multiplication operation method provided in the embodiment of the present disclosure.

[0161] The embodiment of the present disclosure further provides a computer program product, comprising computer programs / instructions, when the computer programs / instructions are executed by a processor, the multi-scalar multiplication operation method provided in the embodiment of the present disclosure is realized.

[0162] The above merely provides optional embodiments of the present disclosure, and is not intended to limit the present disclosure, and any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A method for multi-scalar multiplication, characterized in that, The method for accelerating the operation of the multi-scalar multiplication on a central processing unit (CPU) platform includes: The original computational task of large-scale elliptic curve multi-scalar multiplication is divided into multiple sub-computation tasks. Each sub-computation task includes multiple dot multiplication operations. Each dot multiplication operation includes a sub-scalar and an elliptic curve point. The elliptic curve point in each dot multiplication operation corresponds to the sub-scalar. Based on the subscalars corresponding to the multiple elliptic curve points, the multiple elliptic curve points are filled into multiple buckets. In the case where there are two elliptic curve points that both need to be filled into the first bucket, the two elliptic curve points are added to the first-level storage sequence as a point to be added. The first bucket is any one of the multiple buckets. When there are N pending point addition operations in the first-level storage sequence, the N pending point addition operations are executed in parallel based on SIMD instructions to obtain N first point addition results; Write the results of adding the N first points back to the corresponding bucket points; After all the elliptic curve points in the multiple dot product operations of any of the sub-operation tasks have been filled into the bucket points, bucket point aggregation is performed. Based on the result of bucket aggregation for each sub-task, the result of the original task is obtained. The step of writing the sum of the N first points back to the corresponding bucket points includes: For the second addition result, the addition operation of the second addition result and the second bucket point is added to the secondary storage sequence as a point addition operation to be performed. The second addition result is any one of the N first addition results, and the second bucket point is the bucket point corresponding to the second addition result. When there are at least N pending addition operations in the secondary storage sequence, the first N pending addition operations in the secondary storage sequence are executed in parallel based on SIMD instructions to obtain N third addition results; Based on the N third-point addition results, update the value of the corresponding bucket point to realize the writing of the N first-point addition results back to the corresponding bucket point.

2. The method according to claim 1, characterized in that, In the secondary storage sequence, performing the first N addition operations in parallel once indicates that one round of operation in the secondary storage sequence has been completed. If at least two buckets in the secondary storage sequence of the I-th round of operation are third buckets, and any one of the multiple third buckets is a third bucket, then writing the N first-point addition results back to the corresponding bucket includes: When there are K buckets in the secondary storage sequence of the first round of operation that are third buckets, and K is greater than or equal to 2 and K is an even number, then every two first addition results in the K pending addition operations are taken as a pending addition operation, so as to construct 0.5K pending addition operations in the secondary storage sequence of the first round of operation. After the first round of operation is completed, the results of the 0.5K pending addition operations are added to the second-level storage sequence along with the third bucket point as a pending addition operation, and wait for the (I+1)th round of operation. Where I is a positive integer.

3. The method according to claim 2, characterized in that, The step of writing the sum of the N first points back to the corresponding bucket points also includes: When there are K buckets in the secondary storage sequence of the I-th round of operation that are the third buckets, and K is greater than or equal to 2 and K is an odd number, take the first addition result of the first point in the first K-1 addition operations and take every two first addition results as a addition operation to build 0.5 (K-1) addition operations in the secondary storage sequence of the I-th round of operation; After the first round of operation is completed, the results of the 0.5(K-1) pending point addition operations are added to the second-level storage sequence along with the third bucket point as a pending point addition operation, waiting for the (I+1)th round of operation.

4. The method according to any one of claims 1 to 3, characterized in that, After all the elliptic curve points in the multiple dot product operations of any of the sub-operation tasks are filled into the buckets, bucket aggregation is performed, including: The following formula is used to achieve the first Bucket aggregation is performed on each sub-task: in, For the first Sub-computation tasks Indicates the first One bucket point, It is an integer. This represents the window size for the Pippenger algorithm.

5. A multi-scalar multiplication apparatus, characterized in that, The apparatus for accelerating the operation of the multi-scalar multiplication on a central processing unit (CPU) platform includes: The segmentation module is used to segment the original operation task of large-scale elliptic curve multi-scalar multiplication into multiple sub-operation tasks. Each sub-operation task includes multiple dot multiplication operations. Each dot multiplication operation includes a sub-scalar and an elliptic curve point. The elliptic curve point in each dot multiplication operation corresponds to the sub-scalar. The first bucket module is used to fill the multiple elliptic curve points into multiple buckets based on the subscalars corresponding to the multiple elliptic curve points. In the case where there are two elliptic curve points that both need to be filled into the first bucket, the two elliptic curve points are added to the first-level storage sequence as a point to be added. The first bucket is any one of the multiple buckets. The dot-add operation module is used to execute the N dot-add operations to be performed in parallel based on SIMD instructions when there are N dot-add operations to be performed in the first-level storage sequence, so as to obtain N first dot-add results. The second bucket module is used to write the results of the N first points back to the corresponding bucket points; The bucket aggregation module is used to aggregate buckets after all the elliptic curve points in multiple dot multiplication operations of any of the sub-operation tasks have been filled into the buckets. The computation module is used to obtain the computation result of the original computation task based on the result of the bucket aggregation of each sub-computation task; The second bucket filling module is also used to add the second point addition result and the point addition operation of the second point addition result and the second bucket point as a point addition operation to be added to the secondary storage sequence. The second point addition result is any one of the N first point addition results, and the second bucket point is the bucket point corresponding to the second point addition result. When there are at least N pending addition operations in the secondary storage sequence, the first N pending addition operations in the secondary storage sequence are executed in parallel based on SIMD instructions to obtain N third addition results; Based on the N third-point addition results, update the value of the corresponding bucket point to realize the writing of the N first-point addition results back to the corresponding bucket point.

6. A computer device, characterized in that, The computer device includes a memory and a processor, wherein the memory stores at least one computer program, which is loaded and executed by the processor to implement the method according to any one of claims 1 to 4.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to implement the method of any one of claims 1 to 4.

8. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the method described in any one of claims 1 to 4.

Images