A self-isomorphic mapping hardware accelerator and acceleration method based on full homomorphic encryption

Abstract

The application discloses a hardware accelerator and an acceleration method based on a full homomorphic encryption isomorphism mapping, and the accelerator comprises a polynomial storage area, a Tag and Sel reloading unit, a read address calculation unit, a permutation network and a cache unit. The method comprises the following steps: according to the architecture parallelism configured during compilation and the maximum polynomial degree to be supported, after compilation, the isomorphism mapping of the polynomial can be completed according to the actual polynomial degree and the isomorphism parameter of the input. The embodiment of the application can reduce the domain conversion overhead and the overhead of the bit inversion arrangement coefficient, and reduce the calculation burden of the homomorphic rotation. The application can be widely applied to the field of homomorphic encryption technology.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of homomorphic encryption, and particularly relates to a hardware accelerator for automorphism mapping based on full homomorphic encryption and an acceleration method. BACKGROUND

[0002] Full homomorphic encryption is a technology capable of directly performing operations in the state of data encryption, supporting algebraic operations equivalent to plaintext without decryption. However, the computational complexity of the full homomorphic encryption scheme is much higher than that of traditional encryption algorithms, especially when performing complex operations such as homomorphic multiplication and homomorphic rotation, which involve a large number of polynomial operations, increasing the storage and computing burden and leading to low computational efficiency. In machine learning applications based on the CKKS full homomorphic encryption scheme, homomorphic rotation is one of the key operators. It is used to cyclically shift the encrypted plaintext vector, thereby constructing higher-level full homomorphic operations. However, the homomorphic rotation operation relies on complex polynomial automorphism mapping The automorphism mappings under different rotation indices k are different, leading to irregular data access patterns and making hardware implementation complex. The current efficient hardware acceleration design for automorphism mapping includes the automorphism mapping vectorization method in the coefficient domain and the arbitrary automorphism mapping of polynomials in the NTT domain. However, the automorphism mapping vectorization method in the coefficient domain needs to perform domain conversion before and after the mapping, and the computational complexity O(nlog2n) of domain conversion is much higher than the computational complexity O(n) of automorphism mapping, which will bring additional computational overhead to the homomorphic rotation operation that cannot be ignored. In addition, it is necessary to determine whether the coefficients after permutation need to be negated and further convert negative coefficients to positive numbers by using a modulus adder, thus consuming the computational resources of p negation determinators and p modulus adders. For the arbitrary automorphism mapping of polynomials in the NTT domain, it will take about 2×(n / p) cycles to complete the automorphism mapping of one polynomial, 2×p×log2p 2-to-1 multiplexers are required to construct SPN, and a cache with a capacity of n is required. In addition, they require that the polynomial coefficients in the NTT domain are arranged in natural order, which requires bit reversal arrangement of the polynomial coefficients in the coefficient domain in advance, with a computational complexity of O(n), which brings additional overhead of irregular arrangement of coefficients.

[0003] In summary, the technical problems in the related art need to be improved. SUMMARY

[0004] The main purpose of the embodiments of the present application is to provide a hardware accelerator for automorphism mapping based on full homomorphic encryption and an acceleration method, which can reduce the domain conversion overhead and the overhead of bit reversal arrangement of coefficients, and reduce the computational burden of homomorphic rotation.

[0005] To achieve the above object, an aspect of the embodiment of the present application provides a hardware accelerator for automorphism mapping based on full homomorphic encryption, which comprises a polynomial storage area, a Tag and Sel reloading unit, a read address calculation unit, a permutation network and a cache unit, a first output end of the Tag and Sel reloading unit is connected with an input end of the read address calculation unit, a second output end of the Tag and Sel reloading unit is connected with a first input end of the permutation network, a first output end of the read address calculation unit is connected with a first input end of the polynomial storage area, a second output end of the read address calculation unit is connected with a second input end of the permutation network, an output end of the polynomial storage area is connected with a third input end of the permutation network, an output end of the permutation network is connected with an input end of the cache unit, and an output end of the cache unit is connected with a second input end of the polynomial storage area, wherein:

[0006] The Tag and Sel reloading unit is configured to reload according to a first unit activation signal, a running configurable polynomial degree and an automorphism parameter, to generate a value of a Tag Table register and a value of a Sel Table register.

[0007] The read address calculation unit is configured to calculate according to a second unit activation signal, the running configurable polynomial degree, the automorphism parameter and the value of the Tag Table register, to generate a front-half area read enable signal, a rear-half area read enable signal, a half-area read address signal and a Col granularity permutation enable signal.

[0008] The polynomial storage area is configured to read data according to the front-half area read enable signal, the rear-half area read enable signal and the half-area read address signal, to generate a front-half area read data valid signal, a rear-half area read data valid signal and screened half-area read data.

[0009] The permutation network is configured to permute according to the screened half-area read data, the front-half area read data valid signal, the rear-half area read data valid signal, the Col granularity permutation enable signal and the value of the Sel Table register, to generate a permutation result and a permutation result valid signal.

[0010] The cache unit is configured to cache according to the permutation result, the permutation result valid signal and the running configurable polynomial degree, to output a front-half area write-back enable signal, a rear-half area write-back enable signal and half-area write-back data and return to the polynomial storage area, to complete the automorphism mapping of the polynomial.

[0011] In some embodiments, the self-isomorphic mapping hardware accelerator has a compile configurable architecture parallelism of p, a maximum polynomial degree of N, a run configurable polynomial degree of n, and a self-isomorphic parameter of [5 k ] 2n .

[0012] In some embodiments, the Tag and Sel reload unit includes a first unit controller, a Tag calculation core, a position index identification register, and a source data source identification register, a first output terminal of the first unit controller is connected with an input terminal of the Tag calculation core, a second output terminal of the first unit controller is connected with a first input terminal of the position index identification register, a third output terminal of the first unit controller is connected with a first input terminal of the source data source identification register, a first output terminal of the Tag calculation core is connected with a second input terminal of the position index identification register, and a second output terminal of the Tag calculation core is connected with a second input terminal of the source data source identification register, wherein:

[0013] the first unit controller is configured to control the operation of the Tag calculation core, the position index identification register, and the source data source identification register according to the first unit activation signal and the run configurable polynomial degree, and generate a first parameter signal, a first enable signal, a reload first enable signal, and a reload second enable signal;

[0014] the Tag calculation core is configured to obtain the first parameter signal, the first enable signal, and the self-isomorphic parameter, and perform calculation to generate a position index identification and a source data source identification;

[0015] the position index identification register is configured to update the register value according to the reload first enable signal and the position index identification, and output the value of the Tag Table register;

[0016] the source data source identification register is configured to update the register value according to the reload second enable signal and the source data source identification, and output the value of the Sel Table register.

[0017] In some embodiments, the read address calculation unit includes a second unit controller and a read address calculation core, an output terminal of the second unit controller is connected with an input terminal of the read address calculation core, wherein:

[0018] The second unit controller is configured to control operation of the read address calculation core according to the second unit activation signal and the operationally configurable polynomial degree, to generate a second parameter signal, a second enable signal, the front-half-zone read enable signal, and the back-half-zone read enable signal.

[0019] The read address calculation core is configured to calculate the half-zone read address signal and the Col granularity permutation enable signal according to the second parameter signal, the second enable signal, the self-isomorphic parameter, and a value of the Tag Table register.

[0020] In some embodiments, the polynomial storage area includes a plurality of random access memories, and the plurality of random access memories are equally divided into a polynomial storage front-half zone and a polynomial storage back-half zone.

[0021] The polynomial storage front-half zone is configured to perform data reading according to the front-half-zone read enable signal and the half-zone read address signal, to generate the front-half-zone read data valid signal.

[0022] The polynomial storage back-half zone is configured to perform data reading according to the back-half-zone read enable signal and the half-zone read address signal, to generate the back-half-zone read data valid signal.

[0023] The front-half-zone read data valid signal and the back-half-zone read data valid signal are selected as selection signals of half-zone read data, and the selected half-zone read data is output.

[0024] In some embodiments, the polynomial storage area includes p Bank units, each of the Bank units includes at least one random access memory with a depth of and an actual filling depth of the random access memory in the Bank unit is

[0025] In some embodiments, the permutation network is a p×p banyan permutation network, and includes log2p stages, each stage includes p 2-to-1 multiplexers, and a pipeline register is inserted between stages.

[0026] In some embodiments, the cache unit includes a cache area and a third unit controller, an output terminal of the third unit controller is connected to an input terminal of the cache area, and the third unit controller is configured to:

[0027] The cache area is configured to use the permutation result valid signal as a unified write enable signal of the cache, and use the permutation result as write data of a cache bank.

[0028] The third unit controller is configured to calculate actual filling depths of the random access memories according to the running configurable polynomial degree, count the uniform write enable signal of the cache, write the counter value as the uniform write address of the cache to write the write data of the cache group, output the front-half area write-back enable signal, the rear-half area write-back enable signal and the half-area write-back data to the polynomial storage area, and complete the automorphism mapping of the polynomial.

[0029] In some embodiments, the total capacity of the cache unit is The cache unit comprises a plurality of cache groups, and each cache group comprises at least one random access memory with a depth of .

[0030] To achieve the above object, another aspect of the embodiment of the present application proposes an acceleration method of an automorphism mapping hardware accelerator based on full homomorphic encryption, which comprises the following steps:

[0031] configuring a polynomial degree and an automorphism parameter, activating a Tag and Sel reloading unit, reloading a position index identification register and a source data source identification register, and generating a value of a Tag Table register and a value of a Sel Table register;

[0032] configuring the polynomial degree and the automorphism parameter, combining the value of the Tag Table register, activating a read address generation unit, obtaining a front-half area read enable signal, a rear-half area read enable signal, a half-area read address signal and a Col granularity permutation enable signal;

[0033] obtaining half-area read data, a front-half area read data valid signal and a rear-half area read data valid signal from a polynomial storage area according to the front-half area read enable signal, the rear-half area read enable signal and the half-area read address signal;

[0034] screening a permutation network selection parameter from a SelTable register according to the front-half area read data valid signal and the rear-half area read data valid signal, combining the Col granularity permutation enable signal and the permutation network selection parameter, performing Col granularity permutation and Bank granularity recursive permutation on the half-area read data, and obtaining a permutation result and a permutation result valid signal;

[0035] according to the permutation result valid signal, writing the permutation result into a cache until the permutation result is completely loaded into the cache, reading the permutation result from the cache in sequence and writing back to a corresponding half-area of the polynomial storage area, and completing the automorphism mapping of the polynomial.

[0036] The embodiments of the present application at least have the following beneficial effects: the present application provides a self-isomorphism mapping hardware accelerator and an acceleration method based on full homomorphic encryption, the scheme generates the value of the Tag Table register and the value of the Sel Table register through the Tag and Sel overload unit, and generates the front half area read enable signal, the rear half area read enable signal, the half area read address signal and the Col granularity permutation enable signal through the read address calculation unit, and then performs data screening through the polynomial storage area, and finally performs permutation through the permutation network to generate the permutation result and the permutation result valid signal, which allows efficient polynomial self-isomorphism mapping, avoids the domain conversion overhead and the overhead of bit-reversal permutation coefficient, and reduces the calculation burden of homomorphic rotation. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 is a structural schematic diagram of a self-isomorphism mapping hardware accelerator based on full homomorphic encryption provided by the embodiments of the present application;

[0038] Figure 2 is a step flow schematic diagram of an acceleration method of a self-isomorphism mapping hardware accelerator based on full homomorphic encryption provided by the embodiments of the present application;

[0039] Figure 3 is a schematic diagram of polynomial coefficient index distribution under NTT domain when N=64, p=8, n=64 provided by the embodiments of the present application;

[0040] Figure 4 is a structural schematic diagram of a Tag calculation core provided by the embodiments of the present application;

[0041] Figure 5 is a structural schematic diagram of a dynamic bit-reversal component (bitrev) provided by the embodiments of the present application;

[0042] Figure 6 is a structural schematic diagram of a dynamic right shift component (div2fd) provided by the embodiments of the present application;

[0043] Figure 7 is a pseudo code schematic diagram of a Tag and Sel overload unit provided by the embodiments of the present application;

[0044] Figure 8 is a structural schematic diagram of a read address calculation core provided by the embodiments of the present application;

[0045] Figure 9 is a pseudo code schematic diagram of a read address calculation unit provided by the embodiments of the present application;

[0046] Figure 10 is a pseudo code schematic diagram of a permutation network provided by the embodiments of the present application. DETAILED DESCRIPTION

[0047] In order to make the purposes, technical solutions and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the specific examples described herein are only intended to explain the present application and are not intended to limit the present application. When the following description refers to the accompanying drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary examples do not represent all implementations consistent with embodiments of the present application. They are merely examples of systems and methods consistent with some aspects of the embodiments of the present application as detailed in the appended claims.

[0048] It can be understood that the terms "first", "second" and the like used in the present application can be used herein to describe various concepts, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiments of the present application, the first information can also be referred to as the second information, and similarly, the second information can also be referred to as the first information. Depending on the context, the word "if" as used herein can be interpreted as "when" or "when" or "in response to determining".

[0049] The terms "at least one", "multiple", "each", "any" and the like used in the present application include one, two or more than two, multiple includes two or more than two, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as understood by a person skilled in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application and are not intended to limit the present application.

[0051] Before the embodiments of the present application are described in detail, first, some nouns and terms involved in the embodiments of the present application are described, and the nouns and terms involved in the embodiments of the present application are applicable to the following explanations.

[0052] In machine learning applications based on the CKKS fully homomorphic encryption scheme, homomorphic rotation is one of the key operators. It is used to cyclically shift the encrypted plaintext vector, thereby constructing higher-level fully homomorphic operations such as bootstrap, matrix-vector multiplication and convolution calculation. However, the homomorphic rotation operation relies on a complex polynomial automorphism The automorphism mapping under different rotation indices k is different, resulting in irregular data access patterns and making hardware implementation complex. In order to adapt to different rotation indices, each data storage location needs to be connected to a series of different data storage locations, further increasing the complexity of wiring and hardware cost. In addition, in the CKKS fully homomorphic encryption scheme, the ciphertext polynomial is usually placed in the NTT domain (evaluation domain) to accelerate the calculation of polynomial multiplication. If the automorphism mapping is performed in the coefficient domain, the ciphertext polynomial needs to be converted from the NTT domain to the coefficient domain first, and then converted back to the NTT domain after the automorphism mapping is completed. The calculation complexity of NTT / INTT for a polynomial of degree n is O(nlog2n), and this frequent domain conversion further increases the calculation overhead of the homomorphic rotation operation. Therefore, efficient hardware acceleration design for automorphism mapping is crucial.

[0053] In related technologies, there are some deficiencies, such as the vectorization method HFAuto of automorphism mapping in the coefficient domain. They regard the ciphertext polynomial of degree n as a vector of length n, and divide the vector into n / p sub-vectors of length p under the parallel degree p, so as to store a ciphertext polynomial with p BRAMs of depth n / p. It proves the feasibility of vectorized polynomial automorphism mapping under this storage structure. HFAuto performs polynomial automorphism mapping in the coefficient domain, but its shortcomings are: domain conversion is needed before and after the mapping, and the calculation complexity of domain conversion O(nlog2n) is much larger than that of automorphism mapping O(n), which will bring additional calculation overhead to the homomorphic rotation operation that cannot be ignored; secondly, it is necessary to judge whether the coefficients after permutation need to be negated, and further convert the negative coefficients to positive numbers by using the modulus adder, so it also consumes the calculation resources of p negation judges and p modulus adders.

[0054] In addition, for any automorphism mapping of a polynomial in the NTT domain, a stream permutation network (SPN) is selected instead of an expensive Crossbar to perform parallel permutation of coefficients. The implementation of the SPN is based on a benes permutation network structure, and high-throughput arbitrary data permutation can be achieved. The execution process of the SPN is as follows: first, n coefficients are streamed into the first spatial permutation network for n / p cycles, and data routing control is completed by a routing table in the control logic unit. The output of the first spatial permutation network is written into p buffers according to the address generated by the AGU; second, after the results of the first spatial permutation are all written into the buffer area, the second spatial permutation is started, p are read from the buffer area every cycle and sent to the second spatial permutation network for the second spatial permutation, which also takes n / p cycles. Therefore, they will take about 2x(n / p) cycles to complete an automorphism mapping of a polynomial, and 2xPxlog2P 2-to-1 multiplexers and a buffer with a capacity of n are required to build the SPN. In addition, they require that the coefficients of the polynomial in the NTT domain are arranged in natural order, which requires bit-reversal arrangement of the coefficients of the polynomial in the coefficient domain in advance, with a computational complexity of O(n), which brings additional overhead of irregular arrangement of coefficients.

[0055] Therefore, in the embodiments of the present application, a hardware accelerator for automorphism mapping based on full homomorphic encryption is provided, which efficiently implements vectorized automorphism mapping in the NTT domain by using a simpler permutation network, and avoids the overhead of domain conversion and bit-reversal arrangement of coefficients. The architecture has higher scalability and flexibility.

[0056] First, the embodiments of the present application perform a rigorous mathematical analysis for constructing a vectorized automorphism mapping scheme in the NTT domain.

[0057] For a polynomial a(x) = a0 + a1x +... + an-1xn-1 in the coefficient domain, where the coefficient ring R = Z / (x + 1) has a coefficient representation a = (a[0], a[1],..., a[n-1]), where a[j] = a, integer j ∈ [0, n). n-1 x n-1 ∈R q , where the coefficient ring R q = Z q / (x n +1) has a coefficient representation a = (a[0], a[1],..., a[n-1]), where a[j] = a j , integer j ∈ [0, n). It has a point value representation A = (A[0], A[1],..., A[n-1]) in the NTT domain, A[i] = a(ψ bitrev (i)) mod q, i ∈ [0, n). The primitive root g satisfies g q-1 ≡ 1 (mod q), and bitrev(·) is a bit-reversal operation on the binary representation of i.

[0058] In order to cyclically left shift the hidden plaintext slot by k units, a(x) is subjected to an automorphism mapping A polynomial a'(x) is obtained, which has a point value representation A'=(A'[0], A'[1],..., A'[n-1]) under the NTT domain, and for i'∈[0, n) has Let:

[0059]

[0060] Then there is:

[0061]

[0062] Therefore, the automorphism mapping with a rotation exponent of k can be completed by the permutation of A→A' under the NTT domain. Since the automorphism mapping is irregular, in order to avoid a Write-After-Read conflict, additional storage space is required to cache the permutation result.

[0063] The polynomial coefficient storage structure under the NTT domain in the present application is as follows: when the architecture parallelism is p, each polynomial storage area has p banks, and each bank has 2 RAMs (in order to meet the data bandwidth of NTT / INTT calculation), and the filling depth of each RAM is Where n is the polynomial degree, and p, n and fd are powers of 2. It is assumed that the coefficients of the polynomial to be subjected to the automorphism mapping are stored in storage area A, and the permutation result is cached in storage area A'. In storage area A', the coefficient index i'∈[0, n) is specifically distributed in the b'th bank, the r'th row and the c'th column, that is, Bankb', Row r', Col c', denoted as A'(b', r', c'), where c'=i'mod2, that is, i'=b'×(2×fd)+r'×2+c'. Similarly, the coefficient index i∈[0, n) in storage area A is specifically distributed in the b'th bank, the r'th row and the c'th column, denoted as A(b, r, c). Then when the automorphism mapping is performed, there is

[0064] Referring to Figure 1 , Figure 1 A flowchart of a hardware accelerator for automorphism mapping based on full homomorphic encryption according to an embodiment of the present application is provided, referring to Figure 1The accelerator comprises a polynomial storage area, a Tag and Sel reloading unit, a read address calculation unit, a permutation network and a cache unit, a first output end of the Tag and Sel reloading unit is connected with an input end of the read address calculation unit, a second output end of the Tag and Sel reloading unit is connected with a first input end of the permutation network, a first output end of the read address calculation unit is connected with a first input end of the polynomial storage area, a second output end of the read address calculation unit is connected with a second input end of the permutation network, an output end of the polynomial storage area is connected with a third input end of the permutation network, an output end of the permutation network is connected with an input end of the cache unit, and an output end of the cache unit is connected with a second input end of the polynomial storage area.

[0065] Firstly, it needs to be explained that the hardware accelerator for self-homomorphism mapping based on full homomorphic encryption provided by the embodiment of the application can configure the architecture parallel degree p and the maximum polynomial degree N at the compiling time, and can configure the actual polynomial degree n (2p≤n≤N) and the self-homomorphism parameter at the running time. k ] 2n Wherein p, N, n are all powers of 2, and wherein:

[0066] The Tag and Sel reloading unit is used for calculating and reloading according to the first unit activation signal, the running configurable polynomial degree and the self-homomorphism parameter, generating the value of the Tag Table register and the value of the Sel Table register;

[0067] Specifically, the Tag and Sel reloading unit comprises a first unit controller, a Tag calculation core, a position index identification register and a source data source identification register, a first output end of the first unit controller is connected with an input end of the Tag calculation core, a second output end of the first unit controller is connected with a first input end of the position index identification register, a third output end of the first unit controller is connected with a first input end of the source data source identification register, a first output end of the Tag calculation core is connected with a second input end of the position index identification register, and a second output end of the Tag calculation core is connected with a second input end of the source data source identification register, wherein the first unit controller is used for controlling the work of the Tag calculation core, the position index identification register and the source data source identification register according to a first unit activation signal and a running configurable polynomial degree, and generating a first parameter signal, a first enable signal, a reloading first enable signal and a reloading second enable signal; the Tag calculation core is used for acquiring the first parameter signal, the first enable signal and a self-isomorphic parameter and performing calculation, and generating a position index identification and a source data source identification; the position index identification register is used for updating the register value according to the reloading first enable signal and the position index identification, and outputting the value of a Tag Table register; and the source data source identification register is used for updating the register value according to the reloading second enable signal and the source data source identification, and outputting the value of a Sel Table register.

[0068] In the embodiment, inside the Tag and Sel reloading unit: a unit controller is responsible for controlling the whole unit, which calculates parameters log2n, fd and log2fd according to the valid activation signal and the polynomial degree n, and updates the internal state machine, thereby providing parameters (log2n, fd, log2fd, [5 k ] 2nThe unit controller provides the unit controller and enable signals, and generates reload enable signals for each register in the Tag Table and Sel Table. The Tag calculation core calculates the position index identifier (tag) and source data source identifier (sel) of BankO ~ (p-1) in sequence according to the parameters and enable signals provided by the unit controller, and sends them to the input of the Tag Table and Sel Table as write data for the registers. The Tag Table contains p registers, receives p tag reload enable signals provided by the unit controller and write data provided by the Tag calculation core, and updates the corresponding register values. The tag[b] register value serves as the position identifier index of Bank b and is provided to the read address calculation unit for generating the read address of Bank b, where b∈[0, p). The Sel Table contains p registers, receives p sel reload enable signals provided by the unit controller and write data provided by the Tag calculation core, and updates the corresponding register values. The sel[b′] register value serves as the source data source identifier of Bank b′ and is provided to the permutation network for generating the data selection signal, where b′∈[0, p).

[0069] The structure of the Tag computing core is as follows: Figure 4 As shown, the structure of the dynamic bit inversion component is as follows: Figure 5 As shown, the structure of the dynamic right shift unit is as follows: Figure 6 As shown. The pipeline stage number log2N of the dynamic bit-flipping component is determined by the compile-time parameter N. At runtime, based on the input parameter log2n, it performs a bit-flipping operation on the binary representation of the input data din, outputting dou = bitrev(din). The pipeline stage number 1 + log2FD of the dynamic right shift component is determined by the compile-time parameter... It is confirmed that at runtime, the input data i is right-shifted by 1 + log2fd bits based on the input parameter log2fd, and the output result is determined.

[0070] Before performing the polynomial automorphism mapping, based on the runtime input parameters n and [5] k ] 2n This involves calculating tags and overloading the Tag Table and Sel Table. The pseudocode for the Tag and Sel overload is as follows: Figure 7 As shown, the calculation of Tag and the overloading of Sel are active demand queries, sequentially querying which bank the source operands required for Bank b′ = 0, 1, ..., p-1 originate from, and loading the valid b into the sel[b′] register in the Sel Table, which will later be used to generate the data selection signal for the permutation network. The overloading of Tag, on the other hand, is a passive demand query matching, i.e., querying Bank idx. bThe source operand with index = 0, 1,..., p-1 is required by which Bank b' when idx b When the valid b value is equal to b', the coefficient index of Bank b' is reloaded into the tag[b] register in the Tag Table as the position index of Bank b, which identifies the initial value of the variable for the read address calculation unit.

[0071] The read address calculation unit is configured to calculate according to the second unit activation signal, the running configurable polynomial degree, the autotopism parameter and the value of the Tag Table register, to generate the first-half zone read enable signal, the second-half zone read enable signal, the half-zone read address signal and the Col granularity permutation enable signal.

[0072] Specifically, the read address calculation unit comprises a second unit controller and a read address calculation core, the output of the second unit controller is connected with the input of the read address calculation core, wherein the second unit controller is configured to control the operation of the read address calculation core according to the second unit activation signal and the running configurable polynomial degree, the second parameter signal, the second enable signal, the first-half zone read enable signal and the second-half zone read enable signal; the read address calculation core is configured to calculate according to the second parameter signal, the second enable signal, the autotopism parameter and the value of the Tag Table register, to generate the half-zone read address signal and the Col granularity permutation enable signal.

[0073] In the embodiment, in the read address calculation unit: the unit controller is responsible for controlling the whole unit, which calculates the parameters log2n and fd according to the valid activation signal and the polynomial degree n, and updates the internal state machine, thereby providing the parameters (log2n, fd, [5 k ] 2n , tag) and the enable signal for each read address calculation core, and generates the first-half zone read enable signal and the second-half zone enable signal. The read address calculation core calculates the corresponding Bank read address and the Col granularity permutation enable signal of the read data pair according to the parameters and the enable signal provided by the unit controller.

[0074] The structure of the read address calculation core is shown in Figure 8 . The pseudo code of the read address calculation is shown in Figure 9 , which aims to make the write-back address r' of the Bank in the half-zone increase in the natural order, thereby carrying out the calculation task of the Bank read address r. Specifically:

[0075] For Before the start of the address calculation of the first half, the unit controller sends the value of the register tag[u] in the Tag Table to the tag input of the u-th read address calculation core, and provides a low level enable signal en, so that the index variable i' is initialized to tag[u]. In the following fd-1 cycles, en is pulled high, so that i' is increased by 2 every cycle. When i' is increased to tag[u]+2×(fd-1), the unit controller inserts a cycle of pipeline bubble, and sends the value of the register tag[u+p / 2] to the tag input of the u-th read address calculation core, while en is pulled low, preparing to start the calculation of the second half of the read address, i.e. the next cycle i' is successfully initialized to tag[u+p / 2], and in the following fd-1 cycles, en is pulled high, so that i' is increased by 2 every cycle. At the same time, when i' is a valid value, the unit controller marks the data valid signal valid as high, and implements its synchronization with the read address calculation core, while when i' is an invalid value, valid is marked as low.

[0076] The data valid signal ren at the same level as the read address r will be used to generate the first half read enable signal renO and the second half read enable signal ren1. The half selection signal rsel is initially 0, indicating that the first half is selected, so that the valid renO=(ren&~rsel) is generated. After the completion of the first half read address calculation, since the unit controller marks valid as low when inserting a cycle of pipeline bubble, after detecting the falling edge of ren, rsel is inverted to 1, indicating that the second half is selected, so that the valid ren1=(ren&rsel) is generated. When the second half read address calculation is completed, the falling edge of ren is detected, and rsel is inverted to 0, preparing for the next read address generation task.

[0077] Since there is a one-cycle delay in reading data from the Bank, it is necessary to cache the Col granularity permutation enable c for one cycle, and then synchronize it with the half read data of the polynomial storage area to the input of the permutation network.

[0078] The polynomial storage area is used to read data according to the first half read enable signal, the second half read enable signal and the half read address signal, to generate the first half read data valid signal, the second half read data valid signal and the screened half read data;

[0079] Specifically, the polynomial storage area includes several random access memories (RAMs). These RAMs are divided into equal parts to obtain a first half and a second half of the polynomial storage area. The first half of the polynomial storage area is used to read data based on the first half read enable signal and the second half read address signal, generating a valid first half read data signal. The second half of the polynomial storage area is used to read data based on the second half read enable signal and the second half read address signal, generating a valid second half read data signal. The valid first half read data signal and the valid second half read data signal are used as selection signals for the second half read data to filter the data, and the filtered second half read data is output.

[0080] Furthermore, it should be noted that the polynomial storage area consists of p Bank units, and each Bank unit includes at least one unit with a depth of p. The random access memory (RAM) in the Bank cell has an actual fill depth of 1.

[0081] In this embodiment, all coefficients of a polynomial are stored. It consists of p banks, each containing two banks of depth p. The RAM. The actual fill depth fd of each RAM is determined by the actual polynomial degree n input at runtime, i.e. n is a power of 2, and 2p ≤ n ≤ N. Divide the storage area into the first half. and the second half Figure 3 The distribution of polynomial coefficient indices in the NTT field is given when N=64, p=8, and n=64, where the coefficient index i=23 is located in Bank 2, Row 3, Col 1. The first half of the region includes Banks 0 to 3, and the second half includes Banks 4 to 7.

[0082] Specifically, the u-th read address signal is used as Banku and The read address, where Based on the valid read address signal and two half-zone read enable signals, the p / 2 coefficient pairs to be replaced are read from their respective half-zones. Since the read operation has a one-cycle delay, the first and second half-zone read enable signals are buffered for one clock cycle and used as the valid first and second half-zone read data signals, respectively, and sent to the input of the replacement network. Simultaneously, the valid first half-zone read data signal also serves as the selection signal for the half-zone read data; if it is valid, the first half-zone read data is selected; otherwise, the second half-zone read data is selected, and the selected half-zone read data is sent to the input of the replacement network. Furthermore, based on the valid half-zone write enable signal and write address signal, p / 2 write-back data pairs can be written back to their respective half-zones.

[0083] The permutation network is used for generating a permutation result and a permutation result valid signal according to the screened half-region read data, the front half-region read data valid signal, the rear half-region read data valid signal, a Col granularity permutation enable signal and a value of the Sel Table register;

[0084] Specifically, the permutation network is a p*p banyan permutation network, and has log2p levels, each level being composed of p 2-to-1 multiplexers, and a pipeline register being inserted between levels.

[0085] In the embodiment, a pseudo code of the permutation network algorithm is shown in the following table, and specifically: Figure 10 Specifically, the permutation network first level (s=0) performs Col granularity permutation on a pair of read data of the same Bank according to the Col granularity permutation enable signal. In addition, the sel register value participating in the pipeline is screened according to the front half-region read data valid signal, and when the sel register value is high, the sel[0]-sel[p / 2-1] permutation network selection parameters of the Sel Table are screened, otherwise, the sel[p / 2]-sel[p-1] permutation network selection parameters are screened, and the pipeline register is used for register storage. Meanwhile, the front half-region read data valid signal and the rear half-region read data valid signal are operated by OR, as a data valid identifier, and the pipeline register is used for register storage. The next logp-1 levels generate the data selection signals of the multiplexers of each level according to the sel register value of each level, and complete the Bank granularity coefficient recursive permutation. After the permutation result and the permutation result valid signal of the last level are stored, they are sent to the input end of the cache unit, and are ready for the cache of the permutation result.

[0086] The cache unit is used for caching according to the permutation result, the permutation result valid signal and the running configurable polynomial degree, and outputs the front half-region writeback enable signal, the rear half-region writeback enable signal and the half-region writeback data and returns to the polynomial storage area, to complete the automorphism mapping of the polynomial.

[0087] Specifically, the cache unit includes a cache area and a third unit controller, and the output end of the third unit controller is connected with the input end of the cache area. The cache area is used for taking the permutation result valid signal as a unified write enable signal of cache and taking the permutation result as write data of a cache group. The third unit controller is used for calculating the actual filling depth of a plurality of random access memories according to the running configurable polynomial degree, counting the unified write enable signal of cache, taking the counter value as a unified write address of cache for writing the write data of the cache group, and outputting the front half-region writeback enable signal, the rear half-region writeback enable signal and the half-region writeback data and returning to the polynomial storage area, to complete the automorphism mapping of the polynomial.

[0088] Further, it needs to be noted that the total capacity of the cache unit is Include Each cache group includes at least one cache group with a depth of [missing information]. Random access memory.

[0089] In this embodiment, when all permutation results of a half-region are loaded into the cache, the permutation results can be read from the cache sequentially and written back to the corresponding half-region of the polynomial storage area. When all permutation results of the second half-region are written back to the second half-region of the polynomial storage area, it means that the polynomial automorphism mapping has been completed.

[0090] Specifically, within the cache unit: the valid signal of the substitution result serves as the unified write enable for the cache, and the u-th substitution result serves as the write data for cache group u, where u∈[0,p / 2). The unit controller calculates fd based on the polynomial degree n, counts the valid cache write enable signals, and uses the counter value as the unified write address for the cache (the initial counter value is 0). When the write address increases to (fd-1) and the cache write enable is valid, the write address will be cleared, and the write-back state machine will transition from the idle state (IDLE) to the write front half state (WB0). When the write-back state machine is in the WB0 state, it generates a valid cache read enable signal, a cache read address, and a valid write-back enable signal for the front half. When the cache read address increases to (fd-1), the write-back state machine will switch from WB0 to the write back half state (WB1), and the cache read address will be cleared. When the write-back state machine is in the WB1 state, it generates a valid cache read enable signal, a cache read address, and a valid write-back enable signal for the back half. When the cache read address increases to (fd-1), the write-back state machine will switch from WB1 to IDLE.

[0091] In summary, the vectorized automorphic mapping scheme in the NTT domain constructed in this invention starts from the active requirements of A′ and obtains the source operands from A. This scheme has the following characteristics:

[0092] 1) Divide the polynomial coefficient index into the first half. and the second half Therefore, coefficient permutations will only occur within the same half-zone. For Since msb(i′) = 0, then in the calculation At that time, since lsb(bitrev(i′)) = 0, [5] k ] 2n It is an odd number. Since n is even, lsb(idx) ω ) = 0. And i = bitrev(idx) ω Then msb(i) = 0. Similarly, for For all cases, msb(i′) = 1, and msb(i) = 1. This means that A′[i′] ← A[i] always has msb(i′) = 1. or Coefficient permutations can only occur within the same half-zone; that is, coefficient permutations always occur in the first half-zone. Between banks, after Between the banks. Based on this characteristic, this invention divides the automorphic mapping task of the polynomial into a first-half coefficient permutation task and a second-half coefficient permutation task, and performs the two rounds of coefficient permutation tasks in a pipelined manner to reuse computing resources and cache resources in a time-sharing manner, thereby reducing resource overhead.

[0093] 2) It enables recursive coefficient replacement at the Bank granularity. When dividing the coefficient storage area with a 2×fd granularity, for the coefficients in storage area A′ located in Bank... All A′[i′] have source operands derived from Bank b in storage area A, where:

[0094]

[0095] Similarly, the coefficient storage area is divided with a granularity of u×(2×fd), where If it is a power of 2, then:

[0096]

[0097] Therefore, from the perspective of obtaining source operands from each Bank in A', source operand filtering can be achieved in a divide-and-conquer manner. Based on this characteristic, this invention uses a p×p banyan permutation network to implement recursive permutations at the Bank granularity. Compared with a benes permutation network of the same bandwidth, this invention can save the resources of one banyan permutation network.

[0098] 3) Perform coefficient replacement at the row and column levels, i.e., coefficient replacement within the Bank. For memory area A′ located at... For A′[i′] and A′[i′+1] (where i′ is even), the source operands come from Bankb and Rowr in memory area A, where:

[0099]

[0100] Therefore, on the basis of performing the coefficient replacement of the Bank granularity (as described in Property 2), it is also necessary to perform the coefficient replacement of the Row granularity and the Col granularity within the Bank. From the perspective of the Bank b' in A' obtaining the source operand, it is calculated that the source operand required by the Row r' comes from which row (denoted as r) of the Bank b in A. Meanwhile, it is further judged that the source operand of A'(b', r', 0) and A'(b', r', 1) comes from which one of A(b, r, 0) and A(b, r, 1). Specifically, the even index i' in the Row r' is taken as a representative, the source operand source index i is calculated, and thus and c = i mod 2. Let r be the read address of the Bank b in a, and let c be the Col replacement enable of the read data {A(b, r, 0), A(b, r, 1)}.

[0101] Based on this property, the position index identifier (Tag) and the source data source identifier (Sel) reloading unit (Tag and Sel reloading unit) are designed in the embodiments of the present application. From the perspective of the source data required by each Bank, the Tag of each Bank is calculated under different polynomial degrees and rotation exponents, a Tag Table is constructed, and the Tag Table is used for subsequent generation of the read address of the Bank. For example, the source data in the Bank 0 and the Bank 1 are required by the Bank 3 and the Bank 2 respectively in this self-mapping process, and then the Tag of the Bank 0 and the Bank 1 is set to 3 and 2 respectively. Meanwhile, from the perspective of the Bank actively obtaining the source data, the Sel of each Bank is calculated, a Sel Table is constructed, and the Sel Table is used for subsequent generation of the data selection signal of each stage of the replacement network. For example, in this self-mapping process, the Bank 2 and the Bank 3 need to obtain the source data in the Bank 1 and the Bank 0 respectively, and then the Sel of the Bank 2 and the Bank 3 is set to 1 and 0 respectively. In addition, the present application designs a read address calculation unit, generates the read enable and the read address of each Bank in the polynomial storage area according to the input polynomial degree, the self-mapping parameter and the Tag Table, and provides the Col replacement enable of the read data for the replacement network.

[0102] In summary, the present application constructs a vectorized self-mapping scheme under the NTT domain, supports the polynomial self-mapping of any rotation exponent k Based on the vectorized self-mapping scheme under the NTT domain, the present application proposes a self-mapping hardware accelerator and an acceleration method based on the homomorphic encryption, so as to efficiently realize the polynomial self-mapping under the NTT domain, and avoid the domain conversion overhead and the overhead of the bit-reversed permutation coefficient.

[0103] Please refer to Figure 2The embodiment of the application further provides an acceleration method of a self-homomorphism mapping hardware accelerator based on full homomorphic encryption, which can realize the self-homomorphism mapping hardware accelerator based on full homomorphic encryption.

[0104] S100, a polynomial degree and a self-homomorphism parameter are configured, a Tag and Sel reloading unit is activated, a position index identification register and a source data source identification register are reloaded, and a value of a Tag Table register and a value of a Sel Table register are generated;

[0105] S200, the polynomial degree and the self-homomorphism parameter are configured, a read address generation unit is activated in combination with the value of the Tag Table register, a front half area read enable signal, a rear half area read enable signal, a half area read address signal and a Col granularity permutation enable signal are obtained;

[0106] S300, according to the front half area read enable signal, the rear half area read enable signal and the half area read address signal, half area read data, a front half area read data valid signal and a rear half area read data valid signal are obtained from a polynomial storage area;

[0107] S400, according to the front half area read data valid signal and the rear half area read data valid signal, a permutation network selection parameter is screened out from the Sel Table register, and the Col granularity permutation enable signal and the permutation network selection parameter are combined to perform Col granularity permutation and Bank granularity recursive permutation on the half area read data, so that a permutation result and a permutation result valid signal are obtained;

[0108] S500, according to the permutation result valid signal, the permutation result is written into a cache, until the permutation result is completely loaded into the cache, the permutation result is read out from the cache in sequence and written back to a corresponding half area of the polynomial storage area, and self-homomorphism mapping of the polynomial is completed;

[0109] In summary, the acceleration method of the embodiment of the application is summarized as follows:

[0110] First, a polynomial degree n and a self-homomorphism parameter [5 k ] 2n are configured, a Tag and Sel reloading unit is activated, reloading of a Tag Table and a Sel Table is completed, the polynomial degree n and the self-homomorphism parameter [5 k ] 2n, the read address generation unit is activated to obtain a half-area read address, a front half-area read enable signal and a rear half-area read enable signal, and a Col granularity permutation enable signal of a read data pair, and then according to the half-area read address, the front half-area read enable signal and the rear half-area read enable signal, the half-area read data, the front half-area read data valid signal and the rear half-area read data valid signal are obtained from the polynomial storage area, in the permutation network, the front half-area read data valid signal is used to screen the permutation network selection parameter. According to the Col granularity permutation enable signal and the data selection signal at each level, the half-area read data is subjected to Col granularity permutation and Bank granularity recursive permutation to obtain a permutation result and a permutation result valid signal, and finally according to the permutation result valid signal, the permutation result is written into the cache. After the half-area permutation result is completely loaded into the cache, the permutation result is read out from the cache in turn and written back to the corresponding half-area of the polynomial storage area. The result of the polynomial automorphism mapping is stored in the polynomial storage area.

[0111] Therefore, the embodiments of the present application have the following advantages:

[0112] 1) A vectorized automorphism mapping scheme in the NTT domain is constructed, which allows efficient polynomial automorphism mapping while avoiding domain conversion overhead and bit-reversal permutation coefficient overhead, and reducing the calculation burden of homomorphic rotation.

[0113] 2) The constructed scheme allows the present application to use a simpler banyan permutation network to implement recursive permutation of coefficients, which can save the resources of one banyan permutation network compared with the benes permutation network of the same bandwidth.

[0114] 3) The proposed automorphism mapping hardware acceleration architecture provides compile-time configurability and runtime configurability, and has higher scalability and flexibility. According to the architecture parallelism p configured at compile time and the maximum polynomial degree N to be supported, the corresponding hardware acceleration architecture can be generated to adapt to different resource restrictions. After compilation, the actual polynomial degree n and the automorphism parameter [5 k ] 2n of the input polynomial can be used to complete arbitrary automorphism mapping of the polynomial.

[0115] It can be understood that the contents in the above method embodiments are applicable to the system embodiments, the system embodiments specifically implement the same functions as the above method embodiments, and achieve the same beneficial effects as the above method embodiments.

[0116] The preferred embodiments of the application are described above with reference to the accompanying drawings, but this does not limit the scope of the application. Any modifications, equivalent replacements and improvements made by those skilled in the art without departing from the scope and essence of the application shall be within the scope of the application.

Claims

1. A hardware accelerator for automorphic mapping based on fully homomorphic encryption, characterized in that, The accelerator includes a polynomial storage area, a Tag and Sel reloading unit, a read address calculation unit, a permutation network, and a cache unit. The first output of the Tag and Sel reloading unit is connected to the input of the read address calculation unit; the second output of the Tag and Sel reloading unit is connected to the first input of the permutation network; the first output of the read address calculation unit is connected to the first input of the polynomial storage area; the second output of the read address calculation unit is connected to the second input of the permutation network; the output of the polynomial storage area is connected to the third input of the permutation network; the output of the permutation network is connected to the input of the cache unit; and the output of the cache unit is connected to the second input of the polynomial storage area. Wherein: The Tag and Sel overload units are used to calculate the overload based on the first unit activation signal, the configurable polynomial degree and the automorphism parameters, and generate the values ​​of the Tag Table register and the Sel Table register. The read address calculation unit is used to calculate based on the second unit activation signal, the running configurable polynomial degree, the automorphism parameter and the value of the Tag Table register to generate a first half-zone read enable signal, a second half-zone read enable signal, a half-zone read address signal and a Col granularity permutation enable signal; The polynomial storage area is used to read data according to the first half-zone read enable signal, the second half-zone read enable signal and the half-zone read address signal, and to generate a first half-zone read data valid signal, a second half-zone read data valid signal and filtered half-zone read data; The permutation network is used to perform permutations based on the filtered half-area read data, the valid signal of the first half-area read data, the valid signal of the second half-area read data, the Col granularity permutation enable signal, and the value of the Sel Table register, to generate permutation results and permutation result valid signals; The caching unit is used to cache the permutation result, the valid signal of the permutation result and the degree of the configurable polynomial, output the first half-area write-back enable signal, the second half-area write-back enable signal and the half-area write-back data and send them back to the polynomial storage area to complete the self-isomorphic mapping of the polynomial.

2. The accelerator according to claim 1, characterized in that, The compile-configurable architecture parallelism of the automorphic mapping hardware accelerator is p, the maximum polynomial degree of the automorphic mapping hardware accelerator is N, the run-configurable polynomial degree of the automorphic mapping hardware accelerator is n, and the automorphic parameter of the automorphic mapping hardware accelerator is [5]. k ] 2n .

3. The accelerator according to claim 1, characterized in that, The Tag and Sel overload unit includes a first unit controller, a Tag calculation core, a position index identifier register, and a source data source identifier register. The first output of the first unit controller is connected to the input of the Tag calculation core; the second output of the first unit controller is connected to the first input of the position index identifier register; the third output of the first unit controller is connected to the first input of the source data source identifier register; the first output of the Tag calculation core is connected to the second input of the position index identifier register; and the second output of the Tag calculation core is connected to the second input of the source data source identifier register. Wherein: The first unit controller is used to control the operation of the Tag calculation core, the position index identifier register and the source data source identifier register according to the first unit activation signal and the running configurable polynomial degree, and to generate a first parameter signal, a first enable signal, a reloaded first enable signal and a reloaded second enable signal; The Tag calculation core is used to acquire the first parameter signal, the first enable signal and the automorphic parameter and perform calculations to generate a location index identifier and a source data source identifier. The location index identifier register is used to update the register value according to the reload first enable signal and the location index identifier, and output the value of the Tag Table register; The source data source identifier register is used to update the register value according to the reload second enable signal and the source data source identifier, and output the value of the Sel Table register.

4. The accelerator according to claim 1, characterized in that, The read address calculation unit includes a second unit controller and a read address calculation core. The output terminal of the second unit controller is connected to the input terminal of the read address calculation core, wherein: The second unit controller is used to control the operation of the read address calculation core according to the second unit activation signal and the running configurable polynomial degree, and to generate a second parameter signal, a second enable signal, the first half-zone read enable signal and the second half-zone read enable signal; The read address calculation core is used to calculate based on the second parameter signal, the second enable signal, the self-isomorphic parameter and the value of the Tag Table register to generate the half-zone read address signal and the Col granularity permutation enable signal.

5. The accelerator according to claim 1, characterized in that, The polynomial storage area includes several random access memories. These random access memories are divided equally to obtain a first half and a second half of the polynomial storage area, wherein: The first half of the polynomial storage is used to read data according to the first half read enable signal and the half read address signal, and generate the first half read data valid signal. The polynomial storage back half is used to read data according to the back half read enable signal and the half half read address signal, and generate the back half read data valid signal; The valid signals of the first half-zone read data and the valid signals of the second half-zone read data are used as selection signals for half-zone read data and then filtered to output the filtered half-zone read data.

6. The accelerator according to claim 5, characterized in that, The polynomial storage area consists of p Bank cells, each Bank cell including at least one cell with a depth of p. The random access memory in the Bank cell has an actual fill depth of 1.

7. The accelerator according to claim 1, characterized in that, The permutation network is a p×p Banyan permutation network with a total of log2p stages. Each stage consists of p 2-to-1 multiplexers, and pipeline registers are inserted between stages.

8. The accelerator according to claim 1, characterized in that, The cache unit includes a cache area and a third unit controller, wherein the output of the third unit controller is connected to the input of the cache area, wherein: The buffer is used to use the valid signal of the replacement result as the unified write enable signal of the buffer, and the replacement result as the write data of the buffer group; The third unit controller is used to calculate the actual fill depth of several random access memories based on the configurable polynomial degree, count the unified write enable signal of the cache, use the counter value as the unified write address of the cache to write the write data of the cache group, output the first half write back enable signal, the second half write back enable signal and the half half write back data and send them back to the polynomial storage area to complete the polynomial automorphic mapping.

9. The accelerator according to claim 8, characterized in that, The total cache capacity of the cache unit is Include A cache group, the cache group including at least one depth of Random access memory.

10. An acceleration method for a self-isomorphic mapping hardware accelerator based on fully homomorphic encryption, characterized in that, The method includes the following steps: Configure the polynomial degree and automorphism parameters, activate the Tag and Sel overload units, overload the position index identifier register and the source data source identifier register, and generate the values ​​of the Tag Table register and the Sel Table register. Configure the polynomial degree and the automorphism parameter, and combine them with the value of the Tag Table register to activate the read address generation unit, thereby obtaining the first half-zone read enable signal, the second half-zone read enable signal, the half-zone read address signal and the Col granularity permutation enable signal; Based on the first half-zone read enable signal, the second half-zone read enable signal and the half-zone read address signal, obtain the half-zone read data, the first half-zone read data valid signal and the second half-zone read data valid signal from the polynomial memory area; Based on the valid signals of the first half-zone read data and the valid signals of the second half-zone read data, the permutation network selection parameters are filtered from the SelTable register. Combined with the Col granularity permutation enable signal and the permutation network selection parameters, the half-zone read data is subjected to Col granularity permutation and Bank granularity recursive permutation to obtain the permutation result and the valid signal of the permutation result. Based on the valid signal of the permutation result, the permutation result is written into the cache. After all the permutation results are loaded into the cache, the permutation results are read out from the cache in sequence and written back to the corresponding half of the polynomial storage area to complete the self-similar mapping of the polynomial.

Images