Fast number theory transformation (NTT) acceleration chip

Abstract

The embodiment of the invention provides an NTT acceleration chip. The chip comprises a twiddle factor calculation module which comprises a plurality of pre-calculation units and a plurality of real-time calculation units, and the plurality of pre-calculation units are used for calculating a plurality of initial row twiddle factors and row-to-row stepping factors by parallel execution and utilization of primitive unit roots; the plurality of real-time calculation units are used for executing one row twiddle factors in the plurality of initial rows obtained by the plurality of pre-calculation units in parallel, and repeatedly and iteratively calculating twiddle factors of other rows according to the inter-row stepping factors; the transpose module comprises a plurality of transpose units and is used for performing transpose processing on the input sequence in parallel to obtain a transpose sequence; and the NTT calculation module comprises a plurality of butterfly calculation units and is used for executing butterfly operation of each order and point number according to the twiddle factor obtained by the twiddle factor calculation module and the transposition sequence obtained by the transposition module in parallel to obtain an output sequence. The NTT calculation efficiency can be improved.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the computer field, and in particular, to a fast number-theoretic transform (NTT) acceleration chip. Background Art

[0002] Modern public key cryptography is one of the important technologies in the field of information security. It is a cryptographic technology based on mathematics and computer science that aims to ensure secure communication and data exchange. Public key cryptography greatly improves the security of information transmission, because attackers cannot deduce the private key through the public key, thus ensuring the confidentiality of information. Public key cryptography makes information security more feasible, but security depends on the difficulty of mathematical algorithms, so it faces huge performance challenges when processing large-scale data.

[0003] Fast number theoretic transform (NTT) is an important algorithm in the field of public key cryptography. This algorithm is mainly used to calculate the point value representation of polynomials on a ring to accelerate the multiplication of polynomials on a ring. The NTT algorithm is used in lattice-based post-quantum encryption algorithms, hash functions, digital signatures, and fully homomorphic encryption and zero-knowledge proof in privacy computing technologies. Therefore, the high-performance implementation of NTT in hardware and software is currently one of the research hotspots in modern cryptography. With the continuous development of cryptography, the application prospects of NTT are expected to be broader.

[0004] Modern homomorphic encryption algorithms incorporate the residue number system (RNS) algorithm. On the one hand, there will be frequent modulus switching scenarios, and the rotation factors will also change synchronously. On the other hand, the large modulus will be decomposed into multiple small moduli, resulting in multiple sets of different rotation factors. Therefore, the NTT calculation on long polynomials is inevitably accompanied by the work of generating a large number of rotation factors. The usual practice is to reserve a cache inside the computing chip and load the pre-calculated rotation factors into the reserved cache inside the chip by moving them from the chip's external memory multiple times. For the hardware implementation of the NTT algorithm, one of the difficulties and challenges is that the on-chip storage resources in the hardware environment and the bandwidth resources from the off-chip memory to the computing chip are limited, resulting in low efficiency of NTT calculations. Summary of the invention

[0005] One or more embodiments of this specification describe an NTT acceleration chip that can improve the efficiency of NTT computing.

[0006] In the first aspect, a fast number theory transformation NTT acceleration chip is provided, and the acceleration chip includes:

[0007] A rotation factor calculation module, comprising a plurality of pre-calculation units and a plurality of real-time calculation units, wherein the plurality of pre-calculation units are used to perform in parallel the calculation of initial rotation factors of a plurality of rows and inter-row stepping factors using primitive unit roots; and the plurality of real-time calculation units are used to perform in parallel the calculation of rotation factors of a row of the initial plurality of rows obtained by the plurality of pre-calculation units, and repeatedly iteratively calculate the rotation factors of other rows outside the initial plurality of rows according to the inter-row stepping factors.

[0008] A transposition module, comprising a plurality of transposition units, for performing transposition processing on an input sequence in parallel to obtain a transposed sequence;

[0009] The NTT calculation module includes multiple butterfly calculation units, which are used to perform butterfly operations of various orders and points in parallel according to the rotation factors obtained by the rotation factor calculation module and the transposition sequence obtained by the transposition module to obtain an output sequence; wherein the rotation factor calculation module, the transposition module and the NTT calculation module correspond to different stages of the first pipeline processing task respectively.

[0010] In a possible implementation manner, the pre-calculation unit and the real-time calculation unit respectively correspond to different stages of a second pipeline processing task, and the second pipeline processing task is a subtask of the first pipeline processing task.

[0011] In a possible implementation, the rotation factor calculation module further includes:

[0012] A plurality of pre-storage units, used for storing in parallel a plurality of initial row rotation factors and inter-row stepping factors obtained by the plurality of pre-calculation units;

[0013] The multiple real-time calculation units are specifically used to read, from the multiple pre-storage units, a row rotation factor and an inter-row step factor among the initial rows obtained by the multiple pre-calculation units.

[0014] In a possible implementation, the rotation factor calculation module further includes:

[0015] A plurality of cache units, used for caching in parallel the rotation factors of other rows other than the initial plurality of rows obtained by the plurality of real-time computing units;

[0016] A plurality of interconnection selection units are used to execute in parallel the rotation factors required for the butterfly operation of the target order, select the rotation factors from a row of the rotation factors cached by the plurality of cache units, and connect the selected rotation factors to the butterfly calculation unit of the target order.

[0017] In a possible implementation manner, the primitive unit root is externally input.

[0018] In one possible implementation, the pre-calculation unit includes a plurality of modular multiplication units, and the plurality of modular multiplication units are used to perform modular multiplication calculations in parallel to obtain inter-row stepping factors including the maximum power of the primitive unit root, and the various rotation factors of the initial rows in the column direction of the pre-calculated number of rows; wherein the maximum power and the number of pre-calculated rows are determined according to the pipeline depth of the modular multiplication unit.

[0019] Furthermore, the modular multiplication calculation includes:

[0020] The first modular multiplication of two primitive roots of unity of the same power; or,

[0021] The second modular multiplication of the primitive root of unity of the first power and the primitive root of unity of the second power; the difference between the second power and the first power is 1.

[0022] In a possible implementation, the multiple real-time calculation units are specifically configured to repeatedly iteratively calculate the rotation factors of other rows in the column direction other than the initial several rows in the column direction according to the inter-row step factor in the column direction for a row of rotation factors in the initial several rows in the column direction obtained by the pre-calculation unit;

[0023] For a row of rotation factors in the initial rows in the row direction, the rotation factors of other rows in the row direction other than the initial rows are iteratively calculated according to the inter-row stepping factor in the row direction.

[0024] Furthermore, the interconnection selection unit includes:

[0025] The counter subunit is used to generate a time rhythm control signal with the number of NTT points as a period according to an externally input clock cycle signal;

[0026] A control subunit, used to determine the specific point and specific order of the rotation factor output at the current moment for NTT calculation according to the time rhythm control signal generated by the counter subunit;

[0027] The address calculation subunit is used to calculate the index number of the current corresponding rotation factor according to the specific point position and specific order of NTT calculation obtained by the control subunit;

[0028] The selection subunit is used to select a corresponding rotation factor from a row of rotation factors cached by the multiple cache units according to the index number obtained by the address calculation subunit.

[0029] Furthermore, the interconnection selection unit further includes:

[0030] A plurality of interconnection sub-units, used for one-to-one connection with a plurality of butterfly computing units;

[0031] The selection subunit is further used to output the selected rotation factor to the interconnection subunit corresponding to the index number.

[0032] The acceleration chip provided by the embodiment of this specification includes a rotation factor calculation module, a transposition module, and an NTT calculation module, which correspond to different stages of the first pipeline processing task, respectively, to realize the full-pipeline real-time calculation of the rotation factor on-chip, and minimize the off-chip interface bandwidth and on-chip storage resource consumption; the interface between the rotation factor calculation module and the NTT calculation module is integrated, thereby realizing the full-pipeline real-time calculation of the NTT calculation module. Among them, the rotation factor calculation module includes a plurality of pre-calculation units for pre-calculating the initial several rows of rotation factors and the inter-row stepping factors, which can effectively reduce the on-chip pre-storage resources and the off-chip interface bandwidth, and does not need to load a large number of rotation factors from the outside; and, pre-calculating the initial several rows of rotation factors and the inter-row stepping factors can effectively compress the pipeline gaps of the real-time calculation unit, thereby realizing the real-time calculation of the rotation factor rows, and effectively improving the calculation efficiency. In summary, the efficiency of NTT calculation can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0034] Figure 1 A schematic diagram of an implementation scenario of an embodiment disclosed in this specification;

[0035] Figure 2 A schematic diagram of the structure of an NTT acceleration chip according to an embodiment is shown;

[0036] Figure 3 A schematic diagram of NTT pipeline operation according to an embodiment is shown;

[0037] Figure 4 A schematic diagram of the structure of a rotation factor calculation module according to an embodiment is shown;

[0038] Figure 5 A schematic diagram of a rotation factor calculation pipeline according to an embodiment is shown;

[0039] Figure 6 A flow chart of a method for online calculation of rotation factors according to an embodiment is shown;

[0040] Figure 7 A schematic diagram of initial row parallel calculation according to one embodiment is shown;

[0041] Figure 8A schematic diagram showing the calculation of the initial second row from the initial first row according to one embodiment;

[0042] Fig. 9 A schematic diagram showing the structure of a real-time computing array according to an embodiment is shown;

[0043] Fig.10 A schematic diagram showing a real-time calculation process and a calculation timing sequence according to an embodiment is shown;

[0044] Fig.11 A schematic diagram showing the composition structure of an interconnection selection unit according to an embodiment is shown;

[0045] Fig.12 A schematic diagram showing the correspondence between an interconnection unit and an NTT computing unit according to an embodiment. DETAILED DESCRIPTION

[0046] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0047] First, some basic concepts used in the embodiments of this specification are introduced.

[0048] Fully homomorphic encryption (FHE): refers to an encryption scheme that allows any number of addition and multiplication operations to be performed on the encrypted state and the same result as the plaintext data can be obtained. This means that complex calculations can be performed on encrypted data without decrypting the data. FHE is a higher level in homomorphic encryption, providing the greatest computing power, but also the most complex and computationally intensive form.

[0049] Zero-knowledge proof (ZKP) refers to a cryptographic tool that allows two communicating parties who do not trust each other to prove the validity of a proposition without revealing any additional information. The prover can convince the verifier that a certain assertion is correct without providing any useful information to the verifier. Zero-knowledge proof is essentially a protocol involving two or more parties, that is, a series of steps required for two or more parties to complete a task. The prover proves to the verifier and makes him believe that he knows or has a certain message, but the proof process cannot leak any information about the proven message to the verifier.

[0050] Fast number-theoretic transform (NTT): The principle of NTT is very similar to that of FFT in discrete form. The main difference between the two is the domain of operation. FFT operates on the complex domain, while NTT operates on the prime domain. Therefore, the NTT algorithm does not involve any precision rounding and error interception issues. The NTT algorithm has a wide range of applications in lattice post-quantum cryptography, fully homomorphic encryption, zero-knowledge proof and other fields, and is one of the important algorithms in the field of modern cryptography.

[0051] Butterfly calculation: It is the core operation in NTT. It weights and multiplies two input data respectively, and then outputs the results to two different locations. Butterfly calculation can be used to implement different NTT algorithms through different combinations, such as radix 2-butterfly, radix 4-butterfly, etc. Usually, the butterfly calculation in the NTT algorithm is a recursive process, which divides the original N data points into two parts of N / 2 data points, performs complex calculations on each part, and then merges them. The recursive iterations at different levels are integrated through butterfly calculations.

[0052] Twiddle factor: refers to the complex constant multiplied in the butterfly operation of the Cooley-Tukey Fast Fourier Transform (FFT) algorithm. Therefore, the constant is located on the unit circle on the complex plane, which has a rotation effect on the multiplicand on the complex plane. In the NTT calculation process, the operation object is the prime field, so the difference from FFT is that the operation field is different.

[0053] Modular multiplication (MM): a·b mod N, multiply the two input integers a and b and take the remainder with respect to N.

[0054] Figure 1 This is a schematic diagram of an implementation scenario of an embodiment disclosed in this specification. The implementation scenario involves an NTT acceleration chip. It can be understood that the NTT acceleration chip is used to implement NTT calculations in order to improve the efficiency of NTT calculations. Figure 1 , which shows a CT type 32-point NTT butterfly transform, where Represents the rotation factor in each butterfly transformation; according to the power addition property of the rotation factor in the multiplication sense, all It can be calculated from the primitive root of unity.

[0055] This scheme proposes a method for online real-time calculation of rotation factors and the corresponding calculation structure for NTT calculation acceleration, which is expected to achieve the following effects: effectively reduce the use of on-chip memory, thereby reducing the chip area; effectively reduce the number of times the chip accesses the external storage unit and the amount of access data, thereby reducing the access bandwidth requirements for the external storage unit; the calculation process is real-time and the whole process is pipelined, thereby improving the calculation efficiency of the entire NTT; support real-time configuration of the primitive unit root of the rotation factor, support NTT calculation of different lengths, and the scheme is flexible and universal; support the design of the minimum computing unit, so that hardware circuits of different sizes can be flexibly integrated.

[0056] This scheme mainly involves: using the minimum primitive unit root (i.e., primitive root) in NTT calculation to perform recursive calculation to obtain the minimum set of rotation factors, wherein the same rotation factors in different orders are merged; using several powers of the minimum primitive unit root to perform real-time recursive calculation on the minimum set of rotation factors; distributing all elements in the minimum set of rotation factors to several computing units for parallel recursive calculation; extending one-dimensional NTT calculation to multi-dimensional NTT calculation, thereby extending the rotation factor calculation space to multiple dimensions; selecting the rotation factors of all computing units according to the NTT order and number of points and outputting them to the rotation factor interconnection unit; and corresponding each rotation factor interconnection unit to each NTT computing unit one by one to realize a complete NTT calculation.

[0057] Figure 2 A schematic diagram of the structure of an NTT acceleration chip according to an embodiment is shown. The acceleration chip can be based on Figure 1 The implementation scenario shown is used to realize multi-dimensional NTT calculation. Figure 2 FIG. 4 is a schematic block diagram of an NTT acceleration chip according to an embodiment. Figure 2 As shown, the acceleration chip includes:

[0058] The rotation factor calculation module 21 includes a plurality of pre-calculation units and a plurality of real-time calculation units, wherein the plurality of pre-calculation units are used to perform in parallel the calculation of the rotation factors of the initial plurality of rows and the inter-row stepping factors using the primitive unit root; the plurality of real-time calculation units are used to perform in parallel the calculation of the rotation factors of one row among the initial plurality of rows obtained by the plurality of pre-calculation units, and repeatedly iteratively calculate the rotation factors of other rows outside the initial plurality of rows according to the inter-row stepping factors;

[0059] A transposition module 22, comprising a plurality of transposition units, for performing transposition processing on an input sequence in parallel to obtain a transposed sequence;

[0060] The NTT calculation module 23 includes multiple butterfly calculation units, which are used to perform butterfly operations of various orders and points in parallel based on the rotation factors obtained by the rotation factor calculation module 21 and the transposition sequence obtained by the transposition module 22 to obtain an output sequence; wherein the rotation factor calculation module 21, the transposition module 22 and the NTT calculation module 23 correspond to different stages of the first pipeline processing task respectively.

[0061] It should be noted that the rotation factor calculation module 21, the transposition module 22, and the NTT calculation module 23 in this scheme are independent of each other in the entire calculation process; wherein, the rotation factor calculation module may include multiple rotation factor calculation units, each rotation factor calculation unit may include a pre-calculation unit and a real-time calculation unit; the transposition module may include multiple transposition units; the NTT calculation module may include multiple butterfly calculation units, and the butterfly calculation unit is referred to as a butterfly unit for short.

[0062] Figure 3 FIG. 1 shows a schematic diagram of NTT pipeline operation according to an embodiment. Figure 3 At time Tn, the rotation factor calculation, transposition calculation, and butterfly calculation are performed simultaneously; the cache unit in the figure is only used to cope with bandwidth fluctuations between data interfaces and does not perform large-scale data storage.

[0063] In one example, the pre-calculation unit and the real-time calculation unit correspond to different stages of a second pipeline processing task, respectively, and the second pipeline processing task is a subtask of the first pipeline processing task.

[0064] In one example, the rotation factor calculation module 21 further includes:

[0065] A plurality of pre-storage units, used for storing in parallel a plurality of initial row rotation factors and inter-row stepping factors obtained by the plurality of pre-calculation units;

[0066] The multiple real-time calculation units are specifically used to read, from the multiple pre-storage units, a row rotation factor and an inter-row step factor among the initial rows obtained by the multiple pre-calculation units.

[0067] In one example, the rotation factor calculation module 21 further includes:

[0068] A plurality of cache units, used for caching in parallel the rotation factors of other rows other than the initial plurality of rows obtained by the plurality of real-time computing units;

[0069] A plurality of interconnection selection units are used to execute in parallel the rotation factors required for the butterfly operation of the target order, select the rotation factors from a row of the rotation factors cached by the plurality of cache units, and connect the selected rotation factors to the butterfly calculation unit of the target order.

[0070] Figure 4 FIG. 2 shows a schematic diagram of a rotation factor calculation module according to an embodiment. Figure 4 , the pre-calculation unit, pre-storage unit, real-time calculation unit, and interconnection selection unit in this scheme are independent of each other in the whole calculation process; the number of channels C of the pre-storage unit, real-time calculation unit, and cache unit are the same, but the number of channels M of the interconnection selection unit is different from the number of channels K of the pre-calculation unit; C, M, and K depend on the execution efficiency of each unit and have no specific correlation; the cache unit in the figure is only used to cope with bandwidth fluctuations between data interfaces and does not store large-scale data. It can be understood that the primitive root is the abbreviation of the primitive unit root.

[0071] Figure 5 FIG. 2 shows a schematic diagram of a rotation factor calculation pipeline according to an embodiment. Figure 5 ,At time Tn, pre-computation, pre-storage, real-time computation, and interconnection selection are performed simultaneously.

[0072] Figure 6 A flowchart of a method for online calculation of rotation factors according to an embodiment is shown. The method can be based on Figure 4 The structure of the rotation factor calculation module is shown in FIG. Figure 6 As shown, the online calculation method of the rotation factor in this embodiment includes the following steps: step 61, receiving parameters; step 62, based on the parameters, calculating the pre-calculation results including the inter-row step factor and the initial several row rotation factors; step 63, sending the pre-calculation results to the real-time calculation array; step 64, repeatedly iteratively calculating all row rotation factors through the real-time calculation array; step 65, selecting the rotation factors calculated for each row; step 66, integrating the selected rotation factors into the NTT calculation. The specific execution methods of the above steps are described below.

[0073] First, in step 61, parameters are received. It can be understood that the above parameters at least include primitive unit roots.

[0074] In one example, the primitive root of unity is externally input.

[0075] Optionally, receive the primitive unit root w as external input, the number of 2D-NTT points N=R·C, for example, R rows and C columns, generally R=C and both are integer powers of 2, and the pipeline depth PipDepth of modular multiplication.

[0076] Without loss of generality, the input parameters can come from an external control unit, for example, the parameters include several primitive unit roots w1...w n, 2D-NTT point number and row and column number N, R, C (N = R·C), where the pipeline depth PipDepth of the modular multiplication can be consistent with the number of primitive unit roots, or can be different from each other; control chips such as CPU or MCU are configured to the computing unit involved in the embodiments of this specification through a bus, and the above-mentioned bus can be such as PCIE / I2C / SPI or other typical communication buses.

[0077] The input parameters may also be pre-stored inside the processor, and when the calculation is started, the parameters are output from the processor's internal storage unit to the rotation factor calculation module.

[0078] Then, in step 62, based on the parameters, a pre-calculation result including an inter-row stepping factor and initial row rotation factors is calculated. It can be understood that the processing can be performed in parallel by multiple pre-calculation units.

[0079] In one example, the pre-calculation unit includes a plurality of modular multiplication units, and the plurality of modular multiplication units are used to perform modular multiplication calculations in parallel to obtain inter-row stepping factors including the maximum power of the primitive unit root, and the various rotation factors of the initial rows in the column direction of the pre-calculated number of rows; wherein the maximum power and the number of pre-calculated rows are determined according to the pipeline depth of the modular multiplication unit.

[0080] Furthermore, the modular multiplication calculation includes:

[0081] The first modular multiplication of two primitive roots of unity of the same power; or,

[0082] The second modular multiplication of the primitive root of unity of the first power and the primitive root of unity of the second power; the difference between the second power and the first power is 1.

[0083] For example, using the primitive unit root w, we pre-calculate the initial row rotation factors and row stepping factors in the column direction, such as w 2 , w 3 , w 4 ... C .

[0084] In the above process, the inter-row step factor w that needs to calculate the maximum power is determined according to the input modular multiplication unit pipeline depth PipDepth 2 ... PipDepth and pre-calculated line number line1line2...line PipDepth, where the total number of a line refers to the number of rotation factor points in the row direction, that is, R. There are two types of rotation factor initial lines line1 in 2-D NTT, one is C point w 0 , one is w 0 w 1 ... C-1 ,C point w0 It only needs to be initialized to all 1s, no additional calculation is required; w 0 w 1 ... C-1 It is calculated in parallel by several pre-computation units.

[0085] Figure 7 FIG. 4 shows a schematic diagram of initial row parallel calculation according to an embodiment. Figure 7 The ellipsis in the figure indicates that there is no specific requirement for the number of parallel pre-calculation units. 2n =w n *w n w 2n+1 =w n *w n+1 The * here indicates modular multiplication. As can be seen from the above formula, modular multiplication is performed in parallel with powers of n and n+1 for better performance. In the actual NTT calculation process, there are usually dozens of primitive roots, so parallel calculation of multiple initial rows can achieve high computational efficiency.

[0086] In the embodiment of this specification, the rotation factors of the initial first row are first calculated. After the initial first row is calculated, the remaining initial rows are calculated according to PipDepth. For example, if PipDepth=2, line1 line2 needs to be calculated, so that the real-time pipeline calculation of the rotation factors line 1...line R can be realized.

[0087] Figure 8 FIG. 1 is a schematic diagram showing a method for calculating an initial second row from an initial first row according to an embodiment. Figure 8 , respectively showing that the initial line line1 is point C w 0 and w 0 w 1 ... C-1 This corresponds to the calculation of line2. The modmul in the figure represents modular multiplication, that is, multiplication in the modular sense; the other PipDepth cases can be obtained by analogy with the above examples, and will not be described in detail; modmul here means multiple parallel computing units, the number of which usually corresponds to the total number of points C in a row; without loss of generality, the figure only needs to calculate up to line PipDepth. The calculated initial rows and step rotation factors are input into the pre-storage unit, the number of which usually corresponds to the total number of points C in a row.

[0088] Then, in step 63, the pre-calculation result is sent to the real-time calculation array. It can be understood that the real-time calculation array includes a plurality of real-time calculation units, which can calculate the rotation factors in parallel.

[0089] For example, C rotation factors in the initial rows are respectively sent to the rotation factor real-time calculation array, and the array has a total of C real-time calculation units.

[0090] Then, in step 64, all row rotation factors are repeatedly calculated by the real-time calculation array. It can be understood that when the number of rows of rotation factors to be calculated is large, it is impossible to calculate the rotation factors of all rows at once.

[0091] In one example, the multiple real-time calculation units are specifically used to repeatedly iteratively calculate the rotation factors of other rows in the column direction other than the initial several rows in the column direction according to the inter-row step factor in the column direction for a row of rotation factors in the initial several rows in the column direction obtained by the pre-calculation unit;

[0092] For a row of rotation factors in the initial rows in the row direction, the rotation factors of other rows in the row direction other than the initial rows are iteratively calculated according to the inter-row stepping factor in the row direction.

[0093] For example, C real-time computing units repeatedly iteratively calculate the rotation factor of each row according to the inter-row step factor.

[0094] Fig. 9 FIG. 1 is a schematic diagram showing a real-time computing array according to an embodiment of the present invention. Fig. 9 The real-time computing array includes C real-time computing units, each connected to a cache unit. The real-time computing unit obtains the inter-row stepping factor w from the pre-storage unit. 2 ... PipDepth The pre-calculated line line1 line2 ... line PipDepth is calculated in real time, and the calculated rotation factor enters the cache unit.

[0095] For example, if PipDepth = 2, line3 to lineR are calculated in real time;

[0096] If PipDepth=n, calculate line n+1 to line R in real time.

[0097] Fig.10 A real-time calculation process and a calculation sequence diagram according to an embodiment are shown. Fig.10, taking PipDepth = 2 as an example, PipDepth is pipe, the initial lines are line1 and line2, the inter-line step factor is w2, line3 is calculated based on line1 and w2, line4 is calculated based on line2 and w2, line5 is calculated based on line3 and w2, line6 is calculated based on line4 and w2, and so on, for iterative calculation. The cache unit caches several line rotation factors calculated in real time to cope with the fluctuation of data interface bandwidth between different computing units.

[0098] Then, in step 65, the rotation factors calculated for each row are selected. It can be understood that the above processing can be performed by the interconnection selection unit.

[0099] In one example, the interconnection selection unit includes:

[0100] The counter subunit is used to generate a time rhythm control signal with the number of NTT points as a period according to an externally input clock cycle signal;

[0101] A control subunit, used to determine the specific point and specific order of the rotation factor output at the current moment for NTT calculation according to the time rhythm control signal generated by the counter subunit;

[0102] The address calculation subunit is used to calculate the index number of the current corresponding rotation factor according to the specific point position and specific order of NTT calculation obtained by the control subunit;

[0103] The selection subunit is used to select a corresponding rotation factor from a row of rotation factors cached by the multiple cache units according to the index number obtained by the address calculation subunit.

[0104] Furthermore, the interconnection selection unit further includes:

[0105] A plurality of interconnection sub-units, used for one-to-one connection with a plurality of butterfly computing units;

[0106] The selection subunit is further used to output the selected rotation factor to the interconnection subunit corresponding to the index number.

[0107] For example, for the rotation factors required in each order of NTT calculation unit, a row of rotation factors calculated by the real-time calculation unit is selected.

[0108] In the embodiment of this specification, the interconnection selection unit is designed based on the fact that each order of butterfly calculation in the fast number theory transformation has several repeated rotation factors, which can be compressed.

[0109] Take 32-point NTT calculation as an example,

[0110] The rotation factor used by all butterfly transformations of order 1 is 1;

[0111] The rotation factors used by all butterfly transforms of the second order are 2, 1 and w 8 ;

[0112] There are 4 rotation factors used by all third-order butterfly transforms, namely 1w 4 w 8 w 12 ; ...

[0114] There are 16 in total at the 5th level;

[0115] So the total rotation factors for a row are 1+2+4+8+16=31;

[0116] However, the total number of rotation factors required for the actual 32-point NTT is 80; therefore, the expansion from 31 rotations to 80 rotation factors is achieved by interconnecting the selection units; without loss of generality, the total number of rotation factors calculated by the N-point NTT after compression is 1+2+4+...+N / 2;

[0117] Specifically, the interconnection selection unit includes the following four components: 1. Counter unit; 2. Control unit; 3. Address calculation unit; 4. Selection unit; 5. Interconnection unit; In order to reflect the inclusion relationship between the units in the name, the counter unit can be called a counter sub-unit, the control unit can be called a control sub-unit, the address calculation unit can be called an address calculation sub-unit, the selection unit can be called a selection sub-unit, and the interconnection unit can be called an interconnection sub-unit.

[0118] Fig.11 FIG. 2 shows a schematic diagram of a structure of an interconnection selection unit according to an embodiment. Fig.11 , counter unit: referred to as counter, generates a time rhythm control signal with NTT point number as period according to the clock cycle signal input externally; control unit: determines the specific point and specific order of the rotation factor output at the current moment for NTT calculation according to the working time rhythm of the counter control interconnection selection unit; address calculation unit: calculates the index number of the cache unit of the current corresponding rotation factor in the real-time calculation unit array according to the time rhythm information given by the control unit, combined with the specific point and specific order of NTT calculation; selection unit: selects the corresponding rotation factor from the C cache units in the real-time calculation array according to the index number of the cache unit output by the address calculation unit, which is in the range of 1 to C, and outputs it to the interconnection unit; interconnection unit: distributes the rotation factor selected from the cache unit to the adjacent interconnection unit through the interconnection interface.

[0119] Without loss of generality, t clockIndicates the time rhythm information given by the counter, t clock It is a variable that increases at fixed time intervals. The range of change is periodic, and the change period depends on the number of NTT points. clock ) and Y(t clock ) represents the point and order of NTT calculation given by the control unit, which can be calculated as follows: clock The cache unit index number Idx(m) in the real-time calculation array corresponding to the moment:

[0120]

[0121] m(X(t clock ),Y(t clock ))=Y(t clock )*(X(t clock )+1)+X(t clock )

[0122] The % in the above formula represents the remainder processing;

[0123] Taking N=R*C=65536, R=256, C=256 as an example, there are C=256 computing units and cache units in the real-time computing array, t clock The cycle is 256, and then it returns to 1. There are 256 points in 1 row of NTT calculation. Each order has 128 rotation factors, and there are 8 orders in total. 0≤X(t clock )≤127 0≤Y(t clock )≤7 M=128*8, traverse all X(t clock ) and Y(t clock ) can get all Idx(m), and actually 1≤Idx(m)≤256.

[0124] Finally, the selected rotation factors are integrated into the NTT calculation in step 66. It can be understood that the NTT calculation is performed by the NTT calculation unit, and specifically, the selected rotation factors can be integrated into each order of the NTT calculation unit.

[0125] In the embodiment of this specification, the NTT computing unit may be equivalent to the aforementioned butterfly computing unit.

[0126] Among them, the basis for selecting the obtained rotation factor and NTT calculation fusion is as follows:

[0127] Since X(t clock ) and Y(t clock ) by t clock Determine, X(t clock) can represent the number of the two points in the vertical direction input to the butterfly in the NTT calculation, with two points as the numbering unit, Y(t clock ) can represent the current order of NTT calculation, with n(X(t clock ), Y(t clock )) represents the specific order of the butterfly number in NTT. Obviously, m(X(t clock ), Y(t clock )) and n(X(t clock ), Y(t clock )) can correspond one to one;

[0128] Fig.12 A schematic diagram showing the corresponding relationship between the interconnection unit and the NTT computing unit according to an embodiment. Fig.12 , the interconnection units and NTT computing units correspond one to one, that is, there are as many interconnection units as there are NTT computing units.

[0129] It should be noted that the computing architecture mentioned in the embodiments of this specification can run on a field-programmable gate array (FPGA), a CPU, a GPU or an application-specific integrated circuit (ASIC); including but not limited to the above-mentioned processor types.

[0130] In addition, the aforementioned interconnection selection unit can be separated, that is, the NTT rotation factors of all orders are not compressed, all are calculated in real time and directly merged with the NTT calculation unit without affecting the normal calculation of NTT; this solution will sacrifice more computing resources.

[0131] In addition, the aforementioned pre-calculation unit can be separated, that is, all pre-calculated initial several row rotation factors and inter-row stepping factors can be input into the real-time calculation unit from the external interface; or the initial several row rotation factors and inter-row stepping factors can be stored in the processor in a pre-storage manner and input into the real-time calculation unit at the start of the calculation; this solution will sacrifice the interface bandwidth or sacrifice more on-chip storage resources, thereby resulting in a waste of chip area.

[0132] In addition to using the interconnection selection method, the rotation factor can also be expanded and filled directly by replication; when the number of NTT points is large, the direct replication method will cause the fan-out of the same rotation factor signal in the same order NTT to be large.

[0133] The pre-computation array, real-time calculation array, and interconnection selection array in the embodiments of this specification can operate at different working main frequencies; at the same time, there is no limit on the specific number of each array; that is, the computing architectures corresponding to the above arrays of different numbers and different working main frequencies all fall within the scope of this solution.

[0134] The acceleration chip provided by the embodiment of this specification includes a rotation factor calculation module, a transposition module, and an NTT calculation module, which correspond to different stages of the first pipeline processing task, respectively, to realize the full-pipeline real-time calculation of the rotation factor on-chip, and minimize the off-chip interface bandwidth and on-chip storage resource consumption; the interface between the rotation factor calculation module and the NTT calculation module is integrated, thereby realizing the full-pipeline real-time calculation of the NTT calculation module. Among them, the rotation factor calculation module includes a plurality of pre-calculation units for pre-calculating the initial several rows of rotation factors and the inter-row stepping factors, which can effectively reduce the on-chip pre-storage resources and the off-chip interface bandwidth, and does not need to load a large number of rotation factors from the outside; and, pre-calculating the initial several rows of rotation factors and the inter-row stepping factors can effectively compress the pipeline gaps of the real-time calculation unit, thereby realizing the real-time calculation of the rotation factor rows, and effectively improving the calculation efficiency. In summary, the efficiency of NTT calculation can be improved.

[0135] The embodiments of this specification have the following improvements over the usual processing methods: This solution implements the on-chip full-pipeline real-time calculation of the rotation factors, minimizing the off-chip interface bandwidth and on-chip storage resource consumption: The pre-calculation of all the initial several rows of rotation factors and the inter-row stepping factors proposed in this solution can effectively reduce the on-chip pre-storage resources and off-chip interface bandwidth, and does not require a large number of rotation factors to be loaded from the outside; The pre-calculation of all the initial several rows of rotation factors and the inter-row stepping factors proposed in this solution can effectively compress the pipeline gaps caused by the pipeline depth of multiplication in the modular sense, thereby realizing the real-time calculation of the rotation factor rows, effectively improving Computational efficiency: The interconnection selection design proposed in this scheme effectively utilizes the repetitive characteristics of the rotation factors, which can be compressed, thereby reducing on-chip storage resources. It not only realizes the expansion and filling of the rotation factors, but also greatly reduces the amount of signal replication, effectively reducing signal fan-out; This scheme realizes the atomization and arrayization of all computing units and cache units on the chip: the number of computing units and cache units can be flexibly adjusted according to any NTT point number, and the change of NTT point number can be flexibly adapted; the operating main frequency isolation is realized between the computing arrays; and the interface fusion between the NTT computing units is realized, so as to realize the real-time full-pipeline computing of the NTT computing units.

[0136] The embodiments of this specification can achieve the following technical effects: effectively reduce the use of on-chip memory, thereby reducing the chip area; effectively reduce the number of times the chip accesses the external storage unit and the amount of access data, thereby reducing the access bandwidth requirements for the external storage unit; the calculation process is real-time and the whole process is pipelined, thereby improving the calculation efficiency of the entire NTT; support the real-time configuration of the primitive unit root of the rotation factor, support the calculation of NTTs of different lengths, and the solution is flexible and universal; support the design of the minimum computing unit, and the computing unit is atomic, so that hardware circuits of different scales can be flexibly integrated; realize the transmission of the same rotation factor by interconnection, and convert the replication of large-area signals into small-range data interconnection transmission, thereby greatly reducing the amount of signal replication and effectively reducing signal fan-out;

[0137] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 6 The method described.

[0138] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 6 The method described.

[0139] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0140] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A fast number theory transformation (NTT) acceleration chip, the acceleration chip comprising: A rotation factor calculation module, comprising a plurality of pre-calculation units and a plurality of real-time calculation units, wherein the plurality of pre-calculation units are used to perform in parallel the calculation of initial rotation factors of a plurality of rows and inter-row stepping factors using primitive unit roots; and the plurality of real-time calculation units are used to perform in parallel the calculation of rotation factors of a row of the initial plurality of rows obtained by the plurality of pre-calculation units, and repeatedly iteratively calculate the rotation factors of other rows outside the initial plurality of rows according to the inter-row stepping factors. A transposition module, comprising a plurality of transposition units, for performing transposition processing on an input sequence in parallel to obtain a transposed sequence; The NTT calculation module includes multiple butterfly calculation units, which are used to perform butterfly operations of various orders and points in parallel according to the rotation factors obtained by the rotation factor calculation module and the transposition sequence obtained by the transposition module to obtain an output sequence; wherein the rotation factor calculation module, the transposition module and the NTT calculation module correspond to different stages of the first pipeline processing task respectively.

2. The acceleration chip according to claim 1, wherein: The pre-calculation unit and the real-time calculation unit correspond to different stages of a second pipeline processing task respectively, and the second pipeline processing task is a subtask of the first pipeline processing task.

3. The acceleration chip according to claim 1, wherein: The rotation factor calculation module also includes: A plurality of pre-storage units, used for storing in parallel a plurality of initial row rotation factors and inter-row stepping factors obtained by the plurality of pre-calculation units; The multiple real-time calculation units are specifically used to read, from the multiple pre-storage units, a row rotation factor and an inter-row step factor among the initial rows obtained by the multiple pre-calculation units.

4. The acceleration chip according to claim 1, wherein: The rotation factor calculation module also includes: A plurality of cache units, used for caching in parallel the rotation factors of other rows other than the initial plurality of rows obtained by the plurality of real-time computing units; A plurality of interconnection selection units are used to execute in parallel the rotation factors required for the butterfly operation of the target order, select the rotation factors from a row of the rotation factors cached by the plurality of cache units, and connect the selected rotation factors to the butterfly calculation unit of the target order.

5. The acceleration chip according to claim 1, wherein: The primitive unit root is externally input.

6. The acceleration chip according to claim 1, wherein: The pre-calculation unit includes a plurality of modular multiplication units, and the plurality of modular multiplication units are used to perform modular multiplication calculations in parallel to obtain inter-row stepping factors including the maximum power of the primitive unit root, and various rotation factors of the initial rows in the column direction of the pre-calculated number of rows; wherein the maximum power and the pre-calculated number of rows are determined according to the pipeline depth of the modular multiplication unit.

7. The acceleration chip according to claim 6, wherein: The modular multiplication calculation includes: The first modular multiplication of two primitive roots of unity of the same power; or, The second modular multiplication of the primitive root of unity of the first power and the primitive root of unity of the second power; the difference between the second power and the first power is 1.

8. The acceleration chip according to claim 1, wherein: The multiple real-time calculation units are specifically configured to repeatedly iteratively calculate the rotation factors of other rows in the column direction other than the initial rows in the column direction according to the inter-row stepping factor in the column direction for a row of the initial rows in the column direction obtained by the pre-calculation unit; For a row of rotation factors in the initial rows in the row direction, the rotation factors of other rows in the row direction other than the initial rows are iteratively calculated according to the inter-row stepping factor in the row direction.

9. The acceleration chip according to claim 4, wherein: The interconnection selection unit comprises: The counter subunit is used to generate a time rhythm control signal with the number of NTT points as a period according to an externally input clock cycle signal; A control subunit, used to determine the specific point and specific order of the rotation factor output at the current moment for NTT calculation according to the time rhythm control signal generated by the counter subunit; The address calculation subunit is used to calculate the index number of the current corresponding rotation factor according to the specific point position and specific order of NTT calculation obtained by the control subunit; The selection subunit is used to select a corresponding rotation factor from a row of rotation factors cached by the multiple cache units according to the index number obtained by the address calculation subunit.

10. The acceleration chip according to claim 9, wherein: The interconnection selection unit also includes: A plurality of interconnection sub-units, used for one-to-one connection with a plurality of butterfly computing units; The selection subunit is further used to output the selected rotation factor to the interconnection subunit corresponding to the index number.

Images