Fast number theoretic transform ntt acceleration chip

Abstract

The embodiment of the present specification provides an NTT acceleration chip. The chip comprises: a rotation factor calculation module comprising a plurality of pre-calculation units and a plurality of real-time calculation units, the plurality of pre-calculation units are used for performing, in parallel, calculation of initial rows of rotation factors and inter-row stepping factors by using primitive roots; the plurality of real-time calculation units are used for performing, in parallel, repeated iteration calculation of rotation factors of other rows according to the inter-row stepping factors based on the initial rows of rotation factors obtained by the plurality of pre-calculation units; a transposition module comprising a plurality of transposition units, which are used for performing, in parallel, transposition processing on an input sequence to obtain a transposed sequence; and an NTT calculation module comprising a plurality of butterfly calculation units, which are used for performing, in parallel, butterfly operation of each order and point number based on the rotation factors obtained by the rotation factor calculation module and the transposed sequence obtained by the transposition module to obtain an output sequence. The efficiency of NTT calculation can be improved.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the field of computers, and in particular to a fast number-theoretic transform (NTT) acceleration chip. BACKGROUND

[0002] Modern public key cryptography is one of the important technologies in the field of information security, which is a kind of cryptography technology based on mathematics and computer science, aiming to ensure secure communication and exchange of data. Public key cryptography greatly improves the security of information transmission, because the attacker cannot calculate the private key through the public key, thereby ensuring the confidentiality of information. Public key cryptography makes it more feasible to ensure information security, but the security depends on the difficulty of mathematical algorithms, so there will be a huge challenge in performance when dealing with large-scale data.

[0003] Fast number-theoretic transform (NTT) is an important algorithm in the field of public key cryptography, which is mainly used to calculate the point value representation of polynomials on a ring to accelerate the multiplication operation of polynomials on the ring. NTT algorithm is used in lattice-based post-quantum encryption algorithms, hash functions, digital signatures, and homomorphic encryption, zero-knowledge proof, etc. in privacy computing technology, so the high-performance implementation of NTT software and hardware is currently one of the research hotspots in modern cryptography. With the continuous development of cryptography, the application prospect of NTT is expected to be more extensive.

[0004] Modern homomorphic encryption algorithms incorporate residue number system (RNS) algorithms, which will have frequent modulus switching scenarios and synchronous changes in rotation factors. On the other hand, large moduli will be decomposed into multiple small moduli, resulting in multiple sets of different rotation factors. Therefore, NTT calculation on long polynomials will inevitably involve a large number of rotation factor-related operations. The usual approach is to reserve a cache inside the calculation chip and load the pre-calculated rotation factors into the reserved cache inside the chip through multiple moves from the external memory. For hardware implementation of NTT algorithm, one of the difficulties and challenges is that the on-chip storage resources and off-chip memory bandwidth resources to the calculation chip are limited, resulting in low efficiency of NTT calculation. SUMMARY

[0005] One or more embodiments of the present specification describe an NTT acceleration chip that can improve the efficiency of NTT calculation.

[0006] In a first aspect, a fast number-theoretic transform (NTT) acceleration chip is provided, and the acceleration chip comprises:

[0007] a rotation factor calculation module including a plurality of pre-calculation units and a plurality of real-time calculation units, the plurality of pre-calculation units being configured to perform, in parallel, calculation of initial rotation factors of a plurality of initial rows and inter-row stepping factors by using primitive roots of unity; and the plurality of real-time calculation units being configured to perform, in parallel, repeated iteration of calculation of rotation factors of rows other than the initial rows according to the inter-row stepping factors and the rotation factors of one of the initial rows obtained by the plurality of pre-calculation units;

[0008] a transposition module including a plurality of transposition units configured to perform, in parallel, transposition processing on an input sequence to obtain a transposed sequence;

[0009] an NTT calculation module including a plurality of butterfly calculation units configured to perform, in parallel, butterfly operations of different orders and different numbers of points according to the rotation factors obtained by the rotation factor calculation module and the transposed sequence obtained by the transposition module to obtain an output sequence; wherein the rotation factor calculation module, the transposition module and the NTT calculation module correspond to different stages of a first pipeline processing task respectively.

[0010] In a possible implementation, the pre-calculation units and the real-time calculation units correspond to different stages of a second pipeline processing task respectively, and the second pipeline processing task is a subtask of the first pipeline processing task.

[0011] In a possible implementation, the rotation factor calculation module further includes:

[0012] a plurality of pre-storage units configured to store, in parallel, the initial rotation factors of the plurality of initial rows and the inter-row stepping factors obtained by the plurality of pre-calculation units;

[0013] The plurality of real-time calculation units are specifically configured to read, from the plurality of pre-storage units, the rotation factors of one of the initial rows and the inter-row stepping factors obtained by the plurality of pre-calculation units.

[0014] In a possible implementation, the rotation factor calculation module further includes:

[0015] a plurality of cache units configured to cache, in parallel, the rotation factors of the rows other than the initial rows obtained by the plurality of real-time calculation units;

[0016] a plurality of interconnection selection units configured to select, from the rotation factors of one of the rows cached by the plurality of cache units, the rotation factors required for the butterfly operation of a target order, and connect the selected rotation factors to the butterfly calculation units of the target order.

[0017] In a possible implementation, the primitive roots of unity are externally input.

[0018] In a possible implementation, the pre-computation unit comprises a plurality of modular multiplication units, which are configured to perform modular multiplication calculation in parallel to obtain an inter-row stride factor including a maximum power of the primitive root of unity and initial rotation factors of a plurality of rows in a column direction of a pre-computation row number; wherein the maximum power and the pre-computation row number are determined according to a pipeline depth of the modular multiplication units.

[0019] Further, the modular multiplication calculation comprises:

[0020] a first modular multiplication performed by two primitive roots of unity of the same power; or

[0021] a second modular multiplication performed by a first primitive root of unity of a first power and a second primitive root of unity of a second power, wherein the difference between the second power and the first power is 1.

[0022] In a possible implementation, the plurality of real-time computation units are specifically configured to repeatedly and iteratively calculate rotation factors of rows other than the initial rows in the column direction according to the inter-row stride factor in the column direction, for a rotation factor of a row of the initial rows in the column direction obtained by the pre-computation unit.

[0023] repeatedly and iteratively calculate rotation factors of rows other than the initial rows in the row direction according to the inter-row stride factor in the row direction, for a rotation factor of a row of the initial rows in the row direction.

[0024] Further, the interconnection selection unit comprises:

[0025] a counter sub-unit configured to generate a time rhythm control signal with a period of a point number of the NTT according to an externally input clock period signal;

[0026] a control sub-unit configured to determine a specific point position and a specific order of the rotation factor output at a current time for NTT calculation according to the time rhythm control signal generated by the counter sub-unit;

[0027] an address calculation sub-unit configured to calculate an index number of a corresponding rotation factor according to the specific point position and the specific order of the NTT calculation obtained by the control sub-unit;

[0028] a selection sub-unit configured to select a corresponding rotation factor from a row of rotation factors cached by the plurality of cache units according to the index number obtained by the address calculation sub-unit.

[0029] Further, the interconnection selection unit further comprises:

[0030] a plurality of interconnection sub-units configured to be connected to the plurality of butterfly computation units one by one;

[0031] The selection subunit is further configured to output the selected rotation factor to an interconnection subunit corresponding to the index.

[0032] The acceleration chip provided by the embodiment of the present specification includes a rotation factor calculation module, a transposition module and an NTT calculation module, which correspond to different stages of a first pipeline processing task respectively, rotation factor in-chip full-pipeline real-time calculation is realized, and the consumption of off-chip interface bandwidth and in-chip storage resources is minimized; the interface between the rotation factor calculation module and the NTT calculation module is fused, thereby realizing full-pipeline real-time calculation of the NTT calculation module. The rotation factor calculation module includes a plurality of pre-calculation units for pre-calculating initial rotation factors and inter-row step factors, which can effectively reduce the on-chip pre-storage resources and off-chip interface bandwidth, and a large number of rotation factors do not need to be loaded from the outside; and the initial rotation factors and inter-row step factors can effectively compress the pipeline gap of the real-time calculation unit, thereby realizing real-time calculation of the rotation factors between rows and effectively improving the calculation efficiency. In summary, the efficiency of NTT calculation can be improved. BRIEF DESCRIPTION OF DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0034] Figure 1 The schematic diagram of the implementation scene of an embodiment disclosed in the present specification is shown.

[0035] Figure 2 The schematic diagram of the NTT acceleration chip structure according to an embodiment is shown.

[0036] Figure 3 The schematic diagram of the NTT pipeline operation according to an embodiment is shown.

[0037] Figure 4 The schematic diagram of the rotation factor calculation module structure according to an embodiment is shown.

[0038] Figure 5 The schematic diagram of the rotation factor calculation pipeline operation according to an embodiment is shown.

[0039] Figure 6 The flow chart of the rotation factor online calculation method according to an embodiment is shown.

[0040] Figure 7 The schematic diagram of the initial row parallel calculation according to an embodiment is shown.

[0041] Figure 8Fig. 2 shows a schematic diagram of calculating the initial second row from the initial first row according to one embodiment;

[0042] Figure 9 Fig. 3 shows a schematic diagram of the structure of real-time computing array according to one embodiment;

[0043] Figure 10 Fig. 4 shows a schematic diagram of the real-time computing process and the computing timing according to one embodiment;

[0044] Figure 11 Fig. 5 shows a schematic diagram of the composition structure of the interconnection selection unit according to one embodiment;

[0045] Figure 12 Fig. 6 shows a schematic diagram of the correspondence between the interconnection unit and the NTT computing unit according to one embodiment. DETAILED DESCRIPTION

[0046] The schemes provided in the present specification will be described below in conjunction with the accompanying drawings.

[0047] Firstly, some basic concepts used in the embodiments of the present specification are introduced.

[0048] Fully homomorphic encryption (FHE): refers to an encryption scheme that can perform arbitrary multiple addition and multiplication operations on encrypted data and obtain the same result as the plaintext data. This means that complex calculations can be performed on encrypted data without decrypting the data. FHE is a higher level of homomorphic encryption, providing the most computing power, but is also the most complex and computationally intensive form.

[0049] Zero-knowledge proof (ZKP): refers to a cryptographic tool that allows mutually distrustful communication between two parties to prove the validity of a proposition while not revealing any additional information. The prover can convince the verifier that a certain statement is correct without providing any useful information to the verifier. Zero-knowledge proof is essentially a protocol involving two or more parties, i.e., a series of steps that two or more parties need to take to complete a task. The prover proves to the verifier and convinces the verifier that he knows or has a certain message, but the proof process cannot leak any information about the message being proved to the verifier.

[0050] Number-theoretic transform (NTT): The principle of NTT is very similar to that of FFT algorithm in discrete form. The main difference between the two is only the domain of operation. The operation object of FFT is complex number domain, while the operation object of NTT is prime number domain. Therefore, NTT algorithm does not involve any precision rounding and error truncation problems. NTT algorithm has very wide application in lattice-based quantum cryptography, homomorphic encryption, zero-knowledge proof and other fields, and is one of the important algorithms in modern cryptography.

[0051] Butterfly calculation: It is the core operation in NTT, which respectively performs weighted and multiplication operations on two input data, and then outputs the operation results to two different positions. Butterfly operation can be realized by different combination methods to achieve different NTT algorithms, such as base 2-butterfly, base 4-butterfly, etc. The butterfly operation in NTT algorithm is usually a recursive process, which divides the original N data points into two N / 2 data points, and then combines them after complex operation. Different levels of recursive iteration are integrated through butterfly operation.

[0052] Rotation factor: It refers to the complex constant multiplied in the butterfly operation of Cooley-Tukey fast Fourier transform (FFT) algorithm. Therefore, the constant is located on the unit circle in the complex plane, and has a rotating effect on the multiplied number in the complex plane. In the NTT calculation process, the operation object is a prime number domain, so the difference from FFT is only the number domain.

[0053] Modular multiplication (MM): a·b mod N, which multiplies two input integers a and b and takes the remainder of N.

[0054] Figure 1 An implementation scenario of one embodiment disclosed in the present specification is shown. The implementation scenario relates to an NTT acceleration chip. It can be understood that the NTT acceleration chip is used to implement NTT calculation in order to improve the efficiency of NTT calculation. Referring to Figure 1 which shows a 32-point NTT butterfly transform of CT type, wherein, represents the rotation factor in each butterfly transform; according to the power addition property of the rotation factor in the multiplication sense, all can be calculated from the primitive root.

[0055] The scheme proposes a method and corresponding calculation structure for online real-time calculation of rotation factors, which is used for NTT calculation acceleration, and is expected to achieve the following effects: effectively reducing the use of on-chip memory, thereby reducing the chip area; effectively reducing the access frequency and access data volume of the chip to the external storage unit, thereby reducing the access bandwidth demand of the external storage unit; the calculation process has real-time performance and is fully pipelined, thereby improving the calculation efficiency of the entire NTT; supporting real-time configuration of the primitive root of the rotation factor, supporting NTT calculation of different lengths, and the scheme has flexibility and universality; supporting the design of the smallest calculation unit, so that different scale hardware circuits can be flexibly integrated.

[0056] The scheme mainly involves: using the smallest primitive root (i.e., the original root) in NTT calculation to perform recursive calculation to obtain the smallest set of rotation factors, wherein the same rotation factors inside different orders are merged; using several powers of the smallest primitive root to perform real-time recursive calculation on the smallest set of rotation factors; distributing all elements in the smallest set of rotation factors to several calculation units to perform parallel recursive calculation; extending one-dimensional NTT calculation to multi-dimensional NTT calculation, thereby expanding the rotation factor calculation space to multi-dimensions; selecting the rotation factors of all calculation units according to the NTT order and the point number and outputting them to the rotation factor interconnection unit; corresponding each rotation factor interconnection unit to each NTT calculation unit to realize complete NTT calculation.

[0057] Figure 2 An NTT acceleration chip structure diagram according to one embodiment is shown, which can be based on Figure 1 The implementation scenario shown is used to realize multi-dimensional NTT calculation. Figure 2 An NTT acceleration chip structure diagram according to one embodiment is shown. As Figure 2 The acceleration chip includes:

[0058] A rotation factor calculation module 21 includes a plurality of pre-calculation units and a plurality of real-time calculation units, the plurality of pre-calculation units are used to perform parallel calculation of initial several rows of rotation factors and inter-row step factors using primitive roots; the plurality of real-time calculation units are used to perform repeated iterative calculation of rotation factors of other rows except the initial several rows according to the inter-row step factors for one row of rotation factors obtained by the plurality of pre-calculation units;

[0059] A transposition module 22 includes a plurality of transposition units, which are used to perform parallel transposition processing on input sequences to obtain transposed sequences;

[0060] The NTT calculation module 23 includes a plurality of butterfly calculation units, which are used to perform butterfly operations of different orders and points based on the rotation factors obtained by the rotation factor calculation module 21 and the transposed sequences obtained by the transposition module 22 in parallel, to obtain an output sequence. The rotation factor calculation module 21, the transposition module 22, and the NTT calculation module 23 correspond to different stages of the first pipeline processing task, respectively.

[0061] It should be noted that the rotation factor calculation module 21, the transposition module 22, and the NTT calculation module 23 in the present scheme are independent of each other in the entire calculation process. The rotation factor calculation module can include a plurality of rotation factor calculation units, each of which can include a pre-calculation unit and a real-time calculation unit. The transposition module can include a plurality of transposition units. The NTT calculation module can include a plurality of butterfly calculation units, which are referred to as butterfly units for short.

[0062] Figure 3 An NTT pipeline diagram according to an embodiment is shown. Referring to FIG. 2, the rotation factor calculation module 21, the transposition module 22, and the NTT calculation module 23 are used to perform the rotation factor calculation, the transposition calculation, and the butterfly calculation, respectively. Figure 3 At time Tn, the rotation factor calculation, the transposition calculation, and the butterfly calculation are performed simultaneously. The cache units in the diagram are only used to cope with bandwidth fluctuations between data interfaces, and do not store large amounts of data.

[0063] In one example, the pre-calculation unit and the real-time calculation unit correspond to different stages of the second pipeline processing task, which is a subtask of the first pipeline processing task.

[0064] In one example, the rotation factor calculation module 21 further includes:

[0065] A plurality of pre-storage units are used to store a plurality of initial rows of rotation factors and inter-row step factors obtained by the plurality of pre-calculation units in parallel.

[0066] The plurality of real-time calculation units are specifically configured to read a row of rotation factors and inter-row step factors from the plurality of pre-storage units.

[0067] In one example, the rotation factor calculation module 21 further includes:

[0068] A plurality of cache units are used to cache rotation factors of other rows in addition to the initial rows obtained by the plurality of real-time calculation units in parallel.

[0069] A plurality of interconnection selection units are used to select rotation factors required for butterfly operations of a target order from a row of rotation factors cached by the plurality of cache units, and connect the selected rotation factors to the butterfly calculation units of the target order.

[0070] Figure 4 A structure diagram of a rotation factor calculation module according to an embodiment is shown. Referring to Figure 4 , the pre-calculation unit, the pre-storage unit, the real-time calculation unit, and the interconnection selection unit in the present scheme are independent of each other in the entire calculation process; the pre-storage unit, the real-time calculation unit, and the cache unit have the same number of channels C, and the interconnection selection unit has a different number of channels M and a different number of channels K from the pre-calculation unit; C, M, and K depend on the execution efficiency of each unit and have no specific correlation; the cache unit in the diagram is only used to cope with bandwidth fluctuations between data interfaces and does not store large amounts of data. It can be understood that the primitive root is a short form of the primitive unit root.

[0071] Figure 5 A pipeline diagram of a rotation factor calculation according to an embodiment is shown. Referring to Figure 5 , the pre-calculation, the pre-storage, the real-time calculation, and the interconnection selection are performed simultaneously at time Tn.

[0072] Figure 6 A flowchart of a rotation factor online calculation method according to an embodiment is shown, which can be based on Figure 4 the rotation factor calculation module structure shown. As Figure 6 shown, the rotation factor online calculation method in the embodiment includes the following steps: step 61, receiving parameters; step 62, based on the parameters, calculating a pre-calculation result including inter-row step factors and initial row rotation factors; step 63, sending the pre-calculation result to a real-time calculation array; step 64, repeatedly and iteratively calculating all row rotation factors through the real-time calculation array; step 65, selecting the rotation factor calculated for each row; and step 66, fusing the selected rotation factor into NTT calculation. The specific execution mode of each of the above steps is described below.

[0073] First, in step 61, parameters are received. It can be understood that the above-mentioned parameters at least include primitive unit roots.

[0074] In one example, the primitive unit roots are externally input.

[0075] Optionally, the primitive unit roots w input externally are received, and the 2D-NTT point number N = R C, such as R rows and C columns, and in general cases, R = C and both are integer powers of 2, and the pipeline depth PipDepth of modular multiplication.

[0076] Without loss of generality, the input parameters can come from an external control unit, for example, the parameters include a plurality of primitive unit roots w1...wn, and the number of parameters is equal to the number of rows of the 2D-NTT. n, 2D-NTT point number and row number column number N, R, C (N = R.C), here the pipeline depth PipDepth of the module multiplication can be consistent with the number of primitive roots, but also different from each other; such as CPU or MCU and other control chips are configured into the computing unit involved in the embodiments of the present application by bus, the bus can be as PCIE / I2C / SPI or other typical communication bus.

[0077] The input parameters can also be pre-stored in the processor, and the parameters are output from the processor internal storage unit to the rotation factor calculation module when the calculation is started.

[0078] Then in step 62, based on the parameters, the pre-computed results including the inter-row step factor and the initial several rows of rotation factors are calculated. It can be understood that the processing process can be executed in parallel by a plurality of pre-computation units.

[0079] In one example, the pre-computation unit includes a plurality of module multiplication units, which are used to perform module multiplication calculation in parallel to obtain the inter-row step factor including the maximum power of the primitive root and the initial rotation factor of each row in the column direction of the pre-computed row number; wherein the maximum power and the pre-computed row number are determined according to the pipeline depth of the module multiplication unit.

[0080] Further, the module multiplication calculation includes:

[0081] The first module multiplication of two primitive roots of the same power; or,

[0082] The second module multiplication of the primitive root of the first power and the primitive root of the second power; the difference between the second power and the first power is 1.

[0083] For example, using the primitive root w, the initial several rows of rotation factors and the inter-row step factor in the column direction are pre-calculated, such as w 2 , w 3 , w 4 ...w C .

[0084] In the above process, according to the input module multiplication unit pipeline depth PipDepth, the inter-row step factor w 2 ...w PipDepth of the maximum power and the pre-computed row number line1line2...line PipDepth are determined, where the total number of rows refers to the number of rotation factors in the row direction, that is, R, and in the 2-D NTT, the initial row line1 of the rotation factor has two kinds, one is C-point w 0 , and the other is w 0 w 1 ...w C-1 , C-point w0 Only need to initialize to all 1, no additional calculation; w 0 w 1 ...w C-1 By a number of pre-computing units in parallel to obtain.

[0085] Figure 7 Show the initial row parallel computing schematic diagram according to one embodiment. Referring to Figure 7 , the ellipsis in the figure indicates that the number of parallel pre-computing units is not specifically required, w 2n = w n *w n w 2n+1 = w n *w n+1 Here * means multiplication in the sense of modulus, and the above formula shows that it is better to perform modular multiplication in parallel by decomposing into n and n+1 power. In the actual NTT calculation process, the primitive root usually reaches dozens, so a plurality of initial rows are calculated in parallel to obtain high calculation efficiency.

[0086] In the embodiment of the present specification, the rotation factors of the initial first row are first calculated, and after the initial first row is calculated, the remaining initial rows are calculated according to PipDepth. For example, if PipDepth = 2, line1 and line2 need to be calculated, so that real-time pipeline calculation of rotation factors line1...line R can be realized.

[0087] Figure 8 Show the schematic diagram of calculating the initial second row from the initial first row according to one embodiment. Referring to Figure 8 , respectively show the initial row line1 is C points w 0 and w 0 w 1 ...w C-1 Corresponding calculation of line2. The modmul in the figure means modular multiplication, that is, multiplication in the sense of modulus; the cases of the remaining PipDepth can be analogized according to the above examples, and will not be described in detail; modmul here means a plurality of parallel computing units, the number of which usually corresponds to the total number of points C of a row; without loss of generality, line PipDepth needs to be calculated at most in the figure. A plurality of initial rows and step rotation factors calculated are input into a pre-stored unit, the number of which usually corresponds to the total number of points C of a row.

[0088] Then in step 63, the pre-computation result is sent to the real-time calculation array. It can be understood that the real-time calculation array includes a plurality of real-time calculation units, which can calculate the rotation factors in parallel.

[0089] For example, the C rotation factors in the initial several rows are sent into the rotation factor real-time calculation array respectively, and the array has C real-time calculation units.

[0090] In step 64, the rotation factors of all rows are iteratively calculated by the real-time calculation array. It can be understood that when the number of rotation factors to be calculated is large, the rotation factors of all rows cannot be calculated at one time.

[0091] In one example, the plurality of real-time calculation units are specifically configured to, for a rotation factor in one of the initial several rows in the column direction, iteratively calculate rotation factors of other rows except the initial several rows in the column direction according to the inter-row stepping factor in the column direction.

[0092] For a rotation factor in one of the initial several rows in the row direction, iteratively calculate rotation factors of other rows except the initial several rows in the row direction according to the inter-row stepping factor in the row direction.

[0093] For example, the C real-time calculation units iteratively calculate the rotation factor of each row according to the inter-row stepping factor.

[0094] Figure 9 A structural diagram of a real-time calculation array according to one embodiment is shown. Referring to Figure 9 , the real-time calculation array includes C real-time calculation units, each of which is connected to a cache unit, and the real-time calculation unit obtains the inter-row stepping factor w 2 ...w PipDepth and the pre-calculated row line1line2...line PipDepthfrom the pre-storage unit to perform real-time calculation, and the calculated rotation factor enters the cache unit.

[0095] For example, if PipDepth=2, the real-time calculation is performed on line3 to lineR.

[0096] If PipDepth=n, the real-time calculation is performed on line n+1 to lineR.

[0097] Figure 10 A real-time calculation process and a calculation timing diagram according to one embodiment are shown. Referring to Figure 10For example, taking PipDepth=2, the initial behavior of line1 and line2, and the interline step factor w2, line3 is calculated according to line1 and w2, line4 is calculated according to line2 and w2, line5 is calculated according to line3 and w2, line6 is calculated according to line4 and w2, and so on, and the iteration calculation is performed. The cache unit caches a plurality of rows of rotation factors calculated in real time, so as to cope with the data interface bandwidth fluctuation between different calculation units.

[0098] In step 65, the rotation factor calculated for each row is selected. It can be understood that the above processing process can be performed by an interconnection selection unit.

[0099] In an example, the interconnection selection unit comprises:

[0100] A counter subunit is configured to generate a time rhythm control signal with a point number of NTT as a period according to an externally input clock period signal;

[0101] A control subunit is configured to determine a specific point and a specific order of the rotation factor output at a current time for NTT calculation according to the time rhythm control signal generated by the counter subunit;

[0102] An address calculation subunit is configured to calculate an index mark of the current rotation factor according to the specific point and the specific order of the NTT calculation obtained by the control subunit;

[0103] A selection subunit is configured to select the corresponding rotation factor from a row of rotation factors cached by the plurality of cache units according to the index mark obtained by the address calculation subunit.

[0104] Further, the interconnection selection unit further comprises:

[0105] A plurality of interconnection subunits are configured to be connected to the plurality of butterfly calculation units one by one;

[0106] The selection subunit is further configured to output the selected rotation factor to the interconnection subunit corresponding to the index mark.

[0107] For example, the required rotation factor in each order NTT calculation unit is selected from a row of rotation factors calculated by the real-time calculation unit.

[0108] In the embodiment of the present specification, the interconnection selection unit is designed on the basis that the rotation factor of each order butterfly calculation in the fast number theory transform is repeated and can be compressed.

[0109] Taking 32-point NTT calculation as an example,

[0110] The rotation factor used in all the butterfly transform of the 1st order is 1.

[0111] The rotation factor used in all the butterfly transform of the 2nd order is 2, which is 1 and w respectively 8 ;

[0112] The rotation factor used in all the butterfly transform of the 3rd order is 4, which is 1, w 4 w 8 w 12 ; ...

[0114] There are totally 16 in the 5th order.

[0115] So the total rotation factor in a row is 1+2+4+8+16=31;

[0116] But the total rotation factor needed in the actual 32-point NTT is 80; so the expansion from 31 rotations to 80 rotations is realized by the interconnection selection unit; without loss of generality, the total number of rotation factors compressed in the N-point NTT calculation is 1+2+4+...+N / 2;

[0117] Specifically, the interconnection selection unit includes the following four components: 1. a counter unit; 2. a control unit; 3. an address calculation unit; 4. a selection unit; 5. an interconnection unit; in order to reflect the containing relationship between the units in the name, the counter unit can be called the counter subunit, the control unit can be called the control subunit, the address calculation unit can be called the address calculation subunit, the selection unit can be called the selection subunit, and the interconnection unit can be called the interconnection subunit.

[0118] Figure 11 The structural schematic diagram of the interconnection selection unit according to one embodiment is shown. Referring to Figure 11 , the counter unit: simply called the counter, generates a time rhythm control signal with the NTT point number as the period according to the clock period signal input from outside; the control unit: controls the working time rhythm of the interconnection selection unit according to the counter, to decide the specific point position and the specific order of the rotation factor output at the current time for the NTT calculation; the address calculation unit: calculates the index label of the cache unit of the corresponding rotation factor in the real-time calculation unit array according to the time rhythm information given by the control unit, in combination with the specific point position and the specific order of the NTT calculation and other information; the selection unit: selects the corresponding rotation factor from the C cache units in the real-time calculation array according to the index label of the cache unit output by the address calculation unit, which is located in the interval of 1 to C, and outputs the rotation factor to the interconnection unit; the interconnection unit: distributes the rotation factor selected from the cache unit to the adjacent interconnection unit through the interconnection interface.

[0119] Without loss of generality, the time t clockrepresents the time rhythm information given by the counter, t clock is a variable that is incremented at fixed time intervals, the range of variation has periodicity, and the variation period depends on the number of NTT points; X(t clock ) and Y(t clock ) represent the point position and order number of the NTT calculation given by the control unit, which can be calculated as follows: t clock The index label Idx(m) of the cache unit in the real-time calculation array corresponding to the time t

[0120]

[0121] m(X(t clock ), Y(t clock )) = Y(t clock ) * (X(t clock ) + 1) + X(t clock )

[0122] The % in the above formula represents the remainder processing;

[0123] Taking N = R * C = 65536, R = 256, and C = 256 as an example, there are C = 256 calculation units and cache units in the real-time calculation array, t clock increases periodically with a period of 256, that is, it returns to 1 after changing to 256, 1 row of 256-point NTT calculation, 128 rotation factors per order, a total of 8 orders, 0 ≤ X(t clock ) ≤ 127 0 ≤ Y(t clock ) ≤ 7 M = 128 * 8, and all Idx(m) can be obtained by traversing all values of X(t clock ) and Y(t clock ) in the value range.

[0124] Finally, in step 66, the selected rotation factor is fused into the NTT calculation. It can be understood that the NTT calculation is performed by an NTT calculation unit, and specifically, the selected rotation factor can be fused into each order NTT calculation unit.

[0125] In the embodiments of the present specification, the NTT calculation unit can be equivalent to the aforementioned butterfly calculation unit.

[0126] The selected rotation factor is fused into the NTT calculation according to the following:

[0127] Since X(t clock ) and Y(t clock ) are determined by t clock , X(t clock) can be characterized as the number of two points in the vertical direction input to the butterfly in the NTT calculation, taking two points as the unit of numbering, Y(t clock ) can be characterized as the order currently in the NTT calculation, taking n(X(t clock ), Y(t clock )) represents the butterfly numbering of a specific order in the NTT, and obviously m(X(t clock ), Y(t clock )) and n(X(t clock ), Y(t clock )) can be one-to-one corresponding;

[0128] Figure 12 A schematic diagram of the correspondence between the interconnection unit and the NTT calculation unit according to an embodiment is shown. Referring to Figure 12 The interconnection unit and the NTT calculation unit are one-to-one corresponding, that is, there are as many interconnection units as there are NTT calculation units.

[0129] It should be noted that the computing architecture mentioned in the embodiments of the present specification can run on a field programmable gate array (FPGA), a CPU, a GPU, or an application specific integrated circuit (ASIC); including but not limited to the above processor types.

[0130] In addition, the aforementioned interconnection selection unit can be detached, that is, the NTT rotation factors of all orders are not compressed, and are all calculated in real time and directly fused with the NTT calculation unit without affecting the normal calculation of the NTT; this scheme will sacrifice more operation resources.

[0131] In addition, the aforementioned pre-computation unit can be detached, that is, the initial several rows of rotation factors and inter-row step factors pre-calculated can be input to the real-time calculation unit from the external interface; or by pre-storing the initial several rows of rotation factors and inter-row step factors in the processor, input to the real-time calculation unit at the start time of calculation; this scheme will sacrifice the interface bandwidth or sacrifice more on-chip storage resources, resulting in waste of chip area.

[0132] In addition, in addition to using the interconnection selection method, the rotation factor can also be expanded and filled directly using the replication method; when the NTT point number is very large, the direct replication method will cause the same rotation factor signal in the same order NTT to fan out greatly.

[0133] The pre-computation array, the real-time calculation array, and the interconnection selection array in the embodiments of the present specification can work at different working frequencies; at the same time, the specific number of each array is not limited; that is, the computing architecture corresponding to the above arrays of different numbers and different working frequencies all belong to the scope of the present scheme.

[0134] The acceleration chip provided by the embodiments of the present specification comprises a rotation factor calculation module, a transposition module and an NTT calculation module, which correspond to different stages of a first pipeline processing task respectively, rotation factor on-chip full-pipeline real-time calculation is realized, off-chip interface bandwidth and on-chip memory resource consumption are reduced to the maximum extent, the interface between the rotation factor calculation module and the NTT calculation module is fused, and thus full-pipeline real-time calculation of the NTT calculation module is realized. The rotation factor calculation module comprises a plurality of pre-calculation units, which are used for pre-calculation of initial rotation factors and inter-row step factors, on-chip pre-storage resource and off-chip interface bandwidth can be effectively reduced, and a large number of rotation factors do not need to be loaded from the outside; and the initial rotation factors and the inter-row step factors can effectively compress the pipeline gap of the real-time calculation unit, and thus real-time calculation of the rotation factors between rows is realized, and the calculation efficiency is effectively improved. In summary, the efficiency of NTT calculation can be improved.

[0135] The embodiments of the present specification have the following improvements relative to the general processing mode: the present scheme realizes rotation factor on-chip full-pipeline real-time calculation, and off-chip interface bandwidth and on-chip memory resource consumption are reduced to the maximum extent; the pre-calculation of all initial rotation factors and inter-row step factors can effectively reduce on-chip pre-storage resource and off-chip interface bandwidth, and a large number of rotation factors do not need to be loaded from the outside; the pre-calculation of all initial rotation factors and inter-row step factors can effectively compress the pipeline gap caused by the pipeline depth of the multiplication in the modulo sense, and thus real-time calculation of the rotation factors between rows is realized, and the calculation efficiency is effectively improved; the interconnection selection design effectively utilizes the repetition characteristics of the rotation factors, that is, compression, and thus on-chip memory resource is reduced, not only the expansion filling of the rotation factors is realized, but also the replication amount of signals is greatly reduced, and the signal fan-out is effectively reduced; the present scheme realizes atomization and array of all operation units and cache units on the chip; the number of operation units and cache units can be flexibly adjusted according to any NTT point number, and the change of the NTT point number is flexibly adapted; working frequency isolation is realized between operation arrays; and the interface between NTT calculation units is fused, and thus real-time full-pipeline calculation of the NTT calculation unit is realized.

[0136] The embodiments of the present specification can achieve the following technical effects: effectively reducing the use of on-chip memory, thereby reducing the chip area; effectively reducing the access frequency and access data amount of the chip to the external storage unit, thereby reducing the access bandwidth demand of the external storage unit; the calculation process has real-time and full-process pipelining, thereby improving the calculation efficiency of the entire NTT; supporting real-time configuration of primitive roots of rotation factors, supporting NTT calculation of different lengths, and the scheme has flexibility and universality; supporting minimum calculation unit design, calculation unit atomization, thereby flexible integration of hardware circuits of different scales; the same rotation factor is transmitted through interconnection, the replication of a large-area signal is changed into data interconnection transmission in a small range, thereby greatly reducing the replication amount of the signal and effectively reducing the signal fan-out;

[0137] According to another aspect, embodiments also provide a computer-readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method described above. Figure 6

[0138] According to another aspect, embodiments also provide a computer-readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method described above. Figure 6

[0139] Those skilled in the art should be aware that the functions described in the above one or more examples can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium.

[0140] The above specific embodiments further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.​​

Claims

1. A fast number theoretic transform (NTT) acceleration chip, the acceleration chip comprising: a rotation factor calculation module comprising a plurality of pre-calculation units and a plurality of real-time calculation units, the plurality of pre-calculation units being configured to perform, in parallel, calculation of initial rows of rotation factors and inter-row stepping factors using primitive roots of unity; and the plurality of real-time calculation units being configured to perform, in parallel, repeated iteration of calculation of rotation factors of rows other than the initial rows of rotation factors based on the inter-row stepping factors for a row of the initial rows of rotation factors obtained by the plurality of pre-calculation units; a transposition module comprising a plurality of transposition units, the plurality of transposition units being configured to perform, in parallel, transposition processing on an input sequence to obtain a transposed sequence; an NTT calculation module comprising a plurality of butterfly calculation units, the plurality of butterfly calculation units being configured to perform, in parallel, butterfly operations of respective orders and respective numbers of points based on the rotation factors obtained by the rotation factor calculation module and the transposed sequence obtained by the transposition module to obtain an output sequence; wherein the rotation factor calculation module, the transposition module and the NTT calculation module correspond to different stages of a first pipeline processing task.

2. The acceleration chip of claim 1, wherein, The pre-calculation units and the real-time calculation units correspond to different stages of a second pipeline processing task, the second pipeline processing task being a subtask of the first pipeline processing task.

3. The acceleration chip of claim 1, wherein, The rotation factor calculation module further comprises: a plurality of pre-storage units configured to store, in parallel, the initial rows of rotation factors and the inter-row stepping factors obtained by the plurality of pre-calculation units; The plurality of real-time calculation units are specifically configured to read, from the plurality of pre-storage units, a row of rotation factors and inter-row stepping factors of the initial rows of rotation factors obtained by the plurality of pre-calculation units.

4. The acceleration chip of claim 1, wherein, The rotation factor calculation module further comprises: a plurality of cache units configured to cache, in parallel, rotation factors of rows other than the initial rows of rotation factors obtained by the plurality of real-time calculation units; a plurality of interconnection selection units configured to select, from a row of rotation factors cached by the plurality of cache units, rotation factors required for butterfly operations of a target order, and connect the selected rotation factors to butterfly calculation units of the target order.

5. The acceleration chip of claim 1, wherein, The primitive roots of unity are externally input.

6. The acceleration chip of claim 1, wherein, The pre-calculation units comprise a plurality of modular multiplication units, the plurality of modular multiplication units being configured to perform, in parallel, modular multiplication to obtain inter-row stepping factors including a maximum power of the primitive roots of unity and initial rows of rotation factors in a column direction of a pre-calculation row number; wherein the maximum power and the pre-calculation row number are determined according to a pipeline depth of the modular multiplication units.

7. The acceleration chip of claim 6, wherein, The modular multiplication comprises: first modular multiplication of two primitive roots of unity of the same power; or second modular multiplication of a first primitive root of unity and a second primitive root of unity, the second power being 1 more than the first power.

8. The acceleration chip of claim 1, wherein, The plurality of real-time calculation units are specifically configured to perform, for a row of rotation factors of the initial rows in the column direction obtained by the pre-calculation units, repeated iteration of calculation of rotation factors of rows other than the initial rows in the column direction based on inter-row stepping factors in the column direction. The rotation factor of a row in the initial rows in the row direction is repeatedly iterated according to the inter-row step factor in the row direction to calculate the rotation factor of other rows except the initial rows in the row direction.

9. The acceleration chip of claim 4, wherein, The interconnection selection unit comprises: a counter subunit configured to generate a time rhythm control signal with a point number of the NTT as a period according to a clock period signal input from outside; a control subunit configured to determine a specific point position and a specific order of the rotation factor output at a current time for NTT calculation according to the time rhythm control signal generated by the counter subunit; an address calculation subunit configured to calculate an index number of the corresponding rotation factor according to the specific point position and the specific order of the NTT calculation obtained by the control subunit; a selection subunit configured to select the corresponding rotation factor from a row of rotation factors cached by the plurality of cache units according to the index number obtained by the address calculation subunit.

10. The acceleration chip of claim 9, wherein, The interconnection selection unit further comprises: a plurality of interconnection subunits configured to be connected to the plurality of butterfly calculation units one by one; the selection subunit is further configured to output the selected rotation factor to the interconnection subunit corresponding to the index number.

Images