Method and device for decomposing data according to bit width

Abstract

According to the technical concept of decomposing the data according to the bit width provided by the embodiment of the specification, a bit width decomposition instruction is decomposed into a decomposition process of a plurality of decomposition cycles through shifting operation, and the number of the decomposition cycles is determined by the bit width to be decomposed and the target bit width; the lowest bit of the remaining bits to be decomposed is aligned with the lowest bit of the storage unit, and a target value is obtained by combining bitwise AND operation of the mask word. According to the technical scheme, hardware storage resources are fully utilized, and the processing efficiency is improved.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of computer technology, and more particularly, to a method and apparatus for decomposing data by bit width. Background Art

[0002] Modern public key cryptography is one of the important technologies in the field of information security. It is a cryptographic technology based on mathematics and computer science, which aims to ensure secure communication or secure data exchange between different business parties. Public key cryptography greatly improves the security of information transmission, but its security depends on the difficulty of mathematical algorithms.

[0003] Taking Fully Homomorphic Encryption (FHE) as an example, any number of addition and multiplication operations can be performed in the encrypted state, and the same result as the plaintext data can be obtained. This means that complex calculations can be performed on encrypted data without decrypting the data. FHE is a higher level in homomorphic encryption, providing the greatest computing power, but its computational complexity and computational intensity are also high. For example, complex multiplication operations involving more polynomials (such as 128-point polynomials) and so on.

[0004] Some algorithms used for information security have high computational complexity and face huge challenges in computing device performance when processing large-scale data. Therefore, how to reduce computational complexity is an important technical issue in terms of saving hardware resources, improving computing efficiency, and controlling noise. Summary of the invention

[0005] One or more embodiments of the present specification describe a method and device for decomposing data by bit width, so as to solve one or more problems mentioned in the background technology.

[0006] According to a first aspect, a method for decomposing data by bit width is provided, which is used to decompose each group of bits to be decomposed in a value to be decomposed into weighted forms of several target values ​​under a target bit width. In the process of bit width decomposition, after several iterative decomposition cycles, the corresponding target values ​​are determined in sequence for each bit to be decomposed from the lowest starting bit to the highest ending bit; in a single decomposition cycle, the method comprises: right-shifting a current decomposition value corresponding to the value to be decomposed by a first number of bits so that the current lowest bit to be decomposed in the value to be decomposed is aligned with the lowest bit of a storage unit to obtain a first intermediate result, wherein the current lowest bit to be decomposed is the lowest bit of the remaining bits to be decomposed of the rightmost group of bits to be decomposed; and obtaining target values ​​corresponding to each group of bits to be decomposed by performing a bitwise AND operation on a mask word and the first intermediate result, wherein the mask word has the same bit width as the value to be decomposed and includes each target bit group, a single target bit group corresponds to a single group of bits to be decomposed, and the value on the low-order bit consistent with the target bit width is 1, and the value on the other bits is 0.

[0007] In an optional embodiment, when the current decomposition cycle is the first decomposition cycle for the value to be decomposed, the current decomposition value is the value to be decomposed, and the first quantity is determined by the difference between the starting bit of the rightmost group of bits to be decomposed and the lowest bit of the storage unit; when the current decomposition cycle is not the first decomposition cycle for the value to be decomposed, the current decomposition value is the intermediate result of the previous decomposition cycle, and the first quantity is consistent with the target bit width.

[0008] In an optional embodiment, the bit width of a single group of bits to be decomposed is the first bit width, and each decomposition period corresponds to an offset identifier; in the single decomposition period, the method further includes: detecting whether the offset identifier is greater than 0; if it is not greater than 0, determining that the current decomposition period is the first decomposition period for the value to be decomposed, and updating the offset identifier to the difference between the first bit width and the target bit width; if it is greater than 0, determining that the current decomposition period is not the first decomposition period for the value to be decomposed, and updating the offset identifier to the difference between its current value and the target bit width.

[0009] In an optional embodiment, shifting the current decomposition value corresponding to the value to be decomposed right by a first number of bits includes: keeping the data before the highest bit of the leftmost group of bits to be decomposed in the value to be decomposed unchanged, and shifting other bits to the right; or, circularly shifting the current decomposition value; or, shifting out the lowest first number of bits of the current decomposition value, and filling the highest first number of bits with 0.

[0010] According to a second aspect, a device for decomposing data by bit width is provided, which is used to decompose each group of bits to be decomposed in a value to be decomposed into weighted forms of several target values ​​under a target bit width, and the device comprises: a shift unit and a determination unit; in the process of bit width decomposition, after several iterative decomposition cycles, the corresponding target values ​​are determined in sequence for each bit to be decomposed from the lowest starting bit to the highest ending bit; in a single decomposition cycle:

[0011] The shift unit is configured to right-shift the current decomposition value corresponding to the to-be-decomposed value by a first number of bits, so that the lowest bit to be decomposed currently in the to-be-decomposed value is aligned with the lowest bit of the storage unit, and obtain a first intermediate result, wherein the lowest bit to be decomposed currently is the lowest bit of the remaining to-be-decomposed bits of the rightmost group of to-be-decomposed bits;

[0012] The determination unit is configured to obtain target values ​​corresponding to each group of bits to be decomposed by performing a bitwise AND operation on the mask word and the first intermediate result, wherein the mask word has a bit width consistent with the value to be decomposed and includes target bit groups, a single target bit group corresponds to a single group of bits to be decomposed, and the value of the low-order bit consistent with the target bit width is 1, and the value of other bits is 0.

[0013] In an optional embodiment, the bit width of a single group of bits to be decomposed is the first bit width, and the shift unit also includes a shift rhythm control subunit, which is configured to describe the decomposition progress of the value to be decomposed through an offset identifier; each decomposition period corresponds to; in the single decomposition period, the shift unit is also configured to: detect whether the offset identifier is greater than 0; if it is not greater than 0, determine that the current decomposition period is the first decomposition period for the value to be decomposed, and update the offset identifier to the difference between the first bit width and the target bit width through the shift rhythm control subunit; if it is greater than 0, determine that the current decomposition period is not the first decomposition period for the value to be decomposed, and update the offset identifier to the difference between its current value and the target bit width through the shift rhythm control subunit.

[0014] In a further optional embodiment, the shift unit also includes a shift position control subunit, which is configured to: when the current decomposition cycle is the first decomposition cycle for the value to be decomposed, determine the current decomposition value as the value to be decomposed, and the first quantity is the difference between the starting bit of the rightmost group of bits to be decomposed and the lowest bit of the storage unit; when the current decomposition cycle is not the first decomposition cycle for the value to be decomposed, determine the current decomposition value as an intermediate result of the previous decomposition cycle, and the first quantity is consistent with the target bit width.

[0015] According to a third aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed in a computer, the computer is caused to execute the method described in the first aspect.

[0016] According to a fourth aspect, a computing device is provided, comprising a memory and a processor, wherein an executable code is stored in the memory, and when the processor executes the executable code, the method described in the first aspect is implemented.

[0017] Through the method and device provided in the embodiments of this specification, the bit width decomposition instruction is decomposed into decomposition instructions of multiple decomposition cycles through shift operations, and the number of decomposition cycles is determined by the bit width of the bit to be decomposed and the target bit width, and the lowest bit of the remaining bits to be decomposed is aligned with the lowest bit of the storage unit, and the target value is obtained by combining the bitwise AND operation with the mask word. On the one hand, this technical solution can directly obtain the target result without the need for intermediate transition instructions, that is, without the need for intermediate cache. On the other hand, according to the actual business, the bit width decomposition can be performed on a single group of bits to be decomposed at a time, or the bit width decomposition can be performed on multiple groups of bits to be decomposed at the same time, which is conducive to making full use of hardware storage resources, avoiding resource waste, and improving processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0019] Figure 1 A schematic diagram showing a flow chart of decomposing data by bit width in a specific example of conventional technology;

[0020] Figure 2 A schematic diagram showing the principle of decomposing data by bit width in another specific example of conventional technology;

[0021] Figure 3 A schematic diagram showing a process of decomposing data by bit width according to an embodiment of the present specification;

[0022] Figure 4 A schematic diagram showing the positional relationship between the values ​​to be decomposed and the bits to be decomposed, and the storage units in this specification;

[0023] Figure 5 A schematic diagram showing a flow chart of decomposing a single group of bits to be decomposed according to bit width according to a specific example of this specification;

[0024] Figure 6A schematic diagram showing a flow chart of simultaneously decomposing multiple groups of bits to be decomposed according to bit width according to another specific example of the present specification;

[0025] Figure 7 A schematic block diagram showing an apparatus for decomposing data by bit width according to an embodiment of the present specification;

[0026] Figure 8 A schematic block diagram showing a more specific example of an apparatus for decomposing data by bit width;

[0027] Fig. 9 A schematic diagram of an arrangement structure of an array formed by various decomposition computing units under the technical architecture of this specification is shown. DETAILED DESCRIPTION

[0028] The technical solution provided in this specification is described below in conjunction with the accompanying drawings.

[0029] In some data processing services (such as polynomial decomposition under homomorphic encryption described in the background technology), in order to reduce computational complexity, conventional technology can adopt the method of decomposing bit width for data processing. Bit width usually refers to the number of binary bits that a digital circuit (such as a processor, memory, etc.) processes or transmits at one time. The decomposition bit width operation can be to decompose a value that occupies a large number of bits into a weighted value that occupies a small number of bits, such as a 64-bit value, which is decomposed into the sum of the products of 32 2-bit values ​​and the corresponding powers of 2. The corresponding power of 2 can be regarded as a weight, and the product of a number and a power of 2 can be achieved by a shift operation. Decomposing the bit width can reduce computational complexity and reduce noise. The purpose and function of bit width decomposition are introduced below through a more specific application example.

[0030] In FHE, key switching may be involved, which is generally used for relinearization and rotation of ciphertext in FHE schemes. For example, in a cryptographic scheme based on RLWE, an encryption / decryption logic C0+C1*S=M+E with good mathematical properties can be used, with the following method: Party A uses the new key S new For the old key S old Encryption is performed to generate the "ciphertext of the old key (C0′, C1′)", that is Then Party A transmits this ciphertext to Party B, and Party B performs an update operation on all the original ciphertext data (C0, C1). In this way, in terms of formula relationship, we have:

[0031]

[0032] After the above update, the ciphertext data is not decrypted by S old The encrypted ciphertext becomes S new Encrypted ciphertext.M The noise introduced during the calculation process. The noise level is usually positively correlated with the number of bits of the data. Ciphertext strings are usually long, such as 64 bits. Therefore, during the key switching process, the noise may become unacceptable (too much noise to decrypt the ciphertext to get the plaintext), resulting in decryption failure; therefore, the noise needs to be controlled. One way to reduce noise is bit width decomposition.

[0033] Specifically, in the polynomial calculation (especially multiplication calculation) of key replacement, a polynomial H with a large number of bits (such as 64 bits, 128 bits, etc.) is decomposed into "small polynomials H0, H1, H2...H w " and a "constant vector" (i.e. 1, 2 1 , 2 2 , ..., 2 w ) (which can be achieved by shifting), and then merge the constant vector part into the "key encryption process", so that the noise amplification factor is changed from a "large number" (such as H·E M ), and become some "decimals" (such as H i ·E i ). Assume that the original polynomial is a large integer on the interval [0, Q-1] (assuming Q is 2 64 , a single value must be represented by 64 bits), E i is the original noise Q level, the coefficient H i It is taken from {0, 1}, so the overall noise level is only about log2Q times of the original noise Q, which is significantly lower than Q, thus playing a role in suppressing noise.

[0034] Issues to consider during bit width decomposition include: target bit width (such as H i bit width), the original bit width of the bits to be decomposed (such as the bit width of H in the previous text), the control of the decomposition start bit and stop bit, etc.

[0035] To this end, the means adopted in conventional technology are:

[0036] (1) Figure 1 The truncation method shown

[0037] Input the value to be decomposed, and calculate the number of executions of the circular shift according to the original bit width and the target bit width ( Figure 1 The decomposition process includes the following loops: truncation → intermediate result cache → right shift target bit width → truncation → target result cache…

[0038] In this scheme, if the number of points of the polynomial is large, such as 2 16, then the original data, target result and intermediate result need to be cached 2 16 *26 points (the bit width of each point is 100 bits). The bit width of the intercepted target data is not necessarily a standard data type (such as integer int, floating point float, etc.), and data format conversion is often required (it is inconsistent with the original data bit width, and the high bits of the target result need to be padded with zeros). In the hardware manufacturing process, for custom circuits, it is necessary to customize the circuit according to the maximum bit width (such as 100 bits). If the bit width is less than the decomposition specification, it may cause a waste of hardware computing resources. In addition, each decomposition requires a sequential division calculation, and the number of circular shifts = original bit width / target bit width, such as 100 / 4.

[0039] (2) Figure 2 The instruction disassembly method shown

[0040] The original bit width decomposition instruction is disassembled, that is, the original large bit width polynomial is first disassembled into intermediate values ​​of intermediate bit width, and then the intermediate values ​​of intermediate bit width are decomposed one by one into the final target bit width value. Figure 2 In the first decomposition instruction, the 64-bit original bit width value can be decomposed into a 16-bit intermediate bit width value, and then the 16-bit intermediate bit width value is decomposed into a 4-bit target bit width value through the second instruction. In this way, after the first instruction is executed, the cache corresponding to the intermediate bit width value and the corresponding 4-bit target bit width value can be released, thereby reducing cache pressure. However, this method increases the number of instructions, and the intermediate results still occupy cache space.

[0041] In view of this, the present specification provides a technical solution for bit width decomposition, which considers solving the following problems: the bit width of the bits to be decomposed is large (such as 256 bits), and the target bit width is small (such as 2 bits, 1 bit). In extreme cases, hundreds of traversal judgments need to be performed, and the execution efficiency is low; transition instructions are used for decomposition, and in order to cache the hundreds of small bit width polynomials generated after the decomposition of the original large bit width polynomial, the cache required is extremely large; and so on.

[0042] Under the technical concept of this specification, the starting bit of the bits to be decomposed, the total bit width of the bits to be decomposed, and the target bit width are first determined. According to the target bit width, the mask word that takes the relevant bits as the target value can be determined. For example, if the target bit width is 8, the mask word may include 8 bits with a value of 1 (expressed as FF in hexadecimal, i.e. 11111111 in binary), and according to the total bit width, the high bit of the mask word can be padded with 0. According to the starting bit, the rightmost bit of a group of bits to be decomposed can be moved to the lowest bit (such as the 0th bit) of a storage unit (such as a register). Initially, the number of moved bits (such as recorded as the first data) can be the difference between the starting bit and the lowest bit of the storage unit. The value after the move is used as the intermediate data, and the "bitwise AND" logic operation is performed with the mask word, and the bit value of the target bit width starting from the lowest bit of the bits to be decomposed can be taken out as the decimal after decomposition, such as recorded as the target value. In this way, the value to be decomposed continues to be shifted, and the number of shifted bits (first data) in the subsequent cycle is the target bit width. Then the corresponding bits are taken based on the "bitwise AND" logic operation through the mask word, so that the bits consistent with the target number of bits can be decomposed from the bits to be decomposed in each cycle as the target value, until all the bits in the bits to be decomposed are decomposed.

[0043] The method of decomposing data by bit width under the technical conception of this specification only requires one decomposition instruction through bitwise AND logic operation of mask words and intermediate results of shifting, and can be extended to synchronous decomposition of multiple groups of bits to be decomposed through mask words. It is less restricted by the bit width of the bits to be decomposed, and can make full use of storage circuits of various specifications in hardware, thereby effectively utilizing hardware resources and improving resource utilization and business processing efficiency.

[0044] The technical concept of this specification is described in detail below with reference to the accompanying drawings.

[0045] Figure 3 The process of decomposing data by bit width according to an embodiment of the present specification is shown. The execution subject of the process can be any computer, device, or server with certain computing capabilities.

[0046] It is understandable that in actual business, the value to be decomposed (refer to Figure 4 As shown in the figure, it can be a single business data or a continuous number of business data connected together and displayed in the current storage unit. For example, in a homomorphic encrypted polynomial transformation (such as the NTT transformation of a vector), one instruction can process multiple polynomials at the same time. A single polynomial can be a multi-point polynomial. The data corresponding to the multiple points of the polynomial (such as the multiple terms of the polynomial) (such as the coefficients of each term) are connected together, and the bits to be decomposed can be the continuous multiple bits that need to be decomposed at present (such as the second point of the polynomial, etc.). A single value to be decomposed can include multiple groups of bits to be decomposed. A group of bits to be decomposed can be as follows: Figure 4 As shown, from Figure 4 The start bit (16th bit) to the end bit (79th bit) are shown.

[0047] Under the technical concept of decomposing data by bit width provided in the embodiments of this specification, for a single value to be decomposed, after obtaining the positions of each group of bits to be decomposed (such as described by the start bit S and the end bit E) and the target bit width (such as represented by d), multiple cycles can be iterated to perform bit width decomposition. In a single cycle, the lowest bit of the bit to be decomposed can be compared with the predetermined position (such as Figure 4 The 0th bit in the value can be recorded as the lowest bit q), and then, the bit consistent with the target bit width is taken as the target value through the mask word. Among them, the bit to be decomposed can be multiple bits in the value to be decomposed.

[0048] Figure 4 In the specific example, the lowest bit of the value to be decomposed is the 0th bit, the value to be decomposed includes a group of bits to be decomposed, the starting bit S of the group of bits to be decomposed is the 16th bit, the ending bit E of the bits to be decomposed is the 79th bit, and the number of bits to be decomposed is its bit width. The target bit width can be preset according to business requirements, for example, 2, 8, etc.

[0049] like Figure 3 As shown, in a single decomposition cycle, the process of decomposing data by bit width can determine the corresponding target values ​​for each group of bits to be decomposed in sequence from the lowest starting bit to the highest ending bit, including the following steps: Step 301, right-shift the current decomposition value corresponding to the value to be decomposed by a first number of bits, so that the current lowest bit to be decomposed in the value to be decomposed is aligned with the lowest bit of the storage unit, thereby obtaining a first intermediate result, and the current lowest bit to be decomposed is the lowest bit of the remaining bits to be decomposed of the rightmost group of bits to be decomposed; Step 302, by performing a bitwise AND operation on the mask word and the first intermediate result, respective target values ​​corresponding to the respective groups of bits to be decomposed are obtained, the mask word has the same bit width as the value to be decomposed, and includes each target bit group, a single target bit group corresponds to a single group of bits to be decomposed, and the value on the low-order bit consistent with the target bit width is 1, and the value on the other bits is 0.

[0050] First, in step 301, the current decomposed value corresponding to the value to be decomposed is right-shifted by a first number of bits to obtain a first intermediate result.

[0051] The current decomposition value corresponding to the value to be decomposed is the initial processing object of the current decomposition cycle. Generally, when the current decomposition cycle is the first decomposition cycle for the value to be decomposed, the current decomposition value may be the initial value to be decomposed; when the current decomposition cycle is not the first decomposition cycle for the value to be decomposed, the current decomposition value may be the intermediate result of the previous decomposition cycle.

[0052] Among them, considering the distribution and usage characteristics of hardware resources, in order to avoid insufficient storage unit length, the value to be decomposed can be right-shifted so that the lowest bit of the bit to be decomposed is aligned with the lowest bit of the storage unit (such as a register). Figure 4 The 16th bit in is aligned to the 0th bit. Therefore, the current decomposed value can be right-shifted, and the number of bits shifted right is recorded as the first quantity, which can also be called the offset bit number. In the first decomposition cycle for the current value to be decomposed, the first quantity can be determined according to the relative position of the starting bit S of the rightmost group of bits to be decomposed and the lowest bit q of the storage unit, such as Sq. Assuming that the lowest bit is the 0th bit, q=0, the first quantity is S. Since the bit width decomposed for the value to be decomposed in a single decomposition cycle is the target bit width d, in other decomposition cycles for the value to be decomposed, the first quantity can be consistent with the target bit width d.

[0053] In one embodiment, in each decomposition cycle, an identifier describing the decomposition progress, such as an offset identifier diff, can be used to determine the value of the offset identifier according to known information, and the number of bits to be moved, i.e., the first quantity, can be determined according to the value of the offset identifier. For example, at the initial time, the value of the offset identifier is the initial value 0. In a single decomposition cycle, it can be first detected whether the offset identifier value is greater than 0. If the offset identifier is not greater than 0, it is determined that the current decomposition cycle is the first decomposition cycle for the above-mentioned value to be decomposed, and it is updated to the difference between the first bit width and the target bit width. Here, the first bit width is the number of bits of a single group of bits to be decomposed. At this time, the first quantity can be the difference between the starting bit S and the lowest bit q. If the offset identifier is greater than 0, it is determined that the current decomposition cycle is not the first decomposition cycle for the above-mentioned value to be decomposed, and the offset identifier can be updated to the difference between its current value and the target bit width d. At this time, the first quantity is the target bit width d. Until the offset identifier is less than or equal to 0, the decomposition of the above-mentioned value to be decomposed ends. It is worth noting that when the first bit width cannot be divided by the target bit width d, the offset identifier is less than 0 when the decomposition of the above-mentioned value to be decomposed ends. Optionally, the offset identifier may be inherited between consecutive values ​​to be decomposed, so that in the first decomposition cycle for the above value to be decomposed, the offset identifier may be equal to 0 or may be less than 0.

[0054] refer to Figure 4 As shown, in the first bit width decomposition cycle, after the value to be decomposed is right-shifted by 16 (first number) bits, the lowest bit (16th bit) of the bits to be decomposed in the value to be decomposed corresponds to the lowest bit of the storage unit (such as a register). In the right shift process, a circular shift can be used to arrange the bit values ​​shifted out from the right side to the left side in sequence, or a right-side discard shift can be used to discard the bit values ​​shifted out from the right side, which is not limited in this application.

[0055] In one embodiment, during the shifting process, the bit values ​​of the to-be-decomposed value higher than the to-be-decomposed bits (such as Figure 4 This is to avoid the situation in which, in the last decomposition process, when the remaining number of bits to be decomposed is less than the target bit, the higher bit value is mistakenly decomposed into the current bit to be decomposed.

[0056] In this specification, the data after the current shift operation is performed is recorded as the first intermediate result. In an optional embodiment, the first intermediate result can have the same format as the data value to be decomposed, and can be stored in the same storage area.

[0057] It is worth noting that, when the current value to be decomposed contains a group of bits to be decomposed, the lowest bit of the above bits to be decomposed is the lowest bit of the group of bits to be decomposed; when the current value to be decomposed contains multiple groups of bits to be decomposed, the lowest bit of the above bits to be decomposed is the lowest bit of the rightmost group of bits to be decomposed.

[0058] Next, in step 302, a bitwise AND operation is performed on the mask word and the first intermediate result to obtain target values ​​corresponding to the groups of bits to be decomposed.

[0059] It can be understood that the role of the mask word is to extract a number of bit values ​​consistent with the target bit width from the first intermediate result after the shift to obtain the target value. In this way, the mask word can be generated according to the target bit width. The length of the mask word can be consistent with the bit width of the original data (such as the value to be decomposed) stored in the storage unit, so that in subsequent operations, all bits of the single data are acted on. For example, Figure 4 The mask word can be divided into target bit groups, and a single target bit group corresponds to a single group of bits to be decomposed. Optionally, the bit width of a single target bit group can be consistent with the initial bit width of the corresponding bits to be decomposed. The interval between the target bit groups is consistent with the interval between the corresponding groups of bits to be decomposed. If the lowest bits of the two groups of bits to be decomposed differ by 32 bits, the lowest bits of the two target bit groups can also differ by 32 bits. In addition, the lowest bit of the rightmost target bit group is consistent with the lowest bit of the storage unit. A single target bit group of the mask word includes low-order target bits, the target bit width is consistent with the target bit width, and the value is 1, and the value on the non-target bit is 0. If the width of the original data storage unit is 128, the mask word width can be 128, and the target data stored in the cache unit has a bit width of 32. Then the mask word can contain 4 target bit groups, and the hexadecimal representation of a single target bit group can be 0000 00FF. If the mask word also includes bits outside the target bit group, the values ​​on these bits can all be set to 0.

[0060] In this way, when the mask word and the first intermediate result are bitwise ANDed, since the corresponding bit values ​​of the bits with a value of 0 in the mask word and the bitwise ANDed result of the first intermediate result are both 0, the target bit is consistent with the low-order bit value of the first intermediate result, that is, the target value under the target bit width is decomposed and obtained.

[0061] In this way, after multiple decomposition cycles of iterative decomposition, each group of bits to be decomposed can be completely decomposed into several target values ​​under the target bit width. Under this technical concept, multiple groups of bits to be decomposed can be decomposed at the same time, and multiple target values ​​can be obtained in one decomposition cycle. The target values ​​obtained in the same decomposition cycle can be recorded as a group of target values. In this way, the utilization efficiency of hardware resources can be improved, and the speed of bit width decomposition can be accelerated.

[0062] In order to make the technical concept of this specification more clear, Figure 5 , Figure 6 Two embodiments are shown to further describe the bit width decomposition process.

[0063] like Figure 5 As shown in FIG. , it is a schematic diagram of the bit width decomposition of a single group of bits to be decomposed in the value to be decomposed. Figure 5 As shown, first determine the starting bit S=8, the ending bit E=39, the total bit width L1 (hexadecimal in the example, a single bit corresponds to a bit width of 4 bits) of the bits to be decomposed (such as cdeffedc ba98 7654) in the current single group of values ​​to be decomposed (such as 89ab cdef fedc ba98 7654 3210)=E-S+1=32, the lowest bit q=0, and the target bit width d=8.

[0064] Each decomposition cycle needs to align the remaining bits to be decomposed in the bits to be decomposed with the lowest bit, that is, to align the current decomposition value corresponding to the value to be decomposed with the lowest bit, and a shift operation to the right is required. The number of bits shifted to the right in a single decomposition cycle is recorded as the first quantity shift. In the initial cycle, the first quantity shift is the difference between the starting bit S and the lowest bit q of the bits to be decomposed. In subsequent decomposition cycles, the first quantity shift is consistent with the target bit width.

[0065] In one embodiment, the offset identifier diff can be changed with the remaining bit width in the bits to be decomposed, such as setting its initial value to 0, and the subsequent cycles are consistent with the remaining bit width. The offset identifier diff can have an initial value of 0 for each bit to be decomposed, or it can be inherited and continued in consecutive bits to be decomposed. When the total bit width of the bits to be decomposed cannot be divided by the target bit width, the offset identifier diff is less than 0 when a group of bits to be decomposed is decomposed. In this way, it can be determined whether it is the first decomposition cycle for the current bits to be decomposed by judging whether the offset identifier diff is greater than 0. When the offset identifier diff is less than or equal to 0, it is the first decomposition cycle for the current bits to be decomposed, and the first number shift=Sq, and in subsequent cycles, the first number shift=d. In one example, the offset identifier diff can be updated to L1-d in the first decomposition cycle, and the offset identifier diff can be updated to diff-d in each subsequent decomposition cycle.

[0066] Figure 5In the example, E=79, S=16, q=0, the total bit width L1=E-S+1=64, d is 8, the first decomposition cycle, the offset flag diff=0, then diff is updated to L1-d=56, the first number shift=Sq=16, right shift 16 bits, and the intermediate result 0000 89ab cdef fedc ba98 7654 is obtained. The mask word is generated according to the target bit width d, the lowest d bits are 1, the bit is 0, and the length is consistent with the length of a single value stored in the storage unit, such as 96 bits, 0000 0000000000000 0000 00FF. The target bit group bit width contained therein can be consistent with the initial bit width 32 of the corresponding bit to be decomposed, for example, "0000 00FF", and the values ​​on the other 64 bits are all 0. In the first decomposition cycle, the intermediate result 000089abcdef fedc ba98 7654 is logically ANDed with the mask word to obtain a target value 0000 00000000 00000000 0054. The target value 0000 0000 0000 0000 0000 0054 is written into the cache. Since the offset identifier diff>0, the shift continues, and the number of right shift bits in the subsequent cycle is consistent with the target bit width d, which is 8, and the intermediate result 00 000089ab cdeffedc ba98 76 is obtained, and the offset identifier diff is updated to diff-d=48. The intermediate result 00 000089ab cdef fedcba98 76 is logically ANDed with the mask word 0000 0000 0000 0000 0000 00FF to obtain a target value 0000 0000 0000 0000 0000 0076. The shift and mask word logical AND operations are iteratively performed in each decomposition cycle until the offset flag diff is less than or equal to 0. Figure 5 In the example, the intermediate result after the 8th decomposition period shift is: 000000000 0000 0000 0000 00cd. At this point, the offset flag diff is equal to 0, the decomposition bit width process is completed, and 8 target values ​​with an effective bit width of 8 are obtained.

[0067] In practice, you may also encounter multiple continuous values ​​to be decomposed, or multiple uniformly distributed groups of bits to be decomposed. For example, in the calculation process corresponding to the homomorphic encryption polynomial, the number of polynomial points (number of terms) is multiple. Combined with hardware resources, multiple points can be bit-decomposed at the same time. For example, if the length of a single processing unit of hardware resources is 128 bits, and the cache length of a single point of the polynomial is 32 bits, then the data of up to 4 points in the polynomial can be bit-decomposed at the same time. The data of a single point corresponds to a single group of bits to be decomposed. The data displayed by a single processing unit of hardware resources can be recorded as a value to be decomposed, that is, a value containing bits to be decomposed.

[0068] Figure 6 An example is shown in which the value to be decomposed contains two groups of bits to be decomposed at the same time. Figure 6 As shown, first determine the two groups of bits to be decomposed contained in the current value to be decomposed "89ab cdef fedc ba98 7654 3210", such as "cdeffedc" and "7654 3210", each with 32 bits. The total bit widths L1 and L2 of the two groups of bits to be decomposed are both 32, the length of the cached single value is 32, the start bit S of the rightmost group of bits to be decomposed = the lowest bit q = 0, the stop bit E of the rightmost group is 31, and the target bit width d = 8.

[0069] When multiple groups of bits to be decomposed are simultaneously decomposed in bit width, each decomposition cycle needs to align the lowest bit of the rightmost group of bits to be decomposed (initially its starting bit) with the lowest bit of the hardware resource as an intermediate result. The number of bits shifted to the right in a single decomposition cycle is recorded as the first quantity shift. Similar to a single group of bits to be decomposed, the value of shift is different in the first decomposition cycle and subsequent decomposition cycles. For the first decomposition cycle of each current group of bits to be decomposed, the first quantity shift = Sq, and in subsequent cycles, the first quantity shift = d. Figure 6 In the example shown, in the first decomposition cycle, the first number shift = 0-0 = 0. In one example, the decomposition progress can be controlled by using the offset identifier, and in the first decomposition cycle, the offset identifier diff is updated to E-S+1-d = L1-d = 24, and in each subsequent decomposition cycle, the offset identifier diff is updated to diff-d.

[0070] Thus, in the first decomposition cycle, the first number shift = d, right shifted by 0 bits, and the offset flag diff is updated to the total bit width L1-d. The intermediate result is consistent with the value to be decomposed. The mask word is generated according to the target bit width d, including multiple target bit groups, a single target bit group has 1 on the lowest d bits, and the remaining bits are 0. The bit width of a single target bit group can be consistent with the initial bit width of the corresponding bit to be decomposed, such as 32 bits, 000000FF, then Figure 6The mask word in contains two target bit groups, which are 0000 00FF and 0000 00FF respectively. The bit values ​​outside the target bit groups in the mask word are 0. In the first decomposition cycle, the intermediate result 89ab cdef fedc ba98 7654 3210 is logically ANDed with the mask word to obtain a set of target values ​​000000dc (target value 2) and 00000010 (target value 1). The target values ​​are written into the cache. Continue shifting, and the number of right shifted bits in subsequent cycles is consistent with the target bit width d, which is 8, and the intermediate result 00 89ab cdef fedc ba987654 32 is obtained, and the offset identifier diff is updated to diff-d=16. The intermediate result 00 89ab cdef fedc ba98 765432 is ANDed with the mask word 000000FF 000000FF to obtain a set of target values ​​000000fe (target value 4) and 00000032 (target value 3). In this way, the shift and mask word logical AND operations are iteratively performed in each decomposition cycle until the offset flag diff is less than or equal to 0. Figure 6 In the example, the intermediate result after the shift of the fourth decomposition cycle is: 00 000089ab cdef fedc ba98 76. Performing a logical AND operation with the mask word 0000 00FF 0000 00FF, a set of target values ​​0000 00cd (target value 8) and 0000 0076 (target value 7) are obtained. At this point, the offset flag diff is equal to 0, the decomposition bit width process is completed, and 4 sets of target values ​​with a bit width of 8 are obtained. The two target values ​​of a single set correspond to each bit to be decomposed.

[0071] Figure 5 , Figure 6 These are just two specific examples. In practice, there may be more bit width decomposition scenarios. For example, on a 128-bit hardware computing unit, 3 or 4 groups of 32-bit bits to be decomposed can be bit-decomposed simultaneously, which will not be described in detail here.

[0072] In order to realize the above technical concept, the embodiment of this specification also provides a device for decomposing data by bit width. The device for decomposing data by bit width can be set in any computer, device, or server with a certain computing power, and is used to decompose each group of bits to be decomposed in the value to be decomposed into a weighted form of several target values ​​under the target bit width. Figure 7 As shown, the device 700 for decomposing data by bit width provided in the embodiment of this specification may include: a shift unit 701 and a determination unit 702 .

[0073] In the process of bit width decomposition, after several iterative decomposition cycles, the corresponding target values ​​are determined for each bit to be decomposed from the lowest starting bit to the highest ending bit; in a single decomposition cycle:

[0074] The shift unit 701 is configured to right-shift the current decomposition value corresponding to the above-mentioned value to be decomposed by a first number of bits, so that the lowest bit to be decomposed currently in the above-mentioned value to be decomposed is aligned with the lowest bit of the storage unit, and obtain a first intermediate result, wherein the lowest bit to be decomposed currently is the lowest bit of the remaining bits to be decomposed of the rightmost group of bits to be decomposed;

[0075] The determination unit 702 is configured to obtain target values ​​corresponding to each group of bits to be decomposed, respectively, by performing a bitwise AND operation on the mask word and the above-mentioned first intermediate result. The above-mentioned mask word is consistent with the bit width of the above-mentioned value to be decomposed, and includes each target bit group. A single target bit group corresponds to a single group of bits to be decomposed, and the value on the low-order bit consistent with the target bit width is 1, and the value on other bits is 0.

[0076] In one embodiment, the bit width of a single group of bits to be decomposed is the first bit width, and the shift unit 701 may further include a shift rhythm control subunit configured to describe the decomposition progress of the above-mentioned value to be decomposed through an offset identifier;

[0077] Each decomposition period corresponds to; in a single decomposition period, the shift unit 701 can also be configured as:

[0078] Check whether the above offset flag is greater than 0;

[0079] If it is not greater than 0, the current decomposition cycle is determined to be the first decomposition cycle for the above-mentioned value to be decomposed, and the above-mentioned offset identifier is updated to the difference between the first bit width and the target bit width through the above-mentioned shift rhythm control subunit;

[0080] When it is greater than 0, it is determined that the current decomposition cycle is not the first decomposition cycle for the above-mentioned value to be decomposed, and the above-mentioned offset identifier is updated to the difference between its current value and the target bit width through the above-mentioned shift rhythm control subunit.

[0081] In one embodiment, the shift unit 701 may further include a shift position control subunit configured as follows:

[0082] In the case where the current decomposition cycle is the first decomposition cycle for the value to be decomposed, determining the current decomposition value to be the value to be decomposed, and the first number is the difference between the start bit of the rightmost group of bits to be decomposed and the lowest bit of the storage unit;

[0083] In the case that the current decomposition cycle is not the first decomposition cycle for the value to be decomposed, the current decomposition value is determined to be an intermediate result of the previous decomposition cycle, and the first number is consistent with the target bit width.

[0084] It is worth mentioning that Figure 7 The device 700 shown is Figure 3 The method flow described corresponds to Figure 3 The corresponding description in the illustrated method embodiment is also applicable to the device 700 and will not be repeated here.

[0085] Figure 8 FIG. 8 shows a more specific example of a device for decomposing data by bit width in an embodiment of this specification, namely, a device 800. Figure 8 As shown, the apparatus 800 includes at least a shift unit 801 and a determination unit 802, and may also include an intermediate result buffer unit and a mask word generation unit. The apparatus 800 or the device in which it is located may also include a to-be-decomposed value buffer unit and a target value buffer unit.

[0086] Further, the shift unit 801 may include a shift rhythm control subunit, a shift position control subunit, a subunit for obtaining a value to be decomposed, a shift operation subunit, etc. The subunit for obtaining a value to be decomposed is used to obtain the current decomposition value of the number to be decomposed. The shift rhythm control subunit is used to determine whether it is the first decomposition cycle by detecting the current value of the shift identifier, and can update the value of the shift identifier. The shift position control subunit can determine the number of shifted bits, such as the first number mentioned above, based on the detection result of the shift rhythm control subunit on the current value of the shift identifier. The shift operation subunit can perform a shift operation on the current decomposition value obtained by the subunit for obtaining the value to be decomposed according to the number of shifted bits determined by the shift position control subunit. The intermediate result obtained by the shift operation can be cached by the intermediate result cache unit.

[0087] On the other hand, the determination unit 802 may include an AND logic operation subunit for performing an AND logic operation on the intermediate result obtained by the shift operation subunit and the mask word. The mask word may be determined by the mask word generation unit according to the storage unit (such as the to-be-decomposed value buffer unit, the target value buffer unit, etc.), and is applicable to the current to-be-decomposed bit.

[0088] Reviewing the above process, the technical concept of decomposing data by bit width provided in the embodiments of this specification decomposes the bit width decomposition instruction into decomposition instructions of multiple decomposition cycles through shift operations. The number of decomposition cycles is determined by the bit width of the bits to be decomposed and the target bit width. The lowest bit of the remaining bits to be decomposed is aligned with the lowest bit of the storage unit, and the target value is obtained by combining the bitwise AND operation with the mask word. On the one hand, this technical solution can directly obtain the target result without the need for intermediate transition instructions, that is, without the need for intermediate cache. On the other hand, according to the actual business, the bit width decomposition can be performed on a single group of bits to be decomposed at a time, or the bit width decomposition can be performed on multiple groups of bits to be decomposed at the same time, which is conducive to making full use of hardware storage resources, avoiding resource waste, and improving processing efficiency.

[0089] In addition, the computing architecture mentioned in the technical solution provided in this specification can be run on processors including but not limited to the following types: field programmable gate array (FPGA), CPU, GPU or application specific integrated circuit (ASIC). The computing architecture mentioned in the technical solution provided in this specification can exist as an independent computing unit, and a computing array is formed by combining several decomposed computing units, such as Fig. 9 As shown, a single decomposition calculation unit is used to execute the process of decomposing data by bit width in the embodiment of this specification, thereby realizing parallel processing of all points in the same polynomial, further improving processing performance.

[0090] According to another embodiment, there is also provided a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute a combination of Figure 3 The method described by et al.

[0091] According to another embodiment of the present invention, a computing device is provided, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the Figure 3 The method described by et al.

[0092] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the embodiments of this specification can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0093] The specific implementation methods described above further explain in detail the purpose, technical solutions and beneficial effects of the technical concept of this specification. It should be understood that the above description is only the specific implementation method of the technical concept of this specification, and is not used to limit the protection scope of the technical concept of this specification. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the embodiments of this specification should be included in the protection scope of the technical concept of this specification.

Claims

1. A method for decomposing data by bit width, for decomposing each group of bits to be decomposed in a value to be decomposed into a weighted form of a plurality of target values ​​under a target bit width, and in the process of bit width decomposition, after a plurality of iterative decomposition cycles, determining the corresponding target values ​​for each group of bits to be decomposed in sequence from the lowest starting bit to the highest ending bit; In a single decomposition cycle, the method comprises: Shifting the current decomposition value corresponding to the to-be-decomposed value right by a first number of bits, so that the lowest bit to be decomposed currently in the to-be-decomposed value is aligned with the lowest bit of the storage unit, thereby obtaining a first intermediate result, wherein the lowest bit to be decomposed currently is the lowest bit of the remaining to-be-decomposed bits of the rightmost group of to-be-decomposed bits; By performing a bitwise AND operation on the mask word and the first intermediate result, target values ​​corresponding to each group of bits to be decomposed are obtained. The mask word has the same bit width as the value to be decomposed and includes each target bit group. A single target bit group corresponds to a single group of bits to be decomposed, and the value of the low-order bit consistent with the target bit width is 1, and the value of other bits is 0.

2. The method of claim 1, wherein: In the case where the current decomposition cycle is the first decomposition cycle for the value to be decomposed, the current decomposition value is the value to be decomposed, and the first number is determined by the difference between the starting bit of the rightmost group of bits to be decomposed and the lowest bit of the storage unit; In the case where the current decomposition cycle is not the first decomposition cycle for the value to be decomposed, the current decomposition value is an intermediate result of the previous decomposition cycle, and the first number is consistent with the target bit width.

3. The method of claim 1, wherein: The bit width of a single group of bits to be decomposed is the first bit width, and each decomposition period corresponds to an offset identifier; During the single decomposition cycle, the method further comprises: Check whether the offset flag is greater than 0; If it is not greater than 0, determine that the current decomposition cycle is the first decomposition cycle for the value to be decomposed, and update the offset identifier to the difference between the first bit width and the target bit width; When it is greater than 0, it is determined that the current decomposition cycle is not the first decomposition cycle for the value to be decomposed, and the offset flag is updated to the difference between its current value and the target bit width.

4. The method of claim 1, wherein: The step of right-shifting the current decomposed value corresponding to the to-be-decomposed value by a first number of bits comprises: Keep the data before the highest bit of the leftmost group of bits to be decomposed in the value to be decomposed unchanged, and perform a right shift operation on the other bits; Alternatively, cyclically shifting the current decomposed value; Alternatively, the lowest first number of bits of the current decomposition value are removed, and the highest first number of bits are filled with 0.

5. A device for decomposing data by bit width, for decomposing each group of bits to be decomposed in a value to be decomposed into a weighted form of a plurality of target values ​​under a target bit width, the device comprising: Shift unit, determination unit; In the process of bit width decomposition, after several iterative decomposition cycles, the corresponding target values ​​are determined for each bit to be decomposed from the lowest starting bit to the highest ending bit; in a single decomposition cycle: The shift unit is configured to right-shift the current decomposition value corresponding to the to-be-decomposed value by a first number of bits, so that the lowest bit to be decomposed currently in the to-be-decomposed value is aligned with the lowest bit of the storage unit, and obtain a first intermediate result, wherein the lowest bit to be decomposed currently is the lowest bit of the remaining to-be-decomposed bits of the rightmost group of to-be-decomposed bits; The determination unit is configured to obtain target values ​​corresponding to each group of bits to be decomposed by performing a bitwise AND operation on the mask word and the first intermediate result, wherein the mask word has a bit width consistent with the value to be decomposed and includes target bit groups, a single target bit group corresponds to a single group of bits to be decomposed, and the value of the low-order bit consistent with the target bit width is 1, and the value of other bits is 0.

6. The device according to claim 5, wherein: The bit width of a single group of bits to be decomposed is a first bit width, and the shift unit further includes a shift rhythm control subunit configured to describe the decomposition progress of the value to be decomposed through an offset identifier; Each decomposition period corresponds to; in the single decomposition period, the shift unit is also configured as: Check whether the offset flag is greater than 0; When the value is not greater than 0, the current decomposition cycle is determined to be the first decomposition cycle for the value to be decomposed, and the shift rhythm control subunit updates the offset flag to the difference between the first bit width and the target bit width; When it is greater than 0, it is determined that the current decomposition cycle is not the first decomposition cycle for the value to be decomposed, and the shift rhythm control subunit updates the offset flag to the difference between its current value and the target bit width.

7. The device according to claim 5 or 6, wherein: The shift unit further includes a shift position control subunit configured as follows: In the case where the current decomposition cycle is the first decomposition cycle for the value to be decomposed, determining that the current decomposition value is the value to be decomposed, and the first number is the difference between the start bit of the rightmost group of bits to be decomposed and the lowest bit of the storage unit; In the case that the current decomposition cycle is not the first decomposition cycle for the value to be decomposed, the current decomposition value is determined to be an intermediate result of the previous decomposition cycle, and the first number is consistent with the target bit width.

8. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method according to any one of claims 1 to 4.

9. A computing device comprising a memory and a processor, characterized in that: The memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 4 is implemented.

Images