Method for executing target transformation, acceleration hardware and polynomial multiplier

Abstract

The embodiment of the invention provides a method for executing target transformation through acceleration hardware. The target transformation comprises transformation operations of N stages, the acceleration hardware comprises N circuit parts corresponding to the N stages, and the i-th circuit part corresponding to any i-th order of non-head and tail stages comprises a controller, a processing engine, a memory, a first rearrangement unit and a second rearrangement unit. The conversion operation of the ith order comprises the following steps: the controller respectively reads out a first data pair and a second data pair from a first read-out address and a second read-out address in the memory of the (i-1) th order; the first rearrangement unit performs first rearrangement operation on the first data pair and the second data pair and outputs a third data pair and a fourth data pair; the processing engine executes 2-based butterfly operation on the third data pair and the fourth data pair respectively and outputs a first result pair and a second result pair; a second rearrangement unit performs second rearrangement operation on the first result pair and the second result pair to obtain a fifth data pair and a sixth data pair; the controller writes the fifth and sixth data pairs to the first and second write addresses in the memory of the i-th stage, respectively.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to optimizing hardware for accelerating target transformation, and more particularly, to accelerating the execution of target transformation and polynomial multiplication by utilizing paired storage and rearrangement of data. Background Art

[0002] Fast Fourier Transform (FFT) and Fast Number-Theoretic Transform (NTT) are the most critical steps to accelerate polynomial multiplication, and they have a wide range of applications in the fields of communication and encryption. For example, FFT realizes the conversion between time domain and frequency domain in digital signal processing, and NTT and negative wrapping convolution (NWC) using NTT accelerate polynomial multiplication under finite fields in the design of fully homomorphic hardware acceleration chips.

[0003] Especially with the continuous advancement of quantum computers, efficient quantum algorithms can crack the mathematical problems that mainstream public key cryptographic systems such as RSA and ECC rely on, thus exposing these cryptographic systems to security threats. Therefore, the development of a more secure post-quantum cryptographic system has become a new research focus. The goal of post-quantum cryptography (PQC) is to ensure security when the attacker has a large quantum computer. Currently, most existing post-quantum cryptographic schemes are mainly based on lattice theory, and polynomial multiplication often becomes the main computational bottleneck in these schemes. In order to speed up the calculation of polynomial multiplication, NTT is widely used, which can reduce the time complexity from O(n) to O(n). 2 ) is reduced to O(nlog2(n)).

[0004] In the above-mentioned various computing scenarios, the efficiency of polynomial multiplication or the FFT or NTT operations contained therein is an important factor affecting the computing performance.

[0005] Therefore, it is expected that there will be an improved solution to increase the speed of polynomial multiplication or the FFT or NTT operations contained therein, thereby improving the computing performance of related application scenarios. Summary of the invention

[0006] One or more embodiments of the present specification describe a solution for executing target transformation by accelerating hardware, which accelerates the execution of target transformation by storing and rearranging data in pairs, thereby improving the operating performance of target transformation and corresponding polynomial multiplication.

[0007] According to a first aspect, a method for performing target transformation by accelerating hardware is provided, wherein the target transformation includes transformation operations of N stages, and the accelerating hardware includes N circuit parts corresponding to the N stages, wherein the i-th circuit part corresponding to any i-th stage that is not the first or last stage includes a controller, a processing engine, a memory, and first and second rearrangement units, and the transformation operation of the i-th stage includes:

[0008] The controller reads out a first data pair and a second data pair from a first read address and a second read address in the memory of the i-1th stage, respectively;

[0009] The first rearrangement unit performs a first rearrangement operation on the first and second data pairs, and sequentially outputs a third data pair and a fourth data pair;

[0010] The processing engine sequentially performs a radix-2 butterfly operation on the third data pair and the fourth data pair, and sequentially outputs a first result pair and a second result pair;

[0011] The second rearrangement unit performs a second rearrangement operation on the first and second result pairs to obtain a fifth data pair and a sixth data pair;

[0012] The controller writes the fifth data pair and the sixth data pair into a first write address and a second write address in the memory of the i-th stage respectively.

[0013] In one embodiment, the target transformation is performed on an n-point input sequence, where n is a power of 2, and the memory of the i-th stage stores n results obtained after the transformation operation of the n-point input sequence in pairs through consecutive n / 2 addresses, and the values ​​of the first and second read addresses are respectively the same as the values ​​of the first and second write addresses.

[0014] In one embodiment, the second read address and write address are the first read address and write address respectively plus 2 to the power of i-1.

[0015] In one embodiment, the second read address and write address are respectively the first read address and write address plus 2 raised to the Ni-2 power.

[0016] In one embodiment, in the transformation operation of the i-th stage, the n / 2 addresses are sequentially divided into Ni-1 power groups of 2; the transformation operation of the i-th stage further includes:

[0017] The controller reads data from the third read address and the fourth read address in the memory of the i-1th stage in two consecutive clock cycles after reading the second data pair;

[0018] If the second read address is the last address in the group, the third read address is the second read address plus 1; otherwise, the third read address is the first read address plus 1;

[0019] The fourth read address is the third read address plus 2 raised to the power of i-1.

[0020] In one embodiment, in the transformation operation of the i-th stage, the n / 2 addresses are sequentially divided into i-th power groups of 2; the transformation operation of the i-th stage further includes:

[0021] The controller reads data from the third read address and the fourth read address in the memory of the i-1th stage in two consecutive clock cycles after reading the second data pair;

[0022] If the second read address is the last address in the group, the third read address is the second read address plus 1; otherwise, the third read address is the first read address plus 1;

[0023] The fourth read address is the third read address plus 2 raised to the power of Ni-2.

[0024] In one embodiment, the controller reads out the first data pair and the second data pair from the first read address and the second read address in the memory of the i-1th stage, respectively, including:

[0025] In response to the completion of writing the data pairs in all addresses of the first group in the i-1th stage, in a first clock cycle, the controller reads the first data pair from the first read address and inputs it into the first rearrangement unit; in a second clock cycle following the first clock cycle, the controller reads the second data pair from the second read address and inputs it into the first rearrangement unit.

[0026] In one embodiment, the processing engine sequentially performs radix-2 butterfly operations on the third data pair and the fourth data pair, respectively, including:

[0027] In a third clock cycle, the processing engine starts to perform a radix-2 butterfly operation on the third data pair, and outputs the obtained first result pair to the second rearrangement unit after t clock cycles;

[0028] In a fourth clock cycle following the third clock cycle, the processing engine starts to perform a radix-2 butterfly operation on the fourth data pair, and outputs the obtained second result pair to the second rearrangement unit after t clock cycles.

[0029] In one embodiment, the controller writes the fifth data pair and the sixth data pair into a first write address and a second write address in the memory of the i-th stage respectively, including:

[0030] In the t+5th clock cycle, the controller writes the fifth data pair into the first write address;

[0031] In the t+6th clock cycle, the controller writes the sixth data pair into the second write address.

[0032] In one embodiment, the first reordering unit performs a first reordering operation on the first and second data pairs, including:

[0033] In a first clock cycle, the first reordering unit receives a first data pair;

[0034] In the second clock cycle, the first reordering unit receives the second data pair and temporarily stores the first data pair;

[0035] In a third clock cycle following the second clock cycle, the first reordering unit outputs the first data in the first data pair and the first data in the second data pair as a third data pair, and temporarily stores the second data in the second data pair;

[0036] In a fourth clock cycle following the third clock cycle, the first rearrangement unit outputs the second data in the first data pair and the second data in the second data pair as a fourth data pair.

[0037] In one embodiment, the second rearrangement unit performs a second rearrangement operation on the first and second result pairs, comprising:

[0038] In the t+3th clock cycle, the second rearrangement unit receives the first result pair;

[0039] In the t+4th clock cycle, the second rearrangement unit receives the second result pair and temporarily stores the first result pair;

[0040] In the t+5th clock cycle, the second rearrangement unit outputs the first result of the first result pair and the first result of the second result pair as the fifth data pair, and temporarily stores the second result of the second result pair;

[0041] In the t+6th clock cycle, the second rearrangement unit outputs the second result of the first result pair and the second result of the second result pair as the sixth data pair.

[0042] In one embodiment, the 0th circuit part corresponding to the first stage among the N circuit parts includes a 0th stage controller, a 0th stage processing engine and a 0th stage memory, and the transformation operation of the 0th stage includes:

[0043] The 0th order processing engine sequentially performs radix-2 butterfly operations on n / 2 input pairs consisting of every two adjacent data in the n-point input sequence arranged in reverse bit order, and sequentially outputs n / 2 result pairs;

[0044] The 0th-order controller writes the n / 2 result pairs into consecutive n / 2 addresses in the 0th-order memory in sequence.

[0045] In one embodiment, the N-1th circuit portion corresponding to the ending stage of the N circuit portions includes an N-1th stage controller and an N-1th stage processing engine, and the transformation operation of the N-1th stage includes:

[0046] The controller of the N-1th stage reads out n / 2 data pairs sequentially from n / 2 addresses in the memory of the N-2th stage;

[0047] The N-1th order processing engine sequentially performs radix-2 butterfly operations on the n / 2 data pairs respectively, and sequentially outputs n / 2 result pairs.

[0048] In one embodiment, the 0th circuit part corresponding to the first stage or the N-1th circuit part corresponding to the final stage among the N circuit parts has the same hardware structure as the i-th circuit part and performs the same transformation operation.

[0049] In one embodiment, the target transformation is a fast Fourier transform FFT, an inverse fast Fourier transform IFFT, a fast number theoretic transform NTT, an inverse fast number theoretic transform INTT, an NTTP transformation obtained by fusing preprocessing with NTT in a negative wrapping convolution NWC, or an INTTP transformation obtained by fusing INTT with post-processing in NWC; the transformation operations of the N stages are performed in the form of decimation by time DIT or in the form of decimation by frequency DIF.

[0050] According to a second aspect, there is provided acceleration hardware for performing target transformation, wherein the target transformation includes transformation operations of N stages, and the acceleration hardware includes N circuit parts corresponding to the N stages, wherein the i-th circuit part corresponding to any i-th stage that is not the first or last stage includes a controller, a processing engine, a memory, and first and second rearrangement units; in the transformation operation of the i-th stage:

[0051] The controller is configured to read out a first data pair and a second data pair from a first read address and a second read address in the memory of the i-1th stage, respectively;

[0052] The first rearrangement unit is configured to perform a first rearrangement operation on the first and second data pairs, and output a third data pair and a fourth data pair in sequence;

[0053] The processing engine is configured to perform a radix-2 butterfly operation on the third data pair and the fourth data pair in sequence, and output a first result pair and a second result pair in sequence;

[0054] The second rearrangement unit is configured to perform a second rearrangement operation on the first result pair and the second result pair to obtain a fifth data pair and a sixth data pair;

[0055] The controller is further configured to write the fifth data pair and the sixth data pair into a first write address and a second write address in the memory of the i-th stage, respectively.

[0056] In one embodiment, the first rearrangement unit includes a first register, a second register, a first multiplexer, a second multiplexer, and a multiplexer control unit.

[0057] Wherein, one input end of the first multiplexer and one input end of the second multiplexer both receive the first data in the currently read data pair,

[0058] The first register receives and temporarily stores the second data in the data pair currently read out, and an output end of the first register is coupled to another input end of the first multiplexer and another input end of the second multiplexer.

[0059] The output terminal of the first multiplexer is coupled to the input terminal of the second register,

[0060] The second register outputs the first data in the currently rearranged data pair, the second multiplexer outputs the second data in the currently rearranged data pair, and

[0061] The multiplexer control unit is configured to control the first multiplexer and the second multiplexer to alternately select one of the two inputs thereof as an output.

[0062] In one embodiment, the multiplexer control unit includes a third register, a fourth register, and an inverter.

[0063] The output terminal of the third register is coupled to the control terminal of the first multiplexer, the input terminal of the fourth register, and the input terminal of the inverter.

[0064] The output terminal of the fourth register is coupled to the control terminal of the second multiplexer,

[0065] The output terminal of the inverter is coupled to the input terminal of the third register.

[0066] In one embodiment, the first rearrangement unit and the second rearrangement unit have the same hardware structure.

[0067] In one embodiment, the processing engine comprises a modular multiplication unit, which comprises first, second and third integer multipliers, wherein the first integer multiplier is implemented using a digital signal processor DSP, and the second and third integer multipliers are implemented using a lookup table LUT.

[0068] According to a third aspect, a polynomial multiplier is provided, which receives an n-point first input sequence and an n-point second input sequence, and outputs an n-point polynomial multiplication output sequence; the polynomial multiplier comprises a first transformation module, a second transformation module, a point-by-point multiplication hardware module and a third transformation module, wherein the first transformation module, the second transformation module and the third transformation module all comprise the acceleration hardware as described in the second aspect;

[0069] The first transformation module is configured to perform NTTP on the first input sequence in a DI F form to output a first output sequence;

[0070] The second transformation module is configured to perform NTTP on the second input sequence in a DI F form to output a second output sequence;

[0071] The point-by-point multiplication hardware module is configured to perform point-by-point multiplication on the first and second output sequences to output a third output sequence;

[0072] The third transformation module is configured to perform INTTP on the third output sequence in a DI T form, and output the n-point polynomial multiplication output sequence.

[0073] In an embodiment of the present specification, a method for performing target transformation by accelerating hardware and corresponding accelerating hardware are proposed. A controller, a processing engine, a memory, and a first and a second rearrangement unit are set in the i-th circuit part corresponding to any i-th stage of the non-first and last stages in the above-mentioned accelerating hardware, a pair of data is stored at one address in the memory, and the first and the second rearrangement units are used to switch between the storage pair in the memory and the calculation pair of the butterfly operation in the processing engine, thereby eliminating the mismatch between the two. This realizes an efficient data flow, which can unify the speed of the calculation unit and the memory, thereby improving the utilization rate of the calculation unit and improving the performance of the overall transformation. BRIEF DESCRIPTION OF THE DRAWINGS

[0074] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0075] Figure 1A schematic diagram showing the structure of dedicated acceleration hardware for performing DIT-style target transformation according to one embodiment;

[0076] Figure 2 A flowchart showing a pair of butterfly operation processing in the i-th stage of any intermediate stage in a method of performing target transformation by accelerating hardware according to one embodiment;

[0077] Figure 3 A data flow diagram (butterfly diagram) of a 16-point DI T NTT according to an embodiment is shown, wherein the address access order of each stage, the butterfly unit calculation order and the access address of each data are marked;

[0078] Figure 4 A schematic diagram showing the structure of a first reordering unit in acceleration hardware according to an embodiment;

[0079] Figure 5 A schematic diagram showing the structure of a processing engine in acceleration hardware according to an embodiment;

[0080] Figure 6 A schematic structural diagram of a polynomial multiplier according to an embodiment is shown. DETAILED DESCRIPTION

[0081] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0082] NTT will polynomial The coefficient a i Convert to A i , and INTT is its inverse operation. In mainstream post-quantum cryptography schemes, NTT and INTT are usually defined in polynomial rings. And the negative wrapped convolution (NWC) method is used to reduce the extra computation caused by zero padding in polynomial multiplication.

[0083] The operation of NWC is described below in pseudocode, which provides an efficient method for computing polynomial products c(x).

[0084]

[0085] Among them, a(x) and b(x) are The polynomials in the equation have coefficients a n-1 to a0 and b n-1 to b0, where a i ,b i ∈[0,q). The polynomial multiplication of a(x) and b(x) yields a polynomial c(x) with n coefficients.

[0086] As shown in the above pseudo code, when performing polynomial multiplication, NTT and I NTT operations must be performed in step 3, and the preprocessing shown in steps 1 and 2 must be performed before the NTT operation, and the post-processing shown in step 4 must be performed after the INTT operation.

[0087] To speed up the operation, the pre-processing step can be integrated into NTT and the post-processing step can be integrated into INTT.

[0088] For simplicity, the embodiment of this specification introduces NTTP to represent the transformation obtained by fusing pre-processing with NTT in NWC, and introduces INTTP to represent the transformation obtained by fusing INTT with post-processing in NWC, as shown in the following formulas (1) and (2), respectively:

[0089]

[0090] where ω n yes The nth primitive root of unity on satisfies Ψ 2n is a primitive root of unity of power 2n, satisfying

[0091] It can be seen that the algorithm principles of NTTP and NTT are consistent, except that there is an additional preprocessing factor in the multiplication factor. NTT is a finite field FFT variant. Compared with FFT, it has an additional modulus operation, but its algorithm principle is consistent with FFT in discrete form. Similarly, the algorithm principles of INTTP, INTT, I FFT and other inverse transformations are consistent with NTTP. The main difference lies in the factors in the multiplication and the final multiplication by the constant 1 / n. This type of transformation can be implemented with the same data flow graph (butterfly graph). Therefore, this type of transformation can use the same hardware architecture to accelerate the operation.

[0092] Therefore, the discussion of the embodiments of the present disclosure is applicable to all the above-mentioned transformations, as well as other transformations with consistent or similar algorithmic principles. Therefore, in the discussion of the present disclosure, when it comes to general schemes or general operations in schemes, etc., the target transformation can be used as a general synonym. The target transformation is a discrete transformation or its inverse transformation that transforms an input coefficient sequence into an output coefficient sequence, which can be converted into a butterfly operation of N stages.

[0093] At present, some algorithms have been proposed, such as the Decimation-In-Time (DIT) method or the Decimation-In-Frequency (DIF) method, which converts the n-point target transformation into an N-order basis 2 butterfly operation, where n = 2 NA dedicated accelerator for executing target transformation can be implemented by using a spatial parallel architecture or a pipeline architecture. However, the existing accelerator solutions are not well designed for data storage and reading, which makes the efficiency of data storage and reading still insufficient, and the performance of target transformation needs to be further improved.

[0094] In addition, in some cases, in order to adapt to the changes in various security parameters during the standardization of the PQC scheme, the scalability of the accelerator used to perform the target transformation is of great significance. At present, some scalable accelerator architectures have been proposed. However, some of these accelerators have poor versatility. The calculation rules for the read and write addresses of data are different when calculating in each stage. It is necessary to set the data selection logic with the same number of groups as the total number of orders, and it is not convenient to set any order; or, the control unit of some accelerators is relatively complex, occupying a large amount of area outside of the calculation, and the utilization rate of the computing unit in some architectures is low. Therefore, it is challenging to have both good hardware efficiency and scalability.

[0095] In view of this, in an embodiment of this specification, a solution for hardware-accelerated target transformation is proposed. In this solution, the execution of target transformation is accelerated by storing and rearranging data in pairs, thereby improving the performance of target transformation.

[0096] Specifically, since the butterfly operation processes a pair of data each time, its input data and output data are paired (hereinafter also referred to as calculation pairs), and the memory can only perform one read / write operation in one clock cycle, the solution of the embodiment of this specification proposes to store a pair of data (hereinafter also referred to as storage pair) in a storage address in the memory, so that each read and write can process two data at the same time, so that the data flow speed of storage access and calculation is consistent, and the efficiency of transformation operation execution is improved. This is particularly beneficial for pipeline architecture acceleration hardware, because memory access and butterfly operations in the processing engine can be performed in pairs simultaneously on the pipeline, which makes it easy to fully fill the pipeline and allow all stages of the pipeline to run simultaneously.

[0097] In addition, the embodiments of this specification have found that, although in an N-order butterfly operation, there is no direct correspondence between the storage pair of the previous stage and the calculation pair of the current stage in each non-first and last stage (i.e., the middle stage), after rearranging the two storage pairs in the two addresses with a preset relationship, two input calculation pairs of two butterfly operations can be obtained, and then the two output calculation pairs of the two butterfly operations can be rearranged and stored to facilitate reading in the next stage. It can be understood that in this specification, "rearrangement" refers to rearranging two data pairs so that one data is extracted from each of the two data pairs to form a new data pair, and the other data remaining in each of the two data pairs forms another new data pair.

[0098] Therefore, the solution of the embodiment of the present specification introduces two reordering units in each intermediate stage, wherein the first reordering unit is located before the processing engine for butterfly operation, and is used to reorder the two storage pairs read from the previous stage into two calculation pairs, so as to serve as the input data pairs of the two butterfly operations respectively, and the second reordering unit is located after the processing engine, and is used to reorder the two calculation pairs as the output data pairs obtained by the two butterfly operations into two storage pairs, so as to be stored in two addresses in the memory of the current stage respectively, so as to be read by the next stage to continue the subsequent transformation operation. Thus, by rearranging the data pairs read from the memory or to be written into the memory through the first and second reordering units, the mismatch between the data pairs in the memory and the data pairs used for calculation can be eliminated.

[0099] Based on the above-mentioned paired storage access and rearrangement operations, the solution of the embodiments of this specification implements an efficient data flow, which can unify the speed of the computing unit and the memory, thereby improving the utilization rate of the computing unit.

[0100] In addition, as will be described in detail later, in some embodiments, the data flow control is simple, effectively reducing the hardware resources occupied by the control logic.

[0101] In addition, in some embodiments, a grouping paired storage access method is proposed to achieve control of the data flow, which ensures that the control logic in each stage is consistent, and thus has good scalability and can support a variety of polynomial lengths and data bit widths.

[0102] The scheme of the embodiments of this specification will be described in detail below mainly by taking NTTP in the form of DIT as an example. As mentioned above, NTT, INTT, FFT, I FFT, and INTTP can all adopt the same hardware architecture, and the difference mainly lies in the factors in the multiplication and the multiplication with the constant 1 / n. Based on the description of the inventive concept, technical details, etc. of each embodiment in this specification, it is easy for those skilled in the art to understand the corresponding settings or changes for various types of target transformations, so they will not be repeated one by one below.

[0103] Figure 1 A schematic diagram of the structure of dedicated acceleration hardware for executing a target transformation in the form of a DIT according to an embodiment is shown, wherein the target transformation includes transformation operations in N stages.

[0104] like Figure 1 As shown, in order to accelerate the execution of the target transformation in the form of DIT, in an embodiment of the present specification, the dedicated acceleration hardware is designed to include N circuit parts corresponding to N stages, wherein the i-th circuit part corresponding to any i-th stage other than the first and last stages includes: a controller, a processing engine, a memory, and a first and a second rearrangement unit.

[0105] In the following, the i-th stage can also be referred to as the intermediate stage, where 0 < i < N - 1. That is, Figure 1 in the intermediate stage, that is, stages 1 to N - 2 all have the same hardware structure. For simplicity, Figure 1 the display of the hardware structure after stage 2 is omitted in Figure 1 . The hardware structure of the last stage, that is, stage N - 1, is also basically omitted in Figure 1 because in the acceleration hardware for the DIT form, the circuit part of stage N - 1 has the same hardware structure as the circuit part of the intermediate stage and performs the same transformation operation.

[0106] As Figure 1 shown, for the first stage in the acceleration hardware for the DIT form, that is, the circuit part corresponding to stage 0 only includes a controller, a processing engine, and a memory, and there is no need for a rearrangement unit. An input memory ( Figure 1 labeled as "input" in N ) can also be provided to store the input sequence arranged in bit-reversed order. For example, for an n-point input sequence, n = 2 N , it can be arranged in bit-reversed order first, and then the n / 2 input data pairs formed by every two adjacent data after bit-reversed arrangement are sequentially stored at n / 2 consecutive addresses in the input memory.

[0107] Figure 1 The solid arrows in Figure 1 represent the data flow, and the dashed arrows represent the control signals. The ① on them represents the read control signal, ② represents the write control signal, and ③ represents the enable control signal. As Figure 1 shown, in stage 0, the controller can control the read operation of the input memory and the write operation of the memory in stage 0, and generate the enable signal for the processing engine.

[0108] Through the control of the controller in stage 0, the transformation operation in stage 0 can be carried out as follows:

[0109] The controller in stage 0 sequentially reads n / 2 input data pairs from n / 2 addresses in the input memory,

[0110] The processing engine in stage 0 sequentially performs the radix-2 butterfly operation on the n / 2 input pairs read and sequentially outputs n / 2 result pairs;

[0111] The controller of stage 0 writes the n / 2 result pairs into consecutive n / 2 addresses in the memory of stage 0 in sequence.

[0112] by Figure 3 The data flow diagram of the 16-point DIT NTT shown in FIG. 1 is taken as an example. The 16-point DIT NTT includes a transformation operation of four stages (stages 0 to 3). In stage 0, every two adjacent input data in the 16-point input sequence that has been arranged in reverse bit order are sequentially stored in addresses A0 to A7 of the input memory. Then, as shown in FIG. Figure 3 As shown in the address access sequence below, in stage 0, the eight input pairs are read in the order of addresses A0 to A7, and as Figure 3 As shown in the sequence numbers marked in the upper right corners of each butterfly unit, in stage 0, butterfly operations are performed sequentially on the eight input pairs read from addresses A0 to A7.

[0113] In addition, Figure 3 Each address in the table corresponds to two adjacent rows of data (indicated by a gray strip), which means that the read / write addresses of the data of these two rows in each stage are the corresponding addresses marked on the left. Figure 3 As shown, the n / 2 result pairs obtained by each butterfly operation in stage 0 are sequentially written into addresses A0 to A7 of the memory of stage 0.

[0114] In some cases, the input memory of stage 0 is not necessary, that is, the input data does not need to be stored, but the input data is directly received from the outside or other processing circuits in front. In this case, the processing engine of stage 0 can sequentially perform radix-2 butterfly operations on the n / 2 input pairs directly received, and sequentially output n / 2 result pairs, and the controller of stage 0 sequentially writes the n / 2 result pairs into the continuous n / 2 addresses in the memory of stage 0. These n / 2 input pairs are the same as the n / 2 input pairs sequentially stored in the aforementioned input memory.

[0115] Back to Figure 1 In any subsequent intermediate stage, in the i-th stage, as mentioned above, in order to match the storage pair with the calculation pair and keep the data flow speed of storage access and calculation consistent, the solution of the embodiment of this specification processes butterfly operations in pairs. That is, the transformation operation of the i-th stage can be divided into n / 4 pairs of butterfly operations, and the process of any pair of butterfly operations can be as follows: Figure 2 The steps shown include:

[0116] Step S21, the controller reads out a first data pair and a second data pair from a first read address and a second read address in the memory of the i-1th stage, respectively;

[0117] Step S22, the first rearrangement unit performs a first rearrangement operation on the first and second data pairs, and sequentially outputs a third data pair and a fourth data pair;

[0118] Step S23, the processing engine sequentially performs radix-2 butterfly operations on the third data pair and the fourth data pair, and sequentially outputs a first result pair and a second result pair;

[0119] Step S24, the second rearrangement unit performs a second rearrangement operation on the first and second result pairs to obtain a fifth data pair and a sixth data pair;

[0120] Step S25 , the controller writes the fifth data pair and the sixth data pair into the first write address and the second write address in the memory of the i-th stage respectively.

[0121] The controller, processing engine, and the first and second rearrangement units mentioned above all belong to the circuit part of the i-th stage.

[0122] The above five steps can be viewed as five sub-stages: reading data, first reordering operation, processing engine operation, second reordering operation, and writing data, such as Figure 1 There are five sub-stages of data flow shown by the solid arrows in stage 1 or 2.

[0123] Taking stage 1 as an example, an example of the circuit part of the i-th stage of any intermediate stage is described in detail, as follows Figure 1 As shown, it includes: a first re-arrangement unit 11, a processing engine 12, a second re-arrangement unit 13, a memory 14, and a controller 15.

[0124] The memory 14 may be a random access memory (RAM) used to store the calculation results of the current stage in pairs, that is, one data pair is stored at one address. For example, two data of a storage pair may be concatenated into one data and stored at one address in the memory 14. The memory 14 may store n results obtained after the transformation operation of the n-point input sequence in the first stage in pairs through continuous n / 2 addresses.

[0125] exist Figure 1 In the figure, the gray half of the memory 14 represents the sub-stage of reading data in the next stage, and the white half of the memory 14 represents the sub-stage of writing data in the current stage. For example, the memory 14 can be a dual-port RAM, which can perform read operations and write operations simultaneously in one clock cycle, as long as the read and write addresses are not the same, thereby ensuring that the two sub-stages of reading and writing data can run simultaneously during pipeline operation.

[0126] like Figure 1As shown, the controller 15 controls the read operation of the memory in the previous stage and the write operation of the memory in the current stage, and generates enable signals for the first rearrangement unit 11 , the processing engine 12 and the second rearrangement unit 13 .

[0127] Through the control of the controller 15 , the data flow of the above five sub-stages can be realized in stage 1 .

[0128] In some examples, any qth pair of butterfly operations in the i-th stage of any intermediate stage can be implemented using the same control logic. For an N-th order transform in the form of a DI T, the control logic of the last order can also be the same as that of the intermediate stage.

[0129] For example, for any i-th stage, in each pair of butterfly operation processing, the values ​​of the two read addresses read from the memory of the previous stage and the two write addresses written to the memory of the current stage are the same, and the following grouping paired storage access (read / write) method can be used to implement the n / 4 pairs of butterfly operation processing in the entire stage:

[0130] All input / output data of the stage can be divided into multiple groups in the way that the input / output data of the butterfly units interlaced with each other in the N-order data flow graph (butterfly graph) of the target transformation are divided into one group, and the input / output data in each group is divided into upper and lower halves, and the multiple groups are read / written in sequence from top to bottom, wherein adjacent pairs of input / output data in the upper half and the lower half are read / written alternately in sequence from top to bottom in any group. All groups in a stage are accessed in the same way, and the next group is accessed after one group is accessed.

[0131] by Figure 3 Take the 16-point DITNTT data flow diagram as an example. For example, for stage 2, the first 4 butterfly units are interwoven together and thus divided into the first group, and the last 4 butterfly units are interwoven together and thus divided into the second group. The data in any group is further divided into upper and lower halves. For example, in the first group, the data at addresses A0 and A1 are the upper half, and the data at addresses A2 and A3 are the lower half. The address access sequence of stage 2 is: first access the first group, and then access the second group after completion. In the first group and the second group, the data in the upper half and the lower half are accessed alternately from top to bottom, respectively. From this, it can be inferred that Figure 3 The specific address access sequence is shown below.

[0132] The execution order of each butterfly operation process in stage 2 is also marked by the numbers in the upper right corner of the figure, from 0 to 7. Every two successive butterfly operation processes are the aforementioned pair of butterfly operation processes. For example, the 0th butterfly unit and the 1st butterfly unit are processed in pairs, and their two calculation pairs respectively correspond to the rearrangement of two storage pairs in addresses A0 and A2. The calculation pair of the 0th butterfly unit corresponds to the upper half data of the two storage pairs in addresses A0 and A2 respectively, and the calculation pair of the 1st butterfly unit corresponds to the lower half data of the two storage pairs in addresses A0 and A2 respectively.

[0133] As Figure 3 shown, the data stream implemented in the embodiments of this specification processes data in pairs through two pairing methods. One pairing method is the storage pair, which is composed of every two adjacent rows of data from top to bottom in each stage in Figure 3 . One storage pair is stored at one address in the memory. The other pairing method is the calculation pair, which is composed of two input data or output data of the processing engine or the butterfly unit. The first and second rearrangement units can switch between the two pairing modes by rearranging the data, so that both the memory and the processing engine can operate according to their respective pairing modes.

[0134] According to the above description, it can be deduced that for the i-th order (0 < i, that is, non-first order) in any N orders, in any pair of butterfly operation processes, the second read / write address is the first read / write address plus the (i - 1)th power of 2. For example, Figure 2 in the process shown, the second read address and write address are the first read address and write address plus the (i - 1)th power of 2 respectively.

[0135] In addition, it can be deduced that for the i-th order (0 < i, that is, non-first order) in any N orders, its n / 2 addresses can be sequentially divided into 2 to the power of (N - i - 1) groups. And there is the following relationship between the access addresses of two successive pairs of butterfly operation processes:

[0136] If the second read / write address of the current pair is the last address in its group, the first read / write address of the next pair is the second read / write address of the current pair plus 1; otherwise, it is the first read / write address of the current pair plus 1. As mentioned above, the second read / write address of the next pair is the first read / write address of the next pair plus the (i - 1)th power of 2.

[0137] From this, the following formula can be deduced to obtain the entire address access order of the i-th stage:

[0138] Addr ij= ((j >> i) << i) + ((j % 2) << (i - 1)) + ((j % 2 i ) >> 1)

[0139] where Addr ij is the address of the j-th access (read / write) in the i-th stage, i ∈ {1, 2, …, N - 1}, j ∈ {0, 1, …, n / 2 - 1}. For the first read / write address in any q-th pair of butterfly operation processes, j = 2q, and for the second read / write address in any q-th pair of butterfly operation processes, j = 2q + 1.

[0140] For the operators in the above formula, "j >> i" means shifting j to the right by i bits, "j << i" means shifting j to the left by i bits, and the vacant bits are filled with 0s, while "j % 2" means taking the modulus of j by 2, that is, the remainder of j divided by 2.

[0141] Thus, in the above embodiment solution, the control logic of the data stream is simple, and the control logic of each stage in each order is consistent, so it has good scalability.

[0142] In some examples, the pipeline method can be used to run Figure 1 the accelerated hardware shown. Therefore, after the pipeline is filled, all sub-stages of all stages can run simultaneously, that is Figure 1 all hardware units in can run simultaneously. Figure 1 Some hardware units in, such as the first and second rearrangement units and the processing engine, can also be implemented using a pipeline architecture.

[0143] Still taking Figure 1 the stage 1 in as an example to specifically describe the pipeline operation.

[0144] The aforementioned Figure 2 step S21 (sub-stage 1) in can be executed by the controller 15 within two consecutive clock cycles. For example, in the 1st clock cycle, the controller 15 reads the first data pair from the first read address of the memory in the previous stage (stage 0) and inputs it to the first rearrangement unit 11. At this time, the first rearrangement unit 11 receives the first data pair; in the 2nd clock cycle, the controller 15 reads the second data pair from the second read address of the memory in stage 0 and inputs it to the first rearrangement unit 11. At this time, the first rearrangement unit 11 receives the second data pair.

[0145] After the first rearrangement unit 11 receives the first data pair in the aforementioned 1st clock cycle, the first rearrangement unit 11 can execute the aforementioned Figure 2Step S22 (sub-stage 2) in the above-mentioned second clock cycle. For example, in the second clock cycle, the first reordering unit 11 temporarily stores the first data pair; in the third clock cycle, the first reordering unit 11 temporarily stores the second data in the second data pair, and outputs the first data in the first data pair and the first data in the second data pair as the third data pair, at which time the processing engine receives the third data pair; in the fourth clock cycle, the first reordering unit outputs the second data in the first data pair and the second data in the second data pair as the fourth data pair, at which time the processing engine receives the fourth data pair.

[0146] In some examples, the first rearrangement unit 11 may have Figure 4 The hardware structure shown.

[0147] like Figure 4 As shown, the first rearrangement unit 11 includes a first register R1, a second register R0, a first multiplexer M0, a second multiplexer M1, and a multiplexer control unit, wherein the multiplexer control unit outputs control signals f0 and f1 for respectively controlling the first multiplexer M0 and the second multiplexer M1 to alternately select one of their two inputs as output.

[0148] One input terminal of the first multiplexer M0 and one input terminal of the second multiplexer M1 both receive the first data d0 of the currently read data pair. Figure 4 In the figure, both input terminals are input terminals corresponding to "0", that is, the terminal that will be selected for output when the control signal of the multiplexer is 0. However, this is only exemplary and not restrictive. Those skilled in the art can make any modifications as needed and change the control signal of the multiplexer accordingly.

[0149] The first register R1 receives and stores the second data d1 in the currently read data pair in the next clock cycle accordingly. The output end of the first register R1 is coupled to the other input end of the first multiplexer M0 and the other input end of the second multiplexer M1. Figure 4 The input terminal corresponds to "1".

[0150] An output terminal of the first multiplexer M0 is coupled to an input terminal of the second register R0 .

[0151] The second register R0 outputs the first data x0 in the data pair currently obtained by rearrangement, and the second multiplexer M1 outputs the second data x1 in the data pair currently obtained by rearrangement.

[0152] Thus, the first register R1 is used to directly temporarily store the input data d1, and the second register R0 is used to temporarily store another input data d0 or temporarily store the data stored in R1 in the previous clock cycle.

[0153] Figure 4 The multiplexer selection control unit in includes a third register F0, a fourth register F1, and an inverter Inv1, but this is merely exemplary and not restrictive, and those skilled in the art may make any modifications as needed.

[0154] The output terminal of the third register F0 is coupled to the control terminal of the first multiplexer M0, the input terminal of the fourth register F1, and the input terminal of the inverter Inv1. The third register F0 outputs a control signal f0.

[0155] The output terminal of the fourth register F1 is coupled to the control terminal of the second multiplexer M1. The fourth register F1 outputs a control signal f1.

[0156] An output terminal of the inverter I nv1 is coupled to an input terminal of the third register F0 .

[0157] After the multiplexer control unit operates stably, two control signals f0 and f1 that are inverted from each other can be output within one clock cycle, and f0 and f1 can be inverted once in each subsequent clock cycle.

[0158] pass Figure 4 The first rearrangement unit 11 shown in the figure can perform the above-mentioned steps in three consecutive clock cycles as follows: Figure 2 Step S22 (sub-stage 2) in:

[0159] In the second clock cycle, d0 and d1 of the first data pair are temporarily stored in the second register R0 and the first register R1 respectively;

[0160] In the third clock cycle, d1 of the second data pair is temporarily stored in the first register R1, and the second register R0 outputs d0 of the first data pair as x0, and the second multiplexer M1 outputs d0 of the second data pair as x1. At this time, the output x0 and x1 constitute a third data pair, and the second register R0 temporarily stores d1 of the first data pair stored by the first register R1 in the second clock cycle;

[0161] In the 4th clock cycle, the second register R0 outputs d1 in the first data pair as x0, and the second multiplexer M1 outputs d1 in the second data pair stored in the first register R1 in the 3rd clock cycle as x1. At this time, the output x0 and x1 constitute the fourth data pair.

[0162] Next, after the processing engine 12 receives the third data pair in the third clock cycle, the processing engine 12 may start to execute the aforementioned Figure 2The first step in step S23 (sub-stage 3) in the above is to start performing a radix-2 butterfly operation on the third data pair, and output the obtained first result pair to the second rearrangement unit 13 after t clock cycles (i.e., in the t+3th clock cycle); and after the processing engine 12 receives the fourth data pair in the aforementioned 4th clock cycle, the second step can be started, i.e., start performing a radix-2 butterfly operation on the fourth data pair, and output the obtained second result pair to the second rearrangement unit 13 after t clock cycles (i.e., in the t+4th clock cycle). The t clock cycles are the time required for one butterfly operation.

[0163] For NTT, each butterfly operation includes modular addition, modular subtraction and modular multiplication operations, and usually requires multiple clock cycles to complete the calculation, that is, t>1. However, the processing engine 12 can also adopt a pipeline circuit architecture, so the two butterfly operations can be started separately in two consecutive clock cycles as described above.

[0164] In one example, processing engine 12 may have Figure 5 The pipeline structure shown.

[0165] like Figure 5 As shown, the processing engine 12 uses a five-stage pipeline to process butterfly operations, wherein the first four stages of the pipeline calculate modular multiplications using the Shoup algorithm, and the fifth stage of the pipeline calculates modular additions and modular subtractions. Figure 5 The first 4 stages of the pipeline circuit in the embodiment can be regarded as a modular multiplication unit, which includes three integer multipliers, wherein the first integer multiplier is implemented by a digital signal processor (DSP), while the second and third integer multipliers are implemented by a lookup table (LUT), thereby optimizing the critical path and obtaining a better synthesis result.

[0166] In addition, if Figure 5 As shown, the rotation factors (shown in the figure are the rotation factors used for NTTP) and the parameter m are pre-stored in the read-only memory (ROM) of the processing engine 12.

[0167] Therefore, using Figure 5 The processing engine 12 of the structure needs to spend 5 clock cycles to complete a butterfly operation, that is, the aforementioned t=5.

[0168] Next, after the second reordering unit 13 receives the first result pair in the aforementioned t+3th clock cycle, the second reordering unit 13 may perform the aforementioned Figure 2Step S24 (sub-stage 4) in the above-mentioned step. For example, in the t+4th clock cycle, the second reordering unit 13 temporarily stores the first result pair; in the t+5th clock cycle, the second reordering unit 13 temporarily stores the second result of the second result pair, and outputs the first result of the first result pair and the first result of the second result pair as the fifth data pair, at which time the memory 14 receives the fifth data pair; in the t+6th clock cycle, the second reordering unit 13 outputs the second result of the first result pair and the second result of the second result pair as the sixth data pair, at which time the memory 14 receives the sixth data pair.

[0169] The above operation of the second reordering unit 13 is the same as that of the first reordering unit 11, except that the processed data pairs are different. Therefore, the second reordering unit 13 may have the same hardware structure as the first reordering unit 11, for example Figure 4 The hardware structure shown will not be described in detail here.

[0170] Next, after the memory 14 receives the fifth data pair in the aforementioned t+5th clock cycle, the controller 15 may control the memory 14 to execute the aforementioned Figure 2 For example, in step S25 (sub-stage 5) of the embodiment, in the t+5th clock cycle, the controller 15 writes the fifth data pair into the first write address of the memory 14; in the t+6th clock cycle, the controller 15 writes the sixth data pair into the second write address of the memory 14.

[0171] All butterfly operations in one stage can be processed sequentially in the above pipeline manner, wherein the partial operations of the two pairs of butterfly operations are performed simultaneously. For example, in the above third and fourth clock cycles, the controller 15 can then read the corresponding two data pairs from the third and fourth read addresses corresponding to the next pair of butterfly operations, and run sequentially according to the above pipeline process, which will not be described in detail here.

[0172] In addition, in the pipeline, all N stages can run simultaneously, but since the calculation results of the previous stage need to be read in the later stage, there is an initial delay in the i-th stage. In the case of adopting the aforementioned grouping paired storage access (read / write) method, the i-th stage can start the first read operation only after the calculation of the first group of butterfly units is completed in the i-1th stage and the results are written into the memory. Therefore, in response to the completion of writing the data pairs in all addresses of the first group in the i-1th stage, in the first subsequent clock cycle, the controller of the i-th stage starts the first read operation of the stage and reads the first data pair from the first read address of the memory of the i-1th stage. According to the aforementioned control logic and data flow description, in the first subsequent clock cycle, the i-1th stage just completes the write operation at the second read address in the address access sequence of the i-th stage, so the controller of the i-th stage can just start the second read operation of the stage in the second subsequent clock cycle and read the second data pair from the second read address of the memory of the i-1th stage. Only the first read operation needs to be waited, and the subsequent read operations do not need to be waited. This can maximize the efficiency of the assembly line.

[0173] The following pseudo-code Algorithm 1 illustrates a complete pipeline DI T NTTP N-stage transformation operation. The algorithm uses the aforementioned grouping paired memory access scheme. In order to describe the behavior of the register in the pseudo-code of Algorithm 1, that is, to indicate that the value in the register (the value obtained in the previous sub-stage) is used first in the subsequent sub-stage, and then the register is updated, the first sub-stage is placed at the bottom of the code segment, and the code segments of these sub-stages are started from bottom to top according to their judgment conditions.

[0174] The pipeline operations represented by these pseudo codes have been described in detail before and will not be repeated here.

[0175] In addition, it can be understood that since Algorithm 1 describes NTTP, the rotation factor of the butterfly unit executed for the jth time in the i-th stage is:

[0176]

[0177] in And k2=2 N-1-i .

[0178] If Algorithm 1 is used for other transformations, the value of the rotation factor may be adaptively changed, and for the inverse transformation, a multiplication with 1 / n is also added.

[0179]

[0180]

[0181] The algorithm described above can bring about efficient data flow, so that memory access and butterfly operations in the processing engine can be performed in pairs simultaneously on the pipeline, and the speed of memory access and calculation is consistent. The processing engine can receive two input data of a butterfly unit and generate two output data of a butterfly unit in each clock cycle, and all butterfly units in a stage are calculated by the processing engine in sequence according to a preset order.

[0182] This data stream can process continuous n-point target transformations using an average processing cycle of n / 2. As mentioned above, when the i-1th stage completes the calculation of the first group of butterfly units and writes its results to the memory, the i-th stage can start the first read operation, thus introducing a 2-step delay between two adjacent stages. i-1 -1 cycle pipeline delay. In addition, the delay within stage 0 is 7, and the fixed delay within the subsequent stages is 9. Therefore, the total pipeline delay of the target transformation data flow can be obtained by the following formula:

[0183]

[0184] The above-mentioned DIT NTT / NTTP acceleration hardware structure proposed in the embodiments of this specification can be integrated and implemented on various FPGA platforms. Table 1 below provides a comparison of the embodiments of this specification and the prior art in terms of detailed information on the hardware implementation results, including resource consumption, performance indicators (frequency, delay, throughput) and area-time product as a representation of hardware efficiency. The BRAM and DSP in the FPGA are converted into an equivalent number of slices to evaluate the area. The delay reflects the speed of processing NTT operations. The lower the delay, the faster the calculation speed. Since the embodiments of this specification are pipeline designs, their ideal application scenario is to process continuous NTT operations. Therefore, the average delay for processing 100 continuous NTT operations is given in the comparison results. The area-time product is an indicator that takes into account both hardware resource consumption and calculation speed. The lower the area-time product, the better the hardware efficiency.

[0185]

[0186] The data of each prior art used as a reference for comparison in Table 1 are respectively from a corresponding journal of a certain year described in its design name.

[0187] It can be seen from Table 1 that, compared with the current mainstream NTT accelerator, the NTT structure proposed in the embodiments of this specification achieves a speed improvement of up to 4.8 times and an area-time product improvement of up to 4.3 times.

[0188] The embodiments of this specification achieve a good balance between performance and resource utilization, and obtain higher hardware efficiency.

[0189] The entire circuit structure and operation flow of the embodiment of this specification are described above by taking the DIT form as an example. The circuit structure and operation flow of the DIF form can be obtained by appropriately deforming it.

[0190] The topological structure of each stage in the DI F form is opposite to that in the DI T form, that is, the i-th stage in the DI F form corresponds to the N-1-i-th stage in the DI T form. Figure 1 The acceleration hardware structure in the form of DI T shown is horizontally flipped to obtain the acceleration hardware structure in the form of DI F.

[0191] The first stage of the DI F format, stage 0 corresponds to Figure 1 In stage N-1, it has the same Figure 1 The circuit parts of the intermediate stages in the same hardware structure and perform the same transformation operations.

[0192] The final stage of the DI F form, stage N-1, corresponds to Figure 1 The stage 0 in the N-1 stage, therefore, the circuit part of the stage N-1 only includes the N-1 stage controller and the N-1 stage processing engine, without the need for a reordering unit. Accordingly, the transformation operation of the stage N-1 includes: the N-1 stage controller sequentially reads out n / 2 data pairs from n / 2 addresses in the memory of the N-2 stage; the N-1 stage processing engine sequentially performs radix-2 butterfly operations on the n / 2 data pairs, and sequentially outputs n / 2 result pairs.

[0193] For each intermediate stage of the DI F form, its circuit part is the same as Figure 1 The DIT form in the above is the same, except that i in the above calculation formulas is replaced by Ni-1 in the control logic. For example, in the transformation operation of the i-th stage of the DIF form, n / 2 addresses are sequentially divided into 2 to the power of i groups, and the second read address and write address in any pair of butterfly operation processing are the first read address and write address plus 2 to the power of Ni-2.

[0194] Additionally, the DI F style processing engine performs modular multiplication after modular addition and modular subtraction.

[0195] Since the pipeline structure proposed in the embodiment of this specification can generate two outputs in each cycle, a pipeline polynomial multiplier can be implemented based on the embodiment of this specification. It only needs to input two polynomials into two parallel NTTP units, and pass the result to an INTTP unit through the point-by-point multiplication unit of two data implemented by the Barrett algorithm to obtain the result of the polynomial multiplication.

[0196] Figure 6A schematic diagram of the structure of a polynomial multiplier according to an embodiment is shown. The polynomial multiplier receives an n-point first input sequence and an n-point second input sequence, and outputs an n-point polynomial multiplication output sequence.

[0197] like Figure 6 As shown, the polynomial multiplier includes a first transformation module 61, a second transformation module 62, a point-by-point multiplication hardware module 63 and a third transformation module 64, wherein the first transformation module 61, the second transformation module 62 and the third transformation module 64 can all be implemented using the acceleration hardware of the aforementioned embodiments of this specification.

[0198] The first transformation module 61 may be acceleration hardware of NTTP in DIF form according to the embodiment of this specification, which performs NTTP in DIF form on the first input sequence, ie, the coefficient sequence of the polynomial a(x), and outputs a first output sequence a′.

[0199] The second transformation module 62 can also be the acceleration hardware of NTTP in DIF form according to the embodiment of this specification. Its structure can be the same as that of the first transformation module 61. It performs NTTP in DIF form on the second input sequence, that is, the coefficient sequence of the polynomial b(x), and outputs the second output sequence b'.

[0200] The point-by-point multiplication hardware module 63 can perform point-by-point multiplication on the first and second output sequences a' and b', and output a third output sequence c'. In the case of a pipeline architecture, the point-by-point multiplication hardware module can be implemented by the Barrett algorithm, and point-by-point multiplication is performed on the two data output by each clock cycle of the first transformation module 61 and the second transformation module 62.

[0201] The third transformation module 64 may be an acceleration hardware (eg, Figure 1 As shown), it performs INTTP on the third output sequence c' in the form of DI T, and outputs an n-point polynomial multiplication output sequence, that is, a coefficient sequence of the polynomial c(x).

[0202] Since the DI F form requires a natural order input sequence and obtains a bit-reversed output sequence, and the DI T form requires a bit-reversed input sequence and obtains a natural order output sequence, the processing of reversing the bit order is omitted in the above-mentioned polynomial multiplier, thereby improving the operating efficiency.

[0203] The polynomial multiplier according to the embodiments of this specification can be applied to various other devices, such as a post-quantum cryptography hardware accelerator, etc.

[0204] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, firmware or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0205] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for performing target transformation by accelerating hardware, wherein the target transformation includes transformation operations of N stages, the accelerating hardware includes N circuit parts corresponding to the N stages, wherein the i-th circuit part corresponding to any i-th stage other than the first and last stages includes a controller, a processing engine, a memory, and first and second rearrangement units, and the transformation operations of the i-th stage include: The controller reads out a first data pair and a second data pair from a first read address and a second read address in the memory of the i-1th stage, respectively; The first rearrangement unit performs a first rearrangement operation on the first and second data pairs, and sequentially outputs a third data pair and a fourth data pair; The processing engine sequentially performs a radix-2 butterfly operation on the third data pair and the fourth data pair, and sequentially outputs a first result pair and a second result pair; The second rearrangement unit performs a second rearrangement operation on the first and second result pairs to obtain a fifth data pair and a sixth data pair; The controller writes the fifth data pair and the sixth data pair into a first write address and a second write address in the memory of the i-th stage respectively.

2. The method according to claim 1, wherein: The target transformation is performed on an n-point input sequence, where n is a power of 2. The memory of the i-th stage stores the n results obtained after the transformation operation of the n-point input sequence in pairs through consecutive n / 2 addresses, and the values ​​of the first and second read addresses are respectively the same as the values ​​of the first and second write addresses.

3. The method according to claim 2, wherein: The second read address and write address are respectively the first read address and write address plus 2 to the power of i-1; or, The second read address and write address are respectively the first read address and write address plus 2 raised to the Ni-2 power.

4. The method according to claim 2, wherein: In the transformation operation of the i-th stage, the n / 2 addresses are sequentially divided into 2 to the power of Ni-1 groups or 2 to the power of i groups; The transformation operations in stage i also include: The controller reads data from the third read address and the fourth read address in the memory of the i-1th stage in two consecutive clock cycles after reading the second data pair; If the second read address is the last address in the group, the third read address is the second read address plus 1; otherwise, the third read address is the first read address plus 1; When the number of packets is divided equally into Ni-1 power of 2, the fourth read address is the third read address plus 2 to the i-1 power; when the number of packets is divided equally into 2 to the i power, the fourth read address is the third read address plus 2 to the Ni-2 power.

5. The method according to claim 1, wherein: The controller reads out a first data pair and a second data pair from a first read address and a second read address in the memory of the i-1th stage, respectively, including: In a first clock cycle, the controller reads a first data pair from the first read address and inputs the first data pair into the first rearrangement unit; in a second clock cycle following the first clock cycle, the controller reads a second data pair from the second read address and inputs the second data pair into the first rearrangement unit.

6. The method according to claim 5, wherein: The processing engine sequentially performs a radix-2 butterfly operation on the third data pair and the fourth data pair, respectively, including: In a third clock cycle, the processing engine starts to perform a radix-2 butterfly operation on the third data pair, and outputs the obtained first result pair to the second rearrangement unit after t clock cycles; In a fourth clock cycle following the third clock cycle, the processing engine starts to perform a radix-2 butterfly operation on the fourth data pair, and outputs the obtained second result pair to the second rearrangement unit after t clock cycles.

7. The method according to claim 6, wherein: The controller writes the fifth data pair and the sixth data pair into a first write address and a second write address in the memory of the i-th stage respectively, including: In the t+5th clock cycle, the controller writes the fifth data pair into the first write address; In the t+6th clock cycle, the controller writes the sixth data pair into the second write address.

8. The method according to claim 1, wherein: The first rearrangement unit performs a first rearrangement operation on the first and second data pairs, including: In a first clock cycle, the first reordering unit receives a first data pair; In the second clock cycle, the first reordering unit receives the second data pair and temporarily stores the first data pair; In a third clock cycle following the second clock cycle, the first reordering unit outputs the first data in the first data pair and the first data in the second data pair as a third data pair, and temporarily stores the second data in the second data pair; In a fourth clock cycle following the third clock cycle, the first rearrangement unit outputs the second data in the first data pair and the second data in the second data pair as a fourth data pair.

9. The method according to claim 6, wherein: The second rearrangement unit performs a second rearrangement operation on the first and second result pairs, including: In the t+3th clock cycle, the second rearrangement unit receives the first result pair; In the t+4th clock cycle, the second rearrangement unit receives the second result pair and temporarily stores the first result pair; In the t+5th clock cycle, the second rearrangement unit outputs the first result of the first result pair and the first result of the second result pair as the fifth data pair, and temporarily stores the second result of the second result pair; In the t+6th clock cycle, the second rearrangement unit outputs the second result of the first result pair and the second result of the second result pair as the sixth data pair.

10. The method according to claim 2, wherein: The 0th circuit part corresponding to the first stage among the N circuit parts includes a 0th stage controller, a 0th stage processing engine and a 0th stage memory, and the transformation operation of the 0th stage includes: The 0th order processing engine sequentially performs radix-2 butterfly operations on n / 2 input pairs consisting of every two adjacent data in the n-point input sequence arranged in reverse bit order, and sequentially outputs n / 2 result pairs; The 0th-order controller writes the n / 2 result pairs into consecutive n / 2 addresses in the 0th-order memory in sequence.

11. The method according to claim 2, wherein: The N-1th circuit part corresponding to the ending stage of the N circuit parts includes an N-1th stage controller and an N-1th stage processing engine, and the transformation operation of the N-1th stage includes: The controller of the N-1th stage reads out n / 2 data pairs sequentially from n / 2 addresses in the memory of the N-2th stage; The N-1th order processing engine sequentially performs radix-2 butterfly operations on the n / 2 data pairs respectively, and sequentially outputs n / 2 result pairs.

12. The method according to claim 1, wherein: The 0th circuit portion corresponding to the first stage or the N-1th circuit portion corresponding to the final stage among the N circuit portions has the same hardware structure as the i-th circuit portion and performs the same conversion operation.

13. The method according to claim 1, wherein: The target transformation is a fast Fourier transform FFT, an inverse fast Fourier transform IFFT, a fast number theoretic transform NTT, an inverse fast number theoretic transform INTT, an NTTP transformation obtained by fusing preprocessing with NTT in a negative wrapping convolution NWC, or an INTTP transformation obtained by fusing INTT with postprocessing in a NWC; The N-stage transformation operations are performed in a time-decimation DIT format or a frequency-decimation DIF format.

14. An acceleration hardware for performing a target transformation, the target transformation comprising a transformation operation of N stages, the acceleration hardware comprising N circuit parts corresponding to the N stages, wherein the i-th circuit part corresponding to any i-th stage other than the first and last stages comprises a controller, a processing engine, a memory, and first and second rearrangement units; in the transformation operation of the i-th stage: The controller is configured to read out a first data pair and a second data pair from a first read address and a second read address in the memory of the i-1th stage, respectively; The first rearrangement unit is configured to perform a first rearrangement operation on the first and second data pairs, and output a third data pair and a fourth data pair in sequence; The processing engine is configured to perform a radix-2 butterfly operation on the third data pair and the fourth data pair in sequence, and output a first result pair and a second result pair in sequence; The second rearrangement unit is configured to perform a second rearrangement operation on the first result pair and the second result pair to obtain a fifth data pair and a sixth data pair; The controller is further configured to write the fifth data pair and the sixth data pair into a first write address and a second write address in the memory of the i-th stage, respectively.

15. The acceleration hardware according to claim 14, wherein: The first rearrangement unit includes a first register, a second register, a first multiplexer, a second multiplexer, and a multiplexer control unit. Wherein, one input end of the first multiplexer and one input end of the second multiplexer both receive the first data in the currently read data pair, The first register receives and temporarily stores the second data in the data pair currently read out, and an output end of the first register is coupled to another input end of the first multiplexer and another input end of the second multiplexer. The output terminal of the first multiplexer is coupled to the input terminal of the second register, The second register outputs the first data in the currently rearranged data pair, the second multiplexer outputs the second data in the currently rearranged data pair, and The multiplexer control unit is configured to control the first multiplexer and the second multiplexer to alternately select one of the two inputs thereof as an output.

16. The acceleration hardware according to claim 15, wherein: The multiplexer control unit includes a third register, a fourth register, and an inverter. The output terminal of the third register is coupled to the control terminal of the first multiplexer, the input terminal of the fourth register, and the input terminal of the inverter. The output terminal of the fourth register is coupled to the control terminal of the second multiplexer, The output terminal of the inverter is coupled to the input terminal of the third register.

17. The acceleration hardware according to claim 14, wherein: The first rearrangement unit and the second rearrangement unit have the same hardware structure.

18. The acceleration hardware according to claim 14, wherein: The processing engine comprises a modular multiplication unit, which comprises first, second and third integer multipliers, wherein the first integer multiplier is implemented by a digital signal processor DSP, and the second and third integer multipliers are implemented by a lookup table LUT.

19. A polynomial multiplier, receiving an n-point first input sequence and an n-point second input sequence, and outputting an n-point polynomial multiplication output sequence; the polynomial multiplier comprises a first transform module, a second transform module, a point-by-point multiplication hardware module and a third transform module, wherein the first transform module, the second transform module and the third transform module all comprise the acceleration hardware according to claim 14; The first transformation module is configured to perform NTTP on the first input sequence in DIF form to output a first output sequence; The second transformation module is configured to perform NTTP on the second input sequence in DIF form to output a second output sequence; The point-by-point multiplication hardware module is configured to perform point-by-point multiplication on the first and second output sequences to output a third output sequence; The third transformation module is configured to perform INTTP on the third output sequence in DIT form to output the n-point polynomial multiplication output sequence.

Images