Method, acceleration hardware and polynomial multiplier for performing target transformation

Abstract

Embodiments of the present specification provide a method for performing target transformation by acceleration hardware. The target transformation includes N-stage transformation operations, and the acceleration hardware includes N circuit parts corresponding to the N stages, wherein any i-th stage of the non-first and non-last stages corresponds to an i-th circuit part including a controller, a processing engine, a memory, and first and second rearrangement units. The i-th stage of the transformation operations includes: the controller reading out a first and a second data pair from a first and a second readout address in the memory of the i-1-th stage, respectively; the first rearrangement unit performing a first rearrangement operation on the first and the second data pair to output a third and a fourth data pair; the processing engine performing a butterfly operation of base 2 on the third and the fourth data pair to output a first and a second result pair, respectively; the second rearrangement unit performing a second rearrangement operation on the first and the second result pair to obtain a fifth and a sixth data pair; and the controller writing the fifth and the sixth data pair into a first and a second write address in the memory of the i-th stage, respectively.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to optimization of hardware for accelerating target transform, and in particular to utilizing pair-wise storage and rearrangement of data to accelerate execution of target transform and polynomial multiplication. BACKGROUND

[0002] Fast Fourier Transform (FFT) and Number-Theoretic Transform (NTT) are the most critical steps for accelerating polynomial multiplication, which have very broad application scenarios in both communication and encryption fields. For example, FFT realizes conversion between time domain and frequency domain when digital signal processing, and NTT and Negative Wrap Convolution (NWC) using NTT accelerate polynomial multiplication in the finite field in the design of fully homomorphic hardware acceleration chips.

[0003] In particular, with the continuous progress of quantum computers, efficient quantum algorithms can break the mathematical problems on which the mainstream RSA, ECC and other public key cryptography systems depend, thus making these cryptography systems face security threats. Therefore, developing more secure post-quantum cryptography systems has become a new research focus. The goal of post-quantum cryptography (PQC) is to ensure security in the case that the attacker has a large quantum computer, and most of the existing post-quantum cryptography schemes are mainly based on lattice theory, while polynomial multiplication often becomes the main computational bottleneck in these schemes. In order to speed up the calculation of polynomial multiplication, NTT is widely used, which can reduce the time complexity from O(n 2 ) to O(nlog2(n)).

[0004] In the above various computing scenarios, the efficiency of polynomial multiplication or FFT or NTT operations contained therein is an important influencing factor of computing performance.

[0005] Therefore, it is desirable to have an improved scheme to improve the speed of polynomial multiplication or FFT or NTT operations contained therein, so as to improve the computing performance of related application scenarios. SUMMARY

[0006] One or more embodiments of the present specification describe a scheme for accelerating target transform by hardware, which accelerates the execution of target transform by pair-wise storage and rearrangement of data, and improves the running performance of target transform and corresponding polynomial multiplication.

[0007] According to a first aspect, there is provided a method for performing a target transform by acceleration hardware, the target transform comprising transform operations of N stages, the acceleration hardware comprising N circuit portions corresponding to the N stages, wherein any ith stage of the non-first and non-last stages corresponds to an ith circuit portion comprising a controller, a processing engine, a memory, and first and second reordering units, the transform operations of the ith stage comprising:

[0008] the controller reading out a first data pair and a second data pair from a first readout address and a second readout address in the memory of the ith-1 stage, respectively;

[0009] the first reordering unit performing a first reordering operation on the first and second data pairs, outputting a third data pair and a fourth data pair in sequence;

[0010] the processing engine performing a butterfly operation of base 2 on the third data pair and the fourth data pair in sequence, outputting a first result pair and a second result pair in sequence, respectively;

[0011] the second reordering unit performing a second reordering operation on the first and second result pairs, obtaining a fifth data pair and a sixth data pair;

[0012] the controller writing the fifth data pair and the sixth data pair into a first write address and a second write address in the memory of the ith stage, respectively.

[0013] In one embodiment, the target transform is performed on an n-point input sequence, n being 2 raised to the power of N, the memory of the ith stage stores n results of the n-point input sequence after the transform operation of the ith stage by pairs through consecutive n / 2 addresses, and the values of the first and second readout addresses are the same as the values of the first and second write addresses, respectively.

[0014] In one embodiment, the second readout address and the second write address are the first readout address and the first write address plus 2 raised to the power of i-1, respectively.

[0015] In one embodiment, the second readout address and the second write address are the first readout address and the first write address plus 2 raised to the power of N-i-2, respectively.

[0016] In one embodiment, in the transform operation of the ith stage, the n / 2 addresses are sequentially divided into 2 raised to the power of N-i-1 groups; the transform operation of the ith stage further comprises:

[0017] the controller reading data from a third readout address and a fourth readout address in the memory of the ith-1 stage in sequence in the two clock cycles after reading out the second data pair;

[0018] If the second read address is the last address in the group, the third read address is the second read address plus 1; otherwise, the third read address is the first read address plus 1.

[0019] The fourth read address is the third read address plus 2 raised to the power of i-1.

[0020] In one embodiment, in the transformation operation of the i-th stage, the n / 2 addresses are sequentially divided into 2 raised to the power of i groups; the transformation operation of the i-th stage further comprises:

[0021] The controller reads data from the third read address and the fourth read address in the memory of the i-1-th stage in the two consecutive clock cycles after reading the second data pair;

[0022] If the second read address is the last address in the group, the third read address is the second read address plus 1; otherwise, the third read address is the first read address plus 1.

[0023] The fourth read address is the third read address plus 2 raised to the power of N-i-2.

[0024] In one embodiment, the controller reads the first data pair and the second data pair from the first read address and the second read address in the memory of the i-1-th stage, respectively, comprising:

[0025] In response to the completion of writing the data pairs in all addresses of the first group in the i-1-th stage, the controller reads the first data pair from the first read address and inputs the first data pair into the first rearrangement unit in the first clock cycle; the controller reads the second data pair from the second read address and inputs the second data pair into the first rearrangement unit in the second clock cycle succeeding the first clock cycle.

[0026] In one embodiment, the processing engine sequentially performs the radix-2 butterfly operation on the third data pair and the fourth data pair, respectively, comprising:

[0027] In the third clock cycle, the processing engine starts to perform the radix-2 butterfly operation on the third data pair, and outputs the first result pair obtained after t clock cycles to the second rearrangement unit;

[0028] In the fourth clock cycle succeeding the third clock cycle, the processing engine starts to perform the radix-2 butterfly operation on the fourth data pair, and outputs the second result pair obtained after t clock cycles to the second rearrangement unit.

[0029] In one embodiment, the controller writes the fifth data pair and the sixth data pair into the first write address and the second write address in the memory of the i-th stage, respectively, comprising:

[0030] At the t+5th clock cycle, the controller writes the fifth data pair to the first write address;

[0031] At the t+6th clock cycle, the controller writes the sixth data pair to the second write address.

[0032] In one embodiment, the first reordering unit performs a first reordering operation on the first and second data pairs, comprising:

[0033] At the first clock cycle, the first reordering unit receives the first data pair;

[0034] At the second clock cycle, the first reordering unit receives the second data pair and temporarily stores the first data pair;

[0035] At the third clock cycle succeeding the second clock cycle, the first reordering unit outputs the first data of the first data pair and the first data of the second data pair as a third data pair and temporarily stores the second data of the second data pair;

[0036] At the fourth clock cycle succeeding the third clock cycle, the first reordering unit outputs the second data of the first data pair and the second data of the second data pair as a fourth data pair.

[0037] In one embodiment, the second reordering unit performs a second reordering operation on the first and second result pairs, comprising:

[0038] At the t+3rd clock cycle, the second reordering unit receives the first result pair;

[0039] At the t+4th clock cycle, the second reordering unit receives the second result pair and temporarily stores the first result pair;

[0040] At the t+5th clock cycle, the second reordering unit outputs the first result of the first result pair and the first result of the second result pair as a fifth data pair and temporarily stores the second result of the second result pair;

[0041] At the t+6th clock cycle, the second reordering unit outputs the second result of the first result pair and the second result of the second result pair as a sixth data pair.

[0042] In one embodiment, the 0th circuit part corresponding to the first stage among the N circuit parts comprises a 0th controller, a 0th processing engine and a 0th memory, and the transform operation of the 0th stage comprises:

[0043] The 0th processing engine sequentially performs a butterfly operation of base 2 on each of the n / 2 input pairs formed by every two adjacent data in the n-point input sequence arranged in bit-reversed order in a sequential order and sequentially outputs n / 2 result pairs;

[0044] The 0th order controller sequentially writes the n / 2 result pairs in a sequential order into n / 2 consecutive addresses in a 0th order memory.

[0045] In one embodiment, the Nth-1 circuit part corresponding to the last stage among the N circuit parts comprises an Nth-1 order controller and an Nth-1 order processing engine, and the transform operation of the Nth-1 stage comprises:

[0046] The Nth-1 order controller sequentially reads n / 2 data pairs from n / 2 addresses in the memory of the Nth-2 stage;

[0047] The Nth-1 order processing engine sequentially performs a butterfly operation of base 2 on the n / 2 data pairs respectively, and sequentially outputs n / 2 result pairs.

[0048] In one embodiment, the 0th circuit part corresponding to the first stage or the Nth-1 circuit part corresponding to the last stage among the N circuit parts has the same hardware structure as the ith circuit part and performs the same transform operation.

[0049] In one embodiment, the target transform is a fast Fourier transform FFT, an inverse fast Fourier transform IFFT, a fast number theory transform NTT, an inverse fast number theory transform INTT, an NTTP transform obtained by fusing pre-processing and NTT in negative wrap-around convolution NWC, or an INTTP transform obtained by fusing INTT and post-processing in NWC; and the transform operation of the N stages is performed in a time decimation DI T form or a frequency decimation DI F form.

[0050] According to a second aspect, there is provided an acceleration hardware for performing a target transform comprising transform operations of N stages, the acceleration hardware comprising N circuit parts corresponding to the N stages, wherein any ith stage which is not the first or last stage corresponds to an ith circuit part comprising a controller, a processing engine, a memory, and first and second rearrangement units; in the transform operation of the ith stage:

[0051] The controller is configured to read a first data pair and a second data pair from a first readout address and a second readout address in the memory of the ith-1 stage respectively;

[0052] The first rearrangement unit is configured to perform a first rearrangement operation on the first and second data pairs, and sequentially output a third data pair and a fourth data pair;

[0053] The processing engine is configured to sequentially perform a butterfly operation of base 2 on the third data pair and the fourth data pair respectively, and sequentially output a first result pair and a second result pair;

[0054] The second rearrangement unit is configured to perform a second rearrangement operation on the first result pair and the second result pair to obtain a fifth data pair and a sixth data pair.

[0055] The controller is further configured to write the fifth data pair and the sixth data pair into a first write address and a second write address in the memory of the i-th stage, respectively.

[0056] In one embodiment, the first rearrangement unit comprises a first register, a second register, a first multiplexer, a second multiplexer, and a multiplexer control unit,

[0057] An input of the first multiplexer and an input of the second multiplexer both receive a first data of a currently read data pair,

[0058] The first register receives and temporarily stores a second data of the currently read data pair, and an output of the first register is coupled to another input of the first multiplexer and another input of the second multiplexer,

[0059] An output of the first multiplexer is coupled to an input of the second register,

[0060] The second register outputs a first data of a currently rearranged data pair, and the second multiplexer outputs a second data of the currently rearranged data pair, and

[0061] The multiplexer control unit is configured to control the first multiplexer and the second multiplexer to alternately select one of their two inputs as an output.

[0062] In one embodiment, the multiplexer control unit comprises a third register, a fourth register, and an inverter,

[0063] An output of the third register is coupled to a control terminal of the first multiplexer, an input of the fourth register, and an input of the inverter,

[0064] An output of the fourth register is coupled to a control terminal of the second multiplexer,

[0065] An output of the inverter is coupled to an input of the third register.

[0066] In one embodiment, the first rearrangement unit and the second rearrangement unit have the same hardware structure.

[0067] In one embodiment, the processing engine includes a modulo multiplication unit including first, second, and third integer multipliers, wherein the first integer multiplier is implemented using a digital signal processor (DSP) and the second and third integer multipliers are implemented using look-up tables (LUTs).

[0068] According to a third aspect, there is provided a polynomial multiplier receiving an n-point first input sequence and an n-point second input sequence and outputting an n-point polynomial multiplication output sequence; the polynomial multiplier comprising a first transform module, a second transform module, a point-wise multiplication hardware module, and a third transform module, wherein the first transform module, the second transform module, and the third transform module each comprise the acceleration hardware as described in the second aspect;

[0069] The first transform module is configured to perform NTTP on the first input sequence in DIF form and output a first output sequence;

[0070] The second transform module is configured to perform NTTP on the second input sequence in DIF form and output a second output sequence;

[0071] The point-wise multiplication hardware module is configured to perform point-wise multiplication on the first and second output sequences and output a third output sequence;

[0072] The third transform module is configured to perform INTTP on the third output sequence in DIT form and output the n-point polynomial multiplication output sequence.

[0073] In embodiments of the present specification, a method of performing a target transform by acceleration hardware and corresponding acceleration hardware are proposed. A controller, a processing engine, a memory, and first and second rearrangement units are provided in an i-th circuit portion corresponding to an i-th stage which is not a first or last stage in the acceleration hardware. A pair of data is stored in one address in the memory, and switching between the pair of data stored in the memory and a pair of data calculated by the butterfly operation in the processing engine is performed by the first and second rearrangement units, so that mismatch between the two is eliminated. This achieves an efficient data flow which can unify the speed of the calculation unit and the memory, thereby improving the utilization of the calculation unit and the performance of the overall transform. BRIEF DESCRIPTION OF DRAWINGS

[0074] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can also be obtained without creative labor based on these drawings.

[0075] Figure 1A schematic diagram of the structure of dedicated acceleration hardware for performing a DIT-type target transformation according to one embodiment is shown;

[0076] Figure 2 A flowchart is shown for a pair of butterfly operations in an arbitrary intermediate stage i-th stage of a method for performing a target transformation by accelerating hardware, according to one embodiment;

[0077] Figure 3 A data flow diagram (butterfly diagram) of a 16-point DIT NTT according to one embodiment is shown, in which the address access order of each stage, the butterfly cell calculation order and the access address of each data are marked;

[0078] Figure 4 A schematic diagram of the structure of a first rearrangement unit in acceleration hardware according to one embodiment is shown;

[0079] Figure 5 A schematic diagram of the structure of a processing engine in acceleration hardware according to one embodiment is shown;

[0080] Figure 6 A schematic diagram of the structure of a polynomial multiplier according to one embodiment is shown. Detailed Implementation

[0081] The solution provided in this specification will now be described with reference to the accompanying drawings.

[0082] NTT will use polynomials coefficient a i Convert to A i INTT is its inverse operation. In mainstream post-quantum cryptography schemes, NTT and INTT are usually defined on a polynomial ring. Furthermore, the negative wrapped convolution (NWC) method is used to reduce the additional computational cost caused by zero padding in polynomial multiplication.

[0083] The following pseudocode illustrates the operation of NWC, which provides an efficient method for calculating polynomial products c(x).

[0084]

[0085] Where a(x) and b(x) are The polynomials in the expression have coefficients a, b, c, and d. n-1 to a0 and b n-1 up to b0, where a i ,b i ∈[0,q). Polynomial multiplication of a(x) and b(x) yields a polynomial c(x) with n coefficients.

[0086] As shown in the pseudo code above, when performing polynomial multiplication, the NTT and INTT operations are performed in step 3, and the pre-processing shown in steps 1 and 2 is performed before the NTT operation, and the post-processing shown in step 4 is performed after the INTT operation.

[0087] To speed up the operation, the pre-processing step can be integrated into the NTT, and the post-processing step can be integrated into the INTT.

[0088] For simplicity, the embodiments of the present disclosure introduce NTTP to represent the transformation obtained by fusing the pre-processing with the NTT in the NWC, and introduce INTTP to represent the transformation obtained by fusing the INTT with the post-processing in the NWC, as shown in the following equations (1) and (2) respectively:

[0089]

[0090] where ω n is the n-th unit primitive root on F , which satisfies Ψ 2n is the 2n-th unit primitive root on F

[0091] It can be seen that the algorithm principle of the NTTP is consistent with that of the NTT, except that there is an additional pre-processing factor in the multiplication factor. The NTT is a FFT variant of the finite field, which has an additional modulo operation compared to the FFT, but the algorithm principle is consistent with that of the FFT in the discrete form. Similarly, the algorithm principle of the INTTP, as well as the INTT, IFFT, and other inverse transformations, is consistent with that of the NTTP, and the main difference is the factor in the multiplication and the final multiplication by the constant 1 / n. Such transformations can all be implemented using the same data flow graph (butterfly graph). Therefore, the same hardware architecture can be used to speed up the operation of such transformations.

[0092] Therefore, the discussion about the embodiments of the present disclosure is applicable to all the above-mentioned transformations, as well as other transformations with consistent or similar algorithm principles. Therefore, in the discussion of the present disclosure, the target transformation can be used as a general term when referring to a general scheme or a general operation in the scheme. The target transformation is a discrete transformation or its inverse transformation that transforms an input coefficient sequence into an output coefficient sequence, which can be converted into a butterfly operation of N stages.

[0093] Currently, some algorithms have been proposed, such as the Decimation-In-Time (DIT) method or the Decimation-In-Frequency (DIF) method, which convert an n-point target transformation into a butterfly operation of order 2 NThe special-purpose accelerator for performing the target transformation can be implemented using a spatial parallel architecture or a pipelined architecture, etc. However, the existing accelerator solutions are insufficient in the design of data storage and reading, and the efficiency of data storage and reading is still insufficient, and thus the performance of the target transformation needs to be further improved.

[0094] In addition, in some cases, in order to adapt to the changes of various security parameters in the standardization process of the PQC solution, the scalability of the accelerator for performing the target transformation is of great significance. At present, some scalable accelerator architectures are proposed, however, the versatility of some of the accelerators is poor, the read / write address calculation rules of the data are different from each other when calculating stage by stage, and a data selection logic with the same number of groups as the total order needs to be set, which cannot be conveniently set for any order; or, the control unit of some accelerators is relatively complex, occupies a large area other than calculation, and the utilization rate of the calculation unit in some architectures is low, and thus it is a challenge to have both good hardware efficiency and scalability.

[0095] Therefore, in the embodiments of the present disclosure, a scheme of hardware acceleration of target transformation is proposed. In the scheme, the execution of the target transformation is accelerated by paired storage and rearrangement of data, and the performance of the target transformation is improved.

[0096] Specifically, since the butterfly operation needs to process a pair of data each time, the input data and the output data are paired (hereinafter also referred to as a calculation pair), and the memory can only perform one read / write operation in one clock cycle, therefore, the scheme of the embodiments of the present disclosure proposes to store a pair of data (hereinafter also referred to as a storage pair) in one storage address in the memory, so that 2 data can be processed at the same time each time reading and writing, thereby keeping the data flow speed of the storage access and the calculation consistent, and improving the efficiency of the transformation operation execution. This is particularly advantageous for the acceleration hardware of the pipelined architecture, because the memory access and the butterfly operation in the processing engine can be performed in pairs on the pipeline at the same time, and the pipeline can be easily filled completely, and all stages of the pipeline can run at the same time.

[0097] In addition, the embodiments of the present disclosure find that, although there is no direct correspondence between the storage pair of the previous stage and the calculation pair of the current stage in each non-first-and-last stage (i.e. the intermediate stage) in the N-order butterfly operation, the two storage pairs in the two addresses with a preset relationship can be rearranged to obtain two input calculation pairs of two butterfly operations, and then the two output calculation pairs of the two butterfly operations can be rearranged and stored for the convenience of reading in the next stage. It can be understood that, in the present disclosure, "rearrangement" refers to rearranging two pairs of data, so that one data is extracted from each of the two pairs of data to form a new pair of data, and the other data remaining in each of the two pairs of data forms another new pair of data.

[0098] Therefore, the scheme of the embodiments of the present specification introduces two reordering units in each intermediate stage, wherein the first reordering unit is located before the processing engine for butterfly operation, for reordering the 2 storage pairs read from the previous stage into 2 computation pairs as the input data pairs of the 2 butterfly operations respectively, and the second reordering unit is located after the processing engine, for reordering the 2 computation pairs as the output data pairs of the 2 butterfly operations into 2 storage pairs to be respectively stored in the 2 addresses in the memory of the current stage for the next stage to read to continue the subsequent transform operation. Thus, by reordering the data pairs read from the memory or about to be written into the memory through the first and second reordering units, the mismatch between the data pairs in the memory and the data pairs for computation can be eliminated.

[0099] Based on the above-mentioned paired storage access and reordering operation, the scheme of the embodiments of the present specification realizes an efficient data flow which can unify the speed of the computation unit and the memory, thereby improving the utilization rate of the computation unit.

[0100] In addition, as will be described in detail later, in some embodiments, the data flow control is simple, which effectively reduces the hardware resources occupied by the control logic.

[0101] In addition, in some embodiments, a grouped paired storage access mode is proposed to realize the control of the data flow, which ensures that the control logic in each stage is consistent, thus having good scalability and being able to support various polynomial lengths and data bit widths.

[0102] The scheme of the embodiments of the present specification will be described in detail below mainly taking the NTT in the form of DIT as an example. As mentioned above, the NTT, INTT, FFT, IFFT, and INTTP, etc. can all adopt the same hardware architecture, the main difference being the factor in multiplication and multiplication with the constant 1 / n. Based on the description of the inventive concept, technical details, etc. of each embodiment in the present specification, those skilled in the art can easily understand the corresponding settings or modifications for various types of target transforms, and therefore the following will not be described one by one.

[0103] Figure 1 A structural schematic diagram of the special-purpose acceleration hardware for performing the target transform in the form of DIT according to one embodiment is shown, wherein the target transform includes transform operations of N stages.

[0104] As shown in Figure 1 To accelerate the execution of the target transform in the form of DIT, in the embodiments of the present specification, the special-purpose acceleration hardware is designed to include N circuit parts corresponding to the N stages, wherein any ith circuit part corresponding to an ith stage of the non-first and non-last stages includes a controller, a processing engine, a memory, and first and second reordering units.

[0105] In the following, the i-th stage can also be referred to as an intermediate stage, 0 < i < N-1. That is, Figure 1 The intermediate stages in the DIT form, i.e. stages 1 to N-2, all have the same hardware structure, for the sake of simplicity, Figure 1 The hardware structure of stage 2 onwards is omitted in the DIT form. The hardware structure of the last stage, i.e. stage N-1, is also basically omitted in the DIT form, because in the DIT form of acceleration hardware, the circuit part of stage N-1 has the same hardware structure as the circuit part of the intermediate stages, and performs the same transform operation. Figure 1 The memory of stage N-1 is marked with "output" in the DIT form to emphasize that what is stored therein is the final output result of the target transform. In some cases, the output memory of stage N-1 can also be omitted, i.e. the final output result is not stored but directly output to the outside, or directly output to the subsequent other processing circuit. Figure 1

[0106] As shown in Fig. 1, Figure 1 The circuit part corresponding to the first stage, i.e. stage 0, in the DIT form of acceleration hardware only includes a controller, a processing engine and a memory, without a rearrangement unit. An input memory (marked with "input" in Fig. 1) can also be provided to store the input sequence arranged in bit-reversed order. For example, for an n-point input sequence, n = 2 N The n / 2 input data pairs each consisting of two adjacent data arranged in bit-reversed order can be first arranged in bit-reversed order, and then stored in the input memory in the order of the n / 2 consecutive addresses. Figure 1

[0107] The solid arrows in Fig. 1 represent data flow, and the dashed arrows represent control signals, with ① representing a read control signal, ② representing a write control signal, and ③ representing an enable control signal. As shown in Fig. 1, Figure 1 In stage 0, the controller can control the read operation of the input memory and the write operation of the memory of stage 0, and generate the enable signal of the processing engine. Figure 1 Under the control of the controller of stage 0, the transform operation of stage 0 can be performed as follows:

[0108] The controller of stage 0 reads the n / 2 input data pairs in the order of the n / 2 addresses of the input memory,

[0109] The processing engine of stage 0 performs the butterfly operation of base 2 on the n / 2 input pairs read in the order, respectively, and outputs the n / 2 result pairs in the order;

[0110]

[0111] ​​The controller of the stage 0 writes the n / 2 result pairs in turn and sequentially in the continuous n / 2 addresses in the memory of the stage 0.

[0112] As shown in the data flow diagram of the 16-point DIT NTT, the 16-point DIT NTT includes 4 stages (stage 0 to stage 3) of transform operations, wherein in the stage 0, the 16-point input sequence arranged in bit-reversed order has been stored in the input memory in turn and sequentially in the addresses A0 to A7 for every 2 adjacent input data. Figure 3 As shown in the address access sequence below, in the stage 0, the 8 input pairs are read in turn and sequentially in the addresses A0 to A7, and as shown in the sequence numbers marked in the upper right corner of each butterfly unit in Figure 3 As shown in the address access sequence below, in the stage 0, the 8 input pairs are read in turn and sequentially in the addresses A0 to A7, and as shown in the sequence numbers marked in the upper right corner of each butterfly unit in Figure 3 As shown in the address access sequence below, in the stage 0, the 8 input pairs are read in turn and sequentially in the addresses A0 to A7, and as shown in the sequence numbers marked in the upper right corner of each butterfly unit in

[0113] In addition, in each address corresponds to two adjacent rows of data (represented by a gray band), which means that the reading / writing addresses of the data in each stage are the corresponding addresses marked on the left. Figure 3 As shown in the address access sequence below, in the stage 0, the 8 input pairs are read in turn and sequentially in the addresses A0 to A7, and as shown in the sequence numbers marked in the upper right corner of each butterfly unit in Figure 3 As shown in the address access sequence below, in the stage 0, the 8 input pairs are read in turn and sequentially in the addresses A0 to A7, and as shown in the sequence numbers marked in the upper right corner of each butterfly unit in

[0114] In some cases, the input memory of the stage 0 is not necessary, that is, the input data is not stored, but directly received from the outside or other processing circuits in front. At this time, the n / 2 input pairs directly received can be sequentially executed by the processing engine of the stage 0, and the n / 2 result pairs are sequentially output, and the n / 2 result pairs are sequentially written by the controller of the stage 0 in the continuous n / 2 addresses in the memory of the stage 0. The n / 2 input pairs stored in the input memory in sequence are the same as the n / 2 input pairs.

[0115] Returning to Figure 1 In any one of the subsequent intermediate stages, in the i-th stage, as described above, in order to match the storage pairs with the calculation pairs and keep the data flow speed of the storage access and the calculation consistent, the scheme of the embodiments of the present application is to process the butterfly operation in pairs. That is, the transform operation of the i-th stage can be divided into n / 4 pairs of butterfly operation processing, wherein the flow of any one pair of butterfly operation processing can include the following steps as shown in Figure 2

[0116] Step S21, the controller reads the first data pair and the second data pair from the first readout address and the second readout address in the memory of the i-1th stage, respectively;

[0117] ​Step S22, the first reordering unit performs a first reordering operation on the first and second data pairs, and outputs a third data pair and a fourth data pair in sequence;

[0118] Step S23, the processing engine performs a radix-2 butterfly operation on the third data pair and the fourth data pair in sequence, and outputs a first result pair and a second result pair in sequence;

[0119] Step S24, the second reordering unit performs a second reordering operation on the first and second result pairs, and obtains a fifth data pair and a sixth data pair;

[0120] Step S25, the controller writes the fifth data pair and the sixth data pair into a first write address and a second write address in the memory of the i-th stage, respectively.

[0121] The controller, the processing engine, and the first and second reordering units belong to the circuit part of the i-th stage.

[0122] The above five steps can be regarded as five sub-stages: reading data, first reordering operation, processing engine operation, second reordering operation, and writing data, as shown by the five sub-stages of data flow in the solid arrows in stages 1 or 2 in Figure 1 .

[0123] An example of the circuit part of the i-th stage in any intermediate stage is described in detail taking stage 1 as an example, as shown in Figure 1 , which includes a first reordering unit 11, a processing engine 12, a second reordering unit 13, a memory 14, and a controller 15.

[0124] The memory 14 can be a random access memory (RAM) for storing the calculation results of the current stage in pairs, i.e., one address stores one data pair. For example, two data of a storage pair can be spliced into one data and stored in one address of the memory 14. The memory 14 can store n results obtained by transforming an n-point input sequence through the first stage in pairs through consecutive n / 2 addresses.

[0125] In Figure 1 , the gray half of the memory 14 represents the sub-stage of reading data in the next stage, and the white half of the memory 14 represents the sub-stage of writing data in the current stage. For example, the memory 14 can be a dual-port RAM, which can perform reading and writing operations simultaneously in one clock cycle as long as the addresses for reading and writing are not the same, thus ensuring that the two sub-stages of reading and writing data can run simultaneously in pipeline operation.

[0126] As shown in Figure 1As shown, the controller 15 controls the read operation of the previous stage memory and the write operation of the current stage memory, and generates the enable signals of the first rearrangement unit 11, the processing engine 12 and the second rearrangement unit 13.

[0127] The data flow of the above five sub-stages can be realized in stage 1 through the control of controller 15.

[0128] In some examples, the same control logic can be used to process any q-th pair of butterfly operations in any intermediate stage at the i-th order. For an N-order transformation of the form DIT, the control logic of the last order can also be the same as that of the intermediate stages.

[0129] For example, for any i-th order, where the two read addresses read from the memory of the previous order and the two write addresses written to the memory of the current order are the same in each pair of butterfly operations, and the n / 4 pairs of butterfly operations for the entire stage can be implemented using the following grouped pairwise memory access (read / write) method:

[0130] The input / output data of this stage can be divided into multiple groups by grouping the input / output data of the interlaced butterfly units in the N-order data flow graph (butterfly graph) of the target transformation. Within each group, the input / output data is further divided into upper and lower halves. These groups are read / written sequentially from top to bottom. Within any group, adjacent pairs of input / output data in the upper and lower halves are read / written alternately from top to bottom. All groups within a stage are accessed in the same way, and the next group is accessed only after the previous group has been accessed.

[0131] by Figure 3 Taking a 16-point DIT NTT data flow diagram as an example. For example, in stage 2, the first four butterfly units are interleaved, thus forming the first group, and the last four butterfly units are interleaved, thus forming the second group. The data within any group is further divided into upper and lower halves. For example, in the first group, the data at addresses A0 and A1 is the upper half, and the data at addresses A2 and A3 is the lower half. The address access order in stage 2 is: first access the first group, then access the second group. Within both the first and second groups, the upper and lower halves of the data are accessed alternately from top to bottom. From this, it can be deduced that... Figure 3 The specific address access order is shown below.

[0132] The execution order of each butterfly operation process in stage 2 is also marked by the numbers in the upper right corner of the figure, from 0 to 7. Every two successive butterfly operation processes are the aforementioned pair of butterfly operation processes. For example, the 0th butterfly unit and the 1st butterfly unit are processed in pairs, and their two calculation pairs respectively correspond to the rearrangement of two storage pairs in addresses A0 and A2. The calculation pair of the 0th butterfly unit corresponds to the upper half data of the two storage pairs in addresses A0 and A2 respectively, and the calculation pair of the 1st butterfly unit corresponds to the lower half data of the two storage pairs in addresses A0 and A2 respectively.

[0133] As Figure 3 shown, the data stream implemented in the embodiments of this specification processes data in pairs through two pairing methods. One pairing method is the storage pair, which is composed of every two adjacent rows of data from top to bottom in each stage in Figure 3 . One storage pair is stored at one address in the memory. The other pairing method is the calculation pair, which is composed of two input data or output data of the processing engine or the butterfly unit. The first and second rearrangement units can switch between the two pairing modes by rearranging the data, so that both the memory and the processing engine can operate according to their respective pairing modes.

[0134] According to the above description, it can be deduced that for the i-th order (0 < i, that is, non-first order) in any N orders, in any pair of butterfly operation processes, the second read / write address is the first read / write address plus 2 to the power of i - 1. For example, Figure 2 the second read address and write address in the shown process are the first read address and write address plus 2 to the power of i - 1 respectively.

[0135] In addition, it can be deduced that for the i-th order (0 < i, that is, non-first order) in any N orders, its n / 2 addresses can be sequentially divided into 2 to the power of N - i - 1 groups. And there is the following relationship between the access addresses of two successive pairs of butterfly operation processes:

[0136] If the second read / write address of the current pair is the last address in its group, the first read / write address of the next pair is the second read / write address of the current pair plus 1; otherwise, it is the first read / write address of the current pair plus 1. As mentioned above, the second read / write address of the next pair is the first read / write address of the next pair plus 2 to the power of i - 1.

[0137] From this, the following formula can be deduced to obtain the entire address access order of the i-th stage:

[0138] Addr ij= ((j >> i) << i) + ((j % 2) << (i - 1)) + ((j % 2 i ) >> 1)

[0139] where Addr ij is the address of the j-th access (read / write) within the i-th stage, i ∈ {1, 2, …, N - 1}, j ∈ {0, 1, …, n / 2 - 1}. For the first read / write address in any q-th pair of butterfly operation processes, j = 2q, and for the second read / write address in any q-th pair of butterfly operation processes, j = 2q + 1.

[0140] For the operators in the above formula, "j >> i" means shifting j to the right by i bits, "j << i" means shifting j to the left by i bits, and the vacated bits are filled with 0s, while "j % 2" means taking the modulus of j by 2, i.e., the remainder of j divided by 2.

[0141] Thus, in the above embodiment solution, the control logic of the data stream is simple, and the control logic of each stage in each order is consistent, so it has good scalability.

[0142] In some examples, the acceleration hardware shown can be run in a pipelined manner. Figure 1 Therefore, after the pipeline is filled, all sub-stages of all stages can run simultaneously, that is Figure 1 all hardware units in can run simultaneously. Figure 1 Some hardware units in, such as the first and second rearrangement units and the processing engine, can also be implemented using a pipeline architecture.

[0143] Still taking Figure 1 the stage 1 in as an example to specifically describe the pipeline operation.

[0144] The aforementioned Figure 2 step S21 (sub-stage 1) in can be executed by the controller 15 within two consecutive clock cycles. For example, in the 1st clock cycle, the controller 15 reads the first data pair from the first read address of the memory in the previous stage (stage 0) and inputs it to the first rearrangement unit 11. At this time, the first rearrangement unit 11 receives the first data pair; in the 2nd clock cycle, the controller 15 reads the second data pair from the second read address of the memory in stage 0 and inputs it to the first rearrangement unit 11. At this time, the first rearrangement unit 11 receives the second data pair.

[0145] After the first rearrangement unit 11 receives the first data pair in the aforementioned 1st clock cycle, the first rearrangement unit 11 can execute the aforementioned Figure 2Step S22 (sub-stage 2) in the above. For example, in the second clock cycle, the first rearrangement unit 11 temporarily stores the first data pair; in the third clock cycle, the first rearrangement unit 11 temporarily stores the second data in the second data pair and outputs the first data in the first data pair and the first data in the second data pair as the third data pair, at which time the processing engine receives the third data pair; in the fourth clock cycle, the first rearrangement unit outputs the second data in the first data pair and the second data in the second data pair as the fourth data pair, at which time the processing engine receives the fourth data pair.

[0146] In some examples, the first rearrangement unit 11 may have, for example: Figure 4 The hardware structure shown.

[0147] like Figure 4 As shown, the first rearrangement unit 11 includes a first register R1, a second register R0, a first multiplexer M0, a second multiplexer M1, and a multiplexing control unit, wherein the multiplexing control unit outputs control signals f0 and f1 to control the first multiplexer M0 and the second multiplexer M1 to alternately select one of their two inputs as the output.

[0148] One input of the first multiplexer M0 and one input of the second multiplexer M1 both receive the first data d0 from the currently read data pair. Figure 4 In this example, both input terminals are the input terminals corresponding to "0", that is, the terminal that will be selected for output when the control signal of the multiplexer is 0. However, this is only an example and not a limitation. Those skilled in the art can make any modifications as needed and change the control signal of the multiplexer accordingly.

[0149] The first register R1 receives and temporarily stores the second data d1 from the currently read data pair in the next clock cycle. The output of the first register R1 is coupled to another input of the first multiplexer M0 and another input of the second multiplexer M1. Figure 4 The middle part is the input terminal corresponding to "1".

[0150] The output of the first multiplexer M0 is coupled to the input of the second register R0.

[0151] The second register R0 outputs the first data x0 in the currently rearranged data pair, and the second multiplexer M1 outputs the second data x1 in the currently rearranged data pair.

[0152] Therefore, the first register R1 is used to directly store the input data d1, and the second register R0 is used to store another input data d0 or to store the data stored in R1 in the previous clock cycle.

[0153] Figure 4 The multiplexing control unit includes a third register F0, a fourth register F1, and an inverter Inv1, but this is merely exemplary and not restrictive, and those skilled in the art can make any modifications as needed.

[0154] The output of the third register F0 is coupled to the control terminal of the first multiplexer M0, the input terminal of the fourth register F1, and the input terminal of the inverter Inv1. The third register F0 outputs the control signal f0.

[0155] The output of the fourth register F1 is coupled to the control terminal of the second multiplexer M1. The fourth register F1 outputs the control signal f1.

[0156] The output of inverter Inv1 is coupled to the input of the third register F0.

[0157] After the multiplexing control unit is running stably, it can output two control signals f0 and f1 that are inverted within one clock cycle, and invert f0 and f1 once in each subsequent clock cycle.

[0158] pass Figure 4 The first rearrangement unit 11 shown can perform the aforementioned operations over three consecutive clock cycles as follows. Figure 2 Step S22 (sub-stage 2):

[0159] In the second clock cycle, d0 and d1 of the first data pair are temporarily stored in the second register R0 and the first register R1, respectively.

[0160] In the third clock cycle, d1 of the second data pair is temporarily stored in the first register R1, and the second register R0 outputs d0 of the first data pair as x0. The second multiplexer M1 outputs d0 of the second data pair as x1. At this time, the output x0 and x1 constitute the third data pair. The second register R0 temporarily stores d1 of the first data pair stored in the first register R1 in the second clock cycle.

[0161] In the fourth clock cycle, the second register R0 outputs d1 from the first data pair as x0, and the second multiplexer M1 outputs d1 from the second data pair stored in the first register R1 in the third clock cycle as x1. At this time, the output x0 and x1 constitute the fourth data pair.

[0162] Next, after the processing engine 12 receives the third data pair in the third clock cycle, the processing engine 12 can begin executing the aforementioned... Figure 2In step S23 (sub-stage 3), the first step involves performing a radix-2 butterfly operation on the third data pair. After t clock cycles (i.e., in the (t+3)th clock cycle), the first result pair is output to the second rearrangement unit 13. After the processing engine 12 receives the fourth data pair in the aforementioned fourth clock cycle, the second step can begin: performing a radix-2 butterfly operation on the fourth data pair. After t clock cycles (i.e., in the (t+4)th clock cycle), the second result pair is output to the second rearrangement unit 13. Here, t clock cycles represents the time required for one butterfly operation.

[0163] For NTT, each butterfly operation includes modular addition, modular subtraction, and modular multiplication, which typically requires multiple clock cycles to complete the calculation, i.e., t>1. However, the processing engine 12 can also adopt a pipelined circuit architecture, so the two butterfly operations can be started in two consecutive clock cycles as described above.

[0164] In one example, processing engine 12 may have, for example: Figure 5 The assembly line structure shown.

[0165] like Figure 5 As shown, the processing engine 12 uses a five-stage pipeline to process butterfly operations, where the first four stages of the pipeline calculate modular multiplication using the Shoup algorithm, and the fifth stage calculates modular addition and modular subtraction. Figure 5 The first four stages of the pipeline circuit can be regarded as a modular multiplication unit, which includes three integer multipliers. The first integer multiplier is implemented using a digital signal processor (DSP), while the second and third integer multipliers are implemented using a lookup table (LUT). This optimizes the critical path and yields better synthesis results.

[0166] In addition, such as Figure 5 As shown, the rotation factor (shown in the figure is the rotation factor used for NTTP) and parameter m are pre-stored in the read-only memory (ROM) of the processing engine 12.

[0167] Therefore, adopt Figure 5 The processing engine 12 of the structure requires 5 clock cycles to complete one butterfly operation, that is, t=5 as mentioned above.

[0168] Next, after the second rearrangement unit 13 receives the first result pair in the aforementioned (t+3)th clock cycle, the second rearrangement unit 13 can execute the aforementioned process over three consecutive clock cycles. Figure 2the first result pair in the second result pair and the first result pair as the fifth data pair, at which time the memory 14 receives the fifth data pair; at the t+6th clock cycle, the second reordering unit 13 outputs the second result pair and the second result pair as the sixth data pair, at which time the memory 14 receives the sixth data pair.

[0169] The above-mentioned operation of the second reordering unit 13 is the same as the operation of the first reordering unit 11 as previously described, except that the data pairs being processed are different. Therefore, the second reordering unit 13 can have the same hardware structure as the first reordering unit 11, such as the hardware structure shown in Fig. 2, and will not be described again here. Figure 4

[0170] Next, after the memory 14 receives the fifth data pair at the t+5th clock cycle as previously described, the memory 14 can be controlled by the controller 15 to perform the step S25 (sub-phase 5) in the above-mentioned process S2 in the next 2 consecutive clock cycles. For example, at the t+5th clock cycle, the controller 15 writes the fifth data pair to the first write address of the memory 14; at the t+6th clock cycle, the controller 15 writes the sixth data pair to the second write address of the memory 14. Figure 2

[0171] All the butterfly operation processes in a phase can be sequentially processed in the above-mentioned pipelining manner, in which the partial operations of 2 consecutive pairs of butterfly operation processes are performed simultaneously. For example, at the 3rd and 4th clock cycles as previously described, the controller 15 can then read the corresponding 2 data pairs from the next pair of butterfly operation processes corresponding to the third and fourth readout addresses, and sequentially run according to the above-mentioned pipelining procedure, which will not be described again here.

[0172] ​​In addition, in the pipeline, all N stages can run simultaneously, but there is an initial delay in the i-th stage because the results of the computation in the previous stage need to be read. In the case of the aforementioned grouped pair memory access (read / write) scheme, the i-th stage can start the first read operation only after the i-1-th stage has finished the computation of the first group of butterfly cells and has written their results into the memory. Thus, in response to the completion of the write of the data in all addresses of the first group in the i-1-th stage, the controller of the i-th stage starts the first read operation of the stage in the next first clock cycle, reading the first pair of data from the first read address of the memory of the i-1-th stage. According to the aforementioned control logic and data flow description, in the next first clock cycle, the i-1-th stage has just finished the write operation at the second read address in the address access sequence of the i-th stage, so the controller of the i-th stage can just start the second read operation of the stage in the next second clock cycle, reading the second pair of data from the second read address of the memory of the i-1-th stage. Only the first read operation has to wait, the following read operations do not have to wait. In this way, the efficiency of the pipeline can be maximized.

[0173] Algorithm 1, written in pseudo code below, illustrates a complete pipeline DIT NTTP N-point transform operation. The algorithm uses the aforementioned grouped pair memory access scheme. In order to describe the behavior of the registers in the pseudo code of Algorithm 1, i.e. to indicate that the value in a register (obtained in the previous sub-stage) is used first in the following sub-stage, the first sub-stage is placed at the bottom and the code segments of the sub-stages are enabled from bottom to top according to their condition.

[0174] The pipeline operation represented by the pseudo code has been described in detail above and will not be described again here.

[0175] In addition, it can be understood that, since Algorithm 1 describes the NTTP, the rotation factor of the butterfly cell executed the j-th time in the i-th stage is:

[0176]

[0177] wherein and k2=2 N-1-i .

[0178] If Algorithm 1 is used for other transforms, the value of the rotation factor can be changed adaptively, and for the inverse transform, a multiplication by 1 / n is also added.

[0179]

[0180]

[0181] The algorithm described above can bring an efficient data flow, so that the memory access and the butterfly operation in the processing engine can be performed simultaneously in pairs in the pipeline, and the speed of storage access and calculation remains consistent. The processing engine can receive two input data of a butterfly unit and generate two output data of a butterfly unit in each clock cycle, and all butterfly units in a stage are calculated by the processing engine in a predetermined order.

[0182] The data flow can process a continuous n-point target transform using an average processing period of n / 2. As described above, when the i-1th stage completes the calculation of the first group of butterfly units and writes the results to the memory, the i th stage can start the first read operation, thereby introducing a pipeline delay of 2 i-1 -1 cycles between the adjacent two stages. In addition, the delay within the 0th stage is 7, and the fixed delay within the subsequent stages is 9, so the total pipeline delay of the data flow of the target transform can be obtained by the following formula:

[0183]

[0184] The above-mentioned DIT NTT / NTTP acceleration hardware structure proposed by the embodiments of the present specification can be synthesized and implemented on various FPGA platforms. Table 1 below provides a comparison between the embodiments of the present specification and the prior art in terms of detailed information about the results of hardware implementation, including resource consumption, performance indicators (frequency, delay, throughput), and area-time product as an indication of hardware efficiency. The BRAM and DSP in the FPGA are converted into an equivalent number of slices to evaluate the area. The delay reflects the speed of processing the NTT operation, and the lower the delay, the faster the calculation speed. Since the embodiments of the present specification are pipeline designs, the ideal application scenario is to process continuous NTT operations, so the average delay of processing 100 continuous NTT operations is given in the comparison results. The area-time product is an indicator that considers both hardware resource consumption and calculation speed, and the lower the area-time product, the better the hardware efficiency.

[0185]

[0186] The data of each prior art in Table 1 for comparison are from the corresponding journal of a certain year described in the design name thereof.

[0187] As can be seen from Table 1, compared with the current mainstream NTT accelerator, the NTT structure proposed by the embodiments of the present specification achieves a speed improvement of up to 4.8 times and an area-time product improvement of up to 4.3 times.

[0188] The embodiments of the present specification achieve a good balance between performance and resource utilization, and obtain high hardware efficiency.

[0189] The whole circuit structure and operation flow of the embodiment of the present specification is described above by taking the DIT form as an example, and the circuit structure and operation flow of the DIF form can be obtained by appropriately transforming the DIT form.

[0190] The topology of each stage in the DIF form is opposite to that of the DIT form, that is, the i-th stage of the DIF form corresponds to the N-1-i-th stage of the DIT form. Therefore, the acceleration hardware structure of the DIT form shown in FIG. 1 is horizontally flipped to obtain the acceleration hardware structure of the DIF form. Figure 1

[0191] The first stage, stage 0, of the DIF form corresponds to the N-1-th stage in the DIT form, and therefore has the same hardware structure as the circuit part of the intermediate stage in the DIT form and performs the same transformation operation. Figure 1 Figure 1 The N-1-th stage of the DIF form corresponds to the 0-th stage in the DIT form, and therefore the circuit part of the N-1-th stage only includes the N-1-th controller and the N-1-th processing engine without the need of a rearrangement unit. Accordingly, the transformation operation of the N-1-th stage includes: the N-1-th controller sequentially reading out n / 2 data pairs from n / 2 addresses in the memory of the N-2-th stage in order; and the N-1-th processing engine sequentially performing the radix-2 butterfly operation on the n / 2 data pairs respectively and outputting n / 2 result pairs in order.

[0192] For each intermediate stage of the DIF form, the circuit part thereof is the same as that of the DIT form in the DIT form, except that i in the foregoing calculation formulas is replaced by N-i-1 in the control logic. For example, in the transformation operation of the i-th stage of the DIF form, the n / 2 addresses are sequentially divided into 2i power groups, and the second read-out address and the write-in address in the second butterfly operation processing are the first read-out address and the write-in address plus 2N-i-2 power, respectively. Figure 1

[0193] In addition, the processing engine of the DIF form performs the modular multiplication after the modular addition and the modular subtraction. Figure 1 Since the pipeline structure proposed by the embodiment of the present specification can generate two outputs in each cycle, a pipeline polynomial multiplier can be implemented based on the embodiment of the present specification, which only needs to input two polynomials into two parallel NTTP units and pass the result thereof to an INTTP unit through a point-by-point multiplication unit of two data implemented by the Barrett algorithm to obtain the result of the polynomial multiplication.

[0194]

[0195]

[0196] Figure 6 ​​​​​A schematic diagram of a polynomial multiplier according to one embodiment is shown. The polynomial multiplier receives an n-point first input sequence and an n-point second input sequence, and outputs an n-point polynomial multiplication output sequence.

[0197] like Figure 6 As shown, the polynomial multiplier includes a first transformation module 61, a second transformation module 62, a point-by-point multiplication hardware module 63, and a third transformation module 64, wherein the first transformation module 61, the second transformation module 62, and the third transformation module 64 can all be implemented using the acceleration hardware described in the embodiments of this specification.

[0198] The first transformation module 61 can be an acceleration hardware for NTTP in the form of DIF according to an embodiment of this specification. It performs NTTP in the form of DIF on the first input sequence, i.e. the coefficient sequence of the polynomial a(x), and outputs the first output sequence a'.

[0199] The second transformation module 62 can also be an acceleration hardware for NTTP in the form of DIF according to the embodiments of this specification. Its structure can be the same as that of the first transformation module 61. It performs NTTP in the form of DIF on the second input sequence, that is, the coefficient sequence of the polynomial b(x), and outputs the second output sequence b'.

[0200] The point-by-point multiplication hardware module 63 can perform point-by-point multiplication on the first and second output sequences a' and b' to output a third output sequence c'. In the case of a pipelined architecture, this point-by-point multiplication hardware module can be implemented using the Barrett algorithm, performing point-by-point multiplication on the two data outputs of the first transformation module 61 and the second transformation module 62 in each clock cycle.

[0201] The third transformation module 64 can be acceleration hardware for INTTP in the form of DIT according to embodiments of this specification (e.g., Figure 1 As shown), it performs INTTP in the form of DIT on the third output sequence c', and outputs the n-point polynomial multiplication output sequence, that is, the coefficient sequence of the polynomial c(x).

[0202] Since the DIF form requires a naturally ordered input sequence to produce a bit-reversed output sequence, while the DIT form requires a bit-reversed input sequence to produce a naturally ordered output sequence, the bit-reversal process is eliminated in the polynomial multiplier described above, thus improving operating efficiency.

[0203] The polynomial multipliers according to the embodiments of this specification can be applied to a variety of other devices, such as post-quantum cryptography hardware accelerators.

[0204] Those skilled in the art should be aware that, in the above one or more examples, the functions described in the present application can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium.

[0205] The above detailed description has further explained the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above detailed description is only a specific embodiment of the present application and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.

Claims

1. A method for performing a target transformation by accelerating hardware, the target transformation comprising N stages of transformation operations, the accelerating hardware comprising N circuit sections corresponding to the N stages, wherein any i-th stage (excluding the first and last stages) corresponds to an i-th circuit section comprising a controller, a processing engine, a memory, and first and second rearrangement units, the transformation operation of the i-th stage comprising: The controller reads the first data pair and the second data pair from the first read address and the second read address in the memory of the (i-1)th stage, respectively; The first rearrangement unit performs a first rearrangement operation on the first and second data pairs, and outputs the third and fourth data pairs in sequence. The processing engine performs radix-2 butterfly operations on the third and fourth data pairs in turn, and outputs the first and second result pairs in turn. The second rearrangement unit performs a second rearrangement operation on the first and second result pairs to obtain the fifth data pair and the sixth data pair. The controller writes the fifth data pair and the sixth data pair into the first write address and the second write address in the memory of the i-th stage, respectively; The target transformation is performed on an n-point input sequence, where n is a power of 2. The memory of the i-th stage stores the n results obtained after the transformation operation of the i-th stage through consecutive n / 2 addresses, and the values ​​of the first and second read addresses are the same as the values ​​of the first and second write addresses, respectively. The second read address and write address are respectively the first read address and write address plus 2 raised to the power of i-1; or, the second read address and write address are respectively the first read address and write address plus 2 raised to the power of Ni-2.

2. The method according to claim 1, wherein, In the transformation operation of the i-th stage, the n / 2 addresses are sequentially divided into 2^Ni-1 groups or 2^i groups; The transformation operations in stage i also include: After reading the second data pair, the controller reads data from the third read address and the fourth read address in the memory of the (i-1)th stage for two consecutive clock cycles. Wherein, if the second read address is the last address in the group, then the third read address is the second read address plus 1; otherwise, the third read address is the first read address plus 1; When the data is divided into 2^Ni-1 equal groups, the fourth read address is the third read address plus 2^i-1; when the data is divided into 2^i equal groups, the fourth read address is the third read address plus 2^Ni-2.

3. The method according to claim 1, wherein, The controller reads the first data pair and the second data pair from the first read address and the second read address in the memory of stage i-1, respectively, including: In the first clock cycle, the controller reads a first data pair from the first read address and inputs it into the first rearrangement unit; in the second clock cycle following the first clock cycle, the controller reads a second data pair from the second read address and inputs it into the first rearrangement unit.

4. The method according to claim 3, wherein, The processing engine sequentially performs radix-2 butterfly operations on the third and fourth data pairs, including: In the third clock cycle, the processing engine begins to perform a radix-2 butterfly operation on the third data pair, and after t clock cycles, the first result pair is output to the second rearrangement unit. In the fourth clock cycle following the third clock cycle, the processing engine begins to perform a radix-2 butterfly operation on the fourth data pair, and after t clock cycles, the resulting second result pair is output to the second rearrangement unit.

5. The method according to claim 4, wherein, The controller writes the fifth and sixth data pairs into the first and second write addresses in the memory of the i-th stage, respectively, including: In the t+5th clock cycle, the controller writes the fifth data pair to the first write address; In the t+6 clock cycle, the controller writes the sixth data pair to the second write address.

6. The method according to claim 1, wherein, The first rearrangement unit performs a first rearrangement operation on the first and second data pairs, including: During the first clock cycle, the first rearrangement unit receives the first data pair; During the second clock cycle, the first rearrangement unit receives the second data pair and temporarily stores the first data pair; In the third clock cycle following the second clock cycle, the first rearrangement unit outputs the first data from the first data pair and the first data from the second data pair as the third data pair, and temporarily stores the second data from the second data pair. In the fourth clock cycle following the third clock cycle, the first rearrangement unit outputs the second data from the first data pair and the second data from the second data pair as the fourth data pair.

7. The method according to claim 4, wherein, The second rearrangement unit performs a second rearrangement operation on the first and second result pairs, including: In the (t+3)th clock cycle, the second rearrangement unit receives the first result pair; In the (t+4)th clock cycle, the second rearrangement unit receives the second result pair and temporarily stores the first result pair; In the t+5th clock cycle, the second rearrangement unit outputs the first result of the first result pair and the first result of the second result pair as the fifth data pair, and temporarily stores the second result of the second result pair; At clock cycle t+6, the second rearrangement unit outputs the second result of the first result pair and the second result of the second result pair as the sixth data pair.

8. The method according to claim 1, wherein, The 0th circuit section corresponding to the first stage among the N circuit sections includes a 0th-order controller, a 0th-order processing engine, and a 0th-order memory. The transformation operations of the 0th stage include: The 0th-order processing engine sequentially performs a radix-2 butterfly operation on each of the n / 2 input pairs consisting of two adjacent data points arranged in bit-reversed order, and sequentially outputs n / 2 result pairs. The 0th-order controller writes the n / 2 result pairs sequentially to n / 2 consecutive addresses in the 0th-order memory.

9. The method according to claim 1, wherein, The (N-1)th circuit section corresponding to the final stage among the N circuit sections includes an (N-1)th order controller and an (N-1)th order processing engine. The transformation operation of the (N-1)th stage includes: The (N-1)th stage controller sequentially reads n / 2 data pairs from n / 2 addresses in the memory of the (N-2)th stage; The (N-1)th order processing engine sequentially performs radix-2 butterfly operations on the n / 2 data pairs and outputs n / 2 result pairs sequentially.

10. The method according to claim 1, wherein, The 0th circuit part corresponding to the first stage or the (N-1)th circuit part corresponding to the end stage among the N circuit parts has the same hardware structure as the i-th circuit part and performs the same transformation operation.

11. The method according to claim 1, wherein, The target transform is Fast Fourier Transform (FFT), Inverse Fast Fourier Transform (IFFT), Fast Number Theory Transform (NTT), Inverse Fast Number Theory Transform (INTT), NTTP transform obtained by fusing preprocessing and NTT in Negative Wrapping Convolution (NWC), or INTTP transform obtained by fusing INTT and postprocessing in NWC. The transformation operations of the N stages are performed using either time-decimation (DIT) or frequency-decimation (DIF) methods.

12. Acceleration hardware for performing a target transformation, the target transformation comprising N stages of transformation operations, the acceleration hardware comprising N circuit sections corresponding to the N stages, wherein the i-th circuit section corresponding to any i-th stage (excluding the first and last stages) comprises a controller, a processing engine, a memory, and first and second rearrangement units; in the transformation operation of the i-th stage: The controller is configured to read the first data pair and the second data pair from the first read address and the second read address in the memory of the (i-1)th stage, respectively. The first rearrangement unit is configured to perform a first rearrangement operation on the first and second data pairs and output the third and fourth data pairs in sequence. The processing engine is configured to perform radix-2 butterfly operations on the third and fourth data pairs in sequence, and output the first and second result pairs in sequence. The second rearrangement unit is configured to perform a second rearrangement operation on the first result pair and the second result pair to obtain a fifth data pair and a sixth data pair. The controller is also configured to write the fifth data pair and the sixth data pair to the first write address and the second write address in the memory of the i-th stage, respectively; The target transformation is performed on an n-point input sequence, where n is a power of 2. The memory of the i-th stage stores the n results obtained after the transformation operation of the i-th stage through consecutive n / 2 addresses, and the values ​​of the first and second read addresses are the same as the values ​​of the first and second write addresses, respectively. The second read address and write address are respectively the first read address and write address plus 2 raised to the power of i-1; or, the second read address and write address are respectively the first read address and write address plus 2 raised to the power of Ni-2.

13. The acceleration hardware according to claim 12, wherein, The first rearrangement unit includes a first register, a second register, a first multiplexer, a second multiplexer, and a multiplexing control unit. In this configuration, one input of the first multiplexer and one input of the second multiplexer both receive the first data from the currently read data pair. The first register receives and temporarily stores the second data in the currently read data pair. The output of the first register is coupled to another input of the first multiplexer and another input of the second multiplexer. The output of the first multiplexer is coupled to the input of the second register. The second register outputs the first data in the currently rearranged data pair, and the second multiplexer outputs the second data in the currently rearranged data pair. The multiplexing control unit is configured to control the first multiplexer and the second multiplexer to alternately select one of their two inputs as the output.

14. The acceleration hardware according to claim 13, wherein, The multiplexing control unit includes a third register, a fourth register, and an inverter. The output of the third register is coupled to the control terminal of the first multiplexer, the input of the fourth register, and the input of the inverter. The output of the fourth register is coupled to the control terminal of the second multiplexer. The output of the inverter is coupled to the input of the third register.

15. The acceleration hardware according to claim 12, wherein, The first rearrangement unit and the second rearrangement unit have the same hardware structure.

16. The acceleration hardware according to claim 14, wherein, The processing engine includes a modular multiplication unit, which includes a first, a second, and a third integer multiplier, wherein the first integer multiplier is implemented using a digital signal processor (DSP), while the second and third integer multipliers are implemented using a lookup table (LUT).

17. A polynomial multiplier that receives an n-point first input sequence and an n-point second input sequence, and outputs an n-point polynomial multiplication output sequence; the polynomial multiplier includes a first transformation module, a second transformation module, a point-by-point multiplication hardware module, and a third transformation module, wherein the first transformation module, the second transformation module, and the third transformation module all include the acceleration hardware according to claim 12; The first transformation module is configured to perform NTTP on the first input sequence in DIF form and output a first output sequence; The second transformation module is configured to perform NTTP on the second input sequence in DIF form and output a second output sequence; The point-by-point multiplication hardware module is configured to perform point-by-point multiplication on the first and second output sequences and output a third output sequence. The third transformation module is configured to perform INTTP on the third output sequence in the form of DIT, and output the n-point polynomial multiplication output sequence.

Images