Matrix vector multiplication optimization method based on RISC-V platform

Abstract

The invention discloses a matrix vector multiplication optimization method based on an RISC-V platform, which can complete all related multiplication and accumulation operations after a sk coefficient is loaded once by abstracting a reuse rule of sk from a traditional line-by-line processing flow and adopting a column priority calculation path, and thoroughly eliminate repeated memory access and intermediate value cache. In the structure, each coefficient of sk only needs to be loaded once, all multiplication related to the coefficient is executed immediately, and register resources are released, so that the data locality is maximized, the utilization rate of the register is improved, and the overall memory access frequency is reduced. The method is not only suitable for the Kyber algorithm, but also can be seamlessly applied to different lattice-based cryptographic algorithms, and shows good acceleration effect and resource control capability on a plurality of platforms.

Description

Technical Field

[0001] The present invention relates to the field of RISC-V platform optimization, and particularly to a matrix-vector multiplication optimization method based on the RISC-V platform. Background Art

[0002] With the continuous development of the information society and the accelerated construction of digital infrastructure, the amount of data generated globally has shown an explosive growth trend. At the same time, the secure storage and trustworthy transmission of data have become key elements for social operation and personal privacy protection. Traditional public-key cryptosystems based on integer factorization and elliptic curve discrete logarithms have gradually exposed potential security risks in the context of the increasingly mature quantum computing technology. To address this challenge, Post-Quantum Cryptography (PQC), as a new generation of quantum-resistant security encryption system, is being widely studied and deployed by national standards organizations, research institutions, and enterprises, and has become a key support for ensuring the future digital security system.

[0003] Among many post-quantum cryptosystems, lattice-based cryptography has become the most rapidly developing research direction due to its good balance between theoretical security and engineering feasibility. The security of lattice-based cryptography is based on worst-case lattice problems (such as SIS and LWE problems), has a natural resistance to quantum attacks, and has a simple algorithm structure and is convenient for parallel processing, making it particularly suitable for efficient implementation on software and hardware platforms. The National Institute of Standards and Technology (NIST) has officially selected Kyber as the encryption algorithm standard in its leading PQC standardization project, further establishing the mainstream position of lattice-based cryptography in the international cryptographic system.

[0004] All core computational processes of Kyber involve a large number of polynomial matrix-vector multiplications (Matrix-Vector Multiplication, MVM). This operation appears repeatedly in key generation, encryption / decryption, and signature processes, especially in the NTT domain, where it is frequently called to accelerate the multiplication operation between polynomials. NTT transforms polynomial multiplication into coefficient-by-coefficient multiplication, thereby reducing the overall computational complexity from the traditional O(n²) to O(n log n), significantly improving the running efficiency of the algorithm. However, with the increasing demand for deploying the algorithm in resource-constrained environments such as embedded devices, edge computing nodes, and smart cards, the performance bottlenecks brought about by the computational structure and data access pattern of matrix-vector multiplication have become increasingly prominent, becoming one of the key issues restricting the implementation of the algorithm.

[0005] Currently, most mainstream engineering implementation solutions mostly adopt the row-wise processing method to complete the multiplication operation between the public key vector pk and the secret vector sk. In this mode, the system first pre-computes the results of multiplying each coefficient in sk by the NTT constant and caches them in an intermediate array, and then performs element-wise multiplication and accumulation operations on each row in matrix a and the cached results in turn. Although this solution reduces the repeated modular multiplication calculations to a certain extent, it also introduces significant memory overhead. Especially in the parameter configurations with larger k or higher n dimensions, the cached intermediate results will occupy a large amount of storage resources, even exceeding the register capacity or on-chip cache space, forcing the system to frequently access external memory, resulting in performance degradation. In addition, since the complete sk vector needs to be reloaded every time is processed, the actual number of loading times reaches , bringing serious redundant memory access operations, further exacerbating the data transmission bottleneck. Furthermore, since the above processing flow performs multiplication operations based on rows as the basic unit, the access pattern of sk shows highly scattered and discontinuous characteristics, which not only affects the hit rate of the CPU cache but also is difficult to effectively utilize the hardware potential of GPU thread cooperation and FPGA pipeline scheduling. On parallel platforms, the reasonable design of the memory access pattern is often more decisive than the computing power itself. In the current implementation, threads or logical units frequently load the same sk coefficients, and the intermediate results are written and read multiple times, resulting in a series of problems such as resource waste, increased latency, and increased energy consumption.

[0006] To solve the above technical bottlenecks, some researchers have proposed two optimization calculation methods, namely the so-called "asymmetric multiplication" and "accumulation technique", to reduce the computational complexity and resource consumption in the matrix-vector multiplication process.

[0007] Among them, asymmetric multiplication mainly structurally reconstructs the NTT (number-theoretic transform) multiplication process in the Kyber algorithm. Both the matrix A and the secret key vector sk in Kyber are polynomial arrays in the NTT domain. In the traditional method, each term of calculating needs to perform a complete NTT dot product operation. However, asymmetric multiplication utilizes the conjugate symmetry property in NTT: for an NTT vector of length n, if the first half of the coefficients (i.e., even or odd positions) are known, the other half can be represented by the conjugate relationship. Therefore, this method only processes the odd-position coefficients , and compensate for the missing terms by pre-multiplying the constant ζ (rotation factor):

[0008] ;

[0009] where a[i][j][k] is the k-th coefficient of the polynomial in the i-th row and j-th column of the public key matrix A in the NTT domain, and sk[j][k] is the k-th coefficient of the j-th polynomial in the private key vector sk in the NTT domain. is the rotation factor of NTT.

[0010] This optimization method can theoretically reduce the amount of multiplication operations by nearly half, reducing the cycles and power consumption required for each round of NTT multiplication. However, this technique depends on the symmetry of the NTT structure and the specific parameter layout in Kyber, and its generality is limited.

[0011] On the other hand, the accumulation technique attempts to improve the overall computational efficiency by deferring the modular operation. In the traditional method, when multiplying the matrix A by the vector sk, each term immediately performs multiplication and addition modulo q, that is:

[0012] ;

[0013] where a[i][j][t] is the t-th coefficient of the polynomial in the i-th row and j-th column of the public key matrix A in the NTT domain, sk[j][t] is the t-th coefficient of the j-th polynomial in the private key vector sk in the NTT domain, l is the number of columns of the matrix A, and q = 3329 is the modulus.

[0014] In the accumulation technique, all k multiplication results are first accumulated in a high-precision register, and finally a single modular operation is performed:

[0015] ;

[0016] where pk[i][t] represents the intermediate accumulation result of the t-th coefficient of the i-th polynomial in the NTT domain, a[i][j][t] is the t-th coefficient of the polynomial in the i-th row and j-th column of the public key matrix A in the NTT domain, sk[j][t] is the t-th coefficient of the j-th polynomial in the private key vector sk in the NTT domain, l is the number of columns of the matrix A, and q = 3329 is the modulus.

[0017] By reducing the number of calls to modular multiplication operations (from once per term to once per row), this method effectively reduces the overhead of modular multiplication instructions during the operation process and is applicable to various structures such as Kyber and other lattice-based cryptographic algorithms. However, this technique still cannot fundamentally solve the problem of repeated loading of sk[j][t] in different threads and different positions. At the same time, a larger bit-width intermediate register is required during the accumulation process, increasing the cache pressure and register requirements. Therefore, there are still certain performance bottlenecks on resource-constrained platforms (such as RISC-V).

[0018] Therefore, in standard lattice cryptographic algorithms such as Kyber, there is an urgent need for a new optimization method that can start from the perspective of data access, redesign the MVM calculation process, reduce the number of sk accesses, avoid intermediate caching, and enhance the register reuse rate. Especially when facing high-concurrency multi-core systems, limited register resources, and energy-efficient sensitive platforms, this optimization method should have good structural friendliness and platform adaptability, providing a basis for higher performance and lower resource consumption in the practical application of lattice cryptographic algorithms.

[0019] After retrieval, the Chinese patent application publication number is CN118963703A, and the patent name is a high-performance polynomial multiplication hardware acceleration architecture for lattice cryptographic chips, mainly facing the acceleration scenario of polynomial operations with NTT as the core. This scheme adopts a mixed NTT implementation strategy of base-2 and base-4, and improves the operation efficiency of basic operations such as NTT, INTT, and point multiplication by designing a multi-mode butterfly unit and an address generator.

[0020] Specifically, this technology uses a lightweight butterfly unit (BFU) module to control the execution of different operation processes through scheduling logic. This architecture has multiple levels of memory banks built-in, combined with a rotation factor scheduling and address exclusive mapping mechanism, to solve problems such as complex data rearrangement and frequent memory access conflicts during the NTT process at the hardware level, thus achieving efficient modular multiplication pipelining. Its goal is to provide bottom-layer calculation acceleration logic for lattice cryptographic algorithms facing the NTT layer.

[0021] In addition, the scheme also realizes fast switching between multiple modes of NTT, INTT, and PWM (point-by-point multiplication) through state machine control logic, improving the overall module reuse rate and energy efficiency ratio, and is applicable to embedded chips in resource-constrained scenarios.

[0022] Although the above technology has carried out structural-level optimization on NTT and related modular multiplication operations at the hardware level, this scheme relies on highly customized hybrid NTT hardware modules and complex butterfly scheduling logic, mainly limited to improving the execution efficiency of the NTT transformation itself, and has the following deficiencies:

[0023] First, this solution focuses on hardware pipeline execution of NTT and point multiplication, without specifically optimizing the memory access patterns and data reuse of the upper-level algorithmic structures (such as the matrix-vector multiplication (MVM) in Kyber). In lattice-based cryptographic algorithms like Kyber, MVM is a performance bottleneck. Its characteristic is that the calculation of each public key vector element pk[i] requires full access to the entire secret vector sk[j]. Without optimized memory access paths, a large amount of redundant loads will be generated, severely impacting system throughput. Second, the existing solution does not design a reuse strategy across MVM cycles to address the high-frequency access characteristics of sk[j][t], nor does it adopt a column-major access and computation pattern. As a result, the data for sk[j][t] must be repeatedly loaded for each pk[i] calculation, failing to substantially address the memory bandwidth pressure. Furthermore, this solution focuses solely on hardware circuit optimization, making it difficult to directly reuse on software-programmable platforms (such as RISC-V) that require high flexibility and adaptability in practical applications. Especially in processor-level embedded platforms, hardware butterfly structures, twiddle factor ROMs, and memory-mapped control are expensive to implement, and lack good portability when resource constraints are severe. Finally, existing technical solutions, when dealing with algorithms like Kyber that use atypical moduli (such as 3329) and do not meet the pre-set conditions of standard NTT, require the introduction of additional workarounds, such as pruning KNTT and multi-segment decomposition, which further increases implementation complexity and hinders the standardized and unified deployment of algorithms. Summary of the Invention

[0024] To solve the above problems, the present invention discloses a matrix-vector multiplication optimization method based on RISC-V platform. Aiming at the problems of multiple repeated memory accesses, discontinuous memory access and register resource waste in the existing row-by-row processing, a calculation reconstruction strategy based on column order is proposed. This strategy re-arranges the calculation order and unifies the pre-fetching. data, and immediately after loading all Perform multiplication and accumulation, and then release the sk item, avoiding repeated loading of the sk vector, thereby effectively reducing the number of memory accesses and improving data reuse. In addition, due to the use of column-first processing, the memory The access pattern becomes more continuous and regular, which meets the optimization requirements of modern RISC-V architecture for memory access alignment, significantly improving cache hit rate and data transmission efficiency. Data, effectively reducing on-chip resource usage and alleviating resource scheduling pressure. Regarding the modular operation itself, the present invention further introduces a "delayed modular" strategy, which accumulates multiple products before performing modular operations, reducing the frequency of modular multiplication calls and optimizing the execution path.

[0025] This optimization solution has good generality and deployability, and is particularly suitable for efficiently implementing the Kyber post-quantum cryptography algorithm on platforms with limited resources such as RISC-V, a simple control path, and tight on-chip resources. Through structural reconstruction and access pattern optimization, the present invention fundamentally solves the problems of repeated calculations, chaotic memory access, and inefficient caching in the traditional row-major mode, providing high-performance and low-power core support for the deployment of post-quantum cryptography algorithms on embedded, Internet of Things, and lightweight platforms.

[0026] To achieve the above object, the technical solution adopted by the present invention is as follows:

[0027] A matrix-vector multiplication optimization method based on the RISC-V platform, comprising the following steps:

[0028] Step 1: Perform data layout rearrangement on the host side;

[0029] In the initialization stage, that is, the preprocessing stage before key generation or encryption, the host rearranges all matrix data to be involved in the operation. Assuming the original input matrix is A[i][j][t], which is arranged in row-major order in memory, that is, the data of the same row is stored in consecutive address spaces, a column-major data storage method is constructed, and the three-dimensional array is rearranged into column-major order, that is, the data of each column is continuously distributed in the physical address space. The following transpose operation is used to achieve this:

[0030] ;

[0031] Where is the row index of the matrix, is the column index of the matrix, represents the number of rows of the original data, represents the number of columns of the original matrix;

[0032] Step 2: Transfer the data to the RISC-V platform and perform calculation mapping with columns as processing units;

[0033] In the data loading stage of the embedded platform, dot product and accumulation operations are performed, with columns as the basic data processing blocks. That is, the processing logic sequentially loads all A[i][j][t] on column j, and then uniformly completes its multiplication with the corresponding sk[j][t], and accumulates each item to each output vector pk[i][t];

[0034] Step 3: Optimize the use of computing resources by combining the register life cycle scheduling mechanism during the execution stage;

[0035] Under the column-major data layout, each time only a group of sk[j][t] needs to be loaded, and the system can complete all matrix-vector multiplications related to it without caching the intermediate product results halfway.

[0036] As a further improvement of the present invention, in step one, a column - first data storage method is constructed, and the execution process of matrix - vector multiplication is reconstructed. The calculation order is rearranged as follows: for each , first load all , and then multiply them successively by the corresponding , and accumulate the results to .

[0037] As a further improvement of the present invention, the calculation process of constructing the column - first data storage method is formalized as follows:

[0038] (1) Initialize the output vector:

[0039] ;

[0040] (2) For each sk[j][t], load it only once;

[0041] (3) For the loaded sk[j][t], perform the following operations:

[0042] For all i ∈ [0, k), execute ;

[0043] where is the value of the element in the i - th row and j - th column of the input matrix at the t - th coefficient, is the t - th item of the j - th element in the secret vector.

[0044] As a further improvement of the present invention, the matrix - vector multiplication optimization in step two is a dot - product and accumulation operation, in the following form:

[0045] ;

[0046] where, is the value of the element in the i - th row and j - th column of the input matrix at the t - th coefficient, is the t - th item of the j - th element in the secret vector, l is the number of columns of matrix A, k is the number of rows of matrix A, that is, the dimension of the output public - key vector pk, and n is the number of coefficients of the polynomial in the NTT domain.

[0047] As a further improvement of the present invention, the matrix - vector multiplication optimization method is adapted to GPU, DSP, and RISC - V parallel processing architectures.

[0048] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0049] The present invention aims at the calculation bottleneck problem of matrix - vector multiplication (MVM) in the post - quantum cryptography algorithm Kyber, and proposes an optimization method combining column - first data layout and calculation process reconstruction. By uniformly loading By means such as vector coefficients, avoiding repeated memory accesses, and improving thread access consistency, the overall computing efficiency is effectively improved, which is particularly suitable for parallel or resource-constrained platforms such as GPUs, FPGAs, and RISC-V. The following are several key beneficial effects of the present invention:

[0050] 1. Improve memory access efficiency;

[0051] In the present invention, by reconstructing the calculation process of MVM, the traditional row-by-row processing method is changed to a unified execution mode of column-by-column processing. In this mode, each secret vector only needs to be loaded once to complete all relevant multiplication calculations, avoiding the bandwidth waste caused by repeated loading. Combined with the column-major data storage structure, threads can access consecutive memory blocks, achieving efficient memory access merging, greatly reducing memory access latency and increasing throughput.

[0052] 2. Reduce intermediate cache dependencies and reduce on-chip resource occupancy;

[0053] In traditional implementations, intermediate products (such as ) are often cached to avoid repeated calculations, resulting in a large amount of on-chip resources being occupied. In the present invention, by loading columns uniformly and performing operations in-place, the need for intermediate value caching is completely eliminated, not only reducing resource consumption but also reducing scheduling conflicts between threads, improving hardware utilization and execution efficiency.

[0054] 3. Improve parallel computing performance and throughput;

[0055] Since each thread can directly process the complete data segment and complete multiplication and accumulation operations in the unified calculation stage, the coherence and execution efficiency of thread scheduling are greatly improved. This optimization strategy solves the problem of serious memory access fragmentation and inconsistent execution between threads in the original row-by-row mode, thereby improving the execution efficiency of warps or processing units in GPUs / FPGAs and significantly enhancing the overall parallel throughput capacity.

[0056] 4. Reduce computing latency and shorten the critical path;

[0057] In the optimized calculation process, the calculation of pk[i][t] can be expressed as:

[0058] ;

[0059] where is the value of the element in the i-th row and j-th column of the input matrix at the t-th coefficient, is the t-th item of the j-th element in the secret vector, and l is the number of columns of matrix A.

[0060] Compared with the multiple loadings and redundant repetitions of sk in the original method, after optimization, the total number of loadings is reduced from k × l× n to l × n, which not only reduces the memory overhead, but also shortens the data path and calculation link, effectively reducing the overall latency.

[0061] 5. Enhance cross-platform portability and scalability;

[0062] The optimization scheme proposed by the present invention does not depend on the specific platform hardware characteristics and is applicable to various computing environments such as general GPU architectures, FPGA logic units, or RISC-V embedded instruction systems. It can still maintain good computing performance in resource-constrained or high-concurrency scenarios, has high scalability and deployment flexibility, and provides good support for the application of post-quantum cryptographic algorithms in terminal devices. Brief Description of the Drawings

[0063] Figure 1 is a schematic diagram of row-column conversion of matrix-vector multiplication of the present invention;

[0064] Figure 2 is a flowchart of the calculation of the present invention. Detailed Description of the Invention

[0065] The present invention will be further described in detail below in conjunction with the drawings and specific embodiments:

[0066] In an embodiment of the present invention, taking the public key generation process in the lattice-based encryption algorithm Kyber as the application background, a matrix-vector multiplication implementation method combining column-major data rearrangement and calculation kernel optimization is proposed. This method is applicable to cryptographic algorithms that perform frequent matrix-vector multiplication operations and has good portability and efficiency performance on an embedded RISC-V platform. Its goal is to reduce memory access latency, reduce redundant modular operations, and optimize on-chip resource scheduling to improve the overall operation efficiency. The following combines the schematic diagram of row-column conversion of matrix-vector multiplication Figure 1 , process Figure 2 , and gives the complete implementation process, where Figure 1 shows the optimization process of matrix-vector multiplication in Kyber public key generation: by loading the coefficients of matrix A in batches by column, avoiding repeated reading of the private key vector sk, and pre-multiplying the coefficients sk 2t+1 with the rotation factor ζ required for NTT 2br7(t)+1 , an efficient dot product calculation is realized, and finally the result is stored by column as the public key pk. Where sk 2t+1 represents the t-th coefficient at the odd subscript position in the secret key vector; ζ 2br7(t)+1is the "twiddle factor" pre - prepared in NTT, where ζ is a primitive root used in NTT, and br7(t) represents a 7 - bit bit - reverse operation. The function of this formula is to transform the private - key coefficients into a form suitable for NTT operations in advance, so as to improve the overall operation efficiency and optimize the data - access pattern.

[0067] Step 1: Before entering the matrix - vector multiplication operation, the system needs to allocate memory space for the polynomial matrix a[i][j][t] and the secret vector sk[j][t] participating in the operation. Taking Kyber - 1024 as an example, its parameters are k = 1, l = 4, n = 256, that is, the dimension of matrix A is 4×4, and each element is a polynomial of degree 256. Specifically, in the matrix a[i][j][t], the index range is: i ∈ [0,3], representing the i - th row of the matrix; j ∈ [0,3], representing the j - th column of the matrix; t ∈ [0,255], representing the t - th coefficient, that is, the t - th term of the polynomial in the NTT domain. In the RISC - V main memory or shared SRAM, two independent buffers are allocated for matrix A and vector sk, ensuring that their starting addresses are aligned to the cache - line boundary to enhance the cache hit rate during subsequent accesses. At the same time, space is reserved for the vector pk[i][t] storing the calculation results and initialized to all zeros, which is used to accumulate the intermediate product results term by term.

[0068] Step 2: After completing the basic memory configuration, the main control program performs a structural rearrangement on the original data. In the Kyber implementation, the original polynomial matrix is usually laid out in a "row - major" manner, that is, each row is stored as a complete polynomial, and all its coefficients are continuously arranged in memory. Although suitable for serial processing, in parallel computing on an embedded platform, this layout will cause different computing modules to frequently access across rows, resulting in memory - access conflicts and cache misses. In this embodiment, all data is rearranged in a "column - major" order through a one - time transpose. Specifically, in the original layout, the matrix elements are stored in memory in the following order:

[0069] ;

[0070] In the transposed column - major structure, each coefficient index t ∈ [0,n) is fixed, and they are aggregated and arranged by column as:

[0071] ;

[0072] Described in array form, this transpose can be expressed by the following formula:

[0073] ;

[0074] Among them, \(i\in[0,3]\), \(j\in[0,3]\), and \(t\in[0,255]\). This layout makes all column elements with the same coefficient index \(t\) arranged continuously in memory, thus achieving efficient reuse of the secret vector \(sk[j][t]\) in matrix-vector multiplication, improving data locality, and reducing memory access conflicts.

[0075] Step 3: After data rearrangement is completed, enter the matrix-vector multiplication stage. The scheduler divides the tasks by column according to the matrix size, and each column is independently calculated by a processing core. Each core loads all the matrix data corresponding to the column from the local cache and loads all the elements required for this column in the secret vector at one time. With the support of the V extension of RISC-V, each core can complete a set of modular multiplication operations through instructions and accumulate the results using registers, avoiding frequent access to the main memory. This operation is highly optimized for the memory access pattern. Since all the data participating in the operation is in a continuous storage area, it can significantly reduce the memory access latency.

[0076] Step 4: After each column processing module completes all the multiplication calculations for the current column, it stores the accumulated result in the local register or L1 data cache. To ensure consistency and access efficiency, the system writes the calculation results to the storage area corresponding to the public key vector \(pk[i][t]\) in the preset structure order. Since all write operations are executed column by column, the write addresses are continuous and well-aligned, which can utilize the bandwidth merging and write-back mechanism of the processor, thereby improving the write-back efficiency and reducing system bus conflicts.

[0077] Step 5: After all columns are processed, the main control program issues a synchronization instruction to refresh the relevant cache content and ensure that the results have been correctly written to the target area. Subsequently, release the resources of the intermediate buffer area and clear the register status to prepare for the next round of encryption, decryption, or signature operations. This process also includes the protected cleaning of \(sk\) and \(a\) to meet the security requirement of clearing the key immediately after use. In an embedded system, this step is particularly crucial to prevent the leakage of intermediate sensitive data and reduce power consumption.

[0078] Through the above implementation process, the present invention aims at the public key generation calculation process in the Kyber algorithm, combines the column-major data structure, the column-wise scheduled calculation path, and the cache-friendly access pattern, and achieves the goal of efficiently executing matrix-vector multiplication on the RISC-V architecture. This method not only optimizes the utilization of memory access bandwidth, reduces the number of repeated loads of \(sk\), but also improves data locality and register reuse efficiency, ensuring the algorithm performance under resource-constrained conditions, and has good application and promotion value.

[0079] The above is only a preferred embodiment of the present invention, and it is not any other form of limitation to the present invention, and any modification or equivalent change made according to the technical essence of the present invention still belongs to the scope protected by the present invention.

Claims

1. An optimization method for matrix-vector multiplication based on the RISC-V platform, characterized in that, It includes the following steps: Step 1: Perform data layout rearrangement on the host side; In the initialization stage, that is, the preprocessing stage before key generation or encryption, the host performs a rearrangement operation on all matrix data that will participate in the operation. Assuming the original input matrix is A[i][j][t], which is arranged in row-major order in memory, that is, data in the same row is stored in consecutive address spaces, a column-major data storage method is constructed, and the three-dimensional array is rearranged into column-major order, that is, data in each column is continuously distributed in the physical address space. The following transpose operation is used to achieve this: ； wherein is the row index of the matrix, is the column index of the matrix, represents the number of rows of the original data, represents the number of columns of the original matrix; Step 2: Transfer the data to the RISC-V platform and perform calculation mapping with columns as the processing units; In the data loading stage of the embedded platform, dot product and accumulation operations are performed, with columns as the basic data processing blocks. That is, the processing logic sequentially loads all A[i][j][t] on column j, and then uniformly completes the multiplication with the corresponding sk[j][t], and accumulates each item to each output vector pk[i][t]; Step 3: Optimize the use of computing resources by combining the register life cycle scheduling mechanism during the execution stage; Under the column-major data layout, each time only a group of sk[j][t] needs to be loaded, and the system can complete all matrix-vector multiplications related to it without caching the intermediate product results midway.

2. The matrix-vector multiplication optimization method based on the RISC-V platform according to claim 1, wherein The first step constructs a column - first data storage method, reconstructs the execution process of matrix - vector multiplication, and rearranges the calculation order as follows: for each , first load all , then multiply them successively by the corresponding , and accumulate the results to .

3. The matrix-vector multiplication optimization method based on the RISC-V platform according to claim 2, wherein The calculation process of constructing the column-major data storage method is formalized as: (1) Initialize the output vector: ； (2) For each sk[j][t], load it only once; (3) For the loaded sk[j][t], perform the following operations: For all i ∈ [0, k), perform ; where is the value of the element in the \(i\)-th row and \(j\)-th column of the input matrix at the \(t\)-th coefficient, and is the \(t\)-th item of the \(j\)-th element in the secret vector.

4. The matrix-vector multiplication optimization method based on the RISC-V platform according to claim 1, wherein The matrix-vector multiplication optimization in the second step is a dot product and accumulation operation, in the following form: ； Among them, is the value at the \(i\)-th row and \(j\)-th column of the input matrix at the \(t\)-th coefficient, is the \(t\)-th term of the \(j\)-th element in the secret vector, \(l\) is the number of columns of matrix \(A\), \(k\) is the number of rows of matrix \(A\), that is, the dimension of the output public key vector \(pk\), and \(n\) is the number of coefficients of the polynomial in the NTT domain.

5. The matrix-vector multiplication optimization method based on the RISC-V platform according to any one of claims 1-4, characterized in that The matrix-vector multiplication optimization method is adapted to GPU, DSP, and RISC-V parallel processing architectures.

Images