Matrix-vector multiplication optimization method based on RISC-V platform

Abstract

The present invention discloses a matrix-vector multiplication optimization method based on RISC-V platform. By abstracting the reuse rule of sk from the traditional row-by-row processing flow and adopting the column-first calculation path, the method of the present invention can complete all its related multiplication and accumulation operations after loading the sk coefficient once, completely eliminating repeated memory access and intermediate value cache. In this structure, each coefficient of sk only needs to be loaded once, and all its related multiplications are executed immediately and register resources are released, thereby maximizing data locality, improving register utilization and reducing the overall memory access number. This method is not only applicable to the Kyber algorithm, but also can be seamlessly applied to different lattice cryptographic algorithms, while showing good acceleration effect and resource control capabilities on multiple platforms.

Description

Technical Field

[0001] The present invention relates to the field of RISC-V platform optimization, and in particular to a matrix-vector multiplication optimization method based on the RISC-V platform. Background Art

[0002] With the continuous development of the information society and the accelerated construction of digital infrastructure, the amount of data generated worldwide is experiencing explosive growth. At the same time, the secure storage and trusted transmission of data have become critical elements for the functioning of society and the protection of personal privacy. Traditional public-key cryptography systems based on integer factorization and elliptic curve discrete logarithms are increasingly exposed to potential security risks in the face of the growing maturity of quantum computing technology. To address this challenge, post-quantum cryptography (PQC), a next-generation quantum-resistant encryption system, is being widely researched and deployed by standards bodies, research organizations, and businesses worldwide, becoming a key pillar for safeguarding future digital security systems.

[0003] Among the many post-quantum cryptographic systems, lattice-based cryptography has become the most rapidly developing research area due to its excellent balance between theoretical security and engineering feasibility. Lattice-based cryptography, based on worst-case lattice problems (such as SIS and LWE), offers inherent resistance to quantum attacks. Its algorithmic structure is simple and amenable to parallel processing, making it particularly suitable for efficient implementation on both software and hardware platforms. The National Institute of Standards and Technology (NIST) has officially selected Kyber as the encryption algorithm standard within its PQC standardization project, further solidifying lattice cryptography's mainstream status in international cryptography.

[0004] Kyber's core computational processes all involve a large number of polynomial matrix-vector multiplications (Matrix-Vector Multiplication, MVM). This operation recurs throughout key generation, encryption and decryption, and signing, and is particularly frequently called in the NTT domain to accelerate multiplications between polynomials. NTT converts polynomial multiplications into coefficient-by-coefficient multiplications, reducing the overall computational complexity from the traditional O(n²) to O(n log n), significantly improving the algorithm's operational efficiency. However, with the growing demand for algorithm deployment in resource-constrained environments such as embedded devices, edge computing nodes, and smart cards, the performance bottlenecks imposed by the computational structure and data access patterns of matrix-vector multiplication have become increasingly prominent, becoming a key issue limiting the algorithm's implementation.

[0005] At present, most mainstream engineering implementations use row-wise processing to complete the multiplication operation between the public key vector pk and the secret vector sk. In this mode, the system first pre-calculates each coefficient in sk and multiplies it by the NTT constant. The result is cached in an intermediate array, and then each row in matrix a is multiplied and accumulated element by element with the cached result. Although this solution reduces repeated modular multiplication calculations to a certain extent, it also introduces significant memory overhead. Especially when the parameter configuration is large in k or high in n dimension, the cache The intermediate results of the calculation will occupy a lot of storage resources, even exceeding the register capacity or on-chip cache space, forcing the system to frequently access external memory, resulting in performance degradation. The complete sk vector needs to be reloaded every time, and the actual number of loading times reaches , resulting in serious redundant memory access operations, further exacerbating the data transmission bottleneck. Furthermore, because the above processing flow performs multiplication operations in the basic unit of behavior, the access pattern of sk is highly dispersed and discontinuous, which not only affects the hit rate of the CPU cache, but also makes it difficult to effectively realize the hardware potential of GPU thread collaboration and FPGA pipeline scheduling. On parallel platforms, the reasonable design of memory access patterns is often more decisive than the computing power itself. In the current implementation, threads or logic units frequently load the same sk coefficient, and intermediate results are written and read multiple times, resulting in a series of problems such as resource waste, increased latency, and increased energy consumption.

[0006] To address the above technical bottlenecks, some researchers have proposed two optimized calculation methods, namely the so-called "asymmetric multiplication" and "accumulation technique", to reduce the computational complexity and resource consumption in the matrix-vector multiplication process.

[0007] Among them, asymmetric multiplication mainly focuses on the structural reconstruction of the NTT (number theoretic transformation) multiplication process in the Kyber algorithm. Kyber's matrix A and key vector sk are both polynomial arrays under the NTT domain. In traditional methods, the calculation Each term in requires a complete NTT dot multiplication operation. However, asymmetricmultiplication takes advantage of the conjugate symmetry property of NTT: for an NTT vector of length n, if the first half of the coefficients (i.e., even or odd digits) are known, the other half can be expressed through the conjugate relationship. Therefore, this method only processes odd-digit coefficients. , and compensate for the missing terms by premultiplying with a constant ζ (twiddle factor):

[0008] ;

[0009] Where a[i][j][k] is the kth coefficient of the polynomial in the i-th row and j-th column of the public key matrix A in the NTT domain, and sk[j][k] is the kth coefficient of the j-th polynomial in the private key vector sk in the NTT domain. is the rotation factor of NTT.

[0010] This optimization can theoretically reduce the number of multiplication operations by nearly half, reducing the cycles and power consumption required for each round of NTT multiplication. However, this technology relies on the symmetry of the NTT structure and the unique parameter layout in Kyber, which limits its universality.

[0011] On the other hand, the accumulation technique attempts to improve overall computational efficiency by deferring modular operations. In the traditional method, when matrix A is dot-multiplied by vector sk, each term is immediately multiplied and added modularly, i.e.:

[0012] ;

[0013] Where a[i][j][t] is the tth coefficient of the polynomial in the i-th row and j-th column of the public key matrix A in the NTT domain, sk[j][t] is the tth coefficient of the j-th polynomial in the private key vector sk in the NTT domain, l is the number of columns in the matrix A, and q=3329 is the modulus.

[0014] In the accumulation technique, all k multiplication results are first accumulated in a high-precision register, and then a modular operation is performed on them:

[0015] ;

[0016] Where pk[i][t] represents the intermediate accumulation result of the t-th coefficient of the i-th polynomial in the NTT domain, a[i][j][t] is the t-th coefficient of the i-th row and j-th column polynomial of the public key matrix A in the NTT domain, sk[j][t] is the t-th coefficient of the j-th polynomial of the private key vector sk in the NTT domain, l is the number of columns of the matrix A, and q = 3329 is the modulus.

[0017] By reducing the number of modular multiplication calls (from once per term to once per row), this method effectively reduces the modular multiplication instruction overhead during the computation process and is applicable to various architectures, including Kyber and other lattice-based cryptographic algorithms. However, this technique still cannot fundamentally solve the problem of repeated loading of sk[j][t] in different threads and at different locations. Furthermore, the accumulation process requires the use of wider intermediate registers, increasing cache pressure and register requirements. Therefore, certain performance bottlenecks still exist on resource-constrained platforms (such as RISC-V).

[0018] Therefore, in standard lattice cryptography algorithms like Kyber, there is an urgent need for a novel optimization method that redesigns the MVM computation process from a data access perspective, reduces the number of sk accesses, avoids intermediate caching, and enhances register reuse. This optimization method should be both structurally friendly and platform-adaptable, particularly for highly concurrent multi-core systems, limited register resources, and energy-sensitive platforms, providing a foundation for achieving higher performance and lower resource consumption in practical lattice cryptography applications.

[0019] A search revealed a Chinese patent application with publication number CN118963703A, titled "A High-Performance Polynomial Multiplication Hardware Acceleration Architecture for Lattice Cryptography Chips." The patent is primarily targeted at accelerating polynomial operations centered around NTT. This solution utilizes a hybrid radix-2 and radix-4 NTT implementation strategy, and through the design of a multi-mode butterfly unit and address generator, improves the efficiency of basic operations such as NTT, INTT, and dot multiplication.

[0020] Specifically, this technology utilizes lightweight butterfly units (BFUs) to control the execution of different computational flows through scheduling logic. This architecture incorporates multi-level memory banks, coupled with twiddle factor scheduling and exclusive address mapping mechanisms. This hardware-level solution addresses the complex data reordering and frequent memory access conflicts inherent in the NTT process, enabling efficient modular multiplication pipelines. Its goal is to provide low-level computational acceleration logic for the NTT layer of lattice cryptographic algorithms.

[0021] In addition, the solution also uses state machine control logic to achieve fast switching of NTT, INTT, and PWM (point-by-point multiplication) modes, improving the overall module reuse rate and energy efficiency, and is suitable for embedded chips in resource-constrained scenarios.

[0022] Although the aforementioned technology optimizes NTT and related modular multiplication operations at the hardware level, this solution relies on highly customized hybrid NTT hardware modules and complex butterfly scheduling logic. This solution is primarily limited to improving the execution efficiency of the NTT transformation itself, resulting in the following deficiencies:

[0023] First, this solution focuses on hardware pipeline execution of NTT and point multiplication, without specifically optimizing the memory access patterns and data reuse of the upper-level algorithmic structures (such as the matrix-vector multiplication (MVM) in Kyber). In lattice-based cryptographic algorithms like Kyber, MVM is a performance bottleneck. Its characteristic is that the calculation of each public key vector element pk[i] requires full access to the entire secret vector sk[j]. Without optimized memory access paths, a large amount of redundant loads will be generated, severely impacting system throughput. Second, the existing solution does not design a reuse strategy across MVM cycles to address the high-frequency access characteristics of sk[j][t], nor does it adopt a column-major access and computation pattern. As a result, the data for sk[j][t] must be repeatedly loaded for each pk[i] calculation, failing to substantially address the memory bandwidth pressure. Furthermore, this solution focuses solely on hardware circuit optimization, making it difficult to directly reuse on software-programmable platforms (such as RISC-V) that require high flexibility and adaptability in practical applications. Especially in processor-level embedded platforms, hardware butterfly structures, twiddle factor ROMs, and memory-mapped control are expensive to implement, and lack good portability when resource constraints are severe. Finally, existing technical solutions, when dealing with algorithms like Kyber that use atypical moduli (such as 3329) and do not meet the pre-set conditions of standard NTT, require the introduction of additional workarounds, such as pruning KNTT and multi-segment decomposition, which further increases implementation complexity and hinders the standardized and unified deployment of algorithms. Summary of the Invention

[0024] To solve the above problems, the present invention discloses a matrix-vector multiplication optimization method based on RISC-V platform. Aiming at the problems of multiple repeated memory accesses, discontinuous memory access and register resource waste in the existing row-by-row processing, a calculation reconstruction strategy based on column order is proposed. This strategy re-arranges the calculation order and unifies the pre-fetching. data, and immediately after loading all Perform multiplication and accumulation, and then release the sk item, avoiding repeated loading of the sk vector, thereby effectively reducing the number of memory accesses and improving data reuse. In addition, due to the use of column-first processing, the memory The access pattern becomes more continuous and regular, which meets the optimization requirements of modern RISC-V architecture for memory access alignment, significantly improving cache hit rate and data transmission efficiency. Data, effectively reducing on-chip resource usage and alleviating resource scheduling pressure. Regarding the modular operation itself, the present invention further introduces a "delayed modular" strategy, which accumulates multiple products before performing modular operations, reducing the frequency of modular multiplication calls and optimizing the execution path.

[0025] This optimization scheme boasts excellent versatility and deployability, making it particularly suitable for efficiently implementing the Kyber post-quantum cryptography algorithm on resource-constrained platforms such as RISC-V, characterized by concise control paths and limited on-chip resources. Through structural reconstruction and access pattern optimization, this invention fundamentally addresses the issues of computational duplication, chaotic memory access, and cache inefficiency inherent in the traditional row-first model, providing high-performance, low-energy core support for the deployment of post-quantum cryptography algorithms on embedded, IoT, and lightweight platforms.

[0026] To achieve the above object, the technical solution adopted by the present invention is:

[0027] The matrix-vector multiplication optimization method based on the RISC-V platform includes the following steps:

[0028] Step 1: Perform data layout rearrangement on the host side;

[0029] During the initialization phase, which is the preprocessing phase before key generation or encryption, the host reorders all matrix data involved in the operation. Assuming the original input matrix is ​​A[i][j][t], it is arranged in row-major order in memory, that is, the data of the same row is stored in a continuous address space. A column-major data storage method is constructed to reorder the three-dimensional array into column-major order, that is, the data of each column is continuously distributed in the physical address space. This is achieved by the following transposition operation:

[0030] ;

[0031] in is the row index of the matrix, is the column index of the matrix, Indicates the number of rows of original data, Indicates the number of columns of the original matrix;

[0032] Step 2: Data is transferred to the RISC-V platform, and computational mapping is performed using columns as processing units.

[0033] During the data loading phase on the embedded platform, dot multiplication and accumulation operations are performed, using columns as basic data processing blocks. That is, the processing logic sequentially loads all A[i][j][t] on column j, then uniformly performs multiplication with the corresponding sk[j][t], and accumulates them item by item to each output vector pk[i][t].

[0034] Step 3: Optimize computing resource usage during the execution phase by combining the register lifecycle scheduling mechanism;

[0035] Under the column-major data layout, only one set of sk[j][t] needs to be loaded each time, and the system will complete all matrix-vector multiplications related to it without caching the intermediate product results in the middle.

[0036] As a further improvement of the present invention, the step 1 constructs a column-first data storage method, reconstructs the execution process of matrix-vector multiplication, and rearranges the calculation order as follows: , first load all , and then multiply it by the corresponding , and add to the .

[0037] As a further improvement of the present invention, the calculation process of constructing a column-first data storage method is formalized as follows:

[0038] (1) Initialize the output vector:

[0039] ;

[0040] (2) For each sk[j][t], it is loaded only once;

[0041] (3) Perform the following operations on the loaded sk[j][t]:

[0042] For all i ∈ [0, k), execute ;

[0043] in is the value of the tth coefficient in the i-th row and j-th column of the input matrix, is the t-th entry of the j-th element in the secret vector.

[0044] As a further improvement of the present invention, the matrix-vector multiplication optimization in step 2 is a dot multiplication and accumulation operation in the following form:

[0045] ;

[0046] in, is the value of the tth coefficient in the i-th row and j-th column of the input matrix, is the t-th entry of the j-th element in the secret vector, l is the number of columns of the matrix A, k is the number of rows of the matrix A, that is, the dimension of the output public key vector pk, and n is the number of coefficients of the polynomial in the NTT field.

[0047] As a further improvement of the present invention, the matrix-vector multiplication optimization method is adapted to GPU, DSP and RISC-V parallel processing architectures.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] This paper aims to solve the computational bottleneck problem of matrix-vector multiplication (MVM) in the post-quantum cryptography algorithm Kyber and proposes an optimization method that combines column-first data layout with computational process reconstruction. This invention effectively improves overall computing efficiency by using vector coefficients, avoiding duplicate memory accesses, and improving thread access consistency. It is particularly suitable for parallel or resource-constrained platforms such as GPUs, FPGAs, and RISC-V. The following are several key benefits of this invention:

[0050] 1. Improve memory access efficiency;

[0051] This invention reconstructs the calculation process of MVM and changes the traditional row-by-row processing mode into a unified execution mode of column-by-column processing. In this mode, each secret vector All related multiplication calculations can be completed with a single load, avoiding bandwidth waste caused by repeated loading. Combined with the column-first data storage structure, threads can access contiguous memory blocks, achieving efficient memory access merging, significantly reducing memory access latency and improving throughput.

[0052] 2. Reduce dependence on intermediate caches and reduce on-chip resource usage;

[0053] In traditional implementations, intermediate products are often cached to avoid repeated calculations (e.g. ), resulting in a large amount of on-chip resources being occupied. This invention completely eliminates the need for intermediate value caching by uniformly loading columns and performing calculations in situ. This not only reduces resource consumption but also reduces scheduling conflicts between threads, thereby improving hardware utilization and execution efficiency.

[0054] 3. Improve parallel computing performance and throughput;

[0055] Since each thread can directly process the complete Data segments are processed and multiplication and accumulation operations are performed in a unified computation phase, significantly improving thread scheduling consistency and execution efficiency. This optimization strategy addresses the severe memory access fragmentation and inconsistent execution issues between threads in the original row-by-row mode, thereby improving the execution efficiency of warps (processing units) in GPUs / FPGAs and significantly enhancing overall parallel throughput.

[0056] 4. Reduce computing delay and shorten critical path;

[0057] In the optimized calculation process, the calculation of pk[i][t] can be expressed as:

[0058] ;

[0059] in is the value of the tth coefficient in the i-th row and j-th column of the input matrix, is the tth entry of the jth element in the secret vector, and l is the number of columns in the matrix A.

[0060] Compared with the multiple loading and redundant repetition of sk in the original method, the total number of loading times is reduced from k × l × n to l × n after optimization, which not only reduces memory overhead but also shortens the data path and computing link, effectively reducing the overall latency.

[0061] 5. Enhance cross-platform portability and scalability;

[0062] The proposed optimization scheme is independent of specific platform hardware characteristics and is applicable to a variety of computing environments, including general-purpose GPU architectures, FPGA logic units, and RISC-V embedded instruction sets. It maintains excellent computing performance in resource-constrained or high-concurrency scenarios, offers high scalability and deployment flexibility, and provides strong support for the application of post-quantum cryptographic algorithms in terminal devices. BRIEF DESCRIPTION OF THE DRAWINGS

[0063] Figure 1 It is a schematic diagram of row-column conversion of the matrix-vector multiplication of the present invention;

[0064] Figure 2 It is a calculation flow chart of the present invention. DETAILED DESCRIPTION

[0065] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments:

[0066] In one embodiment of the present invention, a matrix-vector multiplication implementation method combining column-major data rearrangement and computational kernel optimization is proposed, using the public key generation process in the lattice-based encryption algorithm Kyber as the application context. This method is suitable for cryptographic algorithms that perform frequent matrix-vector multiplication operations and has good portability and efficiency performance on the embedded RISC-V platform. Its goal is to reduce memory access latency, reduce redundant modular operations, optimize on-chip resource scheduling, and improve overall computational efficiency. The following is a schematic diagram of row-column conversion combined with matrix-vector multiplication. Figure 1 ,process Figure 2 , giving a complete implementation process, where Figure 1 The optimized process of matrix-vector multiplication in Kyber public key generation is demonstrated: by loading the coefficients of matrix A in batches by columns, avoiding repeated reading of the private key vector sk, and performing multiplication on the coefficients sk with odd subscripts. 2t+1 Pre-multiply the rotation factor ζ required by NTT 2br7(t)+1 , to achieve efficient point multiplication calculation, and finally store the result as public key pk by column. 2t+1 represents the t-th coefficient in the odd-numbered subscript position in the secret key vector; ζ 2br7(t)+1is the pre-prepared "twiddle factor" in NTT, where ζ is a primitive root used in NTT, and br7(t) represents a 7-bit bit-flip operation. This formula is used to pre-convert the private key coefficients into a form suitable for NTT operations, improving overall computational efficiency and optimizing data access patterns.

[0067] Step 1. Before entering the matrix-vector multiplication operation, the system must first allocate memory space for the polynomial matrix a[i][j][t] and secret vector sk[j][t] involved in the operation. Taking Kyber-1024 as an example, its parameters are k=1, l=4, and n=256, meaning that the dimension of matrix A is 4×4, and each element is a 256th-order polynomial. Specifically, the index range in matrix a[i][j][t] is: i∈[0,3]: represents the i-th row of the matrix; j∈[0,3]: represents the j-th column of the matrix; and t∈[0,255]: represents the t-th coefficient, i.e., the t-th term of the polynomial in the NTT domain. In RISC-V main memory or shared SRAM, two separate buffers are allocated for matrix A and vector sk, ensuring that their first addresses are aligned to cache line boundaries to enhance cache hit rates during subsequent accesses. At the same time, space is reserved for the vector pk[i][t] for storing the calculation results and initialized to all zeros for accumulating the intermediate product results item by item.

[0068] Step 2: After completing the basic memory configuration, the main control program performs a structural rearrangement on the original data. In the Kyber implementation, the original polynomial matrix is ​​typically laid out in a "row-major" manner, meaning that each row stores a complete polynomial, with all its coefficients arranged consecutively in memory. While suitable for serial processing, in parallel computing on embedded platforms, this arrangement can lead to frequent cross-row accesses by different computing modules, resulting in memory access conflicts and cache failures. This embodiment uses a one-time transposition to rearrange all data in a "column-major" order. Specifically, in the original layout, the matrix elements are stored in memory in the following order:

[0069] ;

[0070] The column-first structure after transposition fixes each coefficient index t∈[0,n) and arranges them by column aggregation as follows:

[0071] ;

[0072] Described in array form, the transpose can be expressed by the following formula:

[0073] ;

[0074] Here, i∈[0,3], j∈[0,3], and t∈[0,255]. This layout ensures that all column elements with the same coefficient index t are arranged contiguously in memory, enabling efficient reuse of the secret vector sk[j][t] in matrix-vector multiplication, improving data locality and reducing memory access conflicts.

[0075] Step 3: After data rearrangement is complete, the matrix-vector multiplication phase begins. The scheduler divides the task by columns based on the matrix size, with each column being independently computed by a processing core. Each core loads the entire matrix data for the corresponding column from its local cache and simultaneously loads all elements required for that column in the secret vector. With the support of RISC-V's V extension, each core can perform a set of modular multiplication operations using instructions and accumulate the results using registers, avoiding frequent accesses to main memory. This operation highly optimizes memory access patterns, significantly reducing memory access latency because all data involved in the calculation is stored in contiguous storage areas.

[0076] Step 4: After completing all multiplication calculations for the current column, each column processing module stores the accumulated results in a local register or L1 data cache. To ensure consistency and access efficiency, the system writes the calculation results to the storage area corresponding to the public key vector pk[i][t] in a pre-set structural order. Because all write operations are performed uniformly on a column-by-column basis, the write addresses are continuous and well-aligned, leveraging the processor's bandwidth merging and write buffering mechanisms to improve writeback efficiency and reduce system bus contention.

[0077] Step 5: After all columns are processed, the master control program issues a synchronization command to flush the relevant cache contents and ensure that the results have been correctly written to the target area. Subsequently, the intermediate cache resources are released and the register status is cleared, preparing for the next round of encryption, decryption, or signing operations. This process also includes the protection and cleanup of sk and a to meet the security requirement of clearing keys after use. This step is particularly critical in embedded systems, preventing the leakage of sensitive intermediate data and reducing power consumption.

[0078] Through the above implementation process, this paper addresses the public key generation calculation process in the Kyber algorithm by combining a column-major data structure, a column-scheduling computation path, and a cache-friendly access pattern to achieve efficient matrix-vector multiplication on the RISC-V architecture. This approach not only optimizes memory bandwidth utilization and reduces the number of repeated sk loads, but also improves data locality and register reuse efficiency, ensuring algorithm performance under resource-constrained conditions and possessing excellent application and promotion value.

[0079] The above description is merely a preferred embodiment of the present invention and does not constitute any other form of limitation to the present invention. Any modification or equivalent variation based on the technical essence of the present invention shall still fall within the scope of protection claimed by the present invention.

Claims

1. A matrix-vector multiplication optimization method based on the RISC-V platform, characterized in that: The following steps are involved: Step 1: Perform data layout rearrangement on the host side; During the initialization phase, which is the preprocessing phase before key generation or encryption, the host reorders all matrix data involved in the operation. Assuming the original input matrix is ​​A[i][j][t], it is arranged in row-major order in memory, that is, the data of the same row is stored in continuous address space. A column-major data storage method is constructed to reorder the three-dimensional array into column-major order, that is, the data of each column is continuously distributed in the physical address space. This is achieved by the following transposition operation: ； in is the row index of the matrix, is the column index of the matrix, Indicates the number of rows of original data, Indicates the number of columns of the original matrix; The first step constructs a column-first data storage method, reconstructs the execution process of matrix-vector multiplication, and rearranges the calculation order as follows: , first load all , and then multiply it by the corresponding , and add to the corresponding ; The computational process for building a column-first data storage method is formalized as follows: (1) Initialize the output vector: ； (2) For each sk[j][t], it is loaded only once; (3) Perform the following operations on the loaded sk[j][t]: For all i ∈ [0, k), execute ; in is the value of the tth coefficient in the i-th row and j-th column of the input matrix, is the tth entry of the jth element in the secret vector; Step 2: Data is transferred to the RISC-V platform, and computational mapping is performed using columns as processing units. During the data loading phase on the embedded platform, dot multiplication and accumulation operations are performed, using columns as basic data processing blocks. That is, the processing logic sequentially loads all A[i][j][t] on column j, then uniformly performs multiplication with the corresponding sk[j][t], and accumulates them item by item to each output vector pk[i][t]. Step 3: Optimize computing resource usage by combining the register lifecycle scheduling mechanism during the execution phase; Under the column-major data layout, only one set of sk[j][t] needs to be loaded each time, and the system will complete all matrix-vector multiplications related to it without caching the intermediate product results in the middle.

2. The matrix-vector multiplication optimization method based on the RISC-V platform according to claim 1, characterized in that: The matrix-vector multiplication optimization in step 2 is a dot multiplication and accumulation operation, which is as follows: ； in, is the value of the tth coefficient in the i-th row and j-th column of the input matrix, is the t-th entry of the j-th element in the secret vector, l is the number of columns of the matrix A, k is the number of rows of the matrix A, that is, the dimension of the output public key vector pk, and n is the number of coefficients of the polynomial in the NTT field.

3. The matrix-vector multiplication optimization method based on the RISC-V platform according to any one of claims 1 to 2, characterized in that: The matrix-vector multiplication optimization method is suitable for GPU, DSP and RISC-V parallel processing architectures.

Images