Configurable number-theory transformation parallel computing acceleration method and device for post quantum cryptography algorithm

Abstract

The invention discloses a configurable number-theory transformation parallel computing acceleration method and device for a post quantum cryptographic algorithm, and relates to the technical field of cryptographic algorithms. The number theory transformation is a calculation bottleneck in lattice-based post-quantum cryptography and PQC; a hardware accelerator specially designed for number theory transformation (NTT) is an effective solution for improving the execution speed. At present, a mainstream design neglects the influence of the scale of a calculation array, so that the design of an NTT calculation circuit is poor in flexibility and low in memory utilization rate, and a two-dimensional reconfigurable number theory transformation acceleration circuit is provided; the method is applied to a key generation stage, an encryption stage and a decryption stage of the post-quantum cryptographic algorithm. The NTT reconfigurable computing circuit provided by the invention can keep the utilization rate of hardware resources, and is suitable for mobile terminal equipment with limited resources; the NTT circuit adopts a low-complexity memory mapping scheme, so that the address control logic is greatly simplified, and the hardware overhead is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of cryptography and hardware accelerator, and particularly relates to a hardware acceleration implementation method for number theoretic transform, a hardware acceleration implementation device for number theoretic transform and a secure chip. BACKGROUND

[0002] As a kind of efficient mathematical tool, fast number theoretic transform (NTT) is widely used in various computing fields, such as signal processing, cryptography, polynomial multiplication, etc. As one of the core operators of post-quantum cryptography, NTT plays a crucial role in many high-performance computing scenarios. However, with the increasing demand for computing, especially in the context of large numbers and large bit widths, the computational complexity and resource demand of NTT have significantly increased, and traditional general-purpose processors often struggle to meet the performance requirements of practical applications. Therefore, NTT acceleration design based on special hardware has attracted widespread attention in the field of application-specific integrated circuits (ASIC) and field-programmable gate arrays (FPGA).

[0003] Currently, there are several problems with the hardware design of NTT modules. First, the limitations of logical judgment. In hardware design, the number of terms and the bit width are usually represented by fixed register values, which directly affect the processing path of the data stream and the generation of control signals. Due to the fixed nature of hardware logic, dynamically adjusting the number of terms and the bit width significantly increases the design complexity and control logic overhead. Second, the limitation of BRAM capacity. On hardware platforms such as FPGA, BRAM (Block Random Access Memory) is the main data buffering resource, and its capacity is usually fixed. Large number of terms and large bit width NTT calculations require larger buffer areas, and existing hardware designs often cannot meet this demand, thereby limiting the flexibility of the module. Finally, low resource utilization efficiency. In order to support larger numbers of terms and bit widths, some hardware designs use an over-provisioning strategy. Although this method can meet the demand, it also brings significant waste of hardware resources, including an increase in the occupation of logic units, registers, and memory resources, resulting in a significant increase in chip area and power consumption. The above problems directly lead to the poor flexibility of existing NTT hardware modules in practical applications, and the number of terms and bit widths supported by the transformation process are usually downward compatible but cannot be expanded upward. In other words, when the number of terms or bit width of the application scenario exceeds the design range, the existing hardware module needs to be redesigned or completely replaced, which not only increases the development cost but also significantly prolongs the product iteration cycle.

[0004] Past researchers have proposed various optimization strategies. For example, for hardware designs with fixed bit-width and number of terms, reconfigurable architectures are adopted to support a wider range of parameters; or by improving data buffering schemes, the utilization of BRAM is improved. However, these methods usually face some problems. The first is the trade-off of hardware overhead. Supporting dynamically configurable NTT modules usually requires complex control logic and larger register groups, which increases hardware overhead and design difficulty. The second is the conflict between performance and flexibility. Optimized designs often need to make a trade-off between performance and flexibility. For example, to achieve higher flexibility, part of the calculation speed may be sacrificed. Finally, there is a lack of algorithm and hardware co-optimization. Existing designs often focus on the optimization of hardware architecture, ignoring the potential improvement space of the NTT algorithm itself, such as using low-complexity transform algorithms to reduce hardware resource requirements.

[0005] Therefore, there is an urgent need in the art for a configurable NTT acceleration circuit that can flexibly adapt to various NTT scales and be efficiently deployed on resource-constrained platforms such as mobile devices or embedded environments. SUMMARY

[0006] The configurable NTT parallel computing acceleration method and device for post-quantum cryptography algorithms proposed by the present application solve the problems mentioned in the prior art.

[0007] To achieve the above purpose, the present application adopts the following technical scheme: a configurable NTT acceleration circuit and method for post-quantum cryptography algorithms, aiming to solve the deficiencies of traditional NTT hardware design in flexibility, memory utilization, and address control complexity. By introducing a fine-grained hardware reconfiguration mechanism inside the 2D-RCBFU and combining low-complexity data scheduling and memory mapping strategies, the present application can significantly improve the NTT computing throughput in the key generation, encryption, and decryption stages of post-quantum cryptography algorithms such as Kyber, Falcon, Saber, etc., while greatly reducing hardware resource occupation. Compared with existing technologies, the present application does not need to repeatedly reconfigure the hardware design when adapting to different polynomial degrees or security parameters, and is easy to deploy on mobile or embedded platforms, laying a solid foundation for the future large-scale promotion of post-quantum security algorithms.

[0008] As a first aspect of the present application, a two-dimensional reconfigurable acceleration circuit applied to NTT and INTT operation is proposed, which is characterized by the flexibility and versatility of 2D-RCBFU (two-dimensional coupled butterfly unit). Traditional NTT circuits are often based on one-dimensional BFU array or fixed-size two-dimensional array, which is prone to high hardware idle rate or high compensation calculation cost when the polynomial order or security parameter does not match the array size. In view of this situation, the present application couples multiple butterfly units along the row and column directions, and pre-installs reconfigurable switches and control logic at the hardware level, so that each unit can be freely combined or split according to the specific sub-stage of NTT or INTT. Through this method, when facing different point numbers, the 2D-RCBFU array can activate or merge the corresponding number of modules as needed, so that the operation unit maintains a high utilization rate in most cases and is no longer restricted by the design of a few fixed degrees.

[0009] In this two-dimensional reconfigurable structure, the circuit of the present application can not only perform complete Cooley-Tukey (CT) or Gentleman-Sande (GS) butterfly operation, but also can flexibly skip several sub-stages according to whether the input polynomial is already in the NTT domain. For example, if the algorithm needs to perform CT-NTT transformation on the input vector first, the 2D-RCBFU can be configured as a CT-form butterfly network to process multiple coefficients at a time; when the input polynomial has completed the NTT preprocessing and only needs to perform coefficient domain multiplication or inverse transformation, the interconnection between rows and columns can be adjusted to temporarily close some butterfly units or share operation resources with other units, thereby minimizing hardware idling. In contrast, traditional one-dimensional BFU or fixed 2D array often cannot achieve such fine-grained resource scheduling, resulting in waste in small-scale or partial NTT stage calculation.

[0010] As a second aspect of the present application, a low-complexity memory mapping method is proposed to solve the problems of excessive memory resource occupation and read-write conflict in NTT hardware acceleration, which is closely combined with the 2D-RCBFU circuit for optimization. This method improves from two angles: one is Data-Spliced, and the other is Rotary Register Array.

[0011] Data packing refers to "packing" multiple NTT coefficients with the same mapping mode in reading or writing back into the same memory address, so as to fully utilize the bit width of on-chip storage such as BRAM or SRAM. In a partial post-quantum cryptography scheme (such as Kyber), due to the low bit width of the security coefficient (usually between 13 and 16 bits), if a complete memory address is allocated for each coefficient, a large number of redundant bits will not be used. Through data packing, the application can store more NTT coefficient data without increasing the number of BRAMs, thereby reducing storage requirements and power consumption. At the same time, this packing method integrates data with the same access mode, and does not increase address conflict logic when reading and writing, but simplifies subsequent scheduling work.

[0012] The rotating register array further solves the address conflict problem when multiple results are written back at the same time in the NTT operation. In the process of performing butterfly operation, the 2D-RCBFU may generate multiple sets of intermediate results in the same clock cycle, and if they are directly written into the same BRAM address, it is easy to cause overwrite or write conflict. The application sets a register array composed of multiple rows or columns in hardware, temporarily stores the multiple results generated in each beat in the register, and then uses row and column rotation or shifting to write back the data to different physical addresses in turn. In this way, the construction of multiple levels of buffer or complex address scheduler is avoided, and the tedious logic judgment commonly used in the traditional constant geometry (CG) method is also saved. Thanks to this method, hardware designers can more conveniently manage the read and write steps and storage mapping, so that the overall system can significantly reduce the occupation of on-chip BRAM while maintaining high throughput.

[0013] As a third aspect of the application, a deployment method for using a configurable NTT circuit in the key generation, encryption and decryption stages of the post-quantum cryptography application scenario is provided. The application not only supports complete NTT-INTT operation, but also can directly perform subsequent operations when the input is already in the NTT domain, and when the algorithm needs to repeat NTT or process different sizes of polynomials multiple times, there is no need to redesign the hardware. Taking the Kyber protocol as an example, the key generation stage needs to call 256-order NTT multiple times for polynomial sampling and multiplication; if only one or part of the inverse transformation is needed in the encryption and decryption stages, the two-dimensional reconfigurable switch and data scheduling controller in the application can be used to turn off or merge part of the butterfly unit and the storage channel in time, avoiding a large amount of hardware idling. If the algorithm is upgraded to a higher security level (such as 512 or 1024 order NTT of Falcon), the application only needs to expand the row and column coupling number of the 2D-RCBFU in the hardware configuration file, so as to be compatible with larger scale NTT operation under the same architecture, without the need to invest huge manpower and material resources to redesign the wiring and logic.

[0014] The applicability of the present application on mobile terminals or embedded platforms is also highlighted. In recent years, with the development of the Internet of Things and the mobile Internet, many terminal devices need to realize secure communication under limited power consumption and area, which requires the core operation of post-quantum cryptography to be efficiently completed under the condition of lightweight hardware. Since the present application improves the bit utilization rate of BRAM through data splicing, the address control logic of the rotating register array is greatly simplified, and the 2D-RCBFU can flexibly allocate operation resources under most security parameters, so it can realize an observable throughput within a smaller area and power consumption budget, and is suitable for landing in mobile SoC, low-power FPGA and even customized ASIC. In addition, the present application does not need complex multi-buffering scheme in the operation process, reduces the hardware pipeline depth and timing pressure, makes the whole design more easy to wiring optimization and timing convergence, and provides technical feasibility for large-scale production.

[0015] Based on the above design concept, the present application shows high scalability and efficiency in comparison with the existing NTT hardware scheme. On the one hand, the present application can not only provide better resource utilization than the traditional one-dimensional BFU in small-scale (such as 128, 256 order) NTT applications, but also can be smoothly upgraded to 512, 1024 or even higher order, and continuously maintain a reasonable balance between operation throughput and memory overhead; on the other hand, the low complexity memory mapping method proposed by the present application can replace the complex ping-pong double buffering or constant geometry algorithm, not only reduces the implementation threshold, but also has significant advantages in hardware integration and timing design. In summary, the present application has wide and important practical value for NTT acceleration in post-quantum cryptography.

[0016] In summary, through the hardware design of two-dimensional reconfigurable coupled butterfly unit (2D-RCBFU) and the simple and efficient data splicing, rotating register array scheduling strategy, the present application successfully solves the key problems of flexibility and memory utilization of traditional NTT hardware, can consider multiple post-quantum cryptography protocols, support multiple security parameters, and adapt to the harsh resource restrictions of mobile terminals and embedded environments. Compared with existing fixed or large-scale two-dimensional array schemes, the present application can achieve higher operation efficiency and lower storage demand under any point number or any protocol variant, and provides stable technical support for the industrial application of post-quantum cryptography. Any equivalent or modification within the spirit and principles of the present application shall be included in the protection scope of the present application.

[0017] Compared with the existing technology, the present application has the beneficial effects that:

[0018] The core pain points of traditional NTT hardware are effectively solved by a two-dimensional reconfigurable coupled butterfly unit (2D-RCBFU) and a low-complexity memory mapping strategy, and a multi-dimensional technical breakthrough is realized. The two-dimensional reconfigurable architecture supports dynamic activation and splitting of BFU rows and columns. When the NTT point number changes, different scale operations can be quickly adapted through hardware configuration, avoiding resource idling of fixed arrays, and significantly improving hardware utilization. Efficient operation can be maintained in 256-point to 1024-point NTT scenarios.

[0019] The data splicing and rotating register array technology greatly optimizes the memory management efficiency. Multiple low-bit coefficients are packaged and stored in the same BRAM address. The row and column cyclic shift mechanism solves the write-back conflict, improves the BRAM bit utilization rate without increasing the storage resources, reduces the memory access frequency and data movement power consumption, and is especially suitable for low-bit wide protocols such as Kyber. The hybrid operation co-processing mechanism supports parallel execution of NTT sub-stage and coefficient domain multiplication. Through dynamic allocation of BFU resources, data movement overhead is reduced, operation parallelism is improved, and overall processing time is shortened.

[0020] The device has the advantages of multi-protocol compatibility and lightweight deployment. The same hardware architecture can support the NTT requirements of different protocols such as Kyber and Falcon by switching through configuration parameters, without the need for re-designing hardware. In embedded and mobile scenarios, BFU working mode can be dynamically adjusted according to computing power, idle units can be turned off, and clock frequency can be reduced, ensuring security parameters while controlling power consumption to meet the low-power requirements of Internet of Things devices. The test shows that compared with traditional design, this scheme has significantly improved in throughput, resource utilization and power consumption control, providing solid technical support for the industrial application of post-quantum cryptography. BRIEF DESCRIPTION OF DRAWINGS

[0021] The accompanying drawings are included to provide a further understanding of the application, and constitute a part of the specification, and together with the specific embodiments below, serve to explain the application, but do not constitute a limitation on the application.

[0022] Figure 1 The overall workflow diagram of the application is shown. The diagram shows how to call the configurable number theoretic transform (NTT) acceleration circuit to complete the main steps of key generation, encryption and decryption in post-quantum cryptography algorithm, including reading of external input data, configuration of two-dimensional reconfigurable coupled butterfly unit (2D-RCBFU), data scheduling during operation, and final result output. Through the flowchart, the interface between the hardware circuit and the upper layer of the cryptographic protocol can be intuitively understood, and the control signal and data flow relationship at each stage can be clearly seen.

[0023] Figure 2A simplified configuration flowchart of the two-dimensional reconfigurable coupled butterfly unit (2D-RCBFU) of the present application. The circuit layout of the coupling of multiple butterfly units (BFUs) in the row and column two-dimensional directions is shown in the figure, as well as the connection relationship of key components such as reconfigurable switches, controllers, modular multiplication units, and modular addition and subtraction units. Through this structure, the 2D-RCBFU can flexibly close or activate part of the butterfly unit when performing NTT / INTT operations of different scales, thereby realizing efficient use of resources and reducing redundant operations.

[0024] Figure 3 A simplified configuration flowchart of the 2D-RCBFU under different NTT scales of the present application. The figure shows how the present application adapts to new operation requirements by activating or closing part of the BFU and switching the row-column interconnection mode when the polynomial degree or input scale changes. The specific steps of obtaining the polynomial degree, analyzing the scale requirement, and reconfiguring the BFU connection are given in the figure, which can be used to understand the scalability and flexibility of the present application under various security parameters.

[0025] Figure 4 A schematic diagram of the data interaction path between the memory module and the calculation module. This figure focuses on the data flow and connection method between the memory module (such as BRAM or SRAM) and the 2D-RCBFU calculation array, the register array, and the data exchange module. From the figure, it can be seen that in the present application, how data is read from memory into the calculation unit, how it is written back after butterfly operation, and how data splicing and rotating register array techniques are used to avoid conflicts and improve memory utilization during reading and writing.

[0026] Figure 5 A schematic diagram of the CT-NTT algorithm and the GS-NTT algorithm combined to complete polynomial multiplication. The execution order of the Cooley-Tukey (CT) butterfly and the Gentleman-Sande (GS) butterfly is marked in the figure, as well as how they combine to realize fast NTT-based polynomial multiplication in the point-to-point multiplication link. This figure can help understand why the present application supports both butterfly structures on hardware to reduce additional bit inversion or preprocessing processes.

[0027] Figure 6 A comparison diagram between the original polynomial multiplication execution flow and the optimized polynomial multiplication execution flow of the present application. The top is the flow of separate execution of NTT, coefficient domain multiplication (CWM), and INTT in the traditional method, and the bottom is the optimized flow of the present application that fuses part of the isolated NTT sub-stage with CWM and uses a configurable hardware array for parallel operation. This comparison chart directly shows that the present application reduces additional overhead in data transfer and stage switching, thereby significantly improving computational efficiency.

[0028] Figure 7 The top-level architecture diagram of the number theoretic transform hardware accelerator. The diagram contains five parts: control module, memory module, register array, data exchange module, and calculation array (2D-RCBFU). The interaction between these modules and the signal direction are shown by arrows or lines in the diagram, and the unified scheduling of the control module for each operation stage and memory access is emphasized, which shows the framework of the overall hardware design of the application.

[0029] Figure 8 The coupled butterfly unit schematic diagram of the number theoretic transform acceleration circuit in the NTT calculation stage. The specific connection mode of the 2D-RCBFU when performing Cooley-Tukey butterfly operation is given in the diagram, and how the corresponding modular multiplication, modular adder and subtractor are combined to complete the grouped butterfly processing of each sub-stage of NTT. This schematic diagram reflects how the application improves parallelism and throughput by means of a two-dimensional array.

[0030] Figure 9 The circuit schematic diagram of the number theoretic transform acceleration circuit in the point multiplication stage and isolated NTT sub-stage. This diagram shows how the 2D-RCBFU disassembles the original complete butterfly structure when performing coefficient domain multiplication (CWM) or processing partial NTT / INTT sub-stage (such as when polynomial multiplication is fused), and directly uses part of the multiplier for coefficient multiplication while retaining support for the remaining sub-stage to maximize resource utilization.

[0031] Figure 10 The coupled butterfly unit schematic diagram of the number theoretic transform acceleration circuit in the INTT calculation stage. This diagram corresponds to the circuit layout of Gentleman-Sande (GS) butterfly operation, emphasizing the multiplication of the added scaling factor (1 / N) or 1 / 2 in the inverse transform process, and how to continue to maintain high parallelism in the two-dimensional coupled structure. Through this diagram, it can be understood how the application seamlessly switches between NTT and INTT core operations.

[0032] Figure 11 The circuit schematic diagram of the number theoretic transform acceleration circuit in the case where one of the inputs is known. For certain post-quantum cryptography scenarios (such as key generation or partial encryption and decryption process), the input polynomial B may already be in the NTT domain or pre-calculated. This diagram shows how the application can reuse the original multipliers, adders and subtractors of the 2D-RCBFU when only processing the NTT of polynomial A or coefficient multiplication, avoiding repeated calculation and additional resource consumption.

[0033] Figure 12Figure 6 is a diagram showing the data flow from the computation array, through the data exchange module and the register array, and finally to the memory array. This diagram visually demonstrates the row-column switching or shifting mechanism adopted by the rotating register array when writing back data, and shows how the multi-lane computation outputs can be effectively merged or distributed to different memory addresses in combination with the data stitching technique, to maximize the BRAM usage and prevent read-write conflicts.

[0034] Figure 13 Figure 7 is a diagram showing the initial addresses in the memory array for storing all data when the computation size is 64 points. This diagram illustrates, by way of a specific example, how the storage space needs to be allocated for a 64-point NTT computation under the low-complexity memory mapping method of the present application, and how each coefficient or its stitched combination corresponds to a physical address, revealing the data distribution pattern in the small-scale (64-point) scenario of the present application. This diagram can help better understand the address control logic during hardware synthesis, and how to universally extend the same mapping strategy to different scales. DETAILED DESCRIPTION

[0035] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0036] In the description of the present application, it should be understood that the terms "center", "longitudinal", "transverse", "length", "width", "thickness", "upper", "lower", "front", "rear", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer", "clockwise", "counterclockwise", and the like indicate the orientation or positional relationship based on the orientation or positional relationship shown in the drawings, and are only used to facilitate the description of the present application and simplify the description, and therefore cannot be understood as indicating or implying that the device or element referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the present application.

[0037] In addition, the terms "first", "second", "third", etc. are used only for descriptive purposes and do not connote or imply any relative importance or a quantity of the indicated technical features. Thus, features with "first", "second", "third" designations can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "a plurality" is two or more, unless otherwise expressly specified. In addition, the terms "mounting", "connecting", "connection" should be interpreted broadly, for example, it can be fixed connection, or detachable connection, or integral connection; it can be mechanical connection, or electrical connection; it can be direct connection, or indirect connection through an intermediate medium, or internal communication of two elements. For those skilled in the art, the specific meaning of the above terms in the present application can be understood according to the specific circumstances, and the present application will be further described in detail below with reference to the accompanying drawings.

[0038] Reference Figures 1 to 13 A specific embodiment of a configurable number theoretic transform (NTT) parallel computing acceleration method and device for post-quantum cryptography (PQC) algorithms.

[0039] It should be noted that the embodiments in the present application and the features in the embodiments can be combined with each other without conflict. The present application will be described in detail below with reference to the accompanying drawings and in combination with embodiments.

[0040] The present application aims to construct a configurable number theoretic transform (NTT) acceleration circuit for post-quantum cryptography (PQC) algorithms. Through the hardware layout of two-dimensional reconfigurable coupled butterfly unit (2D-RCBFU), the low complexity memory mapping scheme and the flexible data scheduling strategy, the circuit realizes effective support for a variety of different scale NTT / INTT operations and coefficient domain multiplication (CWM) process. In the overall architecture of the present application, the efficient use of memory resources and the avoidance of data read-write conflicts are equally important, especially considering that in post-quantum cryptography, the degree and bit width of polynomials can change, if only the traditional fixed scale butterfly structure or one-dimensional arrangement is used, it will be difficult to balance hardware utilization and computing throughput.

[0041] The following specific embodiments sequentially introduce the working principle of the present application in key generation, encryption and decryption, and even only using part of the NTT sub-stage, and details how to combine the core components and processes shown in Figures 1 to 13 It should be noted that these embodiments are not the only limitation of the present application, any improvement, deformation and equivalent replacement consistent with the idea and scope of the present application shall fall within the protection scope of the present application.

[0042] In the post-quantum cryptography system, most of the algorithms based on lattice problems (RLWE, MLWE, etc.) need to perform fast convolution on large-scale polynomials or vectors, and NTT / INTT is the core method to realize these convolution operations. The traditional method is often based on linear arrangement of one-dimensional butterfly unit (BFU) or relatively single two-dimensional fixed array, but when facing different security parameters, the following bottlenecks often appear:

[0043] Lack of flexibility: When the polynomial order does not match the array size, the hardware can only idle part of the multiplier or adder, or need manual compensation operation, which cannot meet the dynamic changing security demand; Memory resource waste: On the one hand, the BRAM with large bit width is idle for a large number of valid bits when storing low-bit coefficients; on the other hand, the read-write conflict leads to the dependence on complex double buffering or multi-stage pipelining, which further aggravates the consumption of storage resources; Too much data transfer: NTT / INTT may alternate with coefficient domain multiplication (CWM) or other sub-stages, and if the design is not proper, frequent data transmission back and forth will seriously slow down the system throughput; Poor scalability: Some hardware solutions are designed only for fixed point number N or single protocol scenario, and when the demand changes, large-scale reuse or reconfiguration of the circuit is needed, which increases the difficulty of research and verification.

[0044] To solve the above problems, the application proposes an acceleration circuit integrating two-dimensional reconfigurable coupled butterfly unit (2D-RCBFU) and low complexity memory mapping strategy, which realizes the consideration of multiple NTT scales, simplification of data conflict processing and improvement of memory utilization in a set of hardware architecture. Figure 1 The figure shows the overall workflow of the application, covering the data interaction process between the upper protocol and the hardware accelerator. After the system is powered on or reset, the initialization stage is entered, and the control register and resource allocation are preliminarily set. When the upper layer needs to perform NTT or INTT, the polynomial / vector data to be processed is sent to the accelerator memory module through the interface; then, the control module will decide the specific row and column scale configuration of 2D-RCBFU according to the security parameters (such as Kyber256 point, Falcon512 or 1024 point, etc.), and on this basis, the operation and data scheduling are performed. Finally, the resulting polynomial or vector will be sent back to the upper protocol for subsequent signature, encryption or decryption process.

[0045] The two-dimensional reconfigurable coupled butterfly unit of the application is composed of multiple rows and columns of BFUs, each BFU unit comprising: a modulo addition / subtraction unit: for performing addition or subtraction operations in a finite field; a modulo multiplication unit: in the NTT / INTT butterfly stage, the modulo multiplier needs to be able to perform multiple multiplication modes, including constant multiplication (such as 1 / 2, 1 / N) and generic multiplication; a reconfigurable switch: through the row and column coupling lines and the controller, it is determined whether the BFU is connected with its adjacent BFU, and some BFUs can also be temporarily turned off to save resources; a local controller or auxiliary register: stores the current working mode of the BFU (CT or GS butterfly, etc.), selects which omega index table, and how to split when performing point multiplication (CWM) or isolated NTT sub-stage.

[0046] In a traditional one-dimensional array, the BFU is arranged in only one direction. If the polynomial size does not match the number of BFUs, there will be idle or frequent compensation operations. The application enables more rows and columns to be activated simultaneously when the polynomial size is large through two-dimensional coupling; when the size is small, only a small number of rows and columns need to be enabled. Such reconfigurable characteristics lay the foundation for flexible adaptation to different point numbers N.

[0047] When the system detects a new round of NTT / INTT operation or security parameter update, the following operation process is performed according to the configuration process of Figure 3 : analyzing the new size or protocol information; obtaining the current point number N and specific mode (complete NTT or partial NTT) from the upper layer or control register, if it is the same as the last time, there is no need to reconfigure; row and column size selection: if the point number N is smaller than before, turn off a part of the rows and columns; if the point number N increases, enable more BFUs in parallel; if the input polynomial is in the NTT domain, only the CWM or INTT part can be switched;

[0048] Switching the reconfigurable switch: enabling or disabling the connection between the rows and columns through hardware programming, also determining the internal connection mode of the BFU; if point multiplication is needed, some modulo multipliers need to be scheduled separately; loading the primitive root table or constant: loading the omega and 1 / 2 factors needed for NTT / INTT from external ROM or internal register into the BFU; checking and taking effect: checking whether there is a resource conflict or out-of-bound access, if everything is normal, generating the final configuration signal and entering the next operation stage. This simplified configuration process is not only suitable for Kyber's 256 points, but also can be extended to Falcon's 512, 1024 points. If the protocol is upgraded to a higher order NTT in the future, only the BFU rows and columns need to be increased and the corresponding rotation factor table needs to be loaded in the control module, without the need to completely redesign the hardware.

[0049] The application sets a data exchange module and a set of register arrays (also known as rotating register arrays) between the memory (BRAM or SRAM) and the 2D-RCBFU. The data exchange module is responsible for reading the coefficients to the calculation array according to the step size, and splitting or merging the output results in the write-back stage; the register array plays the role of buffering and row-column cycling, so that the multiple data generated in the same clock cycle can be dispersed to different addresses.

[0050] Compared with the traditional ping-pong double buffering or complex selector, the rotating register array of the application greatly simplifies the address conflict management: as long as the register output order is changed in turn in the write-back stage, the problem of multiple writing to a single address can be avoided. At the same time, when the size of the polynomial changes, the row and column depth of the register array can also be adjusted in proportion, without the need for large-scale modification of the control logic.

[0051] For Kyber and other protocols using 16-bit or even 13-bit coefficients, if each coefficient occupies a BRAM address with a width of 32 bits or 64 bits, a large number of idle bits will be wasted. The application stores several coefficients with the same access mode in the same physical address by data splicing. For example, assuming that the BRAM width is 64 bits, four 16-bit coefficients can be packaged and written to one address. In this way, the BRAM utilization rate is greatly improved, and the address space requirement is also reduced.

[0052] In order to cooperate with this strategy, the application performs de-splicing in the read stage by the data exchange module, that is, multiple coefficients are distributed to the BFU from a 64-bit data; and the reverse operation is performed in the write-back stage, that is, multiple coefficients are stored. The address mapping table arranged in sequence is still reserved in the memory, and the outside world only needs to know "which coefficients are included in a certain address", without the need for additional algorithms.

[0053] Figure 5 The typical data flow of CT-NTT (Cooley-Tukey) and GS-NTT (Gentleman-Sande) is described in the specification. In the NTT stage, the application defaults to CT butterfly, which maps the time domain coefficients to the frequency domain step by step; in the INTT stage, GS butterfly is used to cooperate with 1 / 2 or 1 / N scaling, so as to avoid the separate bit inversion overhead. At the hardware level: each BFU performs u+ω·v and u-ω·v operations in the CT mode; performs (u+v) / 2 and ω·(u-v) / 2 in the GS mode; if the number of ω factors required by the protocol exceeds the general range, it can be loaded in batches through an external ROM. The application reserves programmable multiplication control signals in the 2D-RCBFU to integrate 1 / 2 or 1 / N into the same hardware flow, so that additional multiplication is no longer needed after the sub-stage, which saves operation time and improves the multiplexing rate of the array.

[0054] Figure 6 The original polynomial multiplication execution flow (top) and the optimized flow (bottom) of the present application are shown. In the original flow, NTT, CWM, and INTT are performed respectively. In particular, "isolated sub-stages" often occur at the boundary of CWM and NTT / INTT, resulting in the need to move data to the memory or registers multiple times and then switch the operation unit. If the polynomial size does not match the hardware array, additional sub-stage compensation must also be performed. The present application uses a "fusion" strategy to process part of the tail of NTT or the head of INTT and CWM uniformly on the hardware, and activates the required multipliers and adders in parallel to avoid unnecessary transportation. For example, the coefficient multiplication of A^o·B^o·w and A^e·B^e in Kyber can be performed by part of the BFU, while the remaining BFU continues to complete the NTT or INTT sub-stage. This not only reduces the read-write waiting time, but also ensures the full use of the operation unit, from Figure 6 It can be seen that the connection between stages in the lower flow is more compact.

[0055] Figure 7 The top-level architecture of the hardware accelerator for number-theoretic transform is shown. The design consists of five parts: a control module, a memory module, a register array, a data exchange module, and a calculation array (2D-RCBFU). The functions and coordination mechanisms of each module are described as follows: control module, this module includes a register group and a small state machine, which is used to parse external instructions and protocol requirements. After receiving commands such as "perform NTT (256 points)" or "perform INTT (512 points) only", it will start the simplified configuration flow ( Figure 3 ) to select the row and column size, load the ω table, issue the address step, and monitor the sub-stage progress during operation.

[0056] Memory module, in typical scenarios, it is on-chip BRAM, and it can also be extended to SRAM array in large SoC or ASIC. Through the data splicing strategy ( Figure 4 、 Figure 12 、 Figure 13 ), the bit utilization rate can be significantly improved. The memory module itself provides two ports, one connected to the external bus (CPU or host computer), and the other connected to the data exchange module of the present application, realizing real-time or batch coefficient reading and result writing back. Register array (rotating register array), in the reading stage, the array is not eye-catching, only the data taken is cached; but in the writing back, through row and column cycling or shifting, multiple BFU outputs are mapped to different addresses in turn, greatly reducing the collision risk. If the number of BFUs increases, the array can increase the row and column dimensions accordingly to ensure the throughput.

[0057] Data exchange module, connecting memory and register array, providing appropriate address step for each read / write back, also responsible for disassembling or assembling data stream. For example, when BFU needs to process a 64-bit assembled data, data exchange module will send it to BFU as several 16-bit data; while in write back, it will do the opposite operation.

[0058] Computing array (2D-RCBFU), the core of the invention. According to the configuration, it can determine how many BFU rows and columns are activated, and how to set the butterfly pattern (CT or GS). When performing hybrid operation (NTT tail + CWM + INTT head), part of the BFU and multiplier can be split to perform point multiplication, and the other part still maintains the butterfly connection, maximizing parallelism.

[0059] Figure 8 Detailed description of how to use 2D-RCBFU to perform batch butterfly operation in NTT stage (Cooley-Tukey). If the polynomial length is 256, 8 rows and 4 columns of BFU can be activated in the initial configuration. When N = 8, the data block processed in each sub-stage is taken out by the data exchange module according to the step and sent to the corresponding row and column of BFU. Because the row and column can be reconfigured, if only 128-point operation is needed, some rows and columns can be closed, and the effective BFU can complete all sub-stages in a shorter time. The register array is mainly responsible for shifting or assembling the write back data during this process. After the whole NTT is completed, 2D-RCBFU can be switched to the next link (CWM or INTT) synchronously with the control module.

[0060] Figure 9 When coefficient domain multiplication (CWM) and partial NTT or INTT sub-stage need to be performed simultaneously in the invention, how to disassemble the originally tightly coupled butterfly structure is shown. Specifically, part of the BFU can be extracted from the modulus multiplier for additional multiplication operations such as A^o·B^o·w; the remaining BFU continues to perform NTT butterfly. This mode is particularly common in Kyber, because Kyber divides the polynomial into even part (A^e, B^e) and odd part (A^o, B^o), and CWM needs to multiply by w constant. If the traditional method needs to complete all NTT first and then perform multiplication, it will inevitably waste clock cycles, while the invention can combine the operations through this disassembled operation to improve the throughput.

[0061] Figure 10Corresponding to Gentleman-Sande butterfly, used to perform inverse transform INTT. Similar to CT-NTT in that it still relies on row-column coupling and parallelism, but the difference is that it needs to multiply by 1 / 2 or 1 / N factor after each stage of butterfly. The present application integrates a configurable constant multiplier in the BFU unit, which can multiply by 1 / 2 immediately after the butterfly completes (u+v) or (u-v), and send the result to the next stage or write back to memory. If only part of the INTT is performed (such as the input itself has undergone several inverse transform sub-stages), unnecessary rows and columns can also be turned off, or only modulus multiplication is performed on the remaining stages.

[0062] In post-quantum cryptographic protocols, sometimes polynomial B has already been in the NTT domain, while A is still in the time domain. When only NTT needs to be performed on A or CWM is performed on A·B and then INTT is performed, Figure 11 The circuit layout shown works: the 2D-RCBFU can determine at initialization that "B does not need to be re-NTT" and directly access the BFU multipliers occupied by the CWM part for the coefficients of B, while the other BFUs perform NTT for A. When A completes NTT, the two sets of results can immediately be point-multiplied or INTT in the next cycle. The traditional approach may require a large number of multipliers to be occupied by idle hardware for B. The circuit of the present application only needs to be configured in the row-column switch, so that B or A occupies the corresponding channel, greatly improving parallel efficiency and reducing resource idling.

[0063] Figure 12 Focus on the process of data output from the computing array to the final write-back memory. The 2D-RCBFU can generate multiple outputs in the same clock cycle, as multiple groups of BFUs operate in parallel in the same sub-stage. Without special processing, it will cause write conflicts or require complex control. After introducing a rotating register array, the multiple outputs can be temporarily stored in the row-column registers first, and then written to different memory addresses in batches in the following several clock cycles through the row-column shift mechanism, avoiding overwriting or preemption. In addition, when data splicing is used, multiple coefficient groups also need to be combined into a wider data word before being written back to the same physical address. This process is simple and easy in logic, and does not depend on additional buffers.

[0064] Figure 13The allocation of initial addresses of the memory array is listed in the case of a 64-point NTT scenario. If the BRAM width is 64 bits and each coefficient is 16 bits, 4 coefficients can be stored in the same address. The coefficients 0-3 are combined into address 0, the coefficients 4-7 are combined into address 1, and so on, as shown in the figure. In this way, the waste of invalid bits is greatly reduced. When the BFU needs to be accessed, the coefficients 0-3 can be obtained by reading address 0. Similarly, when writing back, the spliced data is sequentially written into different addresses with the cooperation of the rotation register array. Meanwhile, the mapping strategy can be easily extended to 256, 512 or even 1024-point NTT, as long as new step and splicing parameter tables are set in the control module.

[0065] The Kyber protocol uses a 256-point polynomial, and the polynomial is divided into even and odd parts. The key generation process usually needs multiple NTT operations to process random sampling or polynomial products. The present application has obvious advantages in the Kyber protocol: when A and B are in the time domain, the 2D-RCBFU performs CT-NTT(A) and CT-NTT(B) in full parallel, then combines point multiplication (CWM), and finally uses GS-INTT to restore; if B is already in the NTT domain, only A needs to be NTTed, and then directly enters the point multiplication and remaining INTT stage; data splicing is used to fully compress the Kyber coefficient occupation in the BRAM, and the rotation register array is used to reduce the write-back conflict. Experiments show that, when the present application is implemented on a mid-end FPGA platform, compared with the traditional fixed 2D array or one-dimensional BFU arrangement, the memory utilization rate is increased by about 30%-50%, the overall throughput rate is increased by about 20%-40%, and the timing convergence is also relatively stable.

[0066] The Falcon protocol usually uses 512 or 1024-point NTT, which puts higher requirements on hardware resources and flexibility. The 2D-RCBFU of the present application can automatically schedule the BFU rows and columns according to the point size, so it only needs to define a larger scale of row and column number at the initial layout. When switching back to the 256-point scale, the redundant BFUs can also be turned off. In this way, the same chip can be compatible with Kyber and Falcon. Compared with the method of needing separate hardware or multiple sets of design, the present application has obvious advantages in hardware resource reuse. In actual measurement, when the NTT order is expanded to 1024, if the one-dimensional array is continued to be used, the hardware overhead and idleness will increase significantly, while the present application achieves large-scale parallelism by activating more rows and columns, without increasing the memory requirement or wasting multipliers.

[0067] In recent years, the demand for IoT and mobile computing has been rising, and some security protocols need to execute post-quantum cryptography in environments with limited power consumption and area. Traditionally, large-scale NTT operations are incompatible with limited hardware environments. In this invention: data concatenation reduces the waste of BRAM, allowing more coefficients to be accommodated in limited BRAM; the rotating register array reduces the dependence on multi-level buffers and complex selectors, reducing the number of logic gates; row and column reconfigurability allows only a few BFU operations to be used when security parameters are low, avoiding the power waste caused by the entire array working simultaneously. Therefore, it can provide sufficient NTT acceleration capability for lightweight SoCs or low-to-mid-range FPGAs, and ensure the real-time performance of security protocols within a reasonable clock frequency.

[0068] To evaluate the effectiveness of this invention, synthesis and testing can be performed on FPGA or ASIC prototypes of different sizes. Results typically show: a balance between throughput and resource consumption: compared to some fixed 2D large-scale arrays, this invention maintains relatively stable efficiency for different point counts N, without requiring a large number of idle multipliers; improved memory utilization: data concatenation is particularly significant in low-bit-width protocols such as Kyber or Saber, with BRAM utilization reaching 2-3 times the original; reduced complexity: by using a rotating register array, traditional collision detection units and multiplexers are avoided, making timing and routing easier to optimize after hardware synthesis, and leaving room for future expansion. Regarding scalability: higher-order NTT: if the number of points is increased to 2048 or 4096, only appropriate row and column sizes and the original root table size need to be added during hardware design. During runtime, through... Figure 3 Simplified configuration steps ensure compatibility; More post-quantum protocols: In addition to Kyber and Falcon, protocols such as Saber and Dilithium, if they have similar requirements in the NTT or polynomial convolution stage, can also use this invention to achieve the same acceleration approach; Integration with other optimization techniques: Higher radix (radix-4 / 8) can be introduced within the butterfly unit to improve single BFU throughput in conjunction with the pipeline; or deep optimization can be performed at the data splicing level, such as little-endian / big-endian hybrid mapping, thereby further adapting to the BRAM characteristics of hardware manufacturers. System-level collaboration: In higher-level SoCs, if data interaction with the CPU or DMA is required, the control module of this invention can obtain NTT instructions or load / export coefficients through the standard AXI interface, providing unified and secure acceleration for the entire platform.

[0069] To further illustrate the feasibility of the present application, a specific implementation case is listed below: a 2D-RCBFU array is constructed on a Xilinx mid-end FPGA, with 4 BFUs per row and 8 BFUs per column, totaling 32 BFUs. For Kyber 256-degree NTT, 4 rows and 4 columns (16 BFUs) are turned on, and the remaining rows and columns are turned off; when switching to Falcon 512, 6 rows and 4 columns (24 BFUs) are activated; if upgraded to Falcon 1024, all rows and columns are turned on. By rotating the register array and splicing the data, 16-bit coefficients are packed into 64-bit, corresponding to a BRAM address, which can read or write 4 coefficients at a time. The results show that in the 256-point NTT scenario, the throughput significantly exceeds that of the traditional one-dimensional 4BFU design; in the 1024-point NTT, a high degree of parallelism can still be maintained, and the additional hardware overhead is only reflected in the activation of previously reserved BFU rows and columns, without the need to increase the layout of the new array. This implementation also reduces the conflict detection circuit by nearly half when reading and writing memory, and the corresponding timing and power consumption performance is also better.

[0070] In actual industrial applications, this scheme can be used as a post-quantum cryptography hardware acceleration IP combined with a protocol stack or security hardware module. Especially when different security levels or multiple RLWE algorithms need to be supported in a system, the present application provides a unified hardware platform, eliminating the need for a separate NTT array for each protocol. By writing the corresponding parameters during programming, flexible switching can be achieved, fully demonstrating its important value in the post-quantum era.

[0071] In summary, the present application provides a hardware acceleration method for number theoretic transform (NTT / INTT) in post-quantum cryptography, which combines high throughput, flexibility, and efficient resource utilization, through 2D-RCBFU and low-complexity memory mapping technology. This scheme manages BFU at the row and column reconfigurable level, greatly simplifies address conflict processing through data splicing and rotating register arrays, and finds a compromise between high parallelism and low storage overhead. Whether for different security parameters such as Kyber, Falcon, or other polynomial multiplication scenarios of post-quantum protocols, the same hardware architecture can be smoothly transitioned and good performance can be maintained.

[0072] In the mobile terminal or embedded deployment case, the application also shows high feasibility and compatibility due to small memory resource occupation and simple control logic. If higher order NTT is required for subsequent security standard upgrade, it can also be realized by expanding the BFU row and column size and the size of the primitive root table, which is seamlessly connected with the existing design. In summary, the 2D-RCBFU acceleration circuit proposed in the application provides strong technical support for post-quantum cryptography hardware and industrialization. Any modification, deformation, equivalent replacement or change within the technical range disclosed in the application according to the technical solution and the inventive concept of the application shall be covered within the protection scope of the application.

[0073] The above is only the preferred specific embodiment of the application, but the protection scope of the application is not limited thereto, and any person skilled in the art can make equivalent replacement or change within the technical range disclosed in the application according to the technical solution and the inventive concept of the application, which shall be covered within the protection scope of the application.

Claims

1. A configurable parallel computation acceleration method for the number theoretic transform of a post-quantum cryptographic algorithm, characterized in that, Comprise: Hardware configuration initialization step: receiving the security parameters of the post-quantum cryptographic algorithm, determining the NTT number theory transform operation point number N, dynamically configuring the row and column scale of the two-dimensional reconfigurable coupled butterfly unit 2D-RCBFU according to the N value; if N increases, activate the remaining BFU butterfly unit row and column, if N decreases, close part of the row and column; load the primitive root table corresponding to the N value to the modulus multiplication unit of the 2D-RCBFU, configure the reconfiguration switch to determine the row and column interconnection mode between the BFUs, select the CT library-Butterfly or GS Gentry-Sande Butterfly operation mode, and complete the hardware initialization; wherein the primitive root table stores the rotation factor ω used for NTT operation, and the reconfiguration switch is a hardware programmed interconnection circuit, supporting the dynamic switching of the data path between the BFUs; Data preprocessing and splicing step: standardizing the input polynomial coefficients, and performing data splicing according to the coefficient bit width; pack each low bit coefficient to the same BRAM block random memory address, generate a splicing mapping table through a data exchange module, and improve the BRAM bit utilization rate; the data exchange module is a bidirectional data processing unit, responsible for unpacking and packing the splicing data, and the mapping table records the storage location of the coefficients in the BRAM; Parallel butterfly operation execution step: based on the reconfiguration architecture of the 2D-RCBFU, the NTT or INTT inverse number theory transform operation is executed in parallel; in the CT mode, the BFU performs u+ω・v and u−ω・v operations on the input coefficients; in the GS mode, (u+v) / 2 and ω・(u−v) / 2 operations are performed, and each level of butterfly parallel processing is realized through the row and column coupled BFU array, and when the input has been in the NTT domain, part of the transform sub-stage is skipped to directly execute the coefficient domain multiplication or inverse transform; wherein u and v are the input polynomial coefficients, ω is the rotation factor, and the operation is performed in the finite field to perform modulus addition, modulus subtraction and modulus multiplication operations.

2. The configurable parallel computation acceleration method of the post-quantum cryptography algorithm-oriented number theoretic transform according to claim 1, characterized in that, Also include: Rotation register buffer and write-back step: when the butterfly operation result is written back to the memory, the rotation register array is used to temporarily store the multiple intermediate results generated in the same clock cycle, and the data is dispersed to different physical addresses through the row and column cyclic shift mechanism to avoid BRAM write conflict; before writing back, the spliced coefficients are merged, and the corresponding BRAM address is written according to the splicing mapping table; the rotation register array is a register matrix, which realizes data caching and address dispersion through shift operation, and the row and column cyclic shift mechanism controls the output order of the register data through the clock; Mixed operation cooperative processing step: when NTT sub-stage and coefficient domain multiplication CWM need to be executed simultaneously, part of the 2D-RCBFU is split for CWM operation, and the remaining BFU continues to execute butterfly transform; in the Kyber protocol, the point multiplication operation of the polynomial parity part is allocated to an independent BFU, and is executed in parallel with the NTT sub-stage; CWM is a coefficient domain multiplication operation, which is used for point multiplication operation in polynomial multiplication, and the parity part refers to the two parts after the polynomial is split according to the parity of the coefficient index; Dynamic protocol adaptation step: adjust the hardware configuration parameters for different post-quantum cryptography protocols, activate the 4*4 row-column BFU array when processing the 256-point NTT of Kyber protocol, and use the 16-bit coefficient splicing strategy; when processing the 1024-point NTT of Falcon protocol, expand to 8*8 row-column BFU array, load the corresponding primitive root table, and switch the protocol mode through the state machine of the control module to realize the compatible acceleration of each protocol; wherein the state machine is a finite state automaton, which is used to control the state transition and operation process of the hardware module.

3. The configurable parallel computation acceleration method of number theoretic transform for post-quantum cryptography algorithm according to claim 1, characterized in that, Also includes: Resource scheduling step: in the embedded or mobile terminal scene, dynamically adjust the working mode of 2D-RCBFU according to the device computing power; when the device power consumption is limited or the computing power is insufficient, close the redundant BFU row and column, and only keep the necessary operation unit; by cooperatively adjusting the clock frequency and parallelism, the hardware power consumption is controlled within the target range under the premise of ensuring the security parameters, which is suitable for the low-power demand of Internet of Things devices; the clock frequency is the clock signal frequency of hardware work, and the parallelism refers to the number of BFUs that perform operations at the same time.

4. The configurable computational parallel acceleration method of the post-quantum cryptography algorithm-oriented number theoretic transform according to claim 1, characterized in that, The configuration of the reconstruction switch in the hardware configuration initialization step includes enabling or disabling the connection between the BFU rows and columns through hardware programming, and determining the connection mode of the BFU internal modular multiplication unit and the modular addition and subtraction unit; when performing INTT, the multiplication operation of the 1 / 2 or 1 / N scaling factor is automatically triggered after the GS butterfly operation, the scaling factor is integrated into the hardware process, and additional sub-stage operations are avoided; The scaling factor is used for result scaling in INTT operation, and 1 / N is the normalization factor of inverse transformation, which is calculated through a hardware multiplier.

5. The configurable parallel computation acceleration method of number theoretic transform for post-quantum cryptography algorithm according to claim 1, characterized in that, In the data preprocessing and splicing step, the data splicing strategy includes dynamically adjusting the number of splicing coefficients according to the BRAM bit width, splicing 2 16-bit coefficients when the BRAM bit width is 32 bits, and splicing 8 16-bit coefficients when the BRAM bit width is 128 bits; when reading data, the data exchange module unpacks according to the splicing mapping table to ensure that the operation unit obtains the correct coefficient, and the bit width refers to the bit width of the BRAM storage unit, reflecting the amount of data processed at a time.

6. The configurable parallel computation acceleration method of the post-quantum cryptography algorithm based on number theory transformation according to claim 2, characterized in that, In the rotation register buffer and write-back step, the row and column shift mechanism of the rotation register array includes sequentially outputting the data in the register to different BRAM addresses according to the clock period, and the shift step is dynamically adjusted according to the BFU parallelism; when the 2D-RCBFU activates M rows and N columns of BFUs, the shift step is set to M*N, ensuring that each data is written to a different address; the shift step is the address interval of each shift operation, and a beat is the basic time unit of data processing.

7. The configurable parallel computation acceleration method of number theoretic transform for post-quantum cryptography algorithm according to claim 2, characterized in that, In the mixed operation cooperative processing step, the BFU splitting strategy includes dynamically allocating BFU resources according to the proportion of CWM operation amount, and allocating 1 / 4 of the BFU for point multiplication when the CWM operation amount exceeds 30% of the total operation amount; through the resource scheduling table of the control module, the BFU allocation state is recorded to monitor the operation progress of each BFU in real time, and the efficiency of the cooperative execution of NTT and CWM is ensured; the resource scheduling table is a data table for storing BFU allocation information, which is used to track the working state and task allocation of each BFU.

8. A device for implementing the configurable parallel computation acceleration method of the number theoretic transform of the post-quantum oriented cryptographic algorithm according to any one of claims 1-7, characterized in that, Includes: 2D-RCBFU operation array module: coupled by butterfly unit BFU, each BFU includes modulo addition / subtraction unit, modulo multiplication unit, reconfigurable switch and local controller; reconfigurable switch supports interconnection configuration in row and column directions, dynamically activates BFU row and column according to NTT point number N, activates 8x4 row when N=256, activates 16x8 row when N=1024; modulo multiplication unit supports CT butterfly and GS butterfly operation mode, built-in 1 / 2, 1 / N scaling factor multiplier, realizes hardware acceleration of NTT / INTT operation; modulo addition / subtraction unit is used for addition and subtraction operation in finite field, and local controller is responsible for BFU mode control and data processing flow; Memory management module: including BRAM storage array, data exchange module and rotation register array; BRAM storage array adopts data splicing strategy, stores each low bit coefficient, 64-bit BRAM stores 4 16-bit coefficients; data exchange module is responsible for splicing / unsplicing operation, generates address mapping table; rotation register array temporarily stores operation results, avoids BRAM write conflict through row and column cyclic shift, supports stepwise ordered write back; storage array is composed of each BRAM unit, and address mapping table records physical address mapping relationship of coefficients in BRAM; Control scheduling module: including protocol analysis unit, state machine and resource allocator, protocol analysis unit identifies security parameters of Kyber and Falcon protocols, state machine configures row and column size and butterfly mode of 2D-RCBFU according to parameters, resource allocator cooperatively manages BFU resources, supports parallel operation scheduling of NTT and CWM, monitors hardware state in real time and adjusts configuration parameters; protocol analysis unit is used for analyzing instructions and parameters of upper password protocol, and resource allocator is responsible for dynamic allocation and management of BFU hardware resources.

9. The configurable parallel computation acceleration method for number theoretic transform of post-quantum cryptography algorithm device according to claim 8, characterized in that, The BFU in the 2D-RCBFU operation array module further includes a dynamic coefficient cache unit for temporarily storing omega factors and scaling factors of the current butterfly operation; the reconfigurable interconnection network supports dynamic switching of data paths between BFUs, and when performing hybrid operations, the modulo multiplication units of part of the BFUs are independently allocated to CWM operations, and the remaining BFUs maintain butterfly connections to realize flexible scheduling of operation resources; the dynamic coefficient cache unit is a temporary storage unit for temporarily storing coefficients and factors required for operation, and the interconnection network is a connection configuration for data transmission paths between BFUs.

10. The configurable parallel computation acceleration method for number theoretic transform of post-quantum cryptography algorithm device according to claim 8, characterized in that, The rotation register array in the memory management module further includes a conflict detection unit for monitoring address conflicts of write back data in real time, and triggering row shift compensation mechanism when a conflict is detected; a power consumption control unit adjusts the working frequency of the register according to the power consumption mode of the device, reduces the dynamic power consumption by reducing the shift frequency in the low-power consumption scene, while ensuring the correctness of data storage; the conflict detection unit is used for detecting address conflicts when data is written back, the shift compensation mechanism avoids conflicts by adjusting the shift operation, and the power consumption control unit is used for managing the power consumption state of the register.

Images