Fast implementation method and system of polynomial multiplier with multi-stage pipeline structure

Abstract

This invention discloses a method and system for rapidly implementing a polynomial multiplier using a multi-stage pipelined structure, relating to the fields of cryptography and hardware acceleration technology. The method includes: initializing operational parameters; constructing a modular multiplication unit composed of a large number multiplier and a Montgomery modular reduction unit; constructing a butterfly operation unit based on the modular multiplication unit, modular addition unit, and modular subtraction unit; acquiring two polynomials to be computed and extracting their correlation coefficients; inputting the correlation coefficients and operational parameters into the butterfly operation unit and performing a forward transformation using negative wrapping convolution technology and a fast iterative algorithm to obtain even-numbered and odd-numbered point-value coefficients; performing point-value multiplication operations based on the even-numbered and odd-numbered point-value coefficients to obtain a new point-value result; and inputting the new point-value result into the butterfly operation unit for a reverse transformation to obtain the final multiplication result of the two polynomials. This provides an efficient and universal NTT polynomial multiplier, thereby improving the efficiency and security of polynomial operations.

Description

Technical Field

[0001] This invention relates to the fields of cryptography and hardware acceleration technology, and more specifically to a method and system for fast implementation of polynomial multipliers using a multi-stage pipeline structure. Background Technology

[0002] Currently, with the rapid development of quantum computing technology, traditional cryptographic algorithms such as RSA and ECC face potential security threats, and post-quantum cryptographic algorithms based on ring polynomial operations are gradually becoming a research hotspot. Number theory transformation is an efficient polynomial multiplication acceleration technique, widely used in lattice-based encryption, ring learning and error (Ring-LWE) and other cryptographic systems.

[0003] However, existing NTT implementations have several shortcomings in hardware environments: In existing technologies, NTT algorithms based on the Cooley-Tukey structure require additional bit-flipping operations, leading to increased computational and storage overhead. Furthermore, the modular multiplication module in butterfly operations typically uses a general-purpose multiplier, which is inefficient, and the modular reduction process is complex, making it difficult to meet high throughput requirements. Patent document CN116545622A discloses an NTT hardware implementation system based on an FPGA platform. This system uses a Cooley-Tukey structure to implement polynomial multiplication. Due to the sequential dependency of addition and multiplication operations in this structure, and the unoptimized multiplication structure, the overall implementation performance is limited. Analysis of existing technologies reveals that the main problems in the hardware implementation of traditional NTT schemes include: additional overhead caused by bit flipping, insufficient efficiency of modular multiplication operations, poor flexibility, and the use of two similar circuit structures for forward and inverse transformations, resulting in low circuit reuse.

[0004] Therefore, how to provide an efficient and universal NTT polynomial multiplier to improve the efficiency and security of polynomial operations is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the present invention provides a method and system for rapidly implementing a polynomial multiplier using a multi-stage pipeline structure, and provides an efficient and universal NTT polynomial multiplier, thereby improving the efficiency and security of polynomial operations.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A fast implementation method for polynomial multipliers using a multi-stage pipelined structure includes:

[0008] Initialize the operation parameters;

[0009] A modular multiplication unit is constructed by combining a large number multiplier and a Montgomery modular reduction unit.

[0010] A butterfly-shaped arithmetic unit is constructed based on the modular multiplication unit, modular addition unit, and modular subtraction unit.

[0011] Obtain the two polynomials to be calculated and extract their correlation coefficients;

[0012] Based on the correlation coefficient and the operation parameters, the butterfly operation unit is combined with negative wrapping convolution technology and fast iterative algorithm to perform a forward transformation, thereby obtaining even-valued coefficients and odd-valued coefficients.

[0013] A point value multiplication operation is performed based on the even-numbered point value coefficients and the odd-numbered point value coefficients to obtain a new point value result;

[0014] The new point value is input into the butterfly operation unit for inverse transformation to obtain the final multiplication result of the two polynomials.

[0015] In one embodiment, the operational parameters include: polynomial order, prime modulus, rotation factor, negative wrap convolution constant, and inverse rotation factor.

[0016] In one embodiment, the method for obtaining the modular multiplication unit is as follows:

[0017] The large number multiplier is constructed based on a hierarchical progressive multiplier, which decomposes large-bit-width multiplication into multiple small-bit-width operations and completes low-bit multiplication through step-by-step decomposition and recursive calculation.

[0018] The Montgomery modular reduction unit, which constructs a dynamic pipeline structure based on a radix-4 Booth multiplier, generates fewer partial products through 3-bit encoding and employs an optimized Montgomery modular reduction method to decompose modular reduction into multiple small-scale multiplication and addition operations.

[0019] The modular multiplication unit is composed of the large number multiplier and the Montgomery modular reduction unit.

[0020] In one embodiment, the method for obtaining the even-numbered point value coefficient and the odd-numbered point value coefficient specifically includes:

[0021] Based on the correlation coefficient, the data are input to the modulus addition unit and the modulus subtraction unit respectively, and the even-number point value coefficient and the median value are obtained accordingly.

[0022] The intermediate value and related calculation parameters are input into the modular multiplication unit to obtain the odd-point value coefficient.

[0023] In one embodiment, the method for obtaining the odd-numbered point value coefficient is as follows:

[0024] The power term of the rotation factor is obtained based on the rotation factor;

[0025] Based on the negative wrapping convolution constant, obtain the power term of the negative wrapping convolution constant;

[0026] The pre-calculated value is based on the product of the power term of the rotation factor and the power term of the negative wrap convolution constant.

[0027] The intermediate value and the pre-calculated value are input into the large number multiplier to obtain a large-bit-width integer product;

[0028] The odd-point coefficients are obtained by inputting the integer product into the Montgomery modulo reduction unit.

[0029] In one embodiment, the Montgomery modulo reduction unit breaks down the operation into multiple small integer operations based on the characteristics of the prime modulus, resulting in a multi-stage pipelined processing unit.

[0030] The integer product is input to the first-stage pipeline processing unit. The two's complement of the integer product is obtained and multiplied by the high-order bits of the prime modulus. Then, the input to the second-stage pipeline processing unit is obtained through shift and addition operations. The above operations are repeated, and so on. The final pipeline processing unit outputs the final processing result.

[0031] After performing a modulo subtraction operation on the final processing result and the lower digit of the prime modulus, the result is input into the data selector to obtain the odd point value coefficient.

[0032] In one embodiment, the butterfly arithmetic unit further includes a register;

[0033] Both the generated even-numbered point value coefficients and the odd-numbered point value coefficients are stored in the register;

[0034] During the operation, the even-numbered point value coefficients and the odd-numbered point value coefficients are input to the DSP multiplier to perform point value multiplication operations, thereby obtaining the new point value result.

[0035] In one embodiment, the method for obtaining the final multiplication result is as follows:

[0036] Based on the new point value result, the butterfly operation unit is input to perform the inverse transformation. The data processing process is the same as the data processing process of the forward transformation, except that the power term of the rotation factor in the pre-calculated value is replaced with the power term of the inverse rotation factor to participate in the subsequent calculation, and finally the coefficient field polynomial form is obtained.

[0037] The coefficients of the polynomial form in the coefficient field are normalized to obtain the final multiplication result.

[0038] A multinomial multiplier with a multi-stage pipeline structure is used to quickly implement the system, which includes: a parameter initialization module, an operation unit construction module, a point value coefficient acquisition module, a point value operation module, and a result output module;

[0039] The parameter initialization module is used to initialize the operation parameters;

[0040] The computation unit construction module is used to construct a modular multiplication unit composed of a large number multiplier and a Montgomery modular reduction and subtraction unit; and to construct a butterfly-shaped computation unit based on the modular multiplication unit, the modular addition unit, and the modular subtraction unit.

[0041] The point value coefficient acquisition module is used to acquire two polynomials to be calculated and extract the correlation coefficients; based on the correlation coefficients and the operation parameters, the module is input to the butterfly operation unit and performs a forward transformation using negative wrapping convolution technology and fast iterative algorithm to obtain even point value coefficients and odd point value coefficients.

[0042] The point value calculation module is used to perform point value multiplication based on the even point value coefficient and the odd point value coefficient to obtain a new point value result.

[0043] The result output module is used to input the new point value result into the butterfly operation unit for inverse transformation to obtain the final multiplication result of the two polynomials.

[0044] An electronic device includes a processor and a memory, the memory storing instructions, characterized in that the instructions are loaded and executed by the processor to implement the above-described method for rapidly implementing a multinomial multiplier using a multi-stage pipelined structure.

[0045] As can be seen from the above technical solutions, compared with the prior art, the present invention discloses a method and system for fast implementation of polynomial multipliers using a multi-stage pipeline structure, which has the following beneficial effects:

[0046] 1. This invention introduces a novel butterfly structure and negative wrapping convolution technology. By analyzing the actual application requirements, it eliminates the bit flipping operation required by the traditional NTT algorithm after the forward transformation, avoids additional sorting and storage overhead, makes the calculation process smoother, and significantly improves the overall efficiency of polynomial multiplication, especially in high-order polynomial scenarios.

[0047] 2. This invention employs a hierarchical multiplier to reduce the number of multiplications through a divide-and-conquer strategy. The Montgomery modulo reduction method used is adaptively optimized for the characteristics of common moduli in the RLWE cryptographic algorithm, thereby transforming the modulo reduction of large numbers into fast multiplication and addition operations of small numbers. This can be accelerated through a pipelined approach. These improvements collectively accelerate the core steps of the butterfly operation, making the hardware implementation speedup more significant. It is particularly suitable for resource-constrained FPGA or embedded environments. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0049] Figure 1 The flowchart illustrates the method for rapidly implementing a polynomial multiplier using a multi-stage pipeline structure, as provided by this invention.

[0050] Figure 2 This is a schematic diagram of the butterfly-shaped arithmetic unit structure provided by the present invention.

[0051] Figure 3 This is a schematic diagram of the Montgomery modulus reduction unit structure provided by the present invention.

[0052] Figure 4 This is a schematic diagram of the fast iterative algorithm for the inverse number-theory transformation of the Gentleman-Sande butterfly structure provided by the present invention.

[0053] Figure 5 This is a schematic diagram of the state machine control state transition for the number theory transformation control logic provided by the present invention. Detailed Implementation

[0054] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0055] Example 1

[0056] like Figure 1 As shown, this invention discloses a method for rapidly implementing a polynomial multiplier using a multi-stage pipeline structure, including the following steps. For ease of description, S1 to S7 are assigned; these numbers are not intended to limit the sequential relationship between the various steps of this invention:

[0057] S1 initializes the operation parameters.

[0058] By setting the polynomial order, prime modulus, and the rotation factor, negative wrap convolution constant, and inverse rotation factor required for NTT, the algorithm parameters are configured to ensure that the modulus meets specific conditions to support efficient computation.

[0059] Furthermore, in this embodiment, the polynomial order is set to an integer power of 2, such as 1024, 2048, or 4096, to support efficient butterfly decomposition.

[0060] The prime number modulo q satisfies a specific mathematical condition: Where mod represents modulo operation and N represents the modulus;

[0061] The twitch factor and its inverse factor are generated through pre-computation and stored in BRAM for fast access in subsequent operations;

[0062] The initialization process also includes setting other auxiliary parameters, such as the modular inverse factor, for the normalization operation of the inverse transformation. This step lays the foundation for the efficient execution of the algorithm and ensures the security and stability of the computing environment.

[0063] S2 constructs a large number multiplier and Montgomery modular reduction unit together to form a modular multiplication unit.

[0064] The method for obtaining the modular multiplication unit is as follows:

[0065] A large number multiplier is constructed based on a hierarchical progressive multiplier, which decomposes large-bit-width multiplication into multiple small-bit-width operations and completes low-bit multiplication through step-by-step decomposition and recursive calculation.

[0066] Based on the radix-4 Booth multiplier, a dynamic pipeline structure of Montgomery modular reduction unit is constructed. By generating fewer partial products through 3-bit encoding, and by adopting an optimized Montgomery modular reduction method, the modular reduction is decomposed into multiple small-scale multiplication and addition operations.

[0067] The modular multiplication unit is composed of a large number multiplier and a Montgomery modular reduction unit.

[0068] Furthermore, the large number multiplier is used to perform large integer multiplication in modular multiplication. It adopts a divide-and-conquer strategy to decompose the large bit-width multiplication into multiple small bit-width sub-operations and obtain the final result through recursive calculation. This reduces the demand for hardware multiplication resources and lowers the dependence on dedicated hardware (such as DSP).

[0069] Furthermore, considering the characteristics of prime numbers and the data bit width, a multi-stage pipelined circuit structure for the Montgomery modular reduction algorithm, namely the Montgomery modular reduction unit, is designed to handle the multiplication operations in the modular reduction algorithm. Adjustable parameters are used to control the depth of the pipeline, thereby improving the design flexibility. Fewer partial products are generated through 3-bit encoding, and the accumulation process is optimized by combining an efficient addition structure. In addition, an optimized Montgomery modular reduction method is adopted to decompose the modular reduction into multiple small-scale multiplication and addition operations, thereby realizing a pipelined design and effectively accelerating the modular operation process.

[0070] S3 is based on a butterfly operation unit constructed by modular multiplication, modular addition and modular subtraction units.

[0071] Furthermore, such as Figure 2 As shown, the butterfly arithmetic unit also includes two registers and three dual-port memories, BRAM0, BRAM1 and BRAM2, which together with the modular multiplication unit, modular addition unit and modular subtraction unit form a complete butterfly arithmetic unit;

[0072] Figure 2 In the text, wdata[31:0] represents the write data port, used for input polynomial coefficient data (32 bits each time).

[0073] waddr[31:0] represents the write address port, used for address control when writing coefficient data to the dual-port memory;

[0074] addr_sel[1:0] represents the address selection signal, which controls which set of dual-port memory to read the coefficient pair currently participating in the butterfly operation;

[0075] even[31:0] represents the even-numbered point value coefficients of the output, which are output after modulo addition;

[0076] odd[31:0] represents the even-numbered point value coefficients of the output, which are output after modular subtraction and modular multiplication;

[0077] Three dual-port memories, BRAM0, BRAM1, and BRAM2, are used to store the input polynomial coefficients, written via wdata and waddr. Two sets of data (typically a and b) are selected based on addr_sel and sent to the subsequent calculation module. This multi-channel dual-port memory structure facilitates the simultaneous reading of data pairs participating in the butterfly operation.

[0078] The modulo addition unit receives two data points (denoted as a and b) from the dual-port memory, performs the modulo addition operation a+b(mod q), temporarily stores the result in the register, and finally outputs it to even[31:0] to obtain the coefficient of the even point value; the modulo subtraction and modulo multiplication units work on the same principle.

[0079] S4 obtains the two polynomials to be calculated and extracts the correlation coefficients.

[0080] S5 inputs the correlation coefficient and operation parameters into the butterfly operation unit and performs a forward transformation using negative wrapping convolution technology and a fast iterative algorithm to obtain even-numbered point value coefficients and odd-numbered point value coefficients.

[0081] The methods for obtaining even-numbered point value coefficients and odd-numbered point value coefficients specifically include:

[0082] Based on the correlation coefficients, they are input into the module addition unit and the module subtraction unit respectively, and the even-number point value coefficients and the intermediate values ​​are obtained accordingly.

[0083] Based on the intermediate values ​​and related operational parameters, the odd-point coefficients are obtained by inputting them into the modular multiplication unit.

[0084] By decomposing the terms into even and odd terms, a complex, large-scale operation can be transformed into a series of repetitive operations with the same structure but much smaller scale, thus greatly reducing computational complexity.

[0085] Furthermore, the method for obtaining the coefficients for odd-numbered points is as follows:

[0086] Obtain the power term of the rotation factor based on the rotation factor;

[0087] Obtain the power term of the negative wrapping convolution constant based on the negative wrapping convolution constant;

[0088] The product of the power term of the rotation factor and the power term of the negative wrap convolution constant is used as the pre-calculated value;

[0089] The intermediate and pre-calculated values ​​are input into the large number multiplier to obtain a large-bit-width integer product;

[0090] The odd-point coefficients are obtained by inputting integer products into the Montgomery modulo reduction unit.

[0091] Furthermore, such as Figure 3 As shown, the Montgomery modular reduction unit breaks down the operation into multiple small integer operations based on the properties of prime number modulus, resulting in a multi-stage pipelined processing unit;

[0092] The first-stage pipelined processing unit receives the integer product as input, obtains the two's complement from the integer product, multiplies it by the high-order bits of the prime modulus, and then obtains the input to the second-stage pipelined processing unit through bit shifting and addition operations. This process is repeated until the final-stage pipelined processing unit outputs the final processing result.

[0093] After performing a modulo subtraction operation on the final processing result and the lower digit of the prime modulus, the result is input into the data selector to obtain the odd-point value coefficient.

[0094] In this embodiment, the Montgomery reduction unit employs a three-stage pipeline processing unit, corresponding to... Figure 3 Steps 1 through 3 are as follows: Step 1 takes the multiplication result of the first large integer multiplication module as input, calculates its two's complement, multiplies it by the high bits of the prime modulus q, and then obtains the input of the second-stage pipeline through bit shifting and addition operations. This operation is repeated until the third-stage pipeline is completed. Finally, the bit width range of the output result is limited by the data selector MUX.

[0095] Taking the data execution process of the Step 1 module as an example, it performs a highly optimized, high-radix (2) calculus. 13 The Montgomery modular reduction iteration's complete data processing flow begins by receiving a 64-bit intermediate product C and splitting it into three parallel paths for processing: The first path extracts the lowest 13 bits of C, obtains its inverse through two's complement arithmetic, and feeds it along with a pre-calculated constant g into a dedicated modular multiplier to generate a crucial correction term that ensures the divisibility of subsequent operations; the second path arithmetically right-shifts the complete 64-bit C value by 13 bits, which is equivalent to a high-speed division by 2. 13 The core step of the Montgomery reduction process generates the shifted master data. The third path performs a logical operation on specific boundary bits of C through an OR gate to generate a single-bit fine correction value to handle the boundary overflow problem that may occur in the high-radix algorithm. Finally, a multi-input modular multiplier accumulates the results of these three paths, namely the shifted master data, the correction term generated by the modular multiplier, and the single-bit correction value, to generate the 52-bit final output C1. This output is the complete reduction result of this iteration and is passed to the next stage of the pipeline (Step 2).

[0096] At each stage of the pipeline, a small-scale multiplication-accumulation operation is required. The radix-4 Buss multiplier is responsible for performing these internal multiplications. Specifically, it receives intermediate data from the previous pipeline stage (i.e., a variation of the first multiplier output T, such as its low w-bit binary two's complement) and pre-computed constants related to the prime modulus q, and calculates the adjustment value required for the reduction at this stage. This multiplier halves the number of partial products through 3-bit encoding, which greatly accelerates the accumulation process and thus improves the throughput of the entire modulus reduction pipeline.

[0097] Furthermore, this invention employs a fast iterative algorithm with a Gentleman-Sande butterfly structure, which corresponds to the Decimation-In-Frequency (DIF) design pattern, enabling the input polynomial to be processed... Mapped to point-value vectors , where ω NThis represents the Nth power root of unity modulo q; each level of the Gentleman-Sande structure completes data merging through the following butterfly operation: The entire transformation proceeds from high-frequency coefficients to low-frequency coefficients. Each iteration processes data in a natural order, without the need for input bit flipping or complex address rearrangement. After the transformation is complete, the output point value vector is arranged in bit-reversed order, that is, the position of the i-th output is the address after binary reversal. The Gentleman-Sande butterfly structure transforms the input polynomial from the coefficient field to the point value field.

[0098] Unlike the traditional Cooley-Tukey structure, this structure organizes data through frequency decimation. Considering the co-position of forward and inverse transformation operations, the bit-flipping operation after the forward transformation can be eliminated, thereby reducing computational overhead. In addition, S3 incorporates negative wrapping convolution technology, and the algorithm integrates the normalization operation of the inverse transformation into the pre-computation of the rotation factor, saving the additional normalization step.

[0099] Furthermore, the algorithm diagram for the 8-point transformation is as follows: Figure 4 As shown, the entire process is completed through multiple iterations. Each iteration processes half of the data pairs, requiring a total of 3 iterations. Each iteration contains 4 sets of butterfly operation units. In the first iteration, adjacent pairs are processed with an offset address difference of 1. In the second iteration, the coefficient pairs are processed with an offset address difference of 2. In the third iteration, the coefficient pairs are processed with an offset address difference of 4, ultimately generating coefficients in point value form, laying the foundation for point value multiplication.

[0100] Furthermore, Figure 4 The NTT algorithm hardware implementation uses a "3-level grouping butterfly operation + rotation factor weighting" to gradually convert the 8-point sequence between "time domain coefficients" and "frequency domain point values". This is the core data flow structure of the NTT algorithm hardware implementation. The specific process is explained in stages below:

[0101] (1) First-level butterfly operation (leftmost column)

[0102] The input is the original sequence (A[0], A[1], A[2], A[3], A[4], A[5], A[6], A[7]), and butterfly operations are performed on each pair of data.

[0103] For example, group 1: A[0] and A[4], rotation factor w 0 =1; Group 2: A[2] and A[6], rotation factor w 2 Its function is to decompose an 8-point sequence into a combination of four "2-point subsequences" and introduce the "frequency weight" of the rotation factor through butterfly operation.

[0104] (2) Second-level butterfly operation (middle column)

[0105] The input is the output of the first level, with each group of four data points. A butterfly operation is performed on the results of the "even positions" and "odd positions" within each group: the rotation factor becomes w. 0x2 w 2x2 =w 4 w 1x2 =w 2 w 3x2 =w 6 Its function is to further decompose the four "2-point subsequences" into a combination of two "4-point subsequences", and then introduce frequency domain weights.

[0106] (3) Third-level butterfly operation (rightmost column)

[0107] The input is the output of the second stage. After three stages of butterfly operation, the result of the 8-point NTT transformation A[0]-A[7] is obtained, completing the conversion of "time domain coefficients → frequency domain point values".

[0108] S6 performs point value multiplication based on even-numbered and odd-numbered point value coefficients to obtain a new point value result.

[0109] Both the generated even-point and odd-point coefficients are stored in registers.

[0110] During the operation, the even-numbered and odd-numbered point value coefficients are input to the DSP multiplier to perform point value multiplication and obtain a new point value result.

[0111] S7 inputs the new point value result into the butterfly operation unit for inverse transformation, and obtains the final multiplication result of the two polynomials.

[0112] The final multiplication result is obtained as follows:

[0113] The new point value results are input into the butterfly operation unit to perform the inverse transformation. The data processing process is the same as that of the forward transformation, except that the power term of the rotation factor in the pre-calculated value is replaced with the power term of the inverse rotation factor to participate in the subsequent calculation, and finally the coefficient field polynomial form is obtained.

[0114] The coefficients are normalized based on the polynomial form in the coefficient field, and then converted into a polynomial form in the time domain to obtain the final multiplication result.

[0115] Furthermore, in this embodiment, the coefficients of the polynomial form in the coefficient field are multiplied by N. -1 The normalized result is obtained; in another embodiment, the normalization coefficients are incorporated into the power of the inverse rotation factor in the inverse transformation, which is achieved in a pre-calculated form.

[0116] The final polynomial multiplication result is stored or transmitted to an external interface via a data selector to ensure the correctness and availability of the result and meet the requirements of subsequent cryptographic algorithms.

[0117] Furthermore, since the forward and inverse transformations have similar computational structures, this invention optimizes the control logic design by extracting their common operational parts. The control logic is managed using a state machine, including idle, data loading, computation execution, and result output states. The distinction between forward and inverse transformations is only made in the selection of the rotation factor. The state machine design is as follows: Figure 5 As shown in the diagram, the trigger signal is generated based on the internal execution status of the state machine, controlling the transition between states:

[0118] Idle state: The system is in waiting mode, waiting for external trigger signals load_w, load_data, and start to start subsequent computing tasks;

[0119] Loading data status: When the system is in an idle state and receives the load_data signal, from Figure 2 The coefficients of two sets of polynomials are read from BRAM0 and BRAM1 respectively;

[0120] Load parameter status: When the system is in an idle state and receives the load_w signal, from Figure 2 Parameters such as the rotation factor, prime modulus q, and inverse rotation factor are read from BRAM2;

[0121] Execution status calculation: When the system receives the start signal, it begins to execute the core operation of forward transform (NTT) or inverse transform (INTT): butterfly operation. The system selects the corresponding rotation factor according to the state of the internal intt signal. If it is an NTT operation, the modulo subtraction result is modularly multiplied with the first pre-calculated value (the product of the power term of the rotation factor and the power term of the negative wrapping convolution constant); if it is an INTT operation, the modulo subtraction result is modularly multiplied with the second pre-calculated value (the product of the power term of the inverse rotation factor and the power term of the negative wrapping convolution constant).

[0122] Inverse Transformation State: When the computation execution state ends, that is, all iterations of butterfly operations are completed, if intt=1, it indicates that the INTT transformation is being performed. The final coefficients of the result need to be normalized, that is, all elements are multiplied by the modular inverse. After the process is completed, the process jumps to the output state.

[0123] Output mode: Reads the calculation results from memory and displays them;

[0124] This sequential logic design significantly improves the reusability of hardware resources, reduces circuit area, and ensures efficient transfer of computation results between modules through data flow management.

[0125] Furthermore, Figure 5The cnt_flag series of signals are internal counting / state flag signals of the state machine, used to coordinate the transitions between states and control the progress of processes such as "data loading, parameter loading, operation execution, and result output".

[0126] cnt_flag1: Associated with the "loading parameters" status (interacting with load_w of the loading parameters module), used to mark the progress of parameter loading;

[0127] cnt_flag2: Associated with the "Load Data" status (interacting with the Load Data module), used to mark the loading progress of the polynomial coefficients to be processed;

[0128] cnt_flag4: Associates the switching between "execution state" and "output state", used to mark the completion status of the execution phase (such as NTT butterfly operation).

[0129] cnt_flag5: Associated with the feedback flow of "inverse transformation → output state", used to mark the completion status of the inverse transformation stage.

[0130] Example 2

[0131] Based on the same inventive concept, this invention also provides a rapid implementation system for a polynomial multiplier using a multi-stage pipeline structure, including: a parameter initialization module, an operation unit construction module, a point value coefficient acquisition module, a point value operation module, and a result output module;

[0132] The parameter initialization module is used to initialize the operation parameters;

[0133] The computation unit construction module is used to build a large number multiplier and a Montgomery modular reduction and subtraction unit to form a modular multiplication unit; a butterfly-shaped computation unit is constructed based on the modular multiplication unit, modular addition unit and modular subtraction unit.

[0134] The point value coefficient acquisition module is used to acquire two polynomials to be calculated and extract the correlation coefficients; based on the correlation coefficients and operation parameters, the module is input to the butterfly operation unit and performs a forward transformation using negative wrapping convolution technology and fast iterative algorithm to obtain even-numbered point value coefficients and odd-numbered point value coefficients.

[0135] The point value operation module is used to perform point value multiplication based on even-numbered and odd-numbered point value coefficients to obtain a new point value result.

[0136] The result output module is used to input the new point value result into the butterfly operation unit for inverse transformation to obtain the final multiplication result of the two polynomials.

[0137] Furthermore, in this embodiment, the functional implementation methods of each functional module correspond one-to-one with the methods described above, and will not be repeated here.

[0138] Example 3

[0139] Based on the same inventive concept, the present invention also provides an electronic device, which includes a processor and a memory, wherein the memory stores instructions, characterized in that the instructions are loaded and executed by the processor to implement the fast implementation method of a polynomial multiplier with a multi-stage pipeline structure as described in Embodiment 1.

[0140] Based on the same inventive concept, the present invention also provides a computer device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0141] Memory, used to store computer programs;

[0142] When the processor executes a program stored in memory, it can implement a fast implementation method for a polynomial multiplier using a multi-stage pipeline structure, as shown in Example 1.

[0143] The electronic device may include a processor, a communications interface, a memory, and a communication bus, wherein the processor, communications interface, and memory communicate with each other via the communication bus. The processor can call logical instructions in the memory to execute the fast implementation method of the polynomial multiplier using a multi-stage pipeline structure in Embodiment 1.

[0144] Furthermore, the logical instructions in the aforementioned memory can be implemented as software functional units and sold or used as independent products, and can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0145] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0146] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for fast implementation of polynomial multipliers using a multi-stage pipelined structure, characterized in that, include: Initialize the operation parameters; A modular multiplication unit is constructed by combining a large number multiplier and a Montgomery modular reduction unit. The method for obtaining the modular multiplication unit is as follows: The large number multiplier is constructed based on a hierarchical progressive multiplier, which decomposes large-bit-width multiplication into multiple small-bit-width operations and completes low-bit multiplication through step-by-step decomposition and recursive calculation. The Montgomery modular reduction unit, which constructs a dynamic pipeline structure based on a radix-4 Booth multiplier, generates fewer partial products through 3-bit encoding and employs an optimized Montgomery modular reduction method to decompose modular reduction into multiple small-scale multiplication and addition operations. The modular multiplication unit is composed of the large number multiplier and the Montgomery modular reduction unit. A butterfly-shaped arithmetic unit is constructed based on the modular multiplication unit, modular addition unit, and modular subtraction unit. Obtain the two polynomials to be calculated and extract their correlation coefficients; Based on the correlation coefficient and the operation parameters, the butterfly operation unit is combined with negative wrapping convolution technology and fast iterative algorithm to perform a forward transformation, thereby obtaining even-valued coefficients and odd-valued coefficients. A point value multiplication operation is performed based on the even-numbered point value coefficients and the odd-numbered point value coefficients to obtain a new point value result; The new point value is input into the butterfly operation unit for inverse transformation to obtain the final multiplication result of the two polynomials.

2. The method for fast implementation of a polynomial multiplier using a multi-stage pipeline structure according to claim 1, characterized in that, The operational parameters include: polynomial order, prime modulus, rotation factor, negative wrap convolution constant, and inverse rotation factor.

3. The method for fast implementation of a polynomial multiplier using a multi-stage pipeline structure according to claim 2, characterized in that, The methods for obtaining even-numbered point value coefficients and odd-numbered point value coefficients specifically include: Based on the correlation coefficient, the data are input to the modulus addition unit and the modulus subtraction unit respectively, and the even-number point value coefficient and the median value are obtained accordingly. The intermediate value and related calculation parameters are input into the modular multiplication unit to obtain the odd-point value coefficient.

4. The method for fast implementation of a polynomial multiplier using a multi-stage pipeline structure according to claim 3, characterized in that, The method for obtaining the coefficients of odd-numbered points is as follows: The power term of the rotation factor is obtained based on the rotation factor; Based on the negative wrapping convolution constant, obtain the power term of the negative wrapping convolution constant; The pre-calculated value is based on the product of the power term of the rotation factor and the power term of the negative wrap convolution constant. The intermediate value and the pre-calculated value are input into the large number multiplier to obtain a large-bit-width integer product; The odd-point coefficients are obtained by inputting the integer product into the Montgomery modulo reduction unit.

5. The method for fast implementation of a polynomial multiplier using a multi-stage pipeline structure according to claim 4, characterized in that, The Montgomery modulo reduction unit breaks down the operation into multiple small integer operations based on the characteristics of the prime modulus, resulting in a multi-stage pipeline processing unit. The integer product is input to the first-stage pipeline processing unit. The two's complement of the integer product is obtained and multiplied by the high-order bits of the prime modulus. Then, the input to the second-stage pipeline processing unit is obtained through shift and addition operations. The above operations are repeated, and so on. The final pipeline processing unit outputs the final processing result. After performing a modulo subtraction operation on the final processing result and the lower digit of the prime modulus, the result is input into the data selector to obtain the odd point value coefficient.

6. The method for fast implementation of a polynomial multiplier using a multi-stage pipeline structure according to claim 5, characterized in that, The butterfly-shaped arithmetic unit also includes registers; Both the generated even-numbered point value coefficients and the odd-numbered point value coefficients are stored in the register; During the operation, the even-numbered point value coefficients and the odd-numbered point value coefficients are input to the DSP multiplier to perform point value multiplication operations, thereby obtaining the new point value result.

7. The method for fast implementation of a polynomial multiplier using a multi-stage pipeline structure according to claim 6, characterized in that, The method for obtaining the final multiplication result is as follows: The new point value is input into the butterfly operation unit to perform the inverse transformation. The data processing process is the same as the forward transformation data processing process, except that the power term of the rotation factor in the pre-calculated value is replaced with the power term of the inverse rotation factor to participate in the subsequent calculation, and finally the coefficient field polynomial form is obtained. The coefficients of the polynomial form in the coefficient field are normalized to obtain the final multiplication result.

8. A system for rapidly implementing a polynomial multiplier using a multi-stage pipelined structure, used to execute the rapid implementation method of a polynomial multiplier using a multi-stage pipelined structure as described in any one of claims 1-7, characterized in that, include: The module includes a parameter initialization module, a computation unit construction module, a point value coefficient acquisition module, a point value computation module, and a result output module. The parameter initialization module is used to initialize the operation parameters; The computation unit construction module is used to construct a modular multiplication unit composed of a large number multiplier and a Montgomery modular reduction and subtraction unit; and to construct a butterfly-shaped computation unit based on the modular multiplication unit, the modular addition unit, and the modular subtraction unit. The point value coefficient acquisition module is used to acquire two polynomials to be calculated and extract the correlation coefficients; based on the correlation coefficients and the operation parameters, the module is input to the butterfly operation unit and performs a forward transformation using negative wrapping convolution technology and fast iterative algorithm to obtain even point value coefficients and odd point value coefficients. The point value calculation module is used to perform point value multiplication based on the even point value coefficient and the odd point value coefficient to obtain a new point value result. The result output module is used to input the new point value result into the butterfly operation unit for inverse transformation to obtain the final multiplication result of the two polynomials.

9. An electronic device comprising a processor and a memory, wherein the memory stores instructions, characterized in that, The instructions are loaded and executed by the processor to implement the fast implementation method of a polynomial multiplier with a multi-stage pipeline structure as described in any one of claims 1-7.

Images