A method and device for accelerating processing of polynomial operations in post-quantum cryptography

Abstract

Embodiments of the present application provide a kind of post quantum cryptography polynomial operation acceleration processing method and device, method includes: obtaining the operation data of post quantum cryptography polynomial operation to be handled, the operation data includes at least two kinds in shared scalar polynomial, vector polynomial and matrix polynomial;Different operands in the operation data are distributed to corresponding intermediate cache according to type and stored;According to the type of computing task, the operands in the intermediate cache are distributed to a plurality of parallel acceleration cores;Control each parallel acceleration core executes in turn the number theory transformation on the operand received by it, performs point multiplication in transform domain and executes inverse number theory transformation on point multiplication result, obtains the operation result of each parallel acceleration core;The operation result of each parallel acceleration core is gathered, and target operation result is formed;The target operation result is output.The embodiments of the present application can overcome the problem of low parallelism, poor pipeline utilization of hardware design.

Description

Technical Field

[0001] The embodiments of the present invention relate to the field of post-quantum cryptography, and in particular to a method and apparatus for accelerating polynomial operations in post-quantum cryptography. Background Technology

[0002] With the development of quantum computing, post-quantum cryptography (PQC) resistant to attacks is crucial. Among these, lattice-based cryptographic algorithms based on lattice-hard problems (such as MLWE) are mainstream schemes, with the CRYSTALS-Dilithium signature algorithm being a representative example. The core operations of this type of algorithm are polynomial matrix-vector multiplication and polynomial-vector dot product over specific polynomial rings. Employing number-theoretic transformations (NTTs) can significantly reduce computational complexity and is key to hardware acceleration.

[0003] However, existing implementations have significant bottlenecks: 1) Even with instruction set optimization, CPU software implementations still struggle to meet high-performance requirements in terms of latency and throughput; 2) GPU acceleration suffers from large data transmission latency, difficulty in meeting fixed-latency safety requirements in execution timing, and high power consumption, making it unsuitable for embedded scenarios; 3) Existing dedicated FPGA / ASIC hardware designs are inefficient, exhibiting the following characteristics: low computational core parallelism and poor pipeline utilization; lack of optimization in on-chip memory access, leading to conflicts and performance degradation; lack of data reuse mechanisms in multi-round iterations (such as rejection sampling), resulting in repeated loading or transformation of matrix data, leading to high bandwidth and computational overhead; and rigid control flow, making it impossible to achieve efficient pipelined sampling and computation. Summary of the Invention

[0004] The technical problem to be solved by the embodiments of the present invention is to provide a method and apparatus for accelerating polynomial operations in post-quantum cryptography, which can overcome the problems of low parallelism and poor pipeline utilization in hardware design.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0006] A method for accelerating polynomial operations in post-quantum cryptography includes:

[0007] Obtain the computational data to be processed in polynomial operations in post-quantum cryptography, wherein the computational data includes at least two of the following: shared scalar polynomials, vector polynomials, and matrix polynomials;

[0008] Different operands in the computational data are allocated to corresponding intermediate caches according to their type for storage;

[0009] Based on the type of computation task, the operands in the intermediate cache are distributed to multiple parallel acceleration cores;

[0010] Each of the parallel acceleration cores is controlled to perform number-theoretical transformations on its received operands, perform dot multiplication in the transformation domain, and perform inverse number-theoretical transformations on the dot multiplication results in turn, so as to obtain the operation results of each parallel acceleration core;

[0011] The computational results of each of the aforementioned parallel acceleration cores are combined to form the target computational result;

[0012] Output the target calculation result.

[0013] Optionally, the different operands in the computational data are allocated to corresponding intermediate caches according to their type for storage, including:

[0014] If the computational data is a shared scalar polynomial, then the shared scalar polynomial is stored in a separate first intermediate cache;

[0015] If the computational data is a vector polynomial, then the multiple polynomial components contained in the vector polynomial are stored in multiple parallel second intermediate caches respectively.

[0016] If the computational data is a matrix polynomial, then the multiple polynomial elements contained in the matrix polynomial are stored in multiple parallel third intermediate caches respectively.

[0017] Optionally, depending on the type of computation task, the operands in the intermediate cache are distributed to multiple parallel acceleration cores, including:

[0018] If the computation task type is a dot product of a shared scalar polynomial and a vector polynomial, then the shared scalar polynomial is broadcast to all the parallel acceleration cores, and each polynomial component of the vector polynomial is unicast to the corresponding parallel acceleration core.

[0019] If the computation task type is the multiplication of a matrix polynomial and a vector polynomial, then multiple polynomial elements belonging to the same operation row in the matrix polynomial are distributed in parallel to each of the parallel acceleration cores, and each polynomial component of the vector polynomial is distributed to the corresponding parallel acceleration core.

[0020] Optionally, each of the parallel acceleration cores is controlled to sequentially perform number-theoretical transformations on its received operands, perform dot multiplication in the transform domain, and perform inverse number-theoretical transformations on the dot multiplication results to obtain the operation results of each parallel acceleration core, including:

[0021] Each of the parallel acceleration cores is controlled to perform a forward number theory transformation on the received operands in parallel to obtain the corresponding first transformation result and second transformation result;

[0022] Each of the parallel acceleration cores is controlled to perform a dot product of the coefficients at the same position in the first and second transformation results in the transformation domain to obtain a dot product result vector;

[0023] Each of the parallel acceleration cores is controlled to perform an inverse number theory transformation on the dot product result vector to obtain the operation result of each parallel acceleration core in the time domain.

[0024] Optionally, the computation results of each of the parallel acceleration cores are aggregated to form the target computation result, including:

[0025] When performing a dot product of a shared scalar polynomial and a vector polynomial, the time-domain operation results output by each parallel acceleration core are directly combined to form the target operation result;

[0026] When performing matrix polynomial and vector polynomial multiplication, the time-domain operation results output by each parallel acceleration core in the same round of operation are accumulated to obtain the intermediate result of one row of the matrix. The calculation of all rows is completed through multiple rounds of operation to finally form the target operation result.

[0027] Optionally, the above methods also include:

[0028] After completing the acceleration process for the current round, the matrix polynomial is held in the third intermediate cache, and the system listens for a start signal to indicate an update of the vector polynomial.

[0029] Based on the start signal, the matrix polynomial stored in the third intermediate cache is reused, and a new round of accelerated processing of matrix polynomial and vector polynomial multiplication is performed with the updated vector polynomial.

[0030] Optionally, before allocating different operands in the computational data to corresponding intermediate caches for storage according to their type, the above method further includes:

[0031] The computational data is preprocessed to obtain computational data in a unified format.

[0032] Embodiments of the present invention also provide an accelerated processing device for polynomial operations in post-quantum cryptography, comprising:

[0033] The acquisition module is used to acquire the computational data to be processed in polynomial operations in post-quantum cryptography, wherein the computational data includes at least two of the following: shared scalar polynomials, vector polynomials, and matrix polynomials.

[0034] The processing module is used to allocate different operands in the computation data to corresponding intermediate caches for storage according to their types; distribute the operands in the intermediate caches to multiple parallel acceleration cores according to the type of computation task; control each parallel acceleration core to perform number theory transformation, dot product in the transformation domain, and inverse number theory transformation on the dot product result sequentially on the operands it receives, to obtain the computation results of each parallel acceleration core; collect the computation results of each parallel acceleration core to form the target computation result; and output the target computation result.

[0035] Embodiments of the present invention also provide a computing device, comprising:

[0036] One or more processors;

[0037] A storage device for storing one or more programs that, when executed by one or more processors, cause the one or more processors to perform the method as described above.

[0038] Embodiments of the present invention also provide a computing device readable storage medium storing a program that, when executed by a processor, implements the method described above.

[0039] The above-described solutions of the embodiments of the present invention have at least the following beneficial effects:

[0040] The above-described scheme of this invention achieves efficient parallel computing by allocating and storing different operands by type and distributing them to multiple parallel acceleration cores for parallel execution of number-theoretical transformations, performing dot multiplication in the transformation domain, and performing inverse number-theoretical transformations on the dot multiplication results. This overcomes the problems of low parallelism and poor pipeline utilization in hardware design. The typed storage structure reduces on-chip memory access conflicts. Combined with the distribution control of computing tasks, it can reuse loaded or transformed matrix data in multiple iterations, reducing the overhead of repeated transmission and computation. Compared with CPU software solutions, hardware parallelization greatly reduces computational latency. Compared with GPUs, the specialized design reduces data transmission latency and power consumption, making it more suitable for embedded scenarios. Furthermore, the controllable parallel execution timing makes it easier to meet the long-term security requirements against side-channel attacks. Through configurable computing task distribution and core control, it supports flexible acceleration of core operations such as polynomial matrix-vector multiplication and polynomial-vector dot multiplication, overcoming the problem of rigid traditional control flows and providing an efficient and practical hardware acceleration foundation for post-quantum cryptography algorithms. Attached Figure Description

[0041] Figure 1 This is a flowchart illustrating the accelerated processing method for polynomial operations in post-quantum cryptography provided by an embodiment of the present invention.

[0042] Figure 2 This is a schematic diagram of the overall data flow architecture of the accelerated processing method for polynomial operations in post-quantum cryptography provided by an embodiment of the present invention.

[0043] Figure 3 This is a schematic diagram of the storage structure of the accelerated processing method for polynomial operations in post-quantum cryptography provided by an embodiment of the present invention.

[0044] Figure 4 This is a block diagram of a single accelerated computation kernel for a method of accelerating polynomial operations in post-quantum cryptography provided in an embodiment of the present invention.

[0045] Figure 5 This is a schematic diagram of a module for accelerating polynomial operations in post-quantum cryptography provided in an embodiment of the present invention. Detailed Implementation

[0046] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0047] like Figure 1 As shown, an embodiment of the present invention provides a method for accelerating polynomial operations in post-quantum cryptography, comprising:

[0048] Step 11: Obtain the computational data to be processed for polynomial operations in post-quantum cryptography, wherein the computational data includes at least two of the following: shared scalar polynomials, vector polynomials, and matrix polynomials.

[0049] Step 12: Allocate the different operands in the computation data to the corresponding intermediate cache according to their type for storage;

[0050] Step 13: Distribute the operands in the intermediate cache to multiple parallel acceleration cores according to the type of computing task;

[0051] Step 14: Control each of the parallel acceleration cores to perform number theory transformations on the operands they receive, perform dot multiplication in the transformation domain, and perform inverse number theory transformations on the dot multiplication results in sequence to obtain the operation results of each parallel acceleration core;

[0052] Step 15: Collect the computation results of each of the parallel acceleration cores to form the target computation result;

[0053] Step 16: Output the target calculation result.

[0054] In this example, efficient parallel computation is achieved by allocating storage for different operands by type and distributing them to multiple parallel acceleration cores for parallel execution of number-theoretical transformations, performing dot product in the transformation domain, and performing inverse number-theoretical transformations on the dot product results. This overcomes the problems of low parallelism and poor pipeline utilization in hardware design. The typed storage structure reduces on-chip memory access conflicts. Combined with the distribution control of computational tasks, it can reuse loaded or transformed matrices and other data in multiple iterations, reducing the overhead of repeated transmission and computation. Compared to CPU software solutions, hardware parallelization greatly reduces computational latency. Compared to GPUs, the specialized design reduces data transmission latency and power consumption, making it more suitable for embedded scenarios. Furthermore, the controllable parallel execution timing makes it easier to meet the long-term security requirements against side-channel attacks. Through configurable computational task distribution and core control, it supports flexible acceleration of core operations such as polynomial matrix-vector multiplication and polynomial-vector dot product, overcoming the rigidity of traditional control flows and providing an efficient and practical hardware acceleration foundation for post-quantum cryptography algorithms.

[0055] In an optional embodiment of the present invention, in step 11, the computational data to be processed for polynomial operations in post-quantum cryptography is obtained, wherein the computational data includes at least two of the following: shared scalar polynomials, vector polynomials, and matrix polynomials.

[0056] Specifically, it receives configuration commands and computation data sent by external hosts through bus interfaces such as AXI; it parses the received data and temporarily stores it in the input buffer; it performs format preprocessing on the data, breaking down the compact bit-width data input from the external host and expanding it into a unified data format required by the internal computing core; at the same time, it identifies the specific type of the data, such as shared scalar polynomial, vector polynomial components, or matrix polynomial elements, based on the identifier or preset order in the data, in preparation for subsequent storage by type.

[0057] In this example, bit-width expansion and format alignment are completed early in the data input process, uniformly converting external data into a format directly usable by the computation core. This eliminates the format conversion overhead during computation and improves computational efficiency. Simultaneously, the specific type of operand (shared, vector, or matrix) is identified based on its identifier during the acquisition phase. This provides a crucial prerequisite for the accurate routing of subsequent data to different optimized storage structures, ensuring storage and access efficiency from the source and laying a solid foundation for efficient and smooth data supply throughout the entire parallel acceleration process.

[0058] In an optional embodiment of the present invention, step 12, which involves allocating different operands in the computational data to corresponding intermediate caches for storage according to their type, includes:

[0059] Step 121: If the computation data is a shared scalar polynomial, then the shared scalar polynomial is stored in an independent first intermediate cache; specifically, after being identified as a shared scalar polynomial (such as a challenge polynomial), all its coefficients are sequentially written into an independent single-port or multi-port RAM (first intermediate cache); the cache capacity is n×W bits (n is the polynomial length, W is the internal bit width), ensuring that all parallel acceleration cores simultaneously or quickly poll to read the same data;

[0060] Step 122: If the computational data is a vector polynomial, then the multiple polynomial components contained in the vector polynomial are stored in multiple parallel second intermediate caches respectively. Specifically, after being identified as a vector polynomial (such as a secret vector or a sampled vector), its L polynomial components are stored in L parallel second intermediate caches. During writing, the coefficient stream is input sequentially, and the address generator maps consecutive addresses to different second intermediate caches (implemented by taking the modulo of the low-order bits of the address), realizing conflict-free storage for sequential writing. Each second intermediate cache independently serves a parallel acceleration core.

[0061] Step 123: If the computational data is a matrix polynomial, then the multiple polynomial elements contained in the matrix polynomial are stored in multiple parallel third intermediate caches respectively. Specifically, after being identified as a matrix polynomial (such as a public key matrix with a dimension of K×L), its K×L polynomial elements are stored in multiple parallel third intermediate caches. During storage, according to a preset cross-storage strategy, it is ensured that multiple elements in the same row of the matrix are distributed in different third intermediate caches. After writing, the data can reside on the third intermediate cache for a long time. During reading, multiple third intermediate caches are accessed in parallel row by row to obtain all elements of a row at once.

[0062] In this example, by setting up an independent first intermediate cache for the shared scalar polynomial, it is ensured that the data can be efficiently and conflict-free shared accessed by all parallel acceleration cores, eliminating read contention during broadcast distribution and providing optimal support for the one-to-many data supply mode in dot product operations.

[0063] By employing multiple second intermediate caches and conflict-free writing based on low-order address mapping for vector polynomials, physical isolation and parallel access of vector components are achieved. Each parallel acceleration core has its own dedicated memory channel, fundamentally avoiding structural conflicts and waiting cycles when multiple cores access the same vector data, and greatly improving the bandwidth of vector data supply.

[0064] The matrix polynomials are interleaved and stored in multiple third intermediate caches, combined with a long-term on-chip residency mechanism. This not only allows the entire row of matrix data to be read in parallel at once, meeting the row-parallel computation requirements of matrix-vector multiplication, but also completely eliminates the huge external bandwidth overhead and computational latency caused by repeatedly loading the matrix in each iteration by fully reusing the loaded matrix data in multiple iterations.

[0065] In an optional embodiment of the present invention, step 13, distributing the operands in the intermediate cache to multiple parallel acceleration cores according to the computation task type, includes:

[0066] Step 131: If the computation task type is a dot product of a shared scalar polynomial and a vector polynomial, then the shared scalar polynomial is broadcast to all the parallel acceleration cores, and each polynomial component of the vector polynomial is unicast and distributed to the corresponding parallel acceleration core.

[0067] Specifically, once the task is determined to be the dot product of a shared scalar polynomial and a vector polynomial, all coefficients of the shared scalar polynomial are read from the first intermediate buffer and synchronously sent to all parallel acceleration cores via a broadcast network (such as a set of parallel connections or a shared bus). At the same time, each component of the vector polynomial is read in parallel from each of the second intermediate buffers and sent to the corresponding parallel acceleration core via a unicast path. This process is triggered by a unified start signal to ensure that all parallel acceleration cores start computing synchronously.

[0068] Step 132: If the computation task type is the multiplication of a matrix polynomial and a vector polynomial, then the multiple polynomial elements belonging to the same operation row in the matrix polynomial are distributed in parallel to each of the parallel acceleration cores, and the polynomial components of the vector polynomial are distributed to the corresponding parallel acceleration cores.

[0069] Specifically, after determining that the task is a multiplication of a matrix polynomial and a vector polynomial, according to the row number i of the current operation, all elements A[i][0] to A[i][N-1] of the i-th row of matrix A are read in parallel from each of the third intermediate buffers (when the parallelism N equals the number of columns L); these elements are simultaneously and separately distributed to all parallel acceleration cores; at the same time, each component y[0] to y[N-1] of vector y is read from each of the second intermediate buffers and distributed to the corresponding parallel acceleration core; for multi-row calculations, this process is repeated row by row, and the components of vector y are cached in the parallel acceleration core for multi-row reuse.

[0070] In this example, for the dot product task involving shared scalar polynomials and vector polynomials, a broadcast + unicast distribution model is adopted. The broadcast mechanism delivers the shared polynomial (such as the challenge polynomial) to all parallel acceleration cores simultaneously, avoiding repeated read operations on the same data by the cores, significantly saving storage bandwidth and access power consumption. At the same time, each component of the vector is unicast to a designated core, ensuring that each core independently and without conflict obtains its dedicated operands, eliminating the structural conflict of multiple cores competing for the same data port, and realizing the synchronous start of parallel data provisioning and computation.

[0071] For matrix and vector polynomial multiplication tasks, a row-parallel distribution + vector cache reuse strategy is adopted. By reading entire rows of matrix elements in parallel from multiple third intermediate caches and distributing them synchronously, complete row computation data is provided to all parallel acceleration cores at once, perfectly matching the row-parallel computation mode of matrix multiplication and greatly improving data throughput. At the same time, vector components are distributed to cores and cached within them for multi-row reuse, avoiding repeated access to vector storage in multiple rounds of row computation, reducing data handling overhead and access latency.

[0072] In an optional embodiment of the present invention, step 14 involves controlling each of the parallel acceleration cores to sequentially perform number-theoretical transformations on its received operands, perform dot multiplication in the transform domain, and perform inverse number-theoretical transformations on the dot multiplication results to obtain the computational results of each parallel acceleration core, including:

[0073] Step 141: Control each of the parallel acceleration kernels to perform a forward number theory transformation on the received operands in parallel to obtain the corresponding first transformation result and second transformation result;

[0074] Specifically, the dual-path NTT units inside the parallel acceleration core start working simultaneously, performing iterative calculations on the input polynomial coefficients through a multi-stage pipeline structure; each stage of operation performs modular multiplication and modular addition operations based on the pre-stored rotation factor, and after complete pipeline processing, the two time-domain polynomials of length 256 are converted into corresponding frequency-domain coefficient vectors, thus obtaining the first transformation result and the second transformation result;

[0075] Step 142: Control each of the parallel acceleration cores to perform dot product of the coefficients at the same position in the first transformation result and the second transformation result in the transformation domain to obtain the dot product result vector;

[0076] Specifically, the dot product unit inside the parallel acceleration core receives the two frequency domain coefficient vectors mentioned above, and its 256 parallel multipliers start simultaneously. Each multiplier is responsible for performing modular multiplication on the coefficients with the same index in the two input vectors, and immediately reducing the result to the modulus range through the matching modular reduction circuit. This step completes the operation of all 256 coefficients in one clock cycle with extremely high parallelism, thereby generating a new dot product result vector that is also located in the frequency domain.

[0077] Step 143: Control each of the parallel acceleration cores to perform inverse number theory transformation on the dot product result vector to obtain the operation result of each parallel acceleration core in the time domain;

[0078] Specifically, the INTT unit inside the parallel acceleration core receives the dot product result vector and performs an inverse butterfly operation through a multi-stage pipeline similar to the forward transform structure but with the reverse twitch factor sequence, transforming the data from the frequency domain back to the time domain. In the final stage of the pipeline, each coefficient of the result vector is multiplied by a pre-calculated normalization factor (i.e., the modular inverse of the polynomial length n), and a final modular reduction is performed again to ensure that all coefficients fall within the normalized interval; each parallel acceleration core outputs a complete final polynomial result in the time domain.

[0079] In this example, the dual-path NTT parallel transformation enables each parallel acceleration core to perform forward transformation on two operands simultaneously, directly doubling the processing throughput of the NTT stage compared to serial processing, and making full use of the computational resources of the transformation unit.

[0080] The fully parallel multiplication of 256 coefficients completes the modular multiplication and reduction of all coefficients within one clock cycle, reducing the traditional O(n) multiplication latency to O(1), completely eliminating the iteration latency of the multiplication operation, and greatly accelerating the core computation.

[0081] By sequentially performing number-theoretic transformations, dot product operations in the transformation domain, and inverse number-theoretic transformations on the dot product result, the preceding and following computational stages can be seamlessly connected and executed overlappingly. This hides the latency of each stage of computation, achieves sustained peak computational throughput, and significantly improves hardware utilization.

[0082] The entire operation process is controlled by fixed hardware timing, with a constant number of clock cycles for each step. This naturally satisfies the security requirements of cryptographic algorithms for long-term execution and effectively defends against side-channel attacks based on execution time differences.

[0083] In an optional embodiment of the present invention, step 15, which involves collecting the computation results of each of the parallel acceleration cores to form a target computation result, includes:

[0084] Step 151: When performing the dot product of the shared scalar polynomial and the vector polynomial, the time-domain operation results output by each parallel acceleration core are directly combined to form the target operation result;

[0085] Specifically, each parallel acceleration core outputs an independent time-domain polynomial result; the dataflow controller collects the results into an output buffer queue or a direct streaming output interface in the order of the core numbers through a dedicated data path or a shared bus; these polynomial results are sequentially concatenated to form a complete result vector of dimension L, which is the final target computation result;

[0086] Step 152: When performing the multiplication of matrix polynomial and vector polynomial, the time-domain operation results output by each parallel acceleration core in the same round of operation are accumulated to obtain the intermediate result of one row of the matrix. The calculation of all rows is completed through multiple rounds of operation to finally form the target operation result.

[0087] Specifically, in a single round of computation (for a row of the matrix), each core outputs a partial product. These partial products are then fed into a multi-input accumulator for summation to obtain the intermediate result for that row. The row index is then updated, and the next round of computation is initiated, repeating this process. After all rows have been computed, the intermediate results are combined in row order to form a complete K-dimensional result vector w, which serves as the target computation result.

[0088] In this example, a direct sequential combination strategy is adopted for the dot product task. The independent polynomial results generated by each parallel acceleration core are quickly collected through a dedicated path and sequentially concatenated to form the final vector. This process is simple and direct, avoiding unnecessary post-processing overhead. The result aggregation and computation output can overlap in a streaming manner, making the end-to-end latency of the dot product task only slightly higher than the single-core computation time, achieving a near-linear speedup gain.

[0089] For matrix multiplication tasks, a two-stage process of partial accumulation plus row-order combination is designed. The core lies in utilizing a multi-input accumulator (such as an addition tree) to perform parallel accumulation of the partial products generated by each kernel in a single row computation in a single cycle or with extremely low latency, rapidly generating the intermediate result for that row. This solves the reduction operation that is necessary in matrix multiplication, and the deeply pipelined design of the accumulator ensures that it will not become a performance bottleneck. Subsequently, by updating the row index loop, the intermediate results are finally combined into a complete vector. This mechanism matches the row-parallel computation mode of matrix multiplication, tightly coupling result aggregation with the row computation pipeline, and efficiently completing the transformation from parallel partial products to the final result.

[0090] In an optional embodiment of the present invention, in step 16, the target calculation result is output.

[0091] In this example, the collected target calculation results are read from the internal buffer queue or accumulator, assembled according to a preset output data format (such as compressed packaging), and streamed back to the host or the next-level processing unit via a high-speed output interface (such as AXI4-Stream). After the transmission is complete, a completion interrupt or a high-signal signal is generated to notify the host that the current calculation task has ended.

[0092] This example demonstrates the construction of an efficient and reliable output channel for computation results. High-speed streaming interfaces (such as AXI4-Stream) enable high-bandwidth, low-latency transmission of computation results from the accelerator to the host, avoiding the overhead of traditional block transmission or polling methods. Pre-defined format assembly (such as compression and packaging) further reduces the amount of data to be transmitted, improving effective bandwidth utilization. A mechanism for proactive notification upon completion (interrupt / signal) allows the host to promptly receive notification of task completion and process the results without continuous status queries, thereby freeing up host resources, improving the overall system's response speed and collaborative efficiency, and ensuring end-to-end smoothness and efficiency throughout the acceleration process.

[0093] In an optional embodiment of the present invention, the method further includes:

[0094] Step 17: After completing the acceleration processing of the current round, the matrix polynomial is kept in the third intermediate cache, and the start signal for indicating vector polynomial update is listened for.

[0095] Specifically, after the current round of calculation is completed, the process control unit maintains the matrix polynomial in the third intermediate cache and does not perform clearing or write-back operations; at the same time, the process control unit continuously listens for specific start signals from the sampling logic or external host, which indicate that the new or updated vector polynomial has been sampled and stored in the second intermediate cache.

[0096] Step 18: According to the start signal, reuse the matrix polynomial stored in the third intermediate cache and perform a new round of accelerated processing of matrix polynomial and vector polynomial multiplication with the updated vector polynomial.

[0097] Specifically, once the start signal is detected as valid, the process control unit immediately triggers a new round of calculations. It directly uses the original matrix polynomial held in the third intermediate cache and the updated vector polynomial in the second intermediate cache as input, skipping any loading or transformation stages of the matrix data, and repeats the matrix multiplication acceleration process of steps 13 to 16, thereby efficiently completing the iterative calculations.

[0098] In this example, by keeping the matrix data permanently resident on-chip, large-scale matrix polynomials, which are fixed operands, can be retained in a high-speed third intermediate cache after the initial loading. This completely eliminates the huge overhead of reloading the matrix from off-chip or repeatedly executing its NTT transformation in each subsequent iteration, resulting in significant savings in external storage bandwidth, data transfer time, and corresponding transformation calculation cycles.

[0099] By employing an event-triggered and immediately reusable startup control mechanism, and listening to the vector update completion signal, a new round of computation can be automatically triggered as soon as new data is ready, without waiting for the matrix data to be re-prepared. This not only achieves zero latency in computation startup, but more importantly, it enables the vector sampling process and matrix multiplication calculation process to achieve full pipelined parallelism, highly overlapping the originally serial sampling-loading-computation process, thereby increasing the overall system throughput to near the theoretical peak of pure computational units.

[0100] In an optional embodiment of the present invention, before allocating different operands in the computational data to corresponding intermediate caches for storage according to their types, the method further includes:

[0101] Step 21: Perform data format preprocessing on the computation data to obtain computation data with a unified data format.

[0102] Specifically, the system receives the raw input data stream (e.g., 92-bit wide) and splits it into multiple coefficients according to preset rules; it performs bit-width expansion (e.g., expanding the 23-bit sign bit to 24 bits) and sign bit processing on each coefficient; finally, it reassembles the data according to an internal unified format (e.g., 96-bit with 4 coefficients) to complete data alignment and standardization for subsequent storage and calculation.

[0103] In this example, external transmission optimized formats (such as compact 92-bit packing) are efficiently converted into a unified format (such as 96-bit alignment) that is directly usable by the internal computing core. This conversion is performed centrally at the front end of the data stream, avoiding the fragmented and repetitive format parsing and bit width adjustment in each subsequent computing core or computation step, which significantly reduces overall processing latency and hardware complexity.

[0104] A unified internal data format (such as fixed-width coefficient representation) simplifies and standardizes the design of all subsequent storage modules (such as banked memory) and computing modules (such as NTT butterfly cells and modular multipliers). All modules can be optimized based on the same data width and arrangement, improving hardware resource utilization and timing performance.

[0105] Example 1

[0106] like Figures 2-4 As shown, taking a post-quantum cryptographic polynomial operation acceleration device as an example, the device specifically includes:

[0107] Data Flow Controller (i.e., data processing state machine): Receives instructions, start signals, and raw data streams through an external interface. It contains a state machine to parse instructions, control data format conversion (such as 92-bit to 96-bit expansion and alignment), and coordinate the timing of all subsequent steps.

[0108] Tiered storage system (i.e., data cache and computing unit allocation and listing of cache units);

[0109] The first intermediate cache (i.e., system caches CP0_0, CP0_1, CP0_2, CP0_3): stores shared scalar polynomials (such as cp), and is a storage area that can be accessed simultaneously by all parallel acceleration cores;

[0110] The second intermediate cache (i.e., system cache S1[0], S1[1], S1[2], S1[3]): stores the components (s1[0] to s1[3]) of the vector polynomial (such as s1 or y); each second intermediate cache is independently addressable and supports conflict-free parallel access;

[0111] Third intermediate cache: Stores all elements of a matrix polynomial (such as A), distributed across multiple third intermediate caches using a cross-storage strategy, and supports parallel reading by row;

[0112] Parallel acceleration core array (i.e., loaded computation cores 0, 1, 2, 3): contains multiple (four in this example) identical parallel acceleration cores; the internal structure of each parallel acceleration core includes:

[0113] Dual-path NTT unit (i.e., NTT(a0...a255) and NTT(b0...b255) paths): performs forward number theory transformation (NTT) in parallel on the two received operands;

[0114] Dot product unit (i.e., Mul(0)...Mul(255) module): performs parallel dot product of 256 coefficients of the two inputs in the transform domain;

[0115] INTT unit (i.e. INTT acceleration core): performs inverse number theory transformation (INTT) on the dot product result and outputs a time-domain polynomial result;

[0116] Modulo adder: Used for partial accumulation addition operations when performing matrix multiplication;

[0117] Result storage RAM: Used to temporarily store the target operation result formed by the set, and for output;

[0118] A method for accelerating polynomial operations in post-quantum cryptography includes:

[0119] Step 31, Data Acquisition and Storage

[0120] The data flow controller receives external input data streams and instructions; it performs format preprocessing on the raw data (e.g., 92-bit wide) and converts it into a unified internal format (e.g., 96-bit wide); it allocates storage according to data type: cp is stored in the first intermediate buffer; each component of s1 or y is stored in the corresponding second intermediate buffer; all elements of matrix A are stored in the third intermediate buffer.

[0121] Step 32, Operand Distribution

[0122] Based on the task type, the data flow controller performs dispatching:

[0123] If it is a dot product of cp.s1, then cp is broadcast from the first intermediate buffer to all parallel acceleration cores (cores 0-3), and s1[0] to s1[3] is unicast from each of the second intermediate buffers to the corresponding parallel acceleration cores 0-3;

[0124] If it is an Ay multiplication, then the elements A[i][0] to A[i][3] of the i-th row of the matrix are read in parallel from the third intermediate cache and distributed to all parallel acceleration cores, while y[0] to y[3] are distributed to the corresponding cores;

[0125] Step 33, Parallel Computing

[0126] Each parallel acceleration core starts computing synchronously, and the dual-path NTT unit of each core performs a forward NTT transformation in parallel on the two received operands;

[0127] The dot product unit performs 256 parallel dot products on the frequency domain coefficients of the two NTT outputs;

[0128] The INTT unit performs an inverse transform on the dot product result and outputs the time-domain operation result.

[0129] Step 34, Results Collection and Output

[0130] For dot product tasks, the results of each core are directly stored in the result storage RAM and combined; for matrix multiplication, the partial products of the outputs of each core are accumulated by a modulo adder to obtain the row results, which are then stored in the result storage RAM; after multiple rounds of looping to complete all rows, the final result vector is formed.

[0131] The data flow controller assembles the target computation results stored in RAM according to the format, streams them out through the output interface, and generates a completion signal;

[0132] Step 35, multi-round iterative reuse

[0133] After one round of calculation is completed, matrix A remains in the third intermediate buffer. The controller listens for the start signal when the new vector y is ready. When the signal is valid, A in the third intermediate buffer is immediately reused, and a new round of calculation is started with y updated in the second intermediate buffer, skipping matrix overload and achieving efficient pipelined operation.

[0134] This invention significantly improves computational efficiency and throughput. By allocating dedicated storage structures according to operand types (scalar, vector, matrix) and combining broadcast + unicast and row-parallel data distribution strategies, it achieves efficient data provisioning and conflict-free access. The parallel acceleration core employs dual-path NTT, coefficient-level fully parallel dot multiplication, and pipelining INTT, reducing dot multiplication latency to constant levels and achieving a near-linear speedup for the overall operation.

[0135] Significantly reduces data handling and redundant computation overhead. Matrix polynomials reside permanently and are interleaved in on-chip memory, supporting full reuse across multiple iterations (such as rejection sampling), completely eliminating the bandwidth and computational costs of repeatedly loading and transforming matrices. Data format is uniformly preprocessed during the input stage, avoiding format conversion overhead during computation.

[0136] Balancing high performance, low power consumption, and security requirements, dedicated hardware parallelization reduces latency and lowers data transmission power consumption compared to GPUs, making it more suitable for embedded scenarios. Fixed-timing pipelined execution naturally meets long-term security requirements and can defend against timing side-channel attacks.

[0137] Controllable task distribution and core scheduling support flexible acceleration of various operations such as polynomial multiplication and matrix-vector multiplication, and overlap with the sampling process in a pipelined manner, improving the overall processing throughput and providing an efficient and universal hardware acceleration solution.

[0138] like Figure 5 As shown, embodiments of the present invention also provide an acceleration processing device 50 for polynomial operations in post-quantum cryptography, comprising:

[0139] The acquisition module 51 is used to acquire the computational data to be processed in polynomial operations in post-quantum cryptography, wherein the computational data includes at least two of the following: shared scalar polynomials, vector polynomials, and matrix polynomials.

[0140] The processing module 52 is used to allocate different operands in the computation data to corresponding intermediate caches for storage according to their types; distribute the operands in the intermediate caches to multiple parallel acceleration cores according to the type of computation task; control each parallel acceleration core to perform number theory transformation, dot product in the transformation domain, and inverse number theory transformation on the dot product result sequentially on the operands it receives, to obtain the computation results of each parallel acceleration core; collect the computation results of each parallel acceleration core to form the target computation result; and output the target computation result.

[0141] Optionally, the different operands in the computational data are allocated to corresponding intermediate caches according to their type for storage, including:

[0142] If the computational data is a shared scalar polynomial, then the shared scalar polynomial is stored in a separate first intermediate cache;

[0143] If the computational data is a vector polynomial, then the multiple polynomial components contained in the vector polynomial are stored in multiple parallel second intermediate caches respectively.

[0144] If the computational data is a matrix polynomial, then the multiple polynomial elements contained in the matrix polynomial are stored in multiple parallel third intermediate caches respectively.

[0145] Optionally, depending on the type of computation task, the operands in the intermediate cache are distributed to multiple parallel acceleration cores, including:

[0146] If the computation task type is a dot product of a shared scalar polynomial and a vector polynomial, then the shared scalar polynomial is broadcast to all the parallel acceleration cores, and each polynomial component of the vector polynomial is unicast to the corresponding parallel acceleration core.

[0147] If the computation task type is the multiplication of a matrix polynomial and a vector polynomial, then multiple polynomial elements belonging to the same operation row in the matrix polynomial are distributed in parallel to each of the parallel acceleration cores, and each polynomial component of the vector polynomial is distributed to the corresponding parallel acceleration core.

[0148] Optionally, each of the parallel acceleration cores is controlled to sequentially perform number-theoretical transformations on its received operands, perform dot multiplication in the transform domain, and perform inverse number-theoretical transformations on the dot multiplication results to obtain the operation results of each parallel acceleration core, including:

[0149] Each of the parallel acceleration cores is controlled to perform a forward number theory transformation on the received operands in parallel to obtain the corresponding first transformation result and second transformation result;

[0150] Each of the parallel acceleration cores is controlled to perform a dot product of the coefficients at the same position in the first and second transformation results in the transformation domain to obtain a dot product result vector;

[0151] Each of the parallel acceleration cores is controlled to perform an inverse number theory transformation on the dot product result vector to obtain the operation result of each parallel acceleration core in the time domain.

[0152] Optionally, the computation results of each of the parallel acceleration cores are aggregated to form the target computation result, including:

[0153] When performing a dot product of a shared scalar polynomial and a vector polynomial, the time-domain operation results output by each parallel acceleration core are directly combined to form the target operation result;

[0154] When performing matrix polynomial and vector polynomial multiplication, the time-domain operation results output by each parallel acceleration core in the same round of operation are accumulated to obtain the intermediate result of one row of the matrix. The calculation of all rows is completed through multiple rounds of operation to finally form the target operation result.

[0155] Optionally, the processing device 50 further includes:

[0156] After completing the acceleration process for the current round, the matrix polynomial is held in the third intermediate cache, and the system listens for a start signal to indicate an update of the vector polynomial.

[0157] Based on the start signal, the matrix polynomial stored in the third intermediate cache is reused, and a new round of accelerated processing of matrix polynomial and vector polynomial multiplication is performed with the updated vector polynomial.

[0158] Optionally, before allocating different operands in the computational data to corresponding intermediate caches for storage according to their type, the processing device 50 further includes:

[0159] The computational data is preprocessed to obtain computational data in a unified format.

[0160] It should be noted that this device is a device corresponding to the above method. All implementation methods in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0161] Embodiments of the present invention also provide a computing device, including: one or more processors; and a storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0162] Embodiments of the present invention also provide a computing device readable storage medium storing instructions that, when executed on a computing device, cause the computing device to perform the method described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0163] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computing device software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0164] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0165] In the embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0166] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0167] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0168] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computing device-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computing device software product is stored in a storage medium and includes several instructions to cause a computing device (which may be a personal computing device, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0169] Furthermore, it should be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent solutions of the present invention. Moreover, the steps performing the above-described series of processes can naturally be executed in the order described, but are not necessarily required to be executed in chronological order; some steps can be executed in parallel or independently of each other. Those skilled in the art will understand that all or any step or component of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or network of computing devices, in hardware, firmware, software, or a combination thereof. This is something that those skilled in the art can achieve using basic programming skills after reading the description of the present invention.

[0170] Therefore, the object of the present invention can also be achieved by running a program or a set of programs on any computing device. The computing device can be a known general-purpose device. Therefore, the object of the present invention can also be achieved simply by providing a program product containing program code implementing the method or apparatus. That is, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any known storage medium or any storage medium developed in the future. It should also be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent to the present invention. Furthermore, the steps performing the above series of processes can naturally be performed in the order described, but are not necessarily required to be performed in chronological order. Some steps can be performed in parallel or independently of each other.

[0171] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for accelerating polynomial operations in post-quantum cryptography, characterized in that, include: Obtain the computational data to be processed in polynomial operations in post-quantum cryptography, wherein the computational data includes at least two of the following: shared scalar polynomials, vector polynomials, and matrix polynomials; Different operands in the computational data are allocated to corresponding intermediate caches according to their type for storage; Based on the type of computation task, the operands in the intermediate cache are distributed to multiple parallel acceleration cores; Each of the parallel acceleration cores is controlled to perform number-theoretical transformations on its received operands, perform dot multiplication in the transformation domain, and perform inverse number-theoretical transformations on the dot multiplication results in turn, so as to obtain the operation results of each parallel acceleration core; The computational results of each of the aforementioned parallel acceleration cores are combined to form the target computational result; Output the target calculation result; Specifically, the different operands in the computational data are allocated to corresponding intermediate caches according to their type for storage, including: If the computational data is a shared scalar polynomial, then the shared scalar polynomial is stored in a separate first intermediate cache; If the computational data is a vector polynomial, then the multiple polynomial components contained in the vector polynomial are stored in multiple parallel second intermediate caches respectively. If the operation data is a matrix polynomial, then the multiple polynomial elements contained in the matrix polynomial are stored in multiple parallel third intermediate caches respectively. After completing the acceleration process for the current round, the matrix polynomial is held in the third intermediate cache, and the system listens for a start signal to indicate an update of the vector polynomial. Based on the start signal, the matrix polynomial stored in the third intermediate cache is reused, and a new round of accelerated processing of matrix polynomial and vector polynomial multiplication is performed with the updated vector polynomial.

2. The method for accelerating polynomial operations in post-quantum cryptography according to claim 1, characterized in that, Based on the type of computational task, the operands in the intermediate cache are distributed to multiple parallel acceleration cores, including: If the computation task type is a dot product of a shared scalar polynomial and a vector polynomial, then the shared scalar polynomial is broadcast to all the parallel acceleration cores, and each polynomial component of the vector polynomial is unicast to the corresponding parallel acceleration core. If the computation task type is the multiplication of a matrix polynomial and a vector polynomial, then multiple polynomial elements belonging to the same operation row in the matrix polynomial are distributed in parallel to each of the parallel acceleration cores, and each polynomial component of the vector polynomial is distributed to the corresponding parallel acceleration core.

3. The method for accelerating polynomial operations in post-quantum cryptography according to claim 2, characterized in that, Each of the parallel acceleration cores is controlled to sequentially perform number-theoretical transformations on its received operands, perform dot multiplication in the transform domain, and perform inverse number-theoretical transformations on the dot multiplication results to obtain the operation results of each parallel acceleration core, including: Each of the parallel acceleration cores is controlled to perform a forward number theory transformation on the received operands in parallel to obtain the corresponding first transformation result and second transformation result; Each of the parallel acceleration cores is controlled to perform a dot product of the coefficients at the same position in the first and second transformation results in the transformation domain to obtain a dot product result vector; Each of the parallel acceleration cores is controlled to perform an inverse number theory transformation on the dot product result vector to obtain the operation result of each parallel acceleration core in the time domain.

4. The method for accelerating polynomial operations in post-quantum cryptography according to claim 2, characterized in that, The computational results of each of the aforementioned parallel acceleration cores are aggregated to form the target computational result, including: When performing a dot product of a shared scalar polynomial and a vector polynomial, the time-domain operation results output by each parallel acceleration core are directly combined to form the target operation result; When performing matrix polynomial and vector polynomial multiplication, the time-domain operation results output by each parallel acceleration core in the same round of operation are accumulated to obtain the intermediate result of one row of the matrix. The calculation of all rows is completed through multiple rounds of operation to finally form the target operation result.

5. The method for accelerating polynomial operations in post-quantum cryptography according to claim 1, characterized in that, Before allocating different operands in the computational data to corresponding intermediate caches for storage according to their type, the process further includes: The computational data is preprocessed to obtain computational data in a unified format.

6. A processing device for accelerating polynomial operations in post-quantum cryptography, characterized in that, include: The acquisition module is used to acquire the computational data to be processed in polynomial operations in post-quantum cryptography, wherein the computational data includes at least two of the following: shared scalar polynomials, vector polynomials, and matrix polynomials. The processing module is used to allocate different operands in the computation data to corresponding intermediate caches for storage according to their types; distribute the operands in the intermediate caches to multiple parallel acceleration cores according to the type of computation task; control each parallel acceleration core to perform number theory transformation, dot product in the transformation domain, and inverse number theory transformation on the dot product result sequentially on the operands it receives, to obtain the computation results of each parallel acceleration core; and collect the computation results of each parallel acceleration core to form the target computation result. Output the target operation result; wherein, the different operands in the operation data are allocated to corresponding intermediate caches according to their type for storage, including: if the operation data is a shared scalar polynomial, the shared scalar polynomial is stored in an independent first intermediate cache; if the operation data is a vector polynomial, the multiple polynomial components contained in the vector polynomial are stored in multiple parallel second intermediate caches respectively; if the operation data is a matrix polynomial, the multiple polynomial elements contained in the matrix polynomial are stored in multiple parallel third intermediate caches respectively; after completing the acceleration processing of the current round, the matrix polynomial is kept in the third intermediate cache, and a start signal for indicating vector polynomial update is listened for; according to the start signal, the matrix polynomial kept in the third intermediate cache is reused, and a new round of accelerated processing of matrix polynomial and vector polynomial multiplication is performed with the updated vector polynomial.

7. A computing device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the method as described in any one of claims 1 to 5.

8. A computing device readable storage medium, characterized in that, The computing device readable storage medium stores a program that, when executed by a processor, implements the method as described in any one of claims 1 to 5.

Images