Lattice basis matrix processing method, lattice password generating method, lattice basis matrix processing device, lattice password generating device and equipment

Abstract

The invention discloses a lattice basis matrix processing method, a lattice password generating method, a lattice basis matrix processing device and lattice password generating equipment, and relates to the technical field of post-quantum cryptography. The method comprises the following steps: in response to a received sub-matrix of a target round sent by a central processing unit (CPU), generating at least two groups of candidate vector pairs based on the sub-matrix in the target round, and respectively screening each group of candidate vector pairs in parallel through at least two threads to obtain an update vector of the target round; wherein the sub-matrix is obtained by intercepting a lattice basis matrix of a target round by the CPU based on a sliding window; and sending the update vector of the target round to the CPU, wherein the update vector of the target round is used for indicating the CPU to generate the lattice basis matrix of the next round of the target round based on the update vector. In the target round, the sub-matrixes corresponding to the lattice basis matrix are screened in parallel through multiple threads of the GPU, and the resource utilization rate and the lattice basis matrix processing efficiency are improved.

Description

Technical Field

[0001] This application relates to the field of post-quantum cryptography technology, and in particular to a method for processing lattice basis matrices, a method for generating lattice cryptography, an apparatus, and a device. Background Technology

[0002] The General Sieve Kernel (G6K) algorithm is an efficient algorithmic framework for solving difficult problems in lattices. It is applied in cryptography to encrypt and decrypt data by generating lattice ciphers.

[0003] In related technologies, in the central processing unit (CPU), the G6K algorithm divides the preprocessed lattice basis into multiple sub-blocks, and performs processing operations on the multiple sub-blocks, such as sampling, normalization and neighbor vector filtering, to obtain the short vector corresponding to the lattice basis as the lattice cipher.

[0004] However, in the above-mentioned processing method for lattice base matrices based on the G6K algorithm, the CPU tends to consume a lot of resources and has low processing efficiency when performing processing operations on multiple sub-blocks of the lattice base matrix. Summary of the Invention

[0005] This application provides a method for processing lattice base matrices, a method for generating lattice ciphers, an apparatus, and a device. The technical solutions provided by this application include the following aspects.

[0006] According to one aspect of the embodiments of this application, a method for processing lattice basis matrices is provided, the method being executed by a graphics processing unit (GPU), the method comprising: In response to receiving a submatrix of a target round sent by the central processing unit (CPU), at least two sets of candidate vector pairs are generated based on the submatrix in the target round, and each set of candidate vector pairs is filtered in parallel by at least two threads to obtain the update vector of the target round; wherein, the submatrix is ​​obtained by the CPU based on a sliding window truncated from the lattice basis matrix of the target round. The update vector of the target round is sent to the CPU, and the update vector of the target round is used to instruct the CPU to generate the lattice basis matrix of the next round of the target round based on the update vector.

[0007] According to another aspect of the embodiments of this application, a method for generating a lattice cipher is provided, the method being executed by a central processing unit (CPU), the method comprising: For a target round, obtain the lattice basis matrix and sliding window of the target round, extract the lattice basis matrix of the target round based on the sliding window to obtain the sub-matrix of the target round, and send the sub-matrix to the graphics processing unit (GPU). In response to receiving the update vector of the target round from the GPU, the update vector of the target round is inserted into the lattice basis matrix of the target round to generate the lattice basis matrix of the next round of the target round; wherein, the update vector of the target round is obtained by at least two threads in the GPU in parallel filtering at least two sets of candidate vector pairs in the submatrix respectively.

[0008] According to another aspect of the embodiments of this application, a lattice matrix processing apparatus is provided, the apparatus being deployed on a graphics processing unit (GPU), the apparatus comprising: The processing module is configured to respond to receiving a submatrix of a target round sent by the central processing unit (CPU), generating at least two sets of candidate vector pairs based on the submatrix in the target round, and performing parallel filtering processing on each set of candidate vector pairs by at least two threads to obtain the update vector of the target round; wherein, the submatrix is ​​obtained by the CPU based on a sliding window truncation of the lattice basis matrix of the target round. The transmission module is configured to send the update vector of the target round to the CPU, the update vector of the target round being used to instruct the CPU to generate the lattice basis matrix of the next round of the target round based on the update vector.

[0009] According to another aspect of the embodiments of this application, a grid-based cipher generation apparatus is provided, the apparatus being deployed in a central processing unit (CPU), the apparatus comprising: The acquisition module is configured to acquire the lattice base matrix and sliding window of the target round, extract the lattice base matrix of the target round based on the sliding window to obtain the sub-matrix of the target round, and send the sub-matrix to the graphics processing unit (GPU). The control module is configured to, in response to receiving the update vector of the target round from the GPU, insert the update vector of the target round into the lattice basis matrix of the target round to obtain the lattice basis matrix of the next round of the target round; wherein the update vector of the target round is obtained by at least two threads in the GPU filtering at least two sets of candidate vector pairs in the submatrix in parallel.

[0010] According to another aspect of the embodiments of this application, an electronic device is provided, the electronic device including a graphics processor, a central processing unit and a memory, the memory storing a computer program, the computer program being loaded and executed by the graphics processor to implement the above-described lattice base matrix processing method, or being loaded and executed by the central processing unit to implement the above-described lattice cipher generation method.

[0011] According to one aspect of the embodiments of this application, a computer-readable storage medium is provided, wherein a computer program is stored in the computer program, which is loaded and executed by a graphics processor to implement the above-described lattice basis matrix processing method, or is loaded and executed by a central processing unit to implement the above-described lattice cipher generation method.

[0012] According to one aspect of the embodiments of this application, a computer program product is provided, the computer program product including a computer program stored in a computer-readable storage medium, a graphics processor reading from the computer-readable storage medium and executing the computer program to implement the above-described lattice base matrix processing method, or a central processing unit reading from the computer-readable storage medium and executing the computer program to implement the above-described lattice cipher generation method.

[0013] The technical solution provided in this application can bring the following beneficial effects: At least two candidate vector pairs are generated based on the submatrices corresponding to the lattice base matrix. These candidate vector pairs are then processed in parallel using multi-threaded processing on the GPU to obtain the updated vectors corresponding to the submatrices, thus improving hardware resource utilization and computational throughput. In this scheme, the GPU handles parallel processing, while the CPU controls the flow. The updated vectors obtained from the GPU processing instruct the CPU to update the lattice base matrix, reducing CPU resource consumption and thereby improving the efficiency of lattice base matrix processing and lattice cipher generation. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of a computer system provided in an exemplary embodiment of this application; Figure 2 This is a schematic diagram of the generation process of a lattice cipher provided in an exemplary embodiment of this application; Figure 3 This is a flowchart of a method for processing lattice basis matrices provided in an exemplary embodiment of this application; Figure 4 This is a flowchart of a method for processing lattice basis matrices provided in another exemplary embodiment of this application; Figure 5 This is a flowchart of a method for generating a lattice cipher provided in an exemplary embodiment of this application; Figure 6 This is a structural block diagram of a lattice basis matrix processing apparatus provided in an exemplary embodiment of this application; Figure 7 This is a structural block diagram of a lattice cipher generation apparatus provided in an exemplary embodiment of this application; Figure 8 This is a schematic diagram of the generation process framework of a lattice cipher provided in an exemplary embodiment of this application; Figure 9 This is a schematic diagram of the structure of a computer device provided in an exemplary embodiment of this application. Detailed Implementation

[0015] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0016] The terminology used in this application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. The singular forms “a,” “the,” and “the” used in this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to and includes any and all possible combinations of one or more of the associated listed items.

[0017] It should be understood that although the terms first, second, etc., may be used in this application to describe various information, this information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, a first parameter may also be referred to as a second parameter, and similarly, a second parameter may also be referred to as a first parameter. Depending on the context, the word "if" as used herein may be interpreted as "when," "when," or "in response to determination."

[0018] It should be noted that this application may display prompt interfaces, pop-ups, or output voice prompts before and during the collection of user, processor, and computer device data. These prompt interfaces, pop-ups, or voice prompts are used to inform the user that their data is being collected. This ensures that the application only begins the steps for collecting user data after receiving confirmation from the user regarding the prompt interface or pop-up; otherwise (i.e., without user confirmation), the steps for collecting user data end, meaning no user data is collected. In other words, all user data collected in this application is collected with the user's consent and authorization, and the collection, use, and processing of related user data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0019] To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be described in further detail below with reference to the accompanying drawings.

[0020] Please refer to Figure 1 This illustrates a schematic diagram of a computer system provided in one embodiment of this application.

[0021] Figure 1 This is a schematic diagram of the structure of a computer system provided in an exemplary embodiment of this application. The computer system 100 can implement a system architecture for a method of generating lattice cryptography. The computer system 100 includes: a computer device 120.

[0022] In some embodiments, the computer device 120 includes a lattice matrix processing device and a lattice cipher generation device, wherein the lattice matrix processing device is used to apply a lattice matrix processing method, and the lattice cipher generation device is used to apply a lattice cipher generation method; or, the computer device 120 includes a first processor 122 and a second processor 124, wherein the first processor 122 includes the aforementioned lattice matrix processing device, and the second processor 124 includes the aforementioned lattice cipher generation device. The computer device 120 may be an electronic device such as a mobile phone, tablet computer, vehicle terminal (vehicle system), wearable device, personal computer (PC), or a server, such as a physical server or cloud server; this embodiment does not limit the specific type of server.

[0023] Those skilled in the art will understand that the number of the aforementioned devices can be greater or less. For example, there may be only one device, or there may be dozens or hundreds, or even more. The server includes at least one of a single server, multiple servers, a cloud computing platform, and a virtualization center. The servers collaborate using a distributed computing architecture. Optionally, the server provides functional services for implementing model training. It is worth noting that the aforementioned server can be implemented as a physical server or as a cloud server in the cloud. In some embodiments, the aforementioned server can also be implemented as a node in a blockchain system. This application does not limit the number or type of devices.

[0024] The lattice base matrix processing method provided in this application embodiment can be executed by a lattice base matrix processing device in computer device 120 for each step; the lattice cipher generation method provided in this application embodiment can be executed by a lattice cipher generation device in computer device 120 for each step.

[0025] In some embodiments, the processing device for the lattice matrix may be deployed on at least one of the following: a graphics processing unit (GPU), a general-purpose graphics processing unit (GPRS), or a general-purpose graphics processing unit (GPRS). Hardware devices capable of lattice matrix processing include Purpose Computing on Graphics Processing Units (GPGPU), Digital Signal Processors (DSP), Application Specific Integrated Circuits (ASIC), Tensor Processing Units (TPU), Tensor Cores, and Neural Processing Units (NPU).

[0026] In some embodiments, the grid cipher generation apparatus may be deployed in a CPU or other processor.

[0027] In some embodiments, the computer device 120 includes a first processor 122 and a second processor 124. Optionally, the first processor 122 performs the primary computational task, and the second processor 124 performs the secondary computational task; or, the first processor 122 performs the secondary computational task, and the second processor 124 performs the primary computational task; or, the first processor 122 and the second processor 124 collaborate using dedicated computing units. Schematic, the first processor 122 includes a GPU, and the second processor 124 includes a CPU.

[0028] The Shortest Vector Problem (SVP) is a fundamental and commonly used difficult problem on lattices, serving as the basis for the security of lattice cryptographic schemes. Related technologies include four categories of exact SVP solution algorithms: enumeration algorithms, sieving algorithms, the Voronoi-based approach, and discrete Gaussian sampling algorithms. Among these, under real-world constraints, enumeration and sieving algorithms are the most effective at solving practical problems. These constraints include, but are not limited to, reasonable time, memory, and energy costs; that is, the solution algorithm needs to be theoretically correct and meet engineering application requirements in terms of efficiency, stability, and implementability. Enumeration algorithms have higher time and space complexity than sieving algorithms. Among different sieving algorithms, the G6K algorithm is currently the main practical tool for analyzing cryptographic security.

[0029] Figure 2 This is a schematic diagram of the generation process of a lattice cipher provided in one embodiment of this application, as shown below. Figure 2 As shown, in the process of generating lattice ciphers using the G6K algorithm, the CPU first executes step 210 for the first round to obtain the lattice basis matrix. The lattice basis matrix obtained in the first round is the initial lattice basis matrix. Step 220 is executed to preprocess the lattice basis matrix. This preprocessing is used to initially shorten the basis vectors of the lattice basis matrix in the first round. For the target round, step 230 is executed to obtain a sliding window, and the lattice basis matrix is ​​truncated based on the sliding window to obtain a submatrix. The target round includes the first round or any subsequent round. The sliding window is used to truncate the lattice basis matrix to obtain a submatrix. The sliding window is a fixed-size dimensional space, and the dimension of the sliding window does not exceed the dimension of the lattice basis matrix. The submatrix is ​​a subset of the lattice basis matrix, and the submatrix includes at least two basis vectors from the lattice basis matrix within the range corresponding to the sliding window.

[0030] For example, when step 230 is executed in the first round, an initial sliding window is obtained, and the sub-matrix of the first round is intercepted based on the initial sliding window; when step 230 is executed repeatedly, the sliding window is slid with a preset step size, and the lattice basis matrix of the second round is intercepted to obtain the sub-matrix of the second round, and so on; the sliding of the sliding window is implemented by changing the starting index corresponding to the sliding window, thereby changing at least two basis vectors in the lattice basis matrix of the target round within the range corresponding to the sliding window, that is, obtaining the sub-matrix of the target round.

[0031] like Figure 2As shown, when obtaining the submatrix based on a sliding window, in the target round, step 240 is executed to sample the submatrix and obtain a candidate vector set. The sampling process includes, but is not limited to: obtaining random integer coefficients and performing a combination process on the basis vectors of the submatrix in the target round to obtain N candidate vectors, where N is a positive integer. The candidate vector set includes the N candidate vectors obtained in the above steps.

[0032] like Figure 2 As shown, for the target round, step 250 is executed to filter at least two pairs of candidate vectors in the candidate vector set to obtain an updated vector. The filtering process includes, but is not limited to: pairing each candidate vector in the candidate vector set with N-1 other candidate vectors in the set (excluding itself) to obtain at least two pairs of candidate vectors; performing difference and / or summation on the first and second candidate vectors in each pair to obtain the candidate difference vector corresponding to each pair; for each candidate difference vector, if the candidate difference vector is shorter than the first candidate vector in its corresponding pair, replacing the first candidate vector with the candidate difference vector to update the candidate vector set, until the updated candidate vector set meets the candidate vector requirements, thus obtaining the updated vector.

[0033] like Figure 2 As shown, with the update vector for the target round obtained, step 260 is executed to insert the update vector for the target round into the lattice basis matrix of the target round, generating the lattice basis matrix for the next round of the target round. Step 270 is executed to determine if the lattice basis matrix for the next round satisfies the convergence condition. If the lattice basis matrix for the next round of the target round satisfies the convergence condition, step 280 is executed to obtain the lattice cipher; if the lattice basis matrix for the next round of the target round does not satisfy the convergence condition, steps 230 to 270 are repeated.

[0034] Figure 3 This is a flowchart of a method for processing lattice basis matrices according to another embodiment of this application. The method is implemented by a computer device (which can be configured as follows). Figure 1 The GPU (which can be implemented as shown in the computer device 120) in the computer device 120) Figure 1 The method is executed by the first processor 122 shown. The method includes at least one of the following steps.

[0035] Step 310: In response to receiving the submatrix of the target round sent by the CPU, generate at least two candidate vector pairs based on the submatrix in the target round.

[0036] In response to receiving the submatrix of the target round sent by the central processing unit (CPU), at least two sets of candidate vector pairs are generated based on the submatrix in the target round, and each set of candidate vector pairs is filtered in parallel by at least two threads to obtain the updated vector of the target round; wherein, the submatrix is ​​obtained by the CPU based on the sliding window of the lattice basis matrix of the target round.

[0037] The lattice basis matrix, a mathematical concept in lattice theory within cryptography, is fundamental to the application of the G6K algorithm. Illustratively, assume... It is an n-dimensional real vector space. yes Let L be a set of linearly independent vectors, where m ranges from [1, n]. Let L be a lattice containing the above linearly independent vector set. A set formed by linear combination. Illustratively, the process of linear combination is implemented by combining the above linearly independent vector groups... Each vector and its corresponding integer coefficient Multiplying and adding together, that is:

[0038] in, It is a basis of lattice L, that is, a lattice basis matrix, and at least one vector of the lattice basis matrix. It is a basis vector. At least one vector in the lattice. At least one vector in a linearly independent vector group With at least one integer coefficient A linear combination, that is , The above includes at least one vector If there exists an integer Make v is an element of lattice L, called a lattice point, where vectors The Euclidean norm is In the ideal case where the basis vectors are perfectly orthogonal, the length of a lattice point is equal to the length of the vector. The Euclidean norm of L. Optionally, m is the dimension of the lattice L, i.e., its rank; when When L is a full-rank lattice, L is a discrete, additively closed group, meaning that the sum and difference of any two vectors in L are still in L.

[0039] In some embodiments, the lattice basis matrix includes, but is not limited to, at least one of the following properties: 1. Generative property: The lattice basis matrix can generate a complete lattice, that is, given a lattice basis matrix, each lattice point in the lattice can be uniquely represented as an integer linear combination of at least one basis vector. 2. Non-uniqueness: The lattice corresponds to infinitely many different lattice basis matrices, and each lattice point in the lattice can be represented by infinitely many different lattice basis matrices.

[0040] In some embodiments, the GPU is responsible for receiving the submatrix of the target round sent by the CPU; generating at least two sets of candidate vector pairs based on the submatrix of the target round; performing parallel filtering on each set of candidate vector pairs using at least two threads to obtain updated vectors; and sending the updated vectors to the CPU. Compared to preprocessing the lattice base matrix, the step of filtering each set of candidate vector pairs separately has higher computational complexity and is suitable for parallel processing. The GPU uses corresponding shared memory to store the submatrix, reducing the latency of accessing global memory and improving the processing efficiency of the submatrix. Correspondingly, the CPU is responsible for extracting the submatrix from the lattice base matrix and determining whether the updated lattice base matrix based on the updated vector satisfies the convergence condition; furthermore, the CPU performs preprocessing on the lattice base matrix, using corresponding memory to store the lattice base matrix, avoiding the increase in data transmission complexity during the data transmission process due to the large amount of lattice base matrix, thereby improving the preprocessing efficiency.

[0041] In some embodiments, the GPU's thread block size matches the dimension of the submatrix truncated by the CPU, thereby improving the balance of computational load across thread blocks. The thread block size is the number of threads included in the thread block. Illustratively, during submatrix processing, if the submatrix's dimension is not an integer multiple of the thread block size, the threads in the last thread block that exceed the actual matrix dimension will have no data to process, becoming idle threads and wasting computational resources. Furthermore, when the GPU's thread block size matches the dimension of the submatrix truncated by the CPU, each thread block can issue consecutive, aligned memory access requests when processing its allocated data blocks, maximizing memory bandwidth utilization.

[0042] Step 320: Each candidate vector pair is filtered and processed in parallel by at least two threads to obtain the update vector for the target round.

[0043] In response to receiving the submatrix of the target round sent by the central processing unit (CPU), at least two sets of candidate vector pairs are generated based on the submatrix in the target round, and each set of candidate vector pairs is filtered in parallel by at least two threads to obtain the updated vector of the target round; wherein, the submatrix is ​​obtained by the CPU based on the sliding window of the lattice basis matrix of the target round.

[0044] The update vector for the target round is obtained by filtering at least two sets of candidate vectors in the submatrix in parallel using at least two thread blocks.

[0045] By processing the submatrix obtained by the CPU using the GPU and storing the intermediate results during the processing, and by caching frequently accessed candidate vectors in shared memory, the processing efficiency is improved. Furthermore, the GPU has more processing units, corresponding higher storage bandwidth, and allows the same instruction stream to be executed synchronously by multiple processing units. It is suitable for parallel processing of at least two pairs of candidate vectors with the same format in the submatrix using at least two thread blocks, thereby reducing data processing latency.

[0046] In some embodiments, at least one lattice basis matrix corresponding to the same lattice may include one of the following two types: 1. The basis vectors of this lattice basis matrix are relatively long, and no two basis vectors are orthogonal, meaning the angle between their directions is small, resulting in strong linear dependence. Solving the SVP problem using this lattice basis matrix is ​​extremely difficult. Illustratively, lattice cryptography schemes typically use a lattice basis matrix with long basis vectors and non-orthogonal directions as the public key of the cryptosystem. Even if the public key is leaked, it remains difficult to crack the encrypted information, thus improving the security of the cryptosystem.

[0047] 2. The basis vectors of this lattice basis matrix are relatively short, and any two basis vectors are nearly orthogonal, meaning the angle between their directions is close to 90 degrees, resulting in weak linear dependence. Solving the SVP problem using this lattice basis matrix is ​​relatively easy, but difficult. Illustratively, lattice cryptography schemes typically use a lattice basis matrix with short basis vectors and near orthogonality as the private key, allowing the owner to efficiently perform decryption, signing, and other operations.

[0048] Optionally, in the application of the G6K algorithm, by processing the lattice basis matrix with longer basis vectors and non-orthogonal directions between any two basis vectors, a corresponding lattice basis matrix with shorter basis vectors and nearly orthogonal directions between any two basis vectors is obtained. This yields the shortest or near-shortest basis vector in the lattice basis matrix, which is also the shortest or near-shortest vector in the corresponding lattice, and serves as the output of the G6K algorithm. Based on this output, a lattice cipher is obtained, thereby breaking the cryptographic system.

[0049] Schematic representation: For different cryptosystems, lattice cryptography can be derived from the short vectors corresponding to the lattice basis matrix in at least one of the following ways: 1. For encryption schemes constructed from lattice-hard problems, the private key in the cryptosystem is recovered based on a short vector, or the ciphertext is directly decrypted. Optionally, the short vector output by the G6K algorithm is the private key, or a vector close to the private key. Optionally, the lattice cipher can be the cryptographic object to be cracked in the cryptosystem, such as a private key or security assumption; or protected data, such as ciphertext. Lattice-hard problems include, but are not limited to, the Short Integer Solution problem (SIS) and the Learning With Errors problem (LWE), etc., and this application does not limit them.

[0050] 2. For the digital signature system, signature forgery is based on short vectors. Optionally, the lattice cipher can be a protected operation in the cryptographic system, such as a legitimate signature. The digital signature scheme used by the digital signature system includes, but is not limited to, the Dilithium scheme, the Falcon scheme, and the stateless hash upgrade (SPHINCS+) scheme, etc., and this application does not limit it.

[0051] In some embodiments, in response to receiving a submatrix of the target round sent by the central processing unit (CPU), at least two sets of candidate vector pairs are generated based on the submatrix in the target round, and each set of candidate vector pairs is filtered in parallel by at least two threads to obtain the updated vector for the target round. Illustratively, in the application of the G6K algorithm, the GPU performs at least two threads in parallel filtering of each set of candidate vector pairs, including but not limited to at least one of the following steps: 1. Sample the submatrix using at least two threads to obtain a candidate vector set corresponding to the submatrix of the target round. The candidate vector set includes N candidate vectors, where N is a positive integer. The sampling process of the submatrix using at least two threads includes, but is not limited to, the following operations: 1.1 Obtaining Random Coefficients. The candidate vector set corresponding to the submatrix of the target round is the lattice point in the sub-cell of the target round corresponding to the submatrix of the target round. That is, the random coefficients are used to obtain the lattice point in the sub-cell of the target round corresponding to the submatrix of the target round based on the basis vectors in the submatrix of the target round. Here, the sub-cell of the target round is a subset of the lattice corresponding to the lattice basis matrix, and the vector set is obtained by performing a linear combination of the basis vectors in the submatrix of the target round and the random coefficients, and the random coefficients are integers.

[0052] 1.2 Based on random coefficients, a combination process is performed on the basis vectors of the submatrix of the target round to obtain candidate vectors. The candidate vector set includes at least two of the aforementioned candidate vectors. Schematic, the dimension of the sliding window corresponding to the submatrix of the target round is... Given a sliding window with a starting index of t, obtain the integer. The basis vectors of the submatrix for the target round Performing combination processing yields at least one candidate vector: ,in A set of random coefficients; optionally, the random coefficients include at least two sets of random coefficients. Illustratively, based on N sets of random coefficients and... The basis vectors of the submatrices for each target round are used to obtain a candidate vector set, which contains N candidate vectors. ,in N and t are both positive integers, and t is a non-negative integer.

[0053] 2. Obtain at least one pair of candidate vectors from the candidate vector set. Optionally, each candidate vector in the candidate vector set is paired with each of the other N-1 candidate vectors in the candidate vector set, excluding itself, to obtain at least two pairs of candidate vectors.

[0054] 3. Filter each candidate vector pair in parallel using at least two threads to obtain the update vector for the target round. The filtering process for each candidate vector pair includes, but is not limited to, the following operations: 3.1 Based on each candidate vector pair, obtain the candidate difference vector corresponding to each candidate vector pair. Optionally, for each of at least two threads, the thread performs subtraction and / or summation on the first and second candidate vectors in each candidate vector pair to obtain the candidate difference vector corresponding to each candidate vector pair.

[0055] 3.2 For each candidate difference vector, if the candidate difference vector is shorter than the first candidate vector in its corresponding candidate vector pair, the candidate difference vector replaces the first candidate vector in the candidate vector set to update it. This process continues until the updated candidate vector set meets the candidate vector requirements, resulting in the updated vector. Optionally, if the updated candidate vector set meets the candidate vector requirements, the updated candidate vector set is traversed, and the shortest candidate vector in the updated candidate vector set is obtained as the update vector for the target round.

[0056] The candidate vectors must meet at least one of the following requirements: the number of updates to the candidate vector set reaches a preset first threshold; the length of the candidate difference vector corresponding to each pair of candidate vectors in the candidate vector set is greater than or equal to the length of the first candidate vector. Optionally, the first threshold is related to the dimension β of the sliding window. Accordingly, obtaining a more complex submatrix on the lattice basis matrix through a larger sliding window requires more iterations. Optionally, during the processing of the candidate vector set, the amount of data in one processing operation can be reduced by setting a sub-sliding window, thereby improving the efficiency of obtaining the update vector for the target round.

[0057] At least two sets of candidate vector pairs are filtered in parallel by each thread in each thread block. In some embodiments, the GPU integrates a large number of relatively simple computing cores on a single chip, compared to the CPU. The GPU's computing core cluster can process computationally intensive tasks in parallel, including generating each set of candidate vector pairs based on a submatrix by each thread in each thread block, and filtering each set of candidate vector pairs in parallel by each thread in each thread block. By activating a large number of threads simultaneously, each thread focuses on filtering a set of candidate vector pairs, forming a large-scale single-instruction multithreaded execution mode, improving processing efficiency; and allocating computing resources in units of thread blocks reduces management overhead.

[0058] In some embodiments, the number of candidate vector pairs Q processed by each thread block is determined based on the total number of candidate vector pairs and the total number of preset thread blocks, where Q is a positive integer; each thread in each thread block processes Q groups of candidate vector pairs in parallel according to batches, and each thread processes one group of candidate vector pairs; wherein, the number of batches M = Q / K, M is a positive integer, K is the number of threads in each thread block, and K is an integer greater than 1.

[0059] When a single thread needs to process multiple candidate vector pairs, each thread within the thread block performs the filtering process in batches in parallel. Threads can reuse intermediate states that have been loaded into registers, reducing repeated memory accesses and improving computational intensity. This ensures that each thread processes one set of candidate vector pairs, expanding the GPU's adaptability to complex computational tasks.

[0060] Step 330: Send the update vector for the target round to the CPU.

[0061] The update vector for the target round is used to instruct the CPU to generate the lattice basis matrix for the next round based on the update vector.

[0062] A data transmission channel is established between the CPU and GPU to transmit necessary data during the generation of lattice ciphers, reducing data transmission overhead and thus improving the processing efficiency of the lattice basis matrix and the generation efficiency of the lattice ciphers. This data transmission channel receives the sub-matrix of the target round obtained by the CPU based on a sliding window from the lattice basis matrix of the target round, and sends the update vector of the target round. Illustratively, the necessary data includes the sub-matrix of the target round and the update vector.

[0063] In some embodiments, the data transmission channel between the CPU and the GPU includes, but is not limited to, at least one of the following implementation methods: 1. Non-uniform interconnect physical layers and transmission channels, including but not limited to the Peripheral Component Interconnect Express (PCIe) bus. Schematic example: with the CPU implemented as the CPU and the GPU implemented as the GPU, the PCIe bus performs data copying between the GPU memory and the CPU main memory through the direct memory access mechanism.

[0064] 2. The CPU and GPU share the same physical memory address space, and achieve consistent interconnection through the memory controller. They can access memory directly using pointers without the need for explicit data transfer instructions.

[0065] 3. Connect the CPU and GPU memory spaces via storage media.

[0066] 4. Access the memory space corresponding to the CPU or GPU through the network card and transmit data directly over the network.

[0067] It is worth noting that the data transmission channel between the CPU and GPU described above is merely an illustrative example, and the specific methods by which the GPU sends data to the CPU and receives data sent by the CPU are not limited in the embodiments of this application.

[0068] In summary, the method provided in this embodiment generates at least two candidate vector pairs based on the submatrix corresponding to the lattice basis matrix. The GPU then performs multi-threaded parallel processing on each of these candidate vector pairs to obtain the updated vector corresponding to the submatrix, thereby improving hardware resource utilization and computational throughput. This scheme uses the GPU for parallel processing and the CPU for flow control. The updated vector obtained by the GPU instructs the CPU to update the lattice basis matrix, reducing CPU resource consumption and thus improving the processing efficiency of the lattice basis matrix and the generation efficiency of the lattice cipher.

[0069] Figure 4 This is a flowchart of a method for processing lattice basis matrices according to another embodiment of this application. The method is implemented by a computer device (which can be configured as follows). Figure 1The GPU (which can be implemented as shown in the computer device 120) in the computer device 120) Figure 1 The method is executed by the first processor 122 shown. The method includes at least one of the following steps.

[0070] Step 410: Sample the submatrix using at least two threads to obtain a set of candidate vectors.

[0071] The candidate vector set includes N candidate vectors, where N is a positive integer.

[0072] In some embodiments, random coefficients are obtained; based on the random coefficients, a combination process is performed on the basis vectors of the submatrix of the target round to obtain candidate vectors; based on at least two candidate vectors, a set of candidate vectors corresponding to the submatrix of the target round is obtained. Here, the random coefficients are a combination of random integer coefficients. Based on the closure property of the lattice, performing an integer linear combination on the basis vectors of the submatrix of the target round guarantees that the resulting candidate vectors are valid vectors within the lattice corresponding to the submatrix of the target round.

[0073] In some embodiments, random coefficients are obtained, and the basis vectors of the submatrix of the target round are combined based on the random coefficients, including but not limited to at least one of the following implementation methods: 1. Obtain random coefficients through a Gaussian distribution. Illustratively, the dimension of the sliding window corresponding to the submatrix of the target round is... When the starting index of the sliding window is t, the random coefficients are... ,in The range of i is [1, ..., ], It is a system centered at the origin with a standard deviation of The continuous probability distribution is given by β, where β is a positive integer and t is a non-negative integer. Correspondingly, the candidate vector v is realized as:

[0074] 2. Generate random coefficients using linear combinations of integers. Illustratively, random coefficients... ,in The range of i is [1, ..., Accordingly, the candidate vector v is realized as follows:

[0075] It is worth noting that the above-described method for obtaining random coefficients is merely an illustrative example, and the specific method for performing sampling operations on the submatrix of the target round in this application embodiment is not limited.

[0076] In some embodiments, a set of candidate vectors corresponding to the submatrix of the target round is obtained based on at least two candidate vectors. Optionally, the number of candidate vectors This is a positive integer indicating the expected number of short vectors with a length less than a threshold. Only when the candidate vector set contains at least N vectors can it be expected to find a sufficient number of candidate vector pairs, thus generating the shortest vector in the submatrix of the target round through the difference between at least two candidate vector pairs (i.e., the candidate difference vector). The threshold is determined through mathematical calculation. Illustratively, through mathematical calculations involving the density of spheres and lattice packing theory, when the algorithm parameters are set optimally, the corresponding threshold exponent converges to a fixed constant, thereby obtaining the number of candidate vectors. The number of candidate vectors in the candidate vector set determines the parallelism required for at least two threads on the GPU to process each set of candidate vector pairs in parallel.

[0077] After sampling the submatrix using at least two threads to obtain a candidate vector set, each candidate vector in the candidate vector set is normalized using at least two threads. The direction of each normalized candidate vector remains unchanged, and the length of each normalized candidate vector is the average length of the candidate vector set. The normalization process includes, but is not limited to: obtaining the candidate vector set, which includes at least two normalized candidate vectors; obtaining the average length of at least two candidate vectors in the candidate vector set; and for each candidate vector, obtaining the corresponding unit vector, whose direction is consistent with the candidate vector.

[0078] Schematic illustration: By traversing the candidate vector set, the unit vector corresponding to each candidate vector is obtained, while retaining the direction of the candidate vector. The unit vector corresponding to each candidate vector is then combined with the average length of all candidate vectors in the candidate vector set to obtain normalized candidate vectors. The length of each candidate vector is then standardized. Schematic illustration: The candidate vector set corresponding to the submatrix in the target round is... In this case, the formula for the above normalization process is:

[0079] Here, N is the dimension of the candidate vector set, representing the next round after the target round. By standardizing the length of the candidate vectors to a standard scale, computational errors caused by excessive differences in vector length can be avoided. This also ensures that the judgment criteria are consistent when each group of candidate vector pairs is screened in parallel by at least two threads, thereby stabilizing the iterative processing of the G6K algorithm, preventing it from getting trapped in non-optimal local states, and improving the processing efficiency of the lattice basis matrix.

[0080] In some embodiments, the normalization processing of each candidate vector in the candidate vector set by at least two threads is performed after the sampling processing of the submatrix by at least two threads. From the GPU execution perspective, these two operations are completed in a single kernel startup. By merging multiple fine-grained computational operations into a coarser-grained, composite operation, there is no need to write intermediate results back to the GPU's corresponding memory space. When the efficiency of computational processing via the GPU processing unit is far faster than the efficiency of reading and writing to the GPU's corresponding memory space, merging these two operations can reduce the efficiency loss caused by the memory wall, thereby improving the processing efficiency of the lattice matrix.

[0081] Step 420: Based on the candidate vector set, obtain at least two pairs of candidate vectors.

[0082] Each candidate vector in the candidate vector set is paired with one of the N-1 candidate vectors in the candidate vector set excluding itself, to obtain at least two pairs of candidate vectors.

[0083] In some embodiments, the first candidate vector is paired with each of the other candidate vectors (excluding itself) to obtain at least two sets of candidate vector pairs. To obtain the update vector for the target round, the length of the update vector does not exceed the length of any one of the at least two candidate vectors in the candidate vector set. Based on the candidate vector set, at least one set of candidate vector pairs is obtained. Optionally, a candidate vector pair includes two neighboring candidate vectors, namely the first candidate vector and the second candidate vector; wherein the length of the difference between the two neighboring candidate vectors does not exceed a preset proximity threshold.

[0084] Step 430: Based on each group of candidate vector pairs, obtain the candidate difference vector corresponding to each group of candidate vector pairs.

[0085] For each of at least two threads, the thread performs subtraction and / or summation on the first and second candidate vectors in each candidate vector pair to obtain the candidate difference vector corresponding to each candidate vector pair.

[0086] In some embodiments, the submatrix is ​​sampled using at least two threads to obtain a candidate vector set. Indicatively, the candidate vector set is... N is the dimension of the candidate vector set. The process of updating the candidate vector set based on at least two pairs of candidate vectors is implemented as follows: 1. In the process of obtaining candidate vector pairs, select one candidate vector from the candidate vector set. , where i ranges from [1, N].

[0087] 2. Obtain other candidate vectors With the candidate vector The difference between , which is the candidate difference vector, where i and j are both in the range [1, N], and i and j are not equal.

[0088] 3. In the candidate vector set, for any pair of candidate vectors... In the length of the candidate difference vector No more than the length of the candidate vector pair In that case, that is Replace the candidate vector pairs with the candidate difference vectors and perform... .

[0089] Step 440: Replace the first candidate vector with the candidate difference vector and update the candidate vector set until the updated candidate vector set meets the candidate vector requirements, and obtain the updated vector.

[0090] For each candidate difference vector, if the candidate difference vector is shorter than the first candidate vector in its candidate vector pair, the candidate difference vector replaces the first candidate vector and updates the candidate vector set until the updated candidate vector set meets the candidate vector requirements, thus obtaining the updated vector.

[0091] By using at least two threads to perform pairwise reduction and filtering on each candidate vector pair in parallel, the candidate vector set can be made to continuously approach the optimal solution. By traversing each candidate vector pair in parallel by each thread, when it is detected that the candidate difference vector corresponding to a candidate vector pair is shorter than the first candidate vector, a replacement operation is performed on the candidate vector set, which improves the efficiency of processing the candidate vector set, thereby improving the processing efficiency of the lattice basis matrix.

[0092] Optionally, the process of obtaining the update vector based on the candidate difference vector can also be implemented as including but not limited to the following steps: select any candidate vector as the first candidate vector, obtain the length of the difference between the first candidate vector and other candidate vectors except itself, and use it as the candidate difference vector, compare the candidate difference vectors to obtain the shortest candidate difference vector, and if the candidate difference vector is shorter than the first candidate vector, replace the first candidate vector with the candidate difference vector; repeat the above steps until the candidate vector set meets the candidate vector requirements, traverse the candidate vector set, and obtain the shortest candidate vector in the candidate vector set as the update vector for the target round.

[0093] Optionally, the G6K algorithm starts from a low dimension and performs the pairwise reduction filtering process described above, integrates the found short vectors into a higher dimension, and continues to perform pairwise reduction filtering process on this basis until the target dimension corresponding to the submatrix of the target round is reached. This reduces computational complexity, reduces the requirement for storage space, improves resource utilization, and improves the processing efficiency of the submatrix of the target round.

[0094] In some embodiments, meeting the candidate vector requirements includes at least one of the following: the number of updates to the candidate vector set reaches a preset first threshold; the length of the candidate difference vector corresponding to each candidate vector pair in the candidate vector set is greater than or equal to the length of the first candidate vector.

[0095] Schematic, the candidate difference vector replaces the first candidate vector in the candidate vector set to update the candidate vector set until the updated candidate vector set meets the candidate vector requirements, thus obtaining the update vector for the target round, including at least one of the following: 1. Based on at least one candidate difference vector, update the candidate vector set until the number of updates to the candidate vector set reaches a preset first threshold, thus obtaining the updated vector for the target round. Illustratively, one update to the candidate vector set is one iteration. The first threshold serves as an upper limit for the number of updates. When preset, the corresponding value is considered to be large enough to ensure that convergence occurs before reaching the first threshold, preventing the G6K algorithm from getting stuck in an infinite loop due to individual candidate vector sets that are difficult to converge, or from consuming excessive time. Optionally, the first threshold is related to the dimension N of the candidate vector set. Accordingly, larger candidate vector sets have more complex candidate vectors and require more rounds of filtering.

[0096] 2. Based on at least one candidate difference vector, update the candidate vector set until the length of the candidate difference vector corresponding to each candidate vector pair in the updated candidate vector set is greater than or equal to the length of the first candidate vector, thus obtaining the update vector for the target round.

[0097] Optionally, the candidate vectors in the candidate vector set are compared to obtain the shortest vector length corresponding to the candidate vector set; and the candidate vectors in the candidate vector set updated in the previous update are compared to obtain the shortest vector length corresponding to the candidate vector set updated in the previous update; the difference between the shortest vector lengths corresponding to the two candidate vector sets is compared, and when the difference is less than a preset threshold, it indicates that the update of the candidate vector set has converged.

[0098] By setting candidate vector requirements, the end point of the submatrix processing in the target round is controlled. That is, by judging the convergence of the iteration, the processing flow is controlled, preventing computing resources from being consumed indefinitely in lengthy calculations that cannot produce significant improvements, thus ensuring efficient use of time and computing power. At the same time, if the candidate vector requirements are met, further processing and updating of the submatrix in the target round may be affected by rounding errors, resulting in inaccurate results. This ensures the reliability and repeatability of the results and improves the processing efficiency of the lattice basis matrix.

[0099] In summary, the method provided in this embodiment generates at least two candidate vector pairs based on the submatrix corresponding to the lattice basis matrix. The GPU then performs multi-threaded parallel processing on each of these candidate vector pairs to obtain the updated vector corresponding to the submatrix, thereby improving hardware resource utilization and computational throughput. This scheme uses the GPU for parallel processing and the CPU for flow control. The updated vector obtained by the GPU instructs the CPU to update the lattice basis matrix, reducing CPU resource consumption and thus improving the processing efficiency of the lattice basis matrix and the generation efficiency of the lattice cipher.

[0100] The method provided in this embodiment provides a high-quality initial candidate vector set for the subsequent execution of the G6K algorithm. Based on sampling from a probability distribution centered on short vectors, such as a discrete Gaussian distribution, or by directly generating a linear combination of small coefficients, it ensures that the candidate vector set already contains a large number of shorter vectors before each group of candidate vector pairs is screened in parallel by at least two threads. This provides a basis for the subsequent parallel processing of candidate vector pairs to obtain the update vector for the target round, thereby improving the processing efficiency of the submatrix of the target round.

[0101] To address the aforementioned issues, this application provides a method for generating lattice ciphers. Please refer to [reference needed]. Figure 5 The diagram illustrates a flowchart of a method for generating a lattice cipher according to an embodiment of this application. The method is implemented using a computer device (which can be configured as follows). Figure 1 The CPU in the computer device 120 shown (which can be implemented as follows) Figure 1 The method is executed by the second processor 124 shown. The method includes at least one of the following steps.

[0102] Step 510: For the target round, obtain the lattice basis matrix and sliding window of the target round.

[0103] Depending on the application scenario of the G6K algorithm, there are different ways to obtain the lattice basis matrix corresponding to the generated lattice cipher. In some embodiments, the methods for obtaining the lattice basis matrix include, but are not limited to, at least one of the following: 1. In cryptanalysis scenarios where the G6K algorithm is applied, obtain the lattice basis matrix from public information or the cryptographic construction process. Cryptoanalysis scenarios include, but are not limited to, attackers intercepting keys during encryption, solving lattice hard problems, or solving the output of cryptographic algorithms.

[0104] In this scenario, when an attacker intercepts the key during the encryption process, they obtain the lattice basis matrix from the public key corresponding to the cryptographic scheme. When solving lattice-hard problems, the lattice basis matrix is ​​obtained from the problem parameters. Illustratively, when solving SVP (Shortest-Version Positive) problems, the SVP challenge platform generates at least one lattice basis matrix locally using a standard, reproducible random lattice generation algorithm. Challengers can directly download the corresponding file from the SVP challenge platform to obtain the lattice basis matrix. SVP involves finding the shortest non-zero vector in a lattice generated from a set of linearly independent vectors.

[0105] 2. In the context of cryptographic design, a lattice basis matrix is ​​randomly generated. In some embodiments, a lattice basis matrix with statistical randomness is generated based on a random lattice generation algorithm. Exemplarily, the random lattice generation algorithm may include the Goldstein-Mayer distribution algorithm, the Ajtai class construction algorithm, modular lattice or polynomial lattice algorithms, etc., and this application does not limit it.

[0106] 3. When the G6K algorithm is applied to mathematical and computational research, the corresponding lattice basis matrix is ​​generated based on the research objective, for the theoretical research or algorithm testing required. In some embodiments, the lattice basis matrix is ​​obtained through a random lattice generation algorithm; or, to study the properties of a specific lattice, the lattice basis matrix is ​​obtained by artificially constructing a basis with a special structure.

[0107] A sliding window is used to extract a submatrix representing the target round from the lattice basis matrix. The sliding window is a fixed-size dimensional space, and its dimension does not exceed the dimension of the lattice basis matrix. In some embodiments, obtaining the sliding window includes, but is not limited to, obtaining the dimension of the sliding window and the starting index corresponding to the sliding window. The dimension of the sliding window is an input parameter of the algorithm. Illustratively, when the sliding window dimension β is determined, the sliding window is used to indicate a dimensional interval of size β on the lattice basis matrix. For a lattice basis matrix L of dimension m, based on the sliding window and the given starting index t corresponding to the sliding window, β consecutive basis vectors starting from the t-th element are obtained from the lattice basis matrix. , where 1≤t≤m β+1, a positive integer t, serves as the loop variable to control the sliding of the sliding window. For example, when the sliding window slides with a preset step size, the value of t is increased. Optionally, the initial value of t is 1. When t=1, the β consecutive basis vectors corresponding to the sliding window are... ; at t=m In the case of β+1, the β consecutive basis vectors corresponding to the sliding window are: Where β is a positive integer and t is a non-negative integer.

[0108] Step 520: Extract the lattice basis matrix of the target round based on the sliding window, obtain the sub-matrix of the target round, and send the sub-matrix to the GPU.

[0109] In some embodiments, before extracting the lattice basis matrix of the target round using a sliding window, the CPU performs preprocessing on the initial lattice basis matrix to obtain a preprocessed lattice basis matrix; the CPU then extracts the target round submatrix from the preprocessed lattice basis matrix using a sliding window; and finally sends the extracted target round submatrix from the preprocessed lattice basis matrix to the GPU. Optionally, preprocessing is used to initially shorten the basis vectors, reducing the computational complexity of subsequent processing of the target round submatrix.

[0110] By using a sliding window to extract the submatrix of the target round, at least two consecutive basis vectors from the lattice basis matrix are obtained. Based on the submatrix of the target round, the sub-cells of the target round can be obtained. The sub-cells of the target round are subsets of the lattice corresponding to the lattice basis matrix, and correspondingly, the lattice corresponding to the lattice basis matrix includes at least one sub-cell.

[0111] In some embodiments, the starting index of the sliding window is set as a loop counter, which controls the automatic increment of the starting index after the submatrix of the target round captured by the sliding window is processed. The starting index ranges from 1 to m. β+1, where the dimension of the lattice basis matrix is ​​m, and the dimension of the sliding window is β. Illustratively, when the first round of submatrices is extracted, the starting index of the sliding window is t. If the updated lattice basis matrix does not meet the convergence condition, the sliding window is moved by a preset step size, i.e., the starting index is increased by 1. Based on the new starting index t+1 of the sliding window, the second round of submatrices is extracted, and the β consecutive basis vectors starting from the (t+1)th element in the lattice basis matrix are obtained. , as the submatrix of the second round, where the dimension of the sliding window is β. Here, β is a positive integer, and t is a non-negative integer.

[0112] In some embodiments, after receiving the first-round update vector from the GPU, the CPU inserts the first-round update vector into the first-round lattice basis matrix to generate the second-round lattice basis matrix. If the second-round lattice basis matrix does not meet the convergence condition, the sliding window is slid again with a preset step size, and the second-round lattice basis matrix is ​​truncated to obtain the second-round sub-matrix, which is then sent to the GPU. The CPU then receives the second-round update vector from the GPU and inserts it into the second-round lattice basis matrix to generate the third-round lattice basis matrix. This process continues until the lattice basis matrix of the next round after the target round meets the convergence condition.

[0113] By using a sliding window to extract the submatrix of the target round, at least two basis vectors from the lattice basis matrix are obtained. Based on the submatrix of the target round, the sub-cells of the target round can be obtained. The sub-cells of the target round are subsets of the lattice corresponding to the lattice basis matrix, and correspondingly, the lattice corresponding to the lattice basis matrix includes at least one sub-cell. Illustratively, by using a sliding window of dimension β to extract the lattice basis matrix of the target round, β consecutive basis vectors starting from the t-th vector are obtained. This is the submatrix based on the target round, where t is the starting index of the sliding window. Here, β is a positive integer, and t is a non-negative integer. Submatrix based on the target round Get the subcell of the target round. , indicating that by set The span is the set of all linear combinations of the integer coefficients of the vectors in the middle, which is used to indicate the lattice space spanned by at least two basis vectors.

[0114] Schematic, the dimension of the lattice basis matrix is ​​m, and the dimension of the sliding window is β. Each time the sliding window is moved by a preset step size, the starting index t of the sliding window is incremented by 1; if the updated lattice basis matrix satisfies the convergence condition, the sliding window is stopped moving by the preset step size. That is, given a starting index t for the sliding window in the target round, by moving the sliding window by the preset step size... Obtain the sliding window of the next round after the target round, and extract the submatrix of the next round based on the sliding window of the next round after the target round. The submatrix of the next round based on the target round It can obtain the subcell of the next round after the target round. , representing the set of basis vectors The set of all linear combinations of integer coefficients of vectors.

[0115] To illustrate, if the sliding window slides with a preset step size, the starting index t reaches the upper limit, that is, at t=m In the case of β+1, if the lattice basis matrix of the next round of the target round still does not meet the convergence condition, that is, if the sliding window is not stopped sliding on the updated lattice basis matrix with a preset step size, then the starting index t is reset, that is, t=1, until the updated lattice basis matrix meets the convergence condition, and the sliding window is stopped sliding with a preset step size.

[0116] Step 530: In response to receiving the update vector of the target round from the GPU, insert the update vector of the target round into the lattice basis matrix of the target round to generate the lattice basis matrix of the next round of the target round.

[0117] A data transmission channel is established between the CPU and GPU to transmit necessary data during the generation of lattice ciphers, reducing data transmission overhead and thus improving the efficiency of lattice cipher generation. This data transmission channel sends the target round submatrix, extracted from the lattice basis matrix, and the update vector received from the GPU to the GPU. Illustratively, the necessary data includes the target round submatrix and the update vector. Optionally, the necessary data received from the GPU can be implemented as the GPU processing the target round submatrix to shorten the basis vector, resulting in the target round update vector.

[0118] In some embodiments, when the candidate vectors generated by at least two threads of the GPU in parallel are filtered to obtain the update vector for the target round, the update vector for the target round is inserted into the lattice basis matrix of the target round. Optionally, the update vector for the target round is inserted at or near the beginning of the sliding window of the target round, i.e., in the submatrix of the target round; schematically, the update vector for the target round is inserted after the first basis vector or before the last basis vector of the submatrix of the target round. This embodiment does not limit the method of replacing the basis vectors in the submatrix of the target round with the update vector for the target round.

[0119] Schematic representation of the lattice basis matrix of the next round after the target round. =InsertAndReduce(B,s), where B is the lattice basis matrix of the target round before inserting the update vector, and s is the update vector of the target round, which instructs the GPU to process the short vectors obtained by filtering each group of candidate vector pairs in parallel using at least two threads.

[0120] Optionally, in response to the received update vector for the target round from the GPU, the update vector for the target round is inserted after the lattice basis matrix of the target round. The lattice basis matrix is ​​then preprocessed again using a preprocessing algorithm to generate the lattice basis matrix for the next round of the target round. The preprocessing algorithm is used to initially shorten the basis vectors of the lattice basis matrix and convert the basis vectors to be approximately orthogonal to each other. Exemplarily, the preprocessing algorithm may include the Lenstra–Lenstra–Lovász (LLL) algorithm or the Block Korkine–Zolotarev (BKZ) algorithm; this application is not limited to these algorithms.

[0121] Compared to the G6K algorithm, the preprocessing algorithm has a lower computational cost. The G6K algorithm finds the shortest lattice point in the lattice of the basis matrix, i.e., the smallest vector in the obtained lattice, which serves as the lattice cipher. By ensuring that the basis vectors corresponding to the lattice are approximately orthogonal through the preprocessing algorithm, smaller lattice point coordinates indicate smaller vector lengths. Therefore, the approximately orthogonality of the basis vectors in the preprocessed lattice basis matrix allows the search space corresponding to the basis vectors of the lattice basis matrix to match the result space corresponding to the vectors in the lattice. Simultaneously, based on the preprocessing algorithm, the initial lattice basis matrix is ​​transformed into a weakly reduced form with more concentrated short vectors and a more regular structure, reducing the computational complexity of the next round after the target round. The GPU optimizes the sub-matrices obtained by sliding window extraction in subsequent rounds by using at least two threads to process each group of candidate vectors in parallel, thus improving the efficiency of the G6K algorithm.

[0122] In some embodiments, the above preprocessing steps include, but are not limited to: obtaining at least two basis vectors of the lattice basis matrix, and obtaining the orthogonalization coefficients of the basis vectors; adjusting the basis vectors based on the orthogonalization coefficients, wherein the adjusted basis vectors are shortened. In some embodiments, taking the LLL algorithm as an example, the orthogonalization coefficients of the basis vectors are implemented as GSO coefficients calculated by the Gram-Schmidt Orthogonalization (GSO) algorithm. Illustratively, in the lattice basis matrix implemented as... In the case of obtaining the basis vectors The corresponding auxiliary orthogonal basis vectors, i.e., GSO vectors. Among them, the GSO coefficient Used for indicator vector In the orthogonal direction The projection components on the surface, i and j, are both in the range [1, m].

[0123] In some embodiments, the orthogonalization coefficients are implemented as GSO coefficients. For example, based on the orthogonalization coefficients, adjusting the basis vectors includes, but is not limited to, at least one of the following steps: 1. Size reduction: Ensure that the orthogonality coefficients corresponding to the basis vectors satisfy the following conditions. That is, it controls the magnitude of the projection component of the basis vector onto the direction of the previous basis vector. In this case, the orthogonalization coefficients corresponding to each basis vector Perform integer conversion.

[0124] 2. Adjacent Vector Swapping: Ensure that the basis vectors satisfy the Lovász condition, which controls the geometric growth upper limit of the length of consecutive orthogonal components. Illustratively, for each... ( ),exist:

[0125] in, This is a pre-defined relaxation parameter used to adjust the severity of the Lovász condition, that is, to indicate the degree of preprocessing of the lattice basis matrix. Illustratively, when... The larger the value, the shorter the preprocessed basis vectors, and the more approximately orthogonal the basis vectors are to each other, meaning the angle between the basis vectors is approximately 90 degrees; when The smaller the value, the longer the preprocessed basis vectors and the smaller the angle between them. Optionally, =0.99 or =0.75.

[0126] Used to indicate when conditions are not met. If the length is too long, perform a swap on the basis vectors. Immediately after the exchange, the new Perform size reduction. Change the GSO order by swapping to ensure the GSO vector length is maintained. It exhibits an exponential decay trend, thereby improving the representativeness of the submatrix of the target round obtained by the sliding window to the lattice basis matrix of the target round.

[0127] Schematic representation: Preprocessing the lattice basis matrix is ​​implemented as follows:

[0128] in, It is the lattice basis matrix after preliminary reduction. The submatrix of the target round is obtained by using a sliding window. The above was extracted; This is another manifestation of the Lovász condition. By adjusting the basis vectors of the lattice basis matrix based on the orthogonalization coefficients, approximately orthogonal basis vectors can be obtained in polynomial time. This ensures that the coordinates of the lattice vectors reflect their true geometric lengths. As a preprocessing step in the G6K algorithm, this reduces the computational complexity of subsequent processing, optimizes the submatrices obtained by the sliding window extraction, and improves the efficiency of the G6K algorithm.

[0129] In some embodiments, the BKZ algorithm is implemented based on the LLL algorithm, and preprocesses the lattice basis matrix, including but not limited to at least one of the following steps: 1. Extracting continuous, overlapping segments from the m-dimensional lattice basis matrix. 1. A submatrix of dimension m and β. Where m and β are positive integers. 2. For each... 1. For each submatrix, an enumeration algorithm is used to obtain a short vector from the submatrix, which is then used as a local short vector. 2. In response to inserting this local short vector into the lattice base matrix, the LLL algorithm is immediately applied to the lattice base matrix, and the different submatrices of the lattice base matrix are traversed downwards to digest the impact of local improvements on the lattice base matrix. 3. The lattice base matrix is ​​preprocessed through multiple iterations until a preset termination condition is reached, at which point the preprocessing stops.

[0130] Step 540: In response to the convergence condition being satisfied by the lattice basis matrix of the next round of the target round, the lattice cipher is obtained based on the lattice basis matrix of the next round of the target round.

[0131] The convergence condition includes at least one of the following: the number of updates to the lattice basis matrix reaches a preset second threshold; the length difference between the update vectors of two adjacent iterations is less than a preset length threshold; and in a series of preset iterations, the length of the update vector in the later iteration is greater than or equal to the length of the update vector in the previous iteration.

[0132] In some embodiments, the update vector of the target round is inserted into the lattice basis matrix of the target round to obtain the lattice basis matrix of the next round of the target round. In response to the lattice basis matrix of the next round of the target round satisfying a convergence condition, a lattice cipher is obtained based on the lattice basis matrix of the next round of the target round. Indicatively, satisfying the convergence condition includes at least one of the following: 1. The number of updates to the lattice basis matrix reaches a preset second threshold. Illustratively, one update to the lattice basis matrix is ​​one iteration. The second threshold is pre-set to ensure that convergence usually occurs before reaching the second threshold, serving as an upper limit on the number of updates to prevent the G6K algorithm from getting stuck in an infinite loop due to individual submatrices that are difficult to converge, or from consuming excessive time. Optionally, the second threshold is related to the dimension m of the lattice basis matrix; correspondingly, larger lattice basis matrices correspond to more complex basis vectors, requiring more iterations for processing.

[0133] 2. The length difference between the update vectors of two adjacent rounds is less than the preset length threshold. Illustratively, the difference between the update vector of the target round and the update vector of the previous round is calculated to obtain the length difference of the shortest vector in the lattice basis matrix of the two rounds. When this length difference is less than the preset length threshold, it indicates that the update of the lattice basis matrix has converged, i.e., the convergence condition is met.

[0134] 3. In a series of predetermined iterations, the length of the update vector in the next iteration is greater than or equal to the length of the update vector in the previous iteration. Illustratively, one update of the lattice basis matrix is ​​one iteration, and the predetermined number of iterations is k. During k consecutive iterations, if the update vector in the next iteration is not shorter than the update vector in the previous iteration, or if the difference in length is less than a predetermined threshold, it indicates that the update of the lattice basis matrix has converged.

[0135] It is worth noting that the above convergence conditions are merely illustrative examples, and the specific method of obtaining the lattice cipher after updating to the lattice basis matrix is ​​not limited in the embodiments of this application.

[0136] By setting convergence conditions, the end of the update of the lattice basis matrix is ​​controlled. That is, by judging the convergence of the iteration, the processing flow is controlled, which prevents computing resources from being consumed indefinitely in lengthy calculations that cannot produce significant improvements, and ensures the efficient use of time and computing power. At the same time, if the convergence conditions are met, further processing and updating of the lattice basis matrix may be affected by rounding errors, resulting in inaccurate results. This ensures the reliability and repeatability of the results and improves the efficiency of lattice cipher generation.

[0137] Step 550: In response to the fact that the lattice basis matrix of the next round of the target round does not meet the convergence condition, proceed to the next round of the target round.

[0138] Take the next round as the target round and repeat the steps for the target round until the generated lattice basis matrix satisfies the convergence condition.

[0139] The update vector of the target round is inserted into the lattice basis matrix of the target round to generate the lattice basis matrix of the next round of the target round. In response to the lattice basis matrix of the next round of the target round satisfying the convergence condition, the process moves to the next round of the target round, and the next round is taken as the target round. The steps for the target round are repeated, that is, steps 510 to 530 are repeated. The lattice cipher is obtained based on the generated lattice basis matrix until the generated lattice basis matrix satisfies the convergence condition.

[0140] Schematically, a sliding window is slid across the lattice basis matrix of the next round of the target round with a preset step size to capture the sub-matrix of the next round of the target round, and the sub-matrix of the next round of the target round is sent to the GPU; the update vector of the next round of the target round is received from the GPU, and the update vector of the next round of the target round is obtained by at least two threads in the GPU in parallel filtering at least two sets of candidate vector pairs in the sub-matrix.

[0141] By setting convergence conditions and controlling the iteration process based on these conditions, the iteration process is terminated when iteration can no longer significantly improve the results—that is, when it is impossible to shorten the basis vectors in the lattice basis matrix of the next round after the target round—thus avoiding invalid computation and improving resource utilization and the efficiency of lattice cipher generation. If the lattice basis matrix of the next round after the target round does not meet the convergence condition, the iteration process continues to improve the accuracy of the lattice cipher. This enhances the generalization ability of the G6K algorithm and achieves a dynamic balance between solution quality and computational cost.

[0142] In summary, the method provided in this embodiment generates at least two candidate vector pairs based on the submatrix corresponding to the lattice basis matrix. The GPU then performs multi-threaded parallel processing on each of these candidate vector pairs to obtain the updated vector corresponding to the submatrix, thereby improving hardware resource utilization and computational throughput. This scheme uses the GPU for parallel processing and the CPU for flow control. The updated vector obtained by the GPU instructs the CPU to update the lattice basis matrix, reducing CPU resource consumption and thus improving the processing efficiency of the lattice basis matrix and the generation efficiency of the lattice cipher.

[0143] The method provided in this embodiment is based on the G6K algorithm. It achieves iterative processing from low dimension to high dimension through a sliding window, decomposing the complex lattice basis matrix into a problem of iteratively processing low-dimensional submatrices, thereby reducing computational complexity and memory overhead. By inserting the update vector of the target round into the lattice basis matrix of the target round, the lattice basis matrix of the next round of the target round is generated. The short vector information in the processed submatrices is passed to the higher-dimensional lattice basis matrix through the update vector, thereby improving the generation efficiency of lattice ciphers.

[0144] The following are embodiments of the apparatus described in this application, which can be used to execute the embodiments of the method described in this application. For details not disclosed in the apparatus embodiments of this application, please refer to the embodiments of the method described in this application.

[0145] Please refer to Figure 6 This illustrates a structural block diagram of a lattice basis matrix processing apparatus provided in an exemplary embodiment of this application, such as... Figure 6 As shown, the device is deployed on a GPU; the device includes: The processing module 610 is configured to respond to receiving a submatrix of the target round sent by the central processing unit (CPU), generate at least two sets of candidate vector pairs based on the submatrix in the target round, and perform screening processing on each set of candidate vector pairs in parallel by at least two threads to obtain the updated vector of the target round; wherein, the submatrix is ​​obtained by the CPU based on a sliding window to extract the lattice basis matrix of the target round. The transmission module 620 is configured to send the update vector of the target round to the CPU, the update vector of the target round being used to instruct the CPU to generate the lattice basis matrix of the next round of the target round based on the update vector.

[0146] In an optional embodiment, the processing module 610 is further configured to sample the submatrix using at least two threads to obtain a candidate vector set, the candidate vector set including N candidate vectors, where N is a positive integer; The processing module 610 is also configured to pair each candidate vector in the candidate vector set with N-1 candidate vectors in the candidate vector set excluding itself, to obtain at least two pairs of candidate vectors.

[0147] In an optional embodiment, the processing module 610 is further configured to perform subtraction and / or summation on the first and second candidate vectors in each of at least two threads to obtain the candidate difference vectors corresponding to each candidate vector pair. The processing module 610 is also configured to, for each candidate difference vector, replace the first candidate vector with the candidate difference vector and update the candidate vector set if the candidate difference vector is shorter than the first candidate vector in the candidate vector pair, until the updated candidate vector set meets the candidate vector requirements, and thus obtain the updated vector.

[0148] In an optional embodiment, the processing module 610 is further configured to determine that the updated candidate vector set meets the candidate vector requirements, wherein meeting the candidate vector requirements includes at least one of the following: the number of updates to the candidate vector set reaches a preset first number threshold; the length of the candidate difference vector corresponding to each group of candidate vector pairs in the candidate vector set is greater than or equal to the length of the first candidate vector.

[0149] In an optional embodiment, the processing module 610 is further configured to perform parallel filtering on at least two sets of candidate vector pairs in the submatrix using at least two thread blocks to obtain the update vector for the target round.

[0150] In an optional embodiment, the processing module 610 is further configured to perform filtering processing on at least two sets of candidate vector pairs in parallel by each thread in each thread block.

[0151] In an optional embodiment, the processing module 610 is further configured to determine the number Q of candidate vector pairs processed by each thread block based on the total number of candidate vector pairs and the preset total number of thread blocks, where Q is a positive integer. The processing module 610 is also configured to process Q groups of candidate vector pairs in parallel by each thread in each thread block according to batches, and each thread processes one group of candidate vector pairs; wherein, the number of batches M=Q / K, M is a positive integer, K is the number of threads in each thread block, and K is an integer greater than 1.

[0152] In summary, the apparatus provided in this embodiment generates at least two sets of candidate vector pairs based on the submatrix corresponding to the lattice basis matrix. The GPU performs multi-threaded parallel processing on these candidate vector pairs to obtain the updated vector corresponding to the submatrix, thereby improving hardware resource utilization and computational throughput. This scheme uses the GPU for parallel processing and the CPU for process control. The updated vector obtained by the GPU instructs the CPU to update the lattice basis matrix, reducing CPU resource consumption and thus improving the processing efficiency of the lattice basis matrix and the generation efficiency of the lattice cipher.

[0153] Please refer to Figure 7 It shows a structural block diagram of a lattice cipher generation apparatus provided in an exemplary embodiment of this application, such as Figure 7 As shown, the device is deployed on the CPU; the device includes: The acquisition module 710 is configured to acquire the lattice base matrix and sliding window of the target round, extract the lattice base matrix of the target round based on the sliding window, obtain the sub-matrix of the target round, and send the sub-matrix to the graphics processing unit (GPU). The control module 720 is configured to, in response to receiving the update vector of the target round from the GPU, insert the update vector of the target round into the lattice basis matrix of the target round to generate the lattice basis matrix of the next round of the target round; wherein the update vector of the target round is obtained by at least two threads in the GPU in parallel filtering at least two sets of candidate vector pairs in the submatrix respectively.

[0154] In an optional embodiment, after inserting the update vector of the target round into the lattice basis matrix of the target round to obtain the lattice basis matrix of the next round of the target round, the acquisition module 710 is further configured to obtain the lattice cipher based on the lattice basis matrix of the next round of the target round in response to the lattice basis matrix of the next round of the target round satisfying the convergence condition. The control module 720 is also configured to, in response to the fact that the lattice basis matrix of the next round of the target round does not meet the convergence condition, enter the next round of the target round, take the next round as the target round, and repeat the steps executed for the target round until the generated lattice basis matrix meets the convergence condition.

[0155] In an optional embodiment, the control module 720 is further configured to determine that the lattice basis matrix of the next round of the target round satisfies a convergence condition, wherein satisfying the convergence condition includes at least one of the following: the number of updates to the lattice basis matrix reaches a preset second number threshold; the length difference between the update vectors of two adjacent rounds is less than a preset length threshold; and in a consecutive preset number of iterations, the length of the update vector of the later round is greater than or equal to the length of the update vector of the previous round.

[0156] In summary, the apparatus provided in this embodiment generates at least two sets of candidate vector pairs based on the submatrix corresponding to the lattice basis matrix. The GPU performs multi-threaded parallel processing on these candidate vector pairs to obtain the updated vector corresponding to the submatrix, thereby improving hardware resource utilization and computational throughput. This scheme uses the GPU for parallel processing and the CPU for process control. The updated vector obtained by the GPU instructs the CPU to update the lattice basis matrix, reducing CPU resource consumption and thus improving the processing efficiency of the lattice basis matrix and the generation efficiency of the lattice cipher.

[0157] The apparatus provided in this application embodiment is based on the G6K algorithm and uses a sliding window to achieve iterative processing from low dimension to high dimension. It decomposes the complex lattice basis matrix into a problem of iteratively processing low-dimensional submatrices, reducing computational complexity and memory overhead. By inserting the update vector of the target round into the lattice basis matrix of the target round, the lattice basis matrix of the next round of the target round is generated. The short vector information in the processed submatrices is passed to the higher-dimensional lattice basis matrix through the update vector, thereby improving the generation efficiency of lattice ciphers.

[0158] The apparatus provided in the above embodiments should be noted that, in implementing its functions, the division of the above functional modules is only used as an example. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the content structure of the device can be divided into different functional modules to complete all or part of the functions described above. In addition, the apparatus and method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0159] For illustrative purposes, please refer to the following: Figure 8 , Figure 8 This is a schematic diagram of the generation process framework of a lattice cipher provided in an exemplary embodiment of this application, such as... Figure 8As shown, in the process of generating lattice ciphers using the G6K algorithm, the CPU and GPU work together. The CPU is responsible for handling the control flow and relatively low-complexity computations of the G6K algorithm, while the GPU is responsible for the relatively high-complexity parallel computations. The CPU first executes step 810 to preprocess the initial lattice basis matrix. The initial lattice basis matrix is ​​the one obtained in the first round; the preprocessing in step 810 is used to initially shorten the basis vectors of the lattice basis matrix. Step 820 is executed to extract the submatrix of the target round based on a sliding window. Extracting the lattice basis matrix of the target round based on the sliding window yields the submatrix of the target round; the target round includes the first round or any subsequent round.

[0160] like Figure 8 As shown, when step 820 is executed for the first time, for the first round, a sliding window for the first round is obtained, and the lattice basis matrix of the first round is extracted based on the sliding window to obtain the submatrix of the first round. The sliding window is a fixed-size dimensional space, and the dimension of the sliding window does not exceed the dimension of the lattice basis matrix; the submatrix is ​​a subset of the lattice basis matrix, including at least two basis vectors of the lattice basis matrix within the range corresponding to the sliding window. When step 820 is executed repeatedly, for the target round, a sliding window for the target round is obtained by sliding the sliding window of the previous round, and the lattice basis matrix of the target round is extracted to obtain the submatrix of the target round. The sliding of the sliding window is implemented by changing the starting index corresponding to the sliding window, thereby changing at least two basis vectors of the lattice basis matrix within the range corresponding to the sliding window, that is, obtaining the submatrix of the target round.

[0161] like Figure 8 As shown, the CPU sends the submatrix of the target round to the corresponding memory space in the GPU. After receiving the submatrix of the target round from the CPU, the GPU executes step 830, which uses at least two threads to sample the submatrix to obtain a candidate vector set. The sampling process in step 830 includes, but is not limited to: obtaining random integer coefficients and performing combination processing on at least two basis vectors of the submatrix of the target round to obtain N candidate vectors. The candidate vector set includes these N candidate vectors, where N is a positive integer. Step 840 is executed, where at least two threads perform normalization processing on each candidate vector in the candidate vector set in parallel. During the sampling process in step 830 and the normalization process in step 840, it is not necessary to write the intermediate results back to the corresponding memory space of the GPU separately. Instead, the processed candidate vector set is written back to the corresponding memory space of the GPU after the normalization process is completed, improving read / write efficiency.

[0162] like Figure 8As shown, given the candidate vector set corresponding to the submatrix of the target round, at least two candidate vector pairs are obtained based on the candidate vector set. Step 850 is executed, where at least two threads process each candidate vector pair in parallel to obtain the update vector for the target round. Step 850 includes, but is not limited to: for each of the at least two threads, the thread performs subtraction and / or summation on the first and second candidate vectors in each candidate vector pair to obtain the candidate difference vector corresponding to each candidate vector pair; for each candidate difference vector, if the candidate difference vector is shorter than the first candidate vector in its candidate vector pair, the candidate difference vector replaces the first candidate vector in the candidate vector set to update it, until the updated candidate vector set meets the candidate vector requirements, thus obtaining the update vector.

[0163] like Figure 8 As shown, the GPU sends the update vector of the target round to the corresponding memory unit in the CPU. After receiving the update vector of the target round from the GPU, the CPU executes step 860, inserting the update vector of the target round into the lattice basis matrix of the target round to generate the lattice basis matrix of the next round. Step 870 is executed to determine whether the lattice basis matrix of the next round satisfies the convergence condition. If the lattice basis matrix of the next round satisfies the convergence condition, step 880 is executed to obtain the lattice password. If the lattice basis matrix of the next round does not satisfy the convergence condition, steps 820 to 870 are repeated. Optionally, during or after executing step 860, preprocessing of the lattice basis matrix of the next round can be performed again.

[0164] Figure 9 This is a schematic diagram of the structure of a computer device provided in an exemplary embodiment of this application. Optionally, the computer device 900 is an electronic device.

[0165] The computer device 900 can be any of the following electronic devices: a mobile terminal, a network device, or a server. For example, it could be a smartphone, a tablet, a Moving Picture Experts Group Audio Layer III (MP3) player, or a Moving Picture Experts Group Audio Layer IV (MP4) player. The computer device 900 may also be referred to as a user device, a portable terminal, or other names.

[0166] Typically, computer device 900 includes a processor 901 and a memory 902.

[0167] Processor 901 may include one or more processing cores, such as a quad-core processor or a nine-core processor. Processor 901 may be implemented using at least one hardware form selected from Digital Signal Processing (DSP), FPGA, and Programmable Logic Array (PLA). Processor 901 may also include a main processor and a coprocessor. The main processor, also known as a CPU, is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 901 may integrate a GPU, which is also responsible for rendering and drawing the content required to be displayed on the screen. In some embodiments, processor 901 may also include an Artificial Intelligence (AI) processor, which is used to handle computational operations related to machine learning.

[0168] The memory 902 may include one or more computer-readable storage media, which may be tangible and non-transitory. The memory 902 may also include high-speed random access memory devices and non-volatile storage devices, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 902 are used to store at least one instruction, which is executed by the processor 902 to implement the lattice base matrix processing method or the lattice cipher generation method provided in the various method embodiments of this application.

[0169] In some embodiments, the computer device 900 may also optionally include a peripheral device interface 903 and at least one peripheral device. Specifically, the peripheral device includes at least one of a radio frequency circuit 904, a touch display screen 905, a camera assembly 906, an audio circuit 907, and a power supply 908. The computer device 900 also includes one or more sensors 909. The one or more sensors 909 include, but are not limited to, an accelerometer 910, a gyroscope 911, a pressure sensor 912, an optical sensor 913, and a proximity sensor 914.

[0170] On the other hand, embodiments of this application provide a computer device, which includes a processor and a memory. The memory stores at least one instruction, which is loaded and executed by the processor to implement the lattice base matrix processing method or the lattice cipher generation method provided in the embodiments of this application above.

[0171] On the other hand, embodiments of this application provide a computer-readable storage medium storing at least one instruction, which is loaded and executed by a processor to implement the lattice base matrix processing method or the lattice cipher generation method provided in the embodiments of this application above.

[0172] On the other hand, embodiments of this application provide a computer program product, including a computer program or instructions, which, when executed by a processor, implement the lattice base matrix processing method or the lattice cipher generation method provided in the embodiments of this application above.

[0173] On the other hand, embodiments of this application provide a computer device that includes the processor described above. Optionally, the processor is a GPU. The computer device can be at least one of a portable computer, a desktop computer, a server, a server cluster, an AI computing cluster, and a cloud computing cluster. The AI ​​computing cluster can also be simply referred to as an intelligent computing cluster or a smart computing cluster.

[0174] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0175] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0176] Those skilled in the art will recognize that the functions described in the embodiments of this application in one or more of the above examples can be implemented using hardware, software, firmware, or any combination thereof. When implemented using software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein communication media include any medium that facilitates the transfer of a computer program from one place to another. Storage media can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0177] The above are merely optional embodiments of this application and are not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for processing lattice basis matrices, characterized in that, The method is executed by a graphics processing unit (GPU), and the method includes: In response to receiving a submatrix of a target round sent by the central processing unit (CPU), at least two sets of candidate vector pairs are generated based on the submatrix in the target round, and each set of candidate vector pairs is filtered in parallel by at least two threads to obtain the update vector of the target round; wherein, the submatrix is ​​obtained by the CPU based on a sliding window truncation of the lattice basis matrix of the target round. The update vector of the target round is sent to the CPU, and the update vector of the target round is used to instruct the CPU to generate the lattice basis matrix of the next round of the target round based on the update vector.

2. The method according to claim 1, characterized in that, The generation of at least two candidate vector pairs based on the submatrix includes: The submatrix is ​​sampled by at least two threads to obtain a candidate vector set, which includes N candidate vectors, where N is a positive integer. Each candidate vector in the candidate vector set is paired with N-1 other candidate vectors in the candidate vector set, excluding itself, to obtain at least two pairs of candidate vectors.

3. The method according to claim 1, characterized in that, The step of filtering each candidate vector pair in parallel using at least two threads to obtain the update vector for the target round includes: For each of the at least two threads, the thread performs subtraction and / or summation on the first and second candidate vectors in each pair of candidate vectors to obtain the candidate difference vectors corresponding to each pair of candidate vectors. For each candidate difference vector, if the candidate difference vector is shorter than the first candidate vector in its corresponding candidate vector pair, the candidate difference vector replaces the first candidate vector and updates the candidate vector set until the updated candidate vector set meets the candidate vector requirements, thus obtaining the updated vector.

4. The method according to claim 3, characterized in that, The requirements for meeting the candidate vector criteria include at least one of the following: The number of updates to the candidate vector set reaches a preset first threshold. The length of the candidate difference vector corresponding to each pair of candidate vectors in the candidate vector set is greater than or equal to the length of the first candidate vector.

5. The method according to any one of claims 1 to 4, characterized in that, The step of filtering each candidate vector pair in parallel using at least two threads to obtain the update vector for the target round includes: The update vector for the target round is obtained by filtering at least two sets of candidate vector pairs in the submatrix in parallel using at least two thread blocks.

6. The method according to claim 5, characterized in that, The update vector for the target round is obtained by filtering at least two sets of candidate vector pairs in the submatrix in parallel using at least two thread blocks, including: The at least two sets of candidate vector pairs are filtered in parallel by each thread in each thread block.

7. The method according to claim 6, characterized in that, The step of filtering the at least two sets of candidate vector pairs in parallel by each thread in each thread block includes: Based on the total number of candidate vector pairs and the preset total number of thread blocks, determine the number Q of candidate vector pairs processed by each thread block, where Q is a positive integer; Each thread in each thread block performs parallel filtering on Q groups of candidate vector pairs in batches, with each thread filtering one group of candidate vector pairs; wherein the number of batches M = Q / K, M is a positive integer, K is the number of threads in each thread block, and K is an integer greater than 1.

8. A method for generating a lattice cipher, characterized in that, The method is executed by a central processing unit (CPU), and the method includes: For a target round, obtain the lattice basis matrix and sliding window of the target round, extract the lattice basis matrix of the target round based on the sliding window to obtain the sub-matrix of the target round, and send the sub-matrix to the graphics processing unit (GPU). In response to receiving the update vector of the target round from the GPU, the update vector of the target round is inserted into the lattice basis matrix of the target round to generate the lattice basis matrix of the next round of the target round; wherein, the update vector of the target round is obtained by at least two threads in the GPU in parallel filtering at least two sets of candidate vector pairs in the submatrix respectively.

9. The method according to claim 8, characterized in that, After inserting the update vector of the target round into the lattice basis matrix of the target round to obtain the lattice basis matrix of the next round of the target round, the method further includes: In response to the convergence condition being satisfied by the lattice basis matrix of the next round of the target round, the lattice cipher is obtained based on the lattice basis matrix of the next round of the target round. If the lattice basis matrix of the next round of the target round does not satisfy the convergence condition, proceed to the next round of the target round, take the next round as the target round, and repeat the steps for the target round until the generated lattice basis matrix satisfies the convergence condition.

10. The method according to claim 9, characterized in that, The convergence condition includes at least one of the following: The number of updates to the lattice base matrix reaches a preset second threshold. The length difference between the update vectors of two adjacent rounds is less than a preset length threshold; In a series of preset iterations, the length of the update vector in the next iteration is greater than or equal to the length of the update vector in the previous iteration.

11. A processing apparatus for a lattice basis matrix, characterized in that, The device is deployed on a graphics processing unit (GPU) and includes: The processing module is configured to respond to receiving a submatrix of a target round sent by the central processing unit (CPU), generating at least two sets of candidate vector pairs based on the submatrix in the target round, and performing parallel filtering processing on each set of candidate vector pairs by at least two threads to obtain the update vector of the target round; wherein, the submatrix is ​​obtained by the CPU based on a sliding window truncation of the lattice basis matrix of the target round. The transmission module is configured to send the update vector of the target round to the CPU, the update vector of the target round being used to instruct the CPU to generate the lattice basis matrix of the next round of the target round based on the update vector.

12. A lattice cipher generation apparatus, characterized in that, The device is deployed on a central processing unit (CPU) and includes: The acquisition module is configured to acquire the lattice base matrix and sliding window of the target round, extract the lattice base matrix of the target round based on the sliding window to obtain the sub-matrix of the target round, and send the sub-matrix to the graphics processing unit (GPU). The control module is configured to, in response to receiving the update vector of the target round from the GPU, insert the update vector of the target round into the lattice basis matrix of the target round to generate the lattice basis matrix of the next round of the target round; wherein the update vector of the target round is obtained by at least two threads in the GPU filtering at least two sets of candidate vector pairs in the submatrix in parallel.

13. An electronic device, characterized in that, It includes a memory and a processor; the memory stores a computer program that can be executed by the processor, and when the computer program is executed by the processor, it implements the lattice base matrix processing method as described in any one of claims 1 to 7, or the lattice cipher generation method as described in any one of claims 8 to 10.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the method for processing lattice base matrices as described in any one of claims 1 to 7, or the method for generating lattice ciphers as described in any one of claims 8 to 10.

15. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the lattice base matrix processing method as described in any one of claims 1 to 7, or the lattice cipher generation method as described in any one of claims 8 to 10.

Images