Method and device for constructing NTT accelerator based on FPGA

By constructing configurable operator units and hardware architecture templates on the FPGA platform, a high-efficiency NTT accelerator is generated, solving the problem of the inability to customize NTT accelerators in the existing technology and improving the NTT computing efficiency and resource utilization.

CN121835547APending Publication Date: 2026-04-10ZHEJIANG ANT SECRET TECH CO LTD
View PDF 0 Cites 0 Cited by

Patent Information

Authority / Receiving Office
CN · China
Patent Type
Applications(China)
Current Assignee / Owner
ZHEJIANG ANT SECRET TECH CO LTD
Filing Date
2025-12-15
Publication Date
2026-04-10

AI Technical Summary

Technical Problem

Existing NTT accelerators cannot be flexibly customized to meet user needs, resulting in low efficiency in different FHE scenarios and becoming a bottleneck for FHE applications.

Method used

Based on the FPGA platform, by constructing multiple types of operator units with configurable parameters, different hardware architecture templates are generated, and the optimal parameter configuration is searched to generate a high-efficiency NTT accelerator.

Benefits of technology

A high-performance NTT accelerator customized to user needs has been implemented, which improves NTT computing efficiency and reduces latency and resource consumption.

✦ Generated by Eureka AI based on patent content.

Smart Images

  • Figure CN121835547A_ABST
    Figure CN121835547A_ABST
Patent Text Reader

Abstract

The invention provides a method and device for constructing an NTT accelerator based on an FPGA. The construction method comprises the steps that user input is received, the user input comprises a target algorithm selected from multiple NTT algorithms and the available resource quantity of the FPGA, and the multiple NTT algorithms comprise standard NTT, four-step NTT and ten-step NTT; determining a target architecture template corresponding to the target algorithm from a plurality of hardware architecture templates preset for the plurality of NTT algorithms; each hardware architecture template is obtained by combining multiple types of preset operator units, and at least comprises a basic NTT unit configured according to the parallelism degree of the input data. Next, executing a plurality of rounds of iteration aiming at the degree of parallelism, wherein any round of iteration comprises the following steps of: calculating the resource quantity required by the target architecture template under the current value of the degree of parallelism; under the condition that the required resource quantity does not accord with the available resource quantity, reducing a parallelism degree value; and otherwise, determining the current value of the parallelism degree as the target value. Therefore, according to the target value of the parallelism degree, a hardware architecture code used for FPGA design is generated according to the target architecture template.
Need to check novelty before this filing date? Find Prior Art

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the field of special-purpose acceleration hardware, and in particular to a method and apparatus for constructing an NTT accelerator based on FPGA. BACKGROUND

[0002] In recent years, the increasing demand for data security has driven the research and development of Fully Homomorphic Encryption (FHE) technology. FHE enables direct computation in the ciphertext state, and is widely applicable to cloud computing, data privacy protection, and other scenarios. During FHE operations, the Number Theoretic Transform (NTT) is a core module for improving the efficiency of polynomial operations, which can significantly reduce the computational complexity of N-order polynomial multiplication from O(N 2 ) to O(NlogN), greatly improving the performance of ciphertext operations. For example, in the mainstream FHE scheme such as CKKS (Cheon-Kim-Kim-Song), operations such as ciphertext multiplication and ciphertext addition usually require NTT transformation first, then multiplication in the number field, and finally INTT (Inverse NTT) to return to the time domain calculation. Therefore, the operation time of NTT often accounts for the majority of the entire homomorphic computation process. Existing research shows that NTT usually accounts for 60% to 90% of the total execution time in different FHE application scenarios, and has become one of the bottlenecks affecting the efficiency of FHE applications. In addition, the NTT parameters used in different FHE schemes (such as BFV, CKKS, TFHE, etc.) are not the same, mainly in the range of 2 SUMMARY

[0003] One or more embodiments of the present specification describe a method and apparatus for constructing an NTT accelerator based on FPGA, which can efficiently generate FPGA hardware architecture according to user computing requirements, and achieve flexible customization.

[0004] According to a first aspect, a method for constructing an NTT accelerator based on FPGA is provided, comprising:

[0005] receiving user input, wherein the user input includes a target algorithm type selected from a plurality of NTT algorithm types, and the amount of available resources of the FPGA, wherein the plurality of NTT algorithm types includes a standard NTT, a four-step NTT, and a ten-step NTT;

[0006] determine, from a plurality of hardware architecture templates preset for the plurality of NTT algorithm types, a target architecture template corresponding to the target algorithm type, each hardware architecture template being obtained by combining a plurality of preset operator units, at least including a basic NTT unit configured according to a parallel degree of input data;

[0007] perform a plurality of rounds of iterations on the parallel degree, wherein any one round of iteration includes: calculating a required resource amount of the target architecture template under a current value of the parallel degree; in a case where the required resource amount does not conform to the available resource amount, reducing the value of the parallel degree; otherwise, determining the current value of the parallel degree as a target value;

[0008] generate, according to the target value of the parallel degree, a hardware architecture code for FPGA design according to the target architecture template.

[0009] According to a second aspect, an apparatus for constructing an NTT accelerator based on FPGA is provided, including:

[0010] a receiving module configured to receive user input, including: a target algorithm type selected from a plurality of NTT algorithm types, and an available resource amount of FPGA, wherein the plurality of NTT algorithm types include: standard NTT, four-step NTT and ten-step NTT;

[0011] a determining module configured to determine, from a plurality of hardware architecture templates preset for the plurality of NTT algorithm types, a target architecture template corresponding to the target algorithm type, each hardware architecture template being obtained by combining a plurality of preset operator units, at least including a basic NTT unit configured according to a parallel degree of input data;

[0012] an iteration module configured to perform a plurality of rounds of iterations on the parallel degree, wherein any one round of iteration includes: calculating a required resource amount of the target architecture template under a current value of the parallel degree; in a case where the required resource amount does not conform to the available resource amount, reducing the value of the parallel degree; otherwise, determining the current value of the parallel degree as a target value;

[0013] a constructing module configured to generate, according to the target value of the parallel degree, a hardware architecture code for FPGA design according to the target architecture template.

[0014] According to a third aspect, a computer system is provided, including a memory, a processor, and a computer program stored on the memory and executable on the processor, and the processor implements the method steps of the first aspect when executing the program.

[0015] According to a fourth aspect, a computer readable storage medium is provided, having a computer program stored thereon, and the computer program, when executed in a computer, causes the computer to execute the method of the first aspect.

[0016] In the embodiments of the present specification, the multi-class operator unit configurable parameter is configured, different hardware architecture templates are constructed based on the operator units for different NTT algorithms, and the search of the optimal parameter configuration based on the hardware architecture template is performed, and finally the hardware structure code is generated, so as to realize the customization of the FPGA-based NTT accelerator according to the user demand. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed in the embodiment description will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor on the basis of these drawings.

[0018] Figure 1 The overall flowchart of constructing the NTT accelerator according to the embodiments is shown;

[0019] Figure 2 An example of a basic NTT unit is shown;

[0020] Figure 3A A schematic diagram of the hardware architecture template corresponding to the standard NTT is shown;

[0021] Figure 3B A schematic diagram of the hardware architecture template corresponding to the four-step NTT (FNTT) is shown;

[0022] Figure 3C A schematic diagram of the hardware architecture template corresponding to the ten-step NTT (TNTT) is shown;

[0023] Figure 4 A flowchart of the method of constructing the NTT accelerator based on FPGA according to an embodiment is shown;

[0024] Figure 5 A schematic block diagram of the construction device according to an embodiment is shown. DETAILED DESCRIPTION

[0025] The schemes provided in the present specification will be described below in conjunction with the drawings.

[0026] Firstly, the terms involved in the embodiments of the specification are explained.

[0027] Fully Homomorphic Encryption (FHE): an encryption algorithm that can perform any number of addition and multiplication operations on encrypted data, so that the ciphertext calculation result is the same as the direct calculation result of the plaintext after decryption.

[0028] Number Theoretic Transform (NTT): is a realization of Discrete Fourier Transform on the basis of number theory, defined as a linear orthogonal transform on the integer ring (field) with a positive integer M as the modulus, which has a similar structure form to the Discrete Fourier Transform.

[0029] High Level Synthesis (HLS): a tool that automatically converts the logic structure described by high-level languages such as C / C++ into bottom-level hardware description language (RTL).

[0030] Field Programmable Gate Array (FPGA): a product further developed on the basis of Programmable Array Logic (PAL), Generic Array Logic (GAL), Erasable Programmable Logic Device (EPLD) and other devices. It is a programmable logic chip that can complete general functions, i.e. it can be programmed to achieve certain logic processing functions.

[0031] Hadamard Product: the input is two matrices of the same shape, and the output is a matrix of the same shape, whose elements at each position are equal to the product of the elements at the same position of the two input matrices.

[0032] As mentioned earlier, NTT transform is widely used to accelerate the performance of ciphertext operations in FHE, accordingly, the hardware circuit module performing NTT operation becomes an important and basic unit component in FHE acceleration hardware (such as FHE chip). In order to improve the performance of NTT operation, various NTT algorithms have been proposed, which are briefly introduced as follows.

[0033] Standard NTT (SNTT) algorithm is the most basic NTT algorithm, which usually contains log2N layers of calculation when applied to a polynomial of order N. Each layer needs to perform times of "Butterfly Operation", which involves modulus multiplication, modulus addition / subtraction operations between polynomial coefficients and a specific Twiddle Factor. The above polynomial order N can also be referred to as polynomial point number or NTT operation point number.

[0034] In order to further improve the calculation efficiency of NTT, especially to adapt to the needs of hardware parallelization, researchers have developed optimized algorithm variants such as Four-Step NTT (FNTT) and Ten-Step NTT (TNTT) based on the concept of Multi-Step Decomposition.

[0035] Four-step NTT (FNTT) decomposes the polynomial point number N into N = n1xn2, and decomposes the original N-point NTT into four steps executed in series:

[0036] First step: n2 independent n1-point NTTs (denoted as NTT n1 ) are executed. n1

[0037] Second step: transpose the n2xn1 data matrix output from the first step to obtain an n1xn2 matrix.

[0038] Third step: perform Hadamard product, i.e., calculate the modulo multiplication of each element in the transposed matrix with the corresponding rotation factor.

[0039] Fourth step: n1 independent n2-point NTTs (NTT n2 ) are executed.

[0040] The key advantage of the decomposition and execution in the four-step NTT is that all n2 NTT n1 operations are independent of each other, as are all n1 NTT n2 operations, which have natural parallel execution potential.

[0041] Ten-step NTT (TNTT) further decomposes the polynomial point number N into N = n1xn2 = n 11 xn 12 xn 21 xn 22 , thereby forming ten steps executed in series:

[0042] First step: n 12 xn 21 xn 22 independent n 11 -point NTTs (denoted as NTT n11 ) are executed.

[0043] Second step: transpose each of the n2 n 12 xn 11 dimensional sub-matrices output from the first step.

[0044] Third step: perform Hadamard product.

[0045] Fourth step: n 11 xn 21 xn 22 independent n 12 -point NTTs (denoted as NTT n12 ) are executed.

[0046] Fifth step: transpose the n2xn1 dimension of the current data structure.

[0047] Step 6: Perform Hadamard product.

[0048] Step 7: Perform n 11 x n 12 x n 22 independent n 21 -point NTTs (denoted as NTT n21 ).

[0049] Step 8: Perform transpose operation on each of the n1 n 22 x n 21 -dimensional sub-matrices outputted in Step 7.

[0050] Step 9: Perform Hadamard product.

[0051] Step 10: Perform n 11 x n 12 x n 21 independent n 22 -point NTTs (denoted as NTT n22 ).

[0052] Similar to the four-step NTT, all the sub-NTT operations of the same type (e.g., NTT n11 in Step 1) in the decomposition are independent of each other and highly parallelizable within the respective steps. In addition, it is noted that the ten-step NTT involves multiple matrix transpose steps, and the dimensions of the transposed matrices are different in each step, i.e., the second step, the fifth step, and the eighth step involve matrix transpose operations of different dimensions.

[0053] The above-mentioned SNTT, FNTT, and TNTT algorithms have been widely applied in different FHE schemes. Although various NTT hardware circuit implementation schemes have been proposed based on the above-mentioned NTT algorithms, these schemes are all hardware optimization schemes for a single and specific NTT algorithm, and cannot realize customization of NTT hardware circuits according to user requirements.

[0054] Considering the programmable characteristics of FPGA and the flexible customization requirements of users, the embodiments of the present specification propose an NTT acceleration automatic development framework for FPGA platforms. By using the algorithms and tools proposed in the embodiments of the present specification, high-performance hardware architectures can be automatically and efficiently generated under the condition that the user gives NTT parameters (including the number of terms N, data bit width), NTT algorithms (including SNTT, FNTT, and TNTT), and target FPGA resource limitations, and an NTT accelerator that efficiently performs NTT operations is constructed based on FPGA.

[0055] Figure 1 The overall flowchart of constructing an NTT accelerator based on FPGA according to an embodiment is shown. As shown in FIG. 1, the overall flowchart includes the following steps: Figure 1As shown, the overall flow includes the following steps.

[0056] First, the user can input the NTT parameters required by the intended FHE scheme, including the degree N of the polynomial, the data bit-width B, and the NTT algorithm (including SNTT, FNTT, or TNTT), as well as the total amount of available resources of a given FPGA. The available resources of the FPGA can include, for example, hard-core computing unit DSP resources, storage resources (such as BRAM), lookup table LUT resources, off-chip bandwidth resources, and the like. In a specific implementation, the range of the degree N supported by the present embodiment scheme can be from 2^12 to 2^16, and the supported data bit-width can be 28bit-64bit.

[0057] Then, according to the input NTT algorithm, i.e., one of SNTT, FNTT, and TNTT, the corresponding hardware architecture template and hardware architecture analysis model are selected. In the present embodiment scheme, a plurality of operator templates of parameter-configurable hardware operator units are designed in advance (e.g., using HLS). Depending on different combinations of hardware operator units, hardware architecture templates for different NTT algorithms are constructed, forming a hardware architecture template library. Thus, according to the type of NTT algorithm input by the user, the corresponding hardware architecture template can be selected from the hardware architecture template library constructed in advance, as well as the hardware architecture analysis model corresponding to the hardware architecture template. The hardware architecture analysis model is used to estimate the average delay and the FPGA resource consumption that the NTT hardware accelerator using the hardware architecture template can achieve under different parameter configurations.

[0058] Thus, next, with the total amount of available resources in the given FPGA as a constraint, the optimal parameter configuration candidate that minimizes the average delay is automatically searched for with the aid of the hardware architecture analysis model selected above.

[0059] Then, a selected optimal parameter configuration candidate is selected, and the code generator generates the overall NTT accelerator code based on the hardware architecture template. The generated code, after being synthesized, can be used in the design flow of the FPGA placement and routing phase.

[0060] Alternatively, the existing tool (e.g., the open-source tool RapidStream-TAPA) can be used to search for the optimal layout scheme under the given FPGA device, and then (e.g., using AMD Xilinx's Vitis-HLS) the hardware structure designed by HLS is synthesized into an IP module under the underlying hardware description language RTL, and Vivado is used for actual placement and routing. After that, the generated bitstream is burned on the actual FPGA, and the actual achievable performance is tested. If it meets the user's requirements, the flow ends, and if it does not, the step of selecting the optimal parameter configuration candidate is returned, another parameter configuration is selected, and the subsequent step flow is repeated until the user's requirements are met.

[0061] In the above overall process, the innovative proposal is to construct different hardware architecture templates for different NTT algorithms based on parameter configurable operator units, and search for optimal parameter configuration based on the hardware architecture templates, and finally generate hardware structure code, so as to realize the goal of customizing FPGA according to user demand.

[0062] The following will describe each type of operator unit and the hardware architecture template obtained by combination.

[0063] According to the basic steps of each type of NTT algorithm, in the embodiment of the specification, a plurality of parameter configurable operator units are proposed, including NTT x unit, data reorganization unit, transpose unit, Hadamard product unit. These operator units constitute a bottom layer hardware operator template library. By calling different operator units in the operator template library and combining them, hardware architecture templates of different NTT algorithms can be formed. The following will introduce these operator templates in detail.

[0064] NTT x unit is a basic NTT unit, and its input is x polynomial coefficients and x / 2 rotation factors. The NTT x unit instantiates log x stages, and each stage contains x / 2 butterfly units. Wherein, x is a configurable parameter.

[0065] Figure 2 An example of a basic NTT unit is shown. The example shows a schematic diagram of NTT 16 when x = 16. As shown in the schematic diagram, the input of the NTT 16 unit includes 16 polynomial coefficients as input data, wherein each layer has x / 2 = 8 butterfly units, and a total of log x = 4 stages (each stage corresponds to a layer) are passed through to realize the NTT operation of 16 coefficients.

[0066] The data reorganization unit is mainly used for the connection between NTT x in SNTT or FNTT, buffers the output data of the current NTT x , and reorganizes the data to obtain the input data of the next NTT x . The data reorganization unit mainly consumes storage resources, and the storage resources consumed are related to the input and output data size x of the basic NTT x unit. Optionally, each data reorganization unit can use a double buffer mechanism to fold the delay overhead of data reorganization.

[0067] The transpose unit is used to perform row-column flipping of matrix data of different sizes in FNTT / TNTT. The transpose unit mainly consumes storage resources, and the consumed storage resources are related to the size of the matrix to be transposed. Preferably, the design of the transpose unit can adopt shift storage, and the design of diagonal extraction saves the consumption of on-chip BRAM. The storage inside the transpose unit adopts a double buffer mechanism to fold the time overhead of transposition.

[0068] The Hadamard product unit is used to perform the Hadamard product step in FNTT / TNTT. According to FNTT / TNTT, in the step of calculating Hadamard product, the modulus multiplication result of two matrix bit elements is actually calculated. Therefore, the Hadamard product unit contains a set of modulus multiplication circuits corresponding to a given number of modulus multiplication operators.

[0069] Based on the combination of the above various operator units, a hardware architecture template for different NTT algorithms can be constructed.

[0070] Figure 3A A schematic diagram of a hardware architecture template corresponding to a standard NTT is shown. Subsequently, for the convenience of description, it is assumed that the data parallelism degree is p d , that is, p d polynomial data of B data bit width are input at a time. As Figure 3A shown, when the data parallelism degree is p d , the standard NTT hardware structure cascades a plurality of basic NTT units and inserts a data reorganization unit between . FIFO connections are used between units.

[0071] More specifically, the configuration parameter x of the basic NTT unit in SNTT takes the parallelism degree p d , and each basic NTT unit is used for NTT calculation of p d points. Each basic NTT unit, that is, , contains logp d butterfly operations. A plurality of units perform a total of logN stages of butterfly operations. The number of basic NTT units required is log pd N, and the number of data reorganization units required is the number of basic NTT units minus 1.

[0072] Figure 3B A schematic diagram of a hardware architecture template corresponding to a four-step NTT (FNTT) is shown. As Figure 3B shown, when the data parallelism degree is p d , a first group of units cascaded are used to perform the first step of FNTT in a pipeline manner: n2 The first group of cascaded The total number of stages is log n1, corresponding to log n1. pd n1 units Data recombination units are inserted between the elements. Then, transpose units are used to perform the second step of the FNTT, namely, row and column reversal of the n2×n1 matrix data. Following this, Hadamard product units are used to perform the third step of the FNTT: Hadamard product. This unit design includes... Modular multiplication operator. Preferably, the design of the Hadamard product unit utilizes the cascade multiplication property between the constant twitch factor and polynomial coefficients in NTT, to... Modular multiplication operations are merged into subsequent NTT executions to save resource overhead in modular multiplication computation. Finally, another group The unit is used to pipeline the fourth step in FNTT: This group The total sum of the stages is log n2, requiring log n2. pd n2 unit.

[0073] Figure 3C This diagram illustrates the hardware architecture template corresponding to the Ten-Step NTT (TNTT) architecture. Figure 3C As shown, the TNTT hardware architecture instantiates independent operators for computation from the first to the tenth step. When n 11 ,n 12 ,n 21 ,n 22 All are greater than p d At that time, steps one, four, seven, and ten all employ a cascaded approach. Unit, processing method and Figure 3B The first and fourth steps shown are similar. When n 11 / n 12 / n 21 / n 22 <p d In the first, fourth, seventh, and tenth steps, multiple instances (specifically p) will be instantiated. d / n ij indivual) Unit. In other words, the configuration parameters of a basic NTT unit are set to p. d and corresponding factor n 11 / n 12 / n 21 The smaller of / n2. The number of cached BRAMs in the transpose units of steps two, five, and eight is determined by the transpose matrix size. The Hadamard product units of steps three, six, and ten all contain... The modular multiplication operator. Similar to that in FNTT, the design of this Hadamard product unit utilizes the cascaded multiplication property between the constant twitch factor and polynomial coefficients in NTT, to... The modular multiplication operation is fused into the subsequent NTT execution.

[0074] Based on the various operator units described above and the hardware architecture templates corresponding to the various NTT algorithms, a hardware architecture analysis model can be constructed for any polynomial coefficient N and parallelism degree p d The resource consumption of the FPGA, i.e., the amount of resources required, can be estimated. The following describes the evaluation methods for various resource consumption amounts and related indicators.

[0075] (I) Calculation of average latency (AL)

[0076] To reflect the actual throughput achieved, the average latency of NTT execution for processing a single N-point polynomial can be defined as calculated according to the following formula (1):

[0077]

[0078] According to formula (1), the average latency is proportional to the polynomial point number N and inversely proportional to the parallelism degree p d .

[0079] (II) DSP resource consumption

[0080] Next, the evaluation of DSP resource consumption is described. DSP resources are hard-core arithmetic modules embedded in the FPGA chip and are the main computing resources. The DSP consumption is mainly derived from the NTT unit and the Hadamard product unit. In the p d parallelism degree, the number of DSPs consumed by a single unit in SNTT and FNTT is

[0081]

[0082] where d const is the number of DSPs consumed by a single butterfly unit / modular multiplication operator circuit. It can be understood that according to formula (2), the number of DSPs required by a single is the number of butterfly units in each layer the number of stages of butterfly operation (i.e., the number of layers) logp d , and the number of DSPs consumed by each butterfly unit, multiplied together.

[0083] For TNTT, when n 11 / n 12 / n 21 / n 22 ≥ p d , the first step / fourth step / seventh step / tenth step uses units for calculation, and the DSP consumption of each unit is calculated using formula (2).

[0084] When n 11 / n 12 / n 21 / n 22 <p d , the DSP consumption of the multiple units in the first / fourth / seventh / tenth step is calculated by:

[0085]

[0086] The difference between equation (3) and equation (2) is that when n ij <p d , the actual input number of the NTT unit is n ij , and the number of stages of the butterfly operation is calculated according to the actual input number n ij .

[0087] In addition, the number of DSPs consumed by a single Hadamard product unit is:

[0088]

[0089] Therefore, the total DSP requirement of SNTT / FNTT / TNTT under the data parallelism p d can be expressed as the sum of the DSP consumption of the NTT unit and the Hadamard product unit, as shown in equation (5):

[0090] D = ∑D N + ∑D M (5)

[0091] Wherein, the first summation sign in equation (5) is the summation of each basic NTT unit, and the second summation sign is the summation of each Hadamard product unit. The number of NTT units and the number of Hadamard product units relied on for summation are determined according to the value of each hardware architecture template and the parallelism p d , as described earlier in conjunction with Figures 3A-3C .

[0092] (Three) Storage resource consumption

[0093] Since BRAM is mainly used as a memory in FPGA, the storage resource consumption in the following description is also referred to as BRAM consumption. However, it should be understood that the following algorithm is similarly applicable to other types of memories.

[0094] In the foregoing various operator units, the BRAM consumption mainly comes from the data reorganization unit and the transpose unit. Therefore, the storage resource consumption of the entire hardware architecture can be expressed as:

[0095] B = ∑B DR + ∑D T(6)

[0096] Among them B DR D represents the BRAM consumption of the data reassembly unit. T This represents the BRAM consumption of the transpose unit. The first summation symbol in formula (6) sums over each data reassembly unit, and the second summation symbol sums over each transpose unit. The number of data reassembly units upon which the summation depends depends on the hardware architecture template and the parallelism p. d The value is determined, as previously combined Figures 3A-3C The description is as follows. Furthermore, in SNTT and FNTT, the BRAM consumption of a single data reassembly unit depends on the parallelism p. d In some embodiments, for n in the second step of TNTT 12 ×n 11 The transpose unit and n in step eight 22 ×n 21 The transpose unit can be stored using LUTs and FFs without consuming BRAM.

[0097] (iv) LUT and FF resource consumption (LUT / FF)

[0098] The basic logic units in an FPGA typically include a LUT (Look-Up Table) and FF (Flip-Flop) flip-flops. The LUT can be used to implement arbitrary combinational logic functions (such as AND gates and multiplexers), while the FF implements register functions to store state. They are generally used together.

[0099] The hardware architectures of SNTT, FNTT, and TNTT include NTTs with different parameter configurations. x The LUT / FF resource utilization and consumption methods differ for each operator unit, including the Hadamard product unit, data recombination unit, and transpose unit. Therefore, in the embodiments of this specification, a LUT / FF resource evaluation model is pre-constructed for each operator unit. In a specific example, the above resource evaluation model can be simply modeled as a linear model. For each operator unit, an actual implementation report is obtained; that is, actual LUT and FF resource usage data are collected for that operator unit under different scales and data bit widths. Based on this actual usage data, the model parameters of the linear model are learned and determined, thus constructing the resource evaluation model corresponding to that operator unit. Once the hardware architecture template to be used and the configuration of various parameters (including the number of polynomial points N, data bit width B, parallelism p) are determined... d After that, the current scale parameters can be input into the resource evaluation model corresponding to a certain operator unit to obtain the LUT / FF resources consumed by that operator unit. By accumulating the LUT / FF resource consumption of each operator unit in the hardware architecture template, the overall LUT and FF resource consumption of the hardware structure can be obtained.

[0100] (v) average off-chip bandwidth (ABW) consumption

[0101] According to one hardware architecture setting, independent off-chip memory access interfaces are configured for polynomial input coefficients, rotation factors, and output data, respectively. Therefore, the average total bandwidth for a single N-order polynomial to calculate NTT is:

[0102]

[0103] wherein AL is the average delay, which can be determined according to formula (1).

[0104] According to the above operator unit settings, hardware architecture template settings, and the above-described resource consumption calculation method, appropriate hardware architecture templates and optimal parameter configurations can be searched for the parameters of the NTT calculation task input by the user. The following describes the specific process of searching for optimal parameter configurations and designing FPGAs to perform NTT acceleration operations.

[0105] Figure 4 A flowchart of a method of constructing an NTT accelerator based on an FPGA according to one embodiment is shown. The method can be executed by any device, platform, or cluster with computing and processing capabilities. As shown in Figure 4 The method of constructing an NTT accelerator includes the following steps.

[0106] First, in step S41, user input is received. The user input can include, for example, the polynomial order N, data bit width B, and other conventional basic information. In the embodiments of the present specification, the user input further includes the target algorithm type selected from a plurality of NTT algorithm types, and the amount of available resources in the FPGA, wherein the plurality of NTT algorithm types include: standard NTT, four-step NTT, and ten-step NTT. That is, the user can specify in their input the target algorithm type selected from the standard NTT, four-step NTT, and ten-step NTT. The amount of available resources of the FPGA input by the user is used as a constraint for parameter configuration searching, and can specifically include one or more of the following resources: DSP resources, memory resources, LUT / FF resources, and bandwidth resources.

[0107] Then, in step S43, a target architecture template corresponding to the target algorithm type is determined from a plurality of hardware architecture templates preset for the above-mentioned plurality of NTT algorithm types; each hardware architecture template is obtained by combining a plurality of preset operator units, at least including a basic NTT unit configured according to the parallelism of the input data.

[0108] As mentioned earlier, multiple configurable operator units are pre-defined, and multiple hardware architecture templates corresponding to various NTT algorithm types are constructed based on combinations of these operator units. Specifically, the multiple operator units include: a basic NTT unit; a data recombination unit for recombining data between basic NTT units; a Hadamard product unit for performing Hadamard product operations between matrices; and a transpose unit for performing matrix transpose operations. The multiple hardware architecture templates include a first architecture template for standard NTT (such as...). Figure 3A As shown), the second architecture template for four-step NTT (such as...) Figure 3B As shown), and a third architecture template for Ten-Step NTT (such as...). Figure 3C (As shown). Different hardware architecture templates contain different combinations of different types and numbers of operator units. Specifically, the first architecture template includes a basic NTT unit and a data reconstruction unit; the second architecture template includes a basic NTT unit, a data reconstruction unit, a transpose unit, and a Hadamard product unit; the third architecture template includes a basic NTT unit, a transpose unit, and a Hadamard product unit. Figures 3A-3C The illustration shows that each architecture template contains a basic NTT unit, and the basic parameters of this basic NTT unit (number of processing points or number of input paths) are based on the parallelism p of the input data. d Configuration.

[0109] Based on the design of each architecture template, the parallelism p d Based on the parameter configuration that directly affects the basic NTT unit, it will further affect the parameter configuration and / or number setting of other operator units, thus becoming a core parameter to be determined.

[0110] Therefore, in step S45, the initial value of the parallelism is determined.

[0111] Then, in step S47, several rounds of iterations are performed for the degree of parallelism. For example... Figure 4 As shown, each iteration includes: in step S471, calculating the required resource amount of the target architecture template under the current value of parallelism; in step S472, determining whether the required resource amount conforms to the available resource amount of the FPGA. If the determination result is not met, then in step S473, the parallelism value is reduced, and the process returns to step S471 to enter the next iteration. If the determination result in step S472 is met, then in step S474, the current value of parallelism is determined as the target value.

[0112] The execution process of steps S45-S47 is described in detail below.

[0113] It can be understood that the main goal of the FPGA design is to improve the NTT calculation speed and reduce the latency. Therefore, the parameter selection takes the latency minimization as the design goal. According to the aforementioned formula (1), the average latency is inversely proportional to the parallelism, and thus the maximum possible value of the parallelism can be taken as the initial value in step S45, and then the iterative reduction is performed in step S47. Preferably, before the start of each round of iteration, the average latency under the current value of the parallelism is determined according to formula (1).

[0114] In one case, the amount of available resources of the FPGA input by the user in step S41 includes the available amount of DSP resources and the available amount of other resources. According to one embodiment, in step S45, the maximum possible value of the parallelism is determined as the initial value according to the available amount of the DSP resources; and then in the subsequent iterative step S47, it is only necessary to determine whether the required amount of other resources meets the available amount.

[0115] Specifically, in step S35, the maximum possible value of the parallelism under the constraint of the available amount of the DSP can be determined as the initial value of the parallelism, i.e., the initial value of several rounds of iteration, according to the first relationship between the DSP resource consumption and the parallelism under the target architecture template.

[0116] According to the aforementioned analysis of the DSP resource consumption, the aforementioned first relationship can correspond to formula (5), which shows that the DSP resource consumption is the sum of the DSP consumption of each basic NTT unit and the DSP consumption of each Hadamard product unit. Further, the DSP consumption of a single Hadamard product unit is shown in formula (4), which is proportional to the parallelism p d and inversely proportional to the number of stages logx in the NTT unit, which is related to the input number x of the corresponding NTT unit. The number of basic NTT units and the number of Hadamard product units can be determined according to the target architecture template and the value of the parallelism. d As shown in formula (2) and formula (3), the DSP consumption is proportional to the parallelism p

[0117] Specifically, if the target architecture template is the first architecture template for the standard NTT, the hardware architecture does not contain the Hadamard product unit, and the number of basic NTT units is determined according to the polynomial point number N and the parallelism p d , and the input number x of each basic NTT unit is equal to the parallelism p d , and the consumed DSP is determined according to formula (2).

[0118] If the target architecture template is the second architecture template for the four-step NTT, the hardware architecture contains one Hadamard product unit, and the number of basic NTT units is determined according to the polynomial decomposition factors n1, n2 and the parallelism pd The number of input paths x of each basic NTT unit is determined according to the target architecture template and the parallelism p d The consumed DSPs are determined according to formula (2).

[0119] If the target architecture template is the third architecture template for ten-step NTT, the hardware architecture includes 3 Hadamard multiplication units, and the number of basic NTT units is determined according to the polynomial factorization factor n ij and the parallelism p d , the number of input paths x of a single basic NTT unit is determined according to the target architecture template and the parallelism p d , and the smaller one of the corresponding factorization factor n ij The consumed DSPs are determined according to formula (2) or (3).

[0120] In summary, the combination of formula (2)-(5) shows the relationship between the parallelism and the DSP resource consumption given the target architecture template. Thus, given the available amount of DSPs, the maximum possible value of the parallelism p d can be deduced and taken as the initial value of the parallelism.

[0121] In an embodiment, in order to provide an appropriate amount of redundancy, a discount of the available amount of DSPs input by the user, for example 90%, can be taken as the available amount of DSPs, substituted into formula (5), to determine the maximum possible value of the parallelism, which is taken as the initial value of the parallelism.

[0122] After the initial value of the parallelism is thus determined, the iterative process can be entered. Since the initial value of the parallelism is the maximum possible value determined according to the available amount of DSPs, in the iteration step S471, the amount of DSPs required need not be calculated again, and only the amount of other types of resources required needs to be calculated.

[0123] In an embodiment, the other types of resources input by the user include storage resources. Accordingly, in step S471, the amount of storage resources required can be determined according to the current value of the parallelism and the target architecture template. Specifically, the sum of the storage requirements of each transposition unit and each data reorganization unit in the target architecture template can be calculated as the amount of storage resources required according to the aforementioned formula (6). The storage requirement of a single data reorganization unit is positively correlated with the value of the parallelism p d . The number of transposition units and data reorganization units is determined according to the target architecture template, and the number of data reorganization units further depends on the parallelism p d . For example, when the target architecture template is the first architecture template for standard NTT, which does not include transposition units, and the number of data reorganization units depends on the polynomial point number N and the parallelism p dWhen the target architecture template is the second architecture template for FNTT, it includes 1 transposition unit and multiple data reorganization units, the number of data reorganization units depends on the parallelism p d and the coefficient decomposition factor. When the target architecture template is the third architecture template for TNTT, it includes 3 transposition units; the transposition units of the second step and the eighth step can be implemented by using LUT and FF, therefore only the transposition unit of the fifth step needs to use storage resources. In summary, according to the target architecture template and the current value of the parallelism, the required amount of storage resources can be determined. Correspondingly, the judgment operation of step S472 includes judging whether the required amount of storage resources meets the available amount of storage resources input by the user.

[0124] In another embodiment, the other type of resources input by the user includes LUT resources and / or FF resources. Correspondingly, in step S471, for any type of operator unit included in the target architecture template, a resource evaluation model previously constructed for the type of operator unit is obtained, the current data bit width and the current scale parameter of the type of operator unit are input into the resource evaluation model, and the required amount of LUT resources and / or the required amount of FF resources of a single operator unit of the type are obtained. Then, according to the number of the type of operator units in the target architecture template and the required amount of LUT resources and / or the required amount of FF resources of a single operator unit of the type, the required amount of LUT resources and / or the required amount of FF resources of the type of operator units are determined, wherein the number of at least one type of operator units in the target architecture template is determined according to the current value of the parallelism. After determining the required amount of LUT resources and / or the required amount of FF resources of each type of operator units, the sum of the required amount of LUT resources and / or the required amount of FF resources of each type of operator units can be determined as the required amount of LUT resources and / or the required amount of FF resources of the target architecture template for the current value of the parallelism. Correspondingly, the judgment operation of step S472 includes judging whether the required amount of LUT resources / FF resources meets the available amount of LUT resources / FF resources input by the user.

[0125] In yet another embodiment, the other type of resources input by the user includes bandwidth resources. Correspondingly, in step S471, the average delay can be determined according to the polynomial order N and the current value of the parallelism, as shown in formula (1). Further, according to the polynomial order N, the data bit width and the average delay determined as above, the required bandwidth, i.e. the bandwidth requirement, can be determined, as shown in formula (7). Correspondingly, the judgment operation of step S472 includes judging whether the bandwidth requirement meets the available amount of bandwidth resources input by the user.

[0126] It is important to understand that when the user inputs other types of resources, including multiple resources, the judgment operation in step S472 includes determining whether the demand for each resource meets (i.e., is not greater than) the corresponding available quantity. If the demand for any resource does not meet the available quantity, the judgment result of step S472 is negative, and the process proceeds to step S473, where the parallelism value is reduced. This is because the number of polynomial points N and the parallelism p... d Generally, the parallelism is taken as a power of 2. Therefore, in a typical embodiment, the parallelism value is divided by 2 to reduce and update it. Step S474 is only taken when the resource requirements of all types meet the corresponding availability, and the current value of the parallelism is determined as the target value.

[0127] The above describes one implementation process for steps S45-S47. In another implementation, in step S45, the initial value of the parallelism can be determined in another way without performing resource calculations. For example, in one example, the parallelism can be initialized to a predetermined, sufficiently large value. In another example, considering that the parallelism is necessarily less than the polynomial order N, the parallelism can be initialized to N / 2 as the initial value for iteration.

[0128] When initializing parallelism in this way, during the iteration in step S47, it is necessary to calculate the required amount for each type of resource input by the user and determine whether it matches the corresponding available amount. When the resource type input by the user includes DSP resources, during the iteration in step S47, the DSP required amount can be calculated according to the aforementioned formula (5) and it can be determined whether it matches the corresponding available DSP amount. The calculation of other resource types is similar to that described above and will not be repeated here.

[0129] In this way, after several rounds of iteration, the maximum available value of parallelism that satisfies the resource availability constraint can be determined and used as the target value.

[0130] Therefore, the process proceeds to step S49, where hardware architecture code for FPGA design is generated according to the target value of parallelism and the target architecture template.

[0131] Specifically, step S49 may include generating FPGA hardware architecture code based on the target value of parallelism and the target architecture template through a code generator. This hardware architecture code is used to design the placement and routing of the FPGA.

[0132] As described above, each operator unit is configured with the hardware code of the bottom layer hardware description language RTL in advance by the HLS tool. The code generator needs to combine the hardware code of the required operator to form the hardware architecture code described above. To this end, the code generator can determine the number of each type of operator unit in the target architecture template based on the target value of the parallelism; then according to the hardware code of each type of operator unit, the connection relationship of each type of operator unit indicated by the target architecture template, and the determined number of units, the FPGA hardware architecture code is assembled and generated.

[0133] Further, the step of constructing the NTT accelerator can further include inputting the hardware architecture code generated by the code generator into the design tool, generating the layout and routing of the FPGA, and executing the layout and routing; testing the actual performance of the FPGA according to the bitstream generated by the burning; if the actual performance does not meet the predetermined requirement, the target value of the parallelism is determined again. Repeat this until the test performance meets the requirement, that is, the final NTT accelerator based on FPGA implementation is obtained.

[0134] Reviewing the above process, in the embodiments of the present specification, the multi-type parameter configurable operator units are constructed, different hardware architecture templates are constructed based on these operator units for different NTT algorithms, and the search for the optimal parameter configuration based on the hardware architecture template is performed, and finally the hardware structure code is generated, so as to realize the target of customizing the FPGA according to the user demand.

[0135] According to another aspect, embodiments also provide an apparatus for constructing an NTT accelerator based on FPGA. It can be understood that the apparatus can be deployed in any device, platform, cluster with computing and processing capability. Figure 5 A schematic block diagram of the construction apparatus according to one embodiment is shown. As shown, the construction apparatus 500 includes: Figure 5

[0136] The receiving module 51 is configured to receive user input, which includes the target algorithm type selected from a plurality of NTT algorithm types, and the available resource amount of the FPGA, wherein the plurality of NTT algorithm types includes: standard NTT, four-step NTT and ten-step NTT;

[0137] The determining module 53 is configured to determine the target architecture template corresponding to the target algorithm type from a plurality of hardware architecture templates preset for the plurality of NTT algorithm types; each hardware architecture template is obtained by combining a plurality of preset operator units, at least including a basic NTT unit configured according to the parallelism of the input data;

[0138] ​The iteration module 57 is configured to perform several rounds of iteration for the parallelism, wherein any one round of iteration comprises: calculating the required resource amount of the target architecture template under the current value of the parallelism; reducing the value of the parallelism if the required resource amount does not conform to the available resource amount; otherwise, determining the current value of the parallelism as the target value;

[0139] The construction module 59 is configured to generate the hardware architecture code for the FPGA design according to the target value of the parallelism and the target architecture template.

[0140] For the convenience of description, the above apparatus is described in various modules in the description. Of course, the functions of the modules can be implemented in one or more software and / or hardware in the implementation of the present specification.

[0141] According to another aspect, an embodiment also provides a computer system, comprising a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the following steps when executing the program:

[0142] receiving user input, comprising: a target algorithm type selected from a plurality of NTT algorithm types, and an available resource amount of the FPGA, wherein the plurality of NTT algorithm types comprises: a standard NTT, a four-step NTT and a ten-step NTT;

[0143] determining a target architecture template corresponding to the target algorithm type from a plurality of hardware architecture templates preset for the plurality of NTT algorithm types, wherein each hardware architecture template is obtained by combining a plurality of preset operator units, at least comprising a basic NTT unit configured according to the parallelism of the input data;

[0144] performing several rounds of iteration for the parallelism, wherein any one round of iteration comprises: calculating the required resource amount of the target architecture template under the current value of the parallelism; reducing the value of the parallelism if the required resource amount does not conform to the available resource amount; otherwise, determining the current value of the parallelism as the target value;

[0145] generating the hardware architecture code for the FPGA design according to the target value of the parallelism and the target architecture template.

[0146] The specification also provides a computer-readable non-transitory storage medium having stored thereon computer-executable instructions that, when executed by a processor, are configured to perform one or more steps of one or more methods described or illustrated herein, or to provide functionality described or illustrated herein. In this context, a computer-readable non-transitory storage medium or media can include one or more based on semiconductor or other integrated circuit (IC) (such as a field-programmable gate array (FPGA) or application-specific IC (ASIC)), hard disk drive (HDD), hybrid hard drive (HHD), optical disc, optical disc drive (ODD), magneto-optical disc, magneto-optical drive, floppy disk, floppy disk drive (FDD), magnetic tape, solid-state drive (SSD), RAM- drive, secure digital card or drive, any other suitable computer-readable non-transitory storage media, or any suitable combination of these, as appropriate for a given implementation. A computer-readable non-transitory storage medium can be volatile, non-volatile, or a combination of volatile and non-volatile, as appropriate.

[0147] It should also be noted that the terms "comprising," "including," and any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus. An element proceeded by "comprises... a" does not, without more constraints, exclude the existence of additional identical elements in the process, method, article, or apparatus that comprises the element.

[0148] Various embodiments in the specification are described with progressive manner, and the same or similar parts between various embodiments can be mutually referred to, and each embodiment focuses on the difference from other embodiments. In particular, for system embodiments, since they are basically similar to method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the description of the method embodiments.

[0149] The above only describes the embodiments of the specification and does not limit the specification. The specification can have various changes and variations for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the specification shall be included in the scope of the claims of the application.

Claims

1. A method for constructing an NTT accelerator based on FPGA, comprising: Receive user input, including the target algorithm type selected from multiple NTT algorithm types, the amount of available resources on the FPGA, wherein the multiple NTT algorithm types include: standard NTT, four-step NTT, and ten-step NTT; From a plurality of hardware architecture templates preset for the plurality of NTT algorithm types, a target architecture template corresponding to the target algorithm type is determined; each hardware architecture template is obtained by combining a plurality of preset operator units, including at least a basic NTT unit configured according to the parallelism of the input data; Perform several rounds of iterations for the parallelism, where each round of iteration includes: calculating the required resource amount of the target architecture template under the current value of the parallelism; if the required resource amount does not meet the available resource amount, reduce the value of the parallelism; otherwise, determine the current value of the parallelism as the target value. Based on the target value of parallelism, hardware architecture code for FPGA design is generated according to the target architecture template.

2. The method according to claim 1, wherein, The multi-type operator units further include one or more of the following: a data recombination unit for recombining data between basic NTT units; a Hadamard product unit for performing Hadamard product operations between matrices; and a transpose unit for performing matrix transpose operations.

3. The method according to claim 2, wherein, The plurality of hardware architecture templates include a first architecture template for standard NTT, a second architecture template for four-step NTT, and a third architecture template for ten-step NTT; each architecture template includes the basic NTT unit. The first architecture template also includes the data reassembly unit; The second architecture template also includes the data reassembly unit, the Hadamard product unit, and the transpose unit; The third architecture template also includes the transpose unit and the Hadamard product unit.

4. The method according to claim 2, wherein, The available resources of the FPGA include a first available amount of the first type of resources and a second available amount of the second type of resources; The first type of resource is DSP resources; the method further includes: Based on the first relationship between DSP resource consumption and parallelism under the target architecture template, the maximum possible value of parallelism under the first available quantity constraint is determined and used as the initial value for the several rounds of iterations. The amount of resources required in any iteration is the second demand for the second type of resources.

5. The method according to claim 4, wherein, The first relation shows that the DSP resource consumption is the sum of the DSP consumption of each basic NTT unit and the DSP consumption of each Hadamard product unit. The DSP consumption of a single basic NTT unit is proportional to the parallelism value and the number of stages within that basic NTT unit. The number of stages is related to the number of input paths of the corresponding NTT unit. The DSP consumption of a single Hadamard product unit is proportional to the parallelism value.

6. The method according to claim 5, wherein, If the target architecture template is used for standard NTT, it does not contain Hadamard product units, and the number of input paths is equal to the degree of parallelism; If the target architecture template is used for a four-step NTT, which includes a Hadamard product unit, and the number of input paths is equal to the degree of parallelism; If the target architecture template is used for ten-step NTT, it contains a Hadamard product unit, and the number of input paths is the smaller of the parallelism value and the decomposition factor of the polynomial order.

7. The method according to claim 4, wherein, The second type of resource includes storage resources; Given the current value of computational parallelism, the required resource amount for the target architecture template includes: The storage requirements of each transpose unit and the sum of the storage requirements of each data reassembly unit in the target architecture template are calculated and used as the storage resource requirement, which is then included in the second requirement. The storage requirement of the data reassembly unit is positively correlated with the parallelism value.

8. The method according to claim 4, wherein, The second type of resources includes lookup table (LUT) resources and / or open-ended (FF) resources; Given the current value of computational parallelism, the resource requirements of the target architecture template include: For any type of operator unit contained in the target architecture template, obtain the resource evaluation model pre-built for that type of operator unit, input the current data bit width and the current scale parameter of that type of operator unit into the resource evaluation model, and obtain the LUT resource amount and / or FF resource amount required for a single operator unit of that type. Based on the number of any type of operator unit in the target architecture template, and the amount of LUT resources and / or FF resources required for a single operator unit of that type, determine the amount of LUT resources and / or FF resources required for that type of operator unit, wherein the number of at least one type of operator in the target architecture template is determined according to the current value of the parallelism. The sum of the LUT resources and / or FF resources required by each type of operator unit in the target architecture template is determined and included in the second requirement.

9. The method according to claim 8, wherein, The resource evaluation model is a linear model, and the model parameters are determined by collecting actual LUT and FF resource usage data of the corresponding operator units under different scales and data bit widths.

10. The method according to claim 4, wherein, The second type of resource includes bandwidth resources; Given the current value of computational parallelism, the required resource amount for the target architecture template includes: The average latency is determined based on the polynomial order N and the current value of the parallelism. Based on the polynomial order N, the data bit width, and the average latency, the bandwidth requirement is determined and included in the second requirement.

11. The method according to claim 1, wherein, Based on the target parallelism value, hardware architecture code for FPGA design is generated according to the target architecture template, including: The code generator generates FPGA hardware architecture code based on the target values ​​and target architecture template. After synthesis, the hardware architecture code is used in the placement and routing design process.

12. The method according to claim 11, wherein, Based on the target values ​​and target architecture template, FPGA hardware architecture code is generated, including: The number of various operator units in the target architecture template is determined based on the target value; Based on the hardware code of various operator units, the connection relationships of various operator units indicated by the target architecture template, and the number thereof, the FPGA hardware architecture code is assembled and generated.

13. The method according to claim 11, further comprising: The hardware architecture code is input into the design tool to generate the FPGA placement and routing, and the placement and routing is executed. Test the actual performance of the FPGA based on the bitstream generated during programming. If the actual performance does not meet the predetermined requirements, the target value of the parallelism is redefined.

14. A computer system comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it performs the following steps: Receive user input, including the target algorithm type selected from multiple NTT algorithm types, the amount of available resources on the FPGA, wherein the multiple NTT algorithm types include: standard NTT, four-step NTT, and ten-step NTT; From a plurality of hardware architecture templates preset for the plurality of NTT algorithm types, a target architecture template corresponding to the target algorithm type is determined; each hardware architecture template is obtained by combining a plurality of preset operator units, including at least a basic NTT unit configured according to the parallelism of the input data; Perform several rounds of iterations for the parallelism, where each round of iteration includes: calculating the required resource amount of the target architecture template under the current value of the parallelism; if the required resource amount does not meet the available resource amount, reduce the value of the parallelism; otherwise, determine the current value of the parallelism as the target value. Based on the target value of parallelism, hardware architecture code for FPGA design is generated according to the target architecture template.

15. An apparatus for constructing an NTT accelerator based on an FPGA, comprising: The receiving module is configured to receive user input, including a target algorithm type selected from multiple NTT algorithm types and the amount of available resources on the FPGA, wherein the multiple NTT algorithm types include: standard NTT, four-step NTT, and ten-step NTT; The determination module is configured to determine the target architecture template corresponding to the target algorithm type from multiple hardware architecture templates preset for the multiple NTT algorithm types; each hardware architecture template is obtained by combining multiple preset operator units, including at least a basic NTT unit configured according to the parallelism of the input data; The iteration module is configured to perform several rounds of iteration for the parallelism, wherein any round of iteration includes: calculating the required amount of resources for the target architecture template under the current value of the parallelism; if the required amount of resources does not meet the available amount of resources, reducing the value of the parallelism; otherwise, determining the current value of the parallelism as the target value. The module is configured to generate hardware architecture code for FPGA design according to the target architecture template based on the target value of parallelism.

16. A computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-13.