A method and system for implementing high-order mask comparison based on GPU acceleration

Abstract

The application provides a high-order mask comparison implementation method and system based on GPU acceleration, and relates to the technical field of post-quantum cryptography. Random numbers are independently generated for each thread at the GPU end; input data is converted from an arithmetic mask form to a Boolean mask form by using the random numbers; a direct path or a bit slice path is selected according to the data scale for zero value detection; if the direct path is adopted, the original data layout is kept, a plurality of mask shares of the same data unit are processed by reusing the same random number, and whether the unit is zero is determined by the cumulative result; if the bit slice path is adopted, the data is reorganized into bit slices, a plurality of data units are aggregated in each slice, the units in the slice are differentially processed according to their positions and are accumulated, and multi-unit parallel detection is realized, so that the performance and security of high-order mask comparison in the GPU environment are improved.

Description

Technical Field

[0001] This invention relates to the field of post-quantum cryptography, and in particular to a GPU-accelerated method and system for implementing high-order mask comparison. Background Technology

[0002] Higher-order mask comparison is a core technology in post-quantum cryptography and side-channel protection. By splitting sensitive data into multiple mask shares and performing equivalence tests to reconstruct the data without secret values, it can effectively resist side-channel attacks. It is a crucial link in secure data interaction in scenarios such as industrial IoT gateways and cloud computing, and GPUs, with their high parallelism, have become the preferred hardware platform for large-scale engineering deployment of this technology. With the application of post-quantum algorithms such as lattice cryptography, the demand for higher-order mask comparison technology for GPU environments is becoming increasingly urgent. It needs to simultaneously meet the security requirements of resisting side-channel attacks and the performance requirements of batch processing large amounts of data, making it a current research focus in the field of cryptographic engineering.

[0003] In existing technologies, masking is mostly implemented based on CPUs or embedded chips, making it difficult to adapt to the SIMD parallel architecture of GPUs. Direct porting fails to leverage their parallel advantages and is prone to side-channel leakage due to data-dependent carry propagation and branch operations. Furthermore, the lack of cryptographically secure random number support makes it difficult to meet high-level protection requirements. Simultaneously, existing solutions do not design dedicated domain transformation and comparison paths for GPUs. The conversion from arithmetic masks to Boolean masks suffers from high latency and high overhead, resulting in high redundancy for small-to-medium scale data processing and insufficient throughput for large-scale batch processing, failing to meet the processing needs of different workloads. Summary of the Invention

[0004] To address the aforementioned issues, this invention proposes a GPU-accelerated high-order mask comparison implementation method and system. Through innovative bit-slice data packing technology and parallel design, it achieves high-performance, side-channel resistant secure comparison functionality.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] In a first aspect, the present invention provides a GPU-accelerated high-order mask comparison implementation method, comprising:

[0007] Random numbers are generated independently for each thread on the GPU.

[0008] Using the random number, the input data is converted from an arithmetic mask to a Boolean mask; the conversion is performed by a lookup table, which encodes both the conversion result and the carry status. Each thread sequentially looks up the table to complete the conversion of its assigned portion.

[0009] Zero detection is performed by selecting either a direct path or a bit slice path based on the data size: The direct path maintains the original data layout, processes multiple mask shares of the same data unit using the same random number, and determines whether the unit is zero by accumulating the results; The bit slice path reorganizes the data into bit slices, each slice aggregating the same bits of multiple data units, and performs differentiated processing on each unit within the slice according to its position and accumulates them to achieve parallel detection of multiple units.

[0010] Secondly, the present invention provides a GPU-accelerated high-order mask comparison implementation system, comprising:

[0011] The random number generation module is used to generate random numbers independently for each thread on the GPU.

[0012] The Boolean conversion module is used to convert the input data from an arithmetic mask to a Boolean mask using the random number. The conversion is performed through a lookup table, which encodes both the conversion result and the carry status. Each thread sequentially looks up the table to complete the conversion of its assigned portion.

[0013] The path selection module is used to select either a direct path or a bit slice path for zero value detection based on the data size: the direct path maintains the original data layout, processes multiple mask shares of the same data unit using the same random number, and determines whether the unit is zero by accumulating the results; the bit slice path reorganizes the data into bit slices, each slice aggregates the same bits of multiple data units, performs differentiated processing on each unit within the slice according to its position and accumulates them, realizing parallel detection of multiple units.

[0014] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the GPU-accelerated high-order mask comparison implementation method described in the first aspect.

[0015] Fourthly, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the GPU-accelerated high-order mask comparison implementation method described in the first aspect.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows:

[0017] (1) This invention achieves end-to-end optimized design by integrating three levels: random number generation, A2B conversion, and dual-path comparison. The random number generation level provides each thread with independent cryptographically secure random numbers, ensuring the unpredictability of masking operations from the source. The A2B conversion level uses table-driven technology to eliminate arithmetic carry propagation, ensuring consistent execution of thread warps. In the dual-path level, the bit-slice path achieves fine-grained parallelism through data reorganization, suitable for high-throughput scenarios, while the direct path maintains low latency, suitable for real-time applications. When the target application has large-scale batch processing characteristics, the GPU parallel solution provided by this invention can achieve a peak performance of 7,074 Mops / s (millions of operations per second) for A2B conversion, an end-to-end throughput of 9.6 GB / s, and a masking comparison performance that is 5-6 orders of magnitude higher than the embedded Cortex-M4 baseline (after clock frequency normalization), enabling high-order masking comparison to complete large-scale secure computation tasks with computational complexity linearly related to the data size.

[0018] (2) This invention innovatively proposes bit-slice data reorganization technology and parallel design, transforming traditional serial mask comparison into large-scale parallel computation. The __ballot_sync instruction is used to implement warp-level 32-bit parallel aggregation, converting the bit-slice packing operation, which originally required bit-by-bit serial processing, into single-instruction parallel execution, significantly reducing the computational complexity of bit-level data reorganization. Since the performance of GPU mask comparison is closely related to parallelism and memory access efficiency, this invention fully utilizes the large-scale parallel computing capabilities of the GPU through three-dimensional thread grid configuration and bit-major storage layout optimization, thereby transforming mask comparison from a performance bottleneck into an efficient computational primitive.

[0019] Advantages of additional aspects of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0020] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute a limitation thereof.

[0021] Figure 1 A main flowchart of a GPU-accelerated high-order mask comparison implementation method provided in this embodiment of the invention;

[0022] Figure 2 A flowchart illustrating a GPU-accelerated high-order mask comparison implementation method provided in this embodiment of the invention;

[0023] Figure 3The flowchart for generating random numbers using ChaCha20 provided in this embodiment of the invention is shown below; where (a) represents high-entropy seed initialization; (b) represents Warp-friendly execution; and (c) represents 16-word block caching.

[0024] Figure 4 This is an A2B conversion flowchart provided in an embodiment of the present invention;

[0025] Figure 5 This is a schematic diagram comparing the performance of two paths provided in an embodiment of the present invention; wherein, (a) represents the direct path implementation; and (b) represents the bit slice path implementation.

[0026] Figure 6 The following is a comparison chart of the end-to-end running time of CPU and GPU provided for embodiments of the present invention; wherein, (a) is a schematic diagram of the logarithmic coordinate comparison of the end-to-end running time of GPUChaCha20 and CPU XorShift128 under different data volumes (1KB to 1GB); (b) is a schematic diagram of the speedup ratio (CPU time / GPU time) changing with the amount of data;

[0027] Figure 7 The following is a performance comparison chart of the direct path and bit slice path under different test modes and batch sizes provided in the embodiments of the present invention; wherein, (a) represents a schematic diagram of the total latency of each test case; and (b) represents a schematic diagram of the changing trend of the ratio of direct path latency to bit slice path latency (Tspd) with batch size (shares=3).

[0028] Figure 8 The diagram shows a performance comparison between the A2B algorithm provided in this embodiment of the invention and existing methods; wherein, (a) represents a schematic diagram of GPU kernel throughput using the A2B algorithm; and (b) represents a schematic diagram of the throughput difference between a single CPU core and a GPU core under the same element scale (n=1,048,576).

[0029] Figure 9 Cumulative values ​​provided for embodiments of the present invention Hamming weight distribution diagrams across 1024 batches; where (a) represents a schematic diagram of Hamming weight distribution along the direct path; and (b) represents a schematic diagram of Hamming weight distribution along the bit slice path. Detailed Implementation

[0030] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0031] With the continuous development of quantum computing technology, traditional public-key cryptosystems—especially RSA and elliptic curve cryptography (ECC)—are facing unprecedented security threats. Breakthroughs by quantum computers in large-scale parallel computing and solving difficult problems such as integer factorization and discrete logarithms are rapidly undermining the security foundation of these classical public-key algorithms. Therefore, research and application of post-quantum cryptography (PQC) have gradually become a key focus of the international cryptography community. During the NIST standardization process, lattice-based encryption algorithms such as Kyber (key exchange / encryption) and Dilithium (digital signature) have emerged as the most promising next-generation mainstream cryptographic algorithms. While these algorithms are theoretically resistant to quantum computing attacks, they still face complex engineering and security challenges in practical deployment.

[0032] First, from a performance perspective, most existing mask comparison algorithms are implemented on the CPU, and a single secure comparison often requires 10... 4 Up to 10 6 This overhead is per clock cycle. While acceptable in embedded devices or small-scale applications, in real-world applications requiring the processing of large amounts of data (such as cloud computing environments and privacy-preserving federated learning platforms), performance bottlenecks can severely limit system throughput and response speed. This urgently necessitates exploring how to achieve high-performance mask comparison on more powerful computing platforms (such as GPUs).

[0033] Secondly, regarding scalability, existing solutions are mostly targeted at resource-constrained embedded platforms, and optimization strategies are often aimed at small-scale concurrency and low-power consumption requirements. These implementations are difficult to directly migrate to modern GPU architectures. GPUs have thousands of computing cores and can support large-scale parallel computing, but without targeted optimization of aspects such as random number generation, bitwise operations, and shared memory utilization in masking techniques, it is difficult to fully leverage the parallel capabilities of GPUs. In other words, how to efficiently combine secure and user-friendly masking methods with the GPU's SIMT (Single Instruction, Multithreaded) architecture remains a problem that urgently needs to be solved.

[0034] A more challenging aspect is the security hurdle. In GPU architectures, issues such as branching and uneven memory access between threads can unintentionally leak sensitive information. For example, if a masking algorithm follows different execution paths under different conditions, attackers may be able to detect these differences through side-channel analysis, thus weakening the masking effect. Furthermore, GPU memory access patterns and caching behavior may introduce new risks of information leakage. Therefore, implementing high-order masks in a GPU environment requires breaking through the assumptions of traditional CPU solutions and proposing more stringent parallel security design principles.

[0035] Finally, system integration issues cannot be ignored. Currently, there is a lack of a complete, end-to-end, efficient, and secure solution that covers everything from random number generation and A2B conversion from arithmetic to Boolean fields to the final mask comparison operation. In engineering practice, this often means that researchers need to piece together different modules piecemeal, increasing integration difficulty and easily introducing new security vulnerabilities at the interfaces. A comprehensive optimization solution covering the entire process could significantly improve overall performance and security, reduce development and deployment costs, and accelerate the implementation of post-quantum cryptography in real-world systems.

[0036] In summary, post-quantum cryptography algorithms have demonstrated great potential in addressing quantum threats, but the challenges of side-channel protection cannot be ignored. Secure and efficient implementations for modern hardware architectures such as GPUs will be a key breakthrough for future research and industrial deployment.

[0037] To address the aforementioned issues, this invention constructs a mask comparison architecture suitable for GPU scenarios, comprising three main layers, each satisfying specific security and performance requirements:

[0038] (1) Random number layer—provides cryptographic security entropy for masking operations and random linear hashing, and isolates threads to prevent cross-contamination;

[0039] (2) Domain transformation layer – converts arithmetic shares (the original form of lattice cryptography) into Boolean shares suitable for constant-time comparisons, eliminating carry dependency leakage;

[0040] (3) Comparison layer - Core equivalent testing is achieved through two optimized backends, which balance latency and throughput to adapt to different workload scales.

[0041] This enables a secure batch comparison service for IIoT gateways at the highest level: receiving masked polynomial coefficients from multiple downstream devices, performing anti-leakage equivalence tests, and returning a binary decision—without reconstructing the secret value throughout the process. It fully leverages the massive parallelism of GPUs and implements anti-leakage measures at every computational stage through a layered design, ultimately providing a side-channel resistant batch encrypted comparison service adaptable to different loads for environments such as industrial IoT gateways.

[0042] Example 1

[0043] like Figure 1 As shown, this embodiment discloses a GPU-accelerated high-order mask comparison implementation method, including the following steps:

[0044] S1: Generate random numbers independently for each thread on the GPU;

[0045] S2: Using the random number, the input data is converted from an arithmetic mask to a Boolean mask; wherein, the conversion is completed through a lookup table, which simultaneously encodes the conversion result and carry status, and each thread sequentially looks up the table to complete the conversion of its assigned share;

[0046] S3: Select either the direct path or the bit slice path for zero value detection based on the data size: The direct path maintains the original data layout, processes multiple mask shares of the same data unit using the same random number, and determines whether the unit is zero by accumulating the results; The bit slice path reorganizes the data into bit slices, each slice aggregates the same bits of multiple data units, performs differentiated processing on each unit within the slice according to its position and accumulates them, thereby realizing parallel detection of multiple units.

[0047] Next, combined Figure 2 This embodiment provides a detailed description of a GPU-accelerated high-order mask comparison implementation method.

[0048] In cryptographic workloads targeting industrial IoT gateways, numerous equality verifications are required for encrypted data: determining whether the original ciphertext u matches its re-encrypted result u', and verifying whether v matches v'. Direct plaintext comparison exposes the plaintext information; conventional comparison logic is vulnerable to side-channel attacks, where attackers could deduce the value of the secret data by observing program execution time, GPU power consumption fluctuations, or memory access patterns. Therefore, this embodiment designs a highly secure comparison scheme based on masking technology and implements high-performance parallelization on a GPU.

[0049] I. GPU Parallel Random Number Generation

[0050] The entire processing flow is organized in the form of a data stream: the GPU platform receives a batch of data with dimensions of... (Batch) × (coefficient) × (Mask Shares) of batch input data. First, the host prepares N batches of mask polynomial coefficients and initializes the pseudo-random number generator state of each thread using the randombytes function, providing a source of randomness for subsequent masking operations. All data resides in the device's GPU memory, and data exchange between modules is also completed through device memory, avoiding the overhead of frequent PCIe data transfers. The entire process does not require CPU intervention.

[0051] Among them, such as Figure 3As shown, the ChaCha20 cryptographically secure stream cipher algorithm (compliant with RFC 8439) is used. Each thread maintains an independent ChaCha20 state, including a 256-bit key, a 96-bit nonce, and a 32-bit counter. Each block produces a 512-bit output. On the host side, std::random_device is used in conjunction with thread-specific perturbations for high-entropy seed initialization to ensure the uniqueness of the stream per thread.

[0052] Each thread executes 20 rounds of the ChaCha20 block function, generating cryptographically secure random numbers in real time. Branchless quarter-round operations are used for warp-friendly execution, and computational overhead is amortized through a 16-word block cache. ARX refers to the three basic operations: Add, Rotation, and XOR, which are the core of the ChaCha20 round function. T0-T31 represent 32 intermediate state words from the branchless quarter-round execution, used for warp-friendly parallel computation. W0-W 15 It consists of 16 512-bit cache words output from 20 rounds of block functions, used as block cache to amortize computational overhead. Memory pooling technology reduces allocation overhead by more than 90%. This module provides cryptographically secure random numbers for subsequent A2B conversion and mask comparison.

[0053] Specifically, the target GPU high-order mask comparison system is initialized, and the CUDA execution environment and memory allocation are configured. First, device memory space is allocated to store input data, intermediate results, and output results, which are respectively d input d intermediate d output Allocate the corresponding GPU global memory. Determine the 3D threaded mesh configuration: dim3 grid(batch, n) shares , n bits ) and thread block configuration dim3 block(block) threads ), where block threads Typically set to 128 or 256 to optimize GPU utilization. Initialize the random number generator state array d. states Each thread is assigned an independent ChaCha20 state (containing a 256-bit key, a 96-bit nonce, and a 32-bit counter). The host uses a hardware random device (std::random_device) combined with thread-specific perturbations to generate a seed, ensuring that the (key, nonce) pair is unique for each thread.

[0054] This embodiment generates random numbers directly on the GPU using the cryptographically secure ChaCha20 algorithm. Compared to the traditional approach of generating random numbers on the CPU and then copying them to the GPU, this embodiment allows each GPU thread to run ChaCha20 independently. Random numbers are generated and used immediately upon request, without CPU intervention or PCIe bus bandwidth consumption, thus eliminating the time spent copying back and forth, resulting in lower latency and higher throughput. Simultaneously, the independent state and seed for each thread ensure the quality and security of the random numbers, preventing a problem in one thread from affecting the entire system. Furthermore, the high-performance ChaCha20, combined with branchless execution and memory pool management, improves the efficiency of random number generation, ensuring a stable and sufficient supply of random numbers for subsequent masking operations.

[0055] II. Arithmetic to Boolean (A2B) Conversion

[0056] The core idea of ​​mask comparison is to transform equality judgment into zero-value detection: subtract the input data to obtain the difference value. and If the original data are equal, the differences should all be zero; conversely, if even one coefficient is non-zero, it indicates that the data do not match.

[0057] However, the difference still exists in the form of an arithmetic mask, which splits the secret value into multiple shares, and the sum of each share (under a specific modulus) restores the original value. This form is suitable for arithmetic operations, but not for bit-level logical judgments.

[0058] Therefore, this embodiment proposes to convert the difference data from an arithmetic mask to a Boolean mask through an arithmetic-to-Boolean conversion hierarchy (A2B). The Boolean mask represents the secret value as the XOR result of multiple shares, which facilitates logical operations on the GF(2) field (i.e., the Galois field).

[0059] The A2B conversion uses a table-driven design and supports conversion based on block size. The lookup table T is pre-computed and placed in constant GPU memory to achieve O(1) access latency. When constructing the lookup table, a random seed is first generated. The sequence of round constants , The storage bit width (i.e., machine word length, 32 in this embodiment) represents the arithmetic share. Indicates the total number of blocks, and It is packaged into a single value and stored in the context.

[0060] The lookup table uses a three-dimensional index structure. ,in For block index ( ), It is a carry state (0 or 1). For k-bit input values ​​( In GPUs, memory is a linear one-dimensional array. For efficient access, this three-dimensional table needs to be "flattened" and stored in a one-dimensional array. Therefore, when implementing it using a one-dimensional array, the three-dimensional index is... Converting to an index of a one-dimensional array, the index calculation formula is as follows: The total size of the table is , express , This represents a right shift of integer A. Bit, Modulo operation.

[0061] Each entry in the lookup table stores a packed value that encodes both the Boolean transformation result of the current chunk and the carry output to the next chunk. The specific construction rules are as follows: for each combination... Calculate the two carry states The corresponding package value, This represents the XOR operation.

[0062] when hour, ;when hour, Here, arithmetic addition. Produce a k+1 bit result: the lower k bits are the sum, and the kth bit is the carry-over. Mix the lower k bits with... The result of the XOR operation is stored in the lower k bits of the packed value as a Boolean conversion, and the carry bit is ANDed with the rest of the data. The XOR operation is stored as the new carry state in the k-th bit of the packed value. In this way, the conversion result and the updated carry can be obtained simultaneously with a single table lookup, without the need for runtime condition checks.

[0063] like Figure 4 As shown, during the actual A2B conversion, each thread independently processes the complete conversion of one mask share. The input arithmetic mask value A is divided into k-bit blocks and processed sequentially from the least significant bit to the most significant bit. For the i-th block, its least k bits are extracted first. ( (For bitwise operations) is used as the lookup table input; then, based on the current carry state... (Initial carry is the seed) (Look up the table to get the packaged value) Next, the conversion result is obtained by unpacking the packaged value. and new carry state Finally, With random mask After XORing, the result is assembled into the i-th block position of the output Boolean mask B. This process is repeated until all blocks have been processed. Since the lookup table has pre-computed all possible input and carry combinations, the entire conversion process only involves sequential table lookup operations, completely eliminating the data-dependent carry propagation chain in the traditional A2B algorithm.

[0064] exist Figure 2 In the process, the A2B conversion is performed independently in the direct path (CLMUL+XOR) and the bit-slice path (Warp alignment), respectively generating the corresponding Boolean mask result B. u With B v The two will then enter the comparison module for consistency verification to ensure the correctness and security of the calculation.

[0065] The arithmetic-to-Boolean (A2B) conversion method provided in this embodiment is particularly well-suited for GPU parallel architectures. The lookup table is stored in constant memory, leveraging the GPU's broadcast mechanism and caching for acceleration, allowing all threads to access it simultaneously with extremely low latency. Each CUDA thread independently processes a share of the conversion, with internal table lookups performed in block order, eliminating the need for synchronization. Different shares of the conversion are executed in complete parallelism across a large number of threads, fully utilizing the GPU's SIMD capabilities. Simultaneously, the unified lookup formula avoids any branching instructions, ensuring consistent execution paths within the warp and further improving parallel efficiency. By packaging and storing the conversion results and carry states, and employing branchless index calculations, constant-time, high-throughput A2B conversion is achieved, laying an efficient and secure foundation for subsequent Boolean mask zero-value detection.

[0066] III. Comparison of Dual-Path Masks

[0067] This represents the number of polynomials processed in parallel. This indicates the number of coefficients in each polynomial. Indicates the number of shares of the higher-order mask. The number of coefficients grouped into sets of 32 in the bit slice is calculated as follows. .

[0068] The system provides two implementation paths to adapt to different scales and performance requirements. For scenarios with a small number of coefficients, a direct comparison path is adopted, maintaining the original... Data layout leverages the linear projection property of all shares of each coefficient under the same random number seed to quickly determine if a coefficient is zero. For large-scale batch data, bit-slicing paths are enabled, and the data is reorganized through the pack_fullplanes_ballot_kernel kernel. Layout, each By packaging the same bit of 32 coefficients, the single instruction multiple data (SIMD) parallel capability of the GPU is fully utilized to achieve high throughput detection.

[0069] like Figure 5 As shown in Figure (a), as the batch size increases from small batches to very large batches, the total time for A2B conversion and direct comparison increases linearly, with the time increase being more significant in the direct comparison stage, reflecting the low latency characteristics of the direct path at different scales. Figure (b) shows that, at the same batch size, the A2B conversion time is basically the same as in Figure (a), but the time spent in the bit slicing stage is much higher than that of the direct comparison in Figure (a), resulting in a significant increase in total time. This reflects the throughput advantage and latency cost of the bit slicing path under fine-grained parallelism. It is evident that the direct path meets the low latency requirement with a lower total time, while the bit slicing path adapts to large-scale batch processing scenarios through higher parallelism; the two form a complementary performance design.

[0070] (1) Direct path (low latency): using the original The layout is processed directly without data reorganization. A large-scale batch parallel strategy is adopted, with each thread independently processing the zero-value detection of a polynomial. The linear property of the Galois field GF(2) is utilized: to determine if a polynomial is zero, it is necessary to check if each coefficient is zero, and each coefficient consists of multiple mask shares, with the true value being the XOR sum of all shares. The same random number is used to project the same coefficient onto all shares within the Galois field. Due to the linear property, the XOR result of the projection of all shares equals the product of the true value of the coefficient and the random number. Different random numbers are used for different coefficients to ensure that the coefficients are independent and do not interfere with each other. Finally, an accumulator is used to determine whether all coefficients of u and v are simultaneously zero.

[0071] Specifically, each GPU thread processes one task independently. Samples, to achieve large-scale Parallel processing. Initialize the random number generator and two 64-bit accumulators. , .

[0072] For each coefficient i of u, a random number is generated using ChaCha20. Warp-level shuffle diffusion is achieved through __shfl_xor_sync, ensuring uniform randomness sharing within the warp. Specifically, the same random number is used for all n_shares of this coefficient. Perform carry-free multiplication in the Galois field. When traversing share j, read... (The j-th share of the i-th coefficient), calculate All shares XOR accumulated to 64-bit accumulator middle.

[0073] Due to the linearity property of the Galois field: if the true value of the i-th coefficient is 0 (i.e., the XOR of all shares is 0), then the coefficient is linearly related to the inequality of the inequality. The contribution of is 0. Since each coefficient uses a different random number r, the coefficients are independent and do not interfere with each other. Only when the true values ​​of all coefficients are 0 is the final result... Only 0.

[0074] Perform the same process on v to obtain Finally passed Judgment: If the result is non-zero, it means that u or v has a non-zero coefficient (they are not equal), so output 1; otherwise, u and v are both zero (equal), so output 0. The false alarm probability is 2. -64 .

[0075] (2) Bit slice path (high throughput): For large-scale parallel scenarios, the data is reorganized into Layout (of which) The coefficients are grouped into groups of 32, and then extracted bit by bit. This involves multiple mask shares corresponding to the same bit in each of the 32 coefficients. It utilizes the carry-free property of the Galois field: when coefficients are added, each bit is independent; a coefficient being zero is equivalent to all its bits being zero. After bit slicing, each... All shares are projected using the same random number. The key processing is to prevent interference between different coefficient bits by performing a shift operation based on the position j of the coefficient in the original 32 groups: the projection result is shifted left by j bits and then accumulated, so that the contributions from different coefficient positions are distributed in different positions. The information of all bits is captured by a 128-bit accumulator (which stores the lower 64 bits and the higher 64 bits separately), and finally it is determined whether all bits are zero.

[0076] For example, when the number of coefficients is large (>100), the reorganized version is used. Layout, each Package the same position of 32 coefficients.

[0077] Each thread prepares four 64-bit accumulators for each share: , Store the lower 64 bits of u and the overflow high bits. , The lower 64 bits of v and the overflow high bits are stored accordingly. Two 64-bit variables are used to simulate a 128-bit accumulator because subsequent left shift operations would cause an overflow.

[0078] Process all of u At that time, for each Generate a 64-bit random number R using ChaCha20 (combined from two 32-bit ChaCha20 outputs). Split R into high and low 32 bits, perform warp shuffle on each, and then recombine them. Read the current... The 32-bit mask mask32 contains the values ​​of the 32 coefficients at the current bit (e.g., the 5th bit slice stores the 5th bit of all coefficients).

[0079] For each bit j (0 to 31) of mask32, extract the bit value and select R based on the bit value condition (if bit=1, then tmp=R, otherwise tmp=0), then shift tmp left by j bits and accumulate to... (The 64-bit accumulator corresponding to the s-th share, used to store the lower 64 bits of data of variable u). Since shifting left by j bits will cause the high-order bits to overflow the 64-bit boundary, the overflow portion tmp needs to be... (64-j) accumulated to (The 64-bit accumulator corresponding to the s-th share, used to store the overflow high-order data of variable u). For example, when j=1, the most significant bit of tmp, after being shifted left, will enter the 65th bit, which needs to be captured into the high-order accumulator. By separating the low-order bits and the overflow high-order bits, the complete 128-bit accumulation process is simulated.

[0080] Perform the same processing on all bit slices of v, and store the result. and Array. Finally, perform an XOR reconstruction across all shares: XOR each of the four reconstructed shares sequentially with its least significant bit, and vice versa for the most significant bit. Then OR (bitwise OR) the four reconstructed results together. , This represents the lower 64 bits of the comparison result after the variable u is reconstructed by XORing across all shares. This represents the overflow high-order comparison result of variable u after XOR reconstruction across all shares. This represents the lower 64 bits of the comparison result after XOR reconstruction of variable v across all shares. This represents the overflow high-order comparison result of variable v after XOR reconstruction across all shares.

[0081] Zero value determination uses bitwise operations: calculation Shift right by 63 bits to extract the most significant bit. This is the bitwise OR operator. If it is 0, then the highest bit is 0. If the value is non-zero, the highest bit must be 1, thus avoiding branching decisions. The output result is written to the decision result array. .

[0082] To enhance leakage resistance, a random diffusion mechanism within the warp is introduced into the bit slice path: and circular share remapping This further obfuscates the relationships between shares, ensuring all operations are constant-time and there are no premature exits. Here, r represents the current random value of the thread's mask. This is an XOR shuffle operation within a warp. and s is a fixed thread offset; s is the current share index; For cyclic remapping offset; This indicates the total number of shares.

[0083] In this embodiment, to ensure the leakage resistance of the scheme on actual hardware, all comparison operations adopt linear hashing based on the CLMUL instruction—utilizing carry-less multiplication (clmul) combined with XOR accumulation, its core property... First, it ensures that the accumulated result only reflects the overall XOR value and does not leak information about individual shares. Second, all kernels adopt a strict branchless design to avoid warp splitting due to control flow divergence and eliminate the possibility of timing channel leakage. Third, a randomness diffusion mechanism is used within the warp: the __shfl_xor_sync instruction is used to efficiently exchange random numbers among threads within the warp, combined with circular share remapping. This continuously obscures the relationships between shares. Finally, all memory accesses adopt a constant-time model, ensuring that the address access patterns for table lookups and share loading remain fixed regardless of the data being processed, thus preventing access pattern leaks caused by secret indexes.

[0084] Furthermore, after the above calculations are completed, the results are transferred from the device memory to the host memory. For batch sizes of... Input, output decision bit array Each element is of type uint32_t This represents the comparison result of the i-th sample, where 0 indicates a successful comparison (ciphertext matches) and 1 indicates a failed comparison (ciphertext differs). The memory copy function cudaMemcpy is used. , The data transfer is completed using `batch × sizeof(uint32_t)` and `cudaMemcpyDeviceToHost`. This is the target address for this copy operation. `uint32_t` is the source address for this copy operation, `sizeof(uint32_t)` is the number of bytes occupied by a single decision result (of type `uint32_t`), and `cudaMemcpyDeviceToHost` is an enumeration constant. To improve efficiency, CUDA streams can be used to achieve overlapping execution of computation and transmission.

[0085] When the input data size exceeds the GPU memory limit, a block processing strategy is adopted: large batches are broken down into multiple sub-batches, processed sequentially, and the results are aggregated. If the above steps are applied to continuous data streams, a pipelined processing system can be further built to achieve high-throughput mask comparison services.

[0086] The path selection strategy provided in this embodiment includes a direct path that requires no data packing overhead, has a simple access mode, and is suitable for low-latency processing of small to medium-sized data. The bit-slice path requires additional `pack_fullplanes_ballot_kernel` for data reassembly, but by using warp-level `__ballot_sync` instructions and SIMD parallel processing of the same bit across 32 coefficients, it achieves high latency in large-scale parallel processing (…). and When the data volume is large, the benefits of parallel acceleration outweigh the overhead of packetization, resulting in higher overall throughput. The system dynamically selects the optimal path to perform the comparison operation based on the actual data size.

[0087] As one implementation, the entire processing flow is executed in parallel on the GPU as a data stream. Steps such as difference calculation, A2B transformation, data packing, and zero-value detection are all designed as independent CUDA kernels, fully utilizing the GPU's massive number of threads and warp-level instructions to accelerate computation. All data resides in device memory, and data exchange between modules is also completed through device memory, avoiding the overhead of frequent PCIe data transfers. This design maintains mask security while meeting the performance requirements of large-scale batch processing.

[0088] This specific embodiment provides three layers that work together to achieve a complete, end-to-end, efficient, and secure solution, covering everything from ChaCha20 cryptographically secure random number generation and constant-delay table-driven A2B conversion to masked comparison operations based on GF(2)CLMUL XOR accumulation and bitwise OR decisions. This design adheres to the constant-time principle, uses a warp-consistent access mode, and exploits bit-level parallelism without exposing carry or intermediate associations.

[0089] To verify the effectiveness of the method provided in this embodiment, in terms of generating random numbers, such as... Figure 6As shown in Figure (a), the performance of the common CPU-based pseudo-random number generator XorShift128 and the GPU-based ChaCha20 in this embodiment are compared. It can be seen that the CPU is less secure but faster, while the GPU is very secure and is currently the most secure solution. Figure (b) shows that the CPU has the advantage in end-to-end time for small amounts of data, while the GPU speed is improved for large amounts of data, even exceeding that of the CPU, reaching a maximum of 3.4 times at 1GB, thus combining security and efficiency.

[0090] like Figure 7 As shown in Figure (a), five test modes are illustrated (all_zero, Du_single_bit, Dv_single_bit, sparse_mixed, and equal_pair). It should be understood that these English terms are commonly used technical expressions familiar to those skilled in the art, with clear and unambiguous meanings. Using English allows for more precise reference to specific test scenarios and data types, avoiding semantic discrepancies that may arise from Chinese translation. Therefore, the English terms are retained in the figure.

[0091] It can be seen that: All-zero mode, where all input bits are 0, is used to test the minimum active path under conditions of no effective flips; Unit mode, where only a single bit is 1 and the rest are 0, is used to verify single-point flip propagation behavior; Striped mode, where bits are alternately set at fixed intervals (e.g., 0101… or 0011…), simulates a periodic data structure; Sparse mode, with a small number of randomly distributed 1s and low bit density, is used to test low-activity scenarios; Equal-pair mode: pairs of equal input combinations are used to verify symmetry and boundary consistency. The total latency for each test case is 100% consistent between the GPU path and the CPU reference. Under the five test modes, the total latency of the direct path consistently remains at a low level (approximately 40–50 ms), while the total latency of the bit-slice path is significantly higher (approximately 85–95 ms), indicating that the execution efficiency of the direct path is significantly better than that of the bit-slice path in a single test case. Figure (b) shows the variation of the ratio (Tspd) of the direct path latency (TotN) to the bit-slice path latency (TotBN) with batch size. As the batch size increases, Tspd continues to rise, indicating that the relative efficiency of the bit slice path is constantly improving, and it gradually gains a performance advantage in large-batch scenarios.

[0092] like Figure 8As shown in Figure (a), the throughput of the A2B algorithm in GPU kernel-only mode varies with the number of elements n from 1K to 1M, demonstrating the performance scalability of the algorithm in large-scale parallel scenarios. Figure (b) compares the throughput differences of existing methods (Simple_XOR, Coron, Debraize, Boolean_Circuit, KU_Leuven, Goubin) on a single CPU core and a single GPU core at the same element size n=1,048,576. It can be seen that the throughput of all existing methods on the GPU core is significantly higher than their performance on a single CPU core.

[0093] like Figure 9 As shown, the cumulative values ​​of 1024 batches are displayed. Hamming weight distribution. Both paths avoid Hamming weight aggregation, with the bit-slice path exhibiting higher diffusion, validating effective Hamming weight leakage suppression. It should be understood that... Figure 9 The horizontal axis represents different test samples or data points. It is a dimensionless ordinal identifier without physical units.

[0094] On the RTX 4060 Laptop GPU, the peak A2B core throughput reached 7,074 Mops / s (core only), and the end-to-end throughput reached 9.6 GB / s; mask comparison achieved 2.92 Mops / s in a representative configuration (batch=65,536, coeffs=1024, shares=3). This represents a 10-16x speedup compared to the CPU A2B baseline and a 5-6 order of magnitude improvement compared to Cortex-M4 mask comparison (after clock frequency normalization). Evaluations show that constant-latency A2B bridging is key to unlocking secure Boolean parallelism on SIMT hardware; bit-slicing schemes are competitive when packing costs are amortized and per-byte computation density is high, although their kernel time is approximately twice that of the direct path; end-to-end performance depends on coordinated optimization of random number feeding, layout transformation, and transport-computation overlap.

[0095] This embodiment transforms mask comparison from a performance bottleneck into a scalable building block, providing an efficient, side-channel resistant post-quantum cryptographic solution for device authentication, integrity verification, and secure communication in an industrial IoT environment.

[0096] Example 2

[0097] This embodiment provides a GPU-accelerated high-order mask comparison implementation system, including:

[0098] The random number generation module is used to generate random numbers independently for each thread on the GPU.

[0099] The Boolean conversion module is used to convert the input data from an arithmetic mask to a Boolean mask using the random number. The conversion is performed through a lookup table, which encodes both the conversion result and the carry status. Each thread sequentially looks up the table to complete the conversion of its assigned portion.

[0100] The path selection module is used to select either a direct path or a bit slice path for zero value detection based on the data size: the direct path maintains the original data layout, processes multiple mask shares of the same data unit using the same random number, and determines whether the unit is zero by accumulating the results; the bit slice path reorganizes the data into bit slices, each slice aggregates the same bits of multiple data units, performs differentiated processing on each unit within the slice according to its position and accumulates them, realizing parallel detection of multiple units.

[0101] Example 3

[0102] This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps in the GPU-accelerated high-order mask comparison implementation method described in Embodiment 1 above.

[0103] Example 4

[0104] This embodiment provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps in the GPU-accelerated high-order mask comparison implementation method described in Embodiment 1 above.

[0105] The steps or modules involved in Embodiments 2 to 4 above correspond to those in Embodiment 1. For specific implementation details, please refer to the relevant description section of Embodiment 1. The term "computer-readable storage medium" should be understood as a single medium or multiple media including one or more instruction sets; it should also be understood as including any medium capable of storing, encoding, or carrying an instruction set for execution by a processor and enabling the processor to perform any of the methods in this invention.

[0106] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A GPU-accelerated high-order mask comparison implementation method, characterized in that, include: Random numbers are generated independently for each thread on the GPU. Using the random number, the input data is converted from an arithmetic mask to a Boolean mask; the conversion is performed by a lookup table, which encodes both the conversion result and the carry status. Each thread sequentially looks up the table to complete the conversion of its assigned portion. Zero detection is performed by selecting either a direct path or a bit slice path based on the data size: The direct path maintains the original data layout, processes multiple mask shares of the same data unit using the same random number, and determines whether the unit is zero by accumulating the results; The bit slice path reorganizes the data into bit slices, each slice aggregating the same bits of multiple data units, and performs differentiated processing on each unit within the slice according to its position and accumulates them to achieve parallel detection of multiple units.

2. The GPU-accelerated high-order mask comparison implementation method as described in claim 1, characterized in that, The random number generation process is as follows: On the GPU side, an independent pseudo-random number generator state is maintained for each thread. The host side uses hardware random numbers to generate high-entropy seeds for each thread and initializes the key and random number for each thread. Each thread executes the generation function independently on the device side, and the generated random numbers reside directly in the device memory for conversion and detection. All random number generation operations employ a branchless design and manage state data through a memory pool.

3. The GPU-accelerated high-order mask comparison implementation method as described in claim 1, characterized in that, The conversion is performed using a lookup table, which simultaneously encodes the conversion result and carry status. Each thread sequentially looks up its assigned portion of the table to complete the conversion, specifically including: The input arithmetic mask value is divided into multiple sequential blocks with a fixed bit width; For each block, the corresponding entry is read from a lookup table pre-stored in GPU constant memory. The corresponding entry contains the Boolean transformation result of the current block and the carry status of the next block. The thread looks up the table sequentially according to the current carry state, and combines the results of each block into a complete Boolean mask for output; In this process, different threads process their respective mask shares in parallel, the table lookup process is branchless and the access mode is fixed, and the entire conversion is completed in constant time.

4. The GPU-accelerated high-order mask comparison implementation method as described in claim 1, characterized in that, The direct path maintains the original data layout, and multiple mask shares of the same data unit are processed using the same random number. The cumulative result is used to determine whether the unit is zero, specifically including: Each thread independently processes one data unit, reading all mask shares within the unit sequentially. Perform a carry-free multiplication operation with each share using the same random number, and then XOR the results of each operation bitwise and accumulate them. After traversing all shares of the unit, the cumulative value reflects the projection of the true value of the unit; Perform the same operation on all data units to be compared. If the cumulative value of all units is zero, the comparison is considered equal; otherwise, they are not equal.

5. The GPU-accelerated high-order mask comparison implementation method as described in claim 1, characterized in that, The bit-slice path reorganizes the data into bit slices. Each slice aggregates the same bits from multiple data units, performs differential processing on each unit within the slice according to its position, and accumulates them to achieve parallel detection of multiple units. Specifically, this includes: The raw data is reorganized into a bit slice format by batch, bit, and group, with each bit slice containing a mask share of the same bit for multiple data units; During processing, the same random number is used to perform carry-free multiplication on each bit slice to obtain the intermediate value; Based on the position of each data unit in the bit slice within the original group, the intermediate value is shifted left by the corresponding number of bits and then accumulated into the corresponding high and low bit accumulators. After completing all bit slice processing, perform cross-share reconstruction and bitwise OR operation on each accumulator, and determine whether all data units are simultaneously zero by checking if the result is zero.

6. A GPU-accelerated high-order mask comparison implementation system, characterized in that, include: The random number generation module is used to generate random numbers independently for each thread on the GPU. The Boolean conversion module is used to convert the input data from an arithmetic mask to a Boolean mask using the random number. The conversion is performed through a lookup table, which encodes both the conversion result and the carry status. Each thread sequentially looks up the table to complete the conversion of its assigned portion. The path selection module is used to select either a direct path or a bit slice path for zero value detection based on the data size: the direct path maintains the original data layout, processes multiple mask shares of the same data unit using the same random number, and determines whether the unit is zero by accumulating the results; the bit slice path reorganizes the data into bit slices, each slice aggregates the same bits of multiple data units, performs differentiated processing on each unit within the slice according to its position and accumulates them, realizing parallel detection of multiple units.

7. The GPU-accelerated high-order mask comparison implementation system as described in claim 6, characterized in that, The random number generation process is as follows: On the GPU side, an independent pseudo-random number generator state is maintained for each thread. The host side uses hardware random numbers to generate high-entropy seeds for each thread and initializes the key and random number for each thread. Each thread executes the generation function independently on the device side, and the generated random numbers reside directly in the device memory for conversion and detection. All random number generation operations employ a branchless design and manage state data through a memory pool.

8. The GPU-accelerated high-order mask comparison implementation system as described in claim 6, characterized in that, The conversion is performed using a lookup table, which simultaneously encodes the conversion result and carry status. Each thread sequentially looks up its assigned portion of the table to complete the conversion, specifically including: The input arithmetic mask value is divided into multiple sequential blocks with a fixed bit width; For each block, the corresponding entry is read from a lookup table pre-stored in GPU constant memory. The corresponding entry contains the Boolean transformation result of the current block and the carry status of the next block. The thread looks up the table sequentially according to the current carry state, and combines the results of each block into a complete Boolean mask for output; In this process, different threads process their respective mask shares in parallel, the table lookup process is branchless and the access mode is fixed, and the entire conversion is completed in constant time.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps in the GPU-accelerated high-order mask comparison implementation method as described in any one of claims 1-5.

10. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps in the GPU-accelerated high-order mask comparison implementation method as described in any one of claims 1-5.

Images