Reconfigurable multi-channel polynomial multiplier architecture and implementation method thereof

Abstract

The invention relates to a reconfigurable multi-channel polynomial multiplier architecture and an implementation method thereof, and belongs to the technical field of post-quantum cryptography hardware acceleration. The architecture comprises a scheduler, a twiddle factor memory bank, a bank address routing module, a bank array and a reconfigurable butterfly unit array. According to the architecture, a cyclic decoupling multi-channel NTT / INTT / PWM algorithm is used, flexible configuration of the degree of parallelism and the flow line depth can be supported, and the adaptability of a memory access control strategy is improved; a conflict-free memory mapping scheme based on interleaved storage is adopted, so that storage and read-write of polynomial coefficients are irrelevant to polynomial length and a calculation stage, NTT / INTT / PWM access modes are unified, and hardware resource overhead is greatly reduced; and a conflict-free detection algorithm oriented to multi-channel assembly line design is adopted, so that the utilization rate of hardware resources is remarkably improved.

Description

Technical Field

[0001] This application relates to the field of post-quantum cryptography hardware acceleration technology, and in particular to a reconfigurable multichannel polynomial multiplier architecture and its implementation method. Background Technology

[0002] With the development of quantum computing technology, quantum attack methods such as Shor's algorithm pose a substantial threat to traditional public-key cryptosystems such as RSA and ECC, leading to the standardization process of post-quantum cryptography. The CRYSTALS-Kyber algorithm, as the first post-quantum cryptographic scheme incorporated into the FIPS 203 standard, relies on the modular learning error problem for its security, with its core operation being high-order polynomial multiplication over rings. This operation has high computational complexity and large memory consumption, which is a key bottleneck restricting the widespread deployment of CRYSTALS-Kyber.

[0003] Number Theoretic Transform (NTT) is a core technology for accelerating polynomial multiplication, but existing NTT hardware implementations face three major challenges: First, the three-layer loop of the NTT algorithm is naturally coupled, and existing designs often use dedicated control logic for specific degrees of parallelism, lacking flexible configuration capabilities; Second, the memory access modes of NTT / INTT (Inverse Number Theoretic Transform) / PWM (Point-by-Point Multiplication) operations differ, and structural conflicts easily arise as the polynomial length, computation stage, and parallelism change, resulting in poor adaptability and high hardware overhead of existing memory access control strategies; Third, in multi-channel NTT pipeline designs, it is difficult to balance read-after-write (RAW) conflicts and pipeline cavitation, leading to insufficient hardware utilization; Fourth, the hardware units for NTT, INTT, and PWM operations are often designed independently, resulting in low resource reuse and limited area-time product (ATP) optimization effects. Summary of the Invention

[0004] Based on this, it is necessary to provide a reconfigurable multichannel polynomial multiplier architecture and its implementation method to address the above-mentioned technical problems. This architecture includes a reconfigurable butterfly computing unit that supports NTT / INTT / PWM operations, supports flexible configuration of parallelism and pipeline depth, achieves maximum reuse of underlying operators, and achieves a better trade-off between area and performance.

[0005] A reconfigurable multichannel polynomial multiplier architecture includes a scheduler, a rotation factor storage, a bank (storage) address routing module, a bank array, and a reconfigurable butterfly cell array; The scheduler is used to configure the parallelism and pipeline depth of a multi-channel NTT / INTT / PWM algorithm based on cyclic decoupling, to generate multiple sets of polynomial coefficient addresses in parallel, and to use a conflict-free memory mapping scheme based on interleaved storage to map multiple sets of polynomial coefficient addresses in parallel into physical memory address indices containing BI and BA, and to generate corresponding strobe signals according to each BI; where BI is the bank number and BA is the bank address. The twitch factor storage is used to store pre-calculated twitch factors and is available for use by the reconfigurable butterfly array. The bank address routing module is used to select the BA according to the gating signal to obtain the read and write address of the corresponding BI bank, so as to realize the memory access of polynomial coefficients; The bank array includes multiple banks, which are used to route read and write addresses output by the bank address routing module. It supports read operations on polynomial coefficients and write operations on the results of polynomial coefficient operations. The write operation adopts an in-situ update strategy, and the read and write operations meet the constraints of a collision-free detection algorithm designed for multi-channel pipelines. The reconfigurable butterfly array is used to read multiple sets of polynomial coefficients according to the configured parallelism and pipeline depth to perform butterfly operations based on rotation factors in parallel, and output multiple sets of polynomial coefficient operation results to complete polynomial multiplication operations.

[0006] Furthermore, the scheduler includes a configuration unit, a controller, an address generation unit, an address mapping unit, and an arbitrator; The configuration unit is used to configure the degree of parallelism. and pipeline depth ; The controller is used to generate the outermost loop of a multi-channel NTT / INTT / PWM algorithm based on loop decoupling. and middle loop It is used to control the read / write enable of the bank array; among them, the multi-channel NTT / INTT / PWM algorithm based on loop decoupling is used to integrate the polynomial coefficient address generation logic in the polynomial multiplication operation with the middle loop in the three-layer loop control logic of the algorithm. With the original innermost loop Decoupling, and transferring the generation logic of polynomial coefficient addresses and twitch factors to the decoupled replacement. Innermost loop Meanwhile, the middle loop is restructured. With the innermost loop The function of the middle loop The control was changed from controlling the block step size to controlling the number of parallel groups, and the innermost loop was changed. Convert to butterfly operation iteration within the control group; The address generation unit is used in the innermost loop. Generated in Address of each polynomial coefficient; The address mapping unit is used to map each polynomial coefficient address to a physical storage address index containing BI and BA using a conflict-free memory mapping scheme based on interleaved storage; wherein, the number of address generation units and address mapping units is [number missing]. The number of BI and BA are both The address mapping rule is expressed as: ; ; ; in, This is a row address transformation matrix used to extract the high-order addresses of polynomial coefficients. Bit; for An identity matrix of order 1; express zero-order matrix; Represents the address of the polynomial coefficients and , for transpose; For BI's Bit; For the bank mapping matrix; To calculate the number of stages and , Let the point length be the polynomial length; , ; This indicates finding the greatest common multiple (GCD). This represents the modulo operation; Indicates rounding down; , and The values ​​of are all greater than 0 and are powers of 2; Arbitrator is used to determine In the BI generation bank address routing module A strobe signal sel.

[0007] Furthermore, the rotation factor storage includes an NTT rotation factor storage, an INTT rotation factor storage, a PWM1 rotation factor storage, and a rotation factor address generation unit; The twitch factor address generation unit is used in the innermost loop. The rotation factor storage address is generated in the middle; The NTT rotation factor storage, INTT rotation factor storage, and PWM1 rotation factor storage are used to store the rotation factors of the multi-channel NTT algorithm based on loop decoupling, the rotation factors of the multi-channel INTT algorithm based on loop decoupling, and the rotation factors of the PWM1 operation mode in the multi-channel PWM algorithm based on loop decoupling, respectively. The multi-channel PWM algorithm based on loop decoupling includes two operation modes: PWM0 and PWM1, which are represented as follows: ; in, and They are polynomials The first after NTT transformation Item and the item, and They are polynomials The first after NTT transformation Item and the item, for of N Secondary unit root, Modulus; This is a bit-reversal function.

[0008] Furthermore, a multi-channel NTT algorithm based on loop decoupling is used to perform efficient parallel NTT operations through three layers of loop control logic, including: Outermost loop From 0 to Control each stage of NTT's computation; To calculate the number of stages and , Let the point length be the polynomial length; Middle loop With parallelism For step size traversal 0 to ; Innermost loop To achieve fully parallel expansion, through Each parallel channel concurrently processes butterfly operations within the group; During the address generation phase, composite indexes will be used. Decomposed into high-order bits and low position Thus, the following can be constructed. and The logical address indices of the two operands are respectively and ; Using the bit reversal function The rotation factor was calculated. ; Then, through a conflict-free mapping function The two logical address indices are converted into their corresponding physical memory address indices. and ; Operands are read in parallel from their respective banks based on two physical storage address indexes. and Then, perform butterfly operations: first calculate ,in Use it as an intermediate variable; then update and updates The final updated version and Write it back to the corresponding bank in place to complete a full NTT calculation cycle.

[0009] Furthermore, a multi-channel INTT algorithm based on loop decoupling is used to perform efficient parallel INTT operations through three layers of loop control logic, including: Outermost loop from to Reverse iteration, controlling INTT Each calculation stage; To calculate the number of stages and , Let the point length be the polynomial length; Middle loop With parallelism Step-size traversal arrive The butterfly operation at each stage is divided into multiple processing groups; Innermost loop To achieve fully parallel expansion, through The butterfly operation within the group is processed concurrently through multiple parallel channels; During the address generation phase, composite indexes will be used. Decomposed into high-order bits and low position Thus, the following can be constructed. and The logical address indices of the two operands are respectively and ; Using the bit reversal function The rotation factor was calculated. ; By calling the conflict-free mapping function The two logical address indices are converted into their corresponding physical memory address indices. and ; Operands are read in parallel from their respective banks based on two physical storage address indexes. and Then, perform the reverse butterfly operation: first update ,at this time for Temporary variables; then update ,in For modulo-2 operations; the final updated... and Write it back to the corresponding bank in place to complete a full INTT calculation cycle.

[0010] Furthermore, a multi-channel PWM algorithm based on loop decoupling is used to perform efficient dot multiplication operations through a three-layer loop control logic, including: Outermost loop from arrive Control the overall processing rounds; Let the point length be the polynomial length; Middle loop Value and These correspond to PWM0 and PWM1 operating modes, respectively. Innermost loop from arrive Achieve fully parallel expansion; During the address generation stage, through the formula and Generate polynomials respectively Coefficients after NTT transformation Sum of coefficients The logical address index, and and As polynomials Coefficients after NTT transformation Sum of coefficients Logical address index; By calling the conflict-free mapping function The four logical address indices are converted into their corresponding physical memory address indices. , , and ;wherein polynomial Physical storage address usage pattern and address offset polynomial Physical storage address usage pattern and address offset This ensures that the data for the two sets of polynomials are distributed in different banks; Four sets of coefficients are read in parallel from the corresponding banks based on four physical storage address indexes. Afterwards, according to Select the operation to perform: When First, use the bit reversal function. Calculate the rotation factor Then call the operation mode. Four outputs were obtained. Otherwise, directly invoke the operation mode. Four outputs were obtained. Finally, the four output results are written back to their respective banks in their original positions to complete the dot product operation.

[0011] Furthermore, the bank address routing module includes A multiplexer; among which... Parallelism; Each multiplexer in the bank address routing module selects the BA (Bank Access Element) to the corresponding BI (Bank Access Element) based on the selection signal sel for polynomial coefficient memory access. The selected BA becomes the read address rad for the corresponding polynomial coefficient. Furthermore, since the write operation uses an in-situ update strategy, the write address wad is the result of the read address rad being updated. L The signal is delayed by +1 cycle; The configured pipeline depth.

[0012] Furthermore, the bank array is composed of It consists of several banks with separate read and write addresses, each bank being a simple dual-port RAM structure; the point length is... The polynomial, with a storage depth of for each bank. ; The read and write operations of each bank satisfy the constraints of a collision-free detection algorithm for multi-channel pipeline designs. This algorithm is used to assess the risk of write-after-read collisions in multi-channel pipeline designs, and its input parameters include parallelism. Point length of polynomial and pipeline depth The algorithm includes: First calculate To determine the total number of computation stages and initialize the conflict counter. for ; Then, the index of each computation stage is traversed in a loop. In each iteration, two temporary variables are calculated:

[0013]

[0014] in, and These represent right shift and left shift operations, respectively. if Greater than and If there is no conflict in the current calculation phase, Keep it unchanged; otherwise, An increment of 1 indicates that a conflict has been detected; Finally, the algorithm returns The value reflects the number of stages in the pipeline where a write-after-read conflict occurs under a given configuration; The collision-free detection algorithm for multi-channel pipelines also provides constraints that simultaneously ensure no voids or write-after-read collisions occur in the reconfigurable butterfly array, expressed as:

[0015]

[0016] in, For the number of periods, To round up, , This is a modulo operation.

[0017] Furthermore, the reconfigurable butterfly cell array includes components made of... An input data routing network consisting of multiplexers A reconfigurable butterfly unit and composed of The output data routing network consists of multiplexers; Parallelism; Each multiplexer in the input data routing network is used to select the corresponding reconfigurable butterfly unit based on the polynomial coefficients read from the BI. Each reconfigurable butterfly unit is used to execute two sets of butterfly operations based on the rotation factor in parallel; Each multiplexer in the output data routing network is used to select the polynomial coefficient operation result of the corresponding reconfigurable butterfly unit output to the bank corresponding to the BI for in-situ write-back according to the gating signal sel corresponding to the BI.

[0018] An implementation method for a reconfigurable multichannel polynomial multiplier architecture, comprising: The scheduler employs a multi-channel NTT / INTT / PWM algorithm based on cyclic decoupling to configure parallelism and pipeline depth, thereby generating multiple sets of polynomial coefficient addresses in parallel. A conflict-free memory mapping scheme based on interleaved storage is used to map multiple sets of polynomial coefficient addresses in parallel to physical memory address indices containing BI and BA, and to generate corresponding strobe signals based on each BI; where BI is the bank number and BA is the bank address. The pre-calculated rotation factor is stored in the rotation factor storage and can be called by the reconfigurable butterfly cell array; In the bank address routing module, the BA is selected according to the gating signal to obtain the read and write address of the corresponding BI bank, so as to realize the memory access of polynomial coefficients; In multiple banks within the bank array, read operations on polynomial coefficients and write operations on the results of polynomial coefficient operations are supported based on the read and write addresses output by the bank address routing module. The write operation adopts an in-situ update strategy, and the read and write operations satisfy the constraints of a collision-free detection algorithm designed for multi-channel pipelines. In a reconfigurable butterfly cell array, multiple sets of polynomial coefficients are read according to the configured parallelism and pipeline depth to perform butterfly operations based on rotation factors in parallel, and multiple sets of polynomial coefficient operation results are output to complete the polynomial multiplication operation.

[0019] The aforementioned reconfigurable multichannel polynomial multiplier architecture and its implementation method employ a loop-decoupled multichannel NTT / INTT / PWM algorithm within the architecture. This algorithm supports flexible configuration of parallelism and pipeline depth, improving the adaptability of memory access control strategies. It adopts a conflict-free memory mapping scheme based on interleaved storage, making the storage and reading / writing of polynomial coefficients independent of polynomial length and computation stage, unifying the access modes of NTT / INTT / PWM, and significantly reducing hardware resource overhead. Furthermore, the conflict-free detection algorithm proposed within the architecture for multichannel pipeline design ensures that the pipeline is free from both RAW collisions and cavitation, significantly improving hardware resource utilization. Compared with existing technologies, this application achieves superior area efficiency while maintaining flexibility and adaptability, providing an efficient and scalable solution for post-quantum cryptography hardware acceleration. Attached Figure Description

[0020] Figure 1 This is a schematic diagram of a reconfigurable multichannel polynomial multiplier architecture in one embodiment; Figure 2 This is a schematic diagram of loop decoupling in one embodiment; Figure 3 This is a pseudocode diagram of a conflict-free memory mapping scheme based on interleaved storage in one embodiment; Figure 4 This is a schematic diagram of the NTT operation scheduling process under a conflict-free mapping in one embodiment (based on a 32-point radix-2 NTT). (For example) Figure 5 This is a schematic diagram of the PWM operation scheduling process under a conflict-free mapping in one embodiment; Figure 6 This is a schematic diagram showing the detailed arrangement of rotation factors in one embodiment; Figure 7 This is a pseudocode diagram of a multi-channel NTT algorithm based on loop decoupling in one embodiment; Figure 8 This is a pseudocode diagram of a multi-channel INTT algorithm based on loop decoupling in one embodiment; Figure 9 This is a pseudocode diagram of a multi-channel PWM algorithm based on loop decoupling in one embodiment; Figure 10 This is a pseudocode diagram of a collision-free detection algorithm designed for a multi-channel pipeline in one embodiment. Figure 11 This is a schematic diagram of the pipeline workflow for a reconfigurable multichannel polynomial multiplier architecture in one embodiment. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0022] In one embodiment, such as Figure 1 As shown, a reconfigurable multichannel polynomial multiplier architecture is provided, including a scheduler, a spin factor storage, a bank address routing module, a bank array, and a reconfigurable butterfly cell array.

[0023] The scheduler employs a multi-channel NTT / INTT / PWM algorithm based on cyclic decoupling to configure parallelism and pipeline depth, generating multiple sets of polynomial coefficient addresses in parallel. It also uses a conflict-free memory mapping scheme based on interleaved storage to map these polynomial coefficient addresses into physical memory address indices containing BI and BA, generating a corresponding strobe signal based on each BI. Here, BI is the bank number, and BA is the bank address. The twiddle factor storage stores pre-calculated twiddle factors for use by the reconfigurable butterfly array. The bank address routing module is used to route the signals according to the strobe signals. The BA is selected to obtain the read / write address of the corresponding BI bank, enabling memory access of polynomial coefficients. The bank array includes multiple banks, which are used to route the read / write addresses output by the bank address routing module, supporting read operations on polynomial coefficients and write operations on the results of polynomial coefficient operations. The write operation adopts an in-situ update strategy, and the read / write operations meet the constraints of the collision-free detection algorithm designed for multi-channel pipelines. The reconfigurable butterfly cell array is used to read multiple sets of polynomial coefficients according to the configured parallelism and pipeline depth to perform butterfly operations based on the twitch factor in parallel, and output multiple sets of polynomial coefficient operation results to complete the polynomial multiplication operation.

[0024] Furthermore, such as Figure 1 As shown, the scheduler includes a configuration unit, a controller, an address generation unit, an address mapping unit, and an arbitrator.

[0025] The configuration unit is used to configure the degree of parallelism. and pipeline depth .

[0026] The controller is used to generate the outermost loop of a multi-channel NTT / INTT / PWM algorithm based on loop decoupling. and middle loop It is used to control the read / write enable of the bank array; among them, the multi-channel NTT / INTT / PWM algorithm based on loop decoupling is used to integrate the polynomial coefficient address generation logic in the polynomial multiplication operation with the middle loop in the three-layer loop control logic of the algorithm. With the original innermost loop Decoupling, and transferring the generation logic of polynomial coefficient addresses and twitch factors to the decoupled replacement. Innermost loop Meanwhile, the middle loop is restructured. With the innermost loop The function of the middle loop The control was changed from controlling the block step size to controlling the number of parallel groups, and the innermost loop was changed. The process is converted to control the butterfly operation iteration within the group to achieve full expansion and avoid additional control.

[0027] Specifically, cyclic decoupling is as follows: Figure 2 As shown, the goal is to transform an imperfect loop into a perfect loop, that is, to move all the logic related to the polynomial coefficient addresses and the generation of twiddle factors to the innermost loop. Although the number of iterations for loop-s and loop-j is not constant in different computational stages, the number of butterfly operations in each computational stage is always [missing information]. Based on this, the functions of loop-s and loop-j were restructured. Loop-s was changed from controlling the block step size to controlling the number of parallel groups, and loop-j (i.e., the decoupled loop-k) was changed to controlling the butterfly operation iteration within the group, thereby achieving full expansion and avoiding additional control. Finally, the problem was transformed into finding the address generation mapping relationship between the original loop and the new loop.

[0028] The address generation unit is used in the innermost loop. Generated in The addresses (addr) of the polynomial coefficients.

[0029] The address mapping unit is used to map each polynomial coefficient address to a physical storage address index containing BI and BA using a conflict-free memory mapping scheme based on interleaved storage; wherein, the number of address generation units and address mapping units is [number missing]. The number of BI and BA are both The address mapping rule is expressed as: ; ; ; in, This is a row address transformation matrix used to extract the high-order addresses of polynomial coefficients. Bit; for An identity matrix of order 1; express zero-order matrix; Represents the address of the polynomial coefficients and , for transpose; For BI's Bit; For the bank mapping matrix; To calculate the number of stages and , Let the point length be the polynomial length; , ; This indicates finding the greatest common multiple (GCD). This represents the modulo operation; Indicates rounding down; , and The values ​​of are all greater than 0 and are powers of 2.

[0030] Specifically, the pseudocode for a conflict-free memory mapping scheme based on interleaved storage is as follows: Figure 3 As shown, this scheme is used to implement configurable address mapping based on the idea of ​​linear transformation. It can be used for conflict-free memory mapping schemes suitable for any power of 2 for both the point length and the number of channels. This conflict-free memory mapping scheme uses the original address... Parallelism and point length As input parameters, and under predetermined system parameter conditions, the algorithm first performs an XOR operation on the high-order bits of the original address to obtain intermediate variables. This is used to characterize the mapping relationship of addresses at different stages. Subsequently, through... Perform a left shift operation to generate the offset. The initial bank number (BI) is obtained by adding it to the lower-order bits of the address. When the mode selection is in a specific state, the algorithm further adjusts the BI according to the parallelism of the operation to adapt to the access requirements of different computation stages or operation modes. At the same time, the bank element (BA) is determined by the higher-order bits of the original address and the address offset, and is used to describe the precise location of the data within the storage block. Through the above mapping method, the algorithm can achieve conflict-free storage under parallel access conditions while ensuring the correctness of address access.

[0031] It should be understood that this conflict-free memory mapping scheme based on interleaved storage can be configured with parallelism. Point length The mode selection and address offset are configured to completely avoid structural conflicts in the NTT / INTT / PWM calculation process. Furthermore, due to the parallelism... Point length Since all operations are powers of 2, all modulo, multiplication, and division operations in the algorithm can be implemented using bitwise operations, significantly reducing hardware resource overhead. Figure 4 A 32-point base 2NTT was demonstrated. The polynomial coefficient mapping rules and NTT operation scheduling process. Figure 4The numbers 0-31 in the bank correspond to the address indices of the polynomial coefficients. It can be seen that the storage format of the polynomial coefficients in the bank remains unchanged across different NTT stages. Four data blocks marked with the same color represent combinations of coefficients that need to be accessed simultaneously. For example, the four coefficients 0, 16, 1, and 17 required for the zeroth round of the butterfly operation in stage 0 are distributed in banks with different BI numbers, allowing for simultaneous reading. Throughout the entire NTT calculation process, this mapping scheme ensures conflict-free access. Figure 5 This demonstrates the scheduling process of PWM operation under conflict-free mapping. Since PWM involves operations between two sets of polynomial coefficients, to avoid structural conflicts, the storage location of the second set of polynomial coefficients cannot overlap with the first set. The BI number modulo M of the second set of coefficients is cyclically shifted to the right through mode configuration. The bit allows the coefficients of two sets of polynomials that need to be accessed simultaneously to be distributed within different BI numbers, such as Figure 5 The part selected by the same color dashed line.

[0032] Arbitrator is used to determine In the BI generation bank address routing module A strobe signal sel.

[0033] Furthermore, such as Figure 1 As shown, the rotation factor memory includes NTT rotation factor memory (NTT TF), INTT rotation factor memory (INTT TF), PWM1 rotation factor memory (PWM1 TF), and a rotation factor address generation unit. The rotation factor address generation unit is used to generate the rotation factor address in the innermost loop. The rotation factor storage address is generated in the middle; the NTT rotation factor storage bank, INTT rotation factor storage bank, and PWM1 rotation factor storage bank are used to store the rotation factors of the multi-channel NTT algorithm based on loop decoupling, the rotation factors of the multi-channel INTT algorithm based on loop decoupling, and the rotation factors of the PWM1 operation mode in the multi-channel PWM algorithm based on loop decoupling, respectively; wherein, the multi-channel PWM algorithm based on loop decoupling includes two operation modes, PWM0 and PWM1, which are represented as follows: ; in, and They are polynomials The first after NTT transformation Item and the item, and They are polynomials The first after NTT transformation Item and the item, for of N Secondary unit root, Modulus; This is a bit-reversal function.

[0034] It is important to note that because the rotation factor is pre-calculated, the rotation factor storage is read-only. Specifically, Figure 6 Given The arrangement of rotation factors is as follows. The widths of NTT and INTT are... The width of PWM1 is Therefore, the width of the rotation factor storage is uniformly set to The depths of the NTT and INTT spin factor storage units are... The depth of the PWM1 twitch factor storage is Therefore, the depth of the ROM is .

[0035] Furthermore, such as Figure 7 As shown, the multi-channel NTT algorithm based on loop decoupling is used to perform efficient parallel NTT operations through three layers of loop control logic, including: Outermost loop From 0 to (The actual should be) Controls each stage of the NTT's computation; Middle loop With parallelism For step size traversal 0 to ; Innermost loop To achieve fully parallel expansion, through Each parallel channel concurrently processes butterfly operations within the group; During the address generation phase, composite indexes will be used. Decomposed into high-order bits and low position Thus, the following can be constructed. and The logical address indices of the two operands are respectively and ; Using the bit reversal function The rotation factor was calculated. ; Then, through a conflict-free mapping function The two logical address indices are converted into their corresponding physical memory address indices. and ; Operands are read in parallel from their respective banks based on two physical storage address indexes. and Then, perform butterfly operations: first calculate ,in Use it as an intermediate variable; then update and updates The final updated version and Write it back to the corresponding bank in place to complete a full NTT calculation cycle.

[0036] Furthermore, such as Figure 8 As shown, the multi-channel INTT algorithm based on loop decoupling is used to perform efficient parallel INTT operations through three layers of loop control logic, including: Outermost loop from to Reverse iteration, controlling INTT Each calculation stage; Middle loop With parallelism Step-size traversal arrive The butterfly operation at each stage is divided into multiple processing groups; The innermost loop of the decoupled loop To achieve fully parallel expansion, through The butterfly operation within the group is processed concurrently through multiple parallel channels; During the address generation phase, composite indexes will be used. Decomposed into high-order bits and low position Thus, the following can be constructed. and The logical address indices of the two operands are respectively and ; Using the bit reversal function The rotation factor was calculated. ; By calling the conflict-free mapping function The two logical address indices are converted into their corresponding physical memory address indices. and ; Operands are read in parallel from their respective banks based on two physical storage address indexes. and Then, perform the reverse butterfly operation: first update ,in for Temporary storage; then update ,in For modulo-2 operations; the final updated... and Write it back to the corresponding bank in place to complete a full INTT calculation cycle.

[0037] Furthermore, such as Figure 9 As shown, a multi-channel PWM algorithm based on loop decoupling is used to perform efficient dot multiplication operations through three layers of loop control logic, including: Outermost loop from arrive Control the overall processing rounds; Middle loop Value and These correspond to PWM0 and PWM1 operating modes, respectively. The innermost loop of the decoupled loop from arrive Achieve fully parallel expansion; During the address generation stage, through the formula and Generate polynomials respectively Coefficients after NTT transformation Sum of coefficients The logical address index, and and As polynomials Coefficients after NTT transformation Sum of coefficients Logical address index; By calling the conflict-free mapping function The four logical address indices are converted into their corresponding physical memory address indices. , , and ;wherein polynomial Physical storage address usage pattern and address offset polynomial Physical storage address usage pattern and address offset This ensures that the data for the two sets of polynomials are distributed in different banks; Four sets of coefficients are read in parallel from the corresponding banks based on four physical storage address indexes. Afterwards, according to Select the operation to perform: When First, use the bit reversal function. Calculate the rotation factor Then call the operation mode. Four outputs were obtained. Otherwise, directly invoke the operation mode. Four outputs were obtained. Finally, the four output results are written back to their respective banks in their original positions to complete the dot product operation.

[0038] Furthermore, such as Figure 1 As shown, the bank address routing module includes Each multiplexer in the bank address routing module is used to select the BA to the corresponding BI bank according to the selection signal sel for polynomial coefficient memory access. The selected BA is the read address rad of the corresponding polynomial coefficient; and since the write operation adopts an in-situ update strategy, the write address wad is the read address rad after passing through the read address rad. L The signal is delayed by +1 cycle; The configured pipeline depth. Specifically, such as... Figure 1 As shown, this cycle delay can be implemented based on the registers connected to each multiplexer.

[0039] Furthermore, such as Figure 1 As shown, the bank array consists of It consists of several banks with separate read and write addresses, each bank being a simple dual-port RAM structure; the point length is... The polynomial, with a storage depth of for each bank. (The depth for storing two sets of polynomial coefficients).

[0040] The read and write operations of each bank satisfy the constraints of a collision-free detection algorithm designed for multi-channel pipelines. For example... Figure 10 As shown, a collision-free detection algorithm for multi-channel pipeline design is used to assess the risk of write-after-read collisions in multi-channel pipeline designs. Input parameters include parallelism. Point length of polynomial and pipeline depth The algorithm includes: First calculate To determine the total number of computation stages and initialize the conflict counter. for ; Then, the index of each computation stage is traversed in a loop. In each iteration, two temporary variables are calculated:

[0041]

[0042] in, and These represent right shift and left shift operations, respectively. if Greater than and If there is no conflict in the current calculation phase, Keep it unchanged; otherwise, An increment of 1 indicates that a conflict has been detected; Finally, the algorithm returns The value reflects the number of stages in the pipeline where a write-after-read conflict occurs under a given configuration.

[0043] By considering that write-after-read conflicts mainly occur in adjacent computation stages (stages) with stage The fundamental reason is that the address step size of the data points accessed by the butterfly operation at different stages is dynamically changing (stage). The step size is This could lead to stage The calculation result has not yet been written back, stage The read operation had already accessed the same address, thus reading old data and causing a RAW conflict. Based on this, in the stage... When starting to read a data block, stage The write operation to this data block must have already been completed. This condition applies to all stages. If both conditions are met, it can be guaranteed that the pipeline has neither RAW collisions nor voids. The collision-free detection algorithm designed for multi-channel pipelines also provides constraints that simultaneously ensure the reconfigurable butterfly array does not exhibit voids or write-after-read collisions, expressed as:

[0044]

[0045] in, For the number of periods, To round up, , This is a modulo operation. If this constraint is true, then RAW will never occur.

[0046] Furthermore, such as Figure 1 As shown, the reconfigurable butterfly cell array includes components consisting of... An input data routing network consisting of multiplexers One reconfigurable butterfly unit (RBFU) and composed of The output data routing network consists of multiplexers. Each multiplexer in the input data routing network selects the corresponding reconfigurable butterfly unit based on the polynomial coefficients read from the BI. Figure 1In this context, A0 to A2p-1 represent the polynomial coefficients after route selection; each reconfigurable butterfly unit is used to execute two sets of butterfly operations based on twitch factors in parallel. Figure 1 In the diagram, B0 to B2p-1 represent the polynomial coefficient operation results to be routed. Each multiplexer in the output data routing network is used to select the polynomial coefficient operation results of the corresponding reconfigurable butterfly unit to the bank corresponding to the BI for in-situ write-back according to the strobe signal sel corresponding to the BI.

[0047] Furthermore, Figure 11 This is a schematic diagram of the pipeline workflow for a reconfigurable multichannel polynomial multiplier architecture. First, the controller generates the loop variable. and The data is sent to the address generation unit to generate polynomial coefficient addresses, which are then mapped to BI and BA by the address mapping unit. Subsequently, the arbitrator... (The signal after one BI cycle, i.e., the BI signal stored in the register for one cycle or delayed by one cycle) generates a strobe signal. The bank address routing module in Under the control of The system selects the corresponding bank to complete the data reading operation. The data routing algorithm is based on... Data is gated to the corresponding reconfigurable butterfly unit. Data flows through the reconfigurable butterfly unit... After the pipelined processing, a delayed-aligned strobe signal is required. The result is written back to the bank in its original position. Because a first-level register is introduced at the data output end of the memory bank to improve timing, and because of the reconfigurable butterfly cell itself… Pipeline, the interval between read and write operations on memory. One clock cycle. It's worth noting that the write-back operation uses an in-situ update strategy, meaning the write address is the address that has been updated over time (after one clock cycle). The signal is delayed by one cycle. Figure 11 The registers connected to the output terminals of each module are used to improve timing and performance.

[0048] The aforementioned reconfigurable multichannel polynomial multiplier architecture employs a loop-decoupled multichannel NTT / INTT / PWM algorithm. This algorithm supports flexible configuration of parallelism and pipeline depth, improving the adaptability of memory access control strategies. A conflict-free memory mapping scheme based on interleaved storage is used, making the storage and reading / writing of polynomial coefficients independent of polynomial length and computation stage, unifying the access modes of NTT / INTT / PWM, and significantly reducing hardware resource overhead. Furthermore, the conflict-free detection algorithm proposed within the architecture for multichannel pipeline design ensures that the pipeline is free from both RAW collisions and cavitation, significantly improving hardware resource utilization. Compared with existing technologies, this application achieves superior area efficiency while maintaining flexibility and adaptability, providing an efficient and scalable solution for post-quantum cryptography hardware acceleration.

[0049] In one embodiment, a method for implementing a reconfigurable multichannel polynomial multiplier architecture is provided, including: The scheduler employs a multi-channel NTT / INTT / PWM algorithm based on cyclic decoupling to configure parallelism and pipeline depth, thereby generating multiple sets of polynomial coefficient addresses in parallel. A conflict-free memory mapping scheme based on interleaved storage is used to map multiple sets of polynomial coefficient addresses in parallel to physical memory address indices containing BI and BA, and to generate corresponding strobe signals based on each BI; where BI is the bank number and BA is the bank address. The pre-calculated rotation factor is stored in the rotation factor storage and can be called by the reconfigurable butterfly cell array; In the bank address routing module, the BA is selected according to the gating signal to obtain the read and write address of the corresponding BI bank, so as to realize the memory access of polynomial coefficients; In multiple banks within the bank array, read operations on polynomial coefficients and write operations on the results of polynomial coefficient operations are supported based on the read and write addresses output by the bank address routing module. The write operation adopts an in-situ update strategy, and the read and write operations satisfy the constraints of a collision-free detection algorithm designed for multi-channel pipelines. In a reconfigurable butterfly cell array, multiple sets of polynomial coefficients are read according to the configured parallelism and pipeline depth to perform butterfly operations based on rotation factors in parallel, and multiple sets of polynomial coefficient operation results are output to complete the polynomial multiplication operation.

[0050] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0051] The above embodiments are merely illustrative of several implementation methods of this application, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of this application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application.

Claims

1. A reconfigurable multichannel polynomial multiplier architecture, characterized in that, Includes a scheduler, a spin factor storage, a bank address routing module, a bank array, and a reconfigurable butterfly cell array; The scheduler is used to configure the parallelism and pipeline depth of a multi-channel NTT / INTT / PWM algorithm based on cyclic decoupling, to generate multiple sets of polynomial coefficient addresses in parallel, and to use a conflict-free memory mapping scheme based on interleaved storage to map multiple sets of polynomial coefficient addresses in parallel into physical memory address indices containing BI and BA, and to generate corresponding strobe signals according to each BI; where BI is the bank number and BA is the bank address. The rotation factor storage is used to store the pre-calculated rotation factor, which can then be called by the reconfigurable butterfly array. The bank address routing module is used to select the BA according to the gating signal to obtain the read and write address of the corresponding BI bank, so as to realize the memory access of polynomial coefficients; The bank array includes multiple banks, which are used to support read operations on polynomial coefficients and write operations on the results of polynomial coefficient operations based on the read and write addresses output by the bank address routing module. The write operation adopts an in-situ update strategy, and the read and write operations meet the constraints of a conflict-free detection algorithm designed for multi-channel pipelines. The reconfigurable butterfly array is used to read multiple sets of polynomial coefficients according to the configured parallelism and pipeline depth to perform butterfly operations based on rotation factors in parallel, and output multiple sets of polynomial coefficient operation results to complete polynomial multiplication operations.

2. The reconfigurable multichannel polynomial multiplier architecture according to claim 1, characterized in that, The scheduler includes a configuration unit, a controller, an address generation unit, an address mapping unit, and an arbitrator; The configuration unit is used to configure the parallelism. and pipeline depth ; The controller is used to generate the outermost loop of a multi-channel NTT / INTT / PWM algorithm based on loop decoupling. and middle loop And used to control the read / write enable of the bank array; wherein, the multi-channel NTT / INTT / PWM algorithm based on loop decoupling is used to combine the polynomial coefficient address generation logic in the polynomial multiplication operation with the middle loop in the three-layer loop control logic of the algorithm. With the original innermost loop Decoupling, and transferring the generation logic of polynomial coefficient addresses and twitch factors to the decoupled replacement. Innermost loop Meanwhile, the middle loop is restructured. With the innermost loop The function of the middle loop The control was changed from controlling the block step size to controlling the number of parallel groups, and the innermost loop was changed. Convert to butterfly operation iteration within the control group; The address generation unit is used to loop in the innermost layer. Generated in Address of each polynomial coefficient; The address mapping unit is used to map each polynomial coefficient address to a physical storage address index containing BI and BA using a conflict-free memory mapping scheme based on interleaved storage; wherein, the number of the address generation unit and the address mapping unit is [number missing]. The number of BI and BA are both The address mapping rule is expressed as: ； ； ； in, This is a row address transformation matrix used to extract the high-order addresses of polynomial coefficients. Bit; for An identity matrix of order 1; express zero-order matrix; Represents the address of the polynomial coefficients and , for transpose; For BI's Bit; For the bank mapping matrix; To calculate the number of stages and , Let the point length be the polynomial length; , ; This indicates finding the greatest common multiple (GCD). This represents the modulo operation; Indicates rounding down; , and The values ​​of are all greater than 0 and are powers of 2; The arbitrator is used to determine... The BI generates the bank address routing module in A strobe signal sel.

3. The reconfigurable multichannel polynomial multiplier architecture according to claim 2, characterized in that, The rotation factor storage includes the NTT rotation factor storage, the INTT rotation factor storage, the PWM1 rotation factor storage, and a rotation factor address generation unit; The twitch factor address generation unit is used to perform loop in the innermost layer. The rotation factor storage address is generated in the middle; The NTT rotation factor storage, INTT rotation factor storage, and PWM1 rotation factor storage are used to store the rotation factors of the multi-channel NTT algorithm based on loop decoupling, the rotation factors of the multi-channel INTT algorithm based on loop decoupling, and the rotation factors of the PWM1 operation mode in the multi-channel PWM algorithm based on loop decoupling, respectively; wherein, the multi-channel PWM algorithm based on loop decoupling includes two operation modes, PWM0 and PWM1, which are represented as follows: ； in, and They are polynomials The first after NTT transformation Item and the item, and They are polynomials The first after NTT transformation Item and the item, for of N Secondary unit root, Modulus; This is a bit-reversal function.

4. The reconfigurable multichannel polynomial multiplier architecture according to claim 3, characterized in that, A multi-channel NTT algorithm based on loop decoupling is used to perform efficient parallel NTT operations through three layers of loop control logic, including: Outermost loop From 0 to Control each stage of NTT's computation; To calculate the number of stages and , Let the point length be the polynomial length; Middle loop With parallelism For step size traversal 0 to ; Innermost loop To achieve fully parallel expansion, through Each parallel channel concurrently processes butterfly operations within the group; During the address generation phase, composite indexes will be used. Decomposed into high-order bits and low position Thus, the following can be constructed. and The logical address indices of the two operands are respectively and ; Using the bit reversal function The rotation factor was calculated. ; Then, through a conflict-free mapping function The two logical address indices are converted into their corresponding physical memory address indices. and ; Operands are read in parallel from their respective banks based on two physical storage address indexes. and Then, perform butterfly operations: first calculate ,in Use it as an intermediate variable; then update and updates The final updated version and Write it back to the corresponding bank in place to complete a full NTT calculation cycle.

5. The reconfigurable multichannel polynomial multiplier architecture according to claim 3, characterized in that, The multi-channel INTT algorithm based on loop decoupling is used to perform efficient parallel INTT operations through three layers of loop control logic, including: Outermost loop from to Reverse iteration, controlling INTT Each calculation stage; To calculate the number of stages and , Let the point length be the polynomial length; Middle loop With parallelism Step-size traversal arrive The butterfly operation at each stage is divided into multiple processing groups; Innermost loop To achieve fully parallel expansion, through The butterfly operation within the group is processed concurrently through multiple parallel channels; During the address generation phase, composite indexes will be used. Decomposed into high-order bits and low position Thus, the following can be constructed. and The logical address indices of the two operands are respectively and ; Using the bit reversal function The rotation factor was calculated. ; By calling the conflict-free mapping function The two logical address indices are converted into their corresponding physical memory address indices. and ; Operands are read in parallel from their respective banks based on two physical storage address indexes. and Then, perform the reverse butterfly operation: first update ,at this time for Temporary variables; then update ,in For modulo-2 operations; the final updated... and Write it back to the corresponding bank in place to complete a full INTT calculation cycle.

6. The reconfigurable multichannel polynomial multiplier architecture according to claim 3, characterized in that, A multi-channel PWM algorithm based on loop decoupling is used to perform efficient dot multiplication operations through three layers of loop control logic, including: Outermost loop from arrive Control the overall processing rounds; Let the point length be the polynomial length; Middle loop Value and These correspond to PWM0 and PWM1 operating modes, respectively. Innermost loop from arrive Achieve fully parallel expansion; During the address generation stage, through the formula and Generate polynomials respectively Coefficients after NTT transformation Sum of coefficients The logical address index, and and As polynomials Coefficients after NTT transformation Sum of coefficients Logical address index; By calling the conflict-free mapping function The four logical address indices are converted into their corresponding physical memory address indices. , , and ;wherein polynomial Physical storage address usage pattern and address offset polynomial Physical storage address usage pattern and address offset This ensures that the data for the two sets of polynomials are distributed in different banks; Four sets of coefficients are read in parallel from the corresponding banks based on four physical storage address indexes. Afterwards, according to Select the operation to perform: When First, use the bit reversal function. Calculate the rotation factor Then call the operation mode. Four outputs were obtained. Otherwise, directly invoke the operation mode. Four outputs were obtained. Finally, the four output results are written back to their respective banks in their original positions to complete the dot product operation.

7. The reconfigurable multichannel polynomial multiplier architecture according to claim 1, characterized in that, The bank address routing module includes A multiplexer; among which... Parallelism; Each multiplexer in the bank address routing module is used to select the BA to the corresponding BI bank according to the selection signal sel for polynomial coefficient memory access. The selected BA is the read address rad of the corresponding polynomial coefficient. And since the write operation adopts an in-situ update strategy, the write address wad is the read address rad after passing through the read address rad. L The signal is delayed by +1 cycle; The configured pipeline depth.

8. The reconfigurable multichannel polynomial multiplier architecture according to claim 1, characterized in that, The bank array consists of It consists of several banks with separate read and write addresses, each bank being a simple dual-port RAM structure; the point length is... The polynomial, with a storage depth of for each bank. ; The read and write operations of each bank satisfy the constraints of a collision-free detection algorithm for multi-channel pipeline designs. This collision-free detection algorithm is used to assess the risk of write-after-read collisions in a multi-channel pipeline design, and its input parameters include parallelism. Point length of polynomial and pipeline depth The algorithm includes: First calculate To determine the total number of computation stages and initialize the conflict counter. for ; Then, the index of each computation stage is traversed in a loop. In each iteration, two temporary variables are calculated: in, and These represent right shift and left shift operations, respectively. if Greater than and If there is no conflict in the current calculation phase, Keep it unchanged; otherwise, An increment of 1 indicates that a conflict has been detected; Finally, the algorithm returns The value reflects the number of stages in the pipeline where a write-after-read conflict occurs under a given configuration; The collision-free detection algorithm for multi-channel pipeline design also provides constraints that simultaneously ensure no voids or write-after-read collisions occur in the reconfigurable butterfly array, expressed as: in, For the number of periods, To round up, , This is a modulo operation.

9. A reconfigurable multichannel polynomial multiplier architecture according to claim 1, characterized in that, The reconfigurable butterfly cell array includes components consisting of... An input data routing network consisting of multiplexers A reconfigurable butterfly unit and composed of The output data routing network consists of multiplexers; Parallelism; Each multiplexer in the input data routing network is used to select the corresponding reconfigurable butterfly unit based on the polynomial coefficients read from the BI. Each reconfigurable butterfly unit is used to execute two sets of butterfly operations based on the rotation factor in parallel; Each multiplexer in the output data routing network is used to select the polynomial coefficient operation result of the corresponding reconfigurable butterfly unit output to the bank corresponding to the BI for in-situ write-back according to the gating signal sel corresponding to the BI.

10. A method for implementing a reconfigurable multichannel polynomial multiplier architecture based on any one of claims 1-9, characterized in that, The method includes: The scheduler employs a multi-channel NTT / INTT / PWM algorithm based on cyclic decoupling to configure parallelism and pipeline depth, thereby generating multiple sets of polynomial coefficient addresses in parallel. A conflict-free memory mapping scheme based on interleaved storage is used to map multiple sets of polynomial coefficient addresses in parallel to physical memory address indices containing BI and BA, and to generate corresponding strobe signals based on each BI; where BI is the bank number and BA is the bank address. The pre-calculated rotation factor is stored in the rotation factor storage and can be called by the reconfigurable butterfly cell array; In the bank address routing module, the BA is selected according to the gating signal to obtain the read / write address of the corresponding BI bank, so as to realize the memory access of polynomial coefficients; In multiple banks of the bank array, based on the read and write addresses output by the bank address routing module, read operations on polynomial coefficients and write operations on the results of polynomial coefficient operations are supported; wherein, the write operation adopts an in-situ update strategy, and the read and write operations satisfy the constraints of a conflict-free detection algorithm designed for multi-channel pipelines. In a reconfigurable butterfly cell array, multiple sets of polynomial coefficients are read according to the configured parallelism and pipeline depth to perform butterfly operations based on rotation factors in parallel, and multiple sets of polynomial coefficient operation results are output to complete the polynomial multiplication operation.

Images