Method for executing modular division by using hardware circuit and hardware circuit

Abstract

The invention provides a method for executing modular division by using a hardware circuit and the hardware circuit. The method for executing modular division is used for calculating a modulo result of a preset modulus M after input data is divided by nth power of 2, and the method comprises the following steps: judging whether a first low bit part of low n bits in the input data is 0 or not; under the condition that the first low-order part is not 0, inputting the first low-order part and a second high-order part except for n bits in the modulus M into a first multiplication circuit to obtain first intermediate data; and calculating a sum value of a first high-order part except the low n-bit part in the input data, negative data of the first intermediate data and the modulus M by using a first adding circuit, and taking the sum value as a modulus taking result.

Description

Technical Field

[0001] This specification relates to one or more embodiments in the field of circuit technology, and more particularly to a method and hardware circuit for performing analog division using hardware circuits. Background Technology

[0002] In many scenarios, hardware circuits are needed to perform modular arithmetic. For example, homomorphic encryption algorithms require the execution of Number Theoretic Transform (NTT) and its inverse (INTT). Accordingly, in hardware acceleration chips dedicated to homomorphic operations, the NTT and INTT modules become the foundational computational modules. Both NTT and INTT operations involve a significant amount of modular arithmetic. For INTT, compared to NTT, it requires an additional operation: Z = X / N mod M, i.e., modular division, where X is the input data, Z is the output data, M is the modulus, and N is a preset value, typically a power of 2.

[0003] In related technologies, to execute Z = X / N mod M, it is generally rewritten as This transforms the calculation of Z into n operations of X / 2 mod M. Since n modulo division operations are required, performing this operation using hardware circuitry in related technologies is inefficient and requires a large circuit area. Summary of the Invention

[0004] In view of this, one or more embodiments of this specification provide a method and hardware circuit for performing analog division using hardware circuitry.

[0005] According to a first aspect of one or more embodiments of this specification, a method for performing modular division using hardware circuitry is provided for calculating the modulo result of input data divided by a power of 2 and then modulo a preset modulus M, the method comprising:

[0006] Determine whether the first least significant bit portion of the input data, excluding the high n bits, is 0;

[0007] If the first low-order part is not 0, the first low-order part and the second high-order part of the high n bits in the modulus M are input into the first multiplication circuit to obtain the first intermediate data.

[0008] Using the first addition circuit, the sum of the first high-order bit portion of the input data (high n bits), the negative value of the first intermediate data, and the modulus M is calculated as the modulus result.

[0009] According to a second aspect of one or more embodiments of this specification, a hardware circuit is provided for calculating the modulo result of input data divided by a power of 2 and then modulo a preset modulus M, the hardware circuit comprising:

[0010] The judgment circuit is used to determine whether the first low-order part of the low n bits in the input data is 0. If it is not 0, the first circuit branch is used. The first circuit branch includes a first multiplication circuit and a first addition circuit.

[0011] The first multiplication circuit is used to receive the first low-order part and the second high-order part of the modulus M excluding the low n bits, and to perform a first multiplication process on the received data to obtain the first intermediate data.

[0012] The first adder circuit is used to calculate the sum of three data to obtain the modulo result. The three data include the first high-order part of the input data excluding the low n bits, the negative value data corresponding to the first intermediate data, and the modulus M.

[0013] According to a third aspect of one or more embodiments of this specification, a fully homomorphic hardware acceleration chip is proposed, including the hardware circuitry described in the second aspect of this specification.

[0014] In one or more embodiments of this specification, The operation is transformed into a multiplication of the first least significant bit of X and the second most significant bit of the modulus M, as well as an addition and subtraction operation of the three data. In other words, the method provided in this specification only requires one multiplication operation, one subtraction operation, and one addition operation to obtain the result of the modulo division, saving time, improving operational efficiency, and reducing the circuit area occupied.

[0015] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this specification. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this specification and, together with the description, serve to explain the principles of this specification.

[0017] Figure 1 This manual shows the pseudocode algorithm for calculating modulo 2 division.

[0018] Figure 2 This is a flowchart illustrating a method for performing analog division using hardware circuitry, as shown in this specification.

[0019] Figure 3 This is a schematic diagram of a hardware circuit shown in this specification. Detailed Implementation

[0020] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numerals in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with one or more embodiments of this specification. Rather, they are merely examples of apparatuses and methods consistent with some aspects of one or more embodiments of this specification as detailed in the appended claims.

[0021] It should be noted that the steps of the corresponding methods are not necessarily performed in the order shown and described in this specification in other embodiments. In some other embodiments, the methods may include more or fewer steps than described in this specification. Furthermore, a single step described in this specification may be broken down into multiple steps in other embodiments; and multiple steps described in this specification may be combined into a single step in other embodiments.

[0022] NTT can convert a polynomial from coefficient representation to point-value representation. INTT can convert a polynomial from point-value representation to coefficient representation. Coefficient representation is represented by a coefficient vector (a0, a1, ..., a...). n To represent a polynomial Since a polynomial of degree n-1 can be uniquely determined by the values ​​of the polynomial at n distinct points, the point-value representation method represents the polynomial by n pairs of point values. Any pair of point values ​​is used to represent the value of f(x) for x under a specific value.

[0023] Coefficient notation has high computational complexity when performing polynomial multiplication, while point-value notation has lower computational complexity. Homomorphic encryption algorithms require polynomial multiplication in the ciphertext, which is a relatively time-consuming operation. Homomorphic ciphertext is generally represented using coefficient notation; therefore, to accelerate homomorphic encryption algorithms, NTT and INTT conversion operations are often required. When polynomial multiplication is needed, the ciphertext is converted from coefficient notation to point-value notation using NTT. After the polynomial multiplication is completed, the ciphertext is converted back from point-value notation to coefficient notation using INTT. This improves the computational efficiency of polynomial multiplication in the ciphertext.

[0024] Typically, in a fully homomorphic hardware acceleration chip (or fully homomorphic FHE chip) dedicated to performing fully homomorphic encryption operations, NTT circuit modules and INTT circuit modules are set up as its basic operator units.

[0025] To ensure that the data before the transformation can be recovered after continuous NTT / INTT transformation, the INTT transformation requires an additional modulo division operation Z = X / N mod M, compared to the NTT transformation.

[0026] In NTT / INTT conversion scenarios, N=2 is generally satisfied. n In related technologies, Z = X / N mod M is converted to... Then, Z is calculated by multiplying X / 2 mod M n times, where X in any X / 2 mod M is the output of the previous round of calculation.

[0027] Figure 1 The pseudocode for calculating modulo-2 division is shown. Figure 1 As shown, for each X / 2 mod M, when the least significant bit of the binary X is 0, X / 2 can be converted to the binary X shifted one bit to the right, i.e. If the least significant bit of the binary representation of X is not 0, then X / 2 mod M can be converted to... in, To round down X / 2, according to the rules of modulo operation, if the least significant bit of the binary representation of X is not 0, This is equivalent to the operation X / 2 mod M.

[0028] In related technologies, the computational efficiency is low due to the need for n operations. In terms of circuit implementation, under a pipelined architecture, the above n operations need to be implemented through sub-circuits of n stages. Each stage's sub-circuit needs to prepare two branches with the least significant bit of X being 0 and 1. Correspondingly, the above operations need to be implemented through n full-width adders, which makes the above operation method require a large circuit area.

[0029] Based on this, this specification provides a method for performing modular division using hardware circuitry. This method is used to calculate the modulo result of dividing input data by a power of 2 and then taking the result modulo a preset modulus M. Here, n and M are preset fixed values, the magnitude of which depends on the application scenario of INTT.

[0030] First, the overall implementation process and principle of this method will be explained. First, the binary input data X can be split into a first least significant bit part and a first most significant bit part. The first least significant bit part includes the lower n bits of X, and the first most significant bit part includes the portion of X excluding the lower n bits. Here, n bits refer to n bits in binary, corresponding to n bits in total. Using X... L Identify the first least significant part, X H If we identify the first most significant bit, then the input data X can be represented as X = X H 2 n +XL ∈[0,M). For example, if X is the binary number 10010101, and n=5, then the first least significant bit is 10101 and the first most significant bit is 100.

[0031] Based on the split X, we know that in the first low-order part X L When the value is 0, the first high-order bit X is obtained by dividing the input data by 2 to the power of n and then taking the modulus M. H .

[0032] Correspondingly, the modulus M can also be split into a second least significant bit portion consisting of the lower n bits of M, and a second most significant bit portion excluding the second least significant bit portion. According to the requirements of NTT and INTT, the second least significant bit portion of the lower n bits of the modulus M is generally set to 1. Therefore, using M... H The second most significant bit, the modulus M, can be represented as M = M H 2 n +1.

[0033] Introduce another parameter q, let q = -X L mod 2 n =2 n -X L Therefore, X + qM is 2. n Multiples of. Specifically, substituting the above formulas for X, q, and M into X+qM, as shown in formula (1) below:

[0034] X + qM = X H 2 n +X L +(2 n -X L (M) H 2 n +1)=(X H +MX L M H )2 n (1)

[0035] Since qM is a multiple of M, we can obtain formula (2):

[0036] X2 -n mod M = (X H +MX L M H )mod M (2)

[0037] Furthermore, due to It can be confirmed that:

[0038] X2 -n mod M = X H +MXL M H (3)

[0039] That is, in the first low-position part X L If the input data is not zero, the result Z, which is the modulo of the preset modulus M after dividing the input data by 2 to the power of n, is X. H +MX L M H .

[0040] In summary, the method provided in the embodiments of this specification calculates the modulo division result as follows: in the first low-order part X L When it is not 0, When the first least significant bit is 0.

[0041] Compared to related technologies that break down the computation into n operations, this solution processes the modular division operation as a whole, converting it into one multiplication, one subtraction, and one addition operation. This reduces the number of operations. From a hardware implementation perspective, this solution only requires three operations, eliminating the need for n full-width adders required for n operations, thus saving hardware space.

[0042] Having demonstrated the feasibility of the method provided in this specification, the following will be combined with... Figure 2 To determine how to calculate X H +MX L M H Please provide an explanation.

[0043] like Figure 2 As shown, the method for performing analog division using hardware circuitry provided in this specification includes the following steps:

[0044] Step 201: Determine whether the first least significant bit of the lower n bits in the input data is 0.

[0045] Step 203: If the first low-order part is not 0, input the first low-order part and the second high-order part of the modulus M (excluding the low n bits) into the first multiplication circuit to obtain the first intermediate data.

[0046] The first intermediate data is X L M H The first multiplication circuit can be implemented using various optional multiplication circuits.

[0047] In an alternative implementation, the multiplication circuit can be implemented using Booth encoding. Specifically, the two data points to be multiplied are used as the multiplier and multiplicand, respectively. The multiplier is split into multiple parts, and multiple partial products are obtained by multiplying each part of the multiplier with the multiplicand. The sum of these partial products is the result of the multiplication operation. Then, a compressor compresses these partial products into two data points, the sum of which is the same as the sum of the partial products. Finally, an adder sums the two data points to obtain the result of the multiplication operation.

[0048] The partial product can be obtained through addition, subtraction, or shift operations. Addition can be implemented using an adder. Subtraction can be achieved by inverting the data and then using an adder. Inversion can be achieved using a NOT gate. Shifting can be achieved through connections between different devices. The choice of the partial product calculation method can be achieved using a multiplexer, which can select different paths for different values ​​of the input data. In the following text, the multiplexer, along with the adder and NOT gate used to calculate the partial product, will be referred to as the second multiplication circuit.

[0049] The compressor can compress the input N1 data points (partial products) into a smaller number of N2 data points, and guarantees that the sum of the input N1 data points equals the sum of the output N2 data points. In the circuit described above, the compressor can input n / 2 + 2 partial products, and correspondingly output 2 data points (hereinafter referred to as the second intermediate data). This reduces the number of subsequent addition operations.

[0050] In other words, the first multiplication circuit in step 203 above includes a second multiplication circuit, a compressor, and a second adder circuit. Step 203 can specifically include: using the second multiplication circuit combined with Booth encoding to obtain multiple partial products obtained by operating on the first low-order part and the second high-order part; using the compressor to compress the multiple partial products into two second intermediate data; and using the second adder circuit to calculate the sum of the two second intermediate data to obtain the first intermediate data.

[0051] Step 205: Using the first addition circuit, calculate the sum of the first high-order part of the input data excluding the low n bits, the negative value corresponding to the first intermediate data, and the modulus M, and use it as the modulus result.

[0052] As mentioned above, this instruction manual requires the calculation of X. H +MX L M H The first intermediate data X was obtained through step 203 above. L M HIn step 205, the required addition and subtraction operations can be performed using the first addition circuit. The negative value corresponding to the first intermediate data can be inverted using a NOT gate and then incremented by 1. The circuit for obtaining the negative value may or may not be included in the first addition circuit. Furthermore, through the first addition circuit, the sum of the negative value of the first intermediate data, the first high-order bit portion, and the modulus M can be achieved, thereby obtaining the modulo division result when the first low-order bit portion is not zero, i.e., the modulo result.

[0053] In this embodiment, the first adding circuit and the second adding circuit mentioned above can be the same circuit, multiplexed through the connection between the devices. In another optional embodiment, the first adding circuit and the second adding circuit mentioned above can also be different circuits.

[0054] Furthermore, on the other hand, in the first low-position portion X L If the value is 0, return the first high-order bit portion X. H As the result of modulo operation.

[0055] This specification also provides a hardware circuit for calculating the modulo result of dividing the input data by a power of 2 and then taking the result modulo a preset modulus M, such as... Figure 3 As shown, the hardware circuit includes: a judgment circuit and a first circuit branch and a second circuit branch selectively activated according to the judgment result. The first circuit branch includes a first multiplication circuit and a first addition circuit, which are used to perform multiplication and addition operations on the input data and the modulus. The second circuit branch is used to output the high-order part of the input data as the modulus result.

[0056] The specific implementation of the hardware circuit will be explained next.

[0057] The judgment circuit is used to determine the first least significant bit portion X of the lower n bits in the input data. L If the value is 0, use the first circuit branch if it is not 0; otherwise, use the second circuit branch.

[0058] This judgment circuit can be implemented using conventional circuit components, such as several NOR gates and a multiplexer. The NOR gates can be single n-input NOR gates or multiple NOR gates in a multi-level hierarchy. The outputs of these NOR gates can indicate whether all n bits of the first least significant bit portion are 0. The indication signal of the judgment result can serve as the control signal for the multiplexer, thereby selecting between the first and second circuit branches. Thus, through this judgment circuit, the appropriate circuit branch can be selected based on the value of the first least significant bit portion to output the modulo result.

[0059] If the judgment result indicates that the first low-order part is all 0, the second circuit branch is selected, in which the first high-order part X is directly output. H As the result of modulo operation.

[0060] If the result indicates that the first low-order bit is not 0, the subsequent processing steps are performed using the first circuit branch, which is used to calculate X. H +MX L M H Specifically, the first multiplication circuit in the first circuit branch can calculate the first low-order part X. L And the second most significant part M of the modulus M H The result of the multiplication operation is used to obtain the first intermediate data. The first adder circuit in the first circuit branch can calculate the sum of the negative value corresponding to the first intermediate data, the modulus M, and the first high-order part to obtain the modulo result.

[0061] More specifically, the first multiplication circuit is used to receive the first low-order portion and the second high-order portion of the modulus M excluding the lower n bits, and perform a first multiplication process on the received data to obtain first intermediate data. That is, the first multiplication circuit uses the first low-order portion X... L Second highest part M H The first intermediate data is used as input, and the first intermediate data is used as output, specifically to calculate the first least significant bit of the input, X. L Second highest part M H The result of the multiplication operation.

[0062] In an alternative implementation, as described above, the first multiplication process can be performed using Booth encoding. In other words, the first multiplication circuit includes a second multiplication circuit incorporating Booth encoding, a compressor, and a second adder circuit.

[0063] The second multiplication circuit is used to receive the first low-order part and the second high-order part, and perform a second multiplication process on the received data to obtain multiple partial products; the sum of the multiple partial products is the first intermediate data; the compressor is used to receive the multiple partial products and output two second intermediate data; the sum of the two intermediate data is the same as the sum of the multiple partial products; the second addition circuit is used to calculate the sum of the two second intermediate data to obtain the first intermediate data.

[0064] Specifically, the second multiplication circuit may include a multiplexer and a third adder circuit, so as to obtain the result of the partial product operation based on the addition or subtraction operation with the multiplicand or the shift operation of the multiplicand itself, depending on the different values ​​of the multiplier.

[0065] In one alternative embodiment, the third adder circuit may reuse the second adder circuit. In another alternative embodiment, the third adder circuit may also be a different circuit from the second adder circuit.

[0066] The first adder circuit is used to calculate the sum of three components to obtain a modulo result. These three components include the first high-order bits (excluding the lower n bits) of the input data, the negative value of the first intermediate data, and the modulus M. In one example, a circuit section for obtaining the negative value can be added between the first intermediate data and the first adder circuit. This circuit section may include a NOT gate and an adder; the NOT gate inverts the first intermediate data, and then the adder adds 1 to the inverted value to obtain the negative value of the first intermediate data. In another example, the above circuit section may be included within the first adder circuit. Thus, the first adder circuit can receive the first intermediate data, obtain the negative value of the first intermediate data using the above circuit section, and then perform a summation operation with the first high-order bits and the modulus M.

[0067] The negative value of the first intermediate data, -X, can be obtained through the first adder circuit. L M H First high-level data X H Summing the modulus M and the modulus M, we get the modulo result X. H +MX L M H .

[0068] In one alternative implementation, the first adder circuit may specifically be a full-bit-width adder.

[0069] It is evident that the above hardware circuit can achieve modular division using a compressor and a full-width adder, which saves circuit area compared to the implementation method using n full-width adders in related technologies.

[0070] In one optional implementation, the hardware circuit is used in the INTT module of a fully homomorphic hardware acceleration chip to implement the inverse transformation INTT process of the number-theoretic transformation in the homomorphic algorithm.

[0071] As mentioned earlier, INTT requires calculating the modulo division result of the input data with 2 raised to the power of n. During fully homomorphic encryption, NTT and INTT are used to accelerate the time-consuming multiplication of the ciphertext polynomial. Therefore, this hardware circuit can be applied to fully homomorphic hardware acceleration chips to speed up fully homomorphic encryption operations.

[0072] The preceding text described the implementation of the hardware circuit using specific hardware circuit examples. It is understood that the aforementioned hardware circuit can also be implemented using programmable logic devices, such as Field-Programmable Gate Arrays (FPGAs) or Complex Programmable Logic Devices (CPLDs).

[0073] This specification also provides a fully homomorphic hardware acceleration chip, including the hardware circuit described above.

[0074] Furthermore, this specification also provides a computing device including the aforementioned fully homomorphic hardware acceleration chip. In an optional embodiment, the computing device may further include a processor, memory, input / output interfaces, communication interfaces, and a bus, wherein the fully homomorphic hardware acceleration chip can serve as external heterogeneous acceleration hardware for the processor.

[0075] The processor can be implemented using a general-purpose CPU, microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification. The processor implements the above-described methods by running executable instructions.

[0076] Memory used to store processor-executable instructions can be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage devices, dynamic storage devices, etc. Memory can store the operating system and other application programs.

[0077] Input / output interfaces are used to connect input / output modules to enable information input and output. Input / output modules can be configured as components within a device or connected externally to provide corresponding functions. Input devices can include keyboards, mice, touchscreens, microphones, various sensors, etc., while output devices can include displays, speakers, vibrators, indicator lights, etc.

[0078] The communication interface is used to connect the communication module to enable communication and interaction between this device and other devices. The communication module can communicate via wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0079] A bus is a pathway that transmits information between the various components of a device.

[0080] It should be noted that, in practice, in addition to the components shown above, the device may also include other components necessary for normal operation.

[0081] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0082] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

Claims

1. A method for performing modular division using hardware circuitry, used to calculate the modulo result of input data divided by a power of 2 and then modulo a preset modulus M, the method comprising: Determine whether the first least significant bit of the lower n bits in the input data is 0; If the first low-order part is not 0, the first low-order part and the second high-order part of the modulus M (excluding the low n bits) are input into the first multiplication circuit to obtain the first intermediate data. Using the first addition circuit, the sum of the first high-order part of the input data (excluding the low n bits), the negative value corresponding to the first intermediate data, and the modulus M is calculated as the modulus result.

2. The method according to claim 1, further comprising: If the first low-order part is 0, the first high-order part is returned as the modulo result.

3. The method according to claim 1, wherein, The first multiplication circuit includes a second multiplication circuit, a compressor, and a second adder circuit; The first low-order portion and the second high-order portion of the modulus M, excluding the lower n bits, are input into the first multiplication circuit to obtain the first intermediate data, including: Multiple partial products are obtained by operating on the first low-order part and the second high-order part using a second multiplication circuit that combines Booth encoding; A compressor is used to compress multiple partial products into two second intermediate data; The first intermediate data is obtained by using the second adder circuit to calculate the sum of the two second intermediate data.

4. The method according to claim 1, wherein, The hardware circuitry is applied to the Inverse Number Theory Transform (INTT) module in a fully homomorphic hardware acceleration chip.

5. The method according to claim 1, wherein the second least significant bit portion of the least n bits in the modulus M is 1.

6. A hardware circuit for calculating the modulo result of dividing input data by a power of 2 and then taking the modulus M, the hardware circuit comprising: The judgment circuit is used to determine whether the first low-order part of the low n bits in the input data is 0. If it is not 0, the first circuit branch is used. The first circuit branch includes a first multiplication circuit and a first addition circuit. The first multiplication circuit is used to receive the first low-order part and the second high-order part of the modulus M excluding the low n bits, and to perform a first multiplication process on the received data to obtain the first intermediate data. The first adder circuit is used to calculate the sum of three data to obtain the modulo result. The three data include the first high-order part of the input data excluding the low n bits, the negative value data corresponding to the first intermediate data, and the modulus M.

7. The hardware circuit according to claim 6, wherein, The judgment circuit is also used to return the first high-order part as the modulus result when the first low-order part is 0.

8. The hardware circuit according to claim 6, wherein the first multiplication circuit includes a second multiplication circuit, a compressor, and a second adder circuit; The second multiplication circuit is used to receive the first low-order part and the second high-order part, and perform a second multiplication process on the received data in combination with Booth encoding to obtain multiple partial products; The compressor is used to receive multiple partial products and output two second intermediate data. The second adder circuit is used to calculate the sum of the two second intermediate data to obtain the first intermediate data.

9. The hardware circuit according to claim 6, wherein the hardware circuit is applied to the inverse number theory transformation (INTT) process in a fully homomorphic hardware acceleration chip.

10. A fully homomorphic hardware acceleration chip, comprising the hardware circuitry of any one of claims 6-9.

Images