Dynamic post-quantum cryptography implementation method based on reconfigurable logic units

Abstract

This invention relates to the field of cryptographic communication, specifically to a dynamic post-quantum cryptography implementation method based on reconfigurable logic units, comprising: establishing a fixed parameter library including the NIST standardized PQC algorithm with full security levels; matching a unique target parameter set after receiving a service instruction to generate a hardware-executable parameter configuration frame; completing the physical isolation between the fixed static control domain and the independently reconfigurable dynamic computation domain within the device; the static domain sends the parameter configuration frame, the dynamic domain configures divisible or cascaded modular multiplication operation channels according to the target bit width, configures modular reduction simple elements with boundary checks according to the target modulus, matches the computation bit width throughout, and eliminates overflow and truncation errors; configures a full-link synchronous pipeline for polynomial operations, configures conflict-free memory access rules according to the target parameters, and achieves bubble-free continuous operation of the computation link; performs independent reconfiguration on subdomains with mismatched parameters in the dynamic domain, while the remaining subdomains continue to run, and starts a new computation process after the reconfiguration verification passes.

Description

Technical Field

[0001] This invention belongs to the field of cryptographic communication, specifically relating to a dynamic post-quantum cryptography implementation method based on reconfigurable logic units. Background Technology

[0002] In dynamic post-quantum cryptography, different PQC algorithms, different security levels, and different moduli, polynomial orders, and coefficient bit widths vary greatly. Existing technologies, when configured with reconfigurable logic units, require these reconfigurable logic units to dynamically adapt to these parameters. However, in existing technologies, when variable bit width modular multiplication or reduction simple elements are dynamically switched, modular operation truncation errors and intermediate state data overflow risks are prone to occur. At the same time, the complex control logic introduced to accommodate multiple parameters will significantly increase the computational latency, and may even lead to the engineering dilemma of "increased flexibility but computational performance not surpassing that of fixed architecture". Summary of the Invention

[0003] The purpose of this invention is to provide a dynamic post-quantum cryptography implementation method based on reconfigurable logic units to solve the problems mentioned in the background art.

[0004] To solve the above-mentioned technical problems, the present invention provides the following technical solution: A dynamic post-quantum cryptography implementation method based on reconfigurable logic units includes the following steps: Establish a fixed parameter library that includes all security levels of the NIST standardized PQC algorithm. Each set of parameters is bound to the modulus, polynomial order, coefficient bit width, modulo operation rules, and pre-computed operation boundary constraint parameters. After receiving the service instruction, it matches the unique target parameter set and generates a hardware-executable parameter configuration frame; Complete the physical isolation between the fixed static control domain and the independently reconfigurable dynamic computation domain within the device; The static domain sends out parameter configuration frames, while the dynamic domain configures splittable or cascaded modular multiplication operation channels according to the target bit width and configures modular reduction simple elements with boundary checks according to the target modulus, matching the operation bit width throughout the process to eliminate overflow and truncation errors. Configure a full-link synchronous pipeline for polynomial operations, configure conflict-free memory access rules according to target parameters, and achieve bubble-free continuous operation of the operation link; Independent reconfiguration is performed only on subdomains in the dynamic domain where parameters do not match; the remaining subdomains continue to run. A new computation process is started after the reconfiguration verification passes.

[0005] Furthermore, the establishment of a fixed parameter library including the full security level of the NIST standardized PQC algorithm includes: establishing a fixed parameter library according to the NIST post-quantum cryptography standardization specification, including the full security level parameter set of the standardized PQC algorithm without non-standard parameters, fixing the core parameters and pre-computed bound boundary constraint parameters for each set of parameters, establishing index mapping rules to achieve accurate matching, and setting up an optimized parameter storage partition to store the optimized parameters.

[0006] Furthermore, each set of parameters is bound to the modulus, polynomial order, coefficient bit width, modulus operation rules, and pre-calculated operation boundary constraint parameters. After receiving a business instruction, it matches a unique target parameter set and generates a hardware-executable parameter configuration frame. This includes: according to the NIST post-quantum cryptography standardization specification, binding core operation parameters and pre-calculated boundary constraint parameters to each fixed parameter set in the standardized PQC parameter library to pre-control operation errors and overflow risks, establishing index mapping rules, accurately matching a unique target parameter set after receiving a business instruction, encoding it into a hardware-executable set to generate a parameter configuration frame, and binding the boundary constraint parameters to the configuration frame to ensure that it can be directly used for hardware adaptation of reconfigurable logic units.

[0007] Furthermore, the physical isolation between the fixed static control domain and the independently reconfigurable dynamic computing domain within the device includes: within the reconfigurable logic device, dividing and hardware-isolating the non-reconfigurable static control domain and the reconfigurable dynamic computing domain, with the static domain having a built-in control unit, and the dynamic domain being divided into four independently reconfigurable subdomains, each equipped with a configuration port and a gate switch; the static domain completes power-on initialization, loading rules, and synchronizing the clock, and the dynamic domain completes basic logic preloading and self-test, then locks the configuration port to wait for parameter configuration instructions.

[0008] Furthermore, the static domain sends parameter configuration frames, and the dynamic domain configures splittable or cascaded modular multiplication operation channels according to the target bit width. This includes: a parameter configuration management unit of the static control domain, which sends the parameter configuration frames corresponding to the target parameter set and the bound boundary constraint parameters point-to-point to the reconfigurable modular multiplication operation array of the dynamic operation domain, and unlocks the configuration port to perform parameterized configuration; the reconfigurable modular multiplication operation array determines the adaptation mode according to the target coefficient bit width, configures the operation channels by splitting single units or cascading multiple units, and configures extended bit width to avoid truncation and overflow. After configuration, parameter consistency verification is performed, and after verification, the port is locked to wait for operation instructions.

[0009] Furthermore, the step of configuring a modular reduction simple element with boundary verification according to the target modulus, matching the operation bit width throughout the process, and eliminating overflow and truncation errors includes: the static control domain sending the parameter configuration frame and the bound boundary constraint parameters to the reconfigurable modular reduction array, and unlocking the port to perform parameterized configuration; the modular reduction array determining the appropriate modular reduction algorithm based on the target parameters, pre-calculating the reduction coefficients, configuring the pipeline stage, loading the truncation threshold and setting the hardware verification logic, the static domain boundary verification unit solidifying the verification logic for real-time verification, and locking the port after consistency verification to wait for the operation instruction after configuration, matching the operation bit width throughout the process, and eliminating overflow and truncation errors.

[0010] Furthermore, the configuration of the polynomial operation full-link synchronous pipeline includes: the static control domain completes the configuration of the polynomial operation full-link synchronous pipeline according to the target parameters, sets multiple core operation stages as continuous full pipelines, sets matching synchronization registers between stages to achieve bubble-free continuous operation of the operation link, and configures the parallel independent partitions of the on-chip memory array and the matching address mapping rules according to the target parameters.

[0011] Furthermore, the step of configuring conflict-free memory access rules according to target parameters to achieve bubble-free continuous operation of the computing link includes: the static control domain performs parameterized configuration of memory access rules for the on-chip parameterized memory array according to the target parameters, divides parallel independent memory partitions and sets address mapping rules to match algorithm access modes.

[0012] Furthermore, the step of performing independent reconfiguration only on subdomains with mismatched parameters in the dynamic domain, while keeping the other subdomains running, includes: after receiving the algorithm or security level switching instruction, the static control domain completes the current operation task, locks the input port of the dynamic operation domain, saves non-sensitive state parameters and isolates sensitive data, synchronously and in parallel generates new parameter configuration information, compares the configuration status of each subdomain of the dynamic operation domain, performs independent reconfiguration only on subdomains with mismatched parameters, and keeps the original running status of subdomains with matching parameters. The reconfiguration process is monitored and controlled in real time, and parameter consistency verification and functional self-check are immediately carried out after the reconfiguration is completed to ensure that the reconfiguration is compliant and effective.

[0013] Furthermore, after reconfiguration and parameter consistency verification, and functional self-test pass, the static control domain locks all subdomain configuration ports of the dynamic operation domain, unlocks the operation input ports, issues operation control commands corresponding to the new target parameters, clears pipeline residual data, resets synchronization status, and starts a new operation process.

[0014] This application also discloses an electronic device, including: At least one processor; and

[0015] A memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores instructions that can be executed by the at least one processor, which, when executed by the at least one processor, enables the at least one processor to perform the dynamic post-quantum cryptography implementation method based on reconfigurable logic units of the present invention.

[0017] Beneficial Effects: This invention addresses the problems of large differences in modulus, polynomial order, and coefficient bit width under different post-quantum cryptography (PQC) algorithms and security levels, which can easily lead to truncation errors, data overflow, complex control logic, high computational latency, and difficulty in balancing flexibility and performance through an integrated approach of standardized parameter solidification, hardware domain isolation, precise parameter configuration, and local independent reconfiguration, achieving the following technical effects: A fixed parameter library for PQC algorithms with full security levels, strictly adhering to NIST specifications, is established, fully covering standard algorithms such as ML-KEM, ML-DSA, Falcon, and SPHINCS+. Only official parameters are included, excluding custom non-standard parameters. Core parameters such as modulus, polynomial order, coefficient bit width, and modulo operation rules are fixed for each set of parameters, and boundary constraint parameters such as intermediate state bit width, legal truncation threshold, and address boundaries are pre-calculated and bound. A unique and accurate match between the algorithm and the security level is achieved through index mapping, completely avoiding modulo operation truncation errors, intermediate data overflow, and parameter matching ambiguities from the hardware configuration source. Physical hardware isolation between the static control domain and the dynamic operation domain is implemented within the reconfigurable logic device. The static domain is responsible for global control, verification, and configuration management and cannot be reconfigured. The dynamic domain is divided into multiple independently reconfigurable operation subdomains and equipped with independent configuration ports and gating switches. After power-on, the static domain completes initialization, clock synchronization, and rule loading, while the dynamic domain completes pre-loading and self-test before locking the configuration port, achieving decoupling of control logic and operation logic, and improving system stability, security, and configuration controllability.

[0018] The static domain sends parameter configuration frames and boundary constraint parameters point-to-point to the dynamic computation domain. The modular multiplication array can automatically select single-cell splitting or multi-cell cascading mode according to the target coefficient bit width, and configure extended bit width to avoid truncation and overflow. The modular reduction array uses the target modulus adaptive matching algorithm, pre-calculates reduction coefficients, configures the pipeline, and is verified throughout by the hardware real-time boundary verification unit to ensure that the computation bit width is matched throughout, there is no overflow, and no illegal truncation, which significantly improves the accuracy and reliability of the operation.

[0019] Based on the target parameters, the core stages such as polynomial NTT, modular multiplication, modular reduction, and INTT are configured as a continuous fully synchronous pipeline, and adaptive synchronization registers are used between stages to eliminate bubbles. At the same time, on-chip memory is divided into parallel independent partitions according to the polynomial order, and address mapping rules matching the algorithm access mode are established to achieve conflict-free memory access in a single clock cycle, providing continuous data flow support for the entire operation chain. While ensuring dynamic adaptation capabilities, it achieves operation efficiency close to that of a fixed architecture.

[0020] When switching algorithms or security levels, independent reconfiguration is performed only on subdomains with mismatched parameters in the dynamic domain, while subdomains with matching parameters continue to run without slowing down. Reconfiguration is processed in parallel with the current task's completion. After completion, consistency verification and functional self-checks are performed immediately. Once the verification passes, pipeline remnants are quickly cleared, synchronization status is reset, and new operations are started. This avoids the high latency, high resource overhead, and business interruption caused by global reconfiguration, achieving smooth switching and seamless continuity of security levels / algorithms. Attached Figure Description

[0021] Figure 1 is a schematic diagram of the overall process of the dynamic post-quantum cryptography implementation method based on reconfigurable logic units according to the present invention; Figure 2 is a schematic diagram of the specific implementation process for constructing the NIST standardized PQC fixed parameter library of the present invention; Figure 3 is a schematic diagram of the specific implementation process of PQC target parameter set matching and hardware executable parameter configuration frame generation of the present invention; Figure 4 is a schematic diagram of the specific implementation process of the reconfigurable modular simplified array parameterization configuration and hardware boundary verification of the present invention; Figure 5 is a schematic diagram of the specific implementation process of the conflict-free memory access rule configuration of the on-chip parameterized memory array of the present invention; Figure 6 This is a line graph comparing the relative errors of the modulus calculation of the present invention and existing technology under different coefficient bit widths. Detailed Implementation

[0022] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0023] This application discloses a method for implementing dynamic post-quantum cryptography based on reconfigurable logic units, such as... Figure 1 As shown, it includes the following steps: Establish a fixed parameter library that includes all security levels of the NIST standardized PQC algorithm. Each set of parameters is bound to the modulus, polynomial order, coefficient bit width, modulo operation rules, and pre-computed operation boundary constraint parameters. After receiving the service instruction, it matches the unique target parameter set and generates a hardware-executable parameter configuration frame; Complete the physical isolation between the fixed static control domain and the independently reconfigurable dynamic computation domain within the device; The static domain sends out parameter configuration frames, while the dynamic domain configures splittable or cascaded modular multiplication operation channels according to the target bit width and configures modular reduction simple elements with boundary checks according to the target modulus, matching the operation bit width throughout the process to eliminate overflow and truncation errors. Configure a full-link synchronous pipeline for polynomial operations, configure conflict-free memory access rules according to target parameters, and achieve bubble-free continuous operation of the operation link; Independent reconfiguration is performed only on subdomains in the dynamic domain where parameters do not match; the remaining subdomains continue to run. A new computation process is started after the reconfiguration verification passes.

[0024] The establishment of a fixed parameter library including all security levels of the NIST standardized PQC algorithm, such as... Figure 2 In practice, this includes: Based on the NIST post-quantum cryptography standardization specifications, determining the compliant scope of the parameter library; fully incorporating the fixed parameter sets corresponding to all officially defined security levels of the four standardized algorithms: ML-KEM, ML-DSA, Falcon, and SPHINCS+; and excluding any custom non-standard parameters. For each included fixed parameter set, six core parameters are fixedly defined: modulus q, polynomial order n, coefficient bit width w, modulo reduction rules, NTT / INTT transformation factor, and key length parameter. This ensures that all core parameters within a single parameter set fully match the official specifications of the corresponding algorithm and security level, with no parameter deviation.

[0025] For each set of fixed parameters, perform pre-calculation of the operation boundary to generate immutable boundary constraint parameters that are bound one-to-one with the parameter set. The boundary constraint parameters include the maximum intermediate state bit width of modular multiplication, the truncation threshold of modular reduction, the address space boundary of polynomial operation, and the legal range of operation values, so as to pre-control the truncation error of modular operation and the risk of data overflow from the source.

[0026] Establish standardized index mapping rules for the parameter library, with each index item corresponding one-to-one with the algorithm identifier and security level identifier. This ensures that after receiving the target algorithm identifier and security level identifier from the upper-layer business input, a unique parameter set can be accurately matched without any matching ambiguity.

[0027] Set up a corresponding optimized parameter storage partition for the parameter library to store pipeline configurations, memory access scheduling rules, and parameters related to the operation unit splicing mode after closed-loop optimization under the same algorithm and security level. The optimized parameters can be directly used for subsequent operation configurations with the same algorithm and security level, supporting continuous iterative improvement of operation performance.

[0028] Each set of parameters is bound to the modulus, polynomial order, coefficient bit width, modulo operation rules, and pre-calculated operation boundary constraints. Upon receiving a service instruction, it matches a unique target parameter set and generates a hardware-executable parameter configuration frame, such as... Figure 3In practice, this includes: based on the NIST post-quantum cryptography standardization specifications, determining the core operational parameters and boundary constraint parameters for each fixed parameter set included in the standardized PQC parameter library. The core operational parameters include six categories: modulus q, polynomial order n, coefficient bit width w, modulus reduction operation rules, NTT / INTT transformation factor, and key length parameter. This ensures that all core operational parameters within a single parameter set fully match the official specifications of the corresponding algorithm and security level, with no parameter deviation.

[0029] For each set of fixed parameters, perform pre-calculation of the operation boundary to generate immutable boundary constraint parameters that are bound one-to-one with the parameter set. The boundary constraint parameters include the maximum intermediate state bit width of modular multiplication, the truncation threshold of modular reduction, the address space boundary of polynomial operation, and the legal range of operation values, so as to pre-control the truncation error of modular operation and the risk of data overflow from the source.

[0030] A standardized index mapping rule is established for the standardized PQC parameter library. The index items correspond one-to-one with the algorithm identifier and security level identifier. After receiving the target PQC algorithm identifier and security level identifier from the upper layer business input, the system completes the precise matching of the unique target parameter set from the standardized PQC parameter library according to the index mapping rule, without any matching ambiguity.

[0031] After locking the target parameter set that has been matched, the hardware executable code of the target parameter set is completed, and a parameter configuration frame with a fixed format is generated. At the same time, the boundary constraint parameters bound to the target parameter set are bound one by one with the parameter configuration frame to ensure that the parameter configuration frame can be directly used for hardware adaptation configuration of reconfigurable logic units.

[0032] The physical isolation between the fixed static control domain and the independently reconfigurable dynamic computing domain within the device is specifically implemented as follows: within the reconfigurable logic device, the physical division and hardware isolation between the fixed static control domain and the reconfigurable dynamic computing domain are completed, and it is determined that the static control domain adopts fixed logic implementation, is not reconfigurable, and has a built-in parameter configuration management unit, boundary verification unit, reconfiguration control unit, and cross-clock domain secure interaction unit.

[0033] The dynamic computation domain is divided into four independently reconfigurable subdomains: a reconfigurable modular multiplication array, a reconfigurable modular reduction array, a polynomial transformation acceleration array, and an on-chip parameterized storage array. Each subdomain is equipped with an independent configuration port and hardware gating switch.

[0034] The static control domain completes power-on initialization, loads the index table and boundary verification rules of the standardized PQC parameter library, completes clock locking and reset stabilization of static logic, and outputs a global synchronization clock signal to all subdomains of the dynamic operation domain to complete system-wide clock synchronization. It performs basic logic preloading on the four subdomains of the dynamic operation domain, completes basic function self-tests and interface connectivity verifications for each subdomain, and locks the configuration port of the dynamic operation domain after the verification passes, waiting for parameter configuration instructions.

[0035] The static domain sends parameter configuration frames, and the dynamic domain configures splittable or cascaded modular multiplication operation channels according to the target bit width. In practice, this specifically includes: the parameter configuration management unit of the static control domain sends the parameter configuration frames corresponding to the target parameter set generated by the standardized parsing and pre-mapping steps of the PQC algorithm and security level parameters, as well as the boundary constraint parameters bound to the parameter configuration frames, point-to-point to the reconfigurable modular multiplication operation array of the dynamic operation domain, unlocks the configuration port of the subdomain, and performs parameterized configuration; the reconfigurable modular multiplication operation array determines the hardware adaptation configuration mode of the operation channels according to the coefficient bit width w in the target parameter set. When the target coefficient bit width w ≤ the basic bit width of a single operation unit, the single unit split operation mode is executed, splitting a single basic operation unit into multiple parallel operation channels that are completely matched with the bit width w.

[0036] When the target coefficient bit width w is greater than the basic bit width of a single operation unit, a multi-unit cascade operation mode is executed, cascading adjacent integer basic operation units into a single operation channel that perfectly matches the bit width w. At the same time, the extended bit width of all operation channels is determined to be twice the target coefficient bit width, fully encompassing the entire intermediate value range of the multiplication of two w-bit-width coefficients, ensuring that there is no bit width truncation or data overflow during the modular multiplication operation. After all operation channels are configured, parameter consistency verification is performed. After the verification passes, the configuration port of the reconfigurable modular multiplication operation array is locked, waiting for the operation instruction to start.

[0037] The method of configuring the modulus-reduced simple elements with boundary checks according to the target modulus ensures full matching of the operation bit width, eliminating overflow and truncation errors. Figure 4 In practice, this includes: the parameter configuration management unit of the static control domain, which sends the parameter configuration frame corresponding to the target parameter set generated by the standardized parsing and pre-mapping steps of the PQC algorithm and security level parameters, as well as the boundary constraint parameters bound to the parameter configuration frame, point-to-point to the reconfigurable modular reduction array of the dynamic operation domain, unlocks the configuration port of the subdomain, and performs parameterized configuration; the reconfigurable modular reduction array determines the Barrett modular reduction or Montgomery modular reduction algorithm that matches the target algorithm based on the modulus q and modular reduction operation rules in the target parameter set, pre-calculates the fixed reduction coefficients based on the bit width of the modulus q, and configures the pipeline stage that matches the operation bit width.

[0038] Simultaneously, the standardized parsing and pre-mapping steps of the PQC algorithm and security level parameters pre-calculate the legal truncation threshold for modulo reduction, and set hardware-level truncation boundary verification logic to ensure that only high-order data exceeding the modulus q are reduced, while low-order legal data are directly passed through, completely eliminating computational errors caused by invalid truncation. The boundary verification unit in the static control domain embeds boundary constraint parameters into hardware-level real-time verification logic. For each pipeline output of the modulo reduction operation, a single-clock-cycle bit width and numerical boundary verification is performed. Exceeding the boundary immediately triggers an operation interrupt and parameter re-verification, ensuring that the modulo reduction operation matches the operation bit width throughout, with no data overflow or truncation error. After all configurations are completed, parameter consistency verification is performed. After successful verification, the configuration port of the reconfigurable modulo reduction array is locked, awaiting the start of the operation command.

[0039] The configuration of the full-link synchronous pipeline for polynomial operations specifically includes: the static control domain, based on the polynomial order n in the target parameter set, completes the synchronous pipeline architecture configuration for the entire polynomial operation chain, determines that the four core operation stages—polynomial NTT transformation, modular multiplication of coefficients, modular reduction, and inverse INTT transformation—are configured as a four-stage continuous pipeline, determines that the output of the previous stage pipeline is directly used as the input of the next stage pipeline, sets synchronization registers between each stage pipeline that are perfectly matched to the target parameter bit width, eliminates pipeline timing violations, and ensures that the operation chain runs continuously without bubbles.

[0040] Meanwhile, the static control domain configures the memory access rules of the on-chip parameterized memory array according to the order n of the target polynomial. The on-chip memory array is divided into parallel independent banks that match n. Each bank corresponds to a coefficient group of the polynomial. Address mapping rules that are fully matched with the NTT / INTT operation access mode are configured to ensure that there are no bank conflicts or address violations in the memory access requests of all parallel operation channels within a single clock cycle, providing conflict-free data flow support for the end-to-end synchronous pipeline.

[0041] During the operation, the static control domain continuously monitors the pipeline's running status and data flow timing, corrects inter-stage synchronization deviations in real time, and ensures the stability of timing and the continuity of data flow throughout the entire operation. For multi-task concurrent scenarios, the static control domain allocates independent computing channels and storage bank partitions to each task based on the task's security level and real-time requirements, sets fixed computing time slices and hardware-level priority scheduling rules, and ensures that the computing pipeline of high-priority tasks is uninterrupted, while computing resources of low-priority tasks are dynamically reused. This avoids resource contention and data flow blockage between multiple tasks throughout the process, ensuring the stable and efficient operation of the entire synchronous pipeline.

[0042] The configuration of conflict-free memory access rules based on target parameters enables bubble-free continuous operation of the computing chain, such as... Figure 5In practice, this includes: the static control domain performs parameterized configuration of memory access rules on the on-chip parameterized memory array based on the polynomial order n in the target parameter set, dividing the on-chip memory array into parallel independent banks that perfectly match n, with each bank corresponding to a coefficient group of the polynomial, ensuring that the address space of each bank is independent and does not overlap, thus avoiding memory access conflicts.

[0043] Meanwhile, based on the NTT / INTT transformation access mode corresponding to the target PQC algorithm, an address mapping rule that perfectly matches the mode is configured, and the memory access address allocation logic for each operation channel is determined. This ensures that memory access requests initiated by all parallel operation channels within a single clock cycle can be accurately mapped to different independent banks, with no bank conflicts or address violations, thus guaranteeing smooth data transmission.

[0044] To ensure the smooth operation of the four-stage continuous pipeline for polynomial computation, memory access rules must be strictly synchronized with the computation timing of each stage of the pipeline. This ensures that the timing of memory access requests is perfectly matched with the pipeline output timing, preventing pipeline bubbles caused by memory access delays and ensuring that the computation chain runs continuously without bubbles.

[0045] For multi-task concurrent scenarios, based on the security level and real-time requirements of each task, the storage bank partition and computing time slice allocation for each task are determined in the memory access rules. High-priority tasks can occupy the corresponding memory access resources first, while low-priority tasks can dynamically reuse idle memory access resources without affecting high-priority tasks. This avoids memory access resource competition and data flow blockage between multiple tasks throughout the process, further ensuring the bubble-free continuous operation of the computing link. At the same time, it ensures that the memory access operation is consistent with the parameter configuration and computing process of the overall reconfigurable logical unit, supporting the coordinated optimization of flexibility and computing performance.

[0046] The implementation of independent reconfiguration only for subdomains with mismatched parameters in the dynamic domain, while other subdomains remain operational, specifically includes: After receiving the PQC algorithm / security level switching instruction from the upper-layer service, the static control domain first triggers the closing process of the current computation task. After the full pipeline computation of the current computation frame is completed, and the results are output and verified, the computation input port of the dynamic computation domain is locked, the non-sensitive state parameters of the current computation domain are saved, and the migration of sensitive key data between the static and dynamic domains is prohibited. At the same time, the reconfiguration control unit synchronously executes the matching of the new target parameter set, the generation of parameter configuration frames and boundary constraint parameters, and executes them in parallel with the closing process of the current computation task, without any additional waiting delay.

[0047] Subsequently, the static control domain compares the new target parameter set with the existing configuration parameters of each subdomain of the current dynamic computing domain to determine whether the configuration of each subdomain matches the new target parameter set. Subdomains with mismatched parameters are selected, and configuration ports are unlocked only for these subdomains. Independent reconfiguration operations are then performed, and the reconfiguration process strictly follows the requirements of the new target parameter set to update the relevant configurations such as computing channels, pipeline stages, and memory access rules for the corresponding subdomains. For subdomains with matching parameters, their existing configurations remain unchanged, configuration ports are not unlocked, and no reconfiguration operations are performed, maintaining normal operation. This ensures that the computing resources of these subdomains are not wasted, while avoiding the additional latency and resource overhead caused by full array reconfiguration.

[0048] During the reconfiguration process, the static control domain continuously monitors the configuration progress and status of each reconfiguration subdomain to ensure the stability and accuracy of the reconfiguration process. After the independent reconfiguration of all parameter mismatch subdomains is completed, parameter consistency verification and function self-check are immediately performed to ensure that the reconfigured subdomain configuration meets the requirements of the new target parameter set.

[0049] After the reconfiguration verification passes, the new operation process is started. In practice, this includes: after the reconfiguration is completed and the parameter consistency verification and function self-test all pass, the static control domain locks the configuration ports of all subdomains of the dynamic operation domain, prohibiting any unauthorized configuration modifications to ensure the stability of the hardware operation architecture; then, the operation input ports of the dynamic operation domain are unlocked, the normal input channels of upper-layer business data are restored, and the operation control instructions corresponding to the new target parameter set are sent to each subdomain of the dynamic operation domain; the residual data of the previous round of operation in the polynomial operation pipeline is cleared synchronously, the pipeline synchronization state is reset, and the continuous operation process of polynomial NTT transformation, modular multiplication of coefficients, modular reduction, and inverse INTT transformation is started according to the four-level continuous full pipeline architecture and conflict-free memory access rules configured with new parameters; the static control domain monitors the start status of the new operation process, pipeline timing and data flow transmission in real time to ensure that each operation subdomain and storage array operates collaboratively, and that the new operation task starts without delay or abnormality, realizing seamless operation continuity of business after algorithm or security level switching.

[0050] Figure 6A line graph comparing the relative error of modular arithmetic under different coefficient bit widths is presented. The horizontal axis represents the polynomial coefficient bit width commonly used in the NIST standardized PQC algorithm, and the vertical axis represents the relative error of modular arithmetic (logarithmic scale). The red dashed line represents the 0.01% high-precision arithmetic qualification line, visually verifying the accuracy guarantee capability of the present invention. The results show that the method of the present invention maintains a stable relative error within 0.0012% across the full bit width range of 16~64 bits, far below the high-precision qualification line throughout, achieving almost zero-error arithmetic. In contrast, the error of the traditional variable bit width architecture increases from 0.08% to 1.87% as the bit width increases, and the error at a 64-bit bit width is more than 1500 times that of the present invention. This fully verifies that the present invention, through pre-calculated boundary constraints, hardware-level real-time boundary verification, and bit-width adaptive modular multiplication / reduction configuration, solves the pain points of truncation error and data overflow during dynamic switching of the traditional architecture, achieving high-precision modular arithmetic across the full bit width, confirming the core technical advantages of the solution.

[0051] This application also provides an embodiment of an electronic device. The electronic device is manifested in the form of a general-purpose computing device. The components of the electronic device may include, but are not limited to: one or more processors or processing units, memory, and buses connecting different components (including memory and processing units).

[0052] A bus refers to one or more of several bus architectures, including memory buses or memory controllers, peripheral buses, graphics acceleration ports, processors, or local buses using any of the various bus architectures. Examples of these architectures include, but are not limited to, Industry Standard Architecture (ISA) buses, Micro Channel Architecture (MCA) buses, Enhanced ISA buses, Video Electronics Standards Association (VESA) local buses, and Peripheral Component Interconnect (PCI) buses.

[0053] Electronic devices typically include a variety of computer-readable media. These media can be any available media that can be accessed by the electronic device, including volatile and non-volatile media, and removable and non-removable media.

[0054] The memory may include computer-readable media in the form of volatile memory, such as random access memory (RAM) and / or cache memory. Electronic devices may further include other removable / non-removable, volatile / non-volatile computer device storage media. By way of example only, the storage system may be used to read and write non-removable, non-volatile magnetic media.

[0055] The electronic device can also communicate with one or more external devices (e.g., keyboard, pointing device, camera, etc.), may include a display, and may communicate with one or more devices that enable a user to interact with the electronic device, and / or with any device that enables the electronic device to communicate with one or more other computing devices (e.g., network interface card, modem, etc.). This communication can be performed via an input / output (I / O) interface. Furthermore, the electronic device can communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN) and / or public networks, such as the Internet) via a network adapter. The network adapter communicates with other modules of the electronic device via a bus. The processor executes various functional applications and data processing by running programs stored in memory, such as implementing the dynamic post-quantum cryptography implementation method based on reconfigurable logic units provided in the above embodiments of the present invention.

[0056] Finally, it should be noted that the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for implementing dynamic post-quantum cryptography based on reconfigurable logic units, characterized in that, Includes the following steps: Establish a fixed parameter library that includes all security levels of the NIST standardized PQC algorithm. Each set of parameters is bound to the modulus, polynomial order, coefficient bit width, modulo operation rules, and pre-computed operation boundary constraint parameters. After receiving the service instruction, it matches the unique target parameter set and generates a hardware-executable parameter configuration frame; Complete the physical isolation between the fixed static control domain and the independently reconfigurable dynamic computation domain within the device; The static domain sends out parameter configuration frames, while the dynamic domain configures splittable or cascaded modular multiplication operation channels according to the target bit width and configures modular reduction simple elements with boundary checks according to the target modulus, matching the operation bit width throughout the process to eliminate overflow and truncation errors. Configure a full-link synchronous pipeline for polynomial operations, configure conflict-free memory access rules according to target parameters, and achieve bubble-free continuous operation of the operation link; Independent reconfiguration is performed only on subdomains in the dynamic domain where parameters do not match; the remaining subdomains continue to run. A new computation process is started after the reconfiguration verification passes.

2. The method for implementing dynamic post-quantum cryptography based on reconfigurable logic units according to claim 1, characterized in that, The establishment of a fixed parameter library including the full security level of the NIST standardized PQC algorithm includes: establishing a fixed parameter library according to the NIST post-quantum cryptography standardization specification, including the full security level parameter set of the standardized PQC algorithm and excluding non-standard parameters, fixing the core parameters and pre-computed bound boundary constraint parameters for each set of parameters, establishing index mapping rules to achieve accurate matching, and setting up an optimized parameter storage partition to store the optimized parameters.

3. The dynamic post-quantum cryptography implementation method based on reconfigurable logic units according to claim 2, characterized in that, Each set of parameters is bound to the modulus, polynomial order, coefficient bit width, modulus operation rules, and pre-computed operation boundary constraint parameters. After receiving a business instruction, it matches a unique target parameter set and generates a hardware-executable parameter configuration frame. This includes: according to the NIST post-quantum cryptography standardization specifications, binding core operation parameters and pre-computed boundary constraint parameters to each fixed parameter set in the standardized PQC parameter library to pre-control operation errors and overflow risks, establishing index mapping rules, accurately matching a unique target parameter set after receiving a business instruction, encoding it into a hardware-executable set to generate a parameter configuration frame, and binding the boundary constraint parameters to the configuration frame.

4. The method for implementing dynamic post-quantum cryptography based on reconfigurable logic units according to claim 1, characterized in that, The physical isolation between the fixed static control domain and the independently reconfigurable dynamic computing domain within the device includes: within the reconfigurable logic device, dividing and hardware-isolating the non-reconfigurable static control domain and the reconfigurable dynamic computing domain, with the static domain having a built-in control unit, and the dynamic domain being divided into four independently reconfigurable subdomains, each with a configuration port and a gate switch; the static domain completes power-on initialization, loading rules, and synchronizing the clock, and the dynamic domain completes basic logic preloading and self-test, then locks the configuration port to wait for parameter configuration instructions.

5. The dynamic post-quantum cryptography implementation method based on reconfigurable logic units according to claim 4, characterized in that, The static domain sends out parameter configuration frames, and the dynamic domain configures splittable or cascaded modular multiplication operation channels according to the target bit width. This includes: the parameter configuration management unit of the static control domain, which sends the parameter configuration frame corresponding to the target parameter set and the bound boundary constraint parameters point-to-point to the reconfigurable modular multiplication operation array of the dynamic operation domain, and unlocks the configuration port to perform parameterized configuration; the reconfigurable modular multiplication operation array determines the adaptation mode according to the target coefficient bit width, configures the operation channel by splitting a single unit or cascading multiple units, and configures the extended bit width to avoid truncation and overflow. After the configuration is completed, parameter consistency verification is performed. After the verification is passed, the port is locked to wait for operation instructions.

6. The method for implementing dynamic post-quantum cryptography based on reconfigurable logic units according to claim 1, characterized in that, The configuration of the modulo-reduced simple element with boundary verification according to the target modulus, matching the operation bit width throughout the process, and eliminating overflow and truncation errors includes: the static control domain sending the parameter configuration frame and the bound boundary constraint parameters to the reconfigurable modulo-reduced array, and unlocking the port to perform parameterized configuration; the modulo-reduced array determining the appropriate modulo-reducing algorithm based on the target parameters, pre-calculating the reduction coefficients, configuring the pipeline stage, loading the truncation threshold and setting the hardware verification logic, the static domain boundary verification unit solidifying the verification logic for real-time verification, and locking the port after the configuration is completed through consistency verification to wait for the operation instruction, matching the operation bit width throughout the process, and eliminating overflow and truncation errors.

7. The dynamic post-quantum cryptography implementation method based on reconfigurable logic units according to claim 6, characterized in that, The configuration of the polynomial operation full-link synchronous pipeline includes: the static control domain completes the configuration of the polynomial operation full-link synchronous pipeline according to the target parameters, sets multiple core operation stages as continuous full pipelines, sets appropriate synchronization registers between stages to achieve bubble-free continuous operation of the operation link, and configures the parallel independent partitions of the on-chip memory array and the matching address mapping rules according to the target parameters.

8. The method for implementing dynamic post-quantum cryptography based on reconfigurable logic units according to claim 1, characterized in that, The configuration of conflict-free memory access rules according to target parameters to achieve bubble-free continuous operation of the computing link includes: the static control domain performs parameterized configuration of memory access rules for the on-chip parameterized memory array according to the target parameters, divides parallel independent memory partitions and sets address mapping rules to match the algorithm access mode.

9. The method for implementing dynamic post-quantum cryptography based on reconfigurable logic units according to claim 1, characterized in that, The process of performing independent reconfiguration only on subdomains with mismatched parameters in the dynamic domain, while keeping the other subdomains running, includes: after receiving an algorithm or security level switching instruction, the static control domain completes the current computation task, locks the input port of the dynamic computation domain, saves non-sensitive state parameters and isolates sensitive data, synchronously and in parallel generates new parameter configuration information, compares the configuration status of each subdomain of the dynamic computation domain, performs independent reconfiguration only on subdomains with mismatched parameters, and keeps the original running status of subdomains with matching parameters. The reconfiguration process is monitored and controlled in real time, and parameter consistency verification and functional self-check are immediately carried out after the reconfiguration is completed to ensure that the reconfiguration is compliant and effective.

10. The method for implementing dynamic post-quantum cryptography based on reconfigurable logic units according to claim 1, characterized in that, After reconfiguration and parameter consistency verification, and function self-test pass, the static control domain locks all subdomain configuration ports of the dynamic operation domain, unlocks the operation input ports, issues operation control instructions corresponding to the new target parameters, clears pipeline residual data, resets synchronization status, and starts a new operation process.

Images