Scloud+ anti-side channel matrix multiplication acceleration method based on avx2 instruction set

Abstract

This invention discloses a side-channel resistant matrix multiplication acceleration method for Scloud+ based on the AVX2 instruction set, comprising: inputting the matrix and performing adaptive preprocessing; shuffling ground state initialization and random number seeding; blocking side-channel leakage through constant-time blind shuffling addressing mapping based on L1 cache topology, achieving effective immunity to advanced side-channel attacks such as DPA / EMA / SASCA; solving the problem of mismatched SIMD column dimensions through stack sandbox zero-filling; and achieving implicit modulo operation using vector parallel multiplication and addition based on congruent overflow characteristics, combined with logarithmic reduction trees to complete full-vector closed-loop acceleration. This invention significantly improves matrix multiplication throughput while maintaining the high security of Scloud+, solving the problem of balancing side-channel protection and vectorization acceleration in unstructured LWE algorithms, and is suitable for high-security real-time scenarios such as cloud encryption, high-concurrency TLS, and 5G edge computing.

Description

Technical Field

[0001] This invention relates to the fields of computer architecture, microarchitecture instruction set optimization and post-quantum cryptography, and in particular to a method for accelerating Scloud+ side-channel matrix multiplication based on the AVX2 (Advanced Vector Extensions 2) instruction set. Background Technology

[0002] With the development of quantum computing, quantum polynomial-time solving algorithms such as Shor's algorithm can break traditional public-key cryptosystems based on large integer factorization (such as the RSA algorithm) and discrete logarithm problems (such as the ECC algorithm) in a very short time, prompting the cryptographic community to fully migrate to quantum-resistant cryptography, i.e., post-quantum cryptography (PQC).

[0003] Lattice cryptography based on fault-tolerant learning (LWE) is a mainstream approach. Depending on whether the underlying mathematical model includes algebraic ring structures, it is divided into structured LWE and unstructured LWE. Structured LWE (such as Kyber) achieves a significant leap in efficiency by introducing algebraic structures such as rings and modules, but it is vulnerable to algebraic attacks. Unstructured LWE (such as FrodoKEM and Scloud+) make no additional algebraic structure assumptions, and its security can be reduced to the worst-case difficulty of the standard lattice problem, making it suitable for high-security scenarios. However, due to the lack of computational shortcuts provided by algebraic structures, the core operation in its decapsulation process is large-scale, high-density unstructured matrix-vector multiplication. Scalar serial implementations suffer from high clock cycle overhead and high memory access latency, failing to meet the real-time requirements of cloud encryption, TLS handshakes, and 5G edge computing. Even with conventional AVX2 vectorization optimization, the inherent mismatch between the non-integer multiples of Single Instruction Multiple Data (SIMD) column dimensions of Scloud+ (e.g., n=600 at 128-bit security level) and the 256-bit physical register width prevents the full utilization of SIMD parallel computing power, resulting in extremely limited optimization benefits.

[0004] Furthermore, the existing Scloud+ standard implementation uses a basic constant-time coding rule, which has a serious side-channel leakage defect: the core matrix multiplication uses an ijk fixed scalar loop, and the execution order, memory access mode, and iteration process are completely static. The secret vector elements are strongly bound to the operation timing, power consumption / electromagnetic characteristics. Attackers can recover the key completely with only a few hundred or even a single trajectory through differential power analysis (DPA), electromagnetic analysis (EMA), and soft analysis side-channel attacks (SASCA). Conventional protection schemes have an irreconcilable contradiction between security and performance, manifested in: 1) randomized shuffling of the execution order easily leads to cross-cache line access, with a performance loss of over 20%, and introduces cache timing leakage; 2) mask protection increases the computational load by more than 3 times, which conflicts with AVX2 vectorization and offsets the speedup benefits.

[0005] Therefore, achieving side-channel resistance and high throughput acceleration without significant performance loss is the core challenge for the engineering implementation of Scloud+. Summary of the Invention

[0006] To address the problems existing in the engineering of the Scloud+ unstructured LWE algorithm, this invention proposes an Scloud+ side-channel resistant matrix multiplication acceleration method based on the AVX2 instruction set. The aim is to achieve high-level side-channel resistant protection and extreme vectorized computing power acceleration while retaining the algorithm's original high security characteristics.

[0007] This invention adopts the following technical solution: a method for accelerating Scloud+ side-channel matrix multiplication based on the AVX2 instruction set, comprising the following steps:

[0008] Step 1: Receive the data of the input matrix and the three-valued secret vector, and obtain the pointer to the output array used to store the results. Perform adaptive preprocessing based on whether the column dimension of the input matrix is ​​divisible by 16.

[0009] Step 2: Generate the shuffled index ground state through shuffled ground state initialization, and seed it using hardware physical true random numbers to complete the engine state initialization of the pseudo-random number generator;

[0010] Step 3: Perform constant-time blind shuffle addressing mapping based on L1 Cache topology. Execute the constant-time Fisher-Yates reverse shuffle algorithm inside the register to complete the random permutation of the shuffle index, thus isolating the source of side-channel risk from the hardware physical layer.

[0011] Step 4: Based on the congruent overflow characteristics, the vector parallel multiply-add operation loads the corresponding block data according to the random permutation shuffle index, and based on the natural congruent relationship between the algorithm modulus and the register bit width, the multiply-add operation is directly executed in the 16-bit concurrent channel. The implicit modulus is realized by using the processor hardware's native overflow wraparound truncation mechanism, avoiding the explicit anti-overflow widening instruction.

[0012] Step 5: Based on the vector inner product results of the logarithmic reduction tree, merge and output them. Inside the vector register, construct the logarithmic spatial compression reduction folding tree through step shift and parallel addition to complete the full vector closed-loop parallel merging of partial sums. After performing precise bit masking operation, write it to the corresponding position in the output array.

[0013] As a preferred embodiment, the adaptive preprocessing described in step 1 is used to eliminate the branch overhead and pipeline switching penalty caused by conventional scalar tail stripping, and to construct a purely linear SIMD memory access and computation instruction flow.

[0014] If the column dimension of the input matrix is ​​not divisible by 16, a stack sandbox with a physical address of 32 bytes is allocated on the current thread's stack frame using the compiler's alignment macro. The column dimension of the original matrix is ​​extended backward to the nearest 16 integer multiple of the SIMD boundary. The entire sandbox is initialized with zero values ​​using a memory write instruction. Then, the effective data of the original input matrix and the three-valued secret vector are copied completely to the front effective area of ​​the sandbox memory using a memory block copy instruction, so that the redundant slots at the end of the column dimension are covered with zero values.

[0015] If the column dimension of the input matrix is ​​divisible by 16, the native memory pointer is used directly, and the memory access operation is performed through the unaligned load instruction.

[0016] As a preferred embodiment, step 2, the ground-state initialization of the mixing process, includes:

[0017] Create a shuffle state array that is aligned with the size of a single data cache line of the target processor, ensuring that its physical size does not exceed the capacity of a single cache line, and initialize the corresponding number of cells at the beginning of the array in numerical order according to the preset shuffle pool size, as the shuffle index base state;

[0018] A random seed is generated by a low-level hardware true random number generator, and then seeded into the Advanced Encryption Standard Instruction Set Extension to generate a pseudo-random sequence.

[0019] As a preferred embodiment, the random permutation of the shuffling index in step 3 includes:

[0020] Step 3.1: Traverse backward from the end of the shuffling pool to index 1, generating a 32-bit pseudo-random number in each round; update the state counter, and then perform a single round of AES nonlinear permutation on the state counter to extract a 32-bit unbiased pseudo-random number;

[0021] Step 3.2: The generated pseudo-random number is processed by a mapping function and stored in a 64-bit data type, along with the 32-bit pseudo-random number and the current commutative index range. The product of the two elements is used to extract the high-order result through a bitwise shift operation to replace the regular modulo operation, thus obtaining a random index within the current traversal index range.

[0022] Step 3.3: Swap the shuffle index values ​​of the current traversal index and the random index to generate a randomized addressing mapping relationship, thus disrupting the original fixed execution flow.

[0023] Furthermore, in the constant-time blind shuffle addressing mapping, the blind shuffle block size is dynamically partitioned, satisfying constraints including:

[0024] AVX2 register native adaptation constraints: The size of the shuffle basic block is set to an integer multiple of 16 uint16_t elements to ensure that a single block of data can directly fill one or more complete __m256i 256-bit vector registers;

[0025] Cache physical constraints: The physical size of the shuffle state array is controlled within the physical capacity of a single cache line, so that the shuffle index addressing process does not cross the boundary of a single cache line throughout the entire process;

[0026] Security entropy constraint: Maximize the size of the shuffle pool while satisfying the native adaptation constraints of AVX2 registers and the physical constraints of cache.

[0027] Furthermore, the size of the mixing tank is set as follows:

[0028] At the 128-bit security level, with the input matrix column dimension n=600, the basic block size of a single round of shuffling is 16 uint16_t elements, corresponding to a shuffling pool size of 38 units;

[0029] At the 192-bit security level, with the input matrix column dimension n=896, the basic block size of a single round of shuffling is 16 uint16_t elements, corresponding to a shuffling pool size of 56 units;

[0030] At the 256-bit security level, the input matrix has a column dimension of n=1120, the basic block size of a single round of shuffling is 32 uint16_t elements, and the corresponding shuffling pool size is 35 units. It adopts dual registers and dual-track parallelism.

[0031] As a preferred embodiment, the congruent overflow characteristic described in step 4 is:

[0032] The modulus q of the Scloud+ algorithm is 4096, which is an integer factor of the physical overflow limit of 65536 for the uint16_t data type;

[0033] Based on the fundamental principles of modular arithmetic, this approach avoids explicit overflow prevention and widening instructions. Instead, it directly uses the _mm256_add_epi16 and _mm256_mullo_epi16 instructions to perform multiplication and addition operations within a 16-bit concurrent channel. By leveraging the CPU's native overflow wraparound truncation mechanism, the modular arithmetic is completed, effectively doubling the concurrent channel density of the core multiplication and addition instructions.

[0034] Furthermore, the vector parallel multiply-accumulate operation based on the congruent overflow characteristic executes a purely linear SIMD multiply-accumulate instruction stream according to the randomly permuted shuffled index, including:

[0035] Step 4.1: Traverse the input matrix row by row, and initialize an all-zero __m256i vector accumulator for each row's output result, corresponding to the number of column blocks;

[0036] Step 4.2: Traverse the blocks according to the index order after shuffling, and load the vector data c_vec of the corresponding block from the target memory determined by the adaptive preprocessing according to the preset basic block size;

[0037] For non-aligned column dimensions, the aligned load instruction _mm256_load_si256 is used; for aligned column dimensions, the non-aligned load instruction _mm256_loadu_si256 is used.

[0038] Step 4.3: For each secret vector block, synchronously load the corresponding vector data s_vec, perform 16-bit parallel multiplication using the _mm256_mullo_epi16 instruction, and complete the intra-vector accumulation using the _mm256_add_epi16 instruction.

[0039] As a preferred embodiment, the logarithmic reduction tree described in step 5 includes:

[0040] Step 5.1: By using a cross-bit width data extraction instruction in conjunction with forced type conversion, the accumulated state in the 256-bit vector register is divided into two.

[0041] Step 5.2: Call the byte shift instruction, shifting in steps of 8 bytes, 4 bytes, and 2 bytes respectively. Construct a logarithmic space compression reduction folding tree inside the vector register, and merge the accumulated values ​​of 16 channels into a single value through parallel addition.

[0042] Step 5.3: Perform a &0xFFF bitmask operation on the final result and write it to the corresponding position in the output array.

[0043] Compared with the prior art, the present invention, employing the above technical solution, has the following technical effects:

[0044] 1. Constant-time blind shuffling mechanism for L1 cache topology awareness: This invention uses three major constraints—AVX2 register native adaptation constraint, single cache line physical constraint, and maximum security entropy—to dynamically divide the shuffling block size. It uses hardware true random numbers and AES-NI (Advanced Encryption Standard Instruction Set, AES-NI, corresponding instruction _mm_aesenc_si128) to generate pseudo-random sequences, and performs constant-time Fisher-Yates shuffling in the register to prevent the binding of secret values ​​to physical features, thus being immune to DPA / EMA / SASCA attacks without additional performance loss.

[0045] 2. Adaptive memory access and sandbox zero-fill engine for PQC non-aligned column dimensions: The method of this invention opens a 32-byte aligned stack sandbox for non-aligned column dimensions, and extends zero-fill to a multiple of 16. Aligned loading is used to ensure pipeline continuity; aligned column dimensions are directly loaded with native pointers in an unaligned manner to avoid copy overhead.

[0046] 3. Acceleration of Congruent Overflow and Logarithmic Reduction Tree Vector Loop Closure: The method of this invention utilizes the congruent relationship between the modulus q=4096 and the overflow limit of uint16_t 65536 to achieve implicit modulo taking through hardware overflow, eliminating anti-overflow widening instructions; and adopts a logarithmic reduction folding tree in the register to convert serial scalar accumulation into parallel vector merging, achieving full-process vector loop closure. Attached Figure Description

[0047] Figure 1 This is a flowchart illustrating the overall process of this invention.

[0048] Figure 2 This is a flowchart of the preprocessing process for the sandbox on the non-aligned column dimension stack of the present invention;

[0049] Figure 3 This is a flowchart of the constant-time blind mixing and washing mechanism of the present invention;

[0050] Figure 4 This is a graph showing the performance comparison (median) of embodiments of the present invention under different security levels. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of the application will be further described in detail below with reference to the accompanying drawings. The described embodiments are only a part of the embodiments involved in this invention. All non-innovative embodiments based on these embodiments by other researchers in the art are within the protection scope of this invention. Furthermore, the step numbers in the embodiments of this invention are only set for ease of explanation and do not limit the order of the steps. The execution order of each step in the embodiments can be adaptively adjusted according to the understanding of those skilled in the art.

[0052] This invention provides an AVX2-based Scloud+ anti-side-channel matrix multiplication acceleration method, which abandons the traditional scalar nested loop implementation and conventional software layer mask protection scheme. It achieves a collaborative design of side-channel protection and vectorization acceleration from three dimensions: CPU L1 cache physical boundary, stack memory space topology, and algebraic congruence overflow characteristics.

[0053] The specific objectives of this invention are as follows:

[0054] 1) To address the fatal flaw of side-channel leakage caused by the existing fixed execution flow implementation, and the core contradiction between security and performance in existing protection schemes, a constant-time blind shuffling mechanism that is aware of L1 cache topology is provided, which can effectively immunize against advanced side-channel attacks such as DPA / EMA / SASCA without introducing significant performance loss.

[0055] 2) It solves the vectorization efficiency bottleneck caused by the natural mismatch between the non-integer multiple SIMD column dimensions of Scloud+ and the bit width of AVX2 registers, and provides an adaptive memory access and sandbox zero-fill engine to avoid the triple performance loss caused by conventional tail processing and maintain the high continuity of the SIMD pipeline.

[0056] 3) To address the problem of wasted computing power caused by redundant anti-overflow instructions and serial accumulation operations in conventional vectorization implementations, a vector closed-loop acceleration mechanism based on congruent overflow characteristics and logarithmic reduction trees is provided, which significantly improves the core computing throughput and meets the real-time requirements of high-concurrency commercial scenarios.

[0057] The core technical solution of this invention includes the following three key technical features, which work together to achieve the dual goals of side-channel protection and computing power acceleration.

[0058] Feature 1: Constant-time blind shuffling mechanism that is aware of L1 cache topology.

[0059] To address the shortcomings of existing execution order randomization shuffling schemes, such as secondary side-channel leakage across cache lines and insufficient compatibility with AVX2 vectorization optimization, as well as the risks of differential power analysis (DPA), electromagnetic analysis (EMA), and soft analysis side-channel attack (SASCA) caused by the fixed execution flow of the Scloud+ standard implementation, this invention pushes the anti-side-channel protection logic down to the physical layer of registers and L1 cache, severing the static binding relationship between the logic gate flipping differences of the three-valued secret key {-1,0,1} multiplication operation and the power consumption waveform.

[0060] Specifically, this invention employs a dynamic partitioning algorithm for blind shuffling block size using a PQC (Post-Quantum Cryptography) unstructured LWE algorithm. Based on the following three core constraints, an adaptive algorithm for shuffling block size is designed to adapt to different security levels.

[0061] 1) AVX2 register native adaptation constraints: The size of the shuffle basic block must be set to an integer multiple of 16 uint16_t elements (256 bits in total) to ensure that a single block of data can directly fill a single or multiple complete __m256i 256-bit vector registers, reducing cross-register element rearrangement and vector-scalar field data switching operations.

[0062] By leveraging native adaptation constraints of AVX2 registers, a seamless connection between blind shuffling and AVX2 vectorized multiply-add computation is achieved. This effectively avoids performance losses caused by cross-register element rearrangement and vector-scalar domain switching after shuffling, and solves the core defect of insufficient compatibility between existing shuffling schemes and vectorization optimization. It achieves side-channel protection without introducing additional performance overhead.

[0063] 2) Cache physical constraints: The physical size of the array block_ids that records the shuffle status is controlled within 64 bytes (the standard physical capacity of a single L1 cache line under modern x86_64 architecture), so that the shuffle index addressing does not cross the boundary of a single cache line throughout the entire process.

[0064] By using physical constraints on the cache, the shuffle state data is strictly confined to the L1 cache line, effectively avoiding cache misses caused by crossing cache boundaries during out-of-order replacement. This blocks secondary leakage of timing / cache side channels caused by regular large-scale shuffling from the physical layer of the memory bus, reducing the security risks brought about by the shuffling operation itself.

[0065] 3) Security entropy constraint: While satisfying the above register adaptation and cache physical constraints, maximize the size of the shuffling pool to increase the information entropy of the shuffling state space and enhance the algorithm's resistance to attacks.

[0066] By constraining security entropy, a precise match was achieved between the shuffling granularity and the algorithm's security level, as well as the matrix column dimension. Without breaking the first two constraints, large-size random shuffling state spaces of 38!, 56!, and 35! were constructed respectively. The information entropy contained therein exceeds the brute-force exhaustive capability of current general-purpose computing power, which can effectively disrupt the static alignment relationship of power consumption waveforms and achieve effective protection against mainstream side-channel attacks such as DPA, EMA, and SASCA.

[0067] Based on the above three interconnected constraints, the algorithm adaptively selects the optimal shuffling block size that simultaneously satisfies all three constraints for different matrix column dimensions at different security levels:

[0068] For 128-bit security level (matrix column dimension n=600) and 192-bit security level (matrix column dimension n=896), the basic block size of a single round of shuffling is set to 16 uint16_t elements, corresponding to shuffling pool sizes of 38 units and 56 units, respectively.

[0069] For 256-bit high security level (matrix column dimension n=1120), the basic block size of a single round of shuffling is doubled to 32 uint16_t elements, and with dual register dual-track parallel loading adaptation, the corresponding shuffling pool size is 35 units.

[0070] In addition, during the shuffle index generation stage, a random seed is generated by the underlying hardware True Random Number Generator (TRNG, corresponding to instruction _rdrand64_step), which is then seeded into AES-NI (Advanced Encryption Standard Instruction Set, corresponding to instruction _mm_aesenc_si128) to generate a pseudo-random sequence. The constant-time Fisher-Yates shuffle algorithm is then executed inside the register to complete the random permutation of the shuffle index.

[0071] The above three constraints form a closed-loop linkage of performance, security and physical protection, which effectively solves the industry pain point that it is difficult to balance side-channel protection and vectorization acceleration in existing technologies. While achieving high-level anti-side-channel protection, it fully retains the performance benefits of AVX2 vectorization optimization.

[0072] In summary, this invention achieves source isolation of side-channel risks at the hardware physical layer through a constant-time blind shuffling mechanism that is aware of the L1 cache topology. The core protection effects are as follows:

[0073] 1) Risk of secondary side-channel leakage due to blocking the shuffling operation:

[0074] By using a hard constraint design of a single 64-byte L1 Cache line, the shuffle state data is confined to a single cache line throughout the entire process. This avoids the cross-cache line access and cache miss issues caused by out-of-order addressing in conventional randomized shuffle schemes. It also blocks the secondary leakage risks of timing-side channels and cache-side channels from the physical layer of the memory bus, eliminating the security risks introduced by the protection scheme itself.

[0075] 2) Achieve effective protection against mainstream advanced side-channel attacks:

[0076] By employing the constant-time Fisher-Yates shuffling algorithm, the original fixed-order execution flow is highly randomized, breaking the static binding relationship between the three-valued secret key {-1,0,1} and the operation timing and power consumption waveform. At the same time, the shuffling state space is maximized within the cache constraint, and a random permutation space of up to 56! can be constructed. Its information entropy far exceeds the brute-force limit of current general-purpose computing power, and it can effectively resist mainstream advanced side-channel attacks such as differential power analysis (DPA), electromagnetic analysis (EMA), and soft analysis side-channel attack (SASCA).

[0077] 3) Achieve native compatibility between side-channel protection and vectorized operations:

[0078] By precisely matching the size of the shuffle block with the bit width of the AVX2 register, a seamless connection between blind shuffle operation and AVX2 vectorized multiply-accumulate calculation is achieved, which can achieve side-channel protection without introducing additional performance loss.

[0079] Feature 2: Adaptive memory access and sandbox zero-fill engine for PQC non-aligned column dimensions.

[0080] To address the issue that the non-integer multiple SIMD column dimensions under the 128-bit security level of the Scloud+ algorithm cannot be divided by the 256-bit physical register width of AVX2, the scalar tail stripping and tail masking methods used in conventional AVX2 optimizations will cause multiple performance losses.

[0081] Based on this, this invention designs a branchless dynamic memory adaptive switching and boundary alignment mechanism for the column dimensions of the input matrix under different security levels, avoiding the vectorization optimization loss caused by column dimension mismatch. The stack sandbox mentioned in this invention specifically refers to a private memory buffer within the function stack frame, physically aligned to 32 bytes, allocated for SIMD operations, used to pad input matrices with misaligned column dimensions, ensuring that the column dimensions meet the requirement of being an integer multiple of the AVX2 register bit width.

[0082] 1) Stack sandbox pre-alignment and branchless linear memory access mechanism for non-aligned column dimensions:

[0083] When the program detects during the preprocessing stage that the column dimension of the input matrix cannot be divided by 16 (e.g., n=600 under 128-bit security level), it abandons the conventional approach of scalar tail stripping and tail masking. On the stack frame of the current thread, a stack sandbox with a physical address of 32 bytes is allocated by the compiler alignment macro ALIGN(32), and the column dimension of the original matrix is ​​extended backward to the nearest 16-integer multiple of the SIMD boundary (i.e., 608 dimensions). The entire sandbox is initialized with zero values ​​by the memory write instruction memset, and then the original matrix data is shifted to the front effective area of ​​the sandbox by the memory block copy instruction memcpy, so that the redundant slots at the tail of the column dimension are covered by zero values. In the subsequent SIMD main loop multiply-accumulate instruction stream, the pure linear alignment load instruction _mm256_load_si256 without any condition judgment is issued directly according to the aligned column dimension after padding to complete the data reading.

[0084] This mechanism ensures that zero-valued elements beyond the original column dimension do not affect the correctness of the calculation result during the accumulation and addition operation within the matrix; at the same time, it avoids the three types of performance losses caused by vector-scalar VEX state switching, additional masking operations, and unaligned memory access latency in conventional schemes, and maintains the continuity of the SIMD memory access and computation pipeline.

[0085] 2) Adaptive memory access mechanism using native pointers aligned to column dimensions:

[0086] When the column dimension of the input matrix is ​​perfectly divisible by the 16-element width (e.g., n=896 under a 192-bit security level), the engine skips the stack sandbox construction and zero-filling process; it directly performs memory access operations on the native memory pointer through the unaligned load instruction _mm256_loadu_si256.

[0087] This mechanism avoids unnecessary memory copying overhead and effectively improves memory bandwidth utilization in scenarios involving aligned columns.

[0088] Feature 3: Vector loop acceleration mechanism based on congruent overflow characteristics and logarithmic reduction tree.

[0089] To address the issues of wasted computational power and low efficiency of serial accumulation operations caused by overflow prevention widening instructions in existing scalar and conventional vectorization implementations, this invention optimizes the execution efficiency of core computing units by exploring the correlation between the Scloud+ cryptographic algebraic modulus and the characteristics of x86 processor hardware registers. The vector closed-loop acceleration mechanism described in this invention specifically refers to the entire process, from matrix element loading, multiplication and addition operations to partial summation and reduction merging, being completed within the __m256i vector register. There is no involvement of scalar general-purpose registers or vector-scalar field switching; the computational data and execution logic form a self-contained closed loop within the vector register.

[0090] Specifically, in the partial sum accumulation of matrix dot products and the reduction output stage, an acceleration mechanism integrating hardware features and cryptographic algebra rules is constructed, as follows:

[0091] 1) Physical overflow truncation modulo design based on congruence properties:

[0092] This invention abandons the 32-bit width widening operation commonly used in AVX2 programming to prevent accumulation overflow. It utilizes the Scloud+ algorithm modulus q=4096, which is exactly an integer factor of the physical overflow limit of uint16_t data type 65536 (65536=16×4096), a congruence property. According to the basic principle of modular arithmetic, any value x satisfies: (x mod 65536) mod 4096 ≡ x mod 4096.

[0093] Therefore, by eliminating the widening instructions such as _mm256_madd_epi16 used for overflow prevention in conventional implementations, the multiplication and addition operations are performed directly in the 16-bit concurrent channel using the _mm256_add_epi16 and _mm256_mullo_epi16 instructions, and the modulo operation is completed by utilizing the CPU hardware's native overflow wraparound truncation mechanism.

[0094] This design doubles the concurrent channel density of core multiply-accumulate instructions without compromising operational correctness, reduces instruction throughput pressure by 50%, eliminates redundant overflow prevention widening instructions and explicit modular division operations within loops, and lowers the instruction overhead of core operations.

[0095] 2) Logarithmic O(log n) reduction folding tree design inside the vector register:

[0096] In the final accumulated value merging stage, this invention abandons the conventional method of serial extraction and addition of scalar values. Instead, it uses the bit-width data extraction instruction _mm256_extracti128_si256 in conjunction with type casting to first divide the accumulated state in the 256-bit vector register into two parts. Then, it calls the byte shift instruction _mm_srli_si128 to shift the data in steps of 8 bytes, 4 bytes, and 2 bytes respectively, constructing a logarithmic space-compressed reduction folding tree inside the vector register. This compresses the original serial operation requiring 15 scalar additions into only 4 binary merging operations based on the parallel addition instruction _mm_add_epi16.

[0097] This design eliminates the performance loss caused by vector-scalar state switching, realizes full-vector closed-loop parallel execution of partial sum accumulation operations, effectively improves the execution efficiency of the accumulation stage, and makes full use of the parallel computing capabilities of the AVX2 instruction set.

[0098] Furthermore, in the embodiments of the present invention, corresponding complete implementation methods are provided for the three standard security levels of the Scloud+ algorithm: 128-bit, 192-bit, and 256-bit, respectively, fully reflecting the adaptive design logic of the present invention. The execution steps of all embodiments are matched 1:1 with the corresponding C code implementation.

[0099] The embodiments of the present invention are implemented based on the following general environment:

[0100] Hardware environment: It uses an Intel processor (base frequency 2.60GHz, 32GB memory), 32KB L1 data cache, and a single cache line physical capacity of 64 bytes. It also supports AVX2, AES-NI and RDRAND instruction sets at the microarchitecture level.

[0101] Software Environment: To verify cross-platform stability, this embodiment includes two cross-compilation environments. The Windows native environment uses the MSVC2022 compiler (with O2 optimization enabled); the Linux environment relies on the Windows-based WSL2 subsystem and uses the GCC11.4 compiler (with O3 optimization enabled). The system uniformly defines cross-platform adaptation macros and forces AVX2 instruction set support.

[0102] The algorithm's baseline parameters are: using the standard parameter set of the Scloud+ unstructured LWE algorithm, and the security strength is benchmarked against the three security levels of 128 bits, 192 bits, and 256 bits defined by the NIST post-quantum cryptography standard.

[0103] The core parameter of the algorithm is: cryptographic modulus. The secret vector uses ternary encoding. .

[0104] Example 1: Implementation method under 128-bit security level.

[0105] This embodiment corresponds to a 128-bit post-quantum security strength level. The core parameters of the Scloud+ algorithm are: matrix column dimension n=600 (not divisible by 16, which is a non-aligned column dimension), number of output matrix rows scloudplus_mbar=8, number of output matrix columns scloudplus_nbar=8, shuffling pool size scloudplus_blocks_per_row=38, and alignment padding column dimension scloudplus_padded_n=608.

[0106] The specific implementation steps are as follows: Figure 1 As shown, it includes:

[0107] 1. Output memory initialization:

[0108] The input is a public matrix uint16_t* C, a three-valued secret vector uint16_t* S, and an output array uint16_t* out. The output array out is initialized with global zero values ​​using the memset instruction, and the initial memory size is scloudplus_mbar * scloudplus_nbar * sizeof(uint16_t).

[0109] 2. Preprocessing of non-aligned column dimensions adaptive stack sandbox:

[0110] If the column dimension scloudplus_n=600 is not divisible by 16, perform on-stack sandbox preprocessing. The specific process is as follows: Figure 2 As shown:

[0111] 1) Using the compiler alignment macro ALIGN(32), two memory buffers (stack sandboxes) C_padded and S_padded, each with a physical address of 32 bytes aligned, are allocated on the current thread's stack frame. The dimensions are set to [values ​​to be filled in]. , The original 600 dimensions are padded to the nearest 16-integer multiple boundary dimension of 608.

[0112] 2) The memset instruction is used to initialize the two sandbox memory segments with zero values. Then, the memcpy instruction is used to copy the valid data of the original matrix C and the secret vector S to the front valid area of ​​the sandbox memory. The eight redundant slots at the tail are covered with zero values.

[0113] 3) Subsequent operations are executed entirely based on the aligned sandbox memory, without the need for additional branch checks.

[0114] 3. Initialization of ground state by mixing and washing:

[0115] Create a 64-byte aligned uint8_t block_ids

[64] array, the physical size of which strictly matches the capacity of a single L1 cache line; initialize the first 38 units of the array in the order of 0 to 37 as the shuffle index base state.

[0116] 4. Hardware-based true random number seeding and pseudo-random ground state initialization:

[0117] The 128-bit encryption key aes_key and the 128-bit state iterator aes_state of the AES pseudo-random number generator are maintained using thread-local static storage (TLS), and a thread-local static variable is_initialized is defined to mark the initialization state.

[0118] The UNLIKELY macro marks cold branches, and random number ground state seeding is completed on the first execution:

[0119] 1) Call the hardware true random number generator function get_hardware_true_random(), and obtain a 64-bit hardware true random number through the _rdrand64_step instruction; to resist the failure of the entropy source caused by the instantaneous voltage fluctuation of the silicon wafer, a maximum of 10 spin probe cycles are set to ensure the stability of random number acquisition; if no valid random number is obtained after 10 probes, the timestamp counter value is obtained by XORing with the stack address through the __rdtscp instruction to generate a backup random number.

[0120] 2) After obtaining two sets of 64-bit true random numbers, complete the initial security configuration of aes_key using the _mm_set_epi64x instruction, initialize aes_state to an all-zero vector, and set is_initialized to 1.

[0121] 5. Constant-time blind shuffle addressing mapping generation:

[0122] The detailed execution flow of the constant-time blind mixing and washing mechanism of this invention is as follows: Figure 3 As shown, this specifically includes: executing a constant-time Fisher-Yates reverse shuffle algorithm inside the register to complete the random permutation of the shuffle index:

[0123] 1) Traverse backward from the end of the shuffling pool (index 37) to index 1. In each round, generate a 32-bit pseudo-random number using the fast_aes_prng function: first update the aes_state state counter using the _mm_add_epi64 instruction, then execute the _mm_aesenc_si128 instruction to perform a single round of AES nonlinear permutation on the state, and finally extract a 32-bit pseudo-random number using the _mm_cvtsi128_si32 instruction.

[0124] 2) The generated pseudo-random number is processed by the fast_bound mapping function: This function stores the product of the 32-bit pseudo-random number and the current commutative index range (i+1) using a 64-bit data type. It extracts the high-order result through bit shifting operations to replace the regular modulo instruction and ensures that the probability of the modulo result is almost equal. There are no branches or secret-related condition jumps throughout the process, and finally 0~i (the random index in the current traversal index range) is obtained.

[0125] 3) Swap the shuffle index values ​​of the current traversal index and the random index, without any secret-related conditional jumps throughout the process, and finally generate a randomized addressing mapping relationship, disrupting the original fixed execution flow.

[0126] 6. Parallel vector multiplication and addition based on congruent overflow characteristics:

[0127] Performing a purely linear SIMD operation based on the shuffled random index, the core steps are as follows:

[0128] 1) Traverse the input public matrix C row by row, and initialize scloudplus_nbar all-zero __m256i vector accumulators sum[j] for the output result of each row (scloudplus_nbar is 8 in this embodiment under 128-bit security level).

[0129] 2) Traverse the blocks in the order of the shuffled indexes. Each block has 16 uint16_t elements. Load the vector data c_vec of the corresponding block from the sandbox memory using the alignment load instruction _mm256_load_si256.

[0130] 3) For each secret vector block, load the corresponding vector data s_vec synchronously, perform 16-bit parallel multiplication using the _mm256_mullo_epi16 instruction, and complete the intra-vector accumulation using the _mm256_add_epi16 instruction.

[0131] 4) The entire process utilizes the congruence of modulus q=4096 and uint16_t overflow limit 65536, using the processor hardware native overflow wrap-around mechanism as the natural modulo operation unit, without the need for additional 32-bit width expansion instructions and explicit modulo division operations.

[0132] 7. Merge and output the results based on the logarithmic reduction tree:

[0133] For the partial sums in the vector accumulator, perform register-based closed-loop reduction and merging:

[0134] 1) The 256-bit vector accumulator is split into two 128-bit vectors, high and low, by the instruction _mm256_extracti128_si256. The first merging is completed by parallel addition using _mm_add_epi16, resulting in a 128-bit merged vector sum128.

[0135] 2) Using 8-byte, 4-byte, and 2-byte spans respectively, vector shifting and parallel addition are performed using the _mm_srli_si128 instruction to construct a logarithmic O(log n) reduction folding tree, merging the accumulated values ​​of the 16 channels into a single value.

[0136] 3) Perform a &0xFFF bitmask operation on the final result (equivalent to mod4096) and write it to the corresponding position in the output array out.

[0137] 8. Sensitive memory cleanup

[0138] After the operation is completed, the memset instruction is used to overwrite the sandbox memory C_padded and S_padded on the stack with a global zero value to clear sensitive data residue.

[0139] Example 2: Implementation method under 192-bit security level.

[0140] This embodiment corresponds to a 192-bit quantum security strength level. The core parameters of the Scloud+ algorithm are: matrix column dimension n = 896 (divisible by 16, representing the aligned column dimension), number of output matrix rows scloudplus_mbar = 8, number of output matrix columns scloudplus_nbar = 8, and shuffling pool size scloudplus_blocks_per_row = 56. The core differences in the specific implementation steps compared to Embodiment 1 are as follows:

[0141] 1. Upon detecting that the input column dimension n=896 is divisible by 16, the stack sandbox construction, zero-filling, and data copying processes are adaptively skipped, and the native memory pointers of the input matrix C and secret vector S are directly used as the memory access base address.

[0142] 2. The effective length of the shuffle index array block_ids is set to 56 units, and the size of a single shuffle block is 16 uint16_t elements.

[0143] 3. Vector data loading uses the unaligned load instruction _mm256_loadu_si256, which reads data directly from native memory without requiring forced address alignment, thus avoiding undefined behavior.

[0144] 4. Traverse the input public matrix C row by row, and initialize scloudplus_nbar all-zero __m256i vector accumulators sum[j] for the output result of each row (scloudplus_nbar is 8 in this embodiment under 192-bit security level).

[0145] 5. The sandbox-sensitive memory cleanup step is not included in the stack; the rest of the implementation process is completely consistent with Example 1.

[0146] Example 3: Implementation method under 256-bit security level.

[0147] This embodiment corresponds to a 256-bit post-quantum security strength level. The core parameters of the Scloud+ algorithm are: matrix column dimension n = 1120 (divisible by 32, a high-security aligned column dimension), number of output matrix rows scloudplus_mbar = 12, number of output matrix columns scloudplus_nbar = 11, and shuffling pool size scloudplus_blocks_per_row = 35. The core differences in the specific implementation steps compared to Embodiment 1 are as follows:

[0148] 1. If the input column dimension n=1120 is divisible by 32, the on-stack sandbox preprocessing process is automatically skipped, and the native memory pointer is used directly for memory access.

[0149] 2. The effective length of the shuffle index array block_ids is set to 35 units, and the size of a single shuffle block is doubled to 32 uint16_t elements.

[0150] 3. The vector multiplication and addition stage adopts a dual-register, dual-track parallel loading design. In a single iteration, two consecutive __m256i vectors c_vec_0 and c_vec_1 are loaded simultaneously, and the multiplication and addition operations are performed synchronously before the results are merged. The number of elements processed in a single iteration is doubled.

[0151] 4. Vector data loading uses the unaligned loading instruction _mm256_loadu_si256.

[0152] 5. Iterate through the input public matrix C row by row, and initialize scloudplus_nbar all-zero __m256i vector accumulators sum[j] for the output of each row (in this embodiment, scloudplus_nbar is 11 under the 256-bit security level);

[0153] 6. The sandbox-free sensitive memory cleanup step is omitted, and the rest of the implementation process is completely consistent with Example 1.

[0154] The following is a comparison table of core parameters for different safety level embodiments of the present invention:

[0155]

[0156] Furthermore, to verify the performance acceleration effect of the method of the present invention, performance tests were conducted based on the aforementioned processor platform. The test method involved performing 100 independent samplings on the KEM decapsulation core operation process, and taking the median number of cycles as the final test result to ensure that the data was stable and reproducible. The benchmark was the standard scalar implementation provided by the original author of Scloud+.

[0157] The core computation cycle of this invention is compared with that of the original author's baseline scheme, for example. Figure 4 As shown, under the three standard security levels of 128-bit, 192-bit, and 256-bit, the acceleration scheme proposed in this invention not only completely offsets the theoretical performance overhead brought about by the introduction of the constant-time blind shuffling mechanism, but also achieves a comprehensive reduction in core computation cycles. Specifically:

[0158] 1) At the 128-bit security level, the median clock cycle decreased from the original author's baseline of 727,751 to 651,883, resulting in a performance improvement of approximately 11.6%;

[0159] 2) At the 192-bit security level, the median clock cycle decreased from 1,391,908 to 1,297,202, resulting in a performance improvement of approximately 7.3%.

[0160] 3) At the 256-bit high security level, thanks to the dual-register dual-track parallel optimization unique to this invention, the median clock cycle is reduced from 2,385,634 to 2,165,518, and the computing performance is improved by about 10.1%.

[0161] The experimental data above fully demonstrates that this invention effectively solves the technical contradiction between high-level side-channel protection overhead and high throughput computing power in the engineering deployment of unstructured LWE algorithms by optimizing the underlying microarchitecture such as congruent overflow truncation and logarithmic reduction tree. Under the premise of ensuring high security, it achieves a significant improvement in matrix multiplication throughput.

[0162] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for accelerating Scloud+ side-channel matrix multiplication based on the AVX2 instruction set, characterized in that, Includes the following steps: Step 1: Receive the data of the input matrix and the three-valued secret vector, and obtain the pointer to the output array used to store the results. Perform adaptive preprocessing based on whether the column dimension of the input matrix is ​​divisible by 16. Step 2: Generate the shuffled index ground state through shuffled ground state initialization, and seed it using hardware physical true random numbers to complete the engine state initialization of the pseudo-random number generator; Step 3: Perform constant-time blind shuffle addressing mapping based on L1 Cache topology. Execute the constant-time Fisher-Yates reverse shuffle algorithm inside the register to complete the random permutation of the shuffle index, thus isolating the source of side-channel risk from the hardware physical layer. In the constant-time blind shuffle addressing mapping, the blind shuffle block size is dynamically partitioned to satisfy constraints. include: AVX2 register native adaptation constraints: The size of the shuffle basic block is set to an integer multiple of 16 uint16_t elements to ensure that a single block of data can directly fill one or more complete __m256i 256-bit vector registers; Cache physical constraints: The physical size of the shuffle state array is controlled within the physical capacity of a single cache line, so that the shuffle index addressing process does not cross the boundary of a single cache line throughout the entire process; Security entropy constraint: Maximize the size of the shuffle pool while satisfying the native adaptation constraints of AVX2 registers and the physical constraints of the cache; Step 4: Based on the congruent overflow characteristics, the vector parallel multiply-add operation loads the corresponding block data according to the random permutation shuffle index, and performs the multiply-add operation directly in the 16-bit concurrent channel based on the congruent relationship between the algorithm modulus and the register bit width. The implicit modulus is achieved by utilizing the processor hardware's native overflow wraparound truncation mechanism, thus avoiding the explicit anti-overflow widening instruction. The congruent overflow characteristic is: The modulus q of the Scloud+ algorithm is 4096, which is an integer factor of the physical overflow limit of 65536 for the uint16_t data type; Based on the fundamental principles of modular arithmetic, the explicit overflow prevention widening instructions are avoided. Instead, the multiply-add operations are performed directly in the 16-bit concurrent channel using the _mm256_add_epi16 and _mm256_mullo_epi16 instructions. The modular arithmetic is completed by utilizing the CPU hardware’s native overflow wraparound truncation mechanism, thus doubling the concurrent channel density of the core multiply-add instructions. Step 5: Based on the vector inner product results of the logarithmic reduction tree, merge and output them. Inside the vector register, construct the logarithmic spatial compression reduction folding tree through step shift and parallel addition to complete the full vector closed-loop parallel merging of partial sums. After performing precise bit masking operation, write it to the corresponding position in the output array.

2. The Scloud+ anti-side-channel matrix multiplication acceleration method according to claim 1, characterized in that, The adaptive preprocessing described in step 1 is used to eliminate the branch overhead and pipeline switching penalty caused by conventional scalar tail stripping, and to construct a purely linear SIMD memory access and computation instruction flow. If the column dimension of the input matrix is ​​not divisible by 16, a stack sandbox with a physical address of 32 bytes is allocated on the current thread's stack frame using the compiler's alignment macro. The column dimension of the original matrix is ​​extended backward to the nearest 16 integer multiple of the SIMD boundary. The entire sandbox is initialized with zero values ​​using a memory write instruction. Then, the effective data of the original input matrix and the three-valued secret vector are copied completely to the front effective area of ​​the sandbox memory using a memory block copy instruction, so that the redundant slots at the end of the column dimension are covered with zero values. If the column dimension of the input matrix is ​​divisible by 16, the native memory pointer is used directly, and the memory access operation is performed through the unaligned load instruction.

3. The Scloud+ anti-side-channel matrix multiplication acceleration method according to claim 1, characterized in that, Step 2, the ground state initialization of the mixed washing, includes: Create a shuffle state array that is aligned with the size of a single data cache line of the target processor, ensuring that its physical size does not exceed the capacity of a single cache line, and initialize the corresponding number of cells at the beginning of the array in numerical order according to the preset shuffle pool size, as the shuffle index base state; A random seed is generated by a low-level hardware true random number generator, and then seeded into the Advanced Encryption Standard Instruction Set Extension to generate a pseudo-random sequence.

4. The Scloud+ anti-side-channel matrix multiplication acceleration method according to claim 1, characterized in that, The random permutation of the shuffled index in step 3 includes: Step 3.1: Traverse backward from the end of the shuffling pool to index 1, generating a 32-bit pseudo-random number in each round; update the state counter, and then perform a single round of AES nonlinear permutation on the state counter to extract a 32-bit unbiased pseudo-random number; Step 3.2: The generated pseudo-random number is processed by a mapping function and stored in a 64-bit data type, along with the 32-bit pseudo-random number and the current commutative index range. The product of the two elements is used to extract the high-order result through a bitwise shift operation to replace the regular modulo operation, thus obtaining a random index within the current traversal index range. Step 3.3: Swap the shuffle index values ​​of the current traversal index and the random index to generate a randomized addressing mapping relationship, thus disrupting the original fixed execution flow.

5. The Scloud+ anti-side-channel matrix multiplication acceleration method according to claim 4, characterized in that, The size of the mixing tank is set as follows: At the 128-bit security level, with the input matrix column dimension n=600, the basic block size of a single round of shuffling is 16 uint16_t elements, corresponding to a shuffling pool size of 38 units; At the 192-bit security level, with the input matrix column dimension n=896, the basic block size of a single round of shuffling is 16 uint16_t elements, corresponding to a shuffling pool size of 56 units; At the 256-bit security level, the input matrix has a column dimension of n=1120, the basic block size of a single round of shuffling is 32 uint16_t elements, and the corresponding shuffling pool size is 35 units. It adopts dual registers and dual-track parallelism.

6. The Scloud+ anti-side-channel matrix multiplication acceleration method according to claim 1, characterized in that, Step 4, which describes the vector parallel multiply-accumulate operation based on congruent overflow characteristics, executes a purely linear SIMD multiply-accumulate instruction stream according to the randomly permuted shuffled index, including: Step 4.1: Traverse the input matrix row by row, and initialize an all-zero __m256i vector accumulator for each row's output result, corresponding to the number of column blocks; Step 4.2: Traverse the blocks according to the index order after shuffling, and load the vector data c_vec of the corresponding block from the target memory determined by the adaptive preprocessing according to the preset basic block size; Step 4.3: For each secret vector block, synchronously load the corresponding vector data s_vec, perform 16-bit parallel multiplication using the _mm256_mullo_epi16 instruction, and complete the intra-vector accumulation using the _mm256_add_epi16 instruction.

7. The Scloud+ anti-side-channel matrix multiplication acceleration method according to claim 6, characterized in that, In step 4.2, for non-aligned column dimensions, the aligned loading instruction _mm256_load_si256 is used; for aligned column dimensions, the non-aligned loading instruction _mm256_loadu_si256 is used.

8. The Scloud+ anti-side-channel matrix multiplication acceleration method according to claim 1, characterized in that, The logarithmic reduction tree described in step 5 includes: Step 5.1: By using a cross-bit width data extraction instruction in conjunction with forced type conversion, the accumulated state in the 256-bit vector register is divided into two. Step 5.2: Call the byte shift instruction, shifting in steps of 8 bytes, 4 bytes, and 2 bytes respectively. Construct a logarithmic space compression reduction folding tree inside the vector register, and merge the accumulated values ​​of 16 channels into a single value through parallel addition. Step 5.3: Perform a &0xFFF bitmask operation on the final result and write it to the corresponding position in the output array.

Images