A topology-aware lightweight cryptographic S-box quantum circuit automated synthesis method and device
Patent Information
- Application Number
- CN202610575011.5
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-04-28
- Publication Date
- 2026-08-14
AI Technical Summary
[0005]（1）启发式量子电路编译方案采用先逻辑综合、后拓扑路由的两阶段流程，存在SWAP门插入导致的电路深度膨胀问题，难以适配带噪声中等规模量子设备即NISQ设备的相干时间限制；且无严格最优性数学证明，无法满足抗量子密码安全评估的严谨性要求
[0032]1、本发明将硬件拓扑约束原生嵌入SMT形式化逻辑编码体系，摒弃了现有技术先综合、后路由的两阶段分离范式，从根源上消除了后置路由带来的SWAP门开销，生成电路天然符合真实量子硬件的拓扑约束，可直接部署执行，无需额外编译适配。
Smart Images
Figure CN122578128A_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of quantum computing and cryptography, specifically relating to a topology-aware, lightweight cryptographic S-box quantum circuit automated synthesis method and apparatus. Background Technology
[0002] Lightweight block ciphers are core encryption algorithms widely used in resource-constrained edge computing scenarios in the Internet of Things (IoT) and in my country's commercial cryptography system. The S-box (replacement box), as the only nonlinear core component in lightweight block ciphers, directly determines the implementation complexity of Grover attacks and the final strength of quantum security resistance of the corresponding cryptographic algorithm due to the resource overhead of its quantum circuit implementation. The post-quantum cryptography security level standard developed by the National Institute of Standards and Technology (NIST) is directly linked to the quantum resource overhead required for exhaustive attacks on cryptographic algorithms. The core consumption of quantum resources is concentrated in the quantum circuit implementation of the nonlinear S-box in the cryptographic algorithm.
[0003] Existing S-box quantum circuit synthesis techniques are mainly divided into two categories: one is the heuristic compilation method, which has strong scalability, but suffers from defects such as non-optimal generated circuits, the introduction of a large number of quantum swap gates (SWAP gates) in post-routing leading to depth expansion, and the lack of mathematical proof of optimality; the other is the precise synthesis method based on SAT / SMT, which can generate theoretically proven optimal circuits, but completely ignores the real hardware topology constraints in practical applications, and generally introduces serious hidden overhead by relaxing the output bit order; in addition, this type of method defaults to adding auxiliary bits, which will trigger the routing barrier effect, and the lack of pruning mechanism leads to extremely low solution efficiency.
[0004] Current problems with S-box quantum circuit synthesis technology:
[0005] (1) The heuristic quantum circuit compilation scheme adopts a two-stage process of logic synthesis first and topology routing later. It has the problem of circuit depth expansion caused by SWAP gate insertion, which is difficult to adapt to the coherence time limit of medium-scale quantum devices with noise, i.e. NISQ devices. Moreover, there is no strict mathematical proof of optimality, which cannot meet the rigorous requirements of quantum cryptography security assessment.
[0006] (2) The precise synthesis scheme based on SAT / SMT is generally based on the ideal fully connected topology assumption for solving, without considering the physical limitation that only adjacent bits of the real quantum chip can be interconnected, and the generation circuit cannot be directly physically executed on the target hardware; and by introducing output bit order permutation relaxation constraint to reduce the difficulty of solving, hidden resource overhead is generated in the scenario of lightweight cryptography multi-round cascading.
[0007] (3) Existing solutions do not recognize the routing wall effect under non-fully connected restricted topologies. They assume that adding auxiliary bits can reduce circuit depth, but the cascaded routing overhead actually caused will offset the benefits of depth optimization. Moreover, the solution space lacks an efficient redundancy pruning mechanism, resulting in low solution efficiency and difficulty in adapting to engineering application requirements. Summary of the Invention
[0008] To address the problems existing in the prior art, this invention provides a topology-aware, lightweight, automated synthesis method and apparatus for cryptographic S-box quantum circuits. This invention constructs formal logic encoding by natively integrating hardware topology constraints, designs constraint models based on the linear nearest neighbor (LNN) routing barrier theory, and achieves strictly in-situ circuit generation with zero auxiliary bits. This significantly reduces the overall quantum bit consumption and routing overhead of the circuit, achieving automated synthesis of optimal S-box quantum circuits with low bandwidth and low overhead as the core objectives.
[0009] To achieve the above-mentioned technical objectives, the technical solution of the present invention includes:
[0010] In a first aspect, the present invention provides a topology-aware, lightweight, cryptographic S-box quantum circuit automated synthesis method, comprising the following steps:
[0011] S1. Based on the topological parameters and physical bit interaction constraints of the target quantum hardware, a topology-aware quantum bit routing constraint model is constructed. The physical connectivity graph model of the quantum hardware is extracted as a spatial routing constraint. The actual physical interaction constraints of the target quantum hardware are natively mapped to Boolean logic variables and constraint clauses in satisfiability module theory (SMT) as formal logic encoding of hardware constraints. The actual physical interaction constraints include hardware topological connectivity constraints and concurrent read / write mutual exclusion constraints for a single physical bit.
[0012] S2. Based on the Boolean truth table transformation rules of the lightweight cryptographic S-box to be synthesized, construct the functional consistency constraints of quantum state mapping; then, force the initial input physical bit index and the final output physical bit index of the quantum circuit to be generated to be equal and bind them together, and combine them with the restriction of not introducing any additional auxiliary qubits to jointly construct the zero-auxiliary-bit strict in-situ realization constraint; then, transform the functional consistency constraints and the zero-auxiliary-bit strict in-situ realization constraints into the state transition equations and boundary equations in SMT, as the formal logical encoding of the S-box function;
[0013] S3. With minimizing the joint cost of the physical depth and physical bit width of the target quantum circuit as the optimization objective, construct a target optimization function; based on the target optimization function, set the depth and width parameters to be verified in the current search iteration, and perform Boolean logic concatenation with the Boolean logic variables and constraint clauses generated in step S1, and the state transition equations and boundary equations generated in step S2, to jointly generate a unified SMT inference instance, thereby constructing a complete SMT constraint coding system for the underlying SMT solving engine to call;
[0014] S4. Input the SMT constraint encoding system into the underlying SMT solving engine for incremental iterative solving. The incremental iterative solving is a layer-by-layer incremental trial-and-error solving. During the iteration process, if the instance cannot be satisfied at the current depth, the smallest unsatisfiable kernel, i.e., the UNSAT kernel, is extracted as a mathematical proof, and the circuit depth parameters are incremented in step S3 to reconstruct the SMT inference instance, thus establishing the precise lower bound of the target hardware's depth under the current quantum circuit width configuration.
[0015] When the iteration converges to a satisfyable state of the precise lower bound of the quantum circuit depth verified by the UNSAT kernel, the depth iteration at the current width is terminated. When it is desired to explore a better value for the joint cost of width and depth, the process returns to step S3 to reset the width parameter and construct the SMT constraint coding system. When all width configuration iterations are completed or the early termination condition is triggered, the target lightweight cryptographic S-box quantum circuit that satisfies the target optimization function and achieves optimal spatiotemporal resource allocation is output.
[0016] Preferably, in step S1, the formal logic encoding of topological connectivity constraints embeds the topological connectivity constraints natively into the SMT solution space by pre-eliminating all multi-quantum gate operations acting on non-topologically connected physical bits; the formal logic encoding of concurrent read-write mutual exclusion constraints serves as a hard execution rule at the hardware level by limiting a single physical bit to participate in at most one quantum gate operation in the same time step.
[0017] Preferably, step S2 further includes a homogeneous redundant branch pruning step: based on the causal dependency between gate operations, a lexicographical partial order constraint is applied to gate operations that have no data dependency in adjacent time steps to eliminate homogeneous redundant search branches in the solution space and improve SMT solution efficiency.
[0018] Preferably, in step S1, the topological arrangement of the topological structure parameters of the quantum hardware is any one of linear nearest neighbor (LNN) topology, two-dimensional grid topology, or ring topology; in step S2, the lightweight cryptographic S-box to be synthesized is a 4-bit lightweight block cipher S-box, and the corresponding cryptographic algorithm is any one of PRESENT, GIFT, SKINNY, or RECTANGLE.
[0019] Preferably, in step S2, the zero-auxiliary-bit strict in-situ realization constraint includes: the bit width of the quantum circuit is exactly equal to the input bit width of the lightweight cryptographic S-box, without allocating any additional auxiliary quantum bit registers; through the boundary equation, the condition that each output quantum state of the lightweight cryptographic S-box is strictly mapped to the initial physical bit register corresponding to the input sequence without any output bit order permutation is embedded as a pre-constraint in the SMT formal logic encoding, so that the final generated target quantum circuit satisfies the in-situ mapping requirement.
[0020] Preferably, in step S2, when generating the target quantum circuit based on the Boolean function mapping rules of the lightweight cryptographic S-box to be synthesized, in order to satisfy the strict reversibility of cryptographic nonlinear operations, the gate type in the target quantum circuit is constrained to be an NCT gate set containing NOT gates, controlled NOT gates, and Toveley gates.
[0021] Preferably, in step S3, the depth-width joint cost is the product of the physical depth of the quantum circuit and the physical bit width; the objective optimization function takes minimizing the depth-width joint cost as its core objective, and also includes the constraint of minimizing the total number of two-qubit gates in the circuit as a supplementary objective for engineering optimization.
[0022] Preferably, in step S3, the SMT constraint coding system further includes circuit physical depth boundary constraints: under the circuit depth set in the current search iteration, it is forcibly stipulated that the gate selection variables corresponding to all time step indices exceeding the circuit depth are always equal to zero, so as to achieve precise constraints on the physical depth of the target quantum circuit.
[0023] Preferably, in step S4, the incremental iterative solution includes: setting an initial lower bound for the search depth; calling the underlying SMT solution engine at the current depth; if the solution engine returns an unsatisfiable result, extracting the minimum unsatisfiable kernel and incrementing the lower bound for the depth; if the solution engine returns a satisfiable result, and the previous depth has been verified as unsatisfiable by the UNSAT kernel, then determining the current depth as the optimal lower bound for the depth, and extracting the gate sequence corresponding to the current model as the target quantum circuit.
[0024] During the iteration process, the completion of all width configuration iterations means that the external width loop ends normally, that is, the optimal depth of each preset width has been verified and solved by the UNSAT kernel; the early termination condition is that when the width is n+1, if the obtained width-depth joint solution is greater than the width n, then early termination is triggered; in addition, if the solution of an SMT instance under a certain width times out, exceeds the computing power capacity limit, or the number of required qubits exceeds the actual available qubit scale of the physical device, then early termination is also performed.
[0025] Secondly, the present invention also provides a topology-aware lightweight cryptographic S-box quantum circuit automated synthesis device, comprising:
[0026] The quantum hardware constraint transformation module is used to construct a topology-aware quantum bit routing constraint model based on the topological parameters and physical bit interaction constraints of the target quantum hardware. It extracts the physical connectivity graph model of the quantum hardware as spatial routing constraints and maps the actual physical interaction constraints of the target quantum hardware to Boolean logic variables and constraint clauses in satisfiability module theory (SMT) as formal logical encoding of hardware constraints. The actual physical interaction constraints include hardware topological connectivity constraints and concurrent read / write mutual exclusion constraints for a single physical bit.
[0027] The S-box constraint transformation module is used to construct functional consistency constraints for quantum state mapping based on the Boolean truth table transformation rules of the lightweight cryptographic S-box to be synthesized. Then, it forces the initial input physical bit index and the final output physical bit index of the quantum circuit to be generated to be equal and binds them together with the constraint of not introducing any additional auxiliary qubits to jointly construct the zero-auxiliary-bit strict in-situ realization constraint. Finally, the functional consistency constraint and the zero-auxiliary-bit strict in-situ realization constraint are transformed into state transition equations and boundary equations in SMT to serve as the formal logical encoding of the S-box function.
[0028] The SMT constraint coding system generation module is used to construct a target optimization function with the goal of minimizing the joint cost of the physical depth and physical bit width of the target quantum circuit. Based on the target optimization function, the depth and width parameters to be verified are set in the current search iteration, and Boolean logic cascaded with the Boolean logic variables and constraint clauses generated in the quantum hardware constraint conversion module and the state transition equations and boundary equations generated in the S-box constraint conversion module to generate a unified SMT inference instance, thereby constructing a complete SMT constraint coding system for the underlying SMT solving engine to call.
[0029] The target lightweight cryptographic S-box quantum circuit generation module is used to input the SMT constraint coding system into the underlying SMT solving engine for incremental iterative solving. The incremental iterative solving is a layer-by-layer incremental trial-and-error solving. During the iteration process, if the instance cannot be satisfied at the current depth, the smallest unsatisfiable kernel, i.e., the UNSAT kernel, is extracted as a mathematical proof. The SMT constraint coding system generation module increments the circuit depth parameter to reconstruct the SMT inference instance and establishes the precise lower bound of the target hardware's depth under the current quantum circuit width configuration.
[0030] When the iteration converges to a satisfyable state that is the precise lower bound of the quantum circuit depth verified by the UNSAT kernel, the depth iteration at the current width is terminated. When it is desired to explore a better value for the joint cost of width and depth, the SMT constraint coding system generation module resets the width parameter to a wider value and constructs the SMT constraint coding system. When all width configuration iterations are completed or the early termination condition is triggered, the target lightweight cryptographic S-box quantum circuit that satisfies the target optimization function and achieves optimal spatiotemporal resource allocation is output.
[0031] Compared with the prior art, the technical effects of the present invention are as follows:
[0032] 1. This invention natively embeds hardware topology constraints into the SMT formal logic coding system, abandoning the existing two-stage separation paradigm of synthesis first and then routing. It eliminates the SWAP gate overhead caused by post-routing from the root, and the generated circuit naturally conforms to the topology constraints of real quantum hardware. It can be directly deployed and executed without additional compilation and adaptation.
[0033] 2. This invention overcomes the routing barrier effect caused by the introduction of auxiliary bits in non-fully connected topologies by strictly in-situ constraints with zero auxiliary bits, thus avoiding hidden overhead caused by output bit order relaxation. Combined with the goal of minimizing the joint depth-width cost, it significantly reduces the overall quantum bit occupancy when cryptographic algorithms are cascaded in multiple rounds, meeting the deployment requirements of resource-constrained scenarios such as the Internet of Things.
[0034] 3. This invention extracts the minimum unsatisfiable kernel, i.e., the UNSAT kernel, through incremental iterative solution, and realizes a computer-verifiable mathematical proof of the optimality of quantum circuits. It establishes a strict lower bound on the circuit depth and solves the problem that existing heuristic schemes cannot provide rigorous proofs of optimality.
[0035] 4. By applying dictionary partial order rules, this invention achieves symmetry breaking preprocessing of the solution space and precise pruning of isomorphic redundant branches, thereby improving the SMT solution efficiency. At the same time, the routing barrier detection mechanism enables early termination of invalid search space, reducing the computational power consumption of the solution and possessing engineering application value. Attached Figure Description
[0036] Figure 1 A flowchart illustrating an automated synthesis method for topology-aware lightweight cryptographic S-box quantum circuits provided in an embodiment of the present invention;
[0037] Figure 2 The diagram shows the quantum circuit implementation of the PRESENT cryptographic S-box under the assumption of an ideal fully connected topology.
[0038] Figure 3 The diagram shows the implementation of the PRESENT cryptographic S-box quantum circuit that satisfies the linear nearest neighbor topological constraint, generated by the method described in this invention. Detailed Implementation
[0039] The principles and features of the present invention are described below with reference to the accompanying drawings. The examples given are only for explaining the present invention and are not intended to limit the scope of the present invention.
[0040] Firstly, this embodiment provides a topology-aware, lightweight, cryptographic S-box quantum circuit automated synthesis method. This method is applied to scenarios involving lightweight cryptographic quantum-resistant security assessment and automated quantum circuit design for resource-constrained NISQ quantum processors. Its core objective is to minimize the joint resource cost of the physical depth and physical bit width of the quantum circuit, making it adaptable to the quantum circuit deployment requirements of resource-constrained terminals such as the quantum Internet of Things. This method is implemented through computer-executable logic encoding and automated reasoning processes. The complete execution process can be found in [reference needed]. Figure 1 The specific implementation steps are as follows:
[0041] First, clarify the basic definitions and input parameters:
[0042] To be synthesized: Boolean permutation function of lightweight cryptographic S-boxes ,in This refers to the input data bit width of the S-box. This embodiment focuses on the mainstream 4-bit lightweight block cipher S-box, including but not limited to the core S-box of algorithms such as PRESENT, GIFT, SKINNY, or RECTANGLE, i.e., setting a constant. .
[0043] Definition of target quantum circuit: The quantum circuit entity to be synthesized. Modeled in the space-time dimension as being composed of Each discrete-time step is a sequence of gate operations comprised of circuit layers. Spatially, the total number of physical qubits allocated to the circuit is denoted as... And satisfy This embodiment is specifically designed for the extremely resource-constrained characteristics of quantum Internet of Things (IoT) devices. Its core principle is to output the optimal solution with zero auxiliary qubits in situ, that is, strictly limiting the allocation of no additional auxiliary qubits and forcing... .
[0044] Reversible Gate Library: To ensure the reversibility of cryptographic logic and the unitarity of quantum state evolution, all gate operations of the circuit must be strictly selected from the standard NCT reversible logic gate library. Specifically, these include: the quantum NOT gate (NOT / X gate) that operates on a single bit, the controlled NOT gate (CNOT / CX gate) with a single control node, and the Toffoli gate (Toffoli / CCX gate) with two control nodes.
[0045] S1. Based on the topological structure parameters and physical bit interaction constraints of the target quantum hardware, a topology-aware quantum bit routing constraint model is constructed. The physical interaction constraints of the hardware topology are natively embedded into the SMT solution space and converted into computer-readable formal logic code.
[0046] S1.1 This embodiment reads the topological arrangement of the target quantum processor and the interaction constraints of adjacent physical bits to clarify the hard, executable quantum gate rules at the hardware level. This embodiment targets the actual physical architecture of current mainstream superconducting quantum computers and reads its corresponding topological graph; this embodiment uses the linear nearest neighbor one-dimensional topology as the core implementation object; inside the computer, the LNN topology is modeled as an undirected path graph. , where vertex set Sideset represents available physical qubits. A unique, physically-level allowed adjacent two-bit interaction channel is defined. Existing technology is based on the PRESENT S-box quantum circuit generated from a fully connected topology; see reference [link / reference]. Figure 2 .
[0047] S1.2. Extracting the physical connectivity graph model of quantum hardware as the core basis for spatial routing constraints, this embodiment declares a Boolean-type gate selection decision variable for each possible gate assignment operation. The semantics of this variable are: if and only if the first... At each time step, the doors in the door vault are executed. hour, To eliminate the need for additional SWAP gates at the source, formal logic encoding is used to force all multi-qubit gates acting on non-topologically connected physical bits to fail. The set of physical bits that are active is The underlying mathematical expression of its topological span constraint is:
[0048] ;
[0049] Deduction: Assuming this embodiment operates with a 4-bit width, the physical bits are... , , , When the SMT solver engine attempts to... and When a CNOT gate is placed between them, its span is If the implied left-hand condition is true, then the forced condition is true. Similarly, if the placement acts on... The Toffoli gate has a span of Similarly, forced scrapping is also achieved. This ensures that the generated quantum circuits naturally satisfy the nearest neighbor interaction constraint, eliminating the need for subsequent routing adaptation.
[0050] S1.3. Based on the noncloning principle of quantum mechanics and the microwave pulse emission mechanism of hardware, design a hardware parallel read / write mutual exclusion constraint code to limit a single physical qubit to participating in at most one quantum gate operation within the same time step, completely eliminating bit resource contention and read / write conflicts within the circuit layer. Its formal logical encoding is as follows:
[0051] ;
[0052] After this step is completed, this embodiment will natively map the topological connectivity constraints and parallel read-write mutual exclusion constraints to Boolean logic variables and constraint clauses in SMT, completing the complete conversion from hardware topological physical interaction constraints to computer-readable formal logic encoding.
[0053] S2. Extract the Boolean truth table transformation rules of the lightweight cryptographic S-box to be synthesized, and construct the functional consistency constraint of the quantum state mapping. Simultaneously, enforce the equality binding between the initial input physical bit index and the final output physical bit index of the quantum circuit. Combined with the constraint of not introducing any additional auxiliary qubits, construct the zero-auxiliary-bit strict in-situ realization constraint. Then, transform the functional consistency constraint and the zero-auxiliary-bit strict in-situ realization constraint into state transition equations and boundary equations in SMT, using these as the formal logical encoding of the S-box function to ensure that the input and output bits of the finally solved quantum circuit are strictly aligned at the physical level, and that the quantum state evolution trajectory is completely consistent with the Boolean function of the S-box.
[0054] S2.1 In this embodiment, the algebraic permutation function of the target lightweight cryptographic S-box is read and expanded into a complete Boolean truth table in the computer. Taking the 4-bit S-box of the PRESENT algorithm as an example, the truth table is [0xC, 0x5, 0x6, 0xB, 0x9, 0x0, 0xA, 0xD, 0x3, 0xE, 0xF, 0x8, 0x4, 0x7, 0x1, 0x2]. Boolean state variables are introduced. Indicates the first The physical bits in the th... The deterministic Boolean state after the step operation. The state evolution of the circuit strictly follows the algebraic normal form of the invertible NCT gate, and the formal logical encoding of the state transition equation is as follows:
[0055] ;
[0056] in, For the door The Boolean activation function corresponding to the control bits. This is an XOR operation. The equation precisely captures the Boolean state evolution trajectory of the circuit, ensuring that the circuit function is strictly consistent with the target S-box.
[0057] S2.2, In-situ boundary constraint coding: The bit width of the quantum circuit is set to be exactly equal to the input bit width of the S-box to be synthesized. No additional auxiliary qubit registers are allocated. All space permutation functions are discarded; through global boundary equations, the S-box output is strictly mapped to the original physical register corresponding to the input after the circuit logic evolution is completed, with no output bit order permutation. A full-state vector is introduced. , indicating the first The formal logical encoding of the full state of the quantum register at each time step and the global boundary equation is as follows:
[0058] ;
[0059] in, For all possible S boxes a kind of input vector, For the target S-box pair input The standard output.
[0060] S2.3. Introducing symmetry breaking techniques, lexicographical constraints are applied to gate operations without data dependencies, pruning isomorphic redundant branches in the solution space, and improving the efficiency of the underlying SMT solution engine. Specifically, a globally unique positive integer identifier is assigned to each specific operation in the gate library. If the door AND gate There are no shared qubits ( (no causal data dependency), and Then apply a partial order constraint: if time step Selected door Then time step Door selection is prohibited This eliminates meaningless isomorphic solution searches and improves solution efficiency.
[0061] S3. Taking the minimization of the depth-width joint cost of quantum circuits as the optimization objective, and combining the topology-aware quantum bit routing constraint model, functional consistency constraint and zero auxiliary bit strict in-situ realization constraint, a complete satisfiability mode theory, namely the SMT constraint coding system, is generated.
[0062] S3.1. Addressing the extremely limited requirements of edge computing terminals such as the quantum Internet of Things (IoT) regarding the number of qubits and the coherence time in this embodiment, this embodiment abandons the single-index optimization strategy and defines a comprehensive DW-cost as the core evolution direction of this embodiment, its expression being:
[0063] ;
[0064] in, To meet the current constraints on circuit physical depth, This is the currently allocated qubit width. This embodiment aims to minimize this. The value is the core optimization objective. For example, for a 4-bit S-cell, if the optimal depth D=14 is obtained when the width W=4 in this embodiment, the cost is 56; if the optimal depth D=12 is obtained when the width is relaxed to W=5, the cost is 60. In this embodiment, the configuration with lower cost W=4 will be preferred to achieve the optimal balance between qubit occupancy and circuit coherence time consumption.
[0065] S3.2 To ensure the solver can accurately sense and optimize the physical depth of the circuit, this embodiment employs strict spatiotemporal layering encoding for the quantum circuit. This embodiment divides the circuit into D discrete time steps, i.e., circuit layers, denoted as... For any selected logic gate It must be strictly bound to a single, unique time step. Above. Subsequently, this embodiment constructs a depth constraint assertion, forcibly stipulating that: when the maximum circuit depth is limited to D, all time step indices... Gate selection variable It must be always equal to 0. This hierarchical encoding mechanism provides precise control points for the incremental deep iterations in subsequent S4.
[0066] S3.3. In this embodiment, a global integration operation is performed, which combines the topological constraints in S1, the functional consistency constraints in S2, and the circuit hierarchical constraints mentioned above in this step using Boolean logic AND (…). The operators are cascaded to generate a globally unified large-scale SMT satisfiability reasoning instance, marked as... .in The physical bit width configured for the current assessment. This specifies the circuit depth limit. This is an instantiated topology graph structure. This unified instance... This marks the completion of the core construction of the integrated framework in the problem modeling phase, and it is ready to serve as direct input to the S4 underlying inference engine.
[0067] S4. Input the SMT constraint coding system into the underlying SMT solving engine for incremental iterative solving. The incremental iterative solving is a layer-by-layer incremental trial-and-error solving. During the iteration process, if the instance cannot be satisfied at the current depth, the minimum unsatisfiable kernel, i.e., the UNSAT kernel, is extracted as a mathematical proof to establish the precise lower bound of the target hardware in the current quantum circuit width configuration. When the iteration converges to a satisfiable state of the circuit's strict lower bound of depth verified by the UNSAT kernel, the iteration is terminated, and the target lightweight cryptographic S-box quantum circuit that satisfies the target optimization function and achieves optimal spatiotemporal resource allocation is output.
[0068] S4.1, This embodiment is for a set width (The initial stage is usually set to the zero auxiliary bit limit, i.e.) ), setting a lower bound for theoretical depth search Construct a corresponding SMT inference instance based on the current width and depth parameters. The inference instance is then input into the underlying SMT engine to perform satisfiability verification. If the solver returns an unsatisfiable signal, it means that the current depth is too shallow to complete the quantum circuit implementation of the S-box; if it returns a satisfiable signal, it means that there exists a legal quantum gate operation path at the current depth that satisfies all topological constraints, functional constraints, and in-situ constraints.
[0069] S4.2 When the solver engine is at a depth When an unsatisfactory result is returned, this embodiment calls the underlying interface to extract the corresponding UNSAT kernel. Based on the completeness of mathematical logic and the reliability of the SMT solver, this UNSAT kernel can serve as a rigorous mathematical proof that can be verified by a computer, demonstrating that under the current hardware parameters, gate library, and constraint system, there is absolutely no solution with a depth less than [a certain value]. The valid circuit structure is obtained. After proving optimality, this embodiment returns to step S3, increments the circuit depth parameter, and reconstructs the SMT inference instance of the corresponding depth to enter the next round of depth iteration solution.
[0070] S4.3 When this embodiment returns a satisfyable signal for the first time at the increased depth, and the previous depth has been rigorously proven to be unsatisfactory by the UNSAT core, the depth is determined to be the minimum physical depth under the current bit width configuration, and the depth iteration process for the current width is terminated. In specific implementations, to further explore the globally optimal value of the joint depth-width cost, this embodiment can increment the bit width parameter. At this time, return to step S3 to reset the width parameter and construct a new SMT inference instance, starting a new round of depth iteration search under the width configuration.
[0071] In this process, this embodiment initiates a routing barrier detection mechanism: In a non-fully connected topology, the newly added auxiliary bits are usually distributed at the topology edge, causing additional long-distance transmission overhead. If this embodiment detects that... The lower bound of depth under the configuration does not decrease but increases, or its joint depth-width cost is inferior to If the configuration fails, a routing barrier is determined to have been triggered. In this embodiment, the early termination module is then activated to block invalid searches to wider dimensions.
[0072] When all iterations are completed or the early termination condition is triggered, this embodiment extracts the SAT solution model with the lowest cost before triggering the routing wall, and uses the output compilation module to reverse map the decision variables to generate the standard quantum assembly instruction set (QASM). Figure 3 As shown, the PRESENT S-box circuit that satisfies LNN topology constraints generated in this embodiment achieves globally optimal allocation of spatiotemporal resources without any post-routing compensation. In this embodiment, iteration completion means that the external width loop ends normally, that is, the optimal depth for each preset width has been verified and solved by the UNSAT kernel. The early termination condition is that when the width is n+1, if the obtained width-depth joint solution is greater than the width n, early termination is triggered; in addition, if the SMT instance under a certain width times out, exceeds the computing power limit, or the number of required qubits exceeds the actual available qubit scale of the physical device, early termination is also performed. In summary, the method provided in this embodiment eliminates the SWAP gate overhead expansion caused by post-routing by natively embedding hardware topology constraints into the SMT formal logic coding system; relying on the physical boundary characteristics of LNN routing barriers, a dynamic monitoring early stopping mechanism is designed to achieve the automated generation of strictly in-situ optimal circuits with zero auxiliary bits; at the same time, the circuit optimality is verifiable through the UNSAT core, and the generated low-width, shallow-depth quantum circuits can be adapted to lightweight cryptographic quantum-resistant security assessments and the deployment requirements of resource-constrained NISQ hardware terminals.
[0073] On the other hand, this embodiment also provides a topology-aware lightweight cryptographic S-box quantum circuit automated synthesis device, including:
[0074] The quantum hardware constraint transformation module is used to construct a topology-aware quantum bit routing constraint model based on the topological parameters and physical bit interaction constraints of the target quantum hardware. It extracts the physical connectivity graph model of the quantum hardware as spatial routing constraints and maps the actual physical interaction constraints of the target quantum hardware to Boolean logic variables and constraint clauses in satisfiability module theory (SMT) as formal logical encoding of hardware constraints. The actual physical interaction constraints include hardware topological connectivity constraints and concurrent read / write mutual exclusion constraints for a single physical bit.
[0075] The S-box constraint transformation module is used to construct functional consistency constraints for quantum state mapping based on the Boolean truth table transformation rules of the lightweight cryptographic S-box to be synthesized. Then, it forces the initial input physical bit index and the final output physical bit index of the quantum circuit to be generated to be equal and binds them together with the constraint of not introducing any additional auxiliary qubits to jointly construct the zero-auxiliary-bit strict in-situ realization constraint. Finally, the functional consistency constraint and the zero-auxiliary-bit strict in-situ realization constraint are transformed into state transition equations and boundary equations in SMT to serve as the formal logical encoding of the S-box function.
[0076] The SMT constraint coding system generation module is used to construct a target optimization function with the goal of minimizing the joint cost of the physical depth and physical bit width of the target quantum circuit. Based on the target optimization function, the depth and width parameters to be verified are set in the current search iteration, and Boolean logic cascaded with the Boolean logic variables and constraint clauses generated in the quantum hardware constraint conversion module and the state transition equations and boundary equations generated in the S-box constraint conversion module to generate a unified SMT inference instance, thereby constructing a complete SMT constraint coding system for the underlying SMT solving engine to call.
[0077] The target lightweight cryptographic S-box quantum circuit generation module is used to input the SMT constraint coding system into the underlying SMT solving engine for incremental iterative solving. The incremental iterative solving is a layer-by-layer incremental trial-and-error solving. During the iteration process, if the instance cannot be satisfied at the current depth, the smallest unsatisfiable kernel, i.e., the UNSAT kernel, is extracted as a mathematical proof. The SMT constraint coding system generation module increments the circuit depth parameter to reconstruct the SMT inference instance and establishes the precise lower bound of the target hardware's depth under the current quantum circuit width configuration.
[0078] When the iteration converges to a satisfyable state that is the precise lower bound of the quantum circuit depth verified by the UNSAT kernel, the depth iteration at the current width is terminated. When it is desired to explore a better value for the joint cost of width and depth, the SMT constraint coding system generation module resets the width parameter to a wider value and constructs the SMT constraint coding system. When all width configuration iterations are completed or the early termination condition is triggered, the target lightweight cryptographic S-box quantum circuit that satisfies the target optimization function and achieves optimal spatiotemporal resource allocation is output.
[0079] Those skilled in the art can adapt the topology-aware routing constraint model to other hardware topologies such as two-dimensional mesh topologies and superconducting quantum processor-specific coupling topologies based on the core method disclosed in this embodiment, adapt the S-box to be synthesized to cryptographic S-boxes of other bit widths such as 8-bit, and adapt the reversible gate library to other general reversible gate libraries such as the Clifford+T gate library. All of the above adaptations do not depart from the core technical concept of this invention and are all within the protection scope of this invention.
Claims
1. A topology-aware, lightweight, cryptographic S-box quantum circuit automated synthesis method, characterized in that, Includes the following steps: S1. Based on the topological parameters and physical bit interaction constraints of the target quantum hardware, a topology-aware quantum bit routing constraint model is constructed. The physical connectivity graph model of the quantum hardware is extracted as a spatial routing constraint. The actual physical interaction constraints of the target quantum hardware are natively mapped to Boolean logic variables and constraint clauses in satisfiability module theory (SMT) as formal logic encoding of hardware constraints. The actual physical interaction constraints include hardware topological connectivity constraints and concurrent read / write mutual exclusion constraints for a single physical bit. S2. Based on the Boolean truth table transformation rules of the lightweight cryptographic S-box to be synthesized, construct the functional consistency constraints of quantum state mapping; then, force the initial input physical bit index and the final output physical bit index of the quantum circuit to be generated to be equal and bind them together, and combine them with the restriction of not introducing any additional auxiliary qubits to jointly construct the zero-auxiliary-bit strict in-situ realization constraint; then, transform the functional consistency constraints and the zero-auxiliary-bit strict in-situ realization constraints into the state transition equations and boundary equations in SMT, as the formal logical encoding of the S-box function; S3. Construct the target optimization function with the goal of minimizing the joint cost of the physical depth and physical bit width of the target quantum circuit; Based on the target optimization function, the depth and width parameters to be verified are set in the current search iteration, and Boolean logic cascaded with the Boolean logic variables and constraint clauses generated in step S1, and the state transition equations and boundary equations generated in step S2, to jointly generate a unified SMT inference instance, thereby constructing a complete SMT constraint coding system for the underlying SMT solving engine to call. S4. Input the SMT constraint coding system into the underlying SMT solving engine for incremental iterative solving. The incremental iterative solving is a layer-by-layer incremental trial-and-error solution. During the iteration process, if the instance is not satisfied at the current depth, the smallest unsatisfiable kernel, i.e., the UNSAT kernel, is extracted as a mathematical proof, and the circuit depth parameter is incremented in step S3 to reconstruct the SMT inference instance, establishing the precise lower bound of the target hardware depth under the current quantum circuit width configuration. When the iteration converges to a satisfyable state of the precise lower bound of the quantum circuit depth verified by the UNSAT kernel, the depth iteration at the current width is terminated. When it is desired to explore a better value for the joint cost of width and depth, the process returns to step S3 to reset the width parameter and construct the SMT constraint coding system. When all width configuration iterations are completed or the early termination condition is triggered, the target lightweight cryptographic S-box quantum circuit that satisfies the target optimization function and achieves optimal spatiotemporal resource allocation is output.
2. The method according to claim 1, characterized in that, In step S1, the formal logic encoding of topological connectivity constraints embeds the topological connectivity constraints natively into the SMT solution space by pre-eliminating all multi-quantum gate operations acting on non-topologically connected physical bits; the formal logic encoding of concurrent read-write mutual exclusion constraints serves as a hard execution rule at the hardware level by limiting a single physical bit to participate in at most one quantum gate operation in the same time step.
3. The method according to claim 1, characterized in that, Step S2 also includes a homogeneous redundant branch pruning step: based on the causal dependency between gate operations, a lexicographical partial order constraint is applied to gate operations that have no data dependency in adjacent time steps to eliminate homogeneous redundant search branches in the solution space and improve SMT solution efficiency.
4. The method according to claim 2, characterized in that, In step S1, the topological arrangement corresponding to the topological structure parameters of the quantum hardware is any one of linear nearest neighbor (LNN) topology, two-dimensional grid topology, or ring topology; in step S2, the lightweight cryptographic S-box to be synthesized is a 4-bit lightweight block cipher S-box, and the corresponding cryptographic algorithm is any one of PRESENT, GIFT, SKINNY, or RECTANGLE.
5. The method according to claim 1, characterized in that, In step S2, the zero-auxiliary-bit strict in-situ realization constraint includes: the bit width of the quantum circuit is exactly equal to the input bit width of the lightweight cryptographic S-box, and no additional auxiliary quantum bit registers are allocated; through the boundary equation, each output quantum state of the lightweight cryptographic S-box is strictly mapped to the initial physical bit register corresponding to the input sequence without any output bit order permutation, and this condition is embedded as a pre-constraint in the SMT formal logic encoding, so that the final generated target quantum circuit satisfies the in-situ mapping requirement.
6. The method according to claim 1, characterized in that, In step S2, when generating the target quantum circuit based on the Boolean function mapping rules of the lightweight cryptographic S-box to be synthesized, in order to satisfy the strict reversibility of cryptographic nonlinear operations, the gate type in the target quantum circuit is constrained to be an NCT gate set containing NOT gates, controlled NOT gates, and Toveley gates.
7. The method according to claim 1, characterized in that, In step S3, the depth-width joint cost is the product of the physical depth of the quantum circuit and the physical bit width; the objective optimization function takes minimizing the depth-width joint cost as its core objective, and also includes the constraint of minimizing the total number of two-qubit gates in the circuit as a supplementary objective for engineering optimization.
8. The method according to claim 1, characterized in that, In step S3, the SMT constraint coding system also includes circuit physical depth boundary constraints: under the circuit depth set in the current search iteration, it is forcibly stipulated that the gate selection variables corresponding to all time step indices exceeding the circuit depth are always equal to zero, so as to achieve precise constraints on the physical depth of the target quantum circuit.
9. The method according to claim 1, characterized in that, In step S4, the incremental iterative solution includes: setting an initial lower bound for the search depth; calling the underlying SMT solution engine at the current depth; if the solution engine returns an unsatisfiable result, extracting the minimum unsatisfiable kernel and incrementing the lower bound for the depth; if the solution engine returns a satisfiable result, and the previous depth has been verified as unsatisfiable by the UNSAT kernel, then the current depth is determined as the optimal lower bound for the depth, and the gate sequence corresponding to the current model is extracted as the target quantum circuit. During the iteration process, the completion of all width configuration iterations means that the external width loop ends normally, that is, the optimal depth of each preset width has been verified and solved by the UNSAT kernel; the early termination condition is that when the width is n+1, if the obtained width-depth joint solution is greater than the width n, then early termination is triggered; in addition, if the solution of an SMT instance under a certain width times out, exceeds the computing power capacity limit, or the number of required qubits exceeds the actual available qubit scale of the physical device, then early termination is also performed.
10. A topology-aware lightweight cryptographic S-box quantum circuit automated synthesis device, characterized in that, include: The quantum hardware constraint transformation module is used to construct a topology-aware quantum bit routing constraint model based on the topological parameters and physical bit interaction constraints of the target quantum hardware. It extracts the physical connectivity graph model of the quantum hardware as spatial routing constraints and maps the actual physical interaction constraints of the target quantum hardware to Boolean logic variables and constraint clauses in satisfiability module theory (SMT) as formal logical encoding of hardware constraints. The actual physical interaction constraints include hardware topological connectivity constraints and concurrent read / write mutual exclusion constraints for a single physical bit. The S-box constraint transformation module is used to construct functional consistency constraints for quantum state mapping based on the Boolean truth table transformation rules of the lightweight cryptographic S-box to be synthesized. Then, it forces the initial input physical bit index and the final output physical bit index of the quantum circuit to be generated to be equal and binds them together with the constraint of not introducing any additional auxiliary qubits to jointly construct the zero-auxiliary-bit strict in-situ realization constraint. Finally, the functional consistency constraint and the zero-auxiliary-bit strict in-situ realization constraint are transformed into state transition equations and boundary equations in SMT to serve as the formal logical encoding of the S-box function. The SMT constraint coding system generation module is used to construct the target optimization function with the goal of minimizing the joint cost of the physical depth and physical bit width of the target quantum circuit. Based on the target optimization function, the depth and width parameters to be verified are set in the current search iteration, and Boolean logic cascaded with the Boolean logic variables and constraint clauses generated in the quantum hardware constraint conversion module and the state transition equations and boundary equations generated in the S-box constraint conversion module to jointly generate a unified SMT inference instance, thereby constructing a complete SMT constraint coding system for the underlying SMT solving engine to call. The target lightweight cryptographic S-box quantum circuit generation module is used to input the SMT constraint coding system into the underlying SMT solving engine for incremental iterative solving. The incremental iterative solving is a layer-by-layer incremental trial-and-error solving. During the iteration process, if the instance cannot be satisfied at the current depth, the smallest unsatisfiable kernel, i.e., the UNSAT kernel, is extracted as a mathematical proof. The SMT constraint coding system generation module increments the circuit depth parameter to reconstruct the SMT inference instance and establishes the precise lower bound of the target hardware's depth under the current quantum circuit width configuration. When the iteration converges to a satisfyable state that is the precise lower bound of the quantum circuit depth verified by the UNSAT kernel, the depth iteration at the current width is terminated. When it is desired to explore a better value for the joint cost of width and depth, the SMT constraint coding system generation module resets the width parameter to a wider value and constructs the SMT constraint coding system. When all width configuration iterations are completed or the early termination condition is triggered, the target lightweight cryptographic S-box quantum circuit that satisfies the target optimization function and achieves optimal spatiotemporal resource allocation is output.