Acceleration method, system, electronic device and medium for PQC-NTT

Abstract

The application provides an acceleration method, system, electronic equipment and medium for PQC-NTT, and belongs to the technical field of cryptographic algorithms. The method comprises the following steps: obtaining a number theory transform pseudo code and architecture characteristic parameters of a target processor; generating optimal expansion factors and pipeline numbers before compilation according to the number theory transform pseudo code and the architecture characteristic parameters; segmenting and recombining an original array according to the optimal expansion factors to obtain a target structure; generating expansion and pipelining code according to the optimal expansion factors, the pipeline numbers and the target structure, and inserting a compilation guide instruction into the expansion and pipelining code. According to the number theory transform pseudo code and the architecture characteristic parameters, the optimal expansion factors and the pipeline numbers are solved through three-dimensional joint modeling, dynamic loop expansion is realized, and the utilization rate of a hardware pipeline is significantly improved. Through dynamic loop expansion, array segmentation-recombination and pipelining cooperation, the running period of an NTT kernel is reduced, and different SIMD bit width processors are adapted.

Description

Technical Field

[0001] This invention relates to the field of cryptographic algorithm technology, and in particular to an acceleration method, system, electronic device and medium for PQC-NTT. Background Technology

[0002] With the finalization of NIST's post-quantum cryptography standard algorithms (CRYSTALS-KYBER, DILITHIUM, etc.), PQC algorithms are rapidly migrating to embedded devices, server CPUs, GPUs, and even smart cards. NTT (Number Theory Transformation), as the most time-consuming kernel in PQC algorithms, accounts for 50% to 80% of the overall runtime, and its performance directly determines the usability of the PQC algorithm. However, with the continuous increase in computational demands, it suffers from drawbacks such as deep static loop unrolling, memory access bit-width mismatch, and pipeline blocking across iteration dependencies. Summary of the Invention

[0003] The present invention aims to solve at least one of the technical problems existing in the prior art, and proposes an acceleration method, system, electronic device and medium for PQC-NTT.

[0004] In a first aspect, embodiments of the present invention provide an acceleration method for PQC-NTT, comprising:

[0005] Obtain the pseudocode for number theory transformations and the architectural feature parameters of the target processor;

[0006] Based on the number theory transformation pseudocode and architectural feature parameters, the optimal expansion factor and pipeline number are generated before compilation;

[0007] The original array is divided and reorganized according to the optimal expansion factor to obtain the target structure;

[0008] The expansion and pipelining code is generated based on the optimal expansion factor, the number of pipelining stages, and the target structure, and compilation guidance instructions are inserted into the expansion and pipelining code.

[0009] In some embodiments, generating the optimal expansion factor and pipeline number before compilation based on the number theory transformation pseudocode and architectural feature parameters includes:

[0010] The register file size and the number of single instruction multiple data stream channels are determined based on the architectural characteristics parameters of the target processor.

[0011] The dependency distance graph is obtained by analyzing the pseudocode of the number theory transformation.

[0012] A three-dimensional joint model is constructed based on the register file size, the number of single instruction multiple data stream channels, and the dependency distance graph.

[0013] The optimal expansion factor and pipeline number are calculated based on the three-dimensional joint model, and a register allocation table is generated based on the optimal expansion factor and pipeline number.

[0014] In some embodiments, the method further includes:

[0015] Detect whether the target processor supports register renaming functionality;

[0016] If the target processor does not support register renaming, the optimal expansion factor is set to a first preset value, and the number of pipeline stages is set to a second preset value; wherein the first preset value is less than the second preset value.

[0017] In some embodiments, the step of segmenting and reorganizing the original array according to the optimal expansion factor to obtain the target structure includes:

[0018] The original array of length N is divided into M subarrays based on the first-level data cache line size, and the starting address of each subarray is aligned to the first-level data cache line size.

[0019] The corresponding elements of adjacent subarrays with the optimal number of expansion factors are bit-concatenated to form the target structure; wherein the width of the target structure matches the bit width of the single instruction multiple data register of the target processor.

[0020] In some embodiments, the method further includes:

[0021] If the target processor supports 128-bit single instruction multiple data stream, the optimal expansion factor is determined to be 2;

[0022] If the target processor supports 512-bit single instruction multiple data stream, the optimal expansion factor is determined to be 8.

[0023] In some embodiments, the method further includes:

[0024] If the compiler does not support the compiler directive, loop unrolling is performed in the header file based on template metaprogramming techniques to replace the function of the compiler directive.

[0025] In some embodiments, the method further includes:

[0026] The program execution performance indicators are obtained based on the processor performance monitoring unit; wherein, the program execution performance indicators include pipeline pause cycle, L1 cache miss rate, and number of packaged instructions;

[0027] When the program's performance metrics are lower than a preset performance threshold, the process returns to the step of generating the optimal expansion factor and pipeline number before compilation based on the number theory transformation pseudocode and architectural feature parameters.

[0028] Secondly, embodiments of the present invention provide an acceleration system for PQC-NTT, comprising:

[0029] The acquisition module is used to acquire the pseudocode of number theory transformation and the architectural feature parameters of the target processor;

[0030] The dynamic loop unrolling and pipeline decision module is used to generate the optimal unrolling factor and pipeline number before compilation based on the number theory transformation pseudocode and architecture feature parameters.

[0031] The array splitting and recombination module is used to split and recombine the original array according to the optimal expansion factor to obtain the target structure;

[0032] The code generation and injection module is used to generate expanded and piped code based on the optimal expansion factor, pipelining level, and target structure, and to insert compilation guidance instructions into the expanded and piped code.

[0033] Thirdly, embodiments of the present invention provide an electronic device, including:

[0034] One or more processors;

[0035] Memory, used to store one or more programs;

[0036] When the one or more programs are executed by the one or more processors, the one or more processors implement any of the methods described above.

[0037] Fourthly, embodiments of the present invention provide a computer-readable medium on which a computer program is stored, the computer program being executed by a processor to implement the steps of any of the methods described above.

[0038] The present invention provides an acceleration method for PQC-NTT, comprising: obtaining number-theoretic transformation pseudocode and architectural feature parameters of the target processor; generating an optimal unrolling factor and pipeline stages before compilation based on the number-theoretic transformation pseudocode and architectural feature parameters; dividing and recombining the original array according to the optimal unrolling factor to obtain the target structure; generating unrolling and pipelined code based on the optimal unrolling factor, pipeline stages, and target structure, and inserting compilation guidance instructions into the unrolling and pipelined code. The present invention solves for the optimal unrolling factor and pipeline stages through three-dimensional joint modeling based on the number-theoretic transformation pseudocode and the architectural feature parameters of the target processor, achieving dynamic cyclic unrolling. This objectively eliminates register pressure imbalance and pipeline bubbles caused by fixed unrolling depth, significantly improving the utilization of the hardware pipeline. Through dynamic cyclic unrolling and configuration of array segmentation-recombination and pipeline coordination, without adding additional hardware, the NTT kernel runtime is reduced by more than 40% through microarchitecture-aware cyclic control and memory data recombination, and it is adaptable to processors with different SIMD bit widths. Attached Figure Description

[0039] Figure 1 A flowchart illustrating an acceleration method for PQC-NTT provided in an embodiment of the present invention;

[0040] Figure 2 This is a schematic diagram of the overall architecture involved in the embodiments of the present invention;

[0041] Figure 3 This refers to the pipeline spatiotemporal graph caused by cross-iteration dependencies in related technologies;

[0042] Figure 4 This is a spatiotemporal diagram of the pipeline involving dynamic cyclic unfolding-pipeline coordination (U=4, P=3) in an embodiment of the present invention;

[0043] Figure 5 This is a schematic diagram involving array segmentation and recombination in an embodiment of the present invention;

[0044] Figure 6 A structural block diagram of an acceleration system for PQC-NTT provided in an embodiment of the present invention;

[0045] Figure 7 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0046] To enable those skilled in the art to better understand the technical solutions of the present invention, exemplary embodiments of the present invention are described below in conjunction with the accompanying drawings, including various details of the embodiments of the present invention to aid understanding. These should be considered merely exemplary. Therefore, those skilled in the art should recognize that various changes and modifications can be made to the embodiments described herein without departing from the scope and spirit of the present invention. Similarly, for clarity and brevity, descriptions of well-known functions and structures are omitted in the following description.

[0047] Where there is no conflict, the various embodiments of the present invention and the features thereof may be combined with each other.

[0048] As used herein, the term “and / or” includes any and all combinations of one or more related enumerated entries.

[0049] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the invention. As used herein, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will also be understood that when the terms “comprising” and / or “made of” are used in this specification, the presence of the stated feature, integral, step, operation, element, and / or component is specified, but the presence or addition of one or more other features, integrals, steps, operations, elements, components, and / or groups thereof is not excluded. Terms such as “connected” or “linked” are not limited to physical or mechanical connections but can include electrical connections, whether direct or indirect.

[0050] Unless otherwise specified, all terms used herein (including technical and scientific terms) have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in commonly used dictionaries should be interpreted as having the meaning consistent with their meaning in the context of the relevant art and the invention, and will not be interpreted as having an idealized or overly formal meaning unless expressly so defined herein.

[0051] In the technical solution of this invention, the collection, storage, use, processing, transmission, provision, and disclosure of user personal information all comply with relevant laws and regulations and do not violate public order and good morals. The use of user data in this technical solution follows relevant national laws and regulations (e.g., the "Information Security Technology - Personal Information Security Specification"). For example: appropriate measures are taken for personal information access control; restrictions are imposed on the display of personal information; the purpose of using personal information does not exceed the scope of direct or reasonable association; and explicit identity targeting is eliminated when using personal information to avoid precisely locating a specific individual.

[0052] The key terms involved in this invention are defined as follows:

[0053] PQC: Post-Quantum Cryptography;

[0054] Kyber: Module Lattice-Based Key Encapsulation Mechanism (standardized as ML-KEM).

[0055] Dilithium: Module Lattice-Based Digital Signature Algorithm (standardized as ML-DSA);

[0056] NTT: Number Theoretic Transform;

[0057] SIMD: Single Instruction Multiple Data;

[0058] SIMD intrinsics, or Single Instruction, or Multiple Data Intrinsics, are a set of high-level functions provided by the compiler that directly map to underlying SIMD instructions (such as SSE / AVX for x86 or NEON for ARM). Developers can directly call these functions in high-level languages ​​such as C / C++ to achieve data-parallel computation without writing assembly code.

[0059] LD: Load;

[0060] CAL: Store;

[0061] ST: Call;

[0062] L1 D-Cache: Level 1 Data Cache.

[0063] In related technologies, open-source solutions such as pqclean, liboqs, and ARM CMSIS mainly adopt the following methods: a) Manually rewrite NTT with SIMD intrinsics, but only perform one loop unrolling; b) Use a fixed 64-bit or 128-bit bit width for loading / storing, without reconstructing the array physical layout; c) There are cross-iteration data dependencies inside the loop body, and the hardware pipeline utilization is less than 40%.

[0064] The aforementioned technical methods have the following drawbacks: the loop unrolling depth is fixed and cannot be dynamically adjusted with the number of iterations, leading to register pressure or pipeline bubbles; multi-level cache line conflicts are not considered, and continuous access to large arrays causes false sharing and bank conflicts; the bit width of a single memory access does not match the bit width of the SIMD register, requiring additional pack / unpack instructions, which occupy the issue slot; the above problems together cause the core NTT to still require >80 k cycles / 1024 points on a 3 GHz desktop CPU, which cannot meet the high-concurrency scenario of key encapsulation ≥100,000 times / second.

[0065] To address at least one of the technical problems existing in the aforementioned related technologies, the present invention provides an acceleration method for PQC-NTT. Figure 1 This is a flowchart illustrating an acceleration method for PQC-NTT provided in an embodiment of the present invention.

[0066] As one embodiment of the present invention, such as Figure 1 As shown, the acceleration method for PQC-NTT includes:

[0067] Step S1: Obtain the pseudocode for number theory transformation and the architectural feature parameters of the target processor;

[0068] Step S2: Generate the optimal expansion factor and pipeline number before compilation based on the number theory transformation pseudocode and architectural feature parameters;

[0069] Step S3: Divide and recombine the original array according to the optimal expansion factor to obtain the target structure;

[0070] Step S4: Generate expansion and pipelining code based on the optimal expansion factor, pipelining stage, and target structure, and insert compilation guidance instructions into the expansion and pipelining code.

[0071] It should be noted that the execution subject in this embodiment can be an electronic device, which can be a computer device with data processing function, or other devices that can achieve the same or similar functions. This embodiment does not limit this. In this embodiment, the execution subject is a computer device as an example for explanation.

[0072] Understandably, in response to the shortcomings of related technologies such as deep static loop unrolling, memory access bit width mismatch, and pipeline blocking across iteration dependencies, this embodiment proposes an acceleration method for PQC-NTT. Through dynamic loop unrolling-pipeline coordination and array splitting-reassembly, it aims to reduce the NTT kernel runtime by more than 40% without adding additional hardware, through microarchitecture-aware loop control and memory data reassembly, and adapt to processors with different SIMD bit widths (128 / 256 / 512 bit).

[0073] Specifically, refer to Figure 2 The overall structure shown in this embodiment automatically generates the optimal expansion factor and pipeline stage number before compilation based on the number of iterations, the number of registers, and the dependency distance. The original large array is divided into parallel-accessible subarrays according to the cache line width, and bit concatenation is used to align a single memory access to the SIMD register bit width. While maintaining the semantics of the algorithm, pipeline bubbles and Pack / Unpack (data packing and unpacking operations) overhead are eliminated, achieving a performance improvement of ≥40% for the PQC algorithm library. The following describes the specific steps.

[0074] In some embodiments, number theory transformation pseudocode and architectural feature parameters of the target processor are obtained.

[0075] In some embodiments, generating the optimal unroll factor and pipeline number before compilation based on the number-theory transform pseudocode and architectural feature parameters includes: determining the register file size and the number of single-instruction multiple-data channels based on the architectural feature parameters of the target processor; analyzing the number-theory transform pseudocode to obtain a dependency distance graph; constructing a three-dimensional joint model based on the register file size, the number of single-instruction multiple-data channels, and the dependency distance graph; calculating the optimal unroll factor and pipeline number based on the three-dimensional joint model; and generating a register allocation table based on the optimal unroll factor and pipeline number.

[0076] Specifically, such as Figure 2 As shown, the dynamic loop unrolling-pipeline decision module (10) is as follows: input NTT pseudocode, target CPU register file size, number of SIMD lanes, and dependency distance graph; output: optimal unrolling factor U, number of pipeline stages P, and register allocation table.

[0077] For example, obtain the target processor's register file size, number of SIMDlanes (single instruction multiple data streams), and dependency distance graph. Simultaneously, input the pseudocode for the number-theoretic transform (NTT) to be optimized.

[0078] Specifically, the optimal unrolling factor and pipeline number are dynamically calculated: based on the obtained register file size, SIMD channel number, dependency distance graph, and iteration count in the NTT pseudocode, a three-dimensional joint model of iteration count, register pressure, and dependency distance is constructed. The optimal loop unrolling factor U and pipeline number P are calculated using this three-dimensional joint model, and the corresponding register allocation table is generated. The generated unrolling factor U and pipeline number P are adapted to the execution capabilities of the target hardware, taking into account the provided hardware parameters and algorithm features.

[0079] For example, static analysis: Scan the input NTT pseudocode, count the number of iterations N in the core loop body, and the number of arithmetic logic operations and memory access operations included in the loop body. Based on the instruction dependencies in the pseudocode, construct a dependency distance graph, identify the data dependencies between instructions, and calculate the dependency distance for data reuse (the number of clock cycles required for one instruction to produce a result before it is used by another instruction). Hardware constraint modeling: Based on the size of the target CPU register file, calculate the upper limit of the total number of registers that can be used to store temporary variables under this architecture; combined with the number of SIMD lanes, calculate the width of data elements that can be processed in parallel for each SIMD operation, and determine the register bit width requirement for a single operation. 3D Joint Modeling and Solution: A 3D joint model of iteration count, register pressure, and dependency distance is established. This model seeks the optimal solution under three constraints: register pressure, dependency distance, and pipeline throughput. The register pressure constraint ensures that the total number of active variables required for the expanded loop body does not exceed the target CPU's register file size. The dependency distance constraint requires that the expanded instruction scheduling must satisfy the order in the dependency distance graph, ensuring that execution only occurs after data is ready. The pipeline throughput constraint utilizes SIMD lanes to execute instructions in parallel, keeping each stage of the pipeline (fetch, decode, execute, memory access, write-back) busy. The optimal expansion factor U (the maximum number of loops that can be expanded without overflowing registers and hiding dependency latency) is solved using this 3D joint model. Simultaneously, the pipeline number P (i.e., dividing the loop body into P pipeline stages based on the size of U and dependency distance to achieve instruction-level parallelism) is also solved. Based on the determined optimal expansion factor U and pipeline number P, specific physical registers are allocated to each temporary variable, intermediate result, and input / output operand in the expanded loop body. A register allocation table is generated, which clearly records the register name corresponding to each variable in the program's lifetime, ensuring direct calling during the code generation phase and avoiding the overhead of dynamic allocation.

[0080] In one example, Figure 3 This illustrates pipeline bubbles caused by cross-iteration dependencies in related technologies (spatiotemporal diagram of NTT core loop pipeline before optimization), such as... Figure 3 As shown, the key issues are analyzed as follows: In the actual dependency mode, there is a data dependency between ST[i] and LD[i], but the dependency distance allows for partial overlap; in the bubble mode, one bubble appears every 3 cycles instead of two bubbles every 4 cycles; the root cause is that due to the store-load dependency, LD[i+1] can only start after ST[i] is completed, but the computational delay between CAL[i] and ST[i] creates a natural interval; in the actual IPC, 14 instructions are completed in 5 iterations within 10 cycles, with an average IPC of 1.4. Figure 4This embodiment illustrates a pipeline with dynamic loop unpacking and pipeline coordination (U=4, P=3) (space-time diagram of the optimized NTT core loop pipeline), as shown below. Figure 4 As shown, the optimization effect analysis is as follows: Bubble elimination: Through loop unrolling (U=4) and pipeline scheduling, all bubbles were completely eliminated; Pipeline saturation: Saturation was achieved starting from the 3rd cycle (IPC=3). Reference Figure 3 and Figure 4 The diagram shows a time-space comparison of the NTT core loop pipeline before and after optimization. Performance comparison: Within the same 10 clock cycles, the related technology completes 4.67 iterations (14 operations), while this embodiment completes 8 iterations (24 operations). The performance improvement using this embodiment is 1.71 times (from the perspective of pipeline utilization only). The comparison shows that the pipeline design using this embodiment is more efficient, successfully eliminating bubbles and improving instruction execution efficiency, thus significantly improving overall performance.

[0081] In some embodiments, the method further includes: detecting whether the target processor supports register renaming; if the target processor does not support register renaming, then setting the optimal expansion factor to a first preset value and setting the pipeline number to a second preset value; wherein the first preset value is less than the second preset value.

[0082] Specifically, an alternative is to automatically downgrade to a pre-defined conservative strategy if the target processor does not support register renaming. In one example, if the target processor, such as the CPU, does not support register renaming, it will downgrade to a conservative strategy with U=1 and P=2.

[0083] For example, determine register renaming support. Detect whether the target processor supports register renaming. If the target processor does not support register renaming, adjust the computation strategy by setting the expansion factor U to 1 and the pipeline number P to 2, generating conservative strategy parameters to prevent execution errors caused by hardware incompatibility.

[0084] In this embodiment, the dynamic loop unrolling-pipeline decision module constructs a three-dimensional joint model including iteration count, register pressure, and dependency distance. Based on the input NTT pseudocode, target CPU register file size, SIMD channel count, and dependency distance graph, this module calculates the optimal loop unrolling factor U and pipeline number P, and outputs the corresponding register allocation table. If the target CPU does not support register renaming, it automatically downgrades to a preset conservative strategy. This embodiment solves for the optimal unrolling factor and pipeline number through three-dimensional joint modeling, enabling dynamic adaptation to processor architectures with different SIMD bit widths (128 / 256 / 512bit). This approach objectively eliminates register pressure imbalance and pipeline bubbles caused by a fixed unrolling depth, significantly improving hardware pipeline utilization and making instruction scheduling more compact.

[0085] In some embodiments, the original array is divided and reorganized according to the optimal expansion factor to obtain the target structure, including: dividing the original array of length N into M subarrays based on the size of the first-level data cache line, and aligning the first address of each subarray to the size of the first-level data cache line; bit-concatenating the corresponding elements of adjacent subarrays with the optimal expansion factor number to form the target structure; wherein the width of the target structure matches the bit width of the single instruction multiple data register of the target processor.

[0086] In some embodiments, the method further includes: if the target processor supports 128-bit single instruction multiple data stream, then the optimal expansion factor is determined to be 2; if the target processor supports 512-bit single instruction multiple data stream, then the optimal expansion factor is determined to be 8.

[0087] Specifically, such as Figure 2 As shown, the array splitting-reassembly engine (20). Segmentation unit (21): Divide the large array A[] of length N into M subarrays A0…Am-1 according to the L1 D-Cache line size (64 B), so that the starting address of each subarray is aligned to 64 B; Reassembly unit (22): Pair the corresponding elements of U adjacent subarrays bit by bit to form a new structure with a width of U×64 bit, ensuring that the U×64 bit SIMD register can be filled in one load / store. Alternative solution: If the target CPU only supports 128 bit SIMD, then U is 2; if it supports 512 bit, then U is 8. In the operation of the PQC algorithm, polynomial multiplication is required. The operation object is usually a polynomial vector with N coefficients (e.g., 1024 or 256 integers). These coefficients are stored continuously in memory to form a large array A[] of length N. The large array A[] is the core data object processed by the NTT kernel.

[0088] For example, such as Figure 5As shown, the array partitioning operation is performed: Based on the determined parameters, the original large array A[] of length N is divided into M subarrays A0…Am-1 according to the line size of the L1 D-Cache (e.g., 64 bytes). This ensures that the starting address of each subarray is aligned to the cache line size. The array partitioning method must adapt to the memory hierarchy to prepare for subsequent data reassembly and wide-width loading. The array reassembly operation is then performed: The corresponding elements of the generated U adjacent subarrays are bit-concatenated to form a new structure (target structure) with a width of U×64 bits. The data bit width of this structure (target structure) matches the bit width of the target processor's SIMD registers. By reassembling the memory layout through bit concatenation, subsequent single memory accesses can directly fill the SIMD registers, eliminating data movement instructions.

[0089] In this embodiment, an array splitting-reassembly engine is configured. The splitting unit divides the original array of length N into M address-aligned subarrays according to the L1 data cache line size. The reassembly unit performs bit-by-bit concatenation on corresponding elements of U adjacent subarrays to form a new structure data layout with a width of U×64 bits, ensuring that the data bit width of a single memory load or store operation matches the bit width of the SIMD register. This embodiment employs cache line-aligned splitting and cross-subarray bit-by-bit concatenation technology, achieving a 1:1 match between the data bit width of a single memory access and the physical SIMD register bit width. This eliminates the original data packing and unpacking instructions, reducing the occupation of instruction issue slots. Simultaneously, the aligned subarray division avoids false sharing and bank conflicts when continuously accessing large arrays, reducing memory access latency.

[0090] In some embodiments, expansion and pipelining code is generated based on the optimal expansion factor, pipelining stage, and target structure, and compilation guidance instructions are inserted into the expansion and pipelining code.

[0091] In some embodiments, the method further includes: if the compiler does not support the compiler directive, performing loop unrolling in the header file based on template metaprogramming techniques to replace the function of the compiler directive.

[0092] Specifically, such as Figure 2 As shown, the code generator and injector (30) automatically generates expanded and piped C / intrinsic code based on the output of the dynamic loop unrolling-pipeline decision module 10 and the array splitting-recombination engine 20, and inserts compiler pragma (e.g., #pragma unroll U, #pragma ivdep); it provides a fallback path: when the compiler does not support pragma, it uses template metaprogramming to complete the expansion in the header file instead.

[0093] For example, optimized code is generated and injected: based on the determined optimal unrolling factor U, pipeline number P, and register allocation table, and combined with the reorganized data structure, unrolled and pipelined code or internal function code is automatically generated. Compiler directives are inserted into the code, such as #pragma unroll U for indicating loop unrolling and #pragma ivdep for asserting vector independence, thereby translating the decisions and layout optimizations into concrete executable code.

[0094] For example, code compilation rollback processing: If it is detected during code generation that the compiler does not support compilation guidance instructions, template metaprogramming technology is used to complete the loop expansion in the header file to achieve the same optimization effect, thereby ensuring the universality and robustness of the optimization scheme in different compilation environments.

[0095] In this embodiment, during the code generation and injection phase, based on the optimal expansion factor U and the reorganized memory layout, expanded and piped code or internal functions are automatically generated, and compiler directives are inserted to assert cross-iteration independence. By eliminating pipeline blockages caused by cross-iteration data dependencies and combining optimized data access patterns, pipeline bubbles and packing / unpacking instruction overhead are eliminated, improving instruction-level parallelism. By eliminating cross-iteration data dependencies within loop bodies and injecting pipeline optimization instructions, pipeline blockage is effectively alleviated, significantly improving instruction-level parallelism efficiency. Experimental data shows that, using the method of this embodiment, under the same hardware conditions, the runtime of NTT forward and reverse transformations is reduced by more than 40%, the overall key encapsulation operation throughput is significantly improved, and the code size increases only slightly, achieving a balance between high performance and low overhead.

[0096] In some embodiments, the method further includes: obtaining program running performance indicators based on the processor performance monitoring unit; wherein the program running performance indicators include pipeline pause cycles, L1 cache miss rate, and number of packaged instructions; when the program running performance indicators are lower than a preset performance threshold, returning to the step of generating the optimal expansion factor and pipeline number before compilation based on the number theory transformation pseudocode and architectural feature parameters.

[0097] Specifically, such as Figure 2 As shown, the runtime performance monitor (40) (optional) reads the number of stall, L1miss, and pack instructions through the CPU PMU; if the performance is lower than expected, it triggers the dynamic loop unrolling-pipeline decision module 10 to recalculate the optimal unrolling factor U and pipeline number P to achieve adaptive re-optimization.

[0098] For example, runtime adaptive re-optimization: During program execution, the processor performance monitoring unit (PMU) reads pipeline stall cycles, L1 cache miss rate, and the number of pack instructions. If the monitored performance metrics are lower than a preset threshold, the optimal unrolling factor U and pipeline number P are recalculated, thus forming a runtime feedback loop that dynamically adjusts optimization parameters based on the actual hardware operating state.

[0099] It should be noted that, compared to the closest liboqs-v0.9.0, when testing CRYSTALS-KYBER-1024 on the same Intel i7-12700K (3.6GHz, AVX2): the NTT forward conversion cycle decreased from 82 k cycles to 47 k cycles, an improvement of 42.7%; the reverse conversion cycle decreased from 85 k cycles to 48 k cycles, an improvement of 43.5%; the overall key encapsulation performance increased from 68,000 times / second to 112,000 times / second; the code size increased by only 3.2%, and no additional third-party dependencies were introduced; it also achieved an acceleration of ≥38% on ARM Cortex-A55 (128-bit SIMD), verifying cross-platform versatility.

[0100] This embodiment, for the first time, uses a three-dimensional joint modeling of iteration count, register pressure, and dependency distance to achieve closed-form solving of the expansion factor U and pipeline stage P. Through dynamic loop expansion technology, multiple instructions are expanded at once. Combined with the automatic generation of the optimal expansion factor and pipeline stage before compilation, the instruction order is rearranged. This allows the processor to switch to executing other instructions in the (N+1)th or (N+2)th loop that do not depend on the data from the Nth iteration while waiting for data in the Nth loop. This keeps each stage of the pipeline busy, eliminating pipeline bubbles and improving instruction-level parallelism efficiency. A memory layout of cache line alignment and cross-subarray bit concatenation is proposed, ensuring a 1:1 match between the SIMD load bit width and the physical memory bit width, eliminating pack / unpack overhead. Through array partitioning and reorganization technology, data is pre-arranged in memory according to cache line alignment and cross-subarray bit concatenation. The physical layout of the data in memory directly matches the format required by the SIMD registers. When a processor, such as a CPU, executes a Load instruction, it can directly fill the SIMD registers at once without any intermediate conversion steps, thus eliminating Pack / Unpack overhead. A three-level collaborative framework—pre-compilation, compile-time, and runtime—is formed at the pure software level, enabling universal application without hardware modification.

[0101] The acceleration method for PQC-NTT provided in this embodiment includes: obtaining number-theoretic transformation pseudocode and architectural feature parameters of the target processor; generating an optimal unrolling factor and pipeline stages before compilation based on the number-theoretic transformation pseudocode and architectural feature parameters; segmenting and recombining the original array according to the optimal unrolling factor to obtain the target structure; generating unrolling and pipelined code based on the optimal unrolling factor, pipeline stages, and target structure, and inserting compilation guidance instructions into the unrolling and pipelined code. In this embodiment, the optimal unrolling factor and pipeline stages are solved through three-dimensional joint modeling based on the number-theoretic transformation pseudocode and architectural feature parameters of the target processor, realizing dynamic cyclic unrolling. This objectively eliminates register pressure imbalance and pipeline bubbles caused by fixed unrolling depth, significantly improving the utilization of the hardware pipeline. Through dynamic cyclic unrolling and configuration of array segmentation-recombination and pipeline coordination, without adding additional hardware, the NTT kernel runtime is reduced by more than 40% through microarchitecture-aware cyclic control and memory data recombination, and it is adapted to processors with different SIMD bit widths.

[0102] Reference Figure 6 , Figure 6 This is a structural block diagram of an embodiment of the acceleration system for PQC-NTT according to the present invention. Figure 6 As shown, the acceleration system for PQC-NTT includes:

[0103] Module 10 is used to acquire the pseudocode of number theory transformation and the architectural feature parameters of the target processor;

[0104] The dynamic loop unrolling and pipeline decision module 20 is used to generate the optimal unrolling factor and pipeline number before compilation based on the number theory transformation pseudocode and architecture feature parameters.

[0105] The array segmentation and recombination module 30 is used to segment and recombine the original array according to the optimal expansion factor to obtain the target structure;

[0106] The code generation and injection module 40 is used to generate expanded and piped code based on the optimal expansion factor, the number of pipelining stages and the target structure, and to insert compilation guidance instructions into the expanded and piped code.

[0107] The acceleration system for PQC-NTT provided in this embodiment solves for the optimal unrolling factor and pipeline stages through three-dimensional joint modeling based on number theory transformation pseudocode and the architectural characteristic parameters of the target processor. This achieves dynamic cyclic unrolling, objectively eliminating register pressure imbalance and pipeline bubbles caused by fixed unrolling depth, and significantly improving hardware pipeline utilization. Through dynamic cyclic unrolling and configuration array splitting-reorganization and pipeline coordination, without adding additional hardware, the NTT kernel runtime is reduced by more than 40% through microarchitecture-aware cyclic control and memory data reorganization, and it is adaptable to processors with different SIMD bit widths.

[0108] Furthermore, for technical details not described in detail in this embodiment of the acceleration system for PQC-NTT, please refer to the acceleration method for PQC-NTT provided in any embodiment of the present invention, which will not be repeated here.

[0109] Based on the same inventive concept, embodiments of the present invention also provide an electronic device. Figure 7 This is a structural block diagram of an electronic device provided in an embodiment of the present invention. Figure 7 As shown, an embodiment of the present invention provides an electronic device including: one or more processors 101, a memory 102, and one or more I / O interfaces 103. The memory 102 stores one or more programs, which, when executed by the one or more processors, cause the one or more processors to implement any of the PQC-NTT-oriented acceleration methods described in the above embodiments; the one or more I / O interfaces 103 are connected between the processor and the memory, configured to enable information interaction between the processor and the memory.

[0110] The processor 101 is a device with data processing capabilities, including but not limited to a central processing unit (CPU); the memory 102 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), and flash memory (FLASH); the I / O interface (read / write interface) 103 is connected between the processor 101 and the memory 102, and can realize information interaction between the processor 101 and the memory 102, including but not limited to a data bus (Bus).

[0111] In some embodiments, the processor 101, memory 102, and I / O interface 103 are interconnected via bus 104, and thus connected to other components of the computing device.

[0112] In some embodiments, the one or more processors 101 include a field-programmable gate array.

[0113] This invention also provides a computer-readable medium. The computer-readable medium stores a computer program, which, when executed by a processor, implements the steps of any of the PQC-NTT-oriented acceleration methods described in the above embodiments. The computer-readable storage medium can be volatile or non-volatile.

[0114] This invention also provides a computer program product, including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code. When the computer-readable code is run in the processor of an electronic device, the processor in the electronic device executes the above-described acceleration method for PQC-NTT.

[0115] Those skilled in the art will understand that all or some of the steps, systems, and apparatuses disclosed above, and their functional modules / units, can be implemented as software, firmware, hardware, or suitable combinations thereof. In hardware implementations, the division between functional modules / units mentioned above does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed collaboratively by several physical components. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, digital signal processor, or microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit (ASIC). Such software can be distributed on a computer-readable storage medium, which may include computer storage media (or non-transitory media) and communication media (or transient media).

[0116] As is known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information, such as computer-readable program instructions, data structures, program modules, or other data. Computer storage media includes, but is not limited to, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), static random access memory (SRAM), flash memory or other memory technologies, portable compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical disc storage, magnetic cartridges, magnetic tape, disk storage or other magnetic storage devices, or any other medium that can be used to store desired information and is accessible to a computer. Furthermore, it is known to those skilled in the art that communication media typically contain computer-readable program instructions, data structures, program modules, or other data in modulated data signals such as carrier waves or other transmission mechanisms, and may include any information delivery medium.

[0117] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0118] The computer program instructions used to perform the operations of this invention may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing state information from the computer-readable program instructions. This electronic circuitry can execute the computer-readable program instructions to implement various aspects of the invention.

[0119] The computer program product described herein can be implemented specifically through hardware, software, or a combination thereof. In one alternative embodiment, the computer program product is specifically embodied in a computer storage medium; in another alternative embodiment, the computer program product is specifically embodied in a software product, such as a software development kit (SDK), etc.

[0120] Various aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0121] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0122] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0123] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction, which contains one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0124] Example embodiments have been disclosed herein, and while specific terminology has been used, it is for illustrative purposes only and should be construed as such, and is not intended to be limiting. In some instances, it will be apparent to those skilled in the art that features, characteristics, and / or elements described in conjunction with particular embodiments may be used alone, or in combination with features, characteristics, and / or elements described in conjunction with other embodiments, unless otherwise expressly indicated. Therefore, those skilled in the art will understand that various changes in form and detail may be made without departing from the scope of the invention as set forth in the appended claims.

Claims

1. An acceleration method for PQC-NTT, characterized in that, include: Obtain the pseudocode for number theory transformations and the architectural feature parameters of the target processor; Based on the number theory transformation pseudocode and architectural feature parameters, the optimal expansion factor and pipeline number are generated before compilation; The original array is divided and reorganized according to the optimal expansion factor to obtain the target structure; The expansion and pipelining code is generated based on the optimal expansion factor, the number of pipelining stages, and the target structure, and compilation guidance instructions are inserted into the expansion and pipelining code.

2. The method according to claim 1, characterized in that, The step of generating the optimal expansion factor and pipeline number before compilation based on the number theory transformation pseudocode and architectural feature parameters includes: The register file size and the number of single instruction multiple data stream channels are determined based on the architectural characteristics parameters of the target processor. The dependency distance graph is obtained by analyzing the pseudocode of the number theory transformation. A three-dimensional joint model is constructed based on the register file size, the number of single instruction multiple data stream channels, and the dependency distance graph. The optimal expansion factor and pipeline number are calculated based on the three-dimensional joint model, and a register allocation table is generated based on the optimal expansion factor and pipeline number.

3. The method according to claim 2, characterized in that, The method further includes: Detect whether the target processor supports register renaming functionality; If the target processor does not support register renaming, the optimal expansion factor is set to a first preset value, and the number of pipeline stages is set to a second preset value; wherein the first preset value is less than the second preset value.

4. The method according to claim 1, characterized in that, The step of dividing and reorganizing the original array according to the optimal expansion factor to obtain the target structure includes: The original array of length N is divided into M subarrays based on the first-level data cache line size, and the starting address of each subarray is aligned to the first-level data cache line size. The corresponding elements of adjacent subarrays with the optimal number of expansion factors are bit-concatenated to form the target structure; wherein the width of the target structure matches the bit width of the single instruction multiple data register of the target processor.

5. The method according to claim 4, characterized in that, The method further includes: If the target processor supports 128-bit single instruction multiple data stream, the optimal expansion factor is determined to be 2; If the target processor supports 512-bit single instruction multiple data stream, the optimal expansion factor is determined to be 8.

6. The method according to claim 1, characterized in that, The method further includes: If the compiler does not support the compiler directive, loop unrolling is performed in the header file based on template metaprogramming techniques to replace the function of the compiler directive.

7. The method according to any one of claims 1 to 6, characterized in that, The method further includes: The program execution performance indicators are obtained based on the processor performance monitoring unit; wherein, the program execution performance indicators include pipeline pause cycle, L1 cache miss rate, and number of packaged instructions; When the program's performance metrics are lower than a preset performance threshold, the process returns to the step of generating the optimal expansion factor and pipeline number before compilation based on the number theory transformation pseudocode and architectural feature parameters.

8. An acceleration system for PQC-NTT, characterized in that, include: The acquisition module is used to acquire the pseudocode of number theory transformation and the architectural feature parameters of the target processor; The dynamic loop unrolling and pipeline decision module is used to generate the optimal unrolling factor and pipeline number before compilation based on the number theory transformation pseudocode and architecture feature parameters. The array splitting and recombination module is used to split and recombine the original array according to the optimal expansion factor to obtain the target structure; The code generation and injection module is used to generate expanded and piped code based on the optimal expansion factor, pipelining level, and target structure, and to insert compilation guidance instructions into the expanded and piped code.

9. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 7.

10. A computer-readable medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 7.

Images