Multi-scalar multiplication (MSM) computation

Abstract

Provided in the embodiments of the present description are a method for multi-scalar multiplication (MSM) computation, a device, a program product and a storage medium. The method is applied to a graphics processing unit (GPU) for executing the MSM computation, and the method comprises: acquiring a bucketing result determined for a current MSM to be computed, wherein the bucketing result indicates a bucket to which each point for computation in the MSM to be computed belongs; on the basis of the bucketing result, determining the number of points for computation in each bucket; and performing computation on each bucket, wherein a plurality of GPU threads are used for computation for a bucket having the number greater than or equal to a preset threshold, and a single GPU thread is used for computation for a bucket having the number less than the preset threshold.

Description

Calculation of Multiscalar Multiplication (MSM) Technical Field

[0001] The embodiments in this specification belong to the field of cryptography technology, and in particular relate to a method, device, program product and storage medium for calculating multiscalar multiplication (MSM). Background Technology

[0002] Elliptic Curve Cryptography (ECC) is a public-key cryptography method based on the mathematical theory of elliptic curves. ECC is an alternative to traditional public-key cryptography (such as RSA), offering advantages such as shorter keys, lower computational cost, and smaller storage space requirements. At the same security strength, the key length of elliptic curve cryptography is significantly shorter than most other public-key cryptosystems.

[0003] Elliptic curve cryptography emerged primarily to address the following problems.

[0004] Key Length and Security Strength: With the development of computer technology, the key length required for traditional public-key cryptography has been continuously increasing to ensure sufficient security strength. However, the increase in key length also leads to an increase in computational load and storage space. Elliptic curve cryptography can achieve comparable security strength to traditional public-key cryptography with shorter key lengths, thereby improving efficiency.

[0005] Limitations of mobile devices: Mobile devices such as smartphones and tablets have relatively limited computing power and storage space. The application of traditional public-key cryptography is limited on these devices. Elliptic curve cryptography, due to its efficiency, is particularly well-suited for use on mobile devices.

[0006] The Threat of Quantum Computing: The development of quantum computers poses a potential threat to traditional public-key cryptography. Theoretically, quantum computers can efficiently solve mathematical problems relied upon by cryptography such as RSA using Shor's algorithm. Elliptic curve cryptography is currently considered a promising approach to resisting quantum computer attacks.

[0007] Elliptic curve cryptography utilizes the algebraic properties of points on an elliptic curve defined over a finite field to construct secure systems. An elliptic curve can be described by the following equation: y 2 =x 3 +ax+b, where 4a 3 +27b 2 ≠0(1)

[0008] Figure 1 shows several different shapes of elliptic curves, where b = 1 and a decreases from 2 to -3.

[0009] As shown in Figure 1, the characteristic of an elliptic curve is that it is symmetric about the x-axis. Therefore, for a point T on one side of the elliptic curve along the x-axis, there exists a point -T that is symmetric about the x-axis.

[0010] The following introduces some basics of group theory.

[0011] In algebra, a group is a set of elements and the operations defined on those elements. For example, all integers form a group, and addition is one such operation. This set is usually denoted by G (group). For a set to become a group, it generally needs to satisfy the following properties.

[0012] 1. Closure: If both a and b belong to G, then a+b also belongs to G.

[0013] 2. Associative Law: For any a, b, c ∈ G, we have (a+b)+c=a+(b+c).

[0014] 3. There exists an identity element O such that for any a∈G, a+O=O+a=a. For example, in real numbers, the identity element for addition is 0. Simply put, in binary operations, the identity element allows operations to be performed with any element without changing the value of that element. Taking real numbers as an example, the identity element for multiplication is 1, and the identity element for addition is 0.

[0015] 4. Every element has an inverse element (also called the inverse or negative element, or simply the inverse), that is, for any element a, there must exist b such that a + b = O (O is the identity element).

[0016] A set that satisfies the above four properties is called a group.

[0017] There are also special groups, such as the Abelian group, which, in addition to satisfying the basic properties of groups, also satisfies the commutative law, i.e., a + b = b + a. Therefore, the Abelian group is also called a commutative group.

[0018] Based on these properties, it can be determined that the set of integers Z is an abelian group, but the set of natural numbers N is not a group because the set of natural numbers N does not satisfy the fourth property that there exists an inverse element.

[0019] The above covers the basics of group theory. Although it seems simple, group theory has many complex properties, which will be omitted here for now. It is important to note that the elements in a group can be not only numbers, but also other types of elements, such as points in analytic geometry (represented in coordinate form).

[0020] With a basic understanding of groups, we can further define groups on elliptic curves in a similar manner.

[0021] As mentioned above, the elements of a group can be of any type. Here, the group elements on an elliptic curve are defined as points on the elliptic curve. The identity element is defined as the point at infinity, denoted as O. The inverse of any point P on the elliptic curve is the point symmetric to that point about the x-axis.

[0022] The addition of elliptic curve groups differs from the addition of integers. The addition of elliptic curve groups can be defined as follows: given three collinear non-zero points P, Q, and R, their sum is P + Q + R = O. As shown in Figure 2, the geometric meaning of this addition is: draw a straight line L through points P and Q, intersecting the elliptic curve at a third point; the point symmetric to this third point about the x-axis is the desired point R.

[0023] The following steps address some exceptional situations.

[0024] 1. O + O = O, that is, for any P, P + O = P; O is regarded as a zero point.

[0025] 2. The negative element of P = (x, y) is the point -P = (x, -y) which is symmetric about the x-axis, not about the origin. P + (-P) = O, which can be seen as the line connecting point P and point -P intersecting the elliptic curve at infinity.

[0026] 3. To calculate twice the value of point P (P≠O), draw the tangent line to the elliptic curve at that point, and then take the point -R, which is the reflection of the intersection point R of the tangent line and the elliptic curve across the x-axis. That is, 2P = P + P = -R. Its geometric meaning is shown in Figure 3; point -R is point 2P. Furthermore, the value of twice can be recursively derived to 2... n The calculation of values ​​can also be recursively derived to calculate values ​​that are any integer multiples of each other.

[0027] A geometric interpretation makes it easier to understand the meaning of point addition on an elliptic curve, while an algebraic interpretation makes it easier to perform calculations. Points on the curve have coordinates in a two-dimensional plane, specifically x and y coordinates. Therefore, through two non-negative points P(x, y) on the curve... p ,y p ) and Q(x q ,y q The problem of finding the third intersection point of a straight line with a curve can be described algebraically, that is, by solving the system of equations (2) and (3) below: y 2 =x 3 +ax+b (2) yy p =k(xx) p (3)

[0028] Where k is the slope.

[0029] Substituting equation (3) into equation (2), and then using the method of aligning the degrees, it is easy to find the point symmetric to the third intersection point about the x-axis, which is the point R(x) representing the sum of point P and point Q. r ,y r ) is: x r =k 2 -x p -x q (4) y r =-y p +k(x p -x r (5)

[0030] If P = Q, then adding the two together is calculating a multiplication. Multiple points can be added repeatedly to obtain a multiplication result. For example, P + P = 2P = R, which can be algebraically described as:

[0031] This concludes the introduction to the basic operations of elliptic curve group elements in the real number field. Addition in the real number field is insufficient for practical security needs because real numbers are continuous; knowing the result allows for inverse operations to solve the problem. Therefore, to prevent invertibility, the next step is to discretize the coordinates of the elliptic curve points.

[0032] Here we will first introduce the modulo operation of a prime number p. First, the modulo operation represents the remainder when a is divided by p, which can be expressed as: a mod p.

[0033] Cryptography employs elliptic curves over finite fields, where the coefficients and variables of the elliptic equations take values ​​within a finite range. These values ​​can be constrained to the finite field Z by using a prime modulus p. p Specifically, introducing modular arithmetic into elliptic curve arithmetic involves taking values ​​for variables and coefficients from the set [0, p-1] rather than from real numbers, and within a finite field (i.e., a finite field). The equation over this field is then modified as follows: y 2 mod p = (x 3 +ax+b)mod p, where (4a) 3 +27b 2 )mod p≠0(8)

[0034] Formula (8) above is also often expressed as: y 2 =(x 3 +ax+b)modp.

[0035] The mathematical notation for all integer solutions (x, y) that satisfy the above equation, where x, y ∈ Zp, and the point at infinity O, is denoted as E. p (a,b) is a finite discrete (discontinuous) set of points.

[0036] If there exists a point g in this finite field such that every element in the group G can be written as a power of some integer power of g (here, power is a generalized concept in the group, describing the number of repetitions of group operations; in the additive group, it refers to the number of addition operations), that is: G = {g 0 =O,g 1 =g,g 2 =2g,...,g n-1 =(n-1)·g}

[0037] Where n is the order of group G (order refers to the number of elements in the group), this group is also called a cyclic group, denoted as E. p The point g (a, b) is called the generator. Due to the modulo effect, the points in this set are distributed in the quadrant from (0, 0) to (p-1, p-1), and even if the value of k changes, the result will still cycle within this quadrant. In fact, the set E p The addition of (a,b) modulo p forms a cyclic abelian group, which is a subset of the quadrants (0,0) to (p-1,p-1). Therefore, this cyclic abelian group is also called a cyclic subgroup.

[0038] Using a prime modulus p ensures consistent and reliable computations, and all non-zero elements have inverses, forming a robust algebraic structure (finite field), making it suitable for elliptic curve cryptography. Conversely, using a non-prime modulus leads to inconsistent computations and the lack of inverses, resulting in a complex algebraic structure (finite ring), thus making it unsuitable for elliptic curve cryptography. In summary, elliptic curve cryptography chooses a prime modulus p, rather than a non-prime modulus, to ensure the reliability and security of mathematical operations. Furthermore, the order n of the chosen cyclic subgroup is usually also chosen to be a prime number for better security and efficiency.

[0039] E p The addition rules on (a,b) are similar to those in the real number field, i.e., similar to the aforementioned formulas (2) to (5). The difference is that modulo operation is added. Similarly, by adding modulo operation to formulas (6) and (7), we can obtain the multiplicative result obtained by repeatedly adding multiple points in the discrete domain cyclic group.

[0040] In simple terms, for a point P on an elliptic curve, there exists a point Q that is k times its value, which forms the relation: Q = k·P, where Q, P ∈ E. p (a,b),k <p (9)

[0041] Given k and P, computing Q is easy; however, conversely, given Q and P, computing k is quite difficult. This is the discrete logarithm problem of elliptic curve cryptography. Constructing a mathematical problem to ensure encryption security is a key idea in cryptographic algorithms. Therefore, Q can be published as the public key, and k can be kept secret as the private key. Obtaining the public key from the private key is quick and simple, but cracking the private key from the public key is extremely difficult.

[0042] The addition operation in the group described above actually defines scalar multiplication, which means adding the same point multiple times. For example, adding k points p can be expressed as: k·P=P+P+…+P (10)

[0043] The simplest way to calculate scalar multiplication is to add the points one by one. It should be noted that, in reality, points on an elliptic curve have coordinates. The calculation of the above formula (10) involves coordinate operations similar to those in formulas (6) and (7), including a large number of modular multiplication and modular addition operations. Therefore, the actual calculation is more complicated.

[0044] Although some optimized algorithms can reduce the number of addition operations, such as breaking 7P down into 4P+2P+P, where 2P requires one addition operation and 4P=2P+2P requires another addition operation on top of 2P, thus requiring a total of 4 addition operations, which is 2 fewer than the original 7P=P+P+P+P+P+P+P (P+P=2P, 2P+P=3P, 3P+P=4P, 4P+P=5P, 5P+P=6P, 6P+P=7P), from the perspective of underlying coordinate operations, it still involves a large number of modular multiplication and modular addition operations.

[0045] Overall, addition on elliptic curves requires a large number of modular multiplication and addition operations; calculating a single addition may require dozens of modular multiplication and addition operations. Multiplication on elliptic curves (i.e., the scalar multiplication mentioned above) requires an even larger number of modular multiplication and addition operations; calculating a single multiplication may require hundreds or more modular multiplication and addition operations.

[0046] The scalar multiplication described above is a fundamental operation in elliptic curve cryptography, used in key generation, encryption, and signature processes. Multi-Scalar Multiplication (MSM) is a generalization of scalar multiplication, involving multiple points and multiple scalars. Specifically, given n points P1, P2, ..., P... n and n integers k1, k2, ..., k n The goal of multiscalar multiplication is to compute: Q = k1P1 + k2P2 + ... + k n P n(11)

[0047] As can be seen, multi-scalar multiplication is the sum of the results of n scalar multiplications.

[0048] Multiscalar multiplication is used in many elliptic curve cryptography protocols, especially in those requiring the simultaneous processing of multiple points and scalars. For example, see below.

[0049] In some digital signature schemes, the generation and verification of a signature require the computation of a linear combination of multiple points.

[0050] In some key exchange protocols, calculating a shared key requires multiplying multiple public key points by their corresponding private key points and then summing the results.

[0051] In some zero-knowledge proof (ZKP) protocols, the generation and verification of a proof requires computing a linear combination of multiple commitment values.

[0052] Taking zero-knowledge proof as an example, this paper illustrates the role of MSM operations in zero-knowledge proof. First, the protocol principle of ZKP is shown in Figure 4.

[0053] There are provers and verifiers. The prover uses a proving key, private input (also called witness), and public input to create a proof through a program. The prover then sends this proof to the verifier. The verifier uses a verification key and public input, along with a verifier, to verify the proof, outputting either true or false.

[0054] In the above process, the prover does not reveal any private input that he does not want to disclose. The verifier can verify that the prover knows the private input by providing a proof, but the verifier does not know what the private input is.

[0055] This property makes zero-knowledge proofs very useful in many scenarios, especially when the prover needs to prove that they possess a secret but do not want to reveal any information about that secret. For example, as follows.

[0056] In identity verification, the prover can prove that he knows a secret associated with an identity (such as a private key) without revealing that secret.

[0057] In privacy-preserving transactions, the certifier can prove that the transaction is valid (e.g., prove that he has sufficient funds) without revealing details of the transaction (e.g., the specific amount).

[0058] In privacy-preserving computation, a prover can demonstrate that he has correctly performed a computation (such as demonstrating that he has correctly evaluated a function) without revealing the input of the computation.

[0059] The prerequisite for ZKP is the existence of a proving key and a verification key. Typically, the proving key and verification key are generated in a centralized manner; this generation process is called the trusted setup process. The trusted setup process can be implemented by a trusted third party other than the prover and verifier. This third party generates the proving key and verification key, and sends the proving key to the prover and the verification key to the verifier, respectively. Trusted setup processes implemented by trusted third parties can be divided into two categories: general trusted setup processes and dedicated trusted setup processes, the differences of which are as follows.

[0060] In a general trusted setup, the generation of proof and verification keys does not necessarily need to be based on a specific computational problem. This setup process is a one-time event, thus saving the overhead of repeatedly setting it up for each computational problem.

[0061] Dedicated trusted setups are configurations based on a specific computational problem. The generated proof and verification keys are specific to that particular computational problem. This means that these keys can only be used to prove and verify that specific problem and cannot be directly applied to other problems. Furthermore, even if someone obtains these keys, they can only forge proofs for that specific problem and cannot affect other problems. However, dedicated trusted setups are less efficient, requiring a separate setup process for each computational problem.

[0062] Taking a general trusted setup as an example, as shown in Figure 4, for instance, choosing an algorithm from the ZK-Snark (Zero-Knowledge Succinct Non-interractive Argument of Knowledge) protocol (such as Pinocchio, Groth16, Sonic, etc.), a trusted third party can generate a proof key and a verification key through the general trusted setup. This also involves some public parameters, reference strings, constraint system templates, randomness proofs, security proofs, etc. (Step ①). Then, the trusted third party can send the generated proof key, along with some public parameters, reference strings, constraint system templates, randomness proofs, and security proofs, to the prover (Step ②), and send the verification key to the verifier (Step ②). The prover can create a proof based on the public and private inputs of the computation problem, combined with the proof key (Step ③), and send the proof to the verifier (Step ④). The verifier verifies the truth or falsehood of the proof based on the verification key, the proof, and the public inputs through a verification program (also called a verifier), that is, verifying whether the prover truly knows the solution (Step ⑤).

[0063] In general, the process of generating a proof can be divided into three parts. The first part is called arithmeticization, which transforms the computation problem into a vector of linear constraints. The second part is to transform these vectors of linear constraints into a "polynomial proof". The third part is to transform the polynomial proof into a "non-interactive proof", which is the final proof. This process is also called "proof compilation".

[0064] Taking ZK-Snark as an example, the above process includes the following.

[0065] Step 1: Arithmetization. Arithmetization is the process of transforming the original computational problem into a set of algebraic constraints. The core work in this process includes the following.

[0066] Representing a computational problem as an arithmetic circuit or a set of polynomial constraints typically involves defining the circuit's inputs, outputs, and intermediate variables, as well as describing the arithmetic relationships between these variables.

[0067] Transforming the constraints of a circuit into a special linear algebraic structure is commonly known as an R1CS (Rank-1 Constraint System). This involves representing each constraint as a matrix and combining all the matrices into a large R1CS instance.

[0068] Transform an R1CS instance into a set of linear equations or polynomials. This is typically achieved using techniques such as Lagrange interpolation.

[0069] The goal of arithmetic transformation is to convert the original problem into an algebraic form more suitable for cryptographic processing. This lays the foundation for subsequent polynomial proof generation and proof compilation.

[0070] Step 2: Polynomial Proof Generation. In this step, the prover transforms the arithmetically derived linear constraint vector into a "polynomial proof." The core work of this process includes the following.

[0071] Linear constraints are randomized using so-called "blinding factors." This is done to hide the specific values ​​of the original constraints, thereby achieving zero knowledge.

[0072] The randomized constraint interpolation is a polynomial.

[0073] These polynomials are operated on to generate different parts of a proof, such as commitments, proofs, and responses. This involves the use of cryptographic primitives such as homomorphic commitments and verifiable random functions. Polynomial operations are typically implemented using efficient algorithms such as the Fast Fourier Transform (FFT) or the Number-Theoretic Transform (NTT).

[0074] The goal of polynomial proof generation is to transform discrete linear constraints into a continuous polynomial form, which is more suitable for subsequent cryptographic processing. This process also introduces randomization and blinding, which are key to achieving zero-knowledge.

[0075] Step 3: Proof Compilation. In the final step, the prover transforms the polynomial proof into a "non-interactive proof," which is the final zk-SNARK proof. The core work of this process includes the following.

[0076] Using zk-SNARK protocols such as Pinocchio and Groth16, polynomial proofs are transformed into non-interactive, verifiable proofs of computational integrity. This involves the use of advanced cryptographic primitives such as pairwise-friendly elliptic curves and pairwise operations.

[0077] Various optimizations were implemented, such as using multiscalar multiplication (MSM) to accelerate computation and using recursion to compress the proof size. This was done to improve the efficiency of proof generation and verification.

[0078] The optimized proof is packaged together with the common input of the original problem to form the final zk-SNARK proof.

[0079] It should also be noted that in the above process, elements such as public parameters, reference strings, constraint system templates, randomness proofs, and security proofs (collectively referred to as artifacts along with the proof key and verification key) are also crucial. The trusted third party needs to distribute appropriate artifacts to the prover and verifier. As mentioned earlier, the third party sends the proof key and some artifacts (such as public parameters, reference strings, constraint system templates, randomness proofs, and security proofs) to the prover, while the verification key is sent to the verifier. The roles of these artifacts—public parameters, reference strings, constraint system templates, randomness proofs, and security proofs—are as follows.

[0080] Public parameters: These parameters define the cryptographic primitives upon which zk-SNARK is based, such as elliptic curves and pairwise friendly curves. Verifiers need these parameters to execute verification algorithms, especially when checking certain cryptographic conditions (such as pairwise equality).

[0081] Reference String: The reference string is a shared input between the prover and the verifier, used to coordinate their interaction. The verifier needs to use the same reference string as the prover to verify the proof.

[0082] Constraint System Template: This template defines the general structure of computational problems that zk-SNARK can handle. Verifiers may need this template to check whether the structure of the common inputs is compatible with the proof.

[0083] Proofs of randomness and proofs of security: These proofs provide evidence of the integrity of the setup process and the security of zk-SNARKs. Verifiers may need these proofs to gain trust in the entire system.

[0084] The dedicated trusted setup is generally similar to the process described above, but as mentioned earlier, it requires design in conjunction with a computational problem. Therefore, the third-party dedicated trusted setup process incorporates a computational problem to generate the proof and verification keys. This means that the generated proof and verification keys will be tightly bound to a specific circuit structure. Furthermore, the computational problem can be preprocessed during this process; for example, the arithmetic setup can be preprocessed, as it does not involve privacy inputs. Thus, during the prover's proof generation process, steps two and three, which involve privacy inputs, can be executed.

[0085] In the proof compilation process of the third step mentioned above, MSM can be said to be ubiquitous. From generating commitments for the polynomial proof, to checking the correctness of these commitments, and then combining these commitments to form the final non-interactive proof, each step involves a large number of MSM operations.

[0086] In fact, the efficiency of MSM (Mean Search Machine) is a key factor in the practical usability of zk-SNARKs. Because proof generation and verification in zk-SNARKs involve so many MSM operations, their performance directly impacts the speed and scalability of the entire system. This is why many zk-SNARK implementations invest significant effort in optimizing MSM, employing techniques such as pre-computation and batch processing to accelerate MSM computation.

[0087] In the proof generation and verification process of zk-SNARKs, multiscalar multiplication (MSM) is a computationally intensive core operation. The performance of MSM has a significant impact on the overall efficiency of the zk-SNARK system. To accelerate MSM computation, the industry typically employs dedicated hardware accelerators, such as acceleration solutions based on FPGAs (Field-Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), or GPUs (Graphics Processing Units). Compared to using general-purpose CPUs, specially designed hardware accelerators can achieve significant advantages in performance and energy efficiency, thereby greatly reducing the generation time and energy consumption of zero-knowledge proofs. Therefore, designing efficient MSM hardware accelerators has become a research hotspot in the field of zk-SNARK hardware optimization.

[0088] Among various dedicated hardware accelerators, GPUs are relatively low-cost, easy to iterate, and the most widely used. Currently, there are many GPU acceleration solutions for MSM, including numerous papers and acceleration libraries. However, when these works are applied to the actual ZKP proof generation process, they often fail to achieve satisfactory acceleration results. This is because existing works typically use the Pippenger algorithm to implement MSM computation, and the Pippenger algorithm assigns the points to be computed on the elliptic curve to several buckets.

[0089] For example, Figure 5 shows a schematic diagram illustrating the implementation of MSM calculation using the Pippenger algorithm according to an exemplary embodiment of this specification; where k i Let P represent the i-th scalar among multiple scalars in MSM. i Let represent the i-th point to be calculated among multiple points to be calculated on the elliptic curve of the MSM. Q is the final calculation result. Q1 represents the calculation result of the first scalar and the first point to be calculated, Q2 represents the calculation result of the second scalar and the second point to be calculated, and so on. The calculation process of the Pippenger algorithm may include the following.

[0090] The scalars in MSM are divided into windows. As shown in Figure 5, each scalar k i The binary representation is divided into three windows (G0, G1 and G2 in Figure 5) by a fixed number of bits (4 bits in Figure 5).

[0091] Each window corresponds to a set of buckets. The number of buckets is usually determined based on the number of bits in the window. The algorithm will assign points with the same value in the same window to the same bucket. Subsequently, only one dot addition is needed for the points in each bucket, instead of multiple dot multiplications.

[0092] As shown in Figure 5, there are 15 buckets under G0 (B0 to B...). 15 The Pippenger algorithm also assigns each point to be computed to a bucket according to a strategy, the specific assignment method depending on the input MSM. In the example shown in Figure 5, B1 under G0 is not assigned a point to be computed; while B5 has 4 points to be computed. 14 There is one point to be calculated. Each calculation point under each bucket needs to be added together; for each window, the calculation results of all buckets are summed to obtain G. j As shown in Figure 5, G0, G1, and G2. Finally, G... j The final result Q is obtained by summing the results. The summation of points within each bucket is completely independent and can be processed in parallel. Calculations in different windows can also be performed in parallel.

[0093] The relevant technologies are based on GPUs to implement MSM computation. Therefore, the main idea is to set a fixed number of GPU threads per bucket. This approach does not require CPU intervention, and the fixed allocation eliminates the need for dynamic decision-making logic, reducing CPU-GPU interaction and synchronization overhead. Furthermore, early GPU programming models (such as CUDA) did not adequately support dynamic parallelism, making it difficult to adjust the number of threads in real time within the GPU kernel.

[0094] Specifically, in traditional solutions, each Bucket is assigned to a GPU thread for processing. However, in real-world scenarios, the number of computation points assigned to each Bucket is often uneven. Most Buckets have relatively few computation points, which the assigned threads can quickly complete. A few Buckets have an unusually large number of computation points, which causes other threads to complete their tasks early while only one or two threads are still processing, resulting in very low GPU utilization.

[0095] In other related technologies, instead of allocating a single thread to each Bucket, a fixed number of N threads is assigned, where N is a multiple of 32 (because the smallest scheduling unit of a GPU, a warp, consists of 32 threads). This way, if a Bucket is very large, the computational efficiency of N threads will be far superior to that of a single thread. Furthermore, for a small number of Buckets, the thread resources released after processing a Bucket will be allocated by the GPU to other Buckets. However, this approach also has drawbacks. First, it introduces GPU scheduling overhead. Multiple threads processing a Bucket require parallel reduction operations. Compared to single-threaded processing, parallel reduction introduces synchronization overhead and wastes some thread resources. The larger N is, the fewer computation points there are within the bucket, making the introduced cost more significant. Summary of the Invention

[0096] To overcome the problems existing in related technologies, this specification provides a method, device, program product and storage medium for calculating multiscalar multiplication (MSM).

[0097] According to a first aspect of the embodiments of this specification, a method for calculating a Multi-Scalar Multiplication (MSM) is provided. The method is applied in a graphics processing unit (GPU) performing the MSM calculation. The method includes: obtaining a bucketing result determined for the current MSM to be calculated; wherein the bucketing result represents the bucket to which each point to be calculated in the MSM belongs; determining the number of points to be calculated in each bucket based on the bucketing result; and calculating for each bucket; wherein buckets with a number greater than or equal to a preset threshold are calculated using multiple GPU threads, and buckets with a number less than the preset threshold are calculated using a single GPU thread.

[0098] According to a second aspect of the embodiments of this specification, a method for calculating a multi-scalar multiplication (MSM) is provided. The method is applied in a central processing unit (CPU). The method includes: reading bucket data copied to memory space by a graphics processing unit (GPU); the GPU performing the steps of the method described in the first aspect; the bucket data refers to the bucket data of the n buckets with the highest number of points to be calculated, determined by the GPU based on the current MSM to be calculated and the bucketing result; after determining whether the number of points to be calculated in each of the n buckets is greater than or equal to a preset threshold, determining a thread allocation result where buckets with a number greater than or equal to the preset threshold are allocated to multiple GPU threads, and buckets with a number less than the preset threshold are allocated to a single GPU thread, and transmitting the thread allocation result to the GPU.

[0099] According to a third aspect of the embodiments of this specification, a graphics processor is provided, the graphics processor being used to perform the steps of the method described in the first aspect.

[0100] According to a fourth aspect of the embodiments of this specification, a computer device is provided, the computer device including a graphics processor and a central processing unit, the graphics processor being configured to perform the steps of the method described in the first aspect, and the central processing unit being configured to perform the steps of the method described in the second aspect.

[0101] According to a fifth aspect of the embodiments of this specification, a computer program product is provided, comprising a computer program that, when executed by a graphics processor, implements the steps of the method described in the first aspect; and / or, when executed by a central processing unit, implements the steps of the method described in the second aspect.

[0102] According to a sixth aspect of the embodiments of this specification, a computer-readable storage medium is provided that stores a computer program thereon, which, when executed by a graphics processor, implements the steps of the method described in the first aspect; and / or, when executed by a central processing unit, implements the steps of the method described in the second aspect.

[0103] In the multi-scalar multiplication (MSM) calculation method provided in the above embodiments, the number of threads allocated can be dynamically determined at runtime based on the number of points to be calculated within the bucket. If there are few points to be calculated within the bucket, one thread is allocated for calculation, avoiding synchronization overhead and wasted thread resources. If the number of points to be calculated within the bucket exceeds a certain limit, several threads are allocated to process them according to the bucket size. Therefore, the method in this embodiment can solve the adverse effect of low GPU resource utilization caused by a fixed number of threads. For the case of uneven distribution of points to be calculated within each bucket, this embodiment makes full use of GPU resources while reducing other additional overhead. Attached Figure Description

[0104] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0105] Figure 1 is a schematic diagram of an elliptic curve.

[0106] Figure 2 is a schematic diagram of the definition of addition on an elliptic curve.

[0107] Figure 3 is a schematic diagram of defining a multiple point on an elliptic curve.

[0108] Figure 4 is a flowchart of the zero-knowledge proof principle in one embodiment.

[0109] Figure 5 is a schematic diagram illustrating an implementation of MSM computation using the Pippenger algorithm according to an exemplary embodiment of this specification.

[0110] Figure 6 is a flowchart illustrating a method for calculating a multiscalar multiplication method (MSM) according to an exemplary embodiment of this specification.

[0111] Figure 7 is a flowchart illustrating another method for calculating a multiscalar multiplication method (MSM) according to an exemplary embodiment of this specification.

[0112] Figure 8 is a schematic diagram of the structure of a computer device according to an exemplary embodiment of this specification.

[0113] Figure 9A is a structural diagram of a computing device for a multiscalar multiplication method (MSM) according to an exemplary embodiment of this specification.

[0114] Figure 9B is a structural diagram of a computing device for another multiscalar multiplication method (MSM) according to an exemplary embodiment of this specification. Detailed Implementation

[0115] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0116] Based on the foregoing background, this specification provides a method for calculating Multiscalar Multiplication (MSM), which dynamically determines the number of threads to allocate at runtime based on the number of computation points within a bucket. If there are few computation points in a bucket, one thread is allocated for computation, avoiding synchronization overhead and wasted thread resources. If the number of computation points in a bucket exceeds a certain limit, several threads are allocated according to the bucket size to handle the computation. Therefore, this method can solve the problem of uneven distribution of computation points within buckets, fully utilizing GPU resources while reducing other additional overhead.

[0117] Figure 6 shows a flowchart of a multiscalar multiplication (MSM) calculation method according to an exemplary embodiment of this specification. The method can be applied to a graphics processing unit (GPU) that performs the MSM calculation, and the method may include the following steps.

[0118] In step 602, the bucketing results determined for the current MSM to be computed are obtained. The bucketing results represent the bucket to which each point in the MSM to be computed belongs.

[0119] In step 604, the number of points to be calculated in each bucket is determined based on the bucketing results.

[0120] In step 606, calculations are performed on each of the buckets.

[0121] The buckets whose number is greater than or equal to a preset threshold are calculated using multiple GPU threads, while the buckets whose number is less than the preset threshold are calculated using a single GPU thread.

[0122] As an example, the GPU in this embodiment can be installed on a computer device (host). The computer device may also include a central processing unit (CPU), etc. When needed by the host, the host can use the GPU of this embodiment to perform MSM calculations. For example, the GPU of this embodiment can be used in various tasks that require MSM calculations, such as zero-knowledge proof tasks.

[0123] The embodiment shown in Figure 6 uses a GPU as the execution entity. In this embodiment, the GPU performing MSM calculations can be based on the Pippenger algorithm or other algorithms. For example, the host can obtain the scalars and points to be calculated (i.e., points on the elliptic curve) in the MSM to be calculated. The CPU can transfer the scalars and points to be calculated in the MSM to the GPU. The MSM calculation program running on the GPU can perform MSM calculations on the input scalars and points to be calculated.

[0124] As an example, the Pippenger algorithm can be used to perform MSM calculations in an MSM calculation program running on a GPU. As shown in Figure 5 above, the Pippenger algorithm can perform a bucketing operation to obtain the bucketing results. The bucketing results represent the bucket to which each point to be calculated in the MSM to be calculated belongs.

[0125] As an example, suppose a certain MSM computation involves 10 points to be computed, from P0 to P9; taking the division into two windows (W0 and W1) as an example, each window has 16 buckets (B0 to B15); the Pippenger algorithm executed in the GPU can produce the following bucketing result: "(P0,W0,B3),(P0,W1,B5),……(P6,W0,B3),……".

[0126] Each set of parentheses contains three pieces of information: the point to be calculated, the window information, and the bucket information. Therefore, the bucketing result represents the bucket to which each point in the MSM to be calculated belongs. Based on this, in step 604, the number of points to be calculated in each bucket can be determined based on the bucketing result. In practical applications, various methods can be used to determine the number of points to be calculated in each bucket from the bucketing result; for example, it can be achieved by traversing the above bucketing result and counting the points to be calculated in each bucket, or other efficient methods can be designed as needed. This embodiment does not limit this approach.

[0127] Furthermore, after obtaining the number of points to be computed in each bucket, this embodiment can reasonably control the number of threads based on the number of points to be computed in each bucket. For example, in step 206, this embodiment designs a preset threshold to divide large buckets and small buckets. For large buckets with a large number of points, a sufficient number of GPU threads can be allocated for parallel processing. For small buckets with a number of points less than the preset threshold, a single thread is still allocated for processing. Therefore, this embodiment avoids the situation where one thread is busy while other threads are idle, effectively improving GPU utilization, preventing resource waste, and maximizing GPU utilization.

[0128] To efficiently obtain the number of points to be calculated in each bucket, this specification also provides an efficient acquisition method. As an example, each bucket data entry in the bucketing result may include: the point to be calculated, the window index of the window containing the bucket to which the point to be calculated belongs, and the bucket index of the bucket to which the point to be calculated belongs. For example, still using the aforementioned embodiment as an example, in the bucketing result: “(P0,W0,B3),(P0,W1,B5),……(P6,W0,B3),……”, “(P0,W0,B3)” can be understood as a single bucket data entry. The bucketing result uses the point to be calculated as the key.

[0129] To efficiently obtain the number of points to be computed in each bucket in the GPU, the step of determining the number of points to be computed in each bucket based on the bucketing results may include: concatenating the window index and bucket index in each bucket data to obtain a concatenated index, and then obtaining a concatenated index sequence from the concatenated indices of each bucket data; sorting each concatenated index in the concatenated index sequence to obtain a sorted concatenated index sequence; and counting the occurrence frequency of each concatenated index in the sorted concatenated index sequence using a run-length encoding function, wherein the occurrence frequency represents the number of points to be computed in each bucket.

[0130] In this embodiment, a run-length encoding function is used to determine the number of points to be calculated in each bucket. Run-length encoding is a lossless data compression algorithm, commonly used for image compression or text compression. It records continuous repetitive data as (value, number of repetitions). For example, the input sequence [A,A,A,B,B,C] can be encoded by the run-length function as: [A,3),(B,2),(C,1)].

[0131] Based on this, this embodiment needs to construct an input sequence that can be encoded by the run-length function. Since it is necessary to determine the number of points to be calculated in each bucket, a unique identifier can be designed for each bucket, that is, the concatenation index obtained by concatenating the window index and the bucket index is used as the unique identifier of the bucket.

[0132] For example, suppose we have the following bucketing results: (P0,W0,B3),(P0,W1,B5), (P1,W0,B0),(P1,W1,B8), (P2,W0,B3),(P2,W1,B2), ... (P9,W0,B15),(P9,W1,B7).

[0133] The concatenated indexes of each bucket's data are: W0B3,W1B5,W0B0,W1B8,W0B3,W1B2,...,W0B15,W1B7.

[0134] Sort the concatenated indexes to obtain a sorted concatenated index sequence: W0B0(P1),W0B3(P0),W0B3(P2),...,W1B2(P2),W1B5(P0),W1B7(P9),W1B8(P1).

[0135] In the example above, each concatenated index in the concatenated index sequence carries information about each point to be calculated; for example, the index of the point to be calculated in the input scalar array. In practical applications, it may not be necessary to carry the points to be calculated. In the concatenated index sequence, because the concatenated indices are sorted, if there are multiple points to be calculated in a certain bucket, the concatenated index will appear repeatedly; for example, "W0B3(P0),W0B3(P2)" above.

[0136] Furthermore, this concatenated index sequence can be input into a run-length encoding function, and the resulting encoding can be: "(W0B0,1),(W0B3,2),(W1B2,1),...,"

[0137] The encoding result contains two pieces of information: concatenation index and occurrence count. The occurrence count is the number of times the concatenation index appears in the sequence. For example, "(W0B0,1)" means that the concatenation index W0B0 appears once in the sequence.

[0138] Therefore, by using the run-length encoding function, the number of occurrences of each concatenation index can be counted, and the number of occurrences represents the number of points to be calculated in each bucket.

[0139] For ease of illustration, the above embodiments use strings to represent the information of the point to be calculated, the window index, and the bucket index. In practical applications, these three types of information can be represented in other ways, such as binary numbers, etc., and this embodiment does not limit this.

[0140] For example, the information of the point to be calculated could be the label of all points to be calculated in the MSM to be calculated; for example, all points to be calculated in the MSM to be calculated could be numbered in a continuous and ascending order, such as starting from 0, so that the sequence number of each point to be calculated could be obtained.

[0141] Similarly, windows and buckets are numbered in a continuous and ascending order, for example, starting from 0. Therefore, the index number can be used as the window index, and the bucket number as the bucket index.

[0142] Optionally, to reduce development difficulty and make efficient use of the GPU, some of the above steps can be implemented using GPU programming tool libraries.

[0143] For example, sorting the concatenated indices in the concatenated index sequence may include: sorting the concatenated indices in the concatenated index sequence using a sorting function provided by the GPU's programming tool library. The sorting function may be a sort_pairs function or similar.

[0144] For example, the run-length encoding function can also be a function provided by the GPU's programming tool library, such as the run_length_encode function.

[0145] Therefore, in implementing this embodiment, functions provided by the GPU's programming tool library can be called, eliminating the need for additional code writing and reducing development difficulty.

[0146] After obtaining the number of points to be calculated in each bucket determined based on the bucketing results, multiple threads can be used to calculate buckets with a number greater than or equal to a preset threshold, while a single thread can be used to calculate buckets with a number less than the preset threshold. In practical applications, for some high-version GPUs, this processing flow can be implemented within the GPU itself. That is, the logical judgment of the number is performed within the GPU to further determine the buckets with a number greater than or equal to the preset threshold, and the required number of threads for these buckets is determined and the corresponding number of threads is scheduled; and for the buckets with a number less than the preset threshold, a single thread is scheduled for these buckets. In other examples, for some low-version GPUs, it is not possible to determine whether the number of points to be calculated in a bucket is greater than or equal to the preset threshold, nor can it automatically allocate the number of threads to the buckets. The CPU needs to initiate specific tasks and control the task scale. Therefore, the CPU can implement this, and then the GPU, based on the CPU's control instructions, uses multiple threads to calculate buckets with a number greater than or equal to the preset threshold, and a single thread to calculate buckets with a number less than the preset threshold.

[0147] Therefore, in order to be compatible with different versions of GPUs, for example, the computer device where the GPU is located includes a central processing unit (CPU); the method may further include: obtaining bucket data of the n buckets with the highest number of buckets; wherein n is a positive integer; determining that the other buckets, excluding the n buckets with the highest number of buckets, will be computed using a single GPU thread; copying the bucket data of the n buckets with the highest number of buckets to the memory space of the CPU, and obtaining the thread allocation result of the CPU for the n buckets with the highest number of buckets; wherein, after reading the bucket data of the n buckets from the memory space, the CPU determines whether the number of points to be computed in each of the n buckets is greater than or equal to a preset threshold, and determines the thread allocation result of buckets with a number greater than or equal to the preset threshold being allocated multiple GPU threads and buckets with a number less than the preset threshold being allocated a single GPU thread, and transmits the thread allocation result to the GPU.

[0148] In this embodiment, the CPU can determine the number of buckets greater than or equal to a preset threshold and allocate appropriate threads. The information representing the number of computation points in each bucket is stored in the GPU's video memory. Therefore, this information needs to be copied to the CPU's memory space so that the CPU can read this data and execute subsequent processing. Copying data from GPU video memory to CPU memory space incurs overhead, which increases with the amount of data. In MSM computing scenarios, many buckets are typically created. To reduce overhead, this embodiment designs a strategy of not copying all bucket data, but instead copying the data of the n buckets with the highest number of data points. This controls the impact of data copying.

[0149] For buckets other than the n buckets with the highest number, a single thread is used for calculation by default. After the CPU reads the bucket data of the n buckets from the memory space, it determines whether the number of points to be calculated in each of the n buckets is greater than or equal to the preset threshold. For buckets with a number greater than or equal to the preset threshold, multiple threads of the GPU are allocated for calculation, and for buckets with a number less than the preset threshold, a single thread of the GPU is allocated for calculation.

[0150] In practical applications, the value of n can be customized as needed. For example, an empirical value can be set based on the actual MSM calculation scenario to ensure that the set n can make the number of points to be calculated in the n buckets with the highest number of data points greater than the preset threshold.

[0151] In practical applications, there are various ways to obtain the data of the n buckets with the highest number of occurrences, such as iterating through the counts of each bucket. In other examples, to improve processing efficiency, obtaining the data of the n buckets with the highest number of occurrences in this embodiment may include: using the reverse sorting function provided by the GPU's programming tool library to sort each concatenation index in reverse order based on the occurrence count, and obtaining the data of the n buckets with the highest number of occurrences based on the reverse sorting result.

[0152] As an example, the GPU programming tool library provides a function for reversing order sorting, such as `sort_pair_descending`. This function can be called with the data to be sorted in reverse order. For example, it can be data with the structure "(pair index, occurrence count)", such as "(W0B0,1),(W0B3,2),(W1B2,1),...,". Reversing the order of each pair index by its occurrence count would result in: (W1B4,6)...,(W1B2,1).

[0153] It can be seen that the number of points to be calculated in the splicing index "W1B4" is 6, which is the first one.

[0154] Based on this, this embodiment can call the reverse sorting function provided by the GPU's programming tool library, eliminating the need for additional code writing and reducing development difficulty. Furthermore, by using reverse sorting, the various concatenation indices can be sorted in reverse order, so the buckets with the highest number of points to be calculated will be sorted first. Therefore, the top n buckets with the highest number of points can be quickly identified and their data obtained.

[0155] Optionally, the data for the n buckets with the highest number of occurrences copied to the CPU's memory space can include bucket-related information, such as the bucket's concatenation index and the number of points to be calculated within that bucket. For example, this could include the starting position, concatenation index, and occurrence count mentioned above.

[0156] Optionally, after the CPU reads this data, the number of threads allocated to buckets with a quantity greater than or equal to the preset threshold can be flexibly configured according to actual needs; this embodiment does not limit this. For example, an upper limit can be set for the number of points to be calculated processed by each thread, and then the number of threads allocated to a bucket can be determined based on the number of points to be calculated in the bucket and this upper limit. This upper limit can be 10 or 8, meaning each thread can process a maximum of 10 or 8 points to be calculated. Of course, other values ​​can be set as needed in practical applications; this embodiment does not limit this.

[0157] As an example, the formula for calculating the number of threads allocated to a bucket can be: Among them, symbols This indicates rounding up. T represents the number of points to be calculated in the bucket, and m represents the upper limit, which can be a preset constant and may be the same as or different from the aforementioned preset threshold. For example, if the number of points to be calculated in the bucket is 91 and the upper limit is 10, the formula can be used to calculate that the number of threads to be allocated is 10.

[0158] Optionally, after allocating threads to each bucket, the CPU can transmit the thread allocation results to the GPU. These results may include each concatenation index and the corresponding number of threads. For example, the CPU can initiate a GPU computation task, which may include the bucket concatenation index and the corresponding number of threads (i.e., the thread allocation result), allowing the GPU to perform computations based on this task.

[0159] Figure 7 illustrates a multiscalar multiplication (MSM) calculation method according to an exemplary embodiment of this specification. The method is applied in a central processing unit (CPU), and the MSM is implemented based on the Pippenger algorithm running in a GPU. The method may include the following steps.

[0160] In step 702, the bucket data copied by the graphics processor (GPU) to the memory space is read.

[0161] The GPU is used to execute the steps of the method described in the foregoing embodiments; the bucket data refers to the bucket data of the n buckets with the highest number of points to be computed, determined by the GPU based on the current MSM to be computed.

[0162] In step 704, after determining whether the number of points to be calculated in each of the n buckets is greater than or equal to a preset threshold, the thread allocation results are determined: buckets with a number greater than or equal to the preset threshold are allocated to multiple GPU threads, and buckets with a number less than the preset threshold are allocated to a single GPU thread. The thread allocation results are then transmitted to the GPU.

[0163] This embodiment describes, from the CPU's perspective, the process of determining whether the number of points to be computed in the n largest buckets is greater than or equal to a preset threshold based on the bucket data copied from the GPU to memory, and the process of allocating multiple threads to large buckets and a single thread to small buckets. For details, please refer to the description in the preceding embodiments; further elaboration will not be repeated here.

[0164] As can be seen from the above embodiments, in this embodiment, buckets with a large number of computation points are allocated enough GPU threads for processing, avoiding a situation where one thread is busy while others are idle. Meanwhile, the vast majority of buckets have a small number of computation points, so each small bucket is still allocated a single thread for processing, instead of using multiple GPU threads regardless of bucket size as in existing solutions. By reasonably controlling the number of threads, this embodiment can keep GPU utilization at its maximum. The most significant additional overhead is the cost of copying data from the GPU to the CPU, but this overhead is usually low and negligible.

[0165] This specification also provides a graphics processor for performing the steps of the method described in the first aspect.

[0166] This specification also provides a computer device, as shown in FIG8, which is a schematic diagram of the structure of a computer device according to this embodiment. The computer device includes a graphics processor and a central processing unit. The graphics processor is used to execute the steps of the method described in the foregoing embodiments, and the central processing unit is used to execute the steps of the method described in the foregoing embodiments. In practical applications, the computer device may also include other hardware such as a network interface, memory, and non-volatile memory, which will not be described in detail in this embodiment.

[0167] This specification also provides a computer program product, including a computer program that, when executed by a graphics processor, implements the steps of the methods described in the foregoing embodiments; and / or, when executed by a central processing unit, implements the steps of the methods described in the foregoing embodiments.

[0168] This specification also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a graphics processor, implements the steps of the method described in the foregoing embodiments; and / or, when executed by a central processing unit, implements the steps of the method described in the foregoing embodiments.

[0169] Corresponding to the aforementioned embodiments of the calculation method for multi-scalar multiplication (MSM), this specification also provides embodiments of the calculation apparatus for multi-scalar multiplication (MSM).

[0170] The embodiments of the computing device for the multiscalar multiplication method (MSM) described in this specification can be applied to computer devices. These embodiments can be implemented in software, hardware, or a combination of both. Taking software implementation as an example, as a logical device, it is formed by its processor reading the corresponding computer program instructions from non-volatile memory into memory and executing them.

[0171] Figure 9A shows a schematic diagram of a computing device for multi-scalar multiplication (MSM) according to an exemplary embodiment of this specification. The device can be applied to a graphics processing unit (GPU) that performs the MSM calculation. The device includes the following modules.

[0172] The acquisition module 901 is used to: acquire the bucketing results determined for the current MSM to be calculated; wherein the bucketing results represent the bucket to which each point to be calculated in the MSM to be calculated belongs.

[0173] The determination module 902 is used to: determine the number of points to be calculated in each bucket based on the bucketing results.

[0174] The calculation module 903 is used to: perform calculations on each of the buckets; wherein, the buckets whose number is greater than or equal to a preset threshold are calculated using multiple GPU threads, and the buckets whose number is less than the preset threshold are calculated using a single GPU thread.

[0175] In some examples, each bucket data entry in the bucketing result includes: the point to be calculated, the window index of the window containing the bucket to which the point to be calculated belongs, and the bucket index of the bucket to which the point to be calculated belongs; the calculation module 902 is used to: concatenate the window index and bucket index in each bucket data entry to obtain a concatenated index, and then obtain a concatenated index sequence from the concatenated indexes of each bucket data entry; sort each concatenated index in the concatenated index sequence to obtain a sorted concatenated index sequence; and count the occurrence frequency of each concatenated index in the sorted concatenated index sequence using a run-length encoding function, wherein the occurrence frequency represents the number of points to be calculated in each bucket.

[0176] In some examples, the computing module 902 is configured to: sort the concatenated indices in the concatenated index sequence using a sorting function provided by the GPU's programming tool library; and / or, the run-length encoding function is a function provided by the GPU's programming tool library.

[0177] In some examples, the computer device housing the GPU includes a central processing unit (CPU); the computing module 902 is configured to: acquire bucket data for the n buckets with the highest number of buckets; where n is a positive integer; determine that the other buckets, excluding the n buckets with the highest number of buckets, will be computed using a single GPU thread; copy the bucket data for the n buckets with the highest number of buckets to the memory space of the CPU; and acquire the thread allocation result of the CPU for the n buckets with the highest number of buckets; wherein the CPU is configured to, after reading the bucket data for the n buckets from the memory space, determine whether the number of computation points in each of the n buckets is greater than or equal to a preset threshold, determine the thread allocation result for buckets with a number greater than or equal to the preset threshold that are allocated to multiple GPU threads, and buckets with a number less than the preset threshold that are allocated to a single GPU thread, and transmit the thread allocation result to the GPU.

[0178] In some examples, obtaining the bucket data of the n buckets with the highest number of occurrences includes: sorting each concatenation index in reverse order by the occurrence count using the reverse sorting function provided by the GPU's programming tool library, and obtaining the bucket data of the n buckets with the highest number of occurrences based on the reverse sorting result.

[0179] In some examples, the GPU is used to perform zero-knowledge proof tasks.

[0180] Figure 9B is a schematic diagram of a computing device for a multi-scalar multiplication method (MSM) according to an exemplary embodiment of this specification. The device is applied in a central processing unit (CPU) and includes: a reading module 912, configured to: read bucket data copied by a graphics processing unit (GPU) to memory space; the GPU is configured to execute the steps of the method described in the foregoing embodiments; the bucket data refers to the bucket data of the n buckets with the highest number of points to be computed, determined by the GPU based on the current MSM to be computed and the bucketing result; and a determining module 914, configured to: determine whether the number of points to be computed in each of the n buckets is greater than or equal to a preset threshold, and then determine the thread allocation result for buckets with a number greater than or equal to the preset threshold, allocating multiple GPU threads to the buckets, and allocating a single GPU thread to the buckets with a number less than the preset threshold, and transmit the thread allocation result to the GPU.

[0181] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0182] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0183] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0184] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes the elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0185] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0186] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in one or more flowchart illustrations and / or one or more block diagrams.

[0187] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means that implement the functions specified in one or more flowcharts and / or one or more block diagrams.

[0188] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, such that the instructions, which execute on the computer or other programmable apparatus, provide steps for implementing the functions specified in one or more flowcharts and / or one or more block diagrams.

[0189] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0190] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0191] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0192] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0193] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0194] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0195] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A method for calculating Multiscalar Multiplication (MSM), the method being applied in a graphics processing unit (GPU) performing the MSM calculation, the method comprising: Obtain the bucketing results determined for the current MSM to be computed; wherein, the bucketing results represent the bucket to which each point to be computed in the MSM to be computed belongs; Based on the binning results, determine the number of points to be calculated in each bin; The calculation is performed on each of the buckets; wherein, the buckets whose number is greater than or equal to a preset threshold are calculated using multiple GPU threads, and the buckets whose number is less than the preset threshold are calculated using a single GPU thread.

2. The method according to claim 1, wherein each bucketed data entry in the bucketing result includes: The point to be calculated, the window index of the window containing the bucket to which the point to be calculated belongs, and the bucket index of the bucket to which the point to be calculated belongs; The step of determining the number of points to be calculated in each bucket based on the bucketing results includes: After concatenating the window index and bucket index in each bucket of data to obtain the concatenated index, the concatenated index sequence is obtained by retrieving the concatenated index of each bucket of data. Sort each concatenation index in the concatenation index sequence to obtain a sorted concatenation index sequence; The occurrence count of each concatenated index in the sorted concatenated index sequence is counted using a run-length encoding function, where the occurrence count represents the number of points to be calculated in each bucket.

3. The method according to claim 2, wherein sorting the concatenated indices in the concatenated index sequence comprises: The concatenated indices in the concatenated index sequence are sorted using the sorting functions provided by the GPU's programming tool library. And / or, The run-length encoding function is a function provided by the GPU's programming tool library.

4. The method according to claim 1 or 2, wherein the computer device in which the GPU is located includes a central processing unit (CPU); the method further includes: Get the data of the n buckets with the highest number of data; where n is a positive integer; for the other buckets besides the n buckets with the highest number of data, determine that a single GPU thread will be used for calculation; Copy the data of the n buckets with the highest number to the memory space of the CPU, and obtain the thread allocation result of the CPU for the n buckets with the highest number; The CPU reads the bucket data of the n buckets from the memory space, determines whether the number of points to be calculated in each of the n buckets is greater than or equal to the preset threshold, determines the thread allocation result of assigning multiple GPU threads to buckets with a number greater than or equal to the preset threshold and assigning a single GPU thread to buckets with a number less than the preset threshold, and transmits the thread allocation result to the GPU.

5. The method according to claim 4, wherein obtaining the bucket data of the n buckets with the highest quantity includes: Using the reverse sorting function provided by the GPU's programming tool library, each concatenated index is sorted in reverse order based on its occurrence count, and the data of the top n buckets with the highest number of occurrences is obtained based on the reverse sorting result.

6. The method according to claim 1, wherein the GPU is used to perform zero-knowledge proof tasks.

7. A method for calculating multiscalar multiplication (MSM), the method being applied in a central processing unit (CPU), the method comprising: Read the data from the bucket that the graphics processing unit (GPU) copied to the memory space; The GPU is used to perform the steps of the method according to any one of claims 1 to 6; the bucket data refers to the bucket data of the n buckets with the highest number of points to be computed determined from the bucketing results after the GPU determines the bucketing results based on the current MSM to be computed. After determining whether the number of points to be calculated in each of the n buckets is greater than or equal to a preset threshold, the thread allocation results are determined: buckets with a number greater than or equal to the preset threshold are allocated to multiple GPU threads, and buckets with a number less than the preset threshold are allocated to a single GPU thread. The thread allocation results are then transmitted to the GPU.

8. A graphics processor for performing the steps of the method according to any one of claims 1 to 6.

9. A computer device comprising a graphics processor and a central processing unit, the graphics processor being configured to perform the steps of the method of any one of claims 1 to 6, and the central processing unit being configured to perform the steps of the method of claim 7.

10. A computer program product comprising a computer program that, when executed by a graphics processor, implements the steps of the method of any one of claims 1 to 6; and / or, when executed by a central processing unit, implements the steps of the method of claim 7.

11. A computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a graphics processor, implements the steps of the method of any one of claims 1 to 6; and / or, when executed by a central processing unit, the computer program implements the steps of the method of claim 7.

Images