Method and apparatus for performing low-density parity-check (ldpc) code operations using a multi-level permutation

BACKGROUND OF THE INVENTION:

0001Nearly all forms of electronic communication and storage systems use error-correcting codes. Error correcting codes compensate for the intrinsic unreliability of information transfer in these systems by introducing redundancy into the data stream. The mathematical foundations of error correcting were established by Shannon. Shannon developed the mathematical concept of the channel in which distortion of signals in communications systems is modeled as a random process. The most fundamental result of Shannon is the Noisy channel theorem, which defines for the channel a <i>capacity,</i> a quantity that specifies the maximum rate at which information can be reliably delivered through the channel. Reliable transmission at rates approaching capacity requires the use of error correcting codes. Thus, error-correcting codes are designed to achieve sufficient reliability while approaching capacity as closely as possible. The complexity of implementing the error correcting code is an additional factor that always comes into play in practical applications of error correcting codes. Recent advances in error correcting coding systems resulting from the invention of turbo codes and the subsequent rediscovery and development of low-density parity-check (LDPC) codes offer coding systems of feasible complexity that can approach Shannon's capacity quite closely.

0002LDPC codes are well represented by bipartite graphs, often called Tanner graphs, see <figref idref="f0001">Fig. 1</figref> diagram 100, in which one set of nodes, the <i>variable</i> nodes 102, corresponds to bits of the codeword and the other set of nodes, the <i>constraint</i> nodes 106, sometimes called <i>check</i> nodes, correspond to the set of parity-check constraints which define the code. Edges 104 in the graph connect variable nodes to constraint nodes. A variable node and a constraint node are said to be <i>neighbors</i> if they are connected by an edge in the graph. One typically assumes that a pair of nodes is connected by at most one edge. LDPC codes can equivalently be represented using the parity check matrix. <figref idref="f0001">Fig. 2</figref> presents an example where the indicated vector x 204 is a codeword if and only if Hx=0, where H 202 is a parity check matrix.

0003To each variable node is associated one bit of the codeword. In some cases some of these bits might be <i>punctured or known.</i> Punctured bits may be desirable in certain code structures and, in liftings (see below), both punctured and known bits can be used to achieve block lengths that are not multiples of the lifting. Punctured bits and known bits are excluded from the transmitted codeword.

0004A bit sequence associated one-to-one with the variable node sequence is a codeword of the code if and only if, for each constraint node, the bits neighboring the constraint (via their association with variable nodes) sum to zero modulo two, i.e., they comprise an even number of ones.

0005The decoders and decoding algorithms used to decode LDPC codewords operate by exchanging messages within the graph along the edges and updating these messages by performing computations at the nodes based on the incoming messages. Such algorithms will be generally referred to as message passing algorithms. Each variable node in the graph is initially provided with a soft bit, termed a <i>received value,</i> that indicates an estimate of the associated bit's value as determined by observations from, e.g., the communications channel. Ideally, the estimates for separate bits are statistically independent. This ideal can be, and often is, violated in practice.

0006The number of edges attached to a node, i.e., a variable node or constraint node, is referred to as the <i>degree</i> of the node. A <i>regular</i> graph or code is one for which all variable nodes have the same degree, j say, and all constraint nodes have the same degree, k say. In this case we say that the code is a (j,k) regular code. These were the codes considered originally by Gallager (1961). In contrast to a "regular" code, an irregular code has constraint nodes and/or variable nodes of differing degrees. For example, some variable nodes may be of degree 4, others of degree 3 and still others of degree 2.

0007While irregular codes can be more complicated to represent and/or implement, it has been shown that irregular LDPC codes can provide superior error correction/detection performance when compared to regular LDPC codes.

0008While implementation of LDPC encoders and decoders using multiple parallel processing elements to process sets of data as part of an encoding or decoding operation have proven both useful and reliable, in known implementations the number of parallel processing elements used in a decoder are normally the same as the number of parallel processing elements used in the encoder. Thus, in a system with multiple devices, e.g., a centralized device such as base station and/or satellite, which interacts with multiple mobile devices, the LDPC encoders and decoders in each of the devices in the system would normally have the same level of parallelism.

0009Given that the centralized device services multiple mobile devices, assuming real time operation and the same level of parallelism within the encoder/decoder, the centralized device will have to operate at a rate many times faster than the individual devices to keep up with the encoding/decoding associated with the various mobile devices being serviced.

0010From an implementation standpoint, it would be beneficial if the level of parallelism in different LDPC encoder/decoders in a system could be different. Such an approach would allow the level of parallelism in the encoder and/or decoder in a particular device to be matched to the amount of data to be transmitted/received by the device. By minimizing the amount of parallelism in a particular device, implementation costs can be minimized.

0011Use of large codes, e.g., including many nodes, which correspond to large graph structures offer many advantages over smaller codes, e.g., including only a few nodes, in terms of error resiliency. To implement a large graph structure using a smaller graph, various permutations may be applied to copies of the smaller graph structure and the copies can be linked together to generate a larger graph structure. In encoding/decoding operations, such permutation operations may be implemented by a switching device, referred to herein as a permuter which applies a permutation operation on elements, e.g., bits to be encoded in the case of an encoding operation or messages in the case of a decoding operation, as they are passed between a memory and a vector processing unit which performs LDPC operations in parallel.

0012Unfortunately, many LDPC codes do not lend themselves to implementations which would allow multiple different levels of parallelism in an encoder and decoder. In addition, while a single simple permutation operation like a cyclic shift is suitable for implementing a permuter suitable for use with many LDPC codes which can be represented using a large graph generated from a smaller graph, such a single permutation operation does not lend itself to implementing LDPC codes which could be implemented using different levels of parallelism.

0013In view of the above discussion, it should be appreciated that there is a need for codes and methods and apparatus for implementing LDPC encoders/decoders in a manner which allow for different degrees of parallelism in different devices which use the same code, e.g., LDPC graph structure, to perform LDPC encoding and/or LPDC decoding operations. In addition, there is a need for a practical way of implementing such encoders/decoders, e.g., through the use of new and improved permuters which would allow devices to use relatively large codes which can be derived from smaller graphs, but which also allow for different levels of parallelism to be implemented in different devices. Prior art publication "<nplcit id="ncit0001" npl-type="s"><text>Low-Power VLSI Decoder Architectures for LDPC Codes" by M.M. Mansour et al., published on 14 August 2002</text></nplcit>, discloses decoding of LDPC codes, constructed by permutation matrices, and where the decoding is based on carrying out the necessary permutations according to the permutation matrices and their arrangement within the H-matrix.

SUMMARY

0014The method of the present invention can be used to implement a communications system wherein different devices using the same LDPC code can implement different levels of parallelism. In order to obtain a high level of error resiliency, relatively long codewords are often used. For example, a single codeword generated by performing an encoding operation using a LDPC code of the present invention may include a total number of bits T, where T may be several hundred or even thousands of bits. For purposes of explaining the invention it is to be understood that bits to be encoded and/or bits corresponding to a received codeword may be arranged into L Z element vectors, where Z is a positive integer greater than 1. Each Z element vector includes Z elements and may be read from memory. The vector read from memory can then be processed using Z processing units in parallel. In contrast to existing systems, which use the same number of Z processing elements in parallel in an encoder that encodes codewords using a particular LDPC code (graph structure) as are used in the decoder implementing the same LDPC code, the present invention allows for different levels of parallelism in the encoders and decoders using the same code. In some embodiments, the encoder in a device using a particular code is implemented using a different number of parallel processing units than are used in decoder implementing the same code. Encoding is usually less processor intensive than decoding so, in some embodiments, within a single device, different numbers of processing elements are used in parallel in the decoder than in the encoder with the encoder often having fewer processing elements operating in parallel.

0015Within a system, different devices may have to encode different amounts of data in real time. Consider a base station serving four wireless terminals. Assuming each wireless terminal transmits and receives the same amount of data, the base station will have to encode and decode 4 times as much data as any of the individual wireless terminals. In some embodiments, the base station or satellite which services multiple nodes is implemented using more processing units in parallel than individual wireless terminals serviced by the base station or satellite. In some systems implemented in accordance with the invention, different wireless terminals within the system using the same code are implemented with different number of parallel processing elements to reflect the different amounts of data each device will have to encode and decode. The use of a novel class of LDPC codes which will be discussed below makes such differences in parallelism possible. Use of a factorable permuter in various embodiments of the invention make LDPC devices with different levels of parallelism in the encoder and decoder relatively easy to implement when using the codes in the class of LDPC codes discussed herein.

BRIEF DESCRIPTION OF THE DRAWINGS:

0016<ul id="ul0001" list-style="none"><li><figref idref="f0001">Figure 1</figref> is a diagram representing an LPDC code as a bipartite (Tanner) graph.</li><li><figref idref="f0001">Figure 2</figref> is a diagram representing an LPDC code using a parity check matrix.</li><li><figref idref="f0002">Figure 3</figref> is a diagram illustrating an exemplary lifting on a Tanner graph.</li><li><figref idref="f0002">Figure 4</figref> is a parity check matrix corresponding to the Tanner graph representation of <figref idref="f0002">Figure 3</figref>.</li><li><figref idref="f0003">Figure 5</figref> shows an exemplary lifted version of the matrix of <figref idref="f0001">Figure 2</figref>, where the Z lifting value = 3 and the permutations used are cyclic permutations.</li><li><figref idref="f0004">Figure 6</figref> is an illustration of an exemplary communications system implemented in accordance with the present invention and using methods in accordance with the present invention.</li><li><figref idref="f0005">Figure 7</figref> is an illustration of an exemplary system which can be used to implement LDPC operations in accordance with the present invention.</li><li><figref idref="f0005">Figure 8</figref> is an illustration of another exemplary system which can be used to implement LDPC operations in accordance with the present invention.</li><li><figref idref="f0006 f0007">Figure 9-11</figref> are examples of using the methods of the present invention in a portion of a system, such as the system shown in <figref idref="f0005">Fig. 7</figref>, which are used to describe steps of various exemplary methods of the present invention which use a factorable permuter to perform LDPC operations.</li><li><figref idref="f0008">Figure 12</figref> illustrates an processing element including an XOR circuit and a storage device, e.g., accumulator, which can be used in a parallel LDPC processor module in accordance with the invention.</li></ul>

DETAILED DESCRIPTION OF THE INVENTION:

0017<figref idref="f0004">Fig. 6</figref> illustrates an exemplary communications system 600 which includes a base station 602, a first wireless terminal 632 and a second wireless terminal 662. The first and second wireless terminals 632, 662 communication with the base station 602 via wireless links 630, 660. Each of the devices 602, 632, 662 includes an encoder 604, 634, 664 and a decoder 606, 636, 666 implemented in accordance with the present invention. The encoders and decoders of each device are coupled to a wireless transceiver (transmitter/receiver) 608, 638, 668 through which the devices communicate with one another. Each device 602, 632 662 also includes a CPU 613, 643, 673 and a set of control routines which are stored in memory 615, 645, 675. The control routines, when executed by the CPU 613, 643, 673 control the device to perform various communications operations. In some embodiments, routines 615, 645, 675 include an encoder routine and/or a decoder routine which use one or more codes in accordance with the present invention to perform an encoding and/or decoding operation which includes a factorable permutation operation. In the particular example shown in <figref idref="f0004">Fig. 6</figref>, various encoding and decoding operations are implemented in hardware. In accordance with the novel LPDC encoding and decoding methods of the invention a device having the same general structure can be used for either encoding or decoding operations. In the case of the base station encoder 604 and decoder 606, it can be seen that the basic structure of these devices includes a factorable permuter 612, 622 which is used to couple a memory 610, 620 used to store vectors of elements which are to be processed by a parallel LDPC processing module 614, 624 which includes a number of processing elements (616, 618) (624, 628) which perform parity check operations in parallel. The parallel LDPC processing module 614 includes one processing element for each element of a vector which may be read out of memory 610. Accordingly, when processing Z element vectors (vectors with Z elements) the module 614 will include Z processing elements 616, 618. In the case of the encoder 604 Z=Me. The number of processing elements Me in the encoder module 614 may be different from the number of processing element Md in the decoder processing module 624. In other words, the encoder and decoder may use vectors with a different number of Z elements, and thus a different level of parallelism, even though they implement the same code. The encoder 604 differs from the decoder 606 in that the vectors read out and processed by the encoder normally include single bit elements, e.g., information values to be encoded. In the case of the decoder elements of vectors which are stored in memory and passed to the processing module 624 normally include elements which each include multiple bits, e.g., are messages, corresponding to portions of a received codeword which are being decoded.

0018The encoder 604 and decoder 606 also differ in the processing operation performed by the processing elements (616, 618) and (626, 628). In the case of the encoder 604, each processor normally performs a logical XOR with a stored value and then replaces the stored value with the result of the XOR operation. Thus, processing elements 616, 618 may be implemented using an XOR circuit and a storage element which acts as an accumulator. <figref idref="f0008">Figure 12</figref> illustrates one processing element including an XOR circuit and a storage device, e.g., accumulator, which can be used in a parallel LDPC processor module in accordance with the invention. At a point in the processing determined by the code (graph structure) being implemented, the result held in the encoder's processors 616, 618 is stored in memory 610. The processing elements 626, 628 perform variable node and/or check node processing operations. While these operations often involve an XOR and accumulate operation, there tend to be additional processing involved with the multi-bit messages being processed by each processing element 626, 628 making decoding operations more complicated than encoding operations.

0019Several of the patent applications incorporated herein by reference discuss in detail a variety of ways in which the parallel LPDC processing module elements 616, 618, 626, 628 can be implemented.

0020In accordance with the present invention, factorable permuters 612, 622 perform, on at least some vectors processed by the permuter 612, 622, either a unity permutation operation (no change) or a permutation operation which is the product of two permutation operations. Thus, the factorable permuter may pass a vector without reordering the elements in the vector or, reorder the elements in a vector, e.g., by performing two sequential permutation operations with the output being the vector of reordered elements, said reordering being the result of composing the two permutation operations. Exemplary permutation operations will be discussed in detail in regard to the figures which follow. In some embodiments factorable permutations are performed as multi-level switching operations. In a first level of switching elements are reordered within the vector being processed, e.g., by shifting n equal sized portions, i.e., subsets of the elements, in the vector using a first cyclic shift. The elements of the processed vector are then further permuted by a second permutation permuting elements within the n equal sized portions but not between portions. The same second permutation is performed on each of the n equal sized portions resulting in the same change in element positions in each of the portions. An equivalent description is as follows. The vector of Z elements are partitioned using a first partition into Z/n equal sized portions and also, using a second partition, into n equal sized portions. This is done in such a way that each of the Z/n equal sized portions in the first partition contain exactly one element in common with each of the n portions in the second partition. Then, the above described first permutation reorders elements within the Z/n portions defined by the first partition, each reordering being identical, but does not alter the first partition. The second permutation reorders elements within the n portions defined by the second partition, each reordering being identical, but does not alter the second partition.

0021In some embodiments of the present invention, the factorable permuter 612 performs a product of two cyclic permutations also known as cyclic shifts. While a single cyclic shift is not factorable, a product of two cyclic shifts is factorable since it can be factored into the two cyclic shifts which produce the product. To give a concrete example, let us assume Z=4. Under a cyclic shift, a vector (v₀,v₁,v₂,v₃) is reordered as (v_0+k, v_1+k, v_2+k, v_3+k) where k is an integer on [0,3] an the addition is modulo 4. Under the product of two cyclic shifts of size 2, a vector (v₀,v₁,v₂,v₃) is reordered as (v_0+2k+j, v_1+2k-j, v_2+2k+j, v_3+2k-j) where k is an integer in [0,1] and j is an integer in [0,1] and all arithmetic is modulo 4. In the case of the product of two cyclic shifts, the first partition is {v₀,v₁} {v₂,v₃} and the second partition is {v₀,v₂} {v₁,v₃}. The first permutation is decided by choosing j, and the second permutation is decided by choosing k. As will be discussed below, the particular reorderings which are performed are a function of the code being implemented with the reorderings being used to, in effect, connect various nodes in the graph by directing vector elements which are to be processed to the processing element corresponding to a particular node in the graph which defines the code being implemented.

0022The encoders and decoders of the wireless terminals are similar to those described with regard to the base station encoder 604 and decoder 606, respectively but may implement different levels of parallelism. The encoders 634, 664 and decoder 636, 666 each include a memory 640, 670, 650, 680 which is coupled by a factorable permuter 642, 672, 652, 682 to a parallel LDPC processing module 644, 674, 654, 684 respectively.

0023The methods and apparatus of the present invention can be better appreciated and understood in the context of various other LDPC coding patents and applications. Various elements, e.g., processing elements which perform LDPC operations, described in the applications included herein, may be used to implement the parallel vector processor described in the exemplary system. Various applications incorporated herein also discuss how memory access and switching operation used to perform permutation operations can be implemented based on stored information providing LDPC code (graph) information. While the codes and permutation operations described are different than those described in the present application, the memory access and switching control operations can be controlled in the same or a similar manner based on stored LPDC code information. Accordingly, such control techniques will be discussed in detail herein. In addition, since such processing elements, e.g., variable node and check node processing elements among others, are described in detail in the incorporated applications, their implementation and function will only be briefly discussed in the present application

0024<figref idref="f0005">Figures 7 and 8</figref> illustrate exemplary systems 700, 800 which can be used to implement LDPC operations in accordance with the present invention, e.g., either an encoding or a decoding LDPC operation depending on such things as the data to be processed, e.g., a received codeword (implying a decoding operation) or information to be generated into a codeword (implying an encoding operation).

0025The systems 700, 800 each include a memory 702, 802, an address generator 716, 816, an address generator and permuter controller 718, 818, stored LDPC code (graph) information 720, 820, a Z element parallel LDPC processing module 710, 810 and a factorable permuter 706, 806. Information to be processed is stored in memory 702, 802 via the memory input for processing. In the case of encoding, when processing is complete the result is read out of memory 702, 802. While processing is ongoing, Z element vectors are read from and written to memory under control of the address generator and permuter controller 718, 818. The address generator and permuter controller 718, 818 uses LDPC code (graph) information 720, 820 and information about the level of parallelism which has been implemented, e.g., the number of elements Z to be processed in parallel, to control the address generator 716, 816 to generate addresses used for read and/or write operations while also controlling the factorable permuter 706, 806 to perform the switching operations, vector element reordering, used to achieve the particular implemented graph structure corresponding to the code being implemented. Address generator and permuter controller 718, 818 also generates a control signal which is passed through the address generator 716, 816 to the memory 702, 802 to indicate whether a read or a write is to be performed at any given point in time. Thus, address generator and permuter control 718, 818 controls not only the switching performed by factorable permuter 706, 806 but also when vectors to be processed are read from memory 702, 802 and when processing results generated by modules 710, 810 are written into memory 702, 802.

0026The main difference between the <figref idref="f0005">Fig 7 and 8</figref> embodiments is that the factorable permuter 706 in the system 700 performs re-ordering operations on an input vector 704 to generate a reordered vector 708 prior to processing of the vector elements by the processing elements 712, 714 included in the parallel LDPC processing module 710. The results of the processing, e.g, a Z element vector is stored in memory 702. In the case of the <figref idref="f0005">Fig. 8</figref> embodiment, the re-ordering by the factorable permuter 806 is performed on the Z element vector 804 generated by the processing elements 812, 814. Whether re-orderings are performed prior to processing by module 710, 810 or subsequent to processing is largely a matter of design choice.

0027To appreciate the novel codes used in various embodiments of the present invention, and the novel codewords that result from the use of such LDPC codes, "liftings" will now be discussed. In general a "lifting" or vectorization of LDPC codes is described as follows. We start with a Tanner graph or a parity check matrix representation of a small LDPC code, as in <figref idref="f0001">Figures 1 and 2</figref>. We describe the lifting from the parity check matrix perspective first. In a Z-lifting, each entry of the parity check matrix is replaced by a ZxZ matrix. 0 entries in H become 0 ZxZ matrices and Is in H become permutation matrices, usually belonging to some group. <figref idref="f0003">Fig 5</figref> shows matrix 502, a lifted version of the matrix in <figref idref="f0001">Fig 2</figref> where Z=3 and the permutations used are cyclic permutations. A lifting can be interpreted on the Tanner graph as follows. Each node in the Tanner graph is replaced by Z equivalent nodes, forming a bundle of nodes, and each edge by a bundle of Z edges. Assume that each element of a bundle is given an index in 0,... ,Z-1. A bundle of Z edges connects a bundle of variable nodes to a bundle of constraint nodes. If each connection is made by connecting nodes and edges of like index, then the construction is, in effect Z parallel copies of the original graph. Such a construction is illustrated in <figref idref="f0002">Fig. 3</figref> diagram 300 corresponding to the basic example in <figref idref="f0001">Figs 1 and 2</figref>. The parity check matrix corresponding to the graph in <figref idref="f0002">Fig. 3</figref> is shown in <figref idref="f0002">Fig. 4</figref> drawing 400. If the connections on, e.g., the constraint side are permuted, i.e., the edge with index j is connected to the constraint node with index <i>π</i>(j), where <i>π</i> denotes a permutation, e.g., a cyclic permutation, on 0,...,Z-1, then the resulting graph can become fully connected and is viewed as a lifted graph. Note that the projected graph may have multiple edges between a pair of nodes while the lifted graph need not. If, for example, the permutations associated to the edges in a multiple edge are all distinct, then the lifted graph will not have corresponding multiple edges.

0028This architecture supports efficient high speed decoding of a large class of LDPC type codes. The supported codes are lifted or vectorized LDPC codes. In the application S.N. 09/975,331 it was suggested that cyclic permutations were a simple and desirable class of permutations to use. Using these permutations induces a group structure on the code, leading to efficient parallel encoding and decoding where the parallelism is on the scale of the size of the lifting, e.g., of the order of the cyclic structure.

0029There are situations, it turns out, where it is desirable to have a given code that can be viewed as a lifting not of just one size, but of two or more sizes thereby facilitating the possibility of different levels of parallelism in encoders/decoders using the same code. This realization and the resulting code structures of the present invention allow for efficient encoder and/or decoder implementations which can have different levels of parallelism using the same LDPC codes. Encoders, decoders, codewords and encoded data which use or are produced by the use of the code structures of the present invention are also to be considered features of the invention.

0030Consider the following example used to explain the invention. We wish to encode in a digital signal processor (DSP), so 16 times parallelism (lifting) is desirable, but we want to make a small decoder, with 4 wide parallelism. The DSP with 16 times parallelism may be used, e.g., in a base station serving 4 mobile devices each of which receives data at roughly ¼ the data rate at which the encoder in the base station operates. Each mobile device in such a system may use the same code as the encoder but be implemented in accordance with the invention with a decoder with 4 wide parallelism reflecting the fact that the mobile device has approximately 4 times as much time to process the same amount of data. Assuming the base station serves three mobiles, e.g. first and second mobiles operating at roughly ¼ the data rate of the encoder and a third mobile at ½ the data rate of the encoder, decoders using 4 times parallelism in the first two mobiles may be used with 8 times parallelism used in the third mobile which supports decoding at ½ the rate of the encoder.

0031The method of the present invention of supporting different levels of encoder and decoder parallelism are useful in a wide range of other applications as well. Another example is the following. We wish to design a code for a very high-speed application requiring large parallelism. We would like to simulate the code on an FPGA (Floating Point Gate Array) platform before proceeding to an ASIC implementation. The FPGA does not support the parallelism required of the application so we cannot simulate the exact code intended for the final application. In the first case, it would be desirable to have a code that can be viewed both as a 4-lifting and a 16-lifting. In a second case we might want a code that is simultaneously a 64-lifting and a 256-lifting. A third scenario is high speed applications where hardware encoders are required. Since hardware encoders generally run faster than decoders we would like to be able to reduce the parallelism (gate count) in the encoder and run it at slower speeds, more closely matching the decoder speed. A fourth scenario is a standardized code that requires implementation at different throughputs, e.g., at different speeds. A fifth scenario is software implementations: the structure of the code can be matched to the inherent parallelism in typical micro-processors. The current invention makes the above possible while maintaining a level of permutation complexity that is close to that required for cyclic permutations. Moreover, there is a potential savings in complexity with regard to the description of the code: if the code has more parallelism than the implementation (by having another factor in the product) then that additional structure can be used to yield a more compact description of the code. This can allow for simplified message passing control. It is largely in the context of the Vector-LDPC architecture that the benefits of such multi-level or product liftings are realized.

0032Applicant believes that the LDPC code structures used in various embodiments of the present invention which support different levels of parallelism for a single code have not been suggested in available LDPC literature. It is the inventors realization that the class of LDPC codes used in various embodiments of the present invention, offer implementation benefits especially in the context of the V-LDPC (Vector-LDPC) architecture that forms one of the bases of the invention over other LDPC codes.

Matched Liftings

0033Before describing product liftings, and to facilitate their description, we first describe a general class of liftings that have additional mathematical structure. We note that liftings by cyclic groups fall in this class.

0034When the order of (the number of elements in) the group used in the lifting is the same as size Z of the lifting then a mathematical structure arises that can be advantageously exploited. We refer to such a lifting as a <i>matched lifting.</i> In a matched lifting, sums over GF[2] of the ZxZ permutation matrices used in the lifting and binary vectors of length Z can simultaneously be identified with elements of a <i>ring.</i> Elements of the ring can be conveniently represented as binary vectors of length Z where addition is bit-wise modulo 2 addition and multiplication arises from the group structure. As a consequence, replacing each element of the projected parity check matrix with an element of the ring forms a lifted parity check matrix. Replacing each bit with an element of the ring lifts the binary codeword of the projected graph. The overall code is still binary, but it is represented as a Z-times smaller code over the ring. One can show that binary matrix operations on the full lifted parity check matrix can be mimicked as operations over the ring. This simplifies encoder extraction dramatically. Moreover, the mathematical structure guarantees that encoding may be performed in the ring.

0035We now present the mathematical structure of matched liftings.

0036Suppose we have a group <i>g</i> of order <i>Z</i> with elements <i>g</i>₁,..., <i>g_Z</i>, where, by convention, <i>g</i>₁ is the identity element. The group can be represented using permutations <i>p</i>₁<i>,...,p_Z</i> by setting <i>π_i</i>(<i>k</i>) = <i>j</i> if and only if <i>g_ig_k</i> = <i>g_j.</i> Correspondingly, we can represent the group using <i>ZxZ</i> permutation matrices G¹,...,G<i>^Z</i> where <maths id="math0001" num=""><math display="inline"><msubsup><mi mathvariant="bold">G</mi><mrow><msub><mi>π</mi><mi>i</mi></msub><mfenced><mi>k</mi></mfenced><mo>,</mo><mi>k</mi></mrow><mi>j</mi></msubsup><mo>=</mo><mn>1</mn></math><img file="EP1597828B1_D0001.tif" /></maths> for <i>k</i>=1,...,<i>Z</i> and all other entries are 0.

0037Given such a group we define a ring whose elements are binary vectors of length <i>Z</i>. A binary vector <i>u</i> = (<i>u</i>₁<i>,</i>...,<i>u_Z</i>) can be identified with a subset of <i>G</i>, or, equivalently, with a formal sum <maths id="math0002" num=""><math display="inline"><mn>1</mn><mstyle displaystyle="true"><munderover><mo>∑</mo><mrow><mi>i</mi><mo>=</mo><mn>0</mn></mrow><mi>Z</mi></munderover><mrow><msub><mi>u</mi><mi>i</mi></msub><msup><mi>G</mi><mi>i</mi></msup></mrow></mstyle><mo>.</mo></math><img file="EP1597828B1_D0002.tif" /></maths> Here, <i>u_i</i> = 1 indicates that <i>g_i</i> is an element of the subset and <i>u_i</i> = 0 indicates that <i>g_i</i> is not an element of the subset. By the correspondence of <i>g_i</i> with G<i>ⁱ</i> we can interpret z the sum as a matrix sum <maths id="math0003" num=""><math display="inline"><mi>M</mi><mfenced><mi>u</mi></mfenced><mo>:</mo><mo>=</mo><mstyle displaystyle="true"><munderover><mo>∑</mo><mrow><mi>i</mi><mo>=</mo><mn>1</mn></mrow><mi>Z</mi></munderover><mrow><msub><mi>u</mi><mi>i</mi></msub><msup><mi mathvariant="normal">G</mi><mi>i</mi></msup></mrow></mstyle></math><img file="EP1597828B1_D0003.tif" /></maths> where addition is modulo two, i.e., over GF[2]. Hence, <i>M</i>(<i>u</i>) is a matrix over GF[2]. Note that this sum is invertible, i.e., <maths id="math0004" num=""><math display="inline"><mstyle displaystyle="true"><munderover><mo>∑</mo><mrow><mi>i</mi><mo>=</mo><mn>0</mn></mrow><mrow><mi>Z</mi><mo>−</mo><mn>1</mn></mrow></munderover><mrow><msub><mi>u</mi><mi>i</mi></msub><msup><mi mathvariant="bold">G</mi><mi>i</mi></msup></mrow></mstyle></math><img file="EP1597828B1_D0004.tif" /></maths>uniquely determines u.

0038Given two binary vectors <i>u</i> and <i>v</i> their product <i>w</i>:=<i>uv</i> is given uniquely by <i>M</i>(<i>w</i>)<i>=M</i>(<i>u</i>)<i>M</i>(<i>v</i>)<i>.</i> Note, moreover, that if we interpret <i>v</i> is a column vector over GF[2] then <i>w</i>=<i>M</i>(<i>u</i>)<i>v.</i>

0039Now that we have defined multiplication for binary vectors, we have a defined a ring which we denote by <img file="EP1597828B1_D0005.tif" />. Unary elements of <img file="EP1597828B1_D0006.tif" /> are those elements whose binary vector representation has exactly one 1 and Z-1 0s.

0040Consider again the lifting indicated in <figref idref="f0003">Fig 5</figref>. Now, the matrix on the right in that figure can be interpreted a matrix of elements in <img file="EP1597828B1_D0007.tif" />, where <img file="EP1597828B1_D0008.tif" /> is the ring induced by cyclic permutations of size K (=3 in the example). The code is still the set of solutions to the parity check equation Hx=0, but elements of H and elements of x belong to <img file="EP1597828B1_D0009.tif" />: The codeword is thus a vector of length <i>K</i> over <img file="EP1597828B1_D0010.tif" />. Each element may be interpreted as a binary vector of length <i>Z</i> so the codeword is a binary vector of length <i>ZK.</i> The <i>J</i>x<i>K</i> parity check matrix contains elements of the ring, but it also may be interpreted as a binary matrix of size <i>ZJ</i>x<i>ZK</i>.

Recognizing codewords of matched lifted codes.

0041A codeword x = (x₁,...,x_K) is a codeword over <img file="EP1597828B1_D0011.tif" /> if and only if each vector xu = (x₁u,..., x_Ku) is a codeword for each element <i>u</i>∈<img file="EP1597828B1_D0012.tif" />. This condition characterizes codewords of matched liftings. Thus an LDPC systems based on a product lifting (see below) can be identified by the fact that the code, suitably partitioned, is invariant under element-wise multiplication by elements of a product ring.

Encoding of Matched Liftings.

0042The matched lifting formalism simplifies our understanding of encoding such LDPC codes and can lead to a simplified encoding process.

0043To build an encoder for a general LDPC code, the first step is to find a permutation of the rows and columns of <i>H</i> so that, up to reordering, we can write <maths id="math0005" num=""><math display="block"><mi>H</mi><mo>=</mo><mfenced open="[" close="]"><mtable columnalign="left"><mtr><mtd><mi>T</mi></mtd><mtd><mi>A</mi></mtd><mtd><mi>B</mi></mtd></mtr><mtr><mtd><mi>E</mi></mtd><mtd><mi>C</mi></mtd><mtd><mi>D</mi></mtd></mtr></mtable></mfenced></math><img file="EP1597828B1_D0013.tif" /></maths> where T is txt upper triangular, E is gxt, A is txg, C is gxg, B is tx(n-m), D is gx(n-m) and t+g=m. Moreover the gxg matrix <i>φ</i>:=<i>ET^-1A</i>+<i>C</i> is invertible (we assume here that H is full row rank.) Encoding the proceeds as follows. Given information bits <i>x^S</i> we solve <maths id="math0006" num=""><math display="block"><mfenced open="[" close="]"><mtable><mtr><mtd><mi>T</mi></mtd><mtd><mi>A</mi></mtd><mtd><mi>B</mi></mtd></mtr></mtable></mfenced><msup><mfenced open="[" close="]"><mtable><mtr><mtd><mi>y</mi></mtd><mtd><mn>0</mn></mtd><mtd><msup><mi>x</mi><mi>s</mi></msup></mtd></mtr></mtable></mfenced><mi>T</mi></msup><mo>=</mo><mn>0</mn></math><img file="EP1597828B1_D0014.tif" /></maths> for <i>y</i> using back-substitution. Next we solve <maths id="math0007" num=""><math display="block"><msup><mi mathvariant="italic">φx</mi><msub><mi>p</mi><mn>2</mn></msub></msup><mo>=</mo><mfenced open="[" close="]"><mtable><mtr><mtd><mi>E</mi></mtd><mtd><mi>C</mi></mtd><mtd><mi>D</mi></mtd></mtr></mtable></mfenced><msup><mfenced open="[" close="]"><mtable><mtr><mtd><mi>y</mi></mtd><mtd><mn>0</mn></mtd><mtd><msup><mi>x</mi><mi>s</mi></msup></mtd></mtr></mtable></mfenced><mi>T</mi></msup></math><img file="EP1597828B1_D0015.tif" /></maths> for <i>x</i>^{<i>p</i><sub2>2</sub2>}. For this step the matrix <i>φ</i>^-1 is pre-computed. Finally, one solves <maths id="math0008" num=""><math display="block"><mfenced open="[" close="]"><mtable><mtr><mtd><mi>T</mi></mtd><mtd><mi>A</mi></mtd><mtd><mi>B</mi></mtd></mtr></mtable></mfenced><msup><mfenced open="[" close="]"><mtable><mtr><mtd><msup><mi>x</mi><msub><mi>p</mi><mn>1</mn></msub></msup></mtd><mtd><msup><mi>x</mi><msub><mi>p</mi><mn>2</mn></msub></msup></mtd><mtd><msup><mi>x</mi><mi>s</mi></msup></mtd></mtr></mtable></mfenced><mi>T</mi></msup><mo>=</mo><mn>0</mn></math><img file="EP1597828B1_D0016.tif" /></maths> for <i>x</i>^{<i>p</i><sub2>1</sub2>} using back substitution. The vector [x^{<i>p</i><sub2>1</sub2>}<i>x</i>^{<i>p</i><sub2>2</sub2>}<i>x^s</i>]<i>^T</i> constitutes the codeword. The idea to encode lifted graphs is to perform the approximate upper triangulation on the projected parity check matrix, but to then perform the encoding by interpreting matrix operations over <img file="EP1597828B1_D0017.tif" />. In practical settings, where the size of the lifting is sufficiently large, one can enforce <i>g</i>=1 with no discernible loss in performance. In this case the matrix <i>ET</i>^-1<i>A</i> + <i>C</i> and its inverse is an element of <img file="EP1597828B1_D0018.tif" />. Invertibility of <i>ET</i>^<i>-</i>1<i>A</i> + <i>C</i> needs to be checked in the lifting, i.e., over <img file="EP1597828B1_D0019.tif" /> This corresponds with invertibility as a lifted binary matrix, but not necessarily with invertibility of the projected matrix. When forming the diagonal matrix T in the presence of multiple edges, it is preferable that diagonal entries be non-multiple edges, giving rise to unary elements in the lifting.

0044Multiplication in the ring by a unary element (an element with only one non-zero entry in its vector representation) of the ring can be implemented directly in hardware as a switch. The switch routing mechanisms described in <patcit id="pcit0001" dnum="US975331" dnum-type="L"><text>U.S. patent application S.N. 09/975,331</text></patcit> and <patcit id="pcit0002" dnum="US404810" dnum-type="L"><text>U.S. provisional patent application S.N. 60/404,810</text></patcit> are exemplary mechanisms which can be used to implement unary multiplication. Multiplication by non-unary elements is implemented by multiple uses of the switch and adding (over the ring) the results. This corresponds to decomposing multiplication of arbitrary elements of <img file="EP1597828B1_D0020.tif" /> into sums of unary multiplications. Such an approach makes the factorable permutation used in various embodiments of the invention possible.

Product Liftings

0045Product liftings are achieved by choosing a product group for the lifting. A product lifting can equivalently be viewed as a multi-dimensional lifting. Correspondingly, assuming the lifting is matched, the ring <img file="EP1597828B1_D0021.tif" /> is a product ring. Consider an example in which a lifting of size 64 is desired. Assume the projected code is of size P, i.e., with P variable nodes. One could choose the cyclic group of size 64 for the lifting. An alternative, in accordance with the invention would be a product of the cyclic group of size 16 and the cyclic group of size 4. This group can be represented as follows. Consider indexing L = 0,... 63 using pairs (a,b), a = 0,..., 15 and b=0,... ,3 by the invertible map L = 4a+b. An element of this product group is a pair (c,d) c = 0,...,15 and d=0,...,3. The action of (c,d) on (a,b) is to permute the pair (a,b) to (a+c mod 16, d+b mod 4). This group also has order 64. The resulting lifted graph, however, can be interpreted as a lifting of a size 4P code by 16 or a size 16P code by 4 or a size P code by 64. Thus, implementations with parallelism 4, 16, or 64 are all simultaneously supported in accordance with the invention. This might be desirable for implementations where high speed decoding with parallelism 64 is needed, but encoding, which is much simpler, is to be performed on a digital signal processor, where the Z=16 representation is much more convenient. The advantages offered by product liftings are realized in the context of the encoder and hardware implementations. The value added by using product liftings is a feature of the invention. Liftings by groups which are not products, e.g., by a cyclic group, allow for liftings of arbitrary size but do not offer the flexibility of product liftings.

0046The set of codes to which the invention is directed is the case where the lifting group g is a product group, in which case the resulting ring is a product ring. Parallelism in our constructions amounts to parallelising over the ring. When we have a product ring there are subrings so we can also parallelise over those rings, giving us a choice of parallelism for a given code.

0047Cases that appear in the literature already are when g is a cyclic group or the multiplicative group of a finite field. These cases are not product groups, so our construction has not been anticipated. Furthermore its benefits are apparent only in light of parallel architectures such as the one we have disclosed.

Exemplary uses

0048Use of factorable permuter 706 which is made possible by the codes of the present invention and the above described product lifting feature will now be described with reference to <figref idref="f0006">Fig. 9. Fig. 9</figref> shows a portion of the system 700 including the memory 702, factorable permuter 706 and parallel Z element LDPC processor module 710. The memory 702 includes L Z element vectors. Each Z element vector includes elements 1 through Z. For purposes of explaining the invention the top portion of each Z element vector in memory 702 had been labeled A and the bottom portion B. In the case of encoding operations each element of Z will normally be one bit, e.g., a bit of information to be encoded. The received codeword may include a total of T bits where T/L = Z. The actual number of bits in a codeword can be padded or some bits dropped, e.g., in the case of a punctured code, to make T/L and integer value. In the case of a decoding operation, the elements of each Z element vector will normally be multi-bit messages.

0049In step 903 a Z element vector is read out of memory 702 in the sequence determined by the address generator which operates under direction of controller 718 to implement the code identified by information 720. Step 904 represents one of the read Z element vectors 704 being supplied to the input of the factorable permuter 706 which performs permutation operations (reorderings of vector elements) under the direction of controller 718. The factorable permuter 706 is implemented as a two stage switching device, a first and second switching device 902, 904 which peform first and second switching steps also referred to herein using refernce numbers 902, 904.. The first stage includes first switching circuit 902 which operates on the full vector 704. In this example, switch 902 performs a first cyclic rotation R which causes the elements input vector 704 to shift by S1=Z/n (where n=2 in this example) or S1=0 positions. with the vector 704. Thus, portions A and B are swapped, if S1=Z/2 , or not, if S1=0. In the examples of <figref idref="f0006">Figs. 9, 10</figref> and <figref idref="f0007">11</figref> n=2. Arrows 911 represent the step of dividing the result of the first permutation (reordering operation) into an integer number n, of equal portions where Z>n>1 which are unchanged by R. The first equal portion 913 and the second equal portion 906 are subjected to the same permutation Q in steps 907 and 909. This second permutation operation causes the elements in each of the equal portions 904, 906 to be reordered within the portion. The reordering R and Q may be an identity reordering (e.g., a shift of 0 or Z) or a shift by some amount which results in an actual change in the order of the elementsThe combination of the first reordering operation with the application of the second reordering Q produces a permutation on the input vector Z which is factorable. The order in which the permutation operation R and permutation operation Q, where Q is applied to n equally sized portions does not matter since the combination of recording operation will produce the same result regardless of the order in which the operations are performed.

0050Each element of the reordered Z element vector resulting from the application of Q to the each portion 913, 906 is supplied to a different corresponding processing element 712, 711, 713 or 714 of the parallel Z element LDPC processor module 710. As a result of the operation of the factorable permuter 706 in combination with the control of the addressing used to determine the order in which Z element vectors are read out, the code identified by code information 720 can be implemented in a relatively straight forward manner.

0051By using a factorable permuter 706, code structures which could not be supported using a single simple cyclic shift can be supported. As discussed above, such codes have the advantage of allowing for different levels of decoder and encoder parallelism for the same code.

0052<figref idref="f0006">Fig 10</figref> illustrates an example where the first permutation operation performed by the permuter 706 can be either an identity (I) permutation or a flip (F) of the upper and lower portions A, B of vector 704. Arrow 1002 represents the step of reading out Z element vector 704 and subjecting it to processing by the permuter 706. In step switching step 902, the first processing path 1004 is followed if the first permutation is an identity permutation. Note that this results in vector 904 being the same as vector 704. Step 1007 represent the application of the permutation Q to the top A portion of vector 904 while step 1009 represents the application of the Q permutation to bottom portion B of vector 904.

0053If in step 902, R was a flip operation processing would proceed along path 1005 with the resulting Z element vector 906 including B in the top portion and A in the bottom portion. The second permutation Q is then applied to each to these portions in steps 1007' and 1009'

0054<figref idref="f0007">Fig. 11</figref> is another more detailed example how the factorable permuter 706 is used to perform two sequential permutation operations R and Q on a Z element vector 704. In the <figref idref="f0007">Fig. 11</figref> example, the Z element vector 704 read out of memory 702 includes a first z/2 portion A 1101 which has element Y 1102 located in position 1. The vector 704 also includes a second portion B 1105 which includes the element X 1106 which is positioned at the start of portion B in vector position Z/2+1. Step 902 represent the application of the first permutation R to the vector 704 to generate the Z element vector 704'. In this example R is a flip, i.e., a first cyclic shift by Z/2 applied to the vector 704. This first cyclic rotation results in the portion B 1105 being shifted to the top portion of the Z element vector 704' and portion A 1101 being shifted to the bottom portion of the Z element vector 704'. This has the result of changing the order of the vector's elements so that element X 1106 is now in the first position and element Y 1102 is in the (Z/2 + 1) position. The n (where n=2 in this example) even sized portions of intermediate vector 704, portion 1105 and portion 1101 into which the Z element vector 704' is separated for application of the second permutation, are then individually subjected to the second permutation Q in steps 904 and 906. In this example Q is a cyclic shift of one position. This results in the element X 1106 being shifted to the Z/2 position within the first portion 1105' of Z element output vector 704"'. It also results in the element Y 1102 being being shifted to the Z position making it the last element in the vector 704" and last element of second portion 1101'. Note that the multi-step reordering process performed by the factorable permuter 706 results in a reordering that is not possible using a single cyclic shift on the Z element input vector 704. This novel reordering approach allows codes to be implemented which could not be implemented using a permuter that was capable of only doing single cyclic shift.

0055Each of the first through Z elements of the permuted vector 704" are supplied to a different one of the first through Z parallel processing elements 712, 711, 713, 714 of module 710. The processing results generated by the parallel processing elements may, and in some embodiments are, written back into memory 702 or, alternatively, can be written into another memory for further processing, e.g., under control of controller 718.

0056While operation of the 706 has been explained in detail, it is to be understood that the permuter 806 shown in <figref idref="f0005">Fig. 8</figref> operates in the same manner except with input vectors being received from the processor parallel LDPC processing instead of memory and the results being written into memory 802.

0057The <figref idref="f0006">Fig. 10</figref> example uses a product lifting with two factor G=G₂ x G_Z/2. The group G₂ consists of two elements F (flip) and I (identity) defined on {0,1} as follows. F(0) = 1, F(1) = 0; I(0) = 0, I(1) = 1; We assume a length L cycle in the process illustrated in <figref idref="f0006">Fig. 10</figref>.

0058The present invention is directed to among other things, novel data structures, e.g., codewords, stored on machine readable media such as memory 702 which is used in some embodiments to store one or more codewords generated from input data by an encoder using one of the codes of the present invention and an encoder which implements the encoding methods of the invention.

0059In particular, some embodiments of the invention are directed to: A machine readable storage medium in a communications device, comprising: <ul id="ul0002" list-style="none" compact="compact"><li>a data structure in the form of an array y of NxZ bits where N and Z are positive integers, said data structure having been generated by:</li><li>operating an encoder circuit to receive an input u which is an array of KxZ bits, where K is a positive integer; and</li><li>operating said encoder circuit to compute y according to the equation <maths id="math0009" num=""><math display="block"><mi>y</mi><mo>=</mo><mi mathvariant="italic">uG</mi></math><img file="EP1597828B1_D0022.tif" /></maths> where <ul id="ul0003" list-style="none" compact="compact"><li><i>y</i> is an array of <i>N</i> × <i>Z</i> bits where <i>N</i> and <i>Z</i> are positive integers,</li><li><i>u</i> is an array of <i>K</i> × <i>Z</i> bits where <i>K</i> is a positive integer,</li><li><i>G</i> is an array of <i>K</i> × <i>N</i> matrix of elements where each element of <i>G</i> is a vector of <i>Z</i> bits, and where <ul id="ul0004" list-style="none" compact="compact"><li><i>y</i> = (<i>y</i>₁<i>, y</i>₂<i>,</i>..., <i>y_N</i>) where <i>y_i</i> for <i>i</i> an integer in [1, <i>N</i>] is a <i>Z</i> bit vector,</li><li><i>u</i> = (<i>u</i>₁, iu₂,...,<i>u_K</i>) where <i>u_i</i> for <i>i</i> an integer in [1, <i>K</i>] is a <i>Z</i> bit vector,</li></ul></li></ul><maths id="math0010" num=""><math display="block"><mi>G</mi><mo>=</mo><mfenced open="[" close="]"><mtable><mtr><mtd><msub><mi>G</mi><mn>1,1</mn></msub></mtd><mtd><msub><mi>G</mi><mn>1,2</mn></msub></mtd><mtd><mo>⋯</mo></mtd><mtd><msub><mi>G</mi><mrow><mn>1</mn><mo>,</mo><mi>N</mi></mrow></msub></mtd></mtr><mtr><mtd><msub><mi>G</mi><mn>2,1</mn></msub></mtd><mtd><msub><mi>G</mi><mn>2,2</mn></msub></mtd><mtd><mo>⋯</mo></mtd><mtd><msub><mi>G</mi><mrow><mn>2</mn><mo>,</mo><mi>N</mi></mrow></msub></mtd></mtr><mtr><mtd><mo>⋮</mo></mtd><mtd><mo>⋮</mo></mtd><mtd><mo>⋮</mo></mtd><mtd><mo>⋮</mo></mtd></mtr><mtr><mtd><msub><mi>G</mi><mrow><mi>K</mi><mo>−</mo><mn>1,1</mn></mrow></msub></mtd><mtd><msub><mi>G</mi><mrow><mi>K</mi><mo>−</mo><mn>1,2</mn></mrow></msub></mtd><mtd><mo>⋯</mo></mtd><mtd><msub><mi>G</mi><mrow><mi>K</mi><mo>−</mo><mn>1</mn><mo>,</mo><mi>N</mi></mrow></msub></mtd></mtr><mtr><mtd><msub><mi>G</mi><mrow><mi>K</mi><mo>,</mo><mn>1</mn></mrow></msub></mtd><mtd><msub><mi>G</mi><mrow><mi>K</mi><mo>,</mo><mn>2</mn></mrow></msub></mtd><mtd><mo>⋯</mo></mtd><mtd><msub><mi>G</mi><mrow><mi>K</mi><mo>,</mo><mi>N</mi></mrow></msub></mtd></mtr></mtable></mfenced><mo>,</mo></math><img file="EP1597828B1_D0023.tif" /></maths> where <i>G_i,j</i> for <i>i</i> an integer in [1, <i>K</i>] and <i>j</i> an integer in [1, <i>N</i>] is a <i>Z</i> bit vector, and where <maths id="math0011" num=""><math display="block"><msub><mi>y</mi><mi>i</mi></msub><mo>=</mo><mstyle displaystyle="true"><munderover><mo>∑</mo><mrow><mi>j</mi><mo>=</mo><mn>1</mn></mrow><mrow><mi>j</mi><mo>=</mo><mi>K</mi></mrow></munderover><msub><mi>v</mi><mrow><mi>i</mi><mo>,</mo><mi>j</mi></mrow></msub></mstyle><mo>,</mo></math><img file="EP1597828B1_D0024.tif" /></maths> with <maths id="math0012" num=""><math display="block"><msub><mi>v</mi><mrow><mi>i</mi><mo>,</mo><mi>j</mi></mrow></msub><mo>=</mo><msub><mi>u</mi><mi>j</mi></msub><msub><mi>G</mi><mrow><mi>i</mi><mo>,</mo><mi>j</mi></mrow></msub></math><img file="EP1597828B1_D0025.tif" /></maths> being a <i>Z</i> bit vector for each integer <i>i</i> in [1, <i>N</i>] and each integer <i>j</i> in [1, <i>K</i>] and <maths id="math0013" num=""><math display="inline"><mstyle displaystyle="true"><msubsup><mo>∑</mo><mrow><mi>j</mi><mo>=</mo><mn>1</mn></mrow><mrow><mi>j</mi><mo>=</mo><mi>K</mi></mrow></msubsup><msub><mi>v</mi><mrow><mi>i</mi><mo>,</mo><mi>j</mi></mrow></msub></mstyle></math><img file="EP1597828B1_D0026.tif" /></maths> denoting componentwise <i>XOR</i> of the <i>Z</i> bit vectors <i>v</i>_<i>i</i>,1, v_<i>i</i>,2,..., <i>v_i,K</i> to form the <i>Z</i> bit vector <i>y</i>_<i>i</i>, where <maths id="math0014" num=""><math display="block"><msub><mi>u</mi><mi>i</mi></msub><msub><mi>G</mi><mrow><mi>i</mi><mo>,</mo><mi>j</mi></mrow></msub></math><img file="EP1597828B1_D0027.tif" /></maths> denotes the PRODUCT of the two <i>Z</i> bit vectors <i>u_j</i> and <i>G_i,j</i> where the PRODUCT of two <i>Z</i> bit vectors is defined as follows: for any <i>Z</i> bit vector <i>a</i> = (<i>a</i>₁<i>,</i> a₂<i>,</i>..., <i>a_Z</i>) and any <i>Z</i> bit vector <i>b</i> = (<i>b</i>₁, <i>b</i>₂,..., <i>b_Z</i>) their PRODUCT <i>ab</i> is a <i>Z</i> bit vector <i>d</i> = (<i>d</i>₁, <i>d</i>₂<i>,....</i>, <i>d_Z</i>) defined by <maths id="math0015" num=""><math display="block"><msub><mi>d</mi><mi>k</mi></msub><mo>=</mo><mstyle displaystyle="true"><munder><mo>∑</mo><mfenced open="{" close="}" separators=""><mfenced><mi>i</mi><mi>j</mi></mfenced><mo>:</mo><msub><mi>g</mi><mi>i</mi></msub><mo>∗</mo><msub><mi>g</mi><mi>j</mi></msub><mo>=</mo><msub><mi>g</mi><mi>k</mi></msub></mfenced></munder><mrow><msub><mi>a</mi><mi>i</mi></msub><msub><mi>b</mi><mi>j</mi></msub></mrow></mstyle></math><img file="EP1597828B1_D0028.tif" /></maths> where all arithmetic is binary arithmetic meaning <i>a_ib_j</i> is the logical AND of bits <i>a_i</i> and <i>b_j</i> and the summation denotes logical XOR, and where <maths id="math0016" num=""><math display="block"><mi>g</mi><mo>=</mo><mfenced open="{" close="}" separators=""><msub><mi>g</mi><mn>1</mn></msub><mo>,</mo><msub><mi>g</mi><mn>2</mn></msub><mo>,</mo><mo>…</mo><mo>,</mo><msub><mi>g</mi><mi>Z</mi></msub></mfenced><mo>,</mo><mo>∗</mo></math><img file="EP1597828B1_D0029.tif" /></maths> is a factorable group of order <i>Z</i> where a group <i>g</i> of order <i>Z</i> is a set of <i>Z</i> distinct elements {<i>g</i>₁, <i>g</i>₂,...,<i>g</i>_Z} together with a group operation * that is mapping of <i>g</i> × <i>g</i> into <i>g</i> given by defining for each pair (<i>i,j</i>) with <i>i</i> and <i>j</i> an integer in [1, <i>Z</i>] a unique integer <i>k</i> in [1, <i>Z</i>] such that <i>g_i</i> ∗ <i>g_j</i> = <i>g_k,</i> furthermore, this mapping is associative, meaning <maths id="math0017" num=""><math display="block"><mfenced separators=""><msub><mi>g</mi><mi>i</mi></msub><mo>∗</mo><msub><mi>g</mi><mi>j</mi></msub></mfenced><mo>∗</mo><msub><mi>g</mi><mi>k</mi></msub><mo>=</mo><msub><mi>g</mi><mi>i</mi></msub><mo>∗</mo><mfenced separators=""><msub><mi>g</mi><mi>j</mi></msub><mo>∗</mo><msub><mi>g</mi><mi>k</mi></msub></mfenced></math><img file="EP1597828B1_D0030.tif" /></maths> for all integers <i>i, j, k</i> in [1, <i>Z</i>], there exists in the group an identity element meaning that for some integer <i>i</i>* in [1, <i>Z</i>] we have <maths id="math0018" num=""><math display="block"><msub><mi>g</mi><msup><mi>i</mi><mo>∗</mo></msup></msub><mo>∗</mo><msub><mi>g</mi><mi>j</mi></msub><mo>=</mo><msub><mi>g</mi><mi>j</mi></msub><mo>∗</mo><msub><mi>g</mi><msup><mi>i</mi><mo>∗</mo></msup></msub><mo>=</mo><msub><mi>g</mi><mi>j</mi></msub></math><img file="EP1597828B1_D0031.tif" /></maths> for all <i>j</i> in [1, <i>Z</i>], and each element has an inverse, meaning that for each integer <i>j</i> in [1, <i>Z</i>] there is an integer <i>k</i> in [1, <i>Z</i>] such that <maths id="math0019" num=""><math display="block"><msub><mi>g</mi><mi>j</mi></msub><mo>∗</mo><msub><mi>g</mi><mi>k</mi></msub><mo>=</mo><msub><mi>g</mi><mi>k</mi></msub><mo>∗</mo><msub><mi>g</mi><mi>j</mi></msub><mo>=</mo><msub><mi>g</mi><msup><mi>i</mi><mo>∗</mo></msup></msub><mo>,</mo></math><img file="EP1597828B1_D0032.tif" /></maths> where <i>g_i</i>* is the above mentioned identity element and a factorable group of order <i>Z</i> is a group <maths id="math0020" num=""><math display="block"><mi>g</mi><mo>=</mo><mfenced open="{" close="}" separators=""><msub><mi>g</mi><mn>1</mn></msub><mo>,</mo><msub><mi>g</mi><mn>2</mn></msub><mo>,</mo><mo>…</mo><mo>,</mo><msub><mi>g</mi><mi>Z</mi></msub></mfenced><mo>,</mo><mo>∗</mo></math><img file="EP1597828B1_D0033.tif" /></maths> of order <i>Z</i> that can be factored into two groups <maths id="math0021" num=""><math display="block"><mi>A</mi><mo>=</mo><mfenced open="{" close="}" separators=""><msub><mi>A</mi><mn>1</mn></msub><mo>,</mo><msub><mi>A</mi><mn>2</mn></msub><mo>,</mo><mo>…</mo><mo>,</mo><msub><mi>A</mi><msub><mi>Z</mi><mi>A</mi></msub></msub></mfenced><mo>,</mo><msub><mo>∗</mo><mi>A</mi></msub></math><img file="EP1597828B1_D0034.tif" /></maths><maths id="math0022" num=""><math display="block"><mi>B</mi><mo>=</mo><mfenced open="{" close="}" separators=""><msub><mi>B</mi><mn>1</mn></msub><mo>,</mo><msub><mi>B</mi><mn>2</mn></msub><mo>,</mo><mo>…</mo><mo>,</mo><msub><mi>B</mi><msub><mi>Z</mi><mi>B</mi></msub></msub></mfenced><mo>,</mo><msub><mo>∗</mo><mi>B</mi></msub></math><img file="EP1597828B1_D0035.tif" /></maths> of order <i>Z_A</i> and <i>Z_B</i> respectively satisfying 1 &lt; <i>Z_A, Z_B</i> &lt; <i>Z</i> and <i>Z_AZ_B</i> = <i>Z</i> and with group operations <i>*_A</i> and *<i>_B</i> respectively, said factoring consisting of identifying each integer i in [1, <i>Z</i>] with a unique ordered pair of integers (<i>i_A, i_B</i>), with <i>i_A</i> an integer in [1, <i>Z_A</i>] and <i>i_B</i> an integer in [1, <i>Z_A</i>], such that <maths id="math0023" num=""><math display="block"><msub><mi>g</mi><mi>i</mi></msub><mo>∗</mo><msub><mi>g</mi><mi>j</mi></msub><mo>=</mo><msub><mi>g</mi><mi>k</mi></msub></math><img file="EP1597828B1_D0036.tif" /></maths> if and only if <maths id="math0024" num=""><math display="block"><msub><mi>A</mi><msub><mi>i</mi><mi>A</mi></msub></msub><msub><mo>∗</mo><mi>A</mi></msub><msub><mi>A</mi><msub><mi>j</mi><mi>A</mi></msub></msub><mo>=</mo><msub><mi>A</mi><msub><mi>k</mi><mi>A</mi></msub></msub></math><img file="EP1597828B1_D0037.tif" /></maths> and <maths id="math0025" num=""><math display="block"><msub><mi>B</mi><msub><mi>i</mi><mi>B</mi></msub></msub><msub><mo>∗</mo><mi>B</mi></msub><msub><mi>B</mi><msub><mi>j</mi><mi>B</mi></msub></msub><mo>=</mo><msub><mi>B</mi><msub><mi>k</mi><mi>B</mi></msub></msub></math><img file="EP1597828B1_D0038.tif" /></maths> where <i>i</i> is identified with the pair (<i>i_A, i_B</i>)<i>, j</i> is identified with the pair (<i>j_A, j_B</i>)<i>,</i> and <i>k</i> is identified with the pair (<i>k_A, k_B</i>) under the above described identification, where <i>i, j,</i> and <i>k</i> are integers in [1, <i>N</i>] and (<i>i_A</i>, <i>i_B</i>)<i>,</i> (<i>j_A, j_B</i>)<i>,</i> (<i>k_A, k_B</i>) are each ordered pairs of integers with the first element in [1, <i>Z_A</i>] and the second element in [1, <i>Z_B</i>]<i>.</i></li></ul>

0060The above described methods may be implemented in a computer system that includes memory, a CPU and one or more input and/or output devices coupled together. The memory includes a routine implemented in accordance with the invention. When executed, the routine causes the CPU to receive, process, and output data in accordance with the present invention.

0061Alternatively, the steps of the present invention may be implemented using dedicated hardware, e.g., circuits and/or a combination of hardware and software.