Method and device for improving safety computing efficiency based on reconfigurable computing

Abstract

The present invention relates to a method and device for improving the efficiency of secure computing based on reconfigurable computing. The method comprises: providing a reconfigurable computing architecture for performing secure computing, configuring an auxiliary storage unit adapted to be connected to the reconfigurable computing architecture, configuring a reconfigurable computing memory to manage the first type of data used in secure computing, and configuring the auxiliary storage unit to manage the second type of data used in secure computing, wherein, in the process of secure computing, the participation frequency of the second type of data is higher than the participation frequency of the first type of data; configuring a reconfigurable operator array to perform secure computing, at least obtaining the second type of target data from the auxiliary storage unit, so as to perform target secure computing based on the secure computing target data and the obtained second type of target data, and generating secure computing result data after performing the target secure computing. The present invention can reduce the congestion of the storage interface and improve the efficiency of secure computing based on reconfigurable computing.

Description

Technical Field

[0001] The present invention relates to a method and a device, and in particular to a method and a device for improving security computing efficiency based on reconfigurable computing. Background Art

[0002] The reconfigurable computing architecture generally includes a reconfigurable operator array (PEA), an input FIFO (Input FIFO) unit, a reconfigurable computing memory (Memory) and an output FIFO (Output FIFO) unit. Among them, the input FIFO unit, the reconfigurable computing memory and the output FIFO unit are all adapted and connected to the reconfigurable operator array. When working, the data to be processed is transmitted to the input FIFO unit by the external bus, and after being calculated by the reconfigurable operator array, it is output to the output FIFO unit. Some intermediate data generated during the calculation process are generally stored in the reconfigurable computing memory.

[0003] It should be noted that the intermediate data generated during the calculation process generally includes constant data or data that requires data displacement. The reconfigurable operator array needs to use the intermediate data to complete the reconfigurable calculation. At present, the intermediate data is stored by the reconfigurable computing memory and provided to the reconfigurable operator array. At this time, according to the characteristics of the intermediate data, it is necessary to perform cyclic reading and writing on the reconfigurable computing memory, which makes the storage interface of the reconfigurable computing memory more crowded. In addition to affecting the efficiency of the reconfigurable computing, it will also increase the complexity of the reconfigurable computing. Summary of the invention

[0004] The purpose of the present invention is to overcome the deficiencies in the prior art and provide a method and device for improving the efficiency of secure computing based on reconfigurable computing, which can reduce the congestion of storage interfaces and improve the efficiency of secure computing based on reconfigurable computing.

[0005] According to the technical solution provided by the present invention, a method for improving security computing efficiency based on reconfigurable computing, the method for improving security computing efficiency includes:

[0006] A reconfigurable computing architecture for performing secure computing is provided, and an auxiliary storage unit adapted to be connected to the reconfigurable computing architecture is configured, wherein:

[0007] The reconfigurable computing architecture includes a reconfigurable operator array and a reconfigurable computing memory adaptively connected to the reconfigurable operator array.

[0008] The reconfigurable computing memory is configured to manage the first type of data used in the secure computing, and the auxiliary storage unit is configured to manage the second type of data used in the secure computing, wherein, during the secure computing, the participation frequency of the second type of data is higher than the participation frequency of the first type of data;

[0009] When configuring the reconfigurable operator array to perform security calculations, at least the second type of target data is obtained from the auxiliary storage unit to perform target security calculations based on the security calculation target data and the obtained second type of target data, and generate security calculation result data after performing the target security calculations.

[0010] The management of the second type of data by the auxiliary storage unit includes first data management, second data management and / or third data management, wherein:

[0011] When performing the first data management on the second type of data, at least the input second type of source data is updated, and the second type of target data is generated after the updating process;

[0012] When performing the second data management on the second type of data, firstly storing a plurality of second type of source data, and thereafter, in the secure computing process, sequentially using at least the stored second type of source data as second type of target data, and transmitting the second type of target data to the reconfigurable operator array;

[0013] When performing the third data management on the second type of data, at least the second type of source data is cached, and the cached second type of source data is transmitted to the reconfigurable operator array as the second type of target data.

[0014] The auxiliary storage unit at least includes an auxiliary storage first operator unit and / or an auxiliary storage second operator unit, wherein:

[0015] Using the auxiliary storage first operator unit to perform first data management and / or third data management on the second type of data, wherein when performing the first data management on the second type of data, the update processing on the second type of source data includes displacement calculation processing;

[0016] The auxiliary storage second operator unit is used to perform second data management on the second type of data.

[0017] The second category data includes the second category first subcategory data, the second category second subcategory data and / or the second category third subcategory data, wherein:

[0018] Performing first data management on the second category first subcategory data and / or the second category second subcategory data using the auxiliary storage first operator unit, and performing third data management on the second category third subcategory data using the auxiliary storage first operator unit;

[0019] Performing second data management on the second category and second subcategory data using the auxiliary storage second operator unit;

[0020] When the auxiliary storage first operator unit is used to perform first data management on the second category first subcategory data and the second category second subcategory data, the update processing frequency of the second category second subcategory data is lower than the update processing frequency of the second category first subcategory data.

[0021] The auxiliary storage first operator unit includes a first operator unit configuration module, an operator input selector and a first operator storage unit group, wherein the first operator storage unit group includes a plurality of first operator storage units, wherein:

[0022] The output end of the operator input selector is connected to the corresponding input ends of all first operator storage units in the first operator storage unit group;

[0023] When configuring the auxiliary storage first operator unit to perform the first data management, the corresponding first operator storage unit is configured to form an update data chain through the first operator unit configuration module, and the connection state between the operator input selector and the update data chain is configured, wherein,

[0024] Based on the connection state between the operator input selector and the update data chain, the second type of source data loaded into the operator input selector is selected and controlled, and the selected operator selection data is loaded at least into the head of the update data chain, wherein the first operator storage unit receiving the operator selection data is configured to form the head of the update data chain;

[0025] The first operator unit configuration module configures the update data chain to update the update processing state of the operator selected data, so that the update data chain performs update processing on the operator selected data based on the update processing state, and generates the second type of target data corresponding to the update processing state after the update processing;

[0026] When configuring the auxiliary storage first operator unit to perform the third data management, the first operator unit configuration module configures each first operator storage unit as an update data chain and the head of the update data chain to utilize each first operator storage unit for data caching.

[0027] For the chain head in the update data chain, when the operator selection data output by the operator input selector is in a non-empty state, the first operator unit configuration module configures the current update data chain to update the operator selection data, otherwise, closes the update processing state of the current update data chain.

[0028] When the update processing state of the operator selection data by the update data chain is displacement calculation processing, the configuration between the first operator storage units in the update data chain forms a cascade state;

[0029] The first operator storage unit at least includes a storage unit first selector and a D flip-flop, wherein:

[0030] The output terminal of the first selector of the storage unit is connected to the input terminal of the D flip-flop;

[0031] A first input selection terminal of the first selector of the storage unit is connected to the output terminal of the operator input selector, and a second input selection terminal of the first selector of the storage unit is connected to the output terminal of the D flip-flop;

[0032] When the first operator storage units in the update data chain are configured into a cascade state, wherein each first operator storage unit forms a node in the update data chain, along the cascade direction of the nodes, the output of the D flip-flop in the current node is loaded to the corresponding third input selection terminal of the first selector of the storage unit in the next node;

[0033] When calculating displacement, the operator selection data is loaded into the current update data chain through the chain head.

[0034] Based on the update processing state configured by the first operator unit configuration module, the corresponding selection control state of the first selector of the storage unit is determined to shift the selected input data to the corresponding target node in the update data chain to generate the second type of target data corresponding to the update processing state.

[0035] The first operator storage unit further includes a storage unit second selector, wherein:

[0036] The output terminal of the second selector of the storage unit is connected to the third input terminal of the first selector of the storage unit;

[0037] Along the cascade direction of the nodes, the corresponding selection input end of the second selector of a storage unit receives the output of the D flip-flop in other nodes in the update data chain;

[0038] During the displacement calculation processing, for the second type of source data loaded into the operator input selector, the first operator unit configuration module simultaneously selects two corresponding operator selection data through the operator input selector, wherein the two operator selection data are respectively loaded into the head of the current update data chain and the node immediately adjacent to the head of the chain;

[0039] Based on the update processing state configured by the first operator unit configuration module, the corresponding selection control states of the first selector of the storage unit and the second selector of the storage unit are determined to shift the two selection input data to the corresponding target nodes in the update data chain respectively to generate the second type of target data corresponding to the update processing state.

[0040] The auxiliary storage second operator unit includes a second operator unit configuration module, a data storage control module, an input data processing module, an output data processing module and a data storage module, wherein:

[0041] The second operator unit configuration module is adaptively connected with the data storage control module, the input data processing module and the output data processing module;

[0042] The second operator unit configuration module configures the corresponding data working states of the input data processing module and the output data processing module, wherein:

[0043] Configure the data working state of the input data processing module, including the input data storage start address, the input data storage end address and the storage address growth step;

[0044] Configure the data working state of the output data processing module, including the output data reading start address, the output data reading end address and the reading address growth step;

[0045] When executing the target security calculation, a plurality of second-category source data are first stored in the data storage module, wherein:

[0046] When storing a plurality of second-category source data in the data storage module, the second-category source data is received in sequence, and based on the data working state of the input data processing module, the received second-category source data and the corresponding data writing address are sent to the data storage control module, and the data storage control module stores the second-category source data in the data storage module based on the data writing address;

[0047] In the process of executing the target security calculation, the output data processing module sequentially reads the second type of source data, and loads the read second type of source data as the second type of target data into the reconfigurable operator array, wherein:

[0048] When reading the second type of source data, based on the data working state of the output data processing module, a data reading address for reading the second type of source data each time is determined, and the determined data reading address is sent to the data storage control module;

[0049] The data storage control module reads the corresponding second-category source data according to the data reading address, so as to load the second-category source data as the second-category target data into the reconfigurable operator array through the output data processing module.

[0050] The second type of source data includes constant data involved in reconfigurable calculations, wherein the constant data includes round keys in a grouping algorithm or intermediate constants in a hash algorithm;

[0051] When the target security calculation is a group algorithm, the round key configuration in the group algorithm is used as the second type of source data;

[0052] When executing the grouping algorithm processing, the reconfigurable operator array first performs the round key expansion processing to generate a plurality of round keys as the second type of source data after the round key expansion processing, and sequentially stores the expanded round keys in the data storage module via the input data processing module and the data storage control module, so as to perform the second data management on the round keys by using the auxiliary storage second operator;

[0053] During the execution of the grouping algorithm, the round keys are read from the data storage module in sequence through the output data processing module and the data storage control module, and the read round keys are loaded into the reconfigurable operator array as the second type of target data until the grouping algorithm is executed by the reconfigurable operator array.

[0054] When the target security algorithm is a hash algorithm, the second type of target data includes intermediate constant data used in the hash algorithm and text extension data used in the hash algorithm, wherein:

[0055] The intermediate constant data is stored in the auxiliary storage second operator unit, and the auxiliary storage second operator unit is used to perform second data management on the intermediate constant data;

[0056] The text extension data is generated after the reconfigurable operator array and the auxiliary storage first operator unit execute the text extension step, and the text extension data generated after the text extension step is stored in the reconfigurable computing memory;

[0057] Before executing the hash algorithm, the initial value data involved in the hash algorithm is first stored in the reconfigurable computing memory;

[0058] During the execution of the hash algorithm, text expansion target data is read from the reconfigurable computing memory, and intermediate constant target data is read from the auxiliary storage second operator unit, so as to use the reconfigurable operator array to perform calculation processing in the hash algorithm, wherein, during the execution of the calculation processing in the hash algorithm, the auxiliary storage first operator unit is used to perform displacement calculation processing of the word register.

[0059] The reconfigurable computing architecture also includes an input FIFO unit and an output FIFO unit, wherein:

[0060] The input FIFO unit and the output FIFO unit are both adaptively connected to the reconfigurable operator array;

[0061] When the reconfigurable operator array performs the calculation processing of the hash algorithm, the generated security calculation values ​​are transmitted to the output FIFO unit, and the output FIFO unit is configured to update the security calculation values ​​in an overwriting manner, so that after the hash algorithm is executed, the security calculation result data is directly output through the output FIFO unit.

[0062] A device for improving security computing efficiency based on reconfigurable computing, comprising:

[0063] A reconfigurable computing architecture for performing secure computing, comprising a reconfigurable operator array and a reconfigurable computing memory adaptively connected to the reconfigurable operator array, wherein the reconfigurable computing memory is used to manage the first type of data used in the secure computing;

[0064] The auxiliary storage unit is adaptively connected to the reconfigurable operator array to manage the second type of data used in the secure computing, wherein the participation frequency of the second type of data is higher than the participation frequency of the first type of data in the secure computing process;

[0065] When configuring the reconfigurable operator array to perform security calculations, first-category target data is obtained from the reconfigurable computing memory and second-category target data is obtained from the auxiliary storage unit, so as to perform target security calculations based on the obtained first-category target data and second-category target data, and generate security calculation result data after performing the target security calculations.

[0066] The target security calculation includes a grouping algorithm, a hash algorithm or a coarse-grained sequence algorithm.

[0067] The advantages of the present invention are as follows: when executing secure computing based on a reconfigurable computing architecture, the management of the second type of data is realized by utilizing an auxiliary storage unit. During the secure computing process, the second type of data can be provided to the reconfigurable operator array through the auxiliary storage unit so that the target secure computing can be executed by the reconfigurable operator array. Since the participation frequency of the second type of data is higher than that of the first type of data, the cyclic reading of the reconfigurable computing memory can be reduced, the congestion of the storage interface of the reconfigurable computing memory can be reduced, and the efficiency of secure computing based on reconfigurable computing can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] Figure 1 The figure is a schematic diagram of a working process of an embodiment of the method for improving security computing efficiency of the present invention.

[0069] Figure 2 This is a structural block diagram of an embodiment of the device for improving security computing efficiency of the present invention.

[0070] Figure 3 This is a structural block diagram of an embodiment of the auxiliary storage second operator unit of the present invention.

[0071] Figure 4 This is a structural block diagram of an embodiment of the auxiliary storage first operator unit of the present invention.

[0072] Figure 5 This is a circuit schematic diagram of an embodiment of the first operator storage unit of the present invention.

[0073] Figure 6 The present invention is a flowchart of an embodiment of a grouping algorithm.

[0074] Figure 7 The following is a flowchart of an embodiment of the present invention in which an operator array can be reconfigured when executing a grouping algorithm.

[0075] Figure 8The figure is a flow chart of an embodiment of the round key expansion process of the present invention.

[0076] Fig. 9 The present invention is a flowchart of an embodiment of the encryption and decryption in the grouping algorithm.

[0077] Fig.10 A flow chart of an embodiment of executing a hash algorithm of the present invention.

[0078] Fig.11 A process flow chart of an embodiment of executing a hash algorithm of the present invention.

[0079] Explanation of the accompanying drawings: 1-reconfigurable operator array, 2-input FIFO unit, 3-output FIFO unit, 4-reconfigurable computing memory, 5-auxiliary storage first operator unit, 6-auxiliary storage second operator unit, 7-second operator unit configuration module, 8-data storage control module, 9-data storage module, 10-input data processing module, 11-output data processing module, 12-first operator unit configuration module, 13-operator input selector, 14-first operator storage unit, 15-storage unit second selector, 16-storage unit first selector, 17-D flip-flop. DETAILED DESCRIPTION

[0080] The present invention will be further described below in conjunction with specific drawings and embodiments.

[0081] In order to reduce the congestion of the storage interface and improve the security computing efficiency based on reconfigurable computing, the present invention provides a method for improving the security computing efficiency based on reconfigurable computing. Specifically, the method for improving the security computing efficiency includes:

[0082] A reconfigurable computing architecture for performing secure computing is provided, and an auxiliary storage unit adapted to be connected to the reconfigurable computing architecture is configured, wherein:

[0083] The reconfigurable computing architecture includes a reconfigurable operator array 1 and a reconfigurable computing memory 4 adaptively connected to the reconfigurable operator array 1.

[0084] The reconfigurable computing memory 4 is configured to manage the first type of data used in the secure computing, and the auxiliary storage unit is configured to manage the second type of data used in the secure computing, wherein, in the process of the secure computing, the participation frequency of the second type of data is higher than the participation frequency of the first type of data;

[0085] When configuring the reconfigurable operator array 1 to perform security calculations, at least the second type of target data is obtained from the auxiliary storage unit to perform target security calculations based on the security calculation target data and the obtained second type of target data, and generate security calculation result data after performing the target security calculations.

[0086] It should be noted that secure computing includes common encryption / decryption computing. The present invention performs secure computing based on reconfigurable computing. Figure 1 A flow chart of an embodiment of the present invention is shown in FIG. 1 . As can be seen from the figure, when performing secure computing, a reconfigurable computing architecture for performing secure computing should be provided. Background technology and Figure 2 An embodiment of a reconfigurable computing architecture is shown in the figure, wherein the reconfigurable computing architecture includes a reconfigurable operator array 1 and a reconfigurable computing memory 4, the reconfigurable operator array 1 includes a plurality of reconfigurable operators (PE) distributed in an array, the reconfigurable computing memory 4 can adopt an existing commonly used Memory storage form, and the reconfigurable computing memory 4 can be used to store data in reconfigurable computing.

[0087] In order to improve the efficiency of secure computing, in one embodiment of the present invention, an auxiliary storage unit is provided that is adaptably connected to the reconfigurable operator array 1. At this time, the auxiliary storage unit at least has storage capability. After the auxiliary storage unit is adaptably connected to the reconfigurable operator array 1, the auxiliary storage unit can be used to manage the second category of data. At this time, the reconfigurable computing memory 4 is used to manage the first category of data, wherein the management of the first category of data by the reconfigurable computing memory 4 at least includes the storage of the first category of data.

[0088] It should be noted that, in the process of secure computing, the frequency of participation of the second type of data is higher than that of the first type of data. Specifically, the frequency of participation refers to the frequency used by the reconfigurable operator array 1 in the process of secure computing, that is, the frequency of the second type of data being used in the reconfigurable computing process is higher than that of the first type of data. From the above description, it can be seen that the second type of data with a higher participation frequency is managed by the auxiliary storage unit. Therefore, in the process of secure computing based on reconfigurable computing, operations such as cyclic reading of the reconfigurable computing memory 4 that cause storage interface congestion can be reduced. It can be seen that without changing the existing reconfigurable computing architecture, the storage interface congestion of the reconfigurable computing memory 4 can be effectively reduced, and the efficiency of secure computing based on reconfigurable computing can be improved.

[0089] In the specific implementation, in the process of configuring the reconfigurable operator array 1 to perform security calculations, the reconfigurable operator array 1 needs to obtain at least the second type of target data from the auxiliary storage unit. After that, based on the obtained second type of target data and the security calculation target data loaded from the outside, the target security calculation can be performed and the security calculation result data can be generated. It can be seen that the second type of target data is a data in the auxiliary storage unit, and the security calculation target data is loaded from the outside into the reconfigurable operator array 1. The corresponding types of the security calculation target data and the second type of target data should be related to the target security calculation type performed by the reconfigurable operator array 1, and the specific requirements for executing the target security calculation shall prevail. Of course, the security calculation result data is also related to the target security calculation. Specifically, the target security calculation includes a grouping algorithm, a hash algorithm or a coarse-grained sequence algorithm; of course, the target security calculation can also be of other types, so as to meet the requirements based on the reconfigurable calculation and improve the efficiency of the security calculation, which will not be listed here one by one.

[0090] In one embodiment of the present invention, the management of the second type of data by the auxiliary storage unit includes first data management, second data management and / or third data management, wherein:

[0091] When performing the first data management on the second type of data, at least the input second type of source data is updated, and the second type of target data is generated after the updating process;

[0092] When performing the second data management on the second type of data, firstly store a plurality of second type source data, and thereafter, in the secure computing process, at least use the stored second type source data as second type target data in sequence, and transmit the second type target data to the reconfigurable operator array 1;

[0093] When performing the third data management on the second type of data, at least the second type of source data is cached, and the cached second type of source data is transmitted to the reconfigurable operator array 1 as the second type of target data.

[0094] Specifically, according to the process of the second category data participating in the secure computing, the management of the second category data by the auxiliary storage unit may generally include first data management, second data management and / or third data management. The management type of the second category data is related to the type of target secure computing, etc., which is explained in detail below.

[0095] It should be noted that the second-category source data is the second-category data loaded into the auxiliary storage unit, and the second-category target data is the second-category data read from the auxiliary storage unit; when the second-category data is subjected to first data management, at least the second-category source data is updated. At this time, the second-category target data read from the auxiliary storage unit is different from the second-category source data, which is specifically related to the update processing method performed by the auxiliary storage unit, and will be explained in detail below.

[0096] When the auxiliary storage unit performs the second data management on the second type of data, one or more second type source data should generally be stored first. In the subsequent security calculation process, the second type source data are sequentially used as the second type target data and loaded into the reconfigurable operator array 1 after reading / outputting. At this time, the second type target data and the second type source data are generally in one-to-one correspondence, that is, the second type target data is one of the second type source data stored in the auxiliary storage unit.

[0097] The auxiliary storage unit can also be used as a buffer. In this case, the second type of data can be cached. When the second type of data is cached, the second type of target data remains the same as the second type of source data. Through the caching function of the auxiliary storage unit, the requirements of the reconfigurable operator array 1 for reading the second type of target data and executing target security calculations can be met.

[0098] In one embodiment of the present invention, the auxiliary storage unit at least includes an auxiliary storage first operator unit 5 and / or an auxiliary storage second operator unit 6, wherein:

[0099] Using the auxiliary storage first operator unit 5 to perform first data management and / or third data management on the second type of data, wherein when performing the first data management on the second type of data, the update processing on the second type of source data includes displacement calculation processing;

[0100] The auxiliary storage second operator unit 6 is used to perform second data management on the second type of data.

[0101] In order to satisfy the management of the second category data by the auxiliary storage unit, the auxiliary storage unit at least includes an auxiliary storage first operator unit 5 and / or an auxiliary storage second operator unit 6. The auxiliary storage first operator unit 5 can be used to perform the second category data first management and / or data third management on the second category data, that is, the auxiliary storage first operator unit 5 can be used to update the second category source data, or cache the second category source data; specifically, the update processing of the second category source data can include displacement calculation processing, of course, it can also be other update processing, which is based on the specific requirements of meeting the target security calculation. The auxiliary storage second operator unit 6 can be used to perform the second data management on the second category data, that is, the auxiliary storage first operator unit 5 and the auxiliary storage second operator unit 6 can manage the second category data in different ways.

[0102] Figure 2 An embodiment in which the auxiliary storage unit includes both the auxiliary storage first operator unit 5 and the auxiliary storage second operator unit 6 is shown. From the above description, it can be seen that the auxiliary storage unit can adopt the auxiliary storage first operator unit 5 or the auxiliary storage second operator unit 6 according to the type of target security calculation.

[0103] In one embodiment of the present invention, the second category data includes second category first subcategory data, second category second subcategory data and / or second category third subcategory data, wherein:

[0104] Performing first data management on the second category first subcategory data and / or the second category second subcategory data by using the auxiliary storage first operator unit 5, and performing third data management on the second category third subcategory data by using the auxiliary storage first operator unit 5;

[0105] Performing second data management on the second category and second subcategory data by using the auxiliary storage second operator unit 6;

[0106] When the auxiliary storage first operator unit 5 is used to perform the first data management on the second category first subcategory data and the second category second subcategory data, the update processing frequency of the second category second subcategory data is lower than the update processing frequency of the second category first subcategory data.

[0107] As can be seen from the above description, when the target security calculation is different, the type of the second category data will also be different. Therefore, the second category data can be divided into the second category first subcategory data, the second category second subcategory data and / or the second category third subcategory data, wherein the second category first subcategory data is generally data that needs to be updated in real time and is frequently used, such as text data required for text expansion in the hash algorithm, LFSR data in the coarse-grained sequence algorithm, etc.; the second category second subcategory data is generally data that is not frequently updated or does not need to be updated, but is frequently used constant data, such as the round key used in the grouping algorithm, the constant data in the hash algorithm, etc.; the second category third subcategory data is generally other data that needs to be frequently used and is not large in amount. It can be understood that in the process of security calculation, other data except the second category first subcategory data, the second category second subcategory data, and the second category third subcategory data should be treated as the first category data to be stored and managed by the reconfigurable computing memory 4.

[0108] It can be seen from the above description that when the second-category second-subcategory data needs to be updated, the auxiliary storage first operator unit 5 should be used to update the second-category second-subcategory data. It can be seen that the auxiliary storage first operator unit 5 can be used to simultaneously update the second-category first-subcategory data, the second-category second-subcategory data, and the second-category third-subcategory data. Of course, the management of the second-category third-subcategory data specifically refers to caching the second-category third-subcategory data, while updating the second-category first-subcategory data and the second-category second-subcategory data. In addition, it can be seen from the above description of the division of the second-category data that when the auxiliary storage first operator unit 5 is used to perform the first data management on the second-category first-subcategory data and the second-category second-subcategory data, the update processing frequency of the second-category second-subcategory data is lower than the update processing frequency of the second-category first-subcategory data.

[0109] When the second category and the second subcategory data do not need to be updated, the auxiliary storage second operator unit 6 can be used to perform the second data management. The management method and implementation performed by the auxiliary storage first operator unit 5 and the auxiliary storage second operator unit 6 are specifically described below.

[0110] In one embodiment of the present invention, the auxiliary storage first operator unit 5 includes a first operator unit configuration module 12, an operator input selector 13 and a first operator storage unit group, and the first operator storage unit group includes a plurality of first operator storage units 14, wherein:

[0111] The output end of the operator input selector 13 is connected to the corresponding input ends of all the first operator storage units 14 in the first operator storage unit group;

[0112] When configuring the auxiliary storage first operator unit 5 to perform the first data management, the first operator unit configuration module 12 configures the corresponding first operator storage unit 14 to form an update data chain, and configures the connection state between the operator input selector 13 and the update data chain, wherein,

[0113] Based on the connection state between the operator input selector 13 and the update data chain, the second type of source data loaded into the operator input selector 13 is selected and controlled, and the selected operator selection data is loaded at least into the chain head of the update data chain, wherein the first operator storage unit 14 receiving the operator selection data is configured to form the chain head of the update data chain;

[0114] The first operator unit configuration module 12 configures the update data chain to update the update processing state of the operator selected data, so that the update data chain performs update processing on the operator selected data based on the update processing state, and generates the second type of target data corresponding to the update processing state after the update processing;

[0115] When configuring the auxiliary storage first operator unit 5 to perform the third data management, the first operator unit configuration module 12 configures each first operator storage unit 14 as an update data chain and the head of the update data chain to utilize each first operator storage unit 14 for data caching.

[0116] Figure 4 An embodiment of the auxiliary storage first operator unit 5 is shown in FIG. In the figure, the auxiliary storage first operator unit 5 should include a first operator unit configuration module 12, an operator input selector 13 and a first operator storage unit group, wherein the operator input selector 13 can adopt an existing commonly used multiplexer. Figure 4 In the example, Input max is an embodiment in which the operator input selector 13 adopts a multiplexer. The first operator unit configuration module 12 can be in the form of a module with computing and control capabilities. The computing and control capabilities of the first operator unit configuration module 12 in assisting the storage of the first operator unit 5 will be specifically explained below. The first operator storage unit group includes a plurality of first operator storage units 14, and the first operator storage unit 14 has storage capacity. The number of first operator storage units 14 in the first operator storage unit group can be selected as needed to meet the management requirements of the second type of data in the target security calculation.

[0117] The first operator storage units 14 in the first operator storage unit group may be independent of each other, or may be configured by the first operator unit configuration module 12 to form a corresponding update data chain, but the output end of the operator input selector 13 should be connected to the corresponding input end of each first operator storage unit 14, so that the operator selection data selected and output by the operator input selector 13 can be loaded into the corresponding first operator storage unit 14. It should be understood that the operator selection data can be loaded into the specified first operator storage unit 14 by using existing commonly used technical means.

[0118] When managing the second type of data, the second type of source data should be loaded into the corresponding input end of the operator input selector 13. Thereafter, the selection control state of the operator input selector 13 is configured through the first operator unit configuration module 12. The selection control state of the operator input selector 13 is configured to select the second type of source data as the corresponding operator selection data. Therefore, the operator selection data can be part or all of the second type of source data loaded into the operator input selector 13, which can be selected according to needs.

[0119] As can be seen from the above description, the auxiliary storage first operator unit 5 can perform the first data management or the third data management. When the first data management is required, the first operator unit configuration module 12 configures the corresponding first operator storage unit 14 to form an update data chain. The number of first operator storage units 14 in the update data chain can be selected as needed, such as one first operator storage unit 14, or multiple first operator storage units 14. When the update data chain includes multiple first operator storage units 14, the multiple first operator storage units 14 in the update data chain are preferably distributed adjacently, such as Figure 4 In FIG. 1 , an embodiment of configuring the first operator storage unit 14 in the first operator storage unit group to form two update data chains is shown. Figure 4 In FIG. 1 , the corresponding curve indicates the situation of the first operator storage unit 14 in each update data chain, and “×” indicates that the two update data chains are independent of each other, from which it can be known that the two operator selection data can be updated at the same time.

[0120] In specific implementation, the first operator unit configuration module 12 can use existing commonly used technical means to configure different first operator storage units 14 to form an update data chain. The method of configuring the update data chain can be selected according to needs, so as to meet the update processing of the operator selection data. After the update data chain is formed, the first operator unit configuration module 12 should also configure the connection state between the operator input selector 13 and the update data chain, wherein the connection state between the operator input selector 13 and the update data chain is mainly to load the selected operator selection data into the specified update data chain so as to perform the corresponding update processing.

[0121] In one embodiment of the present invention, the selected operator selection data is at least loaded into the head of the update data chain, which is the first operator storage unit 14 at the head of the update data chain. Figure 4 In the embodiment shown in FIG. 1 , in the arrangement direction from left to right according to the direction shown in the figure, the first first operator storage unit 14 and the fifth first operator storage unit 14 respectively form the chain head of the corresponding update data chain. Generally, the first operator storage unit 14 forming the chain head receives the operator selection data, and then the received operator selection data is transmitted between other first operator storage units 14 belonging to the same update data chain to form a displacement calculation output of the operator selection data. In this way, the second type of target data can be formed, and the second type of target data is stored in the current update data chain so as to be read by the reconfigurable operator array 1.

[0122] As can be seen from the above description, the first operator unit configuration module 12 configures the update processing state of the operator selection data, that is, the direction and position of the operator selection data moving in the update data chain, wherein the moving direction can be left or right, and the operator selection data can be updated and processed into the second type of target data according to the moving direction and the moving position. It can be understood that the update processing state should be determined according to the needs of secure computing.

[0123] It can be seen from the above description that the auxiliary storage first operator unit 5 can also be used to perform the third data management. Specifically, when the auxiliary storage first operator unit 5 is configured to perform the third data management, the first operator unit configuration module 12 configures each first operator storage unit 14 as an update data chain and the head of the update data chain. At this time, each first operator storage unit 14 can be used to cache data, that is, there is no need to perform shift processing on the operator selection data.

[0124] In one embodiment of the present invention, for the chain head in the update data chain, when the operator selection data output by the operator input selector 13 is in a non-empty state, the first operator unit configuration module 12 configures the current update data chain to update the operator selection data, otherwise, the update processing state of the current update data chain is closed.

[0125] As can be seen from the above description, the first operator unit configuration module 12 can be configured to form one or more update data chains. Specifically, when multiple update data chains are configured, it is necessary to control the update processing process according to the state of the operator selection data loaded into the current update data chain to reduce the burden of the auxiliary storage first operator unit 5. The state of the operator selection data specifically includes whether the operator selection data is in an empty state or a non-empty state. When the operator selection data loaded into the update data chain is empty, it indicates that the current update data chain is not selected, and the update processing state of the current update data chain should be closed. Only when the selection data loaded into the current update data chain is in a non-empty state, the update data chain is configured for update processing.

[0126] It can be seen from the above description that when the update processing status of the operator selection data of the update data chain includes displacement calculation processing, therefore, when the update processing status is displacement calculation processing, the first operator storage units 14 in the update data chain are configured to form a cascade state. For example, when there are five first operator storage units 14 in the update data chain, the five first operator storage units 14 are connected in series in sequence to form a cascade state, the first first operator storage unit 14 forms the chain head, and the last first operator storage unit 14 forms the chain tail. Thereafter, the operator selection data can be updated in the direction from the chain head to the chain tail.

[0127] In one embodiment of the present invention, the first operator storage unit 14 at least includes a storage unit first selector 16 and a D flip-flop 17, wherein:

[0128] The output terminal of the storage unit first selector 16 is connected to the input terminal of the D flip-flop 17;

[0129] A first input selection terminal of the storage unit first selector 16 is connected to the output terminal of the operator input selector 13, and a second input selection terminal of the storage unit first selector 16 is connected to the output terminal of the D flip-flop 17;

[0130] When the first operator storage units 14 in the update data chain are configured into a cascade state, wherein each first operator storage unit 14 forms a node in the update data chain, along the cascade direction of the nodes, the output of the D flip-flop 17 in the current node is loaded to the corresponding third input selection terminal of the first selector 16 of the storage unit in the next node;

[0131] When calculating displacement, the operator selection data is loaded into the current update data chain through the chain head.

[0132] Based on the update processing state configured by the first operator unit configuration module 12, the corresponding selection control state of the storage unit first selector 16 is determined to shift the selected input data to the corresponding target node in the update data chain to generate the second type of target data corresponding to the update processing state.

[0133] Figure 5 FIG. 1 shows an embodiment of the first operator storage unit 14. In the figure, the first operator storage unit 14 at least includes a storage unit first selector 16 and a D flip-flop 17. Figure 5 In the figure, DFF is the D flip-flop 17, the first selector 16 of the storage unit can be an existing commonly used multiplexer, the output end of the D flip-flop 17 is used as the output end of the first operator storage unit 14, the signal data_select is an embodiment of the update processing state loaded by the first operator unit configuration module 12, the signal data_select is loaded to the selection control end of the first selector 16 of the storage unit, and the output of the first selector 16 of the storage unit can be selected by the signal data_select, such as the first input selection end and the second input selection end of the first selector 16 of the storage unit can be selected for output, and finally output through the D flip-flop 17.

[0134] In the update data chain, each first operator storage unit 14 forms a node, and the cascade direction of the node is the direction from the chain head to the chain tail mentioned above. When the first operator storage unit 14 is configured to be cascaded, the output of the D trigger 17 in the current node is loaded to the third input selection end of the first selector 16 of the next storage unit. For the chain head and the first operator storage unit 14 adjacent to the chain head, the output of the D trigger 17 in the chain head is loaded to the third input selection end of the first selector 16 of the storage unit in the first operator storage unit 14 adjacent to the chain head. For other connection methods configured as cascade, please refer to the description here.

[0135] In specific implementation, in the update data chain, the signal data_select of each node can be different, so that it can be selectively loaded into the corresponding output of the first selector 16 of the storage unit to realize the selective output of the operator selection data, thereby realizing the displacement calculation processing of the operator selection data. As can be seen from the above description, the operator selection data is loaded into the current update data chain through the chain head. As can be seen from the above description, Figure 4 In the embodiment shown, the operator selection data should be loaded into Figure 4 The first first operator storage unit 14 in the embodiment, and Figure 4 The fifth first operator storage unit 14 in the embodiment specifically refers to the storage unit first selector 16 loaded into the first operator storage unit 14.

[0136] In a specific implementation, after the output end of the D flip-flop 17 is used as the output end of the first operator storage unit 14, the corresponding output ends of all the first operator storage units 14 can be connected to the reconfigurable operator array 1 through a bus, and the port data of the corresponding bus is read through the bus, which can meet the update processing such as the displacement of the operator selection data; if the operator selection data is selected from the head of the chain to the end of the chain through the signal data_select, when the reconfigurable operator array 1 is read, the current second-category target data has realized the displacement of the second-category source data, that is, the calculation processing is realized.

[0137] In one embodiment of the present invention, the first operator storage unit 14 further includes a storage unit second selector 15, wherein:

[0138] The output terminal of the second storage unit selector 15 is connected to the third input terminal of the first storage unit selector 16;

[0139] Along the cascade direction of the nodes, the corresponding selection input terminal of the second selector 15 of a storage unit receives the output of the D flip-flop 17 in other nodes in the update data chain;

[0140] During the displacement calculation process, for the second type of source data loaded into the operator input selector 13, the first operator unit configuration module 12 simultaneously selects two corresponding operator selection data through the operator input selector 13, wherein the two operator selection data are respectively loaded into the head of the current update data chain and the node immediately adjacent to the head of the chain;

[0141] Based on the update processing status configured by the first operator unit configuration module 12, the corresponding selection control states of the storage unit first selector 16 and the storage unit second selector 15 are determined to shift the two selection input data to the corresponding target nodes in the update data chain respectively to generate the second type of target data corresponding to the update processing status.

[0142] Figure 5 In the embodiment of the first operator storage unit 14 shown in FIG, the first operator storage unit 14 further includes a storage unit second selector 15, and the storage unit second selector 15 can be a multiplexer. In this case, the output end of the storage unit second selector 15 should be connected to the third input end of the storage unit first selector 16, and the corresponding input end of the storage unit second selector 15 is connected to the output end of the D flip-flop 17 of other nodes in the update data chain. Figure 5In the figure, dinm is the operator selection data, dout_i is the output of the D flip-flop 17 in the first operator storage unit 14, dout_i-1 is the output of the previous node in the update data chain, dout_i-2 is the output of the first two nodes in the update data chain, dout_i-3 is the output of the first three nodes in the update data chain, and dout_i-4 is the output of the first four nodes in the update data chain. For an update data chain with five nodes, the fifth first operator storage unit 14 forms the tail of the update data chain, and the first first operator storage unit 14 forms the head of the update data chain. At this time, for the tail of the chain, the outputs of the other four nodes can be received through the second selector 15 of the storage unit.

[0143] For each storage unit second selector 15, the first operator unit configuration module 12 loads the signal shift_number to the corresponding selection control terminal. At this time, the update processing state includes both the signal data_select and the signal shift_number. It can be understood that the output of the storage unit second selector 15 can be selected by the signal shift_number, and thereafter, the output of the storage unit first selector 16 can be selected by the signal data_select, thereby realizing the update processing of the current node output.

[0144] It can be understood that when the first storage unit 14 contains both the first storage unit selector 16 and the second storage unit selector 15, in order to speed up the displacement calculation processing, the first operator unit configuration module 12 can simultaneously select two operator selection data. Of course, the two operator selection data can be the same or different, and can be selected according to actual needs. The two selected operator selection data should be loaded to the chain head and the node next to the chain head respectively, and then the update processing state control is performed through the signal data_select and the signal shift_number, so as to speed up the generation of the corresponding second type of target data.

[0145] In one embodiment of the present invention, the auxiliary storage second operator unit 6 includes a second operator unit configuration module 7, a data storage control module 8, an input data processing module 10, an output data processing module 11 and a data storage module 9, wherein:

[0146] The second operator unit configuration module 7 is adaptively connected with the data storage control module 8, the input data processing module 10 and the output data processing module 11;

[0147] The second operator unit configuration module 7 configures the corresponding data working states of the input data processing module 10 and the output data processing module 11, wherein:

[0148] Configure the data working state of the input data processing module 10, including the input data storage start address, the input data storage end address and the storage address growth step;

[0149] Configure the data working state of the output data processing module 11, including the output data reading start address, the output data reading end address and the reading address growth step;

[0150] When executing the target security calculation, a plurality of second-category source data are first stored in the data storage module 9, wherein:

[0151] When storing a plurality of second-category source data in the data storage module 9, the second-category source data is received in sequence, and based on the data working state of the input data processing module 10, the received second-category source data and the corresponding data writing address are sent to the data storage control module 8, and the data storage control module 8 stores the second-category source data in the data storage module based on the data writing address;

[0152] In the process of executing the target security calculation, the output data processing module 11 reads the second type of source data in sequence, and loads the read second type of source data into the reconfigurable operator array 1 as the second type of target data, wherein:

[0153] When reading the second type of source data, based on the data working state of the output data processing module 11, a data reading address for reading the second type of source data each time is determined, and the determined data reading address is sent to the data storage control module 8;

[0154] The data storage control module 8 reads the corresponding second-category source data according to the data reading address, so as to load the second-category source data as the second-category target data into the reconfigurable operator array 1 through the output data processing module 11 .

[0155] Figure 3An embodiment of the auxiliary storage second operator unit 6 is shown in FIG. 1 . As can be seen from the figure, the auxiliary storage second operator unit 6 may include a second operator unit configuration module 7, a data storage control module 8, an input data processing module 10, an output data processing module 11 and a data storage module 9, wherein the second operator unit configuration module 7 may adopt a form corresponding to the above-mentioned first operator unit configuration module 12, so as to realize the working position of the auxiliary storage second operator unit 6. The data storage module 9 may adopt an existing register, such as 64 32-bit registers. The data storage control module 8 interacts with the second operator unit configuration module 7, the input data processing module 10 and the output data processing module 11 to realize the control of input data / output data. Specifically, the input data specifically refers to the second type of source data loaded into the input data processing module 10 and stored in the data storage module 9 through the data storage control module 8; the output data specifically refers to the second type of source data in the data storage module 9 being read out and loaded into the reconfigurable operator array 1 to form the second type of target data.

[0156] The input data processing module 10 generally has multiple input ports, such as Figure 3 In the figure, din0~din4 are four input ports of the input data processing module 10, each of which can be 32 bits; the output data processing module 11 generally also has multiple output ports. Figure 3 , dout0~dout3 are 4 output ports of the output data processing module 11, and each output port may be 32 bits wide. When the second operator unit configuration module 7 configures the data working state of the input data processing module 10, it may include configuring the work enable of the input data processing module 10, selecting the effective number of the corresponding input ports of the input data processing module 10, and input space selection, wherein the input space selection may include the input data storage start address, the input data storage end address, and the storage address growth step; when the second operator unit configuration module 7 configures the data working state of the output data processing module 11, it may include configuring the work enable of the output data processing module 11, selecting the effective number of the corresponding output ports of the output data processing module 11, and output space selection, wherein the output space selection may include the output data reading start address, the output data reading end address, and the reading address growth step.

[0157] Before the target security calculation, the second type of source data should be stored in the data storage module 9. When the second type of source data is stored in the data storage module 9, the second operator unit configuration module 7 should configure the data working state of the input data processing module 10. Specifically, when the first valid second type of source data is loaded into the input data processing module 10, the input data processing module 10 will include the input data storage starting address and the second type of source data and send it to the data storage control module 8. Thereafter, the storage address is updated according to the storage address growth step to obtain the storage target address; when the second valid second type of source data arrives, the input data processing module 10 will send the updated storage target address and the second second type of source data to the data storage control module 8. Subsequent second type of source data are sent to the data storage control module 8 in the current manner, and the corresponding storage target address is updated until all the second type of source data are sent to the data storage control module 8. It should be noted that when the updated storage target address exceeds the input data storage end address, the storage target address is configured as the input data storage starting address.

[0158] After receiving the second type of source data and the corresponding storage address, the data storage control module 8 writes the second type of source data into the data storage module 9 according to the storage address, so that the second type of source data can be stored in the data storage module 9. It can be understood that the corresponding input port can be selected according to the type and size of the second type of source data, specifically based on the ability to load the second type of source data into the input data processing module 10.

[0159] In the process of executing the target security calculation, the output data processing module 11 reads the second type of source data in sequence, and loads the read second type of source data as the second type of target data into the reconfigurable operator array 1. Specifically, when the first reconstruction comes, the output data processing module 11 sends the output data reading start address to the data storage control module 8, and updates the read target address in the output data processing module 11 according to the read address growth step. When the second reconstruction comes, the updated read target address is sent to the data storage control module 8, and the current operation is repeated until all reconstructions are completed, that is, all the second type of target data are read and loaded into the reconfigurable operator array 1. When the updated read target address exceeds the output data reading end address, the read target address is updated to the output data reading start address.

[0160] The data storage control module 8 reads the corresponding second-category source data from the data storage module 9 according to the received read target address, and loads the second-category target data into the reconfigurable operator array 1. It should be noted that the output data reading start address may correspond to the input data storage start address, and at this time, the first stored first-category source data may be read out and form the corresponding second-category target data; of course, other corresponding relationships may also be used, so as to meet the requirements of the reconfigurable operator array 1 for executing the target security calculation.

[0161] From the above description, it can be seen that in the process of executing the security target calculation, the stored second-category source data will be read in sequence, and after automatic output, it will be loaded into the reconfigurable operator array 1. Compared with the existing management of the second-category data using the reconfigurable computing memory 4, it can effectively improve the computing efficiency of the entire reconfigurable computing architecture.

[0162] During specific implementation, the data storage control module 8, the input data processing module 10, and the output data processing module 11 may adopt existing commonly used forms, specifically based on whether they can meet the requirements of the auxiliary storage second operator unit 6 for performing the second data management.

[0163] In one embodiment of the present invention, the second type of source data includes constant data involved in the reconfigurable calculation, wherein the constant data includes round keys in a grouping algorithm or intermediate constants in a hash algorithm;

[0164] When the target security calculation is a group algorithm, the round key configuration in the group algorithm is used as the second type of source data;

[0165] When executing the grouping algorithm processing, the reconfigurable operator array 1 first performs the round key expansion processing to generate a plurality of round keys as the second type of source data after the round key expansion processing, and sequentially stores the expanded round keys in the data storage module 9 via the input data processing module 10 and the data storage control module 8, so as to perform the second data management on the round keys by using the auxiliary storage second operator unit 6;

[0166] During the execution of the grouping algorithm, the round keys are read from the data storage module 9 in sequence through the output data processing module 11 and the data storage control module 8, and the read round keys are loaded into the reconfigurable operator array 1 as the second type of target data until the grouping algorithm is executed by the reconfigurable operator array 1.

[0167] From the above description, it can be known that the auxiliary storage second operator unit 6 can perform data second management on the second type and second sub-type data, and the second type and second sub-type data can be the round key in the grouping algorithm or the intermediate constant in the hash algorithm. Figure 6~Figure 9 The process of executing the grouping algorithm based on reconfigurable computing is described in detail.

[0168] Figure 6 , a schematic diagram of an embodiment of executing a grouping algorithm based on a reconfigurable computing architecture is shown in FIG. In the figure, IFIFO is an input FIFO unit 2 connected to a reconfigurable operator array 1, and OFIFO is an output FIFO unit 3 connected to a reconfigurable operator array 1. The connection between the input FIFO unit 2, the output FIFO unit 3 and the reconfigurable operator array 1 can be consistent with the existing one, such as Figure 2 As shown. Figure 6 It can be seen that when executing the grouping algorithm, a reconfigurable configuration file needs to be loaded, wherein the loaded reconfigurable configuration file mainly configures the reconfigurable computing function of the reconfigurable operator array 1, and the reconfigurable configuration file and the method of configuring the reconfigurable computing function of the reconfigurable operator array 1 using the reconfigurable configuration file can be consistent with the existing one.

[0169] The reconfigurable operator array 1 is dynamically configured using the reconfigurable configuration file, and then static configuration is required, such as Figure 6 The AES encryption or decryption operation is completed by configuring the array in the middle. At this time, the auxiliary storage second operator unit 6 also needs to be configured. After that, the initial key is written into the input FIFO unit 2, and the text to be processed is also written into the input FIFO unit 2. The initial key is the initial key required to execute the grouping algorithm, and the text to be processed is the text to be encrypted or decrypted. After that, the reconfigurable operator array 1 encrypts or decrypts the text to be processed according to the configured reconfigurable computing function, and after encryption or decryption, the corresponding security calculation result data is written into the output FIFO unit 3.

[0170] Figure 7 1 shows a flow chart of an embodiment of implementing key expansion using a reconfigurable operator array 1. In the figure, the initial key is expanded to obtain round keys after expansion. For example, for the block algorithm of AES-128, ten rounds of key expansion are required. At this time, ten groups of round keys can be obtained. The initial key and the round keys obtained by expansion need to be stored in the auxiliary storage second operator unit 6, such as Figure 8 As shown, when the initial key and the round key are stored in the auxiliary storage second operator unit 6, the above description can be referred to for details, which will not be repeated here. It should be noted that the method and process of using the reconfigurable operator array 1 to expand the initial key for the round key can be consistent with the existing ones, and will not be given an example here.

[0171] Fig. 9, a flowchart of an embodiment of encryption / decryption of the grouping algorithm is shown in the figure, in which the text to be processed is loaded from the input FIFO unit 2, and then the initial key is read from the auxiliary storage second operator unit 6, and the reconfigurable operator array 1 performs an XOR operation on the text to be processed and the initial key, and then the reconfigurable operator array 1 performs the relevant security calculation; thereafter, the round key obtained by expanding the first round key is read from the auxiliary storage second operator unit 6, and the reconfigurable operator array 1 performs the above XOR operation and the corresponding security calculation; the above operation is repeated, that is, the round key-XOR operation-security calculation is repeated until all round key processing is completed, and then the security calculation result data is written into the output FIFO unit 3. Specifically, the method and process of reading the initial key and the round key from the auxiliary storage second operator unit 6 can refer to the above description, which will not be repeated here.

[0172] It can be seen from the above description that when the grouping algorithm is executed using the reconfigurable computing architecture, the auxiliary storage second operator unit 6 can be used to implement the second data management of the round key, which can effectively speed up the preservation of the round key in the grouping algorithm and the loading into the reconfigurable operator array 1, improve the efficiency of executing the grouping algorithm based on the reconfigurable computing architecture, and avoid the storage interface congestion caused by the cyclic reading of the storage interface of the reconfigurable computing memory 4 in the prior art.

[0173] In one embodiment of the present invention, when the target security algorithm is a hash algorithm, the second type of target data includes intermediate constant data used in the hash algorithm and text extension data used in the hash algorithm, wherein:

[0174] The intermediate constant data is stored in the auxiliary storage second operator unit 6, and the auxiliary storage second operator unit 6 is used to perform second data management on the intermediate constant data;

[0175] The text extension data is generated by the reconfigurable operator array 1 and the auxiliary storage first operator unit 5 after executing the text extension step, and the text extension data generated after the text extension step is stored in the reconfigurable computing memory 4;

[0176] Before executing the hash algorithm, the initial value data involved in the hash algorithm is first stored in the reconfigurable computing memory 4;

[0177] During the execution of the hash algorithm, text expansion target data is read from the reconfigurable computing memory 4, and intermediate constant target data is read from the auxiliary storage second operator unit 6, so as to use the reconfigurable operator array 1 to perform the calculation processing in the hash algorithm, wherein, during the execution of the calculation processing in the hash algorithm, the auxiliary storage first operator unit 5 is used to perform the displacement calculation processing of the word register.

[0178] It can be understood that when the target security algorithm is a hash algorithm, during the execution of the hash algorithm, the second type of data involved may include intermediate constant data and text extension data. At this time, the auxiliary storage second operator unit 6 can be used to perform second data management on the intermediate constant data, and the auxiliary storage first operator unit 5 can be used to perform first data management on the data in the text extension. Thereafter, the reconfigurable computing memory 4 needs to be used to store the text extension data generated by the text expansion step.

[0179] In the specific implementation, during the execution of the hash algorithm, the text expansion target data is read from the reconfigurable calculation memory 4, and the intermediate constant target data is read from the auxiliary storage second operator unit 6, so as to use the reconfigurable operator array 1 to perform the calculation processing in the hash algorithm, wherein, during the execution of the calculation processing in the hash algorithm, the auxiliary storage first operator unit 5 is used to perform the displacement calculation processing of the word register. Fig.10 and Fig.11 The specific hash algorithm execution process is described in detail.

[0180] Fig.10 FIG. 1 shows a flow chart of an embodiment of executing a hash algorithm using a reconfigurable operator array 1. In the figure, the meaning of loading a reconfigurable configuration file can be referred to Figure 6 The description of executing the grouping algorithm in FIG. 1 is not repeated here. In the figure, the configuration array completes the SM3 calculation function, specifically, the configuration of the reconfigurable operator array 1 completes the hash algorithm of the SM3 cryptographic hash algorithm, that is, Fig.10 and Fig.11 The algorithm process using the SM3 cryptographic hash algorithm as an example is shown in FIG. The execution process of the SM3 cryptographic hash algorithm can refer to the corresponding description of the "Cryptography Industry Standard - GM / T0004-2012". Writing CONST data specifically refers to writing the intermediate constant data into the auxiliary storage second operator unit 6, Fig.10 and Fig.11 In the above standard, CONST refers to the auxiliary storage second operator unit 6 of the present invention. An embodiment of the intermediate constant data is given. The intermediate constant data can be "T j "For details on the intermediate constant data, please refer to the standard example mentioned above.

[0181] Fig.10 In the above, writing MEM data specifically refers to storing the initial value data of the constant in the reconfigurable computing memory 4. Fig.10 and Fig.11MEM in the above all refers to the reconfigurable computing memory 4. The initial value data can also refer to the standard example description. Thereafter, the text to be processed is loaded into the input FIFO unit 2. It can be understood that the text to be processed should be filled. The specific filling requirements can also refer to the example description of the standard file mentioned above. Thereafter, the calculated hash value is output to the output FIFO unit 3. During the execution process, the above process of loading the text to be processed into the input FIFO unit 2 and inputting the hash value into the output FIFO unit 3 is repeated.

[0182] It can be seen from the standard file mentioned above that when executing the SM3 cryptographic hash algorithm, it includes an iterative compression process, wherein the iterative compression includes an iterative process step, a message expansion step, and a compression function calculation step. Specifically, in the iterative process step, the padded message is grouped into 512 bits. During the grouping process, the initial value data stored in the reconfigurable computing memory 4 needs to be used.

[0183] The message expansion step is performed, specifically, the message grouping obtained by performing the iterative process step is expanded to obtain 132 message words for use in the following compression function calculation. Fig.11 An embodiment of executing the message expansion step is shown in FIG. In the figure, a text block is read from the IFIFO, wherein the read text block is the message group obtained by the above-mentioned iterative process step, and each message group is divided into a plurality of message group words, such as 16 message group words. At this time, the 16 message group words are stored in 16 first operator storage units 14 in the auxiliary storage first operator unit 5. Fig.11 In the example, storing in SCache specifically refers to storing in the auxiliary storage first operator unit 5. Fig.11 The other SCaches in the present invention all refer to the auxiliary storage first operator unit 5; in addition, the message groupings divided into message group words can also be used as extended text blocks and stored in the reconfigurable computing memory 4, that is, corresponding to Fig.11 Deposit SCaceh and MEM in.

[0184] The 16 first operator storage units 14 can be used as a 16-word update data chain. According to the requirements of message expansion, the output of the corresponding first operator storage unit 14 in the update data chain is selected, and the first operator storage unit 14 is the data tap of the update data chain, so that the tap data can be obtained. According to the requirements of message expansion, a shift operation is performed in the update data chain, and then the reconfigurable operator array 1 performs an exclusive OR operation. After the exclusive OR operation, the message expansion is completed once, and the expanded text should be stored in the auxiliary storage first operator unit 5 and can be written into the reconfigurable computing memory 4.

[0185] Specifically, each time a message is expanded, the above description can be referred to until the message expansion step is completed. As can be seen from the above description, after the message expansion step is completed, the compression function calculation step needs to be executed. When executing the compression function calculation step, the initial value data needs to be read from the reconfigurable calculation memory 4. Fig.11 In the above example, reading IV means reading the initial value data. Fig.10 and Fig.11 The "IV" in the figure refers to the initial value data. The initial value data is written into the auxiliary storage first operator unit 5. At this time, the corresponding first operator storage unit 14 is used to configure a word register to store the initial value data. The word register is configured to meet the requirements of storage of the initial value data and calculation of the compression function.

[0186] When executing the compression function calculation step, it is also necessary to read the expanded text block from the reconfigurable calculation memory 4, read the intermediate constant data from the auxiliary storage second operator unit 6, and then perform shift calculation processing on the initial value data in the auxiliary storage first operator unit 5, and use the reconfigurable operator array 1 to perform an XOR operation. It should be noted that when the compression function is calculated, the shift calculation processing performed includes the shift calculation processing of the intermediate constant data, the shift calculation processing of the data stored in the word register, etc. The shift calculation processing can refer to the description of the compression function calculation in the standard. It can be understood that in the message expansion stage, 16 first operator storage units 14 need to be configured to form an update data chain, in the compression function stage, generally 2 first operator storage units 14 need to be configured to form an update data chain, and in the compression function stage, 4 update data chains formed by the first operator storage units 14 are required to meet the needs of the shift calculation processing of the word register.

[0187] After the compression function calculation is performed, the obtained security calculation result data can be stored in the reconfigurable calculation memory 4 and the output FIFO unit 3, wherein the output security calculation result data is a 256-bit hash value. When the hash algorithm is other, the process description of the SM3 cryptographic hash algorithm mentioned above can be referred to, and examples are not given here one by one.

[0188] According to the above description, when the hash algorithm is executed using the reconfigurable computing architecture, the auxiliary storage first operator unit 5 and the auxiliary storage second operator unit 6 can be used to manage the second type of data, and the reconfigurable computing memory 4 can be used to manage the first type of data, which can effectively speed up the efficiency of secure computing and avoid the storage interface congestion caused by cyclic reading of the storage interface of the reconfigurable computing memory 4 in the prior art.

[0189] In one embodiment of the present invention, the reconfigurable computing architecture further includes an input FIFO unit 2 and an output FIFO unit 3, wherein:

[0190] The input FIFO unit 2 and the output FIFO unit 3 are both adaptively connected to the reconfigurable operator array 1;

[0191] When the reconfigurable operator array 1 performs the calculation processing of the hash algorithm, the generated security calculation values ​​are transmitted to the output FIFO unit 3, and the output FIFO unit 3 is configured to update the security calculation values ​​in an overwriting manner, so that after the hash algorithm is executed, the security calculation result data is directly output through the output FIFO unit 3.

[0192] It can be seen from the above description that when executing the hash algorithm based on the reconfigurable computing architecture, a text data is divided into multiple text blocks, the first text block has a fixed initial vector, and each subsequent text block uses the hash value of the previous text block as the initial vector for update, and the hash value of the last text block is output as the hash value of the entire text data. It can be seen that there will be multiple intermediate results output to the output FIFO unit 3, and then after the hash algorithm is completed, through corresponding processing, the final security calculation result data can be obtained. It can be understood that this method will increase the complexity of obtaining the security calculation result data and reduce the efficiency of security calculation.

[0193] In the existing reconfigurable computing architecture, the hash values ​​corresponding to all text blocks are generally output to the output FIFO unit 3, and the software controls the reading of the hash value of the intermediate text and discards it until the last hash value is read. This method requires the software to count and locate the position of the last valid hash value, and for larger files, the output FIFO unit 3 needs to be cleared in time to avoid the scenario where the calculation is suspended due to back pressure caused by the full output FIFO unit 3; or, the reconfigurable operator array 1 implements the counting function and only outputs the last hash value to the output FIFO unit 3, but in actual use, the size of the file is random, and it is difficult for the hardware to determine whether it is the last hash value, so this method is not applicable.

[0194] In one embodiment of the present invention, the security calculation value is updated in an overwriting manner, that is, only the current latest security calculation value is retained. Since the last calculated value in sequence is the security calculation result data, the security calculation result data can be obtained quickly and accurately, which can improve the efficiency of security calculation.

[0195] Specifically, when the security calculation value is updated by overwriting, the output FIFO unit 3 is improved, such as adding a static configuration to the output FIFO unit 3 to set the maximum amount of data stored in the output FIFO unit 3. For example, for the above-mentioned SM3 algorithm, the data length of the output hash value is 256 bits, then the static configuration can be set to 2, wherein, since the reconfigurable calculation of the general security algorithm is 128 bits in units, the static configuration is set to 2, indicating that the maximum data stored in the output FIFO unit 3 is 2 128-bit data. At this time, the reconfigurable operator array 1 can output all SM3 values ​​to the output FIFO unit 3, and the output FIFO unit 3 only retains the last 2 128-bit data written, and the previously written values ​​are automatically read out and discarded. At this time, the software can be simplified. When all the files to be processed are transferred to the reconfigurable operator array 1, and the reconfigurable operator array 1 has completed the calculation, the value in the output FIFO unit 3 can be read. In addition, if the added static configuration is 0, the output FIFO unit 3 and the reconfigurable operator array 1 maintain the existing coordination form.

[0196] From the above description, a device for improving the efficiency of secure computing based on reconfigurable computing can be obtained. In one embodiment of the present invention, the device comprises:

[0197] A reconfigurable computing architecture for performing secure computing, comprising a reconfigurable operator array 1 and a reconfigurable computing memory 4 adaptively connected to the reconfigurable operator array 1, wherein the reconfigurable computing memory 4 is used to manage the first type of data used in the secure computing;

[0198] The auxiliary storage unit is adaptively connected to the reconfigurable operator array 1 to manage the second type of data used in the secure computing, wherein the participation frequency of the second type of data is higher than the participation frequency of the first type of data in the secure computing process;

[0199] When configuring the reconfigurable operator array 1 to perform security calculations, at least the second type of target data is obtained from the auxiliary storage unit to perform target security calculations based on the security calculation target data and the obtained second type of target data, and generate security calculation result data after performing the target security calculations.

[0200] Specifically, the corresponding situations of the reconfigurable computing architecture, the auxiliary storage unit, and the corresponding working methods can all be referred to the above corresponding descriptions, which will not be repeated here.

Claims

1. A method for improving security computing efficiency based on reconfigurable computing, characterized in that: The method for improving security computing efficiency comprises: A reconfigurable computing architecture for performing secure computing is provided, and an auxiliary storage unit adapted to be connected to the reconfigurable computing architecture is configured, wherein: The reconfigurable computing architecture includes a reconfigurable operator array and a reconfigurable computing memory adaptively connected to the reconfigurable operator array. The reconfigurable computing memory is configured to manage the first type of data used in the secure computing, and the auxiliary storage unit is configured to manage the second type of data used in the secure computing, wherein, during the secure computing, the participation frequency of the second type of data is higher than the participation frequency of the first type of data; In the process of configuring the reconfigurable operator array to perform security calculation, at least the second type of target data is obtained from the auxiliary storage unit, so as to perform target security calculation based on the security calculation target data and the obtained second type of target data, and generate security calculation result data after performing the target security calculation; The management of the second type of data by the auxiliary storage unit includes first data management, second data management and / or third data management, wherein: When performing the first data management on the second type of data, at least the input second type of source data is updated, and the second type of target data is generated after the updating process; When performing the second data management on the second type of data, firstly storing a plurality of second type of source data, and thereafter, in the secure computing process, sequentially using at least the stored second type of source data as second type of target data, and transmitting the second type of target data to the reconfigurable operator array; When performing the third data management on the second type of data, at least the second type of source data is cached, and the cached second type of source data is transmitted to the reconfigurable operator array as the second type of target data.

2. The method for improving security computing efficiency based on reconfigurable computing according to claim 1 is characterized in that: The auxiliary storage unit at least includes an auxiliary storage first operator unit and / or an auxiliary storage second operator unit, wherein: Using the auxiliary storage first operator unit to perform first data management and / or third data management on the second type of data, wherein when performing the first data management on the second type of data, the update processing on the second type of source data includes displacement calculation processing; The auxiliary storage second operator unit is used to perform second data management on the second type of data.

3. The method for improving the efficiency of secure computing based on reconfigurable computing according to claim 2 is characterized in that: the second type The data includes the second category first subcategory data, the second category second subcategory data and / or the second category third subcategory data, wherein: Performing first data management on the second category first subcategory data and / or the second category second subcategory data using the auxiliary storage first operator unit, and performing third data management on the second category third subcategory data using the auxiliary storage first operator unit; Performing second data management on the second category and second subcategory data using the auxiliary storage second operator unit; When the auxiliary storage first operator unit is used to perform first data management on the second category first subcategory data and the second category second subcategory data, the update processing frequency of the second category second subcategory data is lower than the update processing frequency of the second category first subcategory data.

4. The method for improving security computing efficiency based on reconfigurable computing according to claim 2 is characterized in that: The auxiliary storage first operator unit includes a first operator unit configuration module, an operator input selector and a first operator storage unit group, wherein the first operator storage unit group includes a plurality of first operator storage units, wherein: The output end of the operator input selector is connected to the corresponding input ends of all first operator storage units in the first operator storage unit group; When configuring the auxiliary storage first operator unit to perform the first data management, the corresponding first operator storage unit is configured to form an update data chain through the first operator unit configuration module, and the connection state between the operator input selector and the update data chain is configured, wherein, Based on the connection state between the operator input selector and the update data chain, the second type of source data loaded into the operator input selector is selected and controlled, and the selected operator selection data is loaded at least into the head of the update data chain, wherein the first operator storage unit receiving the operator selection data is configured to form the head of the update data chain; The first operator unit configuration module configures the update data chain to update the update processing state of the operator selected data, so that the update data chain performs update processing on the operator selected data based on the update processing state, and generates the second type of target data corresponding to the update processing state after the update processing; When configuring the auxiliary storage first operator unit to perform the third data management, the first operator unit configuration module configures each first operator storage unit as an update data chain and the head of the update data chain to utilize each first operator storage unit for data caching.

5. The method for improving security computing efficiency based on reconfigurable computing according to claim 4 is characterized in that: For the chain head in the update data chain, when the operator selection data output by the operator input selector is in a non-empty state, the first operator unit configuration module configures the current update data chain to update the operator selection data, otherwise, closes the update processing state of the current update data chain.

6. The method for improving security computing efficiency based on reconfigurable computing according to claim 4 is characterized in that: When the update processing state of the operator selection data by the update data chain is displacement calculation processing, the configuration between the first operator storage units in the update data chain forms a cascade state; The first operator storage unit at least includes a storage unit first selector and a D flip-flop, wherein: The output terminal of the first selector of the storage unit is connected to the input terminal of the D flip-flop; A first input selection terminal of the first selector of the storage unit is connected to the output terminal of the operator input selector, and a second input selection terminal of the first selector of the storage unit is connected to the output terminal of the D flip-flop; When the first operator storage units in the update data chain are configured into a cascade state, wherein each first operator storage unit forms a node in the update data chain, along the cascade direction of the nodes, the output of the D flip-flop in the current node is loaded to the corresponding third input selection terminal of the first selector of the storage unit in the next node; When calculating displacement, the operator selection data is loaded into the current update data chain through the chain head. Based on the update processing state configured by the first operator unit configuration module, the corresponding selection control state of the first selector of the storage unit is determined to shift the selected input data to the corresponding target node in the update data chain to generate the second type of target data corresponding to the update processing state.

7. The method for improving security computing efficiency based on reconfigurable computing according to claim 4 is characterized by: The first operator storage unit further includes a storage unit second selector, wherein: The output terminal of the second selector of the storage unit is connected to the third input terminal of the first selector of the storage unit; Along the cascade direction of the nodes, the corresponding selection input end of the second selector of the storage unit in a node in the update data chain receives the output of the D flip-flop in other nodes in the update data chain; During the displacement calculation processing, for the second type of source data loaded into the operator input selector, the first operator unit configuration module simultaneously selects two corresponding operator selection data through the operator input selector, wherein the two operator selection data are respectively loaded into the head of the current update data chain and the node immediately adjacent to the head of the chain; Based on the update processing state configured by the first operator unit configuration module, the corresponding selection control states of the first selector of the storage unit and the second selector of the storage unit are determined to shift the two selection input data to the corresponding target nodes in the update data chain respectively to generate the second type of target data corresponding to the update processing state.

8. The method for improving security computing efficiency based on reconfigurable computing according to any one of claims 2 to 7, characterized in that: The auxiliary storage second operator unit includes a second operator unit configuration module, a data storage control module, an input data processing module, an output data processing module and a data storage module, wherein: The second operator unit configuration module is adaptively connected with the data storage control module, the input data processing module and the output data processing module; The second operator unit configuration module configures the corresponding data working states of the input data processing module and the output data processing module, wherein: Configure the data working state of the input data processing module, including the input data storage start address, the input data storage end address and the storage address growth step; Configure the data working state of the output data processing module, including the output data reading start address, the output data reading end address and the reading address growth step; When executing the target security calculation, a plurality of second-category source data are first stored in the data storage module, wherein: When storing a plurality of second-category source data in the data storage module, the second-category source data is received in sequence, and based on the data working state of the input data processing module, the received second-category source data and the corresponding data writing address are sent to the data storage control module, and the data storage control module stores the second-category source data in the data storage module based on the data writing address; In the process of executing the target security calculation, the output data processing module sequentially reads the second type of source data, and loads the read second type of source data as the second type of target data into the reconfigurable operator array, wherein: When reading the second type of source data, based on the data working state of the output data processing module, a data reading address for reading the second type of source data each time is determined, and the determined data reading address is sent to the data storage control module; The data storage control module reads the corresponding second-category source data according to the data reading address, so as to load the second-category source data as the second-category target data into the reconfigurable operator array through the output data processing module.

9. The method for improving security computing efficiency based on reconfigurable computing according to claim 8 is characterized in that: The second type of source data includes constant data involved in reconfigurable calculations, wherein the constant data includes round keys in a grouping algorithm or intermediate constants in a hash algorithm; When the target security calculation is a group algorithm, the round key configuration in the group algorithm is used as the second type of source data; When executing the grouping algorithm processing, the reconfigurable operator array first performs the round key expansion processing to generate a plurality of round keys as the second type of source data after the round key expansion processing, and stores the expanded round keys in the data storage module in sequence through the input data processing module and the data storage control module, so as to perform the second data management on the round keys by using the auxiliary storage second operator unit; During the execution of the grouping algorithm, the round keys are read from the data storage module in sequence through the output data processing module and the data storage control module, and the read round keys are loaded into the reconfigurable operator array as the second type of target data until the grouping algorithm is executed by the reconfigurable operator array.

10. The method for improving security computing efficiency based on reconfigurable computing according to any one of claims 2 to 7, characterized in that: When the target security algorithm is a hash algorithm, the second type of target data includes intermediate constant data used in the hash algorithm and text extension data used in the hash algorithm, wherein: The intermediate constant data is stored in the auxiliary storage second operator unit, and the auxiliary storage second operator unit is used to perform second data management on the intermediate constant data; The text extension data is generated after the reconfigurable operator array and the auxiliary storage first operator unit execute the text extension step, and the text extension data generated after the text extension step is stored in the reconfigurable computing memory; Before executing the hash algorithm, the initial value data involved in the hash algorithm is first stored in the reconfigurable computing memory; During the execution of the hash algorithm, text expansion target data is read from the reconfigurable computing memory, and intermediate constant target data is read from the auxiliary storage second operator unit, so as to use the reconfigurable operator array to perform calculation processing in the hash algorithm, wherein, during the execution of the calculation processing in the hash algorithm, the auxiliary storage first operator unit is used to perform displacement calculation processing of the word register.

11. The method for improving security computing efficiency based on reconfigurable computing according to claim 10, characterized in that: The reconfigurable computing architecture also includes an input FIFO unit and an output FIFO unit, wherein: The input FIFO unit and the output FIFO unit are both adaptively connected to the reconfigurable operator array; When the reconfigurable operator array performs the calculation processing of the hash algorithm, the generated security calculation values ​​are transmitted to the output FIFO unit, and the output FIFO unit is configured to update the security calculation values ​​in an overwriting manner, so that after the hash algorithm is executed, the security calculation result data is directly output through the output FIFO unit.

12. A device for improving security computing efficiency based on reconfigurable computing, characterized in that: The method for executing any one of claims 1 to 11 above comprises: A reconfigurable computing architecture for performing secure computing, comprising a reconfigurable operator array and a reconfigurable computing memory adaptively connected to the reconfigurable operator array, wherein the reconfigurable computing memory is used to manage the first type of data used in the secure computing; The auxiliary storage unit is adaptively connected to the reconfigurable operator array to manage the second type of data used in the secure computing, wherein the participation frequency of the second type of data is higher than the participation frequency of the first type of data in the secure computing process; When configuring the reconfigurable operator array to perform security calculations, first-category target data is obtained from the reconfigurable computing memory and second-category target data is obtained from the auxiliary storage unit, so as to perform target security calculations based on the obtained first-category target data and second-category target data, and generate security calculation result data after performing the target security calculations.

13. The device for improving security computing efficiency based on reconfigurable computing according to claim 12, characterized in that: The target security calculation includes a grouping algorithm, a hash algorithm or a coarse-grained sequence algorithm.

Images