Multi-scalar multiplication acceleration method based on point cache mechanism and hardware accelerator thereof

Abstract

The invention relates to a multi-scalar multiplication acceleration method based on a point cache mechanism and a hardware accelerator thereof, which are used for further optimizing point addition operation in multi-scalar multiplication. According to the method, a cache mechanism is designed according to the characteristic that repeated operands (points on an elliptic curve) exist in the point addition operation in multi-scalar multiplication, the calculated elliptic curve point addition operation result is temporarily stored, and when two points participating in the point addition operation currently are stored in a point cache, namely, the cache is hit, the point addition operation result is not hit. If not, skipping the current point addition operation and reading the value in the cache of the corresponding point as the calculation result of the current point addition, so that the point addition operation times in the multi-scalar multiplication calculation process are effectively reduced, and the calculation speed is improved. The hardware accelerator is designed according to the method, and the calculation speed can be effectively increased under the condition that additional limited hardware overhead is increased.

Description

Technical Field

[0001] The present invention relates to electronic information technology, and in particular to a multi-scalar multiplication acceleration method based on a point cache mechanism and a hardware accelerator thereof. Background Art

[0002] For zero-knowledge proof calculations, the existing technology uses the Pippenger algorithm to resolve multi-scalar multiplication into a large number of elliptic curve point addition operations, and obtains the multi-scalar multiplication calculation results by point addition operations one by one. Although this method can integrate multiple elliptic curve point addition architectures into one point addition operation circuit without increasing the chip area, and only one point addition operation hardware circuit is needed to accelerate the calculation of elliptic curve multi-scalar multiplication, this method still has room for further optimization. Summary of the invention

[0003] In order to further improve the calculation speed of multi-scalar multiplication, the purpose of this case is to propose a multi-scalar multiplication acceleration method based on a point cache mechanism and its hardware accelerator.

[0004] In order to achieve the above technical objectives, this case proposes a multi-scalar multiplication acceleration method based on a point cache mechanism, which includes the following steps: for the block scalar vectors after segmentation in the multi-scalar multiplication, the two non-zero scalars with the same value and the closest distance are used as the first scalar and the second scalar respectively, and the first entry is obtained based on the addresses of the first scalar and the second scalar; based on the first scalar address of the first entry, the point cache is queried, and the result of the point addition operation corresponding to the first entry and the two scalars in the first entry is cached in the point cache; based on the first scalar address of the first entry, the point cache is queried to obtain the cache entry corresponding to the first entry, and the point addition operation result corresponding to the first entry is directly obtained from the cache entry.

[0005] In the above technical solution, two non-zero scalars with the same value and the closest distance are repeated operands (points on the elliptic curve) in the point addition operation. By temporarily storing the already calculated elliptic curve point addition operation results, the next time the same two points need to be added again, the addition operation can be directly skipped through cache hits and the values ​​in the corresponding point cache can be read as the calculation results of the two points. The above technical solution designs a cache mechanism based on the characteristics of a large number of repeated operands in the point addition operation in multi-scalar multiplication, which can effectively reduce the number of point addition operations in the multi-scalar multiplication calculation process and improve the calculation speed.

[0006] In one implementation of the above technical solution, based on the first scalar address of the first entry, the cache record found in the point cache does not match the first entry, and the cache record is overwritten and updated, or the write point cache operation is not performed.

[0007] In one implementation of the above technical solution, a first entry is obtained based on the addresses of the first scalar and the second scalar, and the steps include: according to the value of the first scalar, storing the address corresponding to the first scalar in the scalar vector into the first scalar cache bucket; based on the second scalar being equal to the first scalar value, storing the address corresponding to the second scalar in the scalar vector into the first scalar cache bucket; taking [bktc, cl, c] as an entry, bktc is the bucket number, c1 is the first scalar address, and c is the second scalar address.

[0008] In one implementation of the above technical solution, before caching the first entry and the point addition result corresponding to the two scalars in the first entry in the point cache, the steps include:

[0009] Utilize the FIFOcache slot to cache the first entry while sequentially obtaining the first entry from the FIFOcache;

[0010] Based on the first scalar address of the first entry obtained, the point cache is queried. When the cache entry corresponding to the first entry is obtained from the point cache, the first entry is deleted from the FIFOcache slot. When the result obtained from the point cache is empty, the first entry is cached in FIFOmiss and all its entries are added one by one. FIFOcache means the first-in-first-out of the pre-cache, and FIFOmiss means the first-in-first-out of the missed entry.

[0011] In one implementation of the above technical solution, the first entry and the point addition result corresponding to the two scalars in the first entry are cached in a point cache, and the steps include: based on the first scalar address of the first entry as the row index Index of the point cache, the second scalar address is written into the tag Tag of the point cache, and the point addition result corresponding to the two scalars in the first entry is written into the data part Data of the point cache.

[0012] In order to achieve the above technical objectives, a hardware accelerator is proposed in this case, which includes a scalar-aware distributor, a point cache module, and a point addition operation unit; the scalar-aware distributor is configured to store the corresponding address of each non-zero scalar in the scalar vector into different scalar cache buckets according to the value of the non-zero scalar after the block scalar vector is split in the multi-scalar multiplication; when there are two scalar addresses in the same scalar cache bucket, [bktc, cl, c] is stored as the first entry in the FIFOcache slot, bktc is the bucket number, cl is the first scalar address, and c is the second scalar address; when an entry in the FIFOcache matches a cache entry in the point cache, the point cache notifies the FIFO cache deletes the entry, otherwise caches the entry in FIFOmiss; the point addition operation unit is configured to be able to perform point addition operation on the first entry in FIFOmiss; the point cache module is configured to cache the first entry and the point addition operation result corresponding to the two scalars in the first entry in the point cache when the result is empty after querying the point cache based on the first scalar address of the first entry, or to overwrite and update the cache record when the cache record found in the point cache based on the first scalar address of the first entry does not match the first entry, or to not update the cache record when the cache record found in the point cache based on the first scalar address of the first entry does not match the first entry. Among them, FIFOcache means first-in-first-out of pre-cache, and FIFOmiss means first-in-first-out of missed entries.

[0013] In one implementation of the above technical solution, the hardware accelerator also includes a first multiplexer MUX1, a q2 queue, and a q3 queue; the first multiplexer MUX1 is configured to receive data from the q2 queue or the q3 queue, send the received data to the point addition operation unit, and give priority to processing the data in the q3 queue; the q2 queue buffers the data output from the point buffer module, the point buffer module is used to write point vectors, and the point vectors correspond to the block scalar vectors after segmentation in the multi-scalar multiplication written in the scalar buffer; the q3 queue is used to buffer the data output from the third multiplexer MUX3; the third multiplexer MUX3 simultaneously outputs the data output from the second multiplexer MUX2 and the data in the point addition result buffer unit, the second multiplexer MUX2 is used to select the data in the q7 queue and the data in the q6 queue, and store the selected data in the point addition result buffer unit, or output it to the third multiplexer MUX3, the data in the q7 queue comes from the point addition operation unit, and the data in the q6 queue comes from the point cache.

[0014] In one implementation of the above technical solution, the hardware accelerator further includes a q1 queue for buffering data, and the q1 queue is used to buffer data to be used in the FIFO cache.

[0015] In one implementation of the above technical solution, the hardware accelerator further includes a q4 queue for buffering data, and the q4 queue is used to buffer data output by the first multiplexer.

[0016] In one implementation of the above technical solution, the hardware accelerator further includes a q5 queue for buffering data, the q5 queue is used to buffer the point addition operation result of the point addition operation unit, and the point addition operation result is the corresponding result of the relevant entry in the FIFOmiss.

[0017] Beneficial technical effects of this case: The method of this case and the hardware accelerator implemented based on this method can effectively remove the repeated point addition operations in the multi-scalar multiplication calculation process, effectively reduce the amount of multi-scalar multiplication calculation, and improve the calculation speed of multi-scalar multiplication. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0019] Figure 1 , one A multi-scalar multiplication acceleration method based on a point cache mechanism in an implementation manner;

[0020] Figure 2 , one An elliptic curve multi-scalar multiplication accelerator in an implementation manner.

[0021] Figure 3 , one In this implementation manner, the number of point addition operations is reduced by . DETAILED DESCRIPTION

[0022] The following will be combined with the attached Figure 1-3 , clearly and completely describing how to implement the technical solution of this case. Obviously, the described implementation method is only a part of the implementation method of this case, not all of the implementation methods. Based on the implementation method in this case, all other implementation methods obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0023] The traditional Pippenger algorithm divides the large bit width scalar in the multi-scalar multiplication into multiple scalars, each scalar has a bit width of θ bits, and performs point addition operations based on the points corresponding to the values ​​of the scalars after the blocks. θ is a set value, and θ is 4 for example. Based on the traditional Pippenger algorithm, this case proposes the following Figure 1 The multi-scalar multiplication acceleration method based on the point cache mechanism is shown.

[0024] The large bit-width scalar in the above multi-scalar multiplication refers to a scalar with a larger bit width. In computer science and digital logic, a scalar usually refers to a single value, and the bit width refers to the maximum number of bits that can be represented by this value. It is generally considered that a scalar with a bit width greater than 64 is a large bit-width scalar.

[0025] For the block scalar vector after segmentation in multi-scalar multiplication, obtain a segmented scalar, which is recorded as S c If S c = 0, then directly remove and do not participate in the point addition operation. c ≠0, then according to its value, the address c corresponding to the scalar in the scalar vector is stored in the corresponding scalar cache bucket in sequence. The number of scalar cache buckets can be set to 2 θ -1.

[0026] When there are two scalar addresses in a scalar cache bucket, the bucket number and the two scalar addresses of the scalar cache bucket are written into the FIFOcache (pre-cache first-in, first-out) slot as an entry. Usually, the scalars corresponding to the two scalar addresses are two non-zero scalars with the same value and the closest distance in the block scalar vector. For example, if the bucket number of a scalar cache bucket is denoted as bktc, and there are two scalar addresses, namely the first scalar address c1 and the second scalar address c, then [bktc, cl, c] is written into the FIFOcache slot in sequence as an entry, and the entry is taken as the first entry.

[0027] Next, all the first entries in FIFOcache will be read out one by one in the first-in-first-out order and checked with the second entries in the point cache. If the current first entry hits, the point addition data Data of the corresponding cache entry in the point cache is read and used as the calculation result of the point addition of the two scalars in the current first entry. If the current first entry misses, the current first entry is stored in FIFOmiss (first-in-first-out of the miss entry). All the first entries in FIFOmiss will be added one by one, and after the point addition operation, it is determined whether to be cached in the point cache.

[0028] The first entry read from the FIFOcache uses the first scalar address c1 as the point cache row index Index. The row index Index is used to query the point cache. If a cache entry is found but the cache entry does not match the first entry read from the FIFOcache, or the corresponding cache entry is not found, it is a miss. If a cache entry is found and the cache entry matches the first entry read from the FIFOcache, it is a hit. If it is a hit, the data part Data of the corresponding row is read as the point addition result of the current first entry. For example, the first entry in the FIFOcache, the bucket number bktc is 6, the first scalar address and the second scalar address are 63 and 65 respectively. Based on the first scalar address 63 as the row index Index in the point cache, the 63rd row in the point cache already exists effectively and the tag Tag matches, so the value of the data part Data (P63+P65) of the row is directly read as the point addition result of this entry.

[0029] The above point cache is empty or called a cold cache at the beginning of each multi-scalar multiplication calculation. The result of the point addition operation will be determined whether to be written into the point cache according to the following cache mechanism.

[0030] Based on the row index Index, the point cache is queried. If the corresponding point cache row is empty, another scalar address c and the result of this point addition operation are written into the tag Tag and data part Data of the point cache row respectively. For example, for the point addition operation with bucket number bktc being 5 and scalar addresses being 62 and 64 respectively, the result of the point addition operation will be written into the row index Index being 62, the valid flag bit Valid of the row is set to 1, the tag Tag is written into 64, and the data part Data is the result of the point addition operation P62+P64 (P62 and P64 are the elliptic curve points at positions 62 and 64 respectively in the point vector participating in the multi-scalar multiplication calculation).

[0031] Based on the row index Index, the point cache is queried. If the corresponding point cache row is non-empty and not hit, there are two point cache content update strategies: overwrite the current non-empty row in the point cache; or skip and do not write to the point cache.

[0032] Based on the above-mentioned point cache mechanism, a multi-scalar multiplication acceleration method is proposed. Figure 2 The multi-scalar multiplication accelerator shown in FIG. The circuit module mainly includes a point addition operation unit, a scalar sensing distributor, a point cache, a scalar buffer, a point buffer, a point addition result buffer, a number of queue buffers (q1 to q7) and three multiplexers (MUX1 to MUX3).

[0033] The point buffer is used to write the point vector. The scalar buffer is used to write the block scalar vectors after being segmented in the multi-scalar multiplication corresponding to the point vector.

[0034] The scalar-aware distributor is combined with the point cache module to implement the above-mentioned point cache mechanism, that is, to skip the point addition operation with the same operands in the multi-scalar multiplication calculation process, which can effectively reduce the number of point addition operations required in the point addition operation unit, thereby speeding up the calculation of multiple scalar multipliers.

[0035] Among them, the scalar-aware distributor is configured to store the address corresponding to each non-zero scalar in the scalar vector into different scalar cache buckets according to the value of the non-zero scalar after the block scalar vector is split in the multi-scalar multiplication; when there are two scalar addresses in the same scalar cache bucket, [bktc, cl, c] is stored as the first entry in the FIFOcache slot, bktc is the bucket number, cl is the first scalar address, and c is the second scalar address; when an entry in the FIFOcache matches a cache entry in the point cache, the point cache notifies the FIFOcache to delete the entry, otherwise the entry is cached in the FIFOmiss.

[0036] Among them, the point cache module is configured to cache the point addition result of the two scalars of the first entry and the first entry in the point cache when the result is empty after querying the point cache based on the first scalar address of the first entry, or to overwrite and update the cache record when the cache record found in the point cache based on the first scalar address of the first entry does not match the first entry, or to not update the cache record when the cache record found in the point cache based on the first scalar address of the first entry does not match the first entry.

[0037] The dot addition result of the two scalars of the first item and the first item is realized by the dot addition unit. Figure 2It can be seen that the point addition operation unit performs the addition operation of two points of the elliptic curve, and its input is a group of point buffers (buffered in the q2 queue) or a group consisting of a point from the point addition result buffer unit and a point from the second multiplexer MUX2 (buffered in the q3 queue). By designing the first multiplexer MUX1 to have a priority, so that the priority of the q3 queue is higher than that of the q2 queue, it can be ensured that the q7 queue is not blocked, and then the result of the point addition operation unit can be smoothly stored in the q7 queue, preventing the point addition operation unit from being blocked and stopping the calculation. The point addition operation result is also determined by the q5 queue combined with the point cache mechanism to determine whether to update the point cache. When an entry in the FIFOcache matches a cache entry in the point cache, the data part Data in the cache entry is stored in the point addition result buffer unit via the q6 queue, or when the corresponding position of the point addition result buffer unit already has a point addition result, it will be directly input to the q3 queue via the third multiplexer MUX3.

[0038] Experiments were conducted on FPGA or ASIC, and the designed elliptic curve multi-scalar multiplication accelerator was applied to four different elliptic curves: BN128, MNT4-298, BLS12-381, and MNT4-753. Figure 3 When the point cache content update strategy is the overwrite strategy, the number of point addition operations required is reduced by 11.75%, 11.86%, 11.8% and 11.51% respectively; when the point cache content update strategy is the skip strategy, the number of point addition operations required is reduced by 12.05%, 11.97%, 11.8% and 11.5% respectively. The additional hardware overhead introduced by the point cache is small. Taking BLS12-381 as an example, its LUT (lookup table) increases by less than 2%.

[0039] Through the description of the above implementation modes, those skilled in the art can clearly understand that the method disclosed herein can be implemented as a simulated hardware accelerator with the aid of software, or can be implemented with the aid of software plus necessary general-purpose hardware.

[0040] The terms "first", "second" and "third" mentioned above are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first", "second" and "third" may explicitly or implicitly include one or more of the features.

[0041] Although the embodiments of the present invention are described above in conjunction with the accompanying drawings, the present invention is not limited to the above specific embodiments and application fields, and the above specific embodiments are only illustrative and instructive, rather than restrictive. A person of ordinary skill in the art can also make many forms under the guidance of this specification and without departing from the scope of protection of the claims of the present invention, all of which belong to the protection of the present invention.

Claims

1. A multi-scalar multiplication acceleration method based on a point cache mechanism, characterized in that: The method comprises the following steps: For the block scalar vector after the segmentation in the multi-scalar multiplication, two non-zero scalars with the same value and the closest distance therebetween are used as the first scalar and the second scalar, respectively, and a first entry is obtained based on the addresses of the first scalar and the second scalar; Based on the first scalar address of the first entry, query the point cache, and if the result is empty, cache the first entry and the point addition result corresponding to the two scalars in the first entry in the point cache; A query is performed in the point cache based on the first scalar address of the first entry to obtain a cache entry corresponding to the first entry, and a point addition result corresponding to the first entry is directly obtained from the cache entry.

2. The method according to claim 1, characterized in that Based on the first scalar address of the first entry, the cache record found in the point cache does not match the first entry, and the cache record is overwritten and updated, or the write point cache operation is not performed.

3. The method according to claim 1, characterized in that Obtaining a first entry based on addresses of a first scalar and a second scalar, the steps comprising: According to the value of the first scalar, storing the address corresponding to the first scalar in the scalar vector into the first scalar cache bucket; Based on the second scalar being equal to the first scalar value, storing an address corresponding to the second scalar in the scalar vector into the first scalar cache bucket; Take [bktc, cl, c] as an entry, bktc is the bucket number, c1 is the first scalar address, and c is the second scalar address.

4. The method according to claim 1, characterized in that: Before caching the first entry and the point addition result corresponding to the two scalars in the first entry in the point cache, the steps include: Utilize the FIFOcache slot to cache the first entry while sequentially obtaining the first entry from the FIFOcache; Based on the first scalar address of the first entry obtained, query the point cache, and when the cache entry corresponding to the first entry is obtained from the point cache, delete the first entry from the FIFOcache slot, and when the result obtained from the point cache is empty, cache the first entry in FIFOmiss and perform point addition operation on all its entries one by one; Among them, FIFOcache means the first-in-first-out of the pre-cache, and FIFOmiss means the first-in-first-out of the miss entry.

5. The method according to claim 1, characterized in that Cache the first entry and the point addition result corresponding to the two scalars in the first entry in a point cache, the steps comprising: Based on the first scalar address of the first entry as the row index Index of the point cache, the second scalar address is written into the tag Tag of the point cache, and the point addition result corresponding to the two scalars in the first entry is written into the data part Data of the point cache.

6. A hardware accelerator, characterized in that: The hardware accelerator includes a scalar perception distributor, a point cache module, and a point addition operation unit; The scalar-aware distributor is configured to store the address corresponding to each non-zero scalar in the scalar vector into different scalar cache buckets according to the value of the non-zero scalar for the block scalar vectors after the segmentation in the multi-scalar multiplication; when there are two scalar addresses in the same scalar cache bucket, [bktc, cl, c] is stored as the first entry in the FIFOcache slot, where bktc is the bucket number, c1 is the first scalar address, and c is the second scalar address; when an entry in the FIFOcache matches a cache entry in the point cache, the point cache notifies the FIFOcache to delete the entry, otherwise the entry is cached in the FIFOmiss; The dot-add operation unit is configured to perform a dot-add operation on the first entry in the FIFOmiss; The point cache module is configured to cache the first entry and the point addition operation result corresponding to the two scalars in the first entry in the point cache when the result obtained after querying the point cache based on the first scalar address of the first entry is empty, or to overwrite and update the cache record when the cache record found in the point cache based on the first scalar address of the first entry does not match the first entry, or not to update the cache record when the cache record found in the point cache based on the first scalar address of the first entry does not match the first entry; Among them, FIFOcache means the first-in-first-out of the pre-cache, and FIFOmiss means the first-in-first-out of the miss entry.

7. The hardware accelerator according to claim 6, characterized in that: The hardware accelerator also includes a first multiplexer MUX1, a q2 queue, and a q3 queue; The first multiplexer MUX1 is configured to receive data from the q2 queue or the q3 queue, send the received data to the point-add operation unit, and give priority to processing the data in the q3 queue; The q2 queue buffers the data outputted from the point buffer module, the point buffer module is used to write point vectors, the point vectors correspond to the block scalar vectors after being segmented in the multi-scalar multiplication written in the scalar buffer; The q3 queue is used to buffer the data output by the third multiplexer MUX3; the third multiplexer simultaneously outputs the data output by the second multiplexer MUX2 and the data in the point addition result buffer unit, the second multiplexer MUX2 is used to select the data in the q7 queue and the data in the q6 queue, and stores the selected data in the point addition result buffer unit, or outputs it to the third multiplexer MUX3, the data in the q7 queue comes from the point addition operation unit, and the data in the q6 queue comes from the point cache.

8. The hardware accelerator according to claim 6, characterized in that: The hardware accelerator also includes a q1 queue for buffering data, and the q1 queue is used to buffer data to be used in the FIFOcache cache; And / or the hardware accelerator further includes a q4 queue for buffering data, the q4 queue being used for buffering data output by the first multiplexer MUX1; And / or the hardware accelerator further includes a q5 queue for buffering data, the q5 queue is used to buffer the point addition operation result of the point addition operation unit, and the point addition operation result is the corresponding result of the relevant entry in the FIFOmiss.

Images