Arithmetic apparatus

Abstract

To provide an arithmetic apparatus capable of executing number theoretic transformations at higher speeds.SOLUTION: An arithmetic apparatus 100 for performing number theoretic transformations comprises: an arithmetic unit 40 that includes a plurality of arithmetic core groups that execute arithmetic operations for different stages in series in the order of the stages in which the arithmetic operations are executed, wherein the arithmetic core group has the plurality of arithmetic cores in parallel configured to perform butterfly arithmetic operations on two pieces of input data, executes the arithmetic operation at a specific stage of the butterfly arithmetic operation for the number theoretic transformations, and outputs four or more pieces of input data and the same number of pieces of output data; and a sorting unit that generates sorted data obtained by sorting the output data output from the arithmetic core group in a predetermined order, and inputs the sorted data as input data to the arithmetic core group immediately following the arithmetic core group that output the output data. The arithmetic unit executes the arithmetic operations of different stages in parallel in each arithmetic core group.SELECTED DRAWING: Figure 13

Description

[Technical field]

[0001] The present disclosure relates to a computing device. [Background technology]

[0002] For example, Patent Document 1 discloses a coprocessor capable of performing quantum-computer-resistant cryptography operations at high speed. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] US Patent Application Publication No. 2022 / 0171885 Summary of the Invention [Problem to be solved by the invention]

[0004] Lattice cryptography, which is one type of quantum-computer-resistant cryptography, performs number-theoretic transformations in its calculations, but number-theoretic transformations are computationally intensive and take a long time to complete. Therefore, there is a demand for a calculation device that can perform number-theoretic transformations at higher speeds. [Means for solving the problem]

[0005] The present disclosure can be realized in the following forms.

[0006] According to one embodiment of the present disclosure, there is provided an arithmetic device (100) for performing number theoretic transformation. The arithmetic device includes an arithmetic unit (40, 41) including a plurality of arithmetic cores configured to perform butterfly operations on two input data in parallel, an arithmetic core group that executes an operation of a specific stage of the butterfly operation of the number theoretic transformation and outputs the same number of output data as the four or more input data, the arithmetic core groups executing operations of different stages being arranged in series in the order in which the stages are executed, and a sorting unit (30) that generates sorted data by sorting the output data output from the arithmetic core groups in a predetermined order and inputs the sorted data as the input data to the arithmetic core group immediately following the arithmetic core group that output the output data, and the arithmetic unit executes the operations of different stages in parallel in each of the arithmetic core groups.

[0007] According to this aspect, when the arithmetic device executes the number theoretic transformation, different stages of the butterfly computation of the number theoretic transformation are executed in parallel in each arithmetic core group, so that the number theoretic transformation can be executed faster than when the different stages of the butterfly computation of the number theoretic transformation are not executed in parallel. [Brief description of the drawings]

[0008] [Figure 1] FIG. 2 is an explanatory diagram showing a schematic configuration of a calculation device according to the first embodiment. [Diagram 2] FIG. 2 is a diagram for explaining a data flow in the first embodiment. [Diagram 3] FIG. 2 is an explanatory diagram showing a schematic configuration of a first calculation core group in the first embodiment. [Figure 4] FIG. 2 is a diagram for explaining the configuration of a first processor core. [Diagram 5] FIG. 2 is an explanatory diagram showing a schematic configuration of a second calculation core group in the first embodiment. [Figure 6] FIG. 2 is an explanatory diagram showing a schematic configuration of a third calculation core group in the first embodiment. [Figure 7] A diagram explaining the butterfly operation of number theoretic transformation of eight pieces of data. [Figure 8] FIG. 4 is a process diagram of number theoretic transformation processing in the first embodiment. [Figure 9] 5A and 5B are diagrams for explaining input data and output data of each arithmetic core in the first embodiment. [Figure 10] FIG. 1 is a process diagram of the NTT calculation process in stage 1 in the first embodiment. [Figure 11] FIG. 11 is a process diagram of the NTT calculation process in stage 2 in the first embodiment. [Figure 12] FIG. 11 is a process diagram of the NTT calculation process in stage 3 in the first embodiment. [Figure 13] FIG. 4 is a diagram showing a time chart of an example of pipeline processing in the first embodiment. [Figure 14] FIG. 11 is a diagram for explaining a data flow in the second embodiment. [Figure 15] FIG. 11 is an explanatory diagram showing a schematic configuration of a first calculation core group in the second embodiment. [Figure 16] FIG. 11 is an explanatory diagram showing a schematic configuration of a second calculation core group in the second embodiment. [Figure 17] FIG. 11 is an explanatory diagram showing a schematic configuration of a third calculation core group in the second embodiment. [Figure 18] FIG. 11 is an explanatory diagram showing a schematic configuration of a fourth calculation core group in the second embodiment. [Figure 19] A diagram explaining the butterfly operation of number theoretic transformation of 16 data. [Figure 20] FIG. 11 is a process diagram of number theoretic transformation processing in the second embodiment. [Figure 21] FIG. 13 is a diagram for explaining input data and output data of each calculation core in the NTT calculation in stage 1 of the second embodiment. [Figure 22] FIG. 13 is a diagram for explaining input data and output data of each calculation core in the NTT calculation in stage 2 of the second embodiment. [Figure 23] FIG. 11 is a process diagram of the NTT calculation process in stage 3 in the second embodiment. [Figure 24] FIG. 13 is a diagram for explaining input data and output data of each calculation core in the NTT calculation in stage 3 of the second embodiment. [Diagram 25]Stage 4 NTT computational processing flow diagram. [Figure 26] A diagram explaining the input data and output data of each calculation core in the NTT calculation of stage 4. [Figure 27] FIG. 11 is a time chart of an example of pipeline processing in the second embodiment. [Figure 28] A diagram explaining the butterfly operation of the reciprocal number theoretic transformation of eight pieces of data. [Figure 29] FIG. 13 is a diagram showing a time chart of an example of pipeline processing of butterfly operations of reciprocal number theoretic transformation. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] A. First embodiment: The arithmetic device 100 shown in Fig. 1 is a device for performing number theoretic transformation. The arithmetic device 100 encrypts or decrypts data by performing butterfly operations of number theoretic transformation. Number theoretic transformation is also called NTT (Number Theoretic Transform). The arithmetic device 100 includes a CPU 10, a memory 20, a sorting unit 30, and a arithmetic unit 40.

[0010] The memory 20 stores data included in data to be encrypted or decrypted by butterfly operations of number theoretic transformation. The data to be encrypted or decrypted by butterfly operations of number theoretic transformation is, for example, data included in authentication data for verifying the validity of a program executed by a personal computer, tablet, or the like equipped with the arithmetic device 100. The above-mentioned data may be data included in authentication data for verifying the validity of a communication device when a personal computer, tablet, or the like equipped with the arithmetic device 100 connects to a communication device such as a server. The memory 20 is configured as a static random access memory (SRAM). The memory 20 may be a direct random access memory (DRAM), a non-volatile memory, or the like. The memory 20 is also called a storage unit.

[0011] The rearrangement unit 30 stores order data. The order data defines the order of rearrangement of the data acquired from the memory 20 and the output data output from the calculation unit 40 described later. The rearrangement unit 30 stores a plurality of order data, i.e., a plurality of types of rearrangement orders. The order data can be updated, added, and deleted. The rearrangement unit 30 also includes a generation unit 31 that generates rearranged data according to the order data. Here, the rearrangement data is data obtained by rearranging the data acquired from the memory 20 or the output data in a predetermined order. That is, the rearrangement unit 30 rearranges the data acquired from the memory 20 or the output data in a predetermined order. The rearrangement unit 30 also has a DMA (Direct Memory Access) function. The rearrangement unit 30 realizes the DMA function by having, for example, a DMA controller. The rearrangement unit 30 transfers data between the rearrangement unit 30 and the memory 20 and between the rearrangement unit 30 and the calculation unit 40 by using the DMA function without going through the CPU 10. The rearrangement unit 30 is realized by a circuit such as a field programmable gate array (FPGA) or an application specific integrated circuit (ASIC).

[0012] As shown in FIG. 2, the arithmetic unit 40 includes a first buffer 50, a first arithmetic core group 51, a second buffer 52, a third buffer 60, a second arithmetic core group 61, a fourth buffer 62, a fifth buffer 70, a third arithmetic core group 71, and a sixth buffer 72. The first buffer 50, the third buffer 60, and the fifth buffer 70 temporarily store rearranged data. The second buffer 52, the fourth buffer 62, and the sixth buffer 72 temporarily store output data. In the following, when each buffer is referred to without distinction, they are simply referred to as buffers. That is, the buffers temporarily store output data or rearranged data.

[0013] 2, the rearrangement unit 30 transfers data between the rearrangement unit 30 and the memory 20, and between the rearrangement unit 30 and the calculation unit 40. The rearrangement unit 30 transfers data between the rearrangement unit 30 and the buffer, thereby transferring data between the rearrangement unit 30 and the calculation unit 40. Specifically, the rearrangement unit 30 transfers the rearranged data from the generation unit 31 to the first buffer 50, the third buffer 60, and the fifth buffer 70 using the DMA function. The rearrangement unit 30 also transfers the output data from the second buffer 52, the fourth buffer 62, and the sixth buffer 72 to the generation unit 31 using the DMA function.

[0014] 3, the first calculation core group 51 includes a first calculation core 53, a second calculation core 54, a third calculation core 55, and a fourth calculation core 56. The first calculation core 53 is configured to perform butterfly calculations of number theoretic transformation of two pieces of input data. The first calculation core 53 is realized by a circuit such as an FPGA or an ASIC.

[0015] As shown in FIG. 4, the first arithmetic core 53 includes a first input unit 81, a second input unit 82, a multiplier 83, a first output unit 84, and a second output unit 85. The first input unit 81 receives first input data, which is one piece of input data. The second input unit 82 receives second input data, which is one piece of input data different from the first input data. A predetermined coefficient is input to the multiplier 83. The multiplier 83 outputs a value obtained by multiplying the value input to the multiplier 83 by the predetermined coefficient. The first output unit 84 outputs first output data, which is one piece of output data. The second output unit 85 outputs second output data, which is one piece of output data different from the first output data.

[0016] The first output unit 84 outputs a value obtained by adding the first input data and the second input data as the first output data. The second output unit 85 outputs a value obtained by multiplying a value obtained by subtracting the second input data from the first input data by a coefficient input to the multiplier 83 as the second output data. That is, the first arithmetic core 53 outputs the result of the butterfly operation performed between the value input to the first input unit 81, the value input to the second input unit 82, and the coefficient input to the multiplier 83 from the first output unit 84 and the second output unit 85. When a value A is input to the first input unit 81, a value B is input to the second input unit 82, and a coefficient C is input to the multiplier 83, the first output unit 84 outputs a value X, and the second output unit 85 outputs a value Y. Here, the values ​​X and Y are expressed by the following formulas (1) and (2), respectively. X=A+B...Formula (1) Y = (AB) × C... formula (2)

[0017] The second arithmetic core 54, the third arithmetic core 55, and the fourth arithmetic core 56 have the same configuration as the first arithmetic core 53. Therefore, detailed description thereof will be omitted.

[0018] As shown in FIG. 5, the second calculation core group 61 includes a fifth calculation core 63, a sixth calculation core 64, a seventh calculation core 65, and an eighth calculation core 66. As shown in FIG. 6, the third calculation core group 71 includes a ninth calculation core 73, a tenth calculation core 74, an eleventh calculation core 75, and a twelfth calculation core 76. The fifth calculation core 63 to the twelfth calculation core 76 have the same configuration as the first calculation core 53. Therefore, detailed description of these will be omitted. In the following, when each calculation core is referred to without distinction, it is simply called a calculation core. As described above, the calculation unit 40 includes a plurality of the same calculation cores. Also, when each calculation core group is referred to without distinction, it is simply called a calculation core group. In this embodiment, the calculation core group includes four calculation cores in parallel. Also, the calculation unit 40 includes three calculation core groups in series. The second calculation core group 61 is provided immediately after the first calculation core group 51 , and the third calculation core group 71 is provided immediately after the second calculation core group 61 .

[0019] In this embodiment, eight pieces of input data are input to each processor core group. The eight pieces of input data are input to a first input unit 81 and a second input unit 82 of each processor core, one each. Each processor core group outputs the same number of output data as the number of input data. Each processor core group outputs one piece of output data from a first output unit 84 and a second output unit 85 of each processor core.

[0020] In this embodiment, the arithmetic device 100 performs butterfly arithmetic of number theoretic transformation of eight data. As shown in FIG. 7, in the butterfly arithmetic of number theoretic transformation of eight data, three stages of arithmetic are performed. First, in the first stage, eight data A0 to A7 are calculated by butterfly arithmetic of eight data x0 to x7. Next, in the second stage, eight data B0 to B7 are calculated by butterfly arithmetic of eight data A0 to A7. Finally, in the third stage, eight data X0 to X7 are calculated by butterfly arithmetic of eight data B0 to B7. W8 shown in FIG. 7 is a primitive eighth root of 1 modulo P (P is a positive integer), and W4 is a primitive fourth root of 1 modulo Q (Q is a positive integer). x0 to x7 are data before number theoretic transformation, and X0 to X7 are data after number theoretic transformation. In this embodiment, the first stage of the butterfly operation of the number theoretic transform described above is also called the stage 1 NTT operation, the second stage is also called the stage 2 NTT operation, and the third stage is also called the stage 3 NTT operation.

[0021] 7, the NTT calculation in stage 1 is executed by the first calculation core group 51, the NTT calculation in stage 2 is executed by the second calculation core group 61, and the NTT calculation in stage 3 is executed by the third calculation core group 71. That is, each calculation core group executes the calculation of a specific stage of the butterfly calculation of the number theoretic transform. The calculation unit 40 includes three calculation core groups arranged in series in the order in which the stages of the butterfly calculation of the number theoretic transform are executed.

[0022] The arithmetic device 100 executes the number theoretic transformation butterfly operation of eight data by executing the number theoretic transformation process shown in FIG. 8. Hereinafter, a set of eight data on which the number theoretic transformation butterfly operation is executed is also referred to as a data set. That is, the arithmetic device 100 executes the number theoretic transformation butterfly operation of one data set by executing the number theoretic transformation process. First, in step S10, the arithmetic device 100 executes the NTT arithmetic process of stage 1. Next, in step S20, the arithmetic device 100 executes the NTT arithmetic process of stage 2. Finally, in step S30, the arithmetic device 100 executes the NTT arithmetic process of stage 3.

[0023] The NTT arithmetic processing of stage 1 will be described below with reference to Fig. 2, Fig. 9, and Fig. 10. In step S110 of Fig. 10, rearrangement unit 30 transfers one data set from memory 20 to rearrangement unit 30 using the DMA function. At this time, rearrangement unit 30 transfers eight pieces of data, x0 to x7, shown in Fig. 7, from memory 20 to rearrangement unit 30. The transferred data is arranged in the order of x0, x1, x2, x3, x4, x5, x6, and x7. In other words, rearrangement unit 30 acquires one data set from memory 20.

[0024] In step S120, the rearrangement unit 30 rearranges the data transferred in step S110 into the bit-reversed order. Specifically, the rearrangement unit 30 rearranges the data arranged in the order of x0, x1, x2, x3, x4, x5, x6, x7 into the order of x0, x4, x2, x6, x1, x5, x3, x7.

[0025] In step S130, the rearrangement unit 30 transfers the rearranged data generated in step S120 from the rearrangement unit 30 to the first buffer 50 using the DMA function, and stores the data in the first buffer 50.

[0026] In step S140, the first calculation core group 51 acquires the rearranged data from the first buffer 50 as input data, and inputs the acquired input data to the first input unit 81 and the second input unit 82 of each calculation core. As shown in FIG. 9, the first calculation core group 51 inputs x0 to the first input unit 81 of the first calculation core 53, inputs x4 to the second input unit 82 of the first calculation core 53, inputs x2 to the first input unit 81 of the second calculation core 54, inputs x6 to the second input unit 82 of the second calculation core 54, inputs x1 to the first input unit 81 of the third calculation core 55, inputs x5 to the second input unit 82 of the third calculation core 55, inputs x3 to the first input unit 81 of the fourth calculation core 56, and inputs x7 to the second input unit 82 of the fourth calculation core 56. Also, in step S140, the multiplier 83 of the first calculation core 53 inputs a coefficient W8 0 However, the multiplier 83 of the second arithmetic core 54 has a coefficient W8 2 However, the multiplier 83 of the third arithmetic core 55 has a coefficient W8 1 However, the multiplier 83 of the fourth arithmetic core 56 has a coefficient W8 3 are input, respectively.

[0027] In step S150, each arithmetic core executes a butterfly operation between the value input to the first input unit 81, the value input to the second input unit 82, and the coefficient input to the multiplier 83, and outputs the result from the first output unit 84 and the second output unit 85. The first output unit 84 of the first arithmetic core 53, the second output unit 85 of the first arithmetic core 53, the first output unit 84 of the second arithmetic core 54, the second output unit 85 of the second arithmetic core 54, the first output unit 84 of the third arithmetic core 55, the second output unit 85 of the third arithmetic core 55, the first output unit 84 of the fourth arithmetic core 56, and the second output unit 85 of the fourth arithmetic core 56 output A0, A4, A2, A6, A1, A5, A3, and A7 as output data to the second buffer 52, respectively. The above output data is stored in the second buffer 52.

[0028] In step S160, the rearrangement unit 30 transfers the output data output in step S150 from the second buffer 52 to the rearrangement unit 30 using the DMA function. In other words, the rearrangement unit 30 obtains the output data from the buffer. As described above, the NTT arithmetic process of stage 1 is executed.

[0029] The NTT arithmetic processing of stage 2 will be described below with reference to Figures 2, 9, and 11. In step S210 in Figure 11, rearrangement unit 30 rearranges the output data transferred to rearrangement unit 30 in step S160 of the NTT arithmetic processing of stage 1. Specifically, rearrangement unit 30 rearranges the output data arranged in the order of A0, A4, A2, A6, A1, A5, A3, A7 into the order of A0, A2, A1, A3, A4, A6, A5, A7.

[0030] In step S220, the rearrangement unit 30 transfers the rearranged data generated in step S210 from the rearrangement unit 30 to the third buffer 60 using the DMA function, and stores the data in the third buffer 60.

[0031] In step S230, the second calculation core group 61 acquires the rearranged data as input data from the third buffer 60, and inputs the acquired input data to the first input unit 81 and the second input unit 82 of each calculation core. As shown in FIG. 9, the second calculation core group 61 inputs A0 to the first input unit 81 of the fifth calculation core 63, inputs A2 to the second input unit 82 of the fifth calculation core 63, inputs A1 to the first input unit 81 of the sixth calculation core 64, inputs A3 to the second input unit 82 of the sixth calculation core 64, inputs A4 to the first input unit 81 of the seventh calculation core 65, inputs A6 to the second input unit 82 of the seventh calculation core 65, inputs A5 to the first input unit 81 of the eighth calculation core 66, and inputs A7 to the second input unit 82 of the eighth calculation core 66. In step S230, the multipliers 83 of the fifth arithmetic core 63 and the seventh arithmetic core 65 are supplied with a coefficient W4 0 However, the multipliers 83 of the sixth arithmetic core 64 and the eighth arithmetic core 66 have coefficients W4 1 are input, respectively.

[0032] In step S240, each arithmetic core executes a butterfly calculation. The first output unit 84 of the fifth arithmetic core 63, the second output unit 85 of the fifth arithmetic core 63, the first output unit 84 of the sixth arithmetic core 64, the second output unit 85 of the sixth arithmetic core 64, the first output unit 84 of the seventh arithmetic core 65, the second output unit 85 of the seventh arithmetic core 65, the first output unit 84 of the eighth arithmetic core 66, and the second output unit 85 of the eighth arithmetic core 66 output B0, B2, B1, B3, B4, B6, B5, and B7 as output data to the fourth buffer 62, respectively. The output data is stored in the fourth buffer 62.

[0033] In step S250, rearrangement unit 30 uses the DMA function to transfer the output data output in step S240 from the fourth buffer 62 to rearrangement unit 30. As described above, the NTT arithmetic process of stage 2 is executed.

[0034] The NTT arithmetic processing of stage 3 will be described below with reference to Figures 2, 9, and 12. In step S310 in Figure 12, rearrangement unit 30 rearranges the output data transferred to rearrangement unit 30 in step S250 of the NTT arithmetic processing of stage 2. Specifically, rearrangement unit 30 rearranges the output data arranged in the order of B0, B2, B1, B3, B4, B6, B5, B7 into the order of B0, B1, B2, B3, B4, B5, B6, B7.

[0035] In step S320, the rearrangement unit 30 transfers the rearranged data generated in step S310 from the rearrangement unit 30 to the fifth buffer 70 using the DMA function, and stores the data in the fifth buffer 70.

[0036] In step S330, the third calculation core group 71 acquires the rearranged data as input data from the fifth buffer 70, and inputs the acquired input data to the first input unit 81 and the second input unit 82 of each calculation core. As shown in FIG. 9, the third calculation core group 71 inputs B0 to the first input unit 81 of the ninth calculation core 73, inputs B1 to the second input unit 82 of the ninth calculation core 73, inputs B2 to the first input unit 81 of the tenth calculation core 74, inputs B3 to the second input unit 82 of the tenth calculation core 74, inputs B4 to the first input unit 81 of the eleventh calculation core 75, inputs B5 to the second input unit 82 of the eleventh calculation core 75, inputs B6 to the first input unit 81 of the twelfth calculation core 76, and inputs B7 to the second input unit 82 of the twelfth calculation core 76. Furthermore, in step S330, the coefficient 1 is input to the multipliers 83 of the ninth arithmetic core 73 to the twelfth arithmetic core .

[0037] In step S340, each arithmetic core executes a butterfly calculation. The first output unit 84 of the ninth arithmetic core 73, the second output unit 85 of the ninth arithmetic core 73, the first output unit 84 of the tenth arithmetic core 74, the second output unit 85 of the tenth arithmetic core 74, the first output unit 84 of the eleventh arithmetic core 75, the second output unit 85 of the eleventh arithmetic core 75, the first output unit 84 of the twelfth arithmetic core 76, and the second output unit 85 of the twelfth arithmetic core 76 output X0, X4, X2, X6, X1, X5, X3, and X7 as output data to the sixth buffer 72, respectively. The output data is stored in the sixth buffer 72.

[0038] In step S350, rearrangement unit 30 transfers the output data output in step S340 from sixth buffer 72 to rearrangement unit 30 using the DMA function.

[0039] In step S360, rearrangement unit 30 rearranges the output data transferred in step S350. Specifically, rearrangement unit 30 rearranges the data arranged in the order of X0, X4, X2, X6, X1, X5, X3, X7 into the order of X0, X1, X2, X3, X4, X5, X6, X7.

[0040] In step S370, rearrangement unit 30 transfers the rearranged data generated in step S360 from rearrangement unit 30 to memory 20 using the DMA function, and stores the data in memory 20. As described above, the NTT arithmetic process of stage 3 is executed.

[0041] The arithmetic device 100 performs pipeline processing when performing number theoretic transformation processing of a plurality of data sets. The pipeline processing is composed of three stages, a stage for performing NTT arithmetic processing in stage 1, a stage for performing NTT arithmetic processing in stage 2, and a stage for performing NTT arithmetic processing in stage 3. At this time, the arithmetic unit 40 performs NTT arithmetic in different stages in parallel in each arithmetic core group. In the following, the pipeline processing in the case where the arithmetic device 100 performs number theoretic transformation processing of four data sets, from the first data set to the fourth data set, will be described with reference to FIG. 13. In FIG. 13, NTT1 means the NTT arithmetic processing in stage 1, NTT2 means the NTT arithmetic processing in stage 2, and NTT3 means the NTT arithmetic processing in stage 3.

[0042] First, in the first cycle, the calculation device 100 executes the NTT calculation process of stage 1 of the first data set.

[0043] Next, in the second cycle, the calculation device 100 executes, in parallel, the NTT calculation process in stage 2 of the first data set and the NTT calculation process in stage 1 of the second data set.

[0044] Next, in the third cycle, the calculation device 100 executes, in parallel, the NTT calculation process in stage 3 of the first data set, the NTT calculation process in stage 2 of the second data set, and the NTT calculation process in stage 1 of the third data set.

[0045] Next, in the fourth cycle, the calculation device 100 executes, in parallel, the NTT calculation process in stage 3 of the second data set, the NTT calculation process in stage 2 of the third data set, and the NTT calculation process in stage 1 of the fourth data set.

[0046] Next, in the fifth cycle, the calculation device 100 executes, in parallel, the NTT calculation process in stage 3 of the third data set and the NTT calculation process in stage 2 of the fourth data set.

[0047] Finally, in the sixth cycle, the calculation device 100 executes the NTT calculation process of stage 3 of the fourth data set.

[0048] According to the first embodiment described above, the arithmetic device 100 performs pipeline processing when performing number theoretic conversion processing of a plurality of data sets, and performs NTT calculations of different stages in parallel in each arithmetic core group. In the case where pipeline processing is not performed, in the example shown in FIG. 13, after the NTT calculation processing of stage 3 of the first data set is completed in the third cycle, the NTT calculation processing of stage 1 of the second data set is performed in the fourth cycle. In this case, it takes up to the twelfth cycle to complete the number theoretic conversion processing of four data sets. Therefore, by performing pipeline processing when performing number theoretic conversion processing of a plurality of data sets, the number theoretic conversion can be performed faster than when pipeline processing is not performed.

[0049] In this embodiment, the rearrangement unit 30 has a DMA function, and uses the DMA function to transfer rearranged data from the rearrangement unit 30 to the first buffer 50, the third buffer 60, and the fifth buffer 70, and to transfer output data from the second buffer 52, the fourth buffer 62, and the sixth buffer 72 to the rearrangement unit 30. Therefore, unlike a case in which the rearrangement unit 30 does not have a DMA function, when the rearrangement unit 30 has the DMA function, data can be transferred directly between the rearrangement unit 30 and the buffers, and the time required for data transfer can be shortened. Therefore, number theoretic transformation can be performed at higher speed.

[0050] In this embodiment, the order data is stored in the rearrangement unit 30, and the generation unit 31 generates the rearranged data according to the order data. Therefore, the load on the CPU 10 can be reduced compared to when the CPU 10 generates the rearranged data.

[0051] In this embodiment, the input data input to the arithmetic core group is data included in the data to be encrypted or decrypted by number theoretic transformation. Therefore, the arithmetic device 100 can encrypt or decrypt data by executing the butterfly operation of the number theoretic transformation.

[0052] In this embodiment, the rearrangement unit 30 and the arithmetic core are realized by circuits such as FPGA and ASIC. Therefore, the butterfly operation of the number theoretic transformation can be performed at a higher speed than when the CPU 10 functions as the rearrangement unit 30 and the arithmetic core by executing the program stored in the memory 20.

[0053] Furthermore, in this embodiment, the rearrangement unit 30 rearranges the data acquired from the memory 20 and the output data, so that butterfly operations of number theoretic transformations can be executed using a plurality of identical arithmetic cores.

[0054] B. Second embodiment: In the first embodiment, the computing unit 40 includes three computing core groups in series. Each computing core group includes four computing cores in parallel. In contrast, in the second embodiment, the computing unit 41 includes four computing core groups in series. Each computing core group includes eight computing cores in parallel. The configurations of the components of the computing device 100 other than the computing unit 41 are the same as those in the first embodiment.

[0055] 14, the arithmetic unit 41 includes a first buffer 50, a first arithmetic core group 151, a second buffer 52, a third buffer 60, a second arithmetic core group 161, a fourth buffer 62, a fifth buffer 70, a third arithmetic core group 171, a sixth buffer 72, a seventh buffer 180, a fourth arithmetic core group 181, and an eighth buffer 182. The seventh buffer 180 temporarily stores the rearranged data. The eighth buffer 182 temporarily stores the output data.

[0056] 15, the first calculation core group 151 includes a first calculation core 201, a second calculation core 202, a third calculation core 203, a fourth calculation core 204, a fifth calculation core 205, a sixth calculation core 206, a seventh calculation core 207, and an eighth calculation core 208. The second calculation core group 161 includes a ninth calculation core 209, a tenth calculation core 210, an eleventh calculation core 211, a twelfth calculation core 212, a thirteenth calculation core 213, a fourteenth calculation core 214, a fifteenth calculation core 215, and a sixteenth calculation core 216, as shown in FIG. As shown in FIG. 17, the third calculation core group 171 includes a seventeenth calculation core 217, an eighteenth calculation core 218, a nineteenth calculation core 219, a twentieth calculation core 220, a twenty-first calculation core 221, a twenty-second calculation core 222, a twenty-third calculation core 223, and a twenty-fourth calculation core 224. As shown in FIG. 18, the fourth calculation core group 181 includes a twenty-fifth calculation core 225, a twenty-sixth calculation core 226, a twenty-seventh calculation core 227, a twenty-eighth calculation core 228, a twenty-ninth calculation core 229, a thirty-first calculation core 230, a thirty-first calculation core 231, and a thirty-second calculation core 232. The first calculation core 201 to the thirty-second calculation core 232 have the same configuration as the first calculation core 53 in the first embodiment. In this embodiment, 16 pieces of input data are input to each calculation core group.

[0057] In the second embodiment, the arithmetic device 100 performs butterfly arithmetic on number theoretic transformation of 16 data. As shown in FIG. 19, in the butterfly arithmetic on number theoretic transformation of 16 data, arithmetic is performed in four stages. First, in the first stage, 16 data A0 to A15 are calculated by butterfly arithmetic on 16 data x0 to x15. Next, in the second stage, 16 data B0 to B15 are calculated by butterfly arithmetic on 16 data A0 to A15. Next, in the third stage, 16 data C0 to C15 are calculated by butterfly arithmetic on 16 data B0 to B15. Finally, in the fourth stage, 16 data X0 to X15 are calculated by butterfly arithmetic on 16 data C0 to C15. In the W stage shown in FIG. 19, 16 is a primitive 16th root of 1 modulo R (R is a positive integer). In this embodiment, the first stage operation of the butterfly operation of the number theoretic transformation described above is also called the stage 1 NTT operation, the second stage operation is also called the stage 2 NTT operation, the third stage operation is also called the stage 3 NTT operation, and the fourth stage operation is also called the stage 4 NTT operation.

[0058] As shown in FIG. 19, the NTT calculations in stage 1 are performed by the first calculation core group 151, the NTT calculations in stage 2 are performed by the second calculation core group 161, the NTT calculations in stage 3 are performed by the third calculation core group 171, and the NTT calculations in stage 4 are performed by the fourth calculation core group 181.

[0059] The arithmetic device 100 executes the number theoretic transformation process shown in FIG. 20 to execute butterfly operations of number theoretic transformation of 16 data. In this embodiment, the data set means a set of 16 data on which the butterfly operations of number theoretic transformation are executed. First, in step S410, the arithmetic device 100 executes NTT arithmetic processing of stage 1. Next, in step S420, the arithmetic device 100 executes NTT arithmetic processing of stage 2. Next, in step S430, the arithmetic device 100 executes NTT arithmetic processing of stage 3. Finally, in step S440, the arithmetic device 100 executes NTT arithmetic processing of stage 4.

[0060] In the following, the NTT arithmetic processing in stage 1 in the second embodiment will be described with reference to Fig. 10, Fig. 14, and Fig. 21. Note that the description of the part in which the same processing as the NTT arithmetic processing in stage 1 in the first embodiment shown in Fig. 10 is executed will be omitted.

[0061] In step S110 in Fig. 10, rearrangement unit 30 transfers 16 pieces of data, x0 to x15, shown in Fig. 19, from memory 20 to rearrangement unit 30. The transferred data is arranged in the following order: x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, and x15.

[0062] In step S120, the rearrangement unit 30 rearranges the data transferred in step S110 into the bit-reversed order. Specifically, the rearrangement unit 30 rearranges the data arranged in the order of x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15 into the order of x0, x8, x4, x12, x2, x10, x6, x14, x1, x9, x5, x13, x3, x11, x7, x15.

[0063] In step S140, as shown in FIG. 21 , the first calculation core group 151 inputs x0 to the first input unit 81 of the first calculation core 201, inputs x8 to the second input unit 82 of the first calculation core 201, inputs x4 to the first input unit 81 of the second calculation core 202, inputs x12 to the second input unit 82 of the second calculation core 202, inputs x2 to the first input unit 81 of the third calculation core 203, inputs x10 to the second input unit 82 of the third calculation core 203, inputs x6 to the first input unit 81 of the fourth calculation core 204, and inputs x14 to the fourth calculation core 205. 8. In step S140, the multiplier 83 of the first arithmetic core 201 receives the coefficient W 16 0 However, the multiplier 83 of the second arithmetic core 202 has a coefficient W 16 4 However, the multiplier 83 of the third arithmetic core 203 has a coefficient W 16 2 However, the multiplier 83 of the fourth arithmetic core 204 has a coefficient W 16 6 However, the multiplier 83 of the fifth arithmetic core 205 has a coefficient W 16 1 However, the multiplier 83 of the sixth arithmetic core 206 has a coefficient W 16 5 However, the multiplier 83 of the seventh arithmetic core 207 has a coefficient W 16 3 However, the multiplier 83 of the eighth arithmetic core 208 has a coefficient W 16 7 are input, respectively.

[0064] In step S150, each calculation core executes a butterfly calculation. The first output unit 84 of the first calculation core 201, the second output unit 85 of the first calculation core 201, the first output unit 84 of the second calculation core 202, the second output unit 85 of the second calculation core 202, the first output unit 84 of the third calculation core 203, the second output unit 85 of the third calculation core 203, the first output unit 84 of the fourth calculation core 204, the second output unit 85 of the fourth calculation core 204, the first output unit 84 of the fifth calculation core 205, the second output unit 85 of the fifth calculation core 205, the sixth calculation core 206, the sixth calculation core 207, the sixth calculation core 208, the sixth calculation core 209, the sixth calculation core 210, the sixth calculation core 211, the sixth calculation core 212, the sixth calculation core 213, the sixth calculation core 214, the sixth calculation core 215, the sixth calculation core 216, the sixth calculation core 217, the sixth calculation core 218, the sixth calculation core 219, the sixth calculation core 220, the sixth calculation core 221, the sixth calculation core 222, the sixth calculation core 223, the sixth calculation core 224, the sixth calculation core 225, the sixth calculation core 226, the sixth calculation core 227, the sixth calculation core 228, the sixth calculation core 229, the sixth calculation core 230, the sixth calculation core 231, the sixth calculation core 232, the sixth calculation core 233, the sixth calculation core 234, the sixth calculation core 235, the sixth calculation core 236, the sixth calculation core 237, the sixth calculation core 238, the sixth calculation core 239, the sixth calculation core 239, the sixth calculation core 239, the The first output unit 84 of the sixth arithmetic core 206, the second output unit 85 of the sixth arithmetic core 206, the first output unit 84 of the seventh arithmetic core 207, the second output unit 85 of the seventh arithmetic core 207, the first output unit 84 of the eighth arithmetic core 208, and the second output unit 85 of the eighth arithmetic core 208 respectively output A0, A8, A4, A12, A2, A10, A6, A14, A1, A9, A5, A13, A3, A11, A7, and A15 as output data to the second buffer 52. The above output data is stored in the second buffer 52.

[0065] The NTT arithmetic processing in stage 2 will be described below with reference to Fig. 11, Fig. 14, and Fig. 22. Note that a description of the part in which the same processing as the NTT arithmetic processing in stage 2 in the first embodiment shown in Fig. 11 is performed will be omitted.

[0066] 11, the rearrangement unit 30 rearranges the output data transferred to the rearrangement unit 30 in step S160 of the NTT arithmetic processing of stage 1. Specifically, the rearrangement unit 30 rearranges the output data arranged in the order of A0, A8, A4, A12, A2, A10, A6, A14, A1, A9, A5, A13, A3, A11, A7, A15, into the order of A0, A4, A2, A6, A1, A5, A3, A7, A8, A12, A10, A14, A9, A13, A11, A15.

[0067] In step S230, the second calculation core group 161, as shown in FIG. 22 , inputs A0 to the first input unit 81 of the ninth calculation core 209, inputs A4 to the second input unit 82 of the ninth calculation core 209, inputs A2 to the first input unit 81 of the tenth calculation core 210, inputs A6 to the second input unit 82 of the tenth calculation core 210, inputs A1 to the first input unit 81 of the eleventh calculation core 211, inputs A5 to the second input unit 82 of the eleventh calculation core 211, inputs A3 to the first input unit 81 of the twelfth calculation core 212, and inputs A7 to the first input unit 81 of the twelfth calculation core 213. A is input to the second input section 82 of the 12th arithmetic core 212, A8 is input to the first input section 81 of the 13th arithmetic core 213, A12 is input to the second input section 82 of the 13th arithmetic core 213, A10 is input to the first input section 81 of the 14th arithmetic core 214, A14 is input to the second input section 82 of the 14th arithmetic core 214, A9 is input to the first input section 81 of the 15th arithmetic core 215, A13 is input to the second input section 82 of the 15th arithmetic core 215, A11 is input to the first input section 81 of the 16th arithmetic core 216, and A15 is input to the second input section 82 of the 16th arithmetic core 216. Also, in step S230, the coefficient W8 is input to the multipliers 83 of the 9th arithmetic core 209 and the 13th arithmetic core 213. 0 However, the multipliers 83 of the tenth arithmetic core 210 and the fourteenth arithmetic core 214 have the coefficient W8 2 However, the multipliers 83 of the eleventh arithmetic core 211 and the fifteenth arithmetic core 215 have the coefficient W8 1 However, the multipliers 83 of the 12th arithmetic core 212 and the 16th arithmetic core 216 have the coefficient W8 3 are input, respectively.

[0068] In step S240, each arithmetic core executes a butterfly calculation. The first output unit 84 of the ninth arithmetic core 209, the second output unit 85 of the ninth arithmetic core 209, the first output unit 84 of the tenth arithmetic core 210, the second output unit 85 of the tenth arithmetic core 210, the first output unit 84 of the eleventh arithmetic core 211, the second output unit 85 of the eleventh arithmetic core 211, the first output unit 84 of the twelfth arithmetic core 212, the second output unit 85 of the twelfth arithmetic core 212, the first output unit 84 of the thirteenth arithmetic core 213, the second output unit 85 of the thirteenth arithmetic core 213, The first output unit 84 of the 14th arithmetic core 214, the second output unit 85 of the 15th arithmetic core 215, the first output unit 84 of the 15th arithmetic core 215, the first output unit 84 of the 16th arithmetic core 216, and the second output unit 85 of the 16th arithmetic core 216 respectively output B0, B4, B2, B6, B1, B5, B3, B7, B8, B12, B10, B14, B9, B13, B11, and B15 as output data to the fourth buffer 62. The above output data is stored in the fourth buffer 62.

[0069] In the following, the NTT arithmetic processing of stage 3 in the second embodiment will be described with reference to Figures 14, 23, and 24. In Figure 23, the same reference numerals are attached to the parts in which the same processing as the NTT arithmetic processing of stage 3 in the first embodiment shown in Figure 12 is executed, and the description will be omitted.

[0070] 23, the rearrangement unit 30 rearranges the output data transferred to the rearrangement unit 30 in step S250 of the NTT arithmetic processing of stage 2. Specifically, the rearrangement unit 30 rearranges the output data arranged in the order of B0, B4, B2, B6, B1, B5, B3, B7, B8, B12, B10, B14, B9, B13, B11, B15 into the order of B0, B2, B1, B3, B4, B6, B5, B7, B8, B10, B9, B11, B12, B14, B13, B15.

[0071] In step S331, as shown in FIG. 24 , the third calculation core group 71 inputs B0 to the first input unit 81 of the 17th calculation core 217, inputs B2 to the second input unit 82 of the 17th calculation core 217, inputs B1 to the first input unit 81 of the 18th calculation core 218, inputs B3 to the second input unit 82 of the 18th calculation core 218, inputs B4 to the first input unit 81 of the 19th calculation core 219, inputs B6 to the second input unit 82 of the 19th calculation core 219, inputs B5 to the first input unit 81 of the 20th calculation core 220, and inputs B7 to the first input unit 81 of the 20th calculation core 221. 20 to the second input section 82 of the 20th arithmetic core 217, B8 to the first input section 81 of the 21st arithmetic core 221, B10 to the second input section 82 of the 21st arithmetic core 221, B9 to the first input section 81 of the 22nd arithmetic core 222, B11 to the second input section 82 of the 22nd arithmetic core 222, B12 to the first input section 81 of the 23rd arithmetic core 223, B14 to the second input section 82 of the 23rd arithmetic core 223, B13 to the first input section 81 of the 24th arithmetic core 224, and B15 to the second input section 82 of the 24th arithmetic core 224. Also, in step S331, the coefficient W4 is input to the multipliers 83 of the 17th arithmetic core 217, the 19th arithmetic core 219, the 21st arithmetic core 221, and the 23rd arithmetic core 223. 0 However, the multipliers 83 of the 18th arithmetic core 218, the 20th arithmetic core 220, the 22nd arithmetic core 222, and the 24th arithmetic core 224 are provided with the coefficient W4 1 are input, respectively.

[0072] In step S341, each processor core executes a butterfly calculation. The first output unit 84 of the seventeenth processor core 217, the second output unit 85 of the seventeenth processor core 217, the first output unit 84 of the eighteenth processor core 218, the second output unit 85 of the eighteenth processor core 218, the first output unit 84 of the nineteenth processor core 219, the second output unit 85 of the nineteenth processor core 219, the first output unit 84 of the twentieth processor core 220, the second output unit 85 of the twentieth processor core 220, the first output unit 84 of the twenty-first processor core 221, the second output unit 85 of the twenty-first processor core 221, The first output unit 84 of the arithmetic core 222, the second output unit 85 of the 22nd arithmetic core 222, the first output unit 84 of the 23rd arithmetic core 223, the second output unit 85 of the 23rd arithmetic core 223, the first output unit 84 of the 24th arithmetic core 224, and the second output unit 85 of the 24th arithmetic core 224 respectively output C0, C2, C1, C3, C4, C6, C5, C7, C8, C10, C9, C11, C12, C14, C13, and C15 as output data to the sixth buffer 72. The above output data is stored in the sixth buffer 72.

[0073] In the following, the NTT arithmetic processing of stage 4 will be described with reference to Fig. 14, Fig. 25, and Fig. 26. In step S510 in Fig. 25, the rearrangement unit 30 rearranges the output data transferred to the rearrangement unit 30 in step S350 of the NTT arithmetic processing of stage 3. Specifically, the rearrangement unit 30 rearranges the output data arranged in the order of C0, C2, C1, C3, C4, C6, C5, C7, C8, C10, C9, C11, C12, C14, C13, and C15 into the order of C0, C1, C2, C3, C4, C5, C6, C7, C8, C9, C10, C11, C12, C13, C14, and C15.

[0074] In step S520, the rearrangement unit 30 transfers the rearranged data generated in step S510 from the rearrangement unit 30 to the seventh buffer 180 using the DMA function, and stores the data in the seventh buffer 180.

[0075] In step S530, the fourth calculation core group 181 obtains the rearranged data as input data from the seventh buffer 180, and inputs the obtained input data to the first input unit 81 and the second input unit 82 of each calculation core. As shown in FIG. 26 , the fourth calculation core group 181 inputs C0 to the first input unit 81 of the 25th calculation core 225, C1 to the second input unit 82 of the 25th calculation core 225, C2 to the first input unit 81 of the 26th calculation core 226, C3 to the second input unit 82 of the 26th calculation core 226, C4 to the first input unit 81 of the 27th calculation core 227, C5 to the second input unit 82 of the 27th calculation core 227, C6 to the first input unit 81 of the 28th calculation core 228, and C7 to the second input unit 82 of the 28th calculation core 228. 32 Calculation core 232. In step S530, the coefficient 1 is input to the multiplier 83 of the 25th arithmetic core 225 through the 32nd arithmetic core 232. In step S530, the coefficient 1 is input to the multiplier 83 of the 25th arithmetic core 225 through the 32nd arithmetic core 232. In step S530, the coefficient 1 is input to the multiplier 83 of the 25th arithmetic core 225 through the 32nd arithmetic core 232.

[0076] In step S540, each arithmetic core executes a butterfly calculation. The first output unit 84 of the 25th arithmetic core 225, the second output unit 85 of the 25th arithmetic core 225, the first output unit 84 of the 26th arithmetic core 226, the second output unit 85 of the 26th arithmetic core 226, the first output unit 84 of the 27th arithmetic core 227, the second output unit 85 of the 27th arithmetic core 227, the first output unit 84 of the 28th arithmetic core 228, the second output unit 85 of the 28th arithmetic core 228, the first output unit 84 of the 29th arithmetic core 229, the second output unit 85 of the 29th arithmetic core 229, the 30th arithmetic core 229, the 31st arithmetic core 229, the 32nd arithmetic core 229, the 33rd arithmetic core 229, the 40th arithmetic core 229, the 41st arithmetic core 229, the 42nd arithmetic core 229, the 43rd arithmetic core 229, the 44th arithmetic core 229, the 45th arithmetic core 229, the 46th arithmetic core 229, the 47th arithmetic core 227, the 48th arithmetic core 228, the 49th arithmetic core 229, the 50th arithmetic core 229, the 51st arithmetic core The first output unit 84 of the 30th arithmetic core 230, the second output unit 85 of the 31st arithmetic core 231, the first output unit 84 of the 31st arithmetic core 231, the second output unit 85 of the 32nd arithmetic core 232, and the second output unit 85 of the 32nd arithmetic core 232 respectively output X0, X8, X4, X12, X2, X10, X6, X14, X1, X9, X5, X13, X3, X11, X7, and X15 as output data to the eighth buffer 182. The above output data is stored in the eighth buffer 182.

[0077] In step S550, rearrangement unit 30 transfers the output data output in step S540 from the eighth buffer 182 to rearrangement unit 30 using the DMA function.

[0078] In step S560, rearrangement unit 30 rearranges the output data transferred in step S550. Specifically, rearrangement unit 30 rearranges the data arranged in the order of X0, X8, X4, X12, X2, X10, X6, X14, X1, X9, X5, X13, X3, X11, X7, X15 into the order of X0, X1, X2, X3, X4, X5, X6, X7, X8, X9, X10, X11, X12, X13, X14, X15.

[0079] In step S570, rearrangement unit 30 transfers the rearranged data generated in step S560 from rearrangement unit 30 to memory 20 using the DMA function, and stores the data in memory 20. As described above, the NTT arithmetic process of stage 4 is executed.

[0080] The arithmetic device 100 performs pipeline processing when executing number theoretic transformation processing of a plurality of data sets. In the second embodiment, the pipeline processing is configured of four stages, including a stage 1 for executing NTT arithmetic processing, a stage 2 for executing NTT arithmetic processing, a stage 3 for executing NTT arithmetic processing, and a stage 4 for executing NTT arithmetic processing. In the following, the pipeline processing when the arithmetic device 100 executes number theoretic transformation processing of four data sets, from the first data set to the fourth data set, will be described with reference to FIG. 27. In FIG. 27, NTT4 means the NTT arithmetic processing of stage 4.

[0081] First, in the first cycle, the calculation device 100 executes the NTT calculation process of stage 1 of the first data set.

[0082] Next, in the second cycle, the calculation device 100 executes, in parallel, the NTT calculation process in stage 2 of the first data set and the NTT calculation process in stage 1 of the second data set.

[0083] Next, in the third cycle, the calculation device 100 executes, in parallel, the NTT calculation process in stage 3 of the first data set, the NTT calculation process in stage 2 of the second data set, and the NTT calculation process in stage 1 of the third data set.

[0084] Next, in the fourth cycle, the calculation device 100 executes in parallel the NTT calculation processing of stage 4 of the first data set, the NTT calculation processing of stage 3 of the second data set, the NTT calculation processing of stage 2 of the third data set, and the NTT calculation processing of stage 1 of the fourth data set.

[0085] Next, in the fifth cycle, the calculation device 100 executes, in parallel, the NTT calculation process in stage 4 of the second data set, the NTT calculation process in stage 3 of the third data set, and the NTT calculation process in stage 2 of the fourth data set.

[0086] Next, in the sixth cycle, the calculation device 100 executes, in parallel, the NTT calculation process in stage 4 of the third data set and the NTT calculation process in stage 3 of the fourth data set.

[0087] Finally, in the seventh cycle, the calculation device 100 executes the NTT calculation process of stage 4 of the fourth data set.

[0088] According to the second embodiment described above, the arithmetic device 100 performs pipeline processing when performing number theoretic transformation processing of a plurality of data sets, and executes NTT operations of different stages in parallel in each arithmetic core group. Therefore, as in the first embodiment, number theoretic transformation can be executed faster than when pipeline processing is not performed.

[0089] C. Other embodiments: (C-1) In the first embodiment, the arithmetic unit 40 includes three arithmetic core groups in series, and each arithmetic core group includes four arithmetic cores in parallel. In the second embodiment, the arithmetic unit 41 includes four arithmetic core groups in series, and each arithmetic core group includes eight arithmetic cores in parallel. In contrast, the arithmetic unit 40 may include two arithmetic core groups in series, and each arithmetic core group may include two arithmetic cores in parallel. Also, the arithmetic unit 40 may include m (m is an integer of 5 or more) arithmetic core groups in series, and each arithmetic core group may include 2(m-1) arithmetic cores in parallel. That is, the arithmetic unit 40 may include n (n is an integer of 2 or more) arithmetic core groups in series, and each arithmetic core group may include 2(n-1) arithmetic cores in parallel. In this case, 2n input data are input to the arithmetic unit 40. That is, the arithmetic device 100 performs butterfly arithmetic on 2n data.

[0090] (C-2) In the above embodiment, the input data is data contained in data to be encrypted or decrypted by number theoretic transformation, but the input data does not have to be data contained in data to be encrypted or decrypted by number theoretic transformation.

[0091] (C-3) In the above embodiment, the buffer is provided in the calculation unit 40. Alternatively, the rearrangement unit 30 may have a buffer function. In this case, the rearrangement unit 30 inputs the rearranged data to the calculation core group as input data. In addition, the calculation core group outputs output data to the rearrangement unit 30.

[0092] (C-4) In the above embodiment, the arithmetic device 100 is configured to be able to execute butterfly operations of number theoretic transformation. In contrast, the arithmetic device 100 may be configured to be able to execute butterfly operations of number theoretic transformation and inverse number theoretic transformation. Inverse number theoretic transformation is also called INTT (Inverse Number Theoretic Transform). For example, in butterfly operations of inverse number theoretic transformation of eight data, as shown in FIG. 28, three stages of operations are executed. When the arithmetic device 100 includes three arithmetic core groups in series, the first arithmetic core group 51 executes the INTT operation of stage 1, the second arithmetic core group 61 executes the INTT operation of stage 2, and the third arithmetic core group 71 executes the INTT operation of stage 3.

[0093] The arithmetic device 100 performs pipeline processing when performing butterfly operations for inverse number theoretic transformation of multiple data sets, as well as when performing number theoretic transformation of multiple data sets. The pipeline processing is composed of three stages: a stage 1 for performing an INTT operation, a stage 2 for performing an INTT operation, and a stage 3 for performing an INTT operation. At this time, the arithmetic unit 40 performs the INTT operations of different stages in parallel in each arithmetic core group, as shown in FIG. 29. In FIG. 29, INTT1 means the INTT operation of stage 1, INTT2 means the INTT operation of stage 2, and INTT3 means the INTT operation of stage 3.

[0094] In the last stage of the butterfly operation of the reciprocal theoretic transformation, a shift operation is performed. For example, in the butterfly operation of the reciprocal theoretic transformation of eight pieces of data, each output data is multiplied by 1 / 8 in the last stage as shown in Fig. 28. When the arithmetic device 100 is configured to be able to perform the butterfly operation of the number theoretic transformation and the butterfly operation of the reciprocal theoretic transformation, the sorting unit 30 has a function of performing a shift operation on the output data transferred from the arithmetic unit 40 to the sorting unit 30 after the arithmetic unit 40 performs the operations except the shift operation in the last stage of the butterfly operation of the reciprocal theoretic transformation.

[0095] The present disclosure is not limited to the above-mentioned embodiment, and can be realized in various configurations without departing from the spirit of the present disclosure. For example, the technical features in the embodiments corresponding to the technical features in each aspect described in the Summary of the Invention column can be appropriately replaced or combined to solve some or all of the above-mentioned problems or to achieve some or all of the above-mentioned effects. Furthermore, if the technical feature is not described as essential in this specification, it can be appropriately deleted. [Explanation of symbols]

[0096] 10...CPU, 20...memory, 30...sorting unit, 31...generation unit, 40, 41...calculation unit, 50...first buffer, 51...first calculation core group, 52...second buffer, 53...first calculation core, 54...second calculation core, 55...third calculation core, 56...fourth calculation core, 60...third buffer, 61...second calculation core group, 62...fourth buffer, 63...fifth calculation core, 64...sixth calculation core, 65...seventh calculation core, 66...eighth calculation core, 70...fifth buffer, 7 1...third calculation core group, 72...sixth buffer, 73...ninth calculation core, 74...tenth calculation core, 75...eleventh calculation core, 76...twelfth calculation core, 81...first input section, 82...second input section, 83...multiplier, 84...first output section, 85...second output section, 100...arithmetic device, 151...first calculation core group, 161...second calculation core group, 171...third calculation core group, 180...seventh buffer, 181...fourth calculation core group, 182...eighth buffer

Claims

1. An arithmetic device (100) for performing number theoretic transformations, comprising: A group of arithmetic cores each configured to perform a butterfly operation on two pieces of input data in parallel, executes a specific stage of a butterfly operation of a number theoretic transform, and outputs four or more pieces of output data equal in number to the four or more pieces of input data, an arithmetic unit (40, 41) including a plurality of arithmetic core groups each executing an arithmetic operation of a different stage, the arithmetic core groups being arranged in series in the order in which the stages are executed; a sorting unit (30) that generates sorted data by sorting the output data output from the processor core group in a predetermined order, and inputs the sorted data as the input data to the processor core group immediately following the processor core group that output the output data, The arithmetic unit executes the operations of different stages in parallel in each of the arithmetic core groups. Computing device.

2. 2. The computing device according to claim 1, a buffer for temporarily storing the output data or the rearranged data; The processing core group outputs the output data to the buffer; the rearrangement unit acquires the output data from the buffer and outputs the generated rearranged data to the buffer; the processing core group immediately following the processing core group that has output the output data, obtains the rearranged data from the buffer as the input data; Computing device.

3. 3. The computing device according to claim 2, The sorting unit is A generation unit (31) that generates the rearranged data in accordance with order data in which the order is defined, Transferring the output data from the buffer to the generating unit using a direct memory access (DMA) function; transferring the rearranged data from the generation unit to the buffer using the DMA function; Computing device.

4. 2. The computing device according to claim 1, The computing core comprises: A first input unit (81) to which first input data, which is one of the input data, is input; a second input section (82) to which second input data, which is one of the input data different from the first input data, is input; a multiplier (83) that outputs a value obtained by multiplying an input value by a predetermined coefficient; A first output section (84) that outputs first output data, which is one of the output data; a second output section (85) that outputs second output data that is one of the output data different from the first output data; the first output unit outputs a value obtained by adding the first input data and the second input data as the first output data; the second output unit outputs, as the second output data, a value obtained by subtracting the second input data from the first input data and multiplying the result by the coefficient. Computing device.

5. 2. The computing device according to claim 1, The input data is data included in data to be encrypted or decrypted by number theoretic transformation. Computing device.

Images