Controller

Abstract

To provide a controller capable of suppressing a time required for calculation processing.SOLUTION: According to an embodiment, provided is a controller for controlling a computing storage device connectable to a host and including a storage. The controller includes: a first interface configured to receive an I / O command designating first host data from the host; a second interface configured to transmit and receive the first host data to and from the storage; and a calculation processing unit. The calculation processing unit is configured to input the first host data and a plurality of calculation parameters, duplicate the first host data to acquire a plurality of first host data, execute calculation processing using the plurality of parameters on the plurality of first host data in parallel, and output a calculation processing result in each of a plurality of first processing units.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] An embodiment of the present invention relates to a controller. [Background technology]

[0002] In recent years, storage devices having a function of processing computational instructions on behalf of a host (hereinafter referred to as computing storage devices) have been developed.

[0003] In such a computing storage device, when a computing storage I / O command (hereinafter referred to as an I / O command) sent from a host is received, the computation instruction is processed according to the computation option accompanying the I / O command, making it possible to replace the host data (e.g., read data) specified in the I / O command with the processing result (computation result).

[0004] As described above, when processing a computation command, computation processing may be performed on host data (input data) using computation parameters. For example, when performing a secret computation (multi-party computation) using fully homomorphic encryption, the computation processing may take a long time. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Ilaria Chillotti and 3 others, "TFHE: Fast Fully Homomorphic Encryption over the Torus", [online], Internet<URL: https: / / eprint.iacr.org / 2018 / 421.pdf> Summary of the Invention [Problem to be solved by the invention]

[0006] Therefore, the present embodiment aims to provide a controller capable of reducing the time required for calculation processing. [Means for solving the problem]

[0007] According to an embodiment, there is provided a controller for controlling a computing storage device connectable to a host and including a storage. The controller includes a first interface for receiving an I / O command specifying first host data from the host, a second interface for transmitting and receiving the first host data between the host and the storage, and a calculation processing unit. The calculation processing unit includes an input unit for inputting the first host data and a plurality of calculation parameters, a duplication processing unit for acquiring a plurality of first host data by replicating the first host data, a plurality of first processing units for performing calculation processing in parallel on the acquired plurality of first host data using the input parameters, and an output unit for outputting a calculation processing result in each of the plurality of first processing units. [Brief description of the drawings]

[0008] [Figure 1] FIG. 2 is a block diagram showing an example of the configuration of a computing storage device according to an embodiment. [Diagram 2] 5 is a diagram for explaining a data structure of a virtual register table in the embodiment. [Diagram 3] FIG. 2 is a diagram illustrating a virtual address space according to the embodiment. [Figure 4] 11 is a flowchart showing an example of a processing procedure of an accelerator operating in a CwR mode according to an embodiment. [Diagram 5] FIG. 4 is a diagram showing an example of a data structure of a page table in the embodiment. [Figure 6] 11 is a flowchart illustrating an example of a paging algorithm in the embodiment. [Figure 7] 11 is a flowchart showing an example of a processing procedure of an accelerator operating in a CwW mode in the embodiment. [Figure 8] 11 is a flowchart showing an example of a processing procedure of an accelerator operating in a CoR mode in an embodiment. [Figure 9] 1 is a flowchart showing an example of a processing procedure of an accelerator operating in a CoW mode according to an embodiment. [Figure 10] FIG. 2 is a diagram showing an example of the configuration of a calculation processing unit included in an accelerator according to the embodiment. [Figure 11] FIG. 13 is a diagram showing another example of the configuration of a calculation processing unit included in the accelerator according to the embodiment. [Figure 12] FIG. 13 is a diagram showing yet another example of the configuration of a calculation processing unit provided in an accelerator according to an embodiment. [Figure 13] 6A and 6B are diagrams for explaining an example of a method for calculating a virtual register number in the embodiment. [Figure 14] FIG. 4 is a diagram showing an example of an instruction set of secure computation instructions used by the accelerator according to the embodiment. [Figure 15] FIG. 4 is a diagram showing an example of a secure computation program stored in a program register according to the embodiment. [Figure 16] FIG. 11 is a diagram showing an example of a secure computation program that is further executed in the embodiment. [Figure 17] FIG. 11 is a diagram showing an example of a secure computation program that is further executed in the embodiment. [Figure 18] FIG. 11 is a diagram showing an example of a secure computation program that is further executed in the embodiment. [Figure 19] FIG. 11 is a diagram showing another example of a secure computation program stored in a program register according to the embodiment. [Figure 20] A diagram for explaining the configuration of a computing storage device that communicates with a host based on the NVMe standard in an embodiment. [Figure 21] FIG. 2 is a diagram for explaining a configuration in which an accelerator according to an embodiment is arranged inside an SSD controller. [Figure 22]FIG. 1 is a diagram for explaining a configuration in which an accelerator according to an embodiment is arranged inside an NVMe-oF target module. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Hereinafter, an embodiment will be described with reference to the drawings. 1 is a block diagram showing an example of the configuration of a computing storage device (hereinafter, referred to as CSD) in this embodiment. The CSD 10 shown in FIG. 1 corresponds to a storage device having a function of processing calculation instructions, for example, and is also called a memory system.

[0010] The CSD 10 is configured to be connectable to a host 20 , and includes an accelerator 11 and a storage 12 .

[0011] The accelerator 11 is a device that operates to improve the processing speed of the computer system (CSD 10 and host 20), and corresponds to a controller that controls the CSD 10. As shown in FIG. 1, the accelerator 11 includes a host interface (I / F) 111, a storage interface (I / F) 112, a main memory 113, a virtual register table 114, a page table 115, a memory management unit 116, and a calculation processing unit 117.

[0012] The host interface 111 receives computing storage I / O commands (hereinafter referred to as I / O commands) that specify host data from the host 20. The I / O commands include a read command for reading data from the storage 12 and a write command for writing data to the storage 12. The host data specified in the I / O command includes read data that is read from the storage 12 and write data that is written to the storage 12 based on the I / O command (read command and write command). In the I / O command, the host data is specified by a logical address used to access the storage 12 (to read data from the storage 12 and write data to the storage 12). The host interface 111 transmits and receives host data to and from the host 20.

[0013] The storage interface 112 transmits and receives host data to and from the storage 12. That is, when the host data is read data, the storage interface 112 receives the read data from the storage 12. When the host data is write data, the storage interface 112 transmits the write data to the storage 12.

[0014] The main memory 113 is used to store a copy of the host data (data read and written by the I / O command) specified in the I / O command. The main memory 113 is configured to be accessible faster than the storage 12, and is realized by a memory (not shown) such as a DRAM provided in the CSD 10, for example.

[0015] The virtual register table 114 is a table for managing virtual registers that hold data used to process a calculation command according to a calculation option associated with host data specified in an I / O command. Specifically, the virtual register table 114 stores, in association with each virtual register number specified (calculated) based on the calculation option, a virtual address represented by a page number and a page offset assigned to a page in which data used to process a calculation command according to the calculation option is stored, and a data size of the data.

[0016] The page table 115 is a table for managing whether the storage destination of data in each page is the main memory 113 or the storage 12 (a swap area described later) for each page number. Specifically, the page table 115 stores, in association with each page number, a flag indicating the storage destination of data (hereinafter referred to as a storage destination flag) and a real address of the storage destination (hereinafter referred to as a storage destination real address).

[0017] The memory management unit 116 executes processing such as referring to the page table 115, storing a copy of the host data specified in the I / O command in the main memory 113, and updating the virtual register table 114, depending on the operation mode of the CSD 10 described later.

[0018] The calculation processing unit 117 refers to the virtual register table 114 and processes a calculation command (a calculation command using the host data) according to a calculation option associated with the host data specified in an I / O command.

[0019] Here, the data structure of the virtual register table 114 shown in FIG. 1 (the virtual registers managed in the virtual register table 114) will be described with reference to FIG.

[0020] As described above, the virtual register table 114 stores a virtual address and a data size in association with the virtual register number. In other words, in this embodiment, one virtual register is referenced by using a virtual register number assigned to the virtual register, and is represented by a pair of a virtual address and a data size.

[0021] A virtual address indicates a memory area represented by a set of a page number and a page offset. The unit of data size is bytes. In FIG. 2, the total number of virtual registers managed by the virtual register table 114 is N. reg This assumes that:

[0022] Meanwhile, host data specified in an I / O command received from the host 20 is accompanied by a computation option for processing the computation command. The computation option includes a content identifier and a data size (bytes). The content identifier is represented by (a set of) Type, KeyID, and DataID.

[0023] As an example of the structure of a calculation option, assuming a calculation option that can be used with Torus Fully Homomorphic Encryption (TFHE), which is one of the secure calculation technologies (secure operation technologies), Type is the TFHE data type, KeyID is the key number, and DataID is the TFHE data identifier. For example, Type is represented by a value between 0 and 6, KeyID is represented by a value equal to or greater than 0, and DataID is represented by a value equal to or greater than 0. A torus in TFHE is a mathematical structure called an algebraic torus or a circular group, and is a multiplicative group T={z∈C:|z|=1}, which is defined by a set of unit circular points on the complex plane C {z∈C:|z|=1} and a binary operation "×". ×In TFHE, for example, a lattice cryptography called TLWE (Torus Learning with Errors) is used. The ciphertext of TFHE is called a TLWE sample and is represented as a vector of a torus. In this embodiment, the torus is scaled and encoded as a 32-bit integer value.

[0024] The virtual register number in the above-mentioned virtual register table 114 is calculated (specified) from the content identifier included in such a calculation option. Note that the method of calculating the virtual register number based on the content identifier will be described later.

[0025] 3 is a diagram showing a schematic diagram of a virtual address space in this embodiment. The virtual address space includes a virtual register area and a stack area.

[0026] The virtual register area is an area corresponding to a plurality of virtual registers including, for example, a program register, etc., which will be described later. The stack area has a structure for holding ciphertext in the Last In Last Out (LILO) format in stack operations using the Push instruction and the Pop instruction, which will be described later.

[0027] In the example shown in FIG. 3, the virtual address is 32 bits. stack indicates the stack size (size of stack area) in bytes. In this case, the maximum virtual address that the virtual register area can use is 2 32 -S stack -1. Also, the virtual address of the bottom of the stack area is 2 32 It is represented as -1. When accessing the virtual register area and stack area (the main memory 113), the page table 115 is used. The page table 115 will be described in detail later.

[0028] The following describes basic operations of the accelerator 11 according to this embodiment. The accelerator 11 according to this embodiment operates in each of a CwR (Copy with Read) mode, a CwW (Copy with Write) mode, a CoR (Compute on Read) mode, and a CoW (Compute on Write) mode.

[0029] In this embodiment, the host data includes host data with and without a calculation option. In addition, when a calculation option is attached to the host data, the calculation option is included in the metadata added to the host data.

[0030] 4 is a flowchart showing an example of a processing procedure of the accelerator 11 operating in the CwR mode. The CwR mode is an operation mode for copying host data (read data) specified in a read command from the host 20 to the main memory 113.

[0031] First, the host interface 111 receives a read command (I / O command) from the host 20 (step S1). The read command received in step S1 includes a logical address used to access the read data.

[0032] Next, the storage interface 112 issues (transmits) the read command received in step S1 to the storage 12 (step S2).

[0033] When the process of step S2 is executed, host data is read from the storage 12 based on the logical address included in the read command. In this case, the memory management unit 116 receives a read completion notification and read data corresponding to the read completion notification from the storage 12 via the storage interface 112. The memory management unit 116 stores the received read data in a variable D (step S3).

[0034] Next, the memory management unit 116 determines whether or not a calculation option is included in the metadata added to the read data (that is, the variable D) (step S4).

[0035] If it is determined that the metadata added to the read data includes a calculation option (YES in step S4), the memory management unit 116 stores the virtual register number calculated based on the calculation option (content identifier) ​​in the variable num (step S5).

[0036] Next, memory management unit 116 stores variable D (read data) in a free area of ​​main memory 113 (step S6).

[0037] When the process of step S6 is executed, memory management unit 116 sets the virtual address indicating the memory area of ​​main memory 113 to which variable D is copied as the virtual address corresponding to variable num (the virtual address referenced by the virtual register number stored in variable num) in virtual register table 114. In other words, the leading virtual address of the copy destination of variable D is set in the virtual address field (reg[num].addr) of the variable num-th virtual register (step S7).

[0038] Furthermore, the memory management unit 116 sets the data size of the variable D as the data size corresponding to the variable num (the data size referenced by the virtual register number stored in the variable num) in the virtual register table 114. In other words, the byte length of the variable D is set in the data size field (reg[num].size) of the variable num-th virtual register (step S8).

[0039] When the process of step S8 is executed, the memory management unit 116 transmits the variable D (that is, the read data) and a read completion notification to the host 20 (that is, the source of the read command) via the host interface 111 (step S9).

[0040] If it is determined in step S4 that the metadata added to the read data does not include a calculation option (NO in step S4), the process proceeds to step S9. In other words, if the metadata added to the read data does not include a calculation option, a copy of the read data is not stored in the main memory 113.

[0041] 4, a copy of the read data to which metadata including calculation options is added can be stored in the main memory 113 based on a read command sent from the host 20. The read data copied to the main memory 113 in this manner can be used when processing a calculation command, which will be described later.

[0042] 4 has been described as a case where a copy of the host data specified in the I / O command (read command) is not stored in the main memory 113 at the time the process shown in Fig. 4 is executed, but if a copy of the host data (read data) is already stored in the main memory 113 and its value has not been rewritten, the host data may be read from the main memory 113 after the process of step S1 is executed, and the process of step S9 may be executed. Whether or not a copy of the host data is stored in the main memory 113 is determined by referring to the page table 115 described above.

[0043] Here, Fig. 5 shows an example of the data structure of the page table 115. As shown in Fig. 5, the page table 115 stores a storage destination flag and a storage destination real address in association with a page number. In other words, each entry (storage destination flag and storage destination real address) of the page table 115 is referenced by a page number. The page table 115 is expressed, for example, in the form of an array table.

[0044] The page number is a number (identifier) ​​assigned to a page that corresponds to an area of ​​a certain size into which the memory area in which a copy of the host data is stored is divided.

[0045] Here, in addition to the host data area in which the host data is stored, a swap area for temporarily storing a copy of the host data is set in the storage 12. The storage destination flag indicates whether the data in the page to which the associated page number is assigned (a copy of the host data) is stored in the main memory 113 or in the swap area set in the storage 12.

[0046] The storage real address indicates the address of the main memory 113 or the storage 12 (swap area) where the data in the page to which the associated page number is assigned is stored.

[0047] Specifically, when a storage destination flag is 0, the storage destination flag indicates that the data in the page to which the associated page number is assigned is stored in the main memory 113. In this case, the storage destination real address indicates an address in the main memory 113.

[0048] On the other hand, when the storage destination flag is 1, the storage destination flag indicates that the data in the page to which the associated page number is assigned is stored in a swap area set in the storage 12. In this case, the storage destination real address indicates the address of the swap area.

[0049] In Figure 5, N page In other words, the page table 115 shown in FIG. page It has entries S page is the page size, S swap is the swap size (size of swap area) in bytes.

[0050] As described above, a virtual address is represented by a page number and a page offset, and the page number is the upper log2N of the virtual address. pageIn this case, in this embodiment, as described above, the page number can be obtained from the virtual address calculated from the calculation option associated with the host data (the calculation option included in the metadata added to the host data), and by referring to the entry (storage destination flag) of the page table 115 with the page number, it is possible to determine whether the host data is stored in the main memory 113 or not.

[0051] In addition, in the above-mentioned FIG. 4, it is explained that there is free space in the main memory 113 for storing the read data (variable D), but if such free space does not exist, it is necessary to secure such free space by using the above-mentioned swap area.

[0052] An example of a process (paging algorithm) for reserving free space in the main memory 113 will be described below with reference to the flowchart of Fig. 6. The process shown in Fig. 6 is executed in step S6 shown in Fig. 4.

[0053] First, in step S6 shown in FIG. 4, it is necessary to store the read data (i.e., the host data specified in the I / O command) in the main memory 113, so the memory management unit 116 determines whether or not the main memory 113 has free space (one page's worth of contiguous free space) for storing the read data (step S11).

[0054] If it is determined that there is free space in the main memory 113 (YES in step S11), the memory management unit 116 stores the top address (real address) of the free space in the main memory 113 in the variable a (step S12).

[0055] When the process of step S12 is executed, the memory management unit 116 copies the variable D to the main memory 113 based on the variable a (step S13). In this case, the read data stored in the variable D is stored in the address of the main memory 113 where the variable a is stored.

[0056] Furthermore, the memory management unit 116 acquires the page number x from the virtual address calculated from the calculation option included in the metadata added to the read data. The memory management unit 116 sets the value of the storage destination flag (table[x].flag) of the entry of the page table 115 referenced by the acquired page number x (hereinafter, referred to as the first target entry) to 0 (step S14).

[0057] Furthermore, the memory management unit 116 sets the value of the variable a to the storage real address (table[x].addr) of the first target entry (step S15).

[0058] On the other hand, if it is determined in step S11 that there is no free space in main memory 113 (NO in step S11), memory management unit 116 refers to page table 115 and selects page number y whose storage destination flag value is 0 (step S16).

[0059] Next, the memory management unit 116 judges whether or not there is a free space (a continuous free space of one page) in the swap area set in the storage 12 (step S17).

[0060] If it is determined that there is free space in the swap area (YES in step S17), the memory management unit 116 stores the top address (real address) of the free space in the swap area in the variable b (step S18).

[0061] When the process of step S18 is executed, the memory management unit 116 copies the data (one page's worth of data) stored in the storage real address (table[y].addr) of the entry in page table 115 referenced by page number y (hereinafter referred to as the second target entry) to the address of the swap area stored in variable b (step S19).

[0062] Next, the memory management unit 116 stores the value of the storage destination real address of the second target entry in the variable a (step S20).

[0063] Moreover, the memory management unit 116 sets the value of the storage destination flag (table[y].flag) of the second target entry to 1 (step S21).

[0064] Furthermore, the memory management unit 116 sets the value of the variable b to the storage real address of the second target entry (step S22).

[0065] After the process of step S22 is executed, the processes of steps S13 to S15 described above are executed.

[0066] According to the process shown in FIG. 6, when there is no free space in the main memory 113 to which the variable D is to be copied, the data stored in the main memory 113 is copied to the swap area of ​​the storage 12, thereby making it possible to copy the variable D to the memory area of ​​the main memory 113 in which the data was stored.

[0067] If it is determined in step S17 that there is no free space in the swap area (NO in step S17), the variable D cannot be copied to the main memory 113, and the process shown in FIG. 6 ends.

[0068] 7 is a flowchart showing an example of a processing procedure of the accelerator 11 operating in the CwW mode. The CwW mode is an operation mode for copying host data (write data) specified in a write command from the host 20 to the main memory 113.

[0069] First, the host interface 111 receives a write command (I / O command) from the host 20 (step S31). The write command received in step S31 includes write data and a logical address used to access the write data.

[0070] When the process of step S31 is executed, the memory management unit 116 stores the write data included in the write command received in step S31 in a variable D (step S32).

[0071] Next, the memory management unit 116 determines whether or not a calculation option is included in the metadata added to the write data (step S33).

[0072] If it is determined that the metadata added to the write data includes a calculation option (YES in step S33), the memory management unit 116 stores the virtual register number calculated based on the calculation option (content identifier) ​​in the variable num (step S34).

[0073] Next, the memory management unit 116 stores the variable D (write data) in a free area of ​​the main memory 113 (step S35). Note that, although a detailed description is omitted, in this step S35, the same process as that described in FIG. 6 is executed.

[0074] When the process of step S35 is executed, memory management unit 116 sets the virtual address indicating the memory area of ​​main memory 113 to which variable D is copied as the virtual address corresponding to variable num (the virtual address referenced by the virtual register number stored in variable num) in virtual register table 114. In other words, the leading virtual address of the copy destination of variable D is set in the virtual address field (reg[num].addr) of the variable num-th virtual register (step S36).

[0075] Furthermore, the memory management unit 116 sets the data size of the variable D as the data size corresponding to the variable num (the data size referenced by the virtual register number stored in the variable num) in the virtual register table 114. In other words, the byte length of the variable D is set in the data size field (reg[num].size) of the variable num-th virtual register (step S37).

[0076] Next, the storage interface 112 issues (transmits) the write command received in step S31 to the storage 12 (step S38).

[0077] When the process of step S38 is executed, the write data is written to the storage 12 based on the logical address included in the write command. In this case, the memory management unit 116 receives a write completion notification from the storage 12 via the storage interface 112. The memory management unit 116 transmits the received write completion notification to the host 20 (i.e., the sender of the write command) (step S39).

[0078] If it is determined in step S33 that the metadata added to the write data does not include a calculation option (NO in step S33), the processes in steps S38 and S39 are executed. In other words, if the metadata added to the write data does not include a calculation option, a copy of the write data is not stored in the main memory 113.

[0079] 7, a copy of the write data to which metadata including calculation options is added can be stored in the main memory 113 based on a write command sent from the host 20. The write data copied to the main memory 113 in this manner can be used when processing a calculation command, which will be described later.

[0080] 8 is a flowchart showing an example of a processing procedure of the accelerator 11 operating in the CoR mode. The CoR mode is an operation mode for processing a calculation command using host data (read data) specified in a read command from the host 20.

[0081] First, the processes of steps S41 to S48, which correspond to the processes of steps S1 to S8 shown in FIG. 4, are executed.

[0082] Here, the virtual register in this embodiment includes a program register. A sequence of calculation instructions (secret calculation instructions) (i.e., a program) is stored in the program register. The calculation processing unit 117 refers to the virtual register table 114 and executes the program stored in the program register (step S49). Note that executing the program in this step S49 corresponds to processing the calculation instructions using the read data.

[0083] When the processing of step S49 is executed, the processing result of step S49 (i.e., the processing result of the calculation command using the read data) is stored in the virtual address set in the virtual address field (reg[num].addr) of the variable num-th virtual register.

[0084] In this case, memory management unit 116 refers to virtual register table 114, reads data of the byte length (number of bytes) of the data size set in the data size field (reg[num].size) of the virtual register from the virtual address set in the virtual address field of the variable num-th virtual register, and copies the data to variable D (step S50).

[0085] After the process of step S50 is executed, the process of step S51, which corresponds to the process of step S9 shown in FIG. 4, is executed.

[0086] Note that the end of the program is assumed to be a Return command (Return num) with the variable num as an argument.

[0087] If it is determined in step S44 that the metadata added to the read data does not include a calculation option (NO in step S44), the process proceeds to step S51.

[0088] 8, a calculation command is processed based on a read command sent from the host 20, and the processing result is returned as read data to the host 20. In addition, a copy of the processing result of the calculation command using the read data is stored in the main memory 113.

[0089] 9 is a flowchart showing an example of a processing procedure of the accelerator 11 operating in the CoW mode. The CoW mode is an operation mode for processing a calculation command using host data (write data) specified in a write command from the host 20.

[0090] First, the processes of steps S61 to S67, which correspond to the processes of steps S31 to S37 shown in FIG. 7, are executed.

[0091] Next, the calculation processing unit 117 executes the program stored in the program register by referring to the virtual register table 114 (step S68). Note that executing the program in step S68 corresponds to processing the calculation command using the write data.

[0092] When the processing of step S68 is executed, the processing result of step S68 (i.e., the processing result of the calculation command using the write data) is stored in the virtual address set in the virtual address field (reg[num].addr) of the variable num-th virtual register.

[0093] In this case, memory management unit 116 refers to virtual register table 114, reads data of the byte length (number of bytes) of the data size set in the data size field (reg[num].size) of the virtual register from the virtual address set in the virtual address field of the variable num-th virtual register, and copies the data to variable D (step S69).

[0094] When the process of step S69 is executed, the processes of steps S70 and S71 are executed, which correspond to the processes of steps S38 and S39 shown in Fig. 7. In step S70, it is assumed that a write command including the above-mentioned variable D as write data (a write command for the variable D) is transmitted to the storage 12.

[0095] Note that the end of the program is assumed to be a Return command (Return num) with the variable num as an argument.

[0096] If it is determined in step S63 that the metadata added to the write data does not include a calculation option (NO in step S63), the processes in steps S70 and S71 are executed.

[0097] 9, a calculation command is processed based on a write command sent from the host 20, and the processing result is written as write data to the storage 12. In addition, a copy of the processing result of the calculation command using the write data is stored in the main memory 113.

[0098] Here, in the above-mentioned TFHE (Torus Fully Homomorphic Encryption), a bootstrapping process called Gate Bootstrapping, Circuit Bootstrapping, etc. for reducing noise is defined, and the bootstrapping process includes encryption key switching processes called Public Functional Key Switching and Private Functional Key Switching.

[0099] Public function key switching is, for example, a,z (1≦z≦p) is key K a p TLWE ciphertexts C a,z (1≦z≦p), the key switching key KSK[K a →K b ] to find the plaintext F(x1, x2, …, xp ) to key K b TLWE (or TRWE) ciphertext C encrypted with b This corresponds to the process of generating C b =PubKS(KSK[K a →K b ],F,C a ) and C a =(C a,1 ,C a,2 ,…,C a,p ). Furthermore, F is an arbitrary function of one variable that outputs an element of the torus polynomial ring, for example, as shown below. However, the identity function (F(x)=x) may be used as F.

number

[0100] In addition, the key change key KSK[K a →K b ] is a two-dimensional array of TLWE (or TRWE) samples, and its (i,j)th element KSK[K a →K b ][i,j](1≦i≦n,1≦j≦t) is the key K a The i-th element (plain text) of j The value divided by (plain text K a [i] / 2 j ) to key K b or the key K b It is encrypted with the public key for

[0101] Private functional key switching is a method for finding the key pairs x a,z (1≦z≦p) is key K a p TLWE ciphertexts C a,z (1≦z≦p), the key switching key KSK[K a →K b , F] to obtain the plaintext F(x1, x2, …, x p ) to key K b TLWE(TRWE) ciphertext C encrypted with b This corresponds to the process of generating C b =PrvKS(KSK[K a →Kb ,F],C a ) and C a =(C a,1 ,C a,2 ,…,C a,p ) Furthermore, F is any function of p variables that outputs elements of the above torus polynomial ring.

[0102] In addition, the key change key KSK[K a →K b ,F] is a three-dimensional array of TLWE (or TRWE) samples, and its (z,i,j)th element KSK[K a →K b ,F][z,i,j](1≦z≦p,1≦i≦n+1,1≦j≦t) is the plaintext F(0,…,0,K a [i] / 2 j ,0,…,0) as key K b or the key K b where K is the public key for a [i] / 2 j is the zth argument of the function F.

[0103] In the above-mentioned public function key switching and private function key switching, n is the key K a t is the bit length of the TLWE ciphertext C a,z is the number of digits of the binary integer value when each of the n+1 torus values ​​of is decomposed into a binary integer value of 0 or 1. a,z It is assumed that both the output of function F are 1-bit values.

[0104] Here, the plaintext x is treated as a key K a The TLWE ciphertext encrypted with a Then, using M key switching keys, a Then, the plaintext F(x) is converted into M keys K b,1 , K b,2 , … , K b,M M ciphertexts C b,1 , C b,2 , … , C b,M Assume that encryption key switching processing is performed to generate the following:

[0105] In addition, if the encryption key switching process is a public function type key switching process, the ciphertext C a From the plaintext F(x), b,1 , K b,2 , … , K b,M M ciphertexts C b,1 , C b,2 , … , C b,M To generate the M key switching keys KSK[K a →K b,1 ], KSK[K a →K b,2 ], …, KSK[K a →K b,M ], M public key switching operations are performed using PubKS(KSK[K a →K b,1 ],F,C a ), PubKS(KSK[K a →K b,2 ],F,C a ), …, PubKS(KSK[K a →K b,M ],F,C a ) is carried out.

[0106] In addition, if the encryption key switching process is a private function type key switching, the ciphertext C a From the plaintext F(x), b,1 , K b,2 , … , K b,M M ciphertexts C b,1 , C b,2 , … , C b,M To generate the M key switching keys KSK[K a →K b,1 ,F], KSK[K a →K b,2 ,F], …, KSK[K a →K b,M ,F], M private functional key switching PubKS(KSK[K a →K b,1 ,F],C a ), PubKS(KSK[K a →K b,2 ,F],C a), …, PubKS(KSK[K a →K b,M ,F],C a ) is carried out.

[0107] Note that there are M keys K b,1 , K b,2 , … , K b,M are the keys held by different users 1, 2, ..., M, and the ciphertext C b,k (1≦k≦M) Only user k has key K b,k It can be decoded using:

[0108] In multi-party computation in which encryption key switching processing is performed using M key switching keys as described above (hereinafter referred to as key switching multi-party computation), each user only needs to perform encryption and decryption once, as compared to other multi-party computations using fully homomorphic encryption. However, in key switching multi-party computation, the computation node (accelerator 11) needs to perform encryption key switching processing (public function key switching or private function key switching) the same number of times as the number of users, and the time required for this processing increases.

[0109] Therefore, in this embodiment, an accelerator 11 (controller) that reduces the time required for calculation processing such as the above-mentioned key-switching multi-party calculation will be described.

[0110] Fig. 10 shows an example of the configuration of the calculation processing unit 117 included in the accelerator 11 according to this embodiment. As shown in Fig. 10, the calculation processing unit 117 includes an input unit 117a, a duplication processing unit 117b, a plurality of processing units (a first processing unit, a second processing unit, ..., an Nth processing unit) 117c, and an output unit 117d.

[0111] The input unit 117a inputs, for example, host data and a plurality of calculation parameters specified in an I / O command received by the host interface 111. The host data is input from the storage interface 112, for example.

[0112] The duplication processor 117b obtains a plurality of host data by duplicating the host data (input data) input by the input unit 117a.

[0113] The multiple processing units 117c execute, in parallel, calculation processes using the multiple parameters input by the input unit 117a on the multiple host data acquired by the duplication processing unit 117b.

[0114] The output unit 117d outputs the results of the calculations performed by each of the processors 117c. The results of the calculations are output to the host interface 111, for example.

[0115] Here, if the number of multiple processing units 117c is N (N is an integer greater than or equal to 2) and the number of multiple calculation parameters is M (M is an integer greater than or equal to 2), the duplication processing unit 117b duplicates the host data so as to obtain the same number of host data as the calculation parameters.

[0116] Furthermore, the multiple processing units (1st to Nth processing units) 117c can execute N calculation processes in parallel per round, and for example, calculation processes using M calculation parameters (i.e., M calculation processes) can be executed in a calculation processing time of ceil(M / N) rounds.

[0117] In addition, although it has been described here that the host data is input from the storage interface 112, the host data may be input from the host interface 111. In addition, it has been described here that the results of the calculation processing in each of the multiple processing units 117c are output to the host interface 111, but the results of the calculation processing may be output to the storage interface 112.

[0118] FIG. 10 simply describes a configuration in which a plurality of calculation processes using a plurality of parameters are executed in parallel by a plurality of processing units 117c. However, when considering the execution of the above-mentioned encryption key switching process (key switching type multi-party computation), as shown in FIG. 11, calculation processing unit 117 may be configured to include a plurality of key switching processing units (first key switching processing unit, second key switching processing unit, ..., Nth key switching processing unit) 117c as the plurality of processing units 117c.

[0119] In this case, the input unit 117a receives, as the host data, for example, ciphertext C a The input unit 117a inputs, as M calculation parameters, different key switching keys KSK[K a →K b,1 ], KSK[K a →K b,2 ], …, KSK[K a →K b,M ].

[0120] In addition, the duplication processing unit 117b duplications the ciphertext C a (Input ciphertext) is replicated to generate M ciphertexts C a Get the.

[0121] The multiple key switching processing units 117c convert M ciphertexts C a For the key switching key KSK[K a →K b,1 ], KSK[K a →K b,2 ], …, KSK[K a →K b,M In other words, each of the multiple key switching processors 117c executes encryption key switching processing using a key switching key corresponding to that key switching processor 117c.

[0122] The output unit 117d outputs the ciphertext C b,1 (=PubKS(KSK[K a →K b,1 ],F,Ca )), C b,2 (=PubKS(KSK[K a →K b,2 ],F,C a )), …, C b,M (=PubKS(KSK[K a →K b,M ],F,C a )).

[0123] Here, it has been described that the encryption key switching process is performed using a public function. However, when the encryption key switching process is performed using a private function, the above M calculation parameters are the key switching key KSK[K a →K b,1 ,F], KSK[K a →K b,2 ,F], …, KSK[K a →K b,M , F], and the multiple key switching units 117c a For the key changeover key KSK[K a →K b,1 ,F], KSK[K a →K b,2 ,F], …, KSK[K a →K b,M , F] (private function type key switching). In this case, the output unit 117d outputs the ciphertext C b,1 (=PrvKS(KSK[K a →K b,1 ,F],C a )), C b,2 (=PrvKS(KSK[K a →K b,2 ,F],C a )), …, C b,M (=PrvKS(KSK[K a →K b,M ,F],C a )).

[0124] In addition, in FIG. 11, it has been described that the encryption key switching process is executed in the calculation processing unit 117. However, when the bootstrapping process is executed in the calculation processing unit 117, as shown in FIG. 12, the calculation processing unit 117 may be configured to further include an FHE processing unit 117e.

[0125] In this case, the input unit 117a receives the ciphertext C a In addition to the above, the input unit 117a further inputs a bootstrapping key. The FHE processing unit 117e uses the bootstrapping key input by the input unit 117a to convert the ciphertext C a The duplication processing unit 117b obtains a plurality of bootstrapping process results by duplicating the results of the bootstrapping process. The plurality of key switching processing units 117c execute encryption key switching processing using a key switching key for the plurality of bootstrapping process results. The output unit 117d outputs the encryption key switching process results in each of the plurality of key switching processing units 117c.

[0126] According to the configuration shown in FIG. 12, prior to the processing (duplication processing) of the duplication processing unit 117b and the processing (encryption key switching processing) of the multiple key switching processing units 117c, noise in the ciphertext Ca (input ciphertext) can be reduced by a bootstrapping process.

[0127] The above-described FHE processing unit 117e may be configured to perform, for example, a homomorphic computation (secure computation) on the ciphertext Ca, and perform a bootstrapping process on the result of the homomorphic computation.

[0128] Although it is assumed that each of the units 117a to 117e shown in the above-mentioned Figures 10 to 12 is realized, for example, by hardware, at least a part of each of the units 117a to 117e may be realized by a processor provided in the accelerator 11 executing a predetermined program (i.e., software).

[0129] 10 to 12 correspond to the process executed in step S49 shown in FIG. 8 or step S68 shown in FIG.

[0130] 10, for example, a configuration is assumed in which the calculation processing unit 117 provided in one accelerator 11 includes multiple processing units (first processing unit, second processing unit, ..., Nth processing unit) 117c, but the multiple processing units 117c may be distributed and arranged in multiple accelerators connected via a network. In such a configuration, the multiple accelerators work in cooperation with each other, so that the multiple processing units arranged in each of the multiple accelerators can execute calculation processes in parallel. Here, the multiple processing units 117c shown in FIG. 10 have been described, but the same applies to the multiple key switching processing units (first key switching processing unit, second key switching processing unit, ..., Nth key switching processing unit) 117c shown in FIG. 11 and FIG. 12.

[0131] As described above, the virtual register number in the virtual register table 114 is calculated from the content identifier included in the calculation option associated with the host data, and an example of a method for calculating the virtual register number will be described with reference to Fig. 13. The virtual registers in this embodiment include a program register, a LUK register, a BK register, a BKNTT register, a PubKSK register, a PrvKSK register, a TLWE ciphertext register, and a TRGSW ciphertext register.

[0132] The program register stores a program (a sequence of calculation instructions). The LUT register stores a test vector for the TFHE. The test vector (LUT) stored in the LUT register corresponds to, for example, a coefficient for a predetermined function (polynomial).

[0133] The BK register stores a bootstrapping key of the TFHE. The bootstrapping key stored in the BK register is used in Gate Bootstrapping (GBS) of the TFHE, etc. The bootstrapping key may be used, for example, in Programmable Bootstrapping (PBS). PBS is a bootstrapping method in which an input TLWE sample (ciphertext) is homomorphically evaluated by a predetermined function, and the resulting TLWE sample is output after reducing its noise to the noise level of a fresh sample.

[0134] The BKNTT register stores the TFHE bootstrapping key that has undergone number theoretic transformation processing.

[0135] The PubKSK register and the PrvKSK register store a key switching key of the TFHE. Specifically, the PubKSK register stores a key switching key used in public function type key switching. The PrvKSK register stores a key switching key used in private function type key switching. The key switching keys stored in the PubKSK register and the PrvKSK register are usually used in post-processing of the above-mentioned GBS or PBS (i.e., bootstrapping processing).

[0136] TLWE samples are stored in the TLWE ciphertext registers. There are two types of TLWE ciphertext registers: TLWE-CoR (CoR register) and TLWE-CoW (CoW register).

[0137] The TRGSW sample is stored in the TRGSW ciphertext register. There are two types of TRGSW ciphertext registers: TRGSW-CoR (CoR register) and TRGSW-CoW (CoW register).

[0138] In FIG. 13, for example, if Type is 0, KeyID is 0, and DataID is 0, the virtual register number "0" is calculated from the Type, KeyID, and DataID (i.e., the content identifier), indicating that the virtual register is a program register.

[0139] Also, in FIG. 13, for example, if Type is 0, KeyID is 0, and DataID is x, the virtual register number "1+x" is calculated from the Type, KeyID, and DataID (i.e., the content identifier), indicating that the virtual register is a LUT register.

[0140] In addition, in FIG. 13, for example, when Type is 2, KeyID is k, and DataID is y, the virtual register number “1+N LUT "+4k+y" is calculated, and it is indicated that the virtual register is the BK register, the BKNTT register, the PubKSK register, or the PrvKSK register. Note that when y=0, the virtual register is the BK register, when y=1, the virtual register is the BKNTT register, when y=2, the virtual register is the PubKSK register, and when y=3, the virtual register is the PrvKSK register.

[0141] In addition, in FIG. 13, for example, when Type is 3 or 4, KeyID is k, and DataID is z, the virtual register number “1+N LUT +4N key +k(N TLWE +N TRGSW )+z" is calculated and it is shown that the virtual register is the TLWE ciphertext register.

[0142] In addition, in FIG. 13, for example, when Type is 5 or 6, KeyID is k, and DataID is z, the virtual register number “1+N LUT +4N key +k(N TLWE +N TRGSW )+N TLWE +z" is calculated, indicating that the virtual register is the TRGSW ciphertext register.

[0143] Note that x is 0 or more and N LUT It assumes an integer less than (0≦x <N LUT ) y is assumed to be an integer between 0 and 3 (0≦y≦3). k is assumed to be an integer between 0 and N key We assume that integers less than 0 are <N key ) z is 0 or more and N TLWE We assume integers less than z <N TLWE ).

[0144] N LUT is the maximum number of LUT registers. key N is the maximum number of BK registers, BKNTT registers, PubKSK registers, and PrvKSK registers. TLWE N is the total number of TLWE ciphertext registers per BK or BKNTT register. TRGSW is the total number of TRGSW ciphertext registers per BK or BKNTT register.

[0145] Note that, although the accelerator 11 according to the present embodiment has been described as operating in each of the CwR mode, the CwW mode, the CoR mode, and the CoW mode, the operation mode of the accelerator 11 is specified in the calculation options.

[0146] Specifically, when a read command is received from the host 20, if the Type of the calculation option associated with the read data is TLWE-CoW, the operation mode of the accelerator 11 becomes the CwR mode.

[0147] Furthermore, when a write command is received from the host 20, if the Type of the calculation option accompanying the write data is TLWE-CoR, the operation mode of the accelerator 11 becomes the CwW mode.

[0148] Furthermore, when a read command is received from the host 20, if the Type of the calculation option accompanying the read data is TLWE-CoR, the operation mode of the accelerator 11 becomes the CoR mode.

[0149] Furthermore, when a write command is received from the host 20, if the Type of the calculation option accompanying the write data is TLWE-CoW, the operation mode of the accelerator 11 becomes the CoW mode.

[0150] The computation command in this embodiment will be specifically described below. An example of the computation command in this embodiment is a secure computation command.

[0151] Fig. 14 shows an example of an instruction set of secure computation instructions used by the accelerator 11 according to this embodiment. In the example shown in Fig. 14, the instruction set of secure computation instructions includes a Return instruction, a Move instruction, a Push instruction, a Pop instruction, a Bootstrap instruction, an Add instruction, a Sub instruction, an IntMult instruction, a PubKS instruction, and a PrvKS instruction, which are indicated by command types 0 to 9. In Fig. 14, for the sake of convenience, a virtual register number for referencing a ciphertext register is indicated as a ciphertext register number, and a virtual register number for referencing a LUT register is indicated as a LUT register number.

[0152] The Return command takes the ciphertext register number num as an argument. According to the Return command, the value of the ciphertext register referenced by the ciphertext register number num is sent to the host 20 or the storage 12. Note that the value of the ciphertext register is sent to the host 20 if the ciphertext register is a CoR register, and is sent to the storage 12 if the ciphertext register is a CoW register. After the value of the ciphertext register is sent, a stack pointer for managing the reference position of the stack area included in the virtual address space is set to 0.

[0153] The Move instruction takes ciphertext register numbers num1 and num2 as arguments, and causes the value of the ciphertext register referenced by ciphertext register number num1 to be copied to the ciphertext register referenced by ciphertext register number num2.

[0154] The push instruction takes the ciphertext register number num as an argument. According to the push instruction, the value of the ciphertext register referenced by the ciphertext register number num is copied to the top of the stack area included in the virtual address space, and the stack pointer is decremented (1 is subtracted from the value of the stack pointer).

[0155] The Pop instruction takes the ciphertext register number num as an argument. According to the Pop instruction, the top value of the stack area included in the virtual address space is copied to the ciphertext register referenced by the ciphertext register number num, and the stack pointer is incremented (1 is added to the value of the stack pointer).

[0156] The Bootstrap instruction takes an LUT register number num1 and a ciphertext register number num2 as arguments. According to the Bootstrap instruction, the LUT register referenced by the LUT register number num1 is used to execute GBS or PBS on the value of the ciphertext register referenced by the ciphertext register number num2. When the LUT register number num1=0, the GBS is executed, and when the LUT register number num1>0, the PBS is executed. The execution result (output value) of the GBS or PBS is copied to the ciphertext register referenced by the ciphertext register number num2. For example, if the value of the LUT register referenced by the LUT register number num1 is the LUT for the function f(x), and the value of the ciphertext register referenced by the ciphertext register number num2 before the Bootstrap instruction is executed is the TLWE sample for x, then the value of the ciphertext register referenced by the ciphertext register number num2 after the Bootstrap instruction is executed is the TLWE sample for f(x).

[0157] The Add instruction takes ciphertext register numbers num1 and num2 as arguments. According to the Add instruction, the value of the ciphertext register referenced by ciphertext register number num1 and the value of the ciphertext register referenced by ciphertext register number num2 are added component by component, and the result of the addition (calculation result) is copied to the ciphertext register referenced by ciphertext register number num1.

[0158] The Sub instruction takes ciphertext register numbers num1 and num2 as arguments. According to the Sub instruction, the value of the ciphertext register referenced by ciphertext register number num2 is subtracted from the value of the ciphertext register referenced by ciphertext register number num1 for each component, and the result of the subtraction (calculation result) is copied to the ciphertext register referenced by ciphertext register number num1.

[0159] The IntMult instruction takes a ciphertext register number num and an integer value val as arguments. The IntMult instruction multiplies the value of the ciphertext register referenced by the ciphertext register number num by the integer value val for each component, and copies the multiplication result (calculation result) to the ciphertext register referenced by the ciphertext register number num.

[0160] The PubKS instruction takes ciphertext register numbers num1 and num2 and key switching key number num3 as arguments. The key switching key number in the PubKS instruction is a virtual register number for referencing the PubKSK register. According to the PubKS instruction, public function type key switching is performed on the value of the ciphertext register referenced by the ciphertext register number num1 (i.e., the ciphertext) using the key switching key stored in the PubKSK register referenced by the key switching key number num3, and the ciphertext after applying the public function type key switching is stored in the ciphertext register referenced by the ciphertext register number num2. The function in the PubKS instruction is, for example, an identity function (f(x)=x).

[0161] The PrvKS instruction takes ciphertext register numbers num1 and num2 and key switching key number num3 as arguments. The key switching key number in the PrvKS instruction is a virtual register number for referencing the PrvKSK register. According to the PrvKS instruction, private functional key switching is performed on the value of the ciphertext register referenced by the ciphertext register number num1 (i.e., the ciphertext) using the key switching key stored in the PrvKSK register referenced by the key switching key number num3, and the ciphertext after the private functional key switching is applied is stored in the ciphertext register referenced by the ciphertext register number num2. The PrvKSK register referenced by the key switching key number num3 stores k+1 key switching keys for Public Functional Key Switching as one key switching key for Private Functional Key Switching. Specifically, the key switching key stored in the PrvKSK register is calculated by applying the function (f_u(x)=-Ku*x if u≦k, otherwise f_{u}(x)=1*x if u=k+1) to x=k_i / 2 for each k+1 TLWE (or TRWE) samples. j (1≦i≦n+1, 1≦j≦t). When k=1, two are counted as one private function type key changeover key (PrvKSK).

[0162] In multi-party computation (key switching multi-party computation), there may be multiple PubKSK registers and PrvKSK registers per ciphertext register. For this reason, the third argument of the PubKS instruction and the PrvKS instruction specifies the key switching key number (virtual register number) for referencing the PubKSK register and the PrvKSK register to be used.

[0163] Next, FIG. 15 shows an example of a secure computation program (a program using an instruction set of secure computation instructions) stored in a program register. In FIG. 15, the secure computation instructions and arguments of the secure computation instructions are arranged in the order in which the secure computation instructions are executed. Also, in FIG. 15, a virtual register number (e.g., a ciphertext register) is represented by the sum of an offset (o1, o2, o3, o4, o5) and a DataID value (0, 1, 2). That is, in each secure computation instruction, the result of calculating the sum of the offset and the DataID value is specified as the virtual register number. Also, k1 to k3 in FIG. 15 are key switching key numbers.

[0164] In the example shown in Figure 15, after the Bootstrap instruction is executed, three PubKS instructions specifying different key switching keys are executed on the value of the ciphertext register referenced by ciphertext register number o2+0, and finally the value of the ciphertext register referenced by ciphertext register number o2+0 is returned.

[0165] Specifically, according to "bootstrap o1+1,o2+0", the result of the bootstrapping process is stored in the ciphertext register referenced by ciphertext register number o2+0. According to "pubks o2+0,o3+0,k1", PubKS is executed using the value of the PubKSK register referenced by key switching key number k1 for the value of the ciphertext register referenced by ciphertext register number o2+0, and the result of the PubKS is stored in the ciphertext register referenced by ciphertext register number o3+0. According to "pubks o2+0,o4+0,k2", PubKS is executed using the value of the PubKSK register referenced by key switching key number k2 for the value of the ciphertext register referenced by ciphertext register number o2+0, and the result of the PubKS is stored in the ciphertext register referenced by ciphertext register number o4+0. According to "pubks o2+0,o5+0,k3", PubKS is executed using the value of the PubKSK register referenced by key switching key number k3 on the value of the ciphertext register referenced by ciphertext register number o2+0, and the result of the PubKS is stored in the ciphertext register referenced by ciphertext register number o5+0. According to "return o2+0", the value of the ciphertext register referenced by ciphertext register number o2+0 (i.e., the result of the bootstrapping process) is returned.

[0166] In addition, o1, o2, o3, o4, and o5 in the secure computation program shown in FIG. 15 are offsets to the LUT register number and the TLWE ciphertext register number, respectively, and are calculated as follows. o1=1 o2=1+N LUT +4N key +k(N TLWE +N TRGSW ) o3=1+N LUT +4N key +(k+1)(N TLWE +N TRGSW ) o4=1+N LUT +4N key +(k+2)(NTLWE +N TRGSW ) o5=1+N LUT +4N key +(k+3)(N TLWE +N TRGSW )

[0167] Also, the key changeover key numbers k1 to k3 used in the third argument of the PubKS command are calculated as follows, where y=2. k1=1+N LUT +4(k+1)+y k2=1+N LUT +4(k+2)+y k3=1+N LUT +4(k+3)+y

[0168] In this embodiment, the three PubKS instructions in the secure computation program shown in Fig. 15 can be processed in parallel by, for example, three (for example, the first to third key switching processors 117c) of the multiple key switching processors (first to Nth key switching processors) 117c shown in Fig. 12. At this time, the input ciphertext, the bootstrapping key, and the three key switching keys (PubKSK) are loaded into a predetermined virtual register in either the CwR mode (step S6 shown in Fig. 5) or the CwW mode (step S35 shown in Fig. 8) before the secure computation program shown in Fig. 15 is executed.

[0169] Next, Figures 16 to 18 show an example of a secure computation program that is executed subsequently to the execution of the secure computation program shown in Figure 15. Note that Figures 16 to 18 are intended to be executed in the order of the secure computation program (secure computation command) shown in Figure 16, the secure computation program (secure computation command) shown in Figure 17, and the secure computation program (secure computation command) shown in Figure 18, after the secure computation program shown in Figure 15 is executed.

[0170] As shown in Figs. 16 to 18, each of the secure computation programs shown in Figs. 16 to 18 includes only a Return instruction. According to "rerurn o3+0" shown in Fig. 16, the value of the ciphertext register referenced by ciphertext register number o3+0 (i.e., the result of the first PubKS) is returned. According to "rerurn o4+0" shown in Fig. 17, the value of the ciphertext register referenced by ciphertext register number o4+0 (i.e., the result of the second PubKS) is returned. According to "rerurn o5+0" shown in Fig. 18, the value of the ciphertext register referenced by ciphertext register number o5+0 (i.e., the result of the third PubKS) is returned.

[0171] That is, according to the example shown in FIGS. 16 to 18, the result of PubKS calculated by three PubKS commands in the secure computation program shown in FIG. 15 is returned.

[0172] 15 to 18 may be executed in the CoR mode (step S49 shown in FIG. 8) or in the CoW mode (step S68 shown in FIG. 9). This secure computation program is loaded into the program register in either the CwR mode (step S6 shown in FIG. 5) or the CwW mode (step S35 shown in FIG. 8) immediately before the secure computation program is executed.

[0173] Here, Fig. 19 shows another example of a secure computation program stored in the program register. Here, the differences from Fig. 15 above will be mainly explained.

[0174] In the example shown in Figure 19, after the Bootstrap instruction is executed, three PrvKS instructions specifying different key switching keys are executed on the value of the ciphertext register referenced by ciphertext register number o2+0, and finally the value of the ciphertext register referenced by ciphertext register number o2+0 is returned.

[0175] Specifically, according to "bootstrap o1+1,o2+0", the result of the bootstrapping process is stored in the ciphertext register referenced by ciphertext register number o2+0. According to "prvks o2+0,o3+0,k1", PrvKS is executed using the value of the PrvKSK register referenced by key switching key number k1 for the value of the ciphertext register referenced by ciphertext register number o2+0, and the result of the PrvKS is stored in the ciphertext register referenced by ciphertext register number o3+0. According to "prvks o2+0,o4+0,k2", PrvKS is executed using the value of the PrvKSK register referenced by key switching key number k2 for the value of the ciphertext register referenced by ciphertext register number o2+0, and the result of the PrvKS is stored in the ciphertext register referenced by ciphertext register number o4+0. According to "prvks o2+0,o5+0,k3", PrvKS is executed using the value of the PrvKSK register referenced by key switching key number k3 on the value of the ciphertext register referenced by ciphertext register number o2+0, and the result of the PrvKS is stored in the ciphertext register referenced by ciphertext register number o5+0. According to "return o2+0", the value of the ciphertext register referenced by ciphertext register number o2+0 (i.e., the result of the bootstrapping process) is returned.

[0176] In addition, o1, o2, o3, o4, and o5 in the secure computation program shown in FIG. 19 are offsets to the LUT register number and the TRGSW ciphertext register number, respectively, and are calculated as follows. o1=1 o2=1+N LUT +4N key +k(N TLWE +N TRGSW )+N TLWE o3=1+N LUT +4N key +(k+1)(N TLWE +N TRGSW )+N TLWE o4=1+N LUT+4N key +(k+1)(N TLWE +N TRGSW )+N TLWE o5=1+N LUT +4N key +(k+1)(N TLWE +N TRGSW )+N TLWE

[0177] Also, the key switching key numbers k1 to k3 used in the third argument of the PrvKS command are calculated as follows, where y=3. k1=1+N LUT +4(k+1)+y k2=1+N LUT +4(k+2)+y k3=1+N LUT +4(k+3)+y

[0178] In this embodiment, the three PrvKS instructions in the secure computation program shown in Fig. 19 can be processed in parallel by, for example, three (for example, the first to third key switching processors 117c) of the multiple key switching processors (first to Nth key switching processors) 117c shown in Fig. 12. At this time, the input ciphertext, the bootstrapping key, and the three key switching keys (PrvKSK) are loaded into a predetermined virtual register in either the CwR mode (step S6 shown in Fig. 5) or the CwW mode (step S35 shown in Fig. 8) before the secure computation program shown in Fig. 19 is executed.

[0179] Although detailed description will be omitted, after the secure computation program shown in FIG. 19 is executed, the secure computation programs shown in the above-mentioned FIGS. 16 to 18 may be executed subsequently.

[0180] As described above, the accelerator 11 according to this embodiment corresponds to a controller that controls the CSD 10 (a computing storage device including the storage 12) connectable to the host 20, and includes a host interface 111 (first interface) that receives an I / O command specifying host data (first host data) from the host 20, a storage interface 112 (second interface) that transmits and receives the host data between the host 20 and the storage 12, and a calculation processing unit 117. In this embodiment, the calculation processing unit 117 inputs host data (input data) and a plurality of calculation parameters, acquires a plurality of host data by replicating the host data, executes calculation processing using the plurality of parameters in parallel on the acquired plurality of host data, and outputs the calculation processing results.

[0181] Specifically, in this embodiment, for example, the host data includes a fully homomorphic encrypted ciphertext, each of the multiple computation parameters includes a different key switching key, and each of the multiple processing units 117c executes an encryption key switching process using the key switching key corresponding to that processing unit 117c.

[0182] In this embodiment, with the above-described configuration, even when it is necessary to execute multiple computation processes (encryption key switching processes) using multiple computation parameters (key switching keys) in the accelerator 11 (computation processing unit 117), for example, as in key switching multi-party computation, it is possible to reduce the time required for the computation processes by executing the multiple computation processes in parallel.

[0183] In this embodiment, the calculation processing unit 117 may further include an FHE processing unit 117e that executes a bootstrapping process on a ciphertext of the fully homomorphic encryption using a bootstrapping key input by the input unit 117a. In such a configuration, the result of the bootstrapping process is duplicated to obtain a plurality of results of the bootstrapping process, and an encryption key switching process is executed for each of the results of the plurality of bootstrapping processes. Furthermore, the FHE processing unit 117e may be configured to execute a homomorphic operation (secret calculation) on the ciphertext of the fully homomorphic encryption, and execute a bootstrapping process on the result of the homomorphic operation.

[0184] In this embodiment, it has been described that a plurality of calculation processes (encryption key switching processes) are executed using a plurality of calculation parameters (key switching keys). The plurality of calculation parameters correspond, for example, to a plurality of users, and the calculation process results in each of the plurality of processing units 117c are output to the host 20 used by the user corresponding to the calculation parameters used in that processing unit.

[0185] Specifically, according to the accelerator 11 of this embodiment, for example, when a write command for writing data to the storage 12 is received by the host interface 111, an encryption key switching process using a key switching key (computation parameters) for the data (ciphertext encrypted using the key of a specified user who uses the host 20) is executed in the calculation processing unit 117, and the ciphertext (fully homomorphic encryption ciphertext) that is the result of the encryption key switching process is written to the storage 12.

[0186] On the other hand, for example, when a read command for reading data from the storage 12 is received by the host interface 111, data specified in the read command is read from the storage 12 and input to the calculation processing unit 117. The data (read data) thus read from the storage 12 and input to the calculation processing unit 117 is a ciphertext of the fully homomorphic encryption. The ciphertext thus input to the calculation processing unit 117 is replicated in the calculation processing unit 117 (replication processing unit 117b), and encryption key switching processes using each of a plurality of key switching keys (calculation parameters) corresponding to a plurality of users are executed in parallel by a plurality of key switching processing units 117c. The result of the encryption key switching process using the plurality of key switching keys corresponding to the plurality of users is returned to the host 20 as a response to the read command, and the host 20 transmits the result of the encryption key switching process corresponding to each user to each user. In this case, each of the plurality of users can decrypt the ciphertext that is the result of the encryption key switching process returned to the host 20 using the key of the user.

[0187] With this configuration, it is possible to realize the accelerator 11 that reduces the time required for key switching type multi-party computation (that is, speeds up multiple key switching processes).

[0188] Here, the encryption key switching process is mainly executed in parallel when a read command is received by the host interface 111, and the result of the encryption key switching process is returned to the host 20. However, the accelerator 11 according to this embodiment may also be configured such that, for example, when a write command is received by the host interface 111, the encryption key switching process is executed in parallel, and the result of the encryption key switching process is written to the storage 12.

[0189] In addition, the host 20 in this embodiment may be realized, for example, by one information processing device used by multiple users, or may be realized, for example, by multiple information processing devices connected to the CSD 10 via a network.

[0190] In this embodiment, the storage 12 provided in the CSD 10 is assumed to be an SSD (Solid State Drive) 120 having a NAND type flash memory 121 as a non-volatile memory as shown in FIG. 20. In this case, the CSD 10 is configured to be connectable to the host 20 via a system bus such as a PCIe (Peripheral Component Interconnect Express) bus. In addition, for example, NVMe (Non-Volatile Memory Express) is adopted as a communication protocol between the CSD 10 and the host 20. In other words, the CSD 10 (host interface 111) is configured to be connectable to the host 20 (to execute communication with the host 20) based on the NVMe standard. In this case, the host 20 has a device called a Root Complex having a PCIe port in addition to a CPU, RAM, etc. In addition, the host interface 111 and the storage interface 112 provided in the accelerator 11 have a PCIe interface (I / F) that executes processing according to the PCIe standard and an NVMe processing unit that executes processing according to the NVMe standard. In this case, the I / O commands (read command and write command) described in this embodiment correspond to commands conforming to the NVMe standard (NVMeRead command and NVMeWrite command). Also, the host data and metadata added to the host data described in this embodiment correspond to NVMe data and NVMe metadata.

[0191] The SSD 120 includes an SSD controller 122 that controls the NAND flash memory 121 in addition to the NAND flash memory 121. The SSD controller 122 includes a NAND control unit 122a that issues read and write commands to the NAND flash memory 121 via the NAND interface based on requests received from the storage interface 112. The NAND control unit 122a also issues read, write, and erase commands to the NAND flash memory 121 via the NAND interface in background processing, regardless of requests received via the storage interface 112. The NAND control unit 122a also manages data storage areas in the NAND flash memory 121 as physical addresses, and associates logical addresses with physical addresses using an address conversion table.

[0192] In addition, while FIG. 20 assumes that the SSD controller 122 is located inside the SSD 120 (i.e., the accelerator 11 is outside the SSD controller 122), the accelerator 11 in this embodiment may also be located inside the SSD controller 122.

[0193] FIG. 21 shows an example of a configuration in which the accelerator 11 is disposed inside the SSD controller 122. According to the example shown in FIG. 21, the SSD 120 includes a NAND type flash memory 121 and an SSD controller 122. The SSD controller 122 includes the accelerator 11 and an SSD controller 122b in addition to the NAND controller 122a. It is assumed that the NAND controller 122a and the SSD controller 122b are realized by hardware, for example, but at least a part of the NAND controller 122a and the SSD controller 122b may be realized by a processor included in the SSD controller 122 executing a predetermined program (i.e., software). The SSD controller 122b has a function of controlling the operation of the SSD 120. The SSD 120 in the example shown in FIG. 21 corresponds to the CSD 10 described in this embodiment. In the configuration shown in FIG. 21, the SSD 120 may be called a memory system, and the SSD controller 122 may be called a memory controller.

[0194] Furthermore, as shown in FIG. 22, the CSD 10 may be configured to be connectable to the host 20 via a network 30. In this case, for example, NVMe-oF (NVMe over Fabric) is used as a communication protocol between the CSD 10 and the host 20, and the accelerator 11 is disposed inside the NVMe-oF target module of the CSD 10. In other words, the accelerator 11 is configured to be connectable to the host 20 via the network 30 in compliance with the NVMe-oF standard. In the example shown in FIG. 22, the host interface 111 provided in the accelerator 11 has a NIC (Network Interface Card) and an NVMe-oF processing unit that executes processing in accordance with the NVMe-oF standard. In the example shown in FIG. 22, the storage 12 has a plurality of SSDs 120, and the storage interface 112 has a PCIe switch that executes switching for the plurality of SSDs 120.

[0195] 20 to 22 are provided to explain application examples of the accelerator 11 according to this embodiment, and therefore the configurations shown in FIGS. 20 to 22 may be modified as appropriate.

[0196] In addition, in this embodiment, the accelerator 11 (controller) and the storage 12 are described as constituting one device (computing storage device), but the controller and the storage may be configured to be arranged as separate devices.

[0197] Although some embodiments of the present invention have been described, these embodiments are presented as examples and are not intended to limit the scope of the invention. These embodiments can be implemented in various other forms, and various omissions, substitutions, and modifications can be made without departing from the spirit of the invention. These embodiments and their modifications are included in the scope of the invention and its equivalents described in the claims, as well as in the scope and spirit of the invention. [Explanation of symbols]

[0198] 10...CSD (computing storage), 11...accelerator (controller), 12...storage, 20...host, 30...network, 111...host interface (first interface), 112...storage interface (second interface), 113...main memory (memory), 114...virtual register table, 115...page table, 116...memory management unit, 117...calculation processing unit, 117a...input unit, 117b...replica- tion processing unit, 117c...processing unit, key switching processing unit (first processing unit), 117d...output unit, 117e...FHE processing unit (second processing unit), 120...SSD, 121...NAND flash memory (non-volatile memory), 122...SSD controller.

Claims

1. A controller for controlling a computing storage device connectable to a host and including a storage, comprising: a first interface for receiving an I / O command from the host specifying first host data; a second interface for transmitting and receiving the first host data to and from the storage; A calculation processing unit Equipped with The calculation processing unit is an input unit for inputting the first host data and a plurality of calculation parameters; a duplication processing unit that obtains a plurality of first host data by duplication of the first host data; a plurality of first processing units that execute, in parallel, calculation processes using the input plurality of parameters on the acquired plurality of first host data; an output unit that outputs a calculation processing result in each of the plurality of first processing units; Includes controller.

2. the first host data includes a fully homomorphic encrypted ciphertext; each of the plurality of computation parameters includes a different key-switching key; Each of the first processing units executes a key switching process using a key switching key corresponding to the first processing unit. The controller of claim 1 .

3. Further comprising a second processing unit, The input unit further inputs a bootstrapping key used in a bootstrapping process, The second processing unit performs a bootstrapping process on the ciphertext of the fully homomorphic encryption by using the input bootstrapping key, the duplication processing unit obtains a plurality of results of the bootstrapping process by duplicating the results of the bootstrapping process; Each of the first processing units executes a key switching process using a key switching key corresponding to the first processing unit on the results of the bootstrapping processes. The controller of claim 2.

4. The controller according to claim 3 , wherein the second processing unit performs a homomorphic operation on a ciphertext of the fully homomorphic encryption, and performs a bootstrapping process on a result of the homomorphic operation.

5. The first interface is connectable to the host based on the NVMe standard; The I / O command is a command that complies with the NVMe standard. A controller according to any one of claims 1 to 4.

6. The computation is performed according to computation options associated with the I / O command; The computation option is included in metadata added to the first host data. The controller of claim 5.

7. the storage is a non-volatile memory; The controller is coupled to the non-volatile memory and configured to control the non-volatile memory. A controller according to any one of claims 1 to 4.

8. The controller of claim 7 , wherein the computing storage device is a solid state drive (SSD).

9. The controller according to any one of claims 1 to 4, wherein the controller is connectable to the host via a network in compliance with the NVMe-oF standard.

10. the computing storage device comprises an NVMe-oF target module; The controller is disposed within the NVMe-oF target module.

10. The controller of claim 9.

Images