Processing element, its control method and control program, and processing apparatus

Abstract

The present invention improves processing for repeatedly calculating a hash function. This processing element comprises: an ME computation unit (30) that repeatedly performs loop processing on a message block to decompress the message block into a plurality of words; and an MC computation unit (31) that repeatedly performs loop processing on the decomposed plurality of words to compress the words into an intermediate hash value. The ME computation unit (30) and the MC computation unit (31) execute one loop processing of the ME computation unit (30) and a part of one loop processing of the MC computation unit (31) in parallel. The MC computation unit (31) executes the remaining processing not executed in parallel out of the one loop processing of the MC computation unit (31) using words computed by the one loop processing of the ME computation unit (30).

Description

Technical Field

[0001] The present invention relates to a processing element that calculates an intermediate hash value from a message block of a predetermined bit length, a control method and a control program therefor, and a processing device.

Background Art

[0002] The blockchain technology is used, for example, to secure decentralized cryptocurrencies such as Bitcoin, Ripple, and Ethereum. Furthermore, recently, the use of blockchain has been widely studied in various fields such as autonomous driving, smart healthcare systems, robotics, and supply chains.

[0003] The current problem in blockchain is that the power consumption is large. This is because it is necessary to repeatedly calculate hash functions (such as SHA-256 and SHA-512).

[0004] On the other hand, the Bitcoin mining accelerator described in Patent Document 1 has a hardware circuit optimized for loop processing in the message compression (MC) process of SHA-256. In addition, the processing system described in Patent Document 2 optimizes the loop processing of SHA-256 in Bitcoin mining using clock gating and hardwiring.

Prior Art Documents

Patent Documents

[0005]

Patent Document 1

Patent Document 2

Summary of the Invention

Problems to be Solved by the Invention

[0006] However, there is still room for improvement in the process of repeatedly calculating the hash function.

[0007] One aspect of the present invention aims to provide a processing element or the like in which the above processing is improved.

Means for Solving the Problems

[0008] In order to solve the above problems, a processing element according to one aspect of the present invention is a processing element that calculates an intermediate hash value from a message block of a predetermined bit length, and repeatedly performs a loop process on the message block to expand it into a bit sequence longer than the bit length, and a compression unit that repeatedly performs a loop process on the expanded bit sequence and compresses it into the intermediate hash value. The expansion unit and the compression unit execute one loop process of the expansion unit and a part of one loop process of the compression unit in parallel, and the compression unit uses the word calculated by one loop process of the expansion unit to execute the remaining processes of one loop process of the compression unit that are not executed in parallel.

[0009] A processing apparatus according to another aspect of the present invention includes a plurality of processing elements having the above configuration, and further includes a control unit that controls the plurality of processing elements.

[0010] A control method for a processing element according to another aspect of the present invention is a control method for a processing element that calculates an intermediate hash value from a message block of a predetermined bit length, and includes a step of repeatedly performing a loop process on the message block to expand it into a bit sequence longer than the bit length, and a compression unit that repeatedly performs a loop process on the expanded bit sequence and compresses it into the intermediate hash value. The method includes a step of causing the expansion unit and the compression unit to execute one loop process of the expansion unit and a part of one loop process of the compression unit in parallel, and a step of causing the compression unit to execute the remaining processes of one loop process of the compression unit that are not executed in parallel using the word calculated by one loop process of the expansion unit. [Effect of the Invention]

[0011] According to one aspect of the present invention, the process of repeatedly calculating a hash function can be improved. [Brief Description of the Drawings]

[0012]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Figure 7

Figure 8

Figure 9

Figure 10

Figure 11

Figure 12

Figure 13

Best Mode for Carrying Out the Invention

[0013] Hereinafter, embodiments of the present invention will be described in detail. For convenience of explanation, members having the same functions as those shown in each embodiment are denoted by the same reference numerals, and the description thereof will be omitted as appropriate.

[0014] 〔Embodiment 1〕 An embodiment of the present invention will be described with reference to FIGS. 1 to 9. The hash value calculation device of the present embodiment performs an operation of the SHA (Secure Hash Algorithm)-256, which is a cryptographic hash function, on input data.

[0015] (SHA-256) FIG. 2 is a diagram for explaining an outline of a method for calculating the value (hash value) of SHA-256. First, padding is performed on the message to convert it into a bit sequence having a length that is a multiple of 512, and the bit sequence is divided into 512-bit message blocks M. Next, the message block M is divided into 32-bit words W0 to W 15 . Next, the ME (message expansion) operation is repeatedly executed on the message block M to calculate W 16 to W 63 . The above ME operation is represented by the following equation (1).

Equation

Equation

[0016] a = H0; b = H1; c = H2; d = H3; e = H4; f = H5; g = H6; h = H7.

[0017] Next, for j = 0 to 63, the operation of the following formula (3) is repeated.

Equation

[0018] Here, the word K j is a constant defined by the standard. Also, the logical functions Σ0, Σ1, Ch, and Maj are represented by the following formula (4).

Equation

[0019] HO0 = a + H0; HO1 = b + H1; HO2 = c + H2; HO3 = d + H3; HO4 = e + H4; HO5 = f + H5; HO6 = g + H6; HO7 = h + H7.

[0020] The above intermediate hash value HO0|HO1|…|HO7 becomes the initial value of the variables a to h for the next message block M. Then, the above process is repeated for all message blocks M, and the intermediate hash value calculated for the last message block M becomes the final hash value corresponding to the message.

[0021] (Overview of the Hash Value Calculation Device) FIG. 3 is a block diagram showing a schematic configuration of the hash value calculation device according to the present embodiment. As shown in FIG. 3, the hash value calculation device 10 (processing device) includes a controller 11 (control unit), a GRAM (Global Random Access Memory) 12, a bus 13, a plurality of processing elements (PEs) 14, and a bus IF (interface) 15. That is, the hash value calculation device 10 is a multi-core processor having a plurality of PEs 14.

[0022] The controller 11 comprehensively controls the operations of various components of the hash value calculation device 10, and is configured by, for example, a computer including a CPU (Central Processing Unit) and a memory. The operation control of various components is performed by causing the computer to execute a control program.

[0023] The GRAM 12 stores information widely used in the hash value calculation device 10, and is configured by a storage device such as a flash memory. The bus 13 is for transferring data between the GRAM 12, the plurality of PEs 14, etc. The PE 14 is a processor core. The details of the PE 14 will be described later. The bus IF 15 is for transmitting and receiving data to and from an external device.

[0024] (PE) FIG. 4 is a block diagram showing a schematic configuration of the PE 14. As shown in FIG. 4, the PE 14 includes an ALU (Arithmetic Logic Unit) 20, two RAMs 21 and 22, four shift buffers 23 to 26, and an adder 27. In the present embodiment, each PE 14 has a function of calculating an intermediate hash value.

[0025] The ALU 20 performs arithmetic operations and logical operations, and in the present embodiment, performs the above-mentioned ME operation and the above-mentioned MC operation. The details of the ALU 20 will be described later.

[0026] RAM21 (expansion memory) stores the data (words W0 to W 63 ) used in the above ME operation, and is hereinafter referred to as "WRAM21". Among words W0 to W 63 , words W0 to W 15 (message block M) are written into WRAM21 from GRAM12 via bus 13. Words W0 to W 63 are written into WRAM21 from ALU20 via shift buffer 25.

[0027] RAM22 (compression memory) stores the initial values H0 to H7 of the hash values used in the above MC operation, and updates them with the calculated intermediate hash values HO0 to HO7, and is hereinafter referred to as "HRAM22". The initial values H0 to H7 of the hash values are written into HRAM22 from GRAM12 via bus 13. The intermediate hash values HO0 to HO7 are written from adder 27.

[0028] Note that the intermediate hash values HO0 to HO7 are the sums of the initial values H0 to H7 of the hash values and the variables a to h calculated by the final loop of the above MC operation, respectively. Also, the initial values H0 to H7 of the hash values are constants defined by the standard for the first-stage message block M, and for other message blocks M, they are the intermediate hash values HO0 to HO7 calculated from the previous-stage message block M.

[0029] Shift buffer 23 (input buffer) temporarily stores the data read from WRAM21. Shift buffer 23 sends the temporarily stored data to ALU20. Note that in Fig. 4, shift buffer 23 is described as "SBi1".

[0030] Shift buffer 24 (input buffer) temporarily stores the initial values H0 to H7 of the hash values read from HRAM22. Shift buffer 24 sends the temporarily stored initial values H0 to H7 of the hash values to ALU20 and adder 27. Note that in Fig. 4, shift buffer 24 is described as "SBi2".

[0031] The shift buffer 25 (output buffer) temporarily stores the word calculated by the ALU 20. The shift buffer 25 writes the temporarily stored word into the WRAM 21. In FIG. 4, the shift buffer 25 is described as "SBo1".

[0032] The shift buffer 26 (output buffer) temporarily stores the variables a to h calculated by the ALU 20. The shift buffer 26 sends the temporarily stored variables a to h to the adder 27. In FIG. 4, the shift buffer 26 is described as "SBo2".

[0033] The adder 27 adds the initial hash values H0 to H7 from the shift buffer 24 and the variables a to h from the shift buffer 26 respectively to calculate the intermediate hash values HO0 to HO7. The adder 27 writes the calculated intermediate hash values HO0 to HO7 into the HRAM 22 and transmits them to the GRAM 12 via the bus 13. Although not shown, the adder 27 includes four adding units.

[0034] (ALU) As shown in FIG. 4, the ALU 20 has a configuration including an ME operation unit 30 (expansion unit), an MC operation unit 31 (compression unit), a multiplexer 32, and a demultiplexer 33.

[0035] The ME operation unit 30 executes the ME operation using the data input from the WRAM 21 via the shift buffer 23. The ME operation unit 30 outputs the data calculated by the ME operation to the WRAM 21 via the shift buffer 25 and sends it to the MC operation unit.

[0036] The MC operation unit 31 executes the MC operation using the data from the ME operation unit 30 and the data from the multiplexer 32. The MC operation unit 31 sends the data calculated by the MC operation to the demultiplexer 33.

[0037] The multiplexer 32 switches to obtain variables a to h input to the MC operation unit 31 from the HRAM 22 via the shift buffer 24 in loop #0, and from the demultiplexer 33 in the other loops #1 to #63. The demultiplexer 33 switches to output (feedback) variables a to h output by the MC operation unit 31 to the multiplexer 32 for the next loops #1 to #63 in loops #0 to #62, and to output to the HRAM 22 via the shift buffer 26 and the adder 27 in the final loop #63.

[0038] Figure 1 is a block diagram showing the schematic configuration of the ALU 20. Figure 1 shows the j-th one-loop processing in the ALU 20. In Figure 1, W j is shown as W(j).

[0039] As shown in Figure 1, in the ME operation unit 30, when j = 0 to 15, the word W(j) is sent to the MC operation unit 31 via the multiplexer MUX. Next, when j = 16 to 63, the first operation process ME-1 and the second operation process ME-2 are performed in order.

[0040] In the first operation process ME-1, the logical operation of the above logical function σ0 is performed on W(j - 15) by the logical operation unit SIG0, and it is added to W(j - 16) by the arithmetic operation unit Adder. Also, the logical operation of the above logical function σ1 is performed on W(j - 2) by the logical operation unit SIG1, and it is added to W(j - 7) by the arithmetic operation unit Adder.

[0041] Next, in the second operation process ME-2, the two words operated in the first operation process ME-1 are added by the arithmetic operation unit Adder. The operation result is output to the WRAM 21 via the shift buffer 25 as the word W(j), and is also sent to the MC operation unit 31.

[0042] On the other hand, in the MC operation unit 31, the first to fourth operation processes MC-1 to MC-4 are performed in order.

[0043] In the first arithmetic operation process MC-1, the constant K(j) and the variable h are added by the arithmetic operation unit Adder. Also, the operation of the logical function Σ1 is performed on the variable e by the logical operation unit EP1, and the operation of the logical function Ch is performed on the variables e, f, and g by the logical operation unit CH. The two calculated words are added by the arithmetic operation unit Adder. Next, in the second arithmetic operation process MC-2, the two words calculated in the first arithmetic operation process MC-1 are added by the arithmetic operation unit Adder. Next, in the third arithmetic operation process MC-3, the word calculated in the second arithmetic operation process MC-2 and the word W(j) from the ME operation unit 30 are added by the arithmetic operation unit Adder. This operation result is the word T1.

[0044] Also, in the first arithmetic operation process MC-1, the operation of the logical function Σ0 is performed on the variable a by the logical operation unit EP0, and the operation of the logical function Maj is performed on the variables a, b, and c by the logical operation unit MAJ. The two calculated words are added by the arithmetic operation unit Adder. This operation result is the word T2.

[0045] In the fourth arithmetic operation process MC-4, the word T1 and the variable d are added by the arithmetic operation unit Adder and then output as the loop variable e. Also, the word T1 and the word T2 are added by the arithmetic operation unit Adder and then output as the variable a of the next loop. Also, the variables a to c, e to g are output as the variables b to d, f to h of the next loop via the wire assignment unit WireAssign.

[0046] As shown in FIG. 1, the first arithmetic operation process ME-1 of the ME operation unit 30 and the first arithmetic operation process MC-1 of the MC operation unit 31 are executed in parallel, and the second arithmetic operation process ME-2 of the ME operation unit 30 and the second arithmetic operation process MC-2 of the MC operation unit 31 are executed in parallel. Then, using the word W(j) calculated by the ME operation unit 30, the third arithmetic operation process MC-3 and the fourth arithmetic operation process MC-4 of the MC operation unit 31 are executed.

[0047] Therefore, compared with the case where the ME operation unit 30 and the MC operation unit 31 are executed separately, the number of clocks required to execute each loop process can be reduced to 4 clocks. Further, with only one PE14, the intermediate hash value regarding the message block M can be calculated. Therefore, the number of PE14s required to obtain the final hash value from the message can be reduced.

[0048] Also, WRAM21 stores the message block M (words W0 to W 15 ) and word W 16 ~W 63 , and HRAM22 stores the initial value of the hash value. Thereby, it is not necessary to write words W 16 ~W 63 to the external memory or read the message block M, the initial value of the hash value, and words W 16 ~W 63 from the external memory. Therefore, the processing efficiency of PE14 can be improved.

[0049] Also, WRAM21 stores the message block M (words W0 to W 15 ), and the intermediate hash value can be calculated from the data stored in HRAM22. Therefore, if WRAM21 stores the next message block M, the next intermediate hash value corresponding to the next message block M can be calculated using the above intermediate hash value. And by repeating these, the final hash value can be obtained from the above message with only one PE14.

[0050] (WRAM·HRAM) As shown in FIG. 4, WRAM21 has a configuration including four memory units WM1 to WM4, and the data of the first to fourth message blocks M are stored in each of the memory units WM1 to WM4. In the present embodiment, the data of the first to fourth message blocks M are different from each other, but may be partially or entirely the same. Each of the memory units WM1 to WM4 has 16 words W j-16 ~W j-1It suffices to have at least a memory size (512 bits) capable of storing, and it may have a memory size (2048 bits) capable of storing 64 words W0 to W 63 It may have a memory size (2048 bits) capable of storing.

[0051] HRAM22 has a configuration including four memory units HM1 to HM4. The memory units HM1 to HM4 each store the first to fourth initial values H0 to H7 of hash values corresponding to the first to fourth message blocks M stored in the memory units WM1 to WM4 of WRAM21. The first to fourth initial values H0 to H7 of the hash values are updated by the first to fourth intermediate hash values HO0 to HO7 corresponding to the first to fourth message blocks M. Each of the memory units HM1 to HM4 may have at least a memory size (256 bits) capable of storing the initial values H0 to H7 of the hash values.

[0052] FIG. 5 is a timing chart showing an example of the processing flow in the ME operation unit 30 and the MC operation unit 31. In FIG. 5, F1 to F4 respectively show the processing related to the first to fourth message blocks M stored in WM1 to WM4. Also, Lj (j = 0 to 63) indicates the loop number.

[0053] The processing F1 related to the first message block M is performed at the following timing. As shown in FIG. 5, first, at clock CK0, the 0th loop is started, data is read from the memory units WM1 and HM1, and the first arithmetic processes ME-1 and MC-1 are executed.

[0054] Next, at clock CK1, the second arithmetic processes ME-2 and MC-2 are executed. The word W(16) calculated in the second arithmetic process ME-2 is stored in the memory unit WM1 and sent to the MC operation unit 31.

[0055] Next, at clocks CK2 and CK3, the third arithmetic process MC-3 and the fourth arithmetic process MC-4 of the MC operation unit 31 are respectively executed to end the 0th loop. Therefore, each loop is executed at four timings.

[0056] Next, at clock CK4, the first loop is started, data is read from the memory unit WM1, and the first arithmetic processing ME-1 is executed. Also, the first arithmetic processing MC-1 is executed using the variables a to h calculated in the fourth arithmetic processing MC-4 at the previous clock CK3. Hereinafter, the above operations are repeated.

[0057] Regarding the processing F2 for the second message block M, the zero-th loop is started at clock CK1, and operations similar to the above operations are repeated. Similarly, regarding the processing F3 and F4 for the third and fourth message blocks M, the zero-th loop is started at clocks CK2 and CK3, respectively, and operations similar to the above operations are repeated. Then, at clock CK4, the first loop of the processing F1 for the first message block M is started.

[0058] Therefore, the PE14 of the present embodiment can calculate four loop processes corresponding to the four message blocks M in four clocks. That is, one loop process can be executed per clock. As a result, the efficiency of the processing in the ALU20 can be improved.

[0059] Note that in the present embodiment, the number of memory units provided in each of the WRAM21 and HRAM22 is set to 4, but it is not limited thereto. Each of the WRAM21 and HRAM22 only needs to be provided with a memory unit for the number of clocks required for one loop.

[0060] (Shift buffer) FIG. 6 is a block diagram showing a schematic configuration of the shift buffers 23 and 24.

[0061] As shown in FIG. 6, the shift buffer 23 is configured to include four shift registers 40 to 43 and a multiplexer 44. The shift register 40 stores four words (W(j - 16), W(j - 15), W(j - 7), and W(j - 2)) from the memory section WM1 of the WRAM 21. Similarly, the shift registers 41 to 43 each store the above four words from the memory sections WM2 to WM4 of the WRAM 21. The multiplexer 44 selects any one of the shift registers 40 to 43 and inputs the four words of the selected shift register to the ME operation section 30 of the ALU 20.

[0062] Also, the shift buffer 24 is configured to include four shift registers 45 to 48 and a multiplexer 49. The shift registers 45 to 48 each store the initial hash values H0 to H7 from the memory sections HM1 to HM4 of the HRAM 22. The multiplexer 49 selects any one of the shift registers 45 to 48, takes the initial values H0 to H7 of the selected shift register as variables a to h, and inputs them to the MC operation section 31 of the ALU 20 via the multiplexer 32. Also, the multiplexer 49 sends the initial hash values H0 to H7 of the selected shift register to the adder 27.

[0063] FIG. 7 is a timing chart showing an example of the processing flow in the shift buffer 23. As shown in FIG. 7, in the shift register 40, at clocks CK10 to CK13, four words used in the MC operation section 31 in a certain loop are sequentially read from the memory section WM1. Then, at clock CK13, the stored four words are input to the MC operation section 31 of the ALU 20 via the multiplexer 44. Thereby, the above certain loop of the processing F1 for the first message block M is started.

[0064] Next, in the shift register 40, at clocks CK14 to CK17, four words used in the MC operation unit 31 in the next loop are sequentially read out. Then, at clock CK17, the stored four words are input to the MC operation unit 31 of the ALU 20 via the multiplexer 44. Subsequently, the above operation is repeated.

[0065] On the other hand, in the shift register 41, at clocks CK11 to CK14, four words used in the MC operation unit 31 in a certain loop are sequentially read out from the memory unit WM2. Then, at clock CK14, the stored four words are input to the MC operation unit 31 of the ALU 20 via the multiplexer 44. Thereby, the above certain loop of the process F2 regarding the second message block M is started.

[0066] Similarly, in the shift register 42, at clock CK15, four words sequentially stored from the memory unit WM3 are input to the MC operation unit 31 of the ALU 20 via the multiplexer 44. Thereby, the above certain loop of the process F3 regarding the third message block M is started. Also, in the shift register 43, at clock CK16, four words sequentially stored from the memory unit WM4 are input to the MC operation unit 31 of the ALU 20 via the multiplexer 44. Thereby, the above certain loop of the process F4 regarding the fourth message block M is started. Then, at clock CK17, four words sequentially stored from the memory unit WM1 are input to the MC operation unit 31 of the ALU 20 via the multiplexer 44. Thereby, the above next loop of the process F1 regarding the first message block M is started.

[0067] Therefore, the shift buffer 23 of the present embodiment can sequentially read out the data required by the ME operation unit 30 from the WRAM 21 and output it to the ME operation unit 30 all at once at a predetermined timing. As a result, the ME operation unit 30 does not need to wait to read data from the WRAM 21. As a result, the processing efficiency in the processing element can be further improved. Further, since the shift buffer 23 includes shift registers 40 to 43 corresponding to the memory units WM1 to WM4 of the WRAM 21, respectively, it is possible to avoid a delay in the processing speed due to providing only one shift register. Note that the shift buffer 24 is the same as the shift buffer 23, and thus its description is omitted.

[0068] FIG. 8 is a block diagram showing a schematic configuration of the shift buffers 25 and 26.

[0069] As shown in FIG. 8, the shift buffer 25 has a configuration including four shift registers 50 to 53 and a demultiplexer 54. The demultiplexer 54 outputs the word W(j) calculated by the ME operation unit 30 to any one of the shift registers 50 to 53. The shift registers 50 to 53 store the word W(j) related to the first to fourth message blocks M via the demultiplexer 54, respectively. The shift registers 50 to 53 write the stored word W(j) to the memory units WM1 to WM4, respectively.

[0070] Further, the shift buffer 26 has a configuration including four shift registers 55 to 58 and a demultiplexer 59. The demultiplexer 59 outputs the variables a to h of the final loop calculated by the MC operation unit 31 to any one of the shift registers 55 to 58. The shift registers 55 to 58 each store the variables a to h of the final loop related to the first to fourth message blocks M via the demultiplexer 54. The variables a to h stored in the shift registers 55 to 58 are respectively added to the initial hash values H0 to H7 from the shift registers 45 to 48 by the adder 27 and written to the memory units HM1 to HM4 as intermediate hash values HO0 to HO7 respectively.

[0071] Figure 9 is a timing chart showing an example of the processing flow in the shift buffer 26. As shown in Figure 9, in the shift register 55, at the clock CK20, the variables a to h of the final loop related to the first message block calculated by the MC operation unit 31 of the ALU 20 are stored via the demultiplexer 33. Then, the variables a to h are sequentially sent to the first adder of the adder 27 at the clocks CK21 to CK28. In the first adder, the variables a to h are sequentially added to the initial hash values H0 to H7 of the hash value related to the first message block obtained from the shift register 45 and written to the memory unit HM1 of the HRAM22 as the intermediate hash values HO0 to HO7 of the first message block in sequence.

[0072] On the other hand, in the shift register 56, at the clock CK21, the variables a to h of the final loop related to the second message block calculated by the MC operation unit 31 of the ALU 20 are stored via the demultiplexer 33. Then, the variables a to h are sequentially sent to the second adder of the adder 27 at the clocks CK22 to CK29. In the second adder, the variables a to h are sequentially added to the initial hash values H0 to H7 of the hash value related to the second message block obtained from the shift register 45 and written to the memory unit HM2 of the HRAM22 as the intermediate hash values HO0 to HO7 of the second message block in sequence. Note that the same applies to the shift registers 57 and 58.

[0073] Therefore, the shift buffer 25 of this embodiment can sequentially write the data output by the ME calculation unit 30 into the WRAM 21. As a result, the ME calculation unit 30 does not need to wait to write the data into the WRAM 21. Consequently, the processing efficiency in the PE 14 can be further improved. In addition, since the shift buffer 25 includes shift registers 50 to 53 corresponding to the memory units WM1 to WM4 of the WRAM 21 respectively, it is possible to avoid the delay in processing speed caused by providing only one shift register. Note that since the shift buffer 26 is the same as the shift buffer 25, its description is omitted.

[0074] (Modification Example 1) In this modification example, the PE 14 calculates four intermediate hash values HO0 to HO7 corresponding to 4×L (L is an integer of 2 or more) message blocks M respectively. In this case, the WRAM 21 may include L groups each consisting of four memory units WM1 to WM4. At this time, the WRAM 21 may have a storage capacity of L×4×64×32 bits = L kilobytes. Also, the HRAM 22 may include L groups each consisting of four memory units HM1 to HM4. At this time, the HRAM 22 may have a storage capacity of L×4×8×32 bits = L×128 bytes.

[0075] And the ALU 20 may execute as follows. That is, first, it calculates four intermediate hash values HO0 to HO7 corresponding to the four message blocks M in the first group. Next, it calculates four intermediate hash values HO0 to HO7 corresponding to the four message blocks M in the second group. This is repeated until the L-th group.

[0076] In the case of this modification example, a large number of intermediate hash values HO0 to HO7 corresponding to a large number of message blocks M can be calculated by one PE.

[0077] (Modification Example 2) By the way, when obtaining the final hash value from a message, as described above, the intermediate hash value corresponding to a certain message block becomes the initial hash value for the next message block.

[0078] Therefore, in this modified example, PE14 is set such that the four intermediate hash values corresponding to four message blocks in a certain group each become the four initial hash values for the four message blocks in the next group. In this case, HRAM22 may include four memory units HM1 to HM4. Therefore, HRAM22 may have a storage capacity of 4 × 8 × 32 bits = 128 bytes.

[0079] [Embodiment 2] Another embodiment of the present invention will be described with reference to FIGS. 10 to 12. The hash value calculation device of this embodiment performs the operation of the above SHA-256 twice on the input data (double hash). The hash value calculation device of this embodiment is suitable for, for example, Bitcoin mining.

[0080] FIG. 10 is a block diagram showing an overview of double hashing in Bitcoin mining. The upper part of FIG. 10 shows the structure of the input data of each block in the Bitcoin blockchain. The lower part of FIG. 10 shows an overview of the process for performing mining on the above block.

[0081] (Bitcoin Mining) In the Bitcoin mining process, 1024-bit input data DAT is used. As shown in the upper part of FIG. 10, the input data DAT consists of a 32-bit version value, a 256-bit hash value (hash value of the previous block) when the previous blockchain was created, a 256-bit Merkle root hash value, a 32-bit timestamp, a 32-bit target, a 32-bit nonce, and 384-bit padding.

[0082] First, divide the input data DAT into two message blocks M1 and M2. Next, perform the hash function SHA-256(1) using the first message block M1 and the initial value of the hash value (initial hash value) to obtain the first hash value Ha-1. This process may be executed by the PE14 of the hash value calculation device in FIGS. 1 to 9, or may be executed by other calculation devices. Note that the initial hash value is a constant.

[0083] Next, perform the hash function SHA-256(2) using the 256-bit first hash value Ha-1 and the second message block M2 to obtain the second hash value Ha-2. Next, perform padding on the 256-bit second hash value Ha-2 to create a 512-bit third message block M3. Next, perform the hash function SHA-256(3) using the third message block M3 and the initial hash value to obtain the final hash value Ha-F. In other words, perform double hashing using the first hash value Ha-1 and the second message block M2 to obtain the final hash value Ha-F.

[0084] If the final hash value Ha-F is equal to or greater than a predetermined threshold, it is determined that the above nonce is not the correct answer, and the above nonce is changed (specifically, incremented by 1), and the above operation is repeated. On the other hand, if the final hash value Ha-F is less than the predetermined threshold, it is determined that the above nonce is the correct answer, and a new block is generated for the above blockchain.

[0085] (Processing element) The hash value calculation device 10 of the present embodiment has a different PE configuration compared to the hash value calculation device shown in FIGS. 1 to 9, and other configurations are the same.

[0086] FIG. 11 is a block diagram showing a schematic configuration of the PE16 in the hash value calculation device 10 of the present embodiment. The PE16 of the present embodiment calculates the hash functions SHA-256(2)·SHA-256(3) shown in FIG. 10. Note that the first hash value Ha-1 and the second message block M2 used for the hash function SHA-256(2) are stored in advance in the GRAM12 (see FIG. 3).

[0087] FIG. 11 is a block diagram showing a schematic configuration of the PE16 in the hash value calculation device 10 of the present embodiment. The PE16 of the present embodiment calculates the hash functions SHA-256(2)·SHA-256(3) shown in FIG. 10. Further, the PE16 of the present embodiment roughly includes two sets of the ALU20, WRAM21, HRAM22, shift buffers 23 to 26, and adder 27 in the PE14 shown in FIG. 4.

[0088] Specifically, the PE16 of the present embodiment has a configuration including a first set of an ALU60, WRAM61, HRAM62, shift buffers 63 to 66, and an adder 67, and a second set of an ALU70, WRAM71, HRAM72, shift buffers 73 to 76, and an adder 77. Note that the ALU60, 70, WRAM61, 71, HRAM62, 72, shift buffers 63 to 66, 73 to 76, and adders 67, 77 have the same functions as the ALU20, WRAM21, HRAM22, shift buffers 23 to 26, and adder 27 shown in FIG. 4, and thus the description thereof is omitted.

[0089] In the first set, the second message block M2 from the GRAM12 is stored in the WRAM61, and the first hash value Ha-1 from the GRAM12 is stored in the HRAM62. Thereby, the adder 67 calculates the second hash value Ha-2.

[0090] In the second set, the second hash value Ha-2 from the first set is stored in the WRAM71 as the words W0 to W7 of the third message block M3, and the padding from the GRAM12 is the word W8 to W of the third message block M315 It is stored in the WRAM71 as such. Also, the initial hash value from the GRAM12 is stored in the HRAM72. As a result, the adder 77 calculates the final hash value Ha-F.

[0091] Therefore, the double hash can be realized by the PE16 of the present embodiment, and the PE16 of the present embodiment can be incorporated into a system that uses the double hash.

[0092] (Update unit) The PE16 of the present embodiment further includes an update unit 68 in the first set. The update unit 68 updates the nonce stored in the WRAM61.

[0093] FIG. 12 is a block diagram showing details of the update unit 68. As shown in FIG. 12, the update unit 68 includes an incrementer 68a and a multiplexer 68b.

[0094] The nonce included in the second message block M2 is stored in the WRAM61 as the word W3. Therefore, in the 19th loop, the incrementer 68a acquires the word W3 input from the shift buffer 63 to the ME operation unit 30 of the ALU60 and increments it by 1. The incrementer 68a sends the incremented word W3 to the multiplexer 68b.

[0095] The 19th loop is the last timing when the word W3 is used. That is, when the use of the word W3 in the ME operation unit 30 ends due to the above input, the word W3 is updated. Note that the update unit 68 can update the word W3 at any timing from the time when the use of the word W3 in the ME operation unit 30 of the ALU60 ends to the time when all loop processes of the ME operation unit 30 end.

[0096] The multiplexer 68b writes the words W16 to W63 acquired from the ALU60 via the shift buffer 65 into the WRAM61, and writes the word W3 incremented by the incrementer 68a into the WRAM61 as a new word W3.

[0097] Therefore, when all loops are completed, a new word W3 is stored in the WRAM61. Thus, immediately after the above completion, the PE16 can perform loop processing again on the second message block M2 including a new nonce to calculate a new final hash value Ha-F. As a result, since there is no need to obtain the second message block M2 including a new nonce from the GRAM12, the above calculation can be performed quickly. In addition, the PE16 can calculate a number of final hash values Ha-F from a number of second message blocks M2 each including a number of different nonces, and the limitation on the amount of nonces used by the PE16 is eliminated.

[0098] Also, even when calculating L second hash values Ha-2 from L second message blocks M2 each including different L nonces, it is not necessary to multiply the storage capacity of the WRAM61 by L. That is, the WRAM61 only needs to have a storage capacity of 4 × 64 × 32 bits = 1 kilobyte.

[0099] Note that the second set of WRAM71 only needs to sequentially update and store the second hash value Ha-2. Therefore, the WRAM71 only needs to have a storage capacity of 4 × 64 × 32 bits = 1 kilobyte, similar to the WRAM61. Also, the HRAM62·72 does not need to change the stored first hash value Ha-1 and the initial hash value. Therefore, the HRAM62·72 only needs to have a storage capacity of 4 × 8 × 32 bits = 128 bytes.

[0100] (Determination unit) As shown in FIG. 11, the PE16 of the present embodiment further includes a determination unit 78 in the second set. The determination unit 78 determines whether the final hash value Ha-F obtained from the ALU70 via the shift buffer 76 is smaller than the target value.

[0101] If the final hash value Ha-F is equal to or greater than the target value, the determination unit 78 determines that the final hash value Ha-F is not a valid hash value and discards the final hash value Ha-F. On the other hand, if the final hash value Ha-F is less than the target value, the determination unit 78 determines that the final hash value Ha-F is a valid hash value. At this time, the determination unit 78 outputs the final hash value Ha-F and the nonce corresponding to the final hash value Ha-F to the GRAM12. Then, the determination unit 78 instructs all the PEs 16 to end the operation.

[0102] Therefore, the PE 16 of the present embodiment can successively update the nonce included in the second message block M2, successively calculate the second hash value Ha-2, successively calculate the final hash value Ha-F, and successively determine whether the final hash value Ha-F is a valid hash value. As a result, Bitcoin mining can be efficiently executed.

[0103] Note that when the determination unit 78 determines that the final hash value Ha-F is a valid hash value, it may instruct the controller 11 to cause all the PEs 16 to end the operation, or may instruct all the PEs 16. Thereby, it is not necessary to execute the subsequent unnecessary mining process.

[0104] (Supplementary items) The hash value calculation device 10 of the present embodiment is applied to Bitcoin mining, but can also be applied to other blockchain mining. Further, the hash value calculation device 10 of the present embodiment is applied to double hash calculation, but can also be applied when executing hash function calculation three or more times.

[0105] 〔Embodiment 3〕 Another embodiment of the present invention will be described with reference to FIG. 13.

[0106] FIG. 13 is a block diagram showing a schematic configuration of the embedded system according to the present embodiment. As shown in FIG. 13, the embedded system 80 includes a processor 81, a DDR (Double Data Rate) memory 82, an AMBA (Advanced Microcontroller Bus Architecture) bus 83, the hash value calculation device 10 shown in FIGS. 1 to 12, and an AXI bus 84.

[0107] The processor 81 includes a CPU, a cache, and a memory management unit (MMU). The processor 81 and the DDR memory 82 are connected via the AMBA bus 83. Also, the processor 81 and the hash value calculation device 10 are connected via the AXI bus 84. As shown in FIG. 13, the hash value calculation device 10 shown in FIGS. 1 to 12 can be incorporated into the embedded system.

[0108] 〔Example of Realization by Software〕 The control blocks of the hash value calculation device 10 (particularly ALU20, 60, 70) may be realized by a logic circuit (hardware) formed in an integrated circuit (IC chip) or the like, or may be realized by software.

[0109] In the latter case, the hash value calculation device 10 includes a computer that executes instructions of a program, which is software for realizing each function. This computer includes, for example, one or more processors and a computer-readable recording medium that stores the above program. Then, in the above computer, when the above processor reads and executes the above program from the above recording medium, the object of the present invention is achieved. As the above processor, for example, a CPU (Central Processing Unit) can be used. As the above recording medium, "non-transitory tangible media" such as ROM (Read Only Memory), tapes, disks, cards, semiconductor memories, programmable logic circuits, etc. can be used. Further, it may further include a RAM (Random Access Memory) for expanding the above program. Further, the above program may be supplied to the above computer via any transmission medium (communication network, broadcast wave, etc.) capable of transmitting the program. Note that one aspect of the present invention can also be realized in the form of a data signal embedded in a carrier wave, in which the above program is embodied by electronic transmission.

[0110] The present invention is not limited to the above-described embodiments, and various modifications are possible within the scope shown in the claims. Embodiments obtained by appropriately combining the technical means disclosed in different embodiments are also included in the technical scope of the present invention.

[0111] For example, in the above embodiment, the value of SHA-256 is obtained. However, the present invention can be applied to any hash value calculation device that performs iterative processing using input data to expand the input data, performs iterative processing using the expanded data, and compresses the data.

[0112] 〔Summary〕 A processing element according to one aspect of the present invention is a processing element that calculates an intermediate hash value from a message block having a predetermined bit length, and repeatedly performs a loop process on the message block to expand it into a bit sequence longer than the bit length, and repeatedly performs a loop process on the expanded bit sequence to compress it into the intermediate hash value. The expansion unit and the compression unit execute one loop process of the expansion unit and a part of one loop process of the compression unit in parallel, and the compression unit uses the word calculated by one loop process of the expansion unit to execute the remaining processes of one loop process of the compression unit that are not executed in parallel.

[0113] According to the above configuration, in each loop process, the arithmetic process of the expansion unit and a part of the arithmetic process of the compression unit can be executed in parallel. As a result, the number of clock cycles required to execute each loop process can be reduced.

[0114] The expansion unit uses the word calculated by a certain loop process in another loop process, and the compression unit uses the variable calculated by a certain loop process in the next loop process. Then, when all loop processes are completed, the intermediate hash value is calculated.

[0115] Therefore, the intermediate hash value can be calculated from the message block using only one such processing element. As a result, the number of processing elements required to obtain the final hash value from the message can be reduced.

[0116] The processing element according to this aspect may further include an expansion memory for storing the message block and the word, and a compression memory for storing an initial value of a hash value used in the first loop process of the compression unit. According to the above configuration, it is not necessary to write the word to an external memory or read the message block, the initial value of the hash value, and the word from the external memory. Therefore, the processing efficiency of the processing element can be improved.

[0117] In the processing element according to this aspect, the compression unit may update the initial value of the hash value stored in the compression memory with the intermediate hash value. According to the above configuration, when the message block stored in the expansion memory is updated with the next message block, the processing element can calculate the next intermediate hash value. By repeating this, the final hash value can be obtained from the message using only one such processing element.

[0118] In the processing element according to this aspect, each of the expansion memory and the compression memory may include a memory unit by the number of clocks required for the compression unit to execute one loop of processing. According to the above configuration, a plurality of message blocks are stored in a plurality of memory units of the expansion memory, and initial values of a plurality of hash values corresponding to the plurality of message blocks are stored in a plurality of memory units of the compression memory. Thereby, a plurality of loop processes for a plurality of message blocks can be executed with the above number of clocks. That is, one loop process can be executed per clock. As a result, the processing efficiency in the processing element can be further improved.

[0119] The processing element according to this aspect may further include an input buffer for temporarily storing data input from the expansion memory to the expansion unit, and an input buffer for temporarily storing data input from the compression memory to the compression unit.

[0120] According to the above configuration, the input buffer can sequentially read out the data required by the expansion unit from the expansion memory and output it to the expansion unit all at once at a predetermined timing. As a result, the expansion unit does not need to wait to read the data from the expansion memory. Also, the input buffer can sequentially read out the data required by the compression unit from the compression memory and output it to the compression unit all at once at a predetermined timing. As a result, the compression unit does not need to wait to read the data from the compression memory. Consequently, the processing efficiency in the processing element can be further improved.

[0121] In addition, when each of the expansion memory and the compression memory includes a plurality of the memory units, it is desirable that the input buffer includes buffer units corresponding to the plurality of the memory units.

[0122] In the processing element according to this aspect, it may further include an output buffer for temporarily storing the data output from the expansion unit to the expansion memory, and an output buffer for temporarily storing the data output from the compression unit to the compression memory.

[0123] In this case, the output buffer can sequentially write the data output by the expansion unit to the expansion memory. As a result, the expansion unit does not need to wait to write the data to the expansion memory. Also, the output buffer can sequentially write the data output by the compression unit to the compression memory. As a result, the compression unit does not need to wait to write the data to the compression memory. Consequently, the processing efficiency in the processing element can be further improved.

[0124] In addition, when each of the expansion memory and the compression memory includes a plurality of the memory units, it is desirable that the output buffer includes buffer units corresponding to the plurality of the memory units.

[0125] In the processing element according to this aspect, a plurality of sets of the deployment unit, the compression unit, the deployment memory, and the compression memory are provided, and the compression unit of a certain set may write the compressed intermediate hash value into the deployment memory of another set as part of the message block of the other set.

[0126] In this case, executing a hash function a plurality of times on the message block, such as double hashing, can be realized by one processing element. As a result, the processing element can be applied to a system that uses double hashing, such as Bitcoin.

[0127] In the processing element according to this aspect, the number of the sets is two, and an update unit may be further provided to update a predetermined range of words in the message block stored in the deployment memory of the first set when the use of the word in the deployment unit of the first set is completed. According to the above configuration, the words in the predetermined range of the message block can be updated one after another, and the intermediate hash values can be calculated one after another. As a result, Bitcoin mining can be efficiently executed. Note that the update unit can update the word at any timing from the time when the use of the word in the deployment unit of the first set is completed to the time when all loop processes of the first set are completed.

[0128] In the processing element according to this aspect, a determination unit may be further provided to determine whether the final hash value is a valid hash value by using the intermediate hash value successively calculated by the compression unit of the first set as the final hash value. According to the above configuration, the compression unit of the second set can successively calculate the final hash value by using the intermediate hash value successively calculated by the compression unit of the first set. As a result, the determination unit can determine whether the successively calculated final hash value is a valid hash value. As a result, Bitcoin mining can be executed more efficiently.

[0129] In addition, when the determination unit determines that the final hash value is a valid hash value, it may notify an external device of the final hash value and the word within the predetermined range corresponding to the final hash value, and terminate the operation of the processing element. As a result, subsequent unnecessary mining processing can be avoided.

[0130] The processing element according to each aspect of the present invention may be realized by a computer. In this case, a control program for realizing the processing element by operating the computer as each part (software element) provided in the processing element, and a computer-readable recording medium recording the same also fall within the scope of the present invention.

[0131] A processing device according to another aspect of the present invention includes a plurality of processing elements having the above-described configuration, and further includes a control unit that controls the plurality of processing elements.

[0132] According to the above configuration, the above-described effects can be achieved. Also, in Bitcoin mining, the control unit can set the change range of the word for each processing element, so that the mining can be executed in parallel by the plurality of processing elements, and the mining can be executed more efficiently.

[0133] In this case, when the control unit acquires the final hash value determined to be a valid hash value and the word within the predetermined range corresponding to the final hash value from a certain processing element, it is desirable to instruct all the processing elements to terminate their operations. As a result, subsequent unnecessary mining processing can be avoided.

[0134] A control method for a processing element according to another aspect of the present invention is a processing element that calculates an intermediate hash value from a message block of a predetermined bit length. The method includes a spreading unit that repeatedly performs a loop process on the message block to expand it into a bit sequence longer than the bit length, and a compressing unit that repeatedly performs a loop process on the expanded bit sequence to compress it into the intermediate hash value. The control method includes steps of causing the spreading unit and the compressing unit to execute in parallel one loop process of the spreading unit and a part of one loop process of the compressing unit, and causing the compressing unit to execute the remaining processes of one loop process of the compressing unit that are not executed in parallel, using a word calculated by one loop process of the spreading unit.

[0135] According to the above method, the same effects as those of the above-described processing element can be achieved.

Explanation of Signs

[0136] 10 Hash value calculation device (processing device) 11 Controller (control unit) 12 GRAM 13 Bus 14, 16 PE 15 Bus IF 20, 60, 70 ALU 21, 61, 71 WRAM (memory for spreading) 22, 62, 72 HRAM (memory for compression) 23, 24, 63, 64, 73, 74 Shift buffer (input buffer) 25, 26, 65, 66, 75, 76 Shift buffer (output buffer) 27, 67, 77 Adder 30 ME operation unit (spreading unit) 31 MC operation unit (compression unit) 32, 44, 49, 68b Multiplexer 33, 54, 59 Demultiplexer 40~43, 45~48 Shift register (input buffer) 50~53, 55~58 Shift register (output buffer) 68 Update Unit 68a Incrementer 78 Determination Unit 80 System 81 Processor 82 DDR Memory 82 Memory 83 AMBA Bus 84 AXI Bus

Claims

1. A processing element that calculates an intermediate hash value from a message block of a predetermined bit length, comprising: an expansion unit that repeatedly performs a loop process on the message block to expand it into a bit sequence longer than the bit length; a compression unit that repeatedly performs a loop process on the expanded bit sequence to compress it into the intermediate hash value, wherein the expansion unit and the compression unit execute in parallel one loop process of the expansion unit and a part of one loop process of the compression unit, and the compression unit is a processing element that uses a word calculated by one loop process of the expansion unit to execute the remaining processes of one loop process of the compression unit that are not executed in parallel.

2. An expansion memory for storing the message block and the word, and a compression memory for storing an initial value of a hash value used in a first loop process of the compression unit, the processing element according to claim 1, further comprising.

3. The processing element according to claim 2, wherein the compression unit updates the initial value of the hash value stored in the compression memory with the intermediate hash value.

4. The processing element according to claim 2 or 3, wherein each of the expansion memory and the compression memory includes a memory unit by the number of clocks required for the compression unit to execute one loop of processing.

5. An input buffer for temporarily storing data input from the expansion memory to the expansion unit, and an input buffer for temporarily storing data input from the compression memory to the compression unit, the processing element according to any one of claims 2 to 4, further comprising.

6. An output buffer for temporarily storing data output from the expansion unit to the expansion memory, and an output buffer for temporarily storing data output from the compression unit to the compression memory, the processing element according to any one of claims 2 to 5, further comprising.

7. A plurality of sets of the expansion unit, the compression unit, the expansion memory, and the compression memory are provided, and the compression unit of a certain set writes the compressed intermediate hash value as a part of the message block of another set to the expansion memory of the another set, the processing element according to any one of claims 2 to 6.

8. The number of the sets is two, The processing element according to claim 7, further comprising an update unit that updates a predetermined range of words in the message block stored in the expansion memory of the first set when the use of the word in the expansion unit of the first set is completed.

9. The processing element according to claim 8, further comprising a determination unit that determines whether the final hash value, which is the intermediate hash value compressed by the compression unit of the second set, is a valid hash value.

10. Comprising a plurality of the processing elements according to any one of claims 1 to 9, A processing apparatus further comprising a control unit that controls the plurality of the processing elements.

11. A processing element that calculates an intermediate hash value from a message block of a predetermined bit length, comprising an expansion unit that repeatedly performs a loop process on the message block and expands it into a bit sequence longer than the bit length, and a compression unit that repeatedly performs a loop process on the expanded bit sequence and compresses it into the intermediate hash value. A control method for the processing element, comprising: In the expansion unit and the compression unit, a step of executing in parallel one loop process of the expansion unit and a part of one loop process of the compression unit; In the compression unit, a step of executing the remaining processes that are not executed in parallel in one loop process of the compression unit using the word calculated by one loop process of the expansion unit. A control method for the processing element.

12. A control program for causing a computer to function as the processing element according to claim 1, which is a control program for causing a computer to function as the expansion unit and the compression unit.

Images