Vectorization method for homomorphic encryption compiler

Abstract

The invention discloses a vectorization method for a homomorphic encryption compiler, and the method comprises the following steps: S1, obtaining a cloud homomorphic encryption calculation-oriented source program written by a developer; s2, converting a source program into an intermediate representation, and executing loop expansion optimization on the intermediate representation to obtain a scalar intermediate representation without control flow; s3, converting the scalar intermediate representation into a directed acyclic graph G (V, E); s4, calculating the ASAP and ALAP attribute of each node in the directed acyclic graph, and determining the maximum lane width required by the directed acyclic graph; s5, constructing an integer linear programming model based on the parameters; and S6, solving the integer linear programming model, and generating a vectorized homomorphic encryption program according to a solving result and a homomorphic encryption library at the rear end of the target hardware. According to the method, manual intervention is not needed, regular and irregular programs are supported, the speed is averagely increased by 5.95 times at the CPU end and 3.79 times at the GPU end compared with a scalar program, and the homomorphic encryption technology is assisted.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of homomorphic encryption, and particularly relates to a vectorization method for a homomorphic encryption compiler. BACKGROUND

[0002] The widespread use of cloud computing has greatly increased the demand for data security, and users want to protect the security of sensitive data uploaded to the cloud. To meet this demand, fully homomorphic encryption (FHE) provides a viable solution. This solution allows direct computation on encrypted data without revealing the original data information. This data security is crucial for fields such as medicine and finance.

[0003] However, computations on ciphertexts are usually orders of magnitude slower than plaintext computations. Fortunately, current FHE schemes support packing a large number of data elements into a single ciphertext, distributing the high computational overhead through a SIMD-like computation model. To facilitate programming development and fully utilize the advantages of this SIMD computation model, an automatic and efficient vectorization method is necessary. However, traditional vectorization methods targeting SIMD hardware structures are not suitable for FHE, because these hardware structures support flexible and low-overhead data movement and arrangement, while FHE only allows ring rotation on the entire ciphertext, and this operation incurs a huge computational cost; without carefully designed data layout and vectorization strategies, the performance of the vectorized FHE program may even be worse than the original program.

[0004] To solve the unique vectorization problem in FHE, existing FHE compilers have proposed a series of methods, but most of them are designed for regular applications (especially workloads in AI), which are difficult to generalize to other types of programs. To support a wider range of applications, Porcupine uses a synthesis-based method to generate vectorized code, but it requires programmers to provide sketches as templates for synthesis; HECO proposes an automated vectorization method to avoid human intervention, but it relies on fixed and simple data layouts, limiting optimization capabilities; Coyote proposes a method that can support arbitrary FHE programs and takes into account the impact of data layout on performance, but it uses a local search approach that cannot capture global optimization information, resulting in suboptimal program performance. In summary, the existing vectorization methods of FHE compilers still cannot balance automation, universality, and performance, and need to be improved to promote the landing and application of FHE technology.

[0005] Therefore, the skilled in the art is committed to developing a vectorization method for a homomorphic encryption compiler. SUMMARY

[0006] In view of the above defects of the prior art, the technical problems to be solved by the present application are: 1) the traditional vectorization method for SIMD hardware structure is not suitable for fully homomorphic encryption (FHE) scene; 2) the existing FHE compiler vectorization method cannot balance automation, universality and performance.

[0007] To achieve the above-mentioned purpose, the present application provides a vectorization method for a homomorphic encryption compiler, which comprises the following steps: S1: obtaining a source program for cloud homomorphic encryption calculation written by a developer, the source program supporting addition, subtraction, multiplication operations and loop structures with known loop boundaries at the time of compilation; S2: converting the source program into an intermediate representation through a compiler front end corresponding to the source program; performing loop unrolling optimization on the intermediate representation to obtain a scalar intermediate representation without control flow; S3: converting the scalar intermediate representation into a directed acyclic graph G(V, E), wherein V is a node set, each node corresponding to a scalar instruction in the intermediate representation, and E is an edge set, each edge corresponding to a dependency relationship between scalar instructions; S4: using ASAP scheduling algorithm and ALAP scheduling algorithm to calculate the ASAP attribute and ALAP attribute of each node in the directed acyclic graph; determining the maximum lane width required by the directed acyclic graph, the maximum lane width being the maximum number of nodes allowed to be mapped to the same vector instruction in the directed acyclic graph; S5: based on the ASAP attribute, ALAP attribute and maximum lane width, constructing an integer linear programming model; the integer linear programming model aims to minimize the delay of the vectorized program, and includes node exclusive constraint, lane exclusive constraint, node operation type constraint, node dependency constraint and rotation instruction overhead constraint, and further includes optimization operation for pruning the solution space through the ASAP attribute and ALAP attribute; S6: solving the integer linear programming model, and generating a vectorized homomorphic encryption program according to the solution result and a homomorphic encryption library of a target hardware backend; Further, in step S1, the programming language of the source program is Python language or C language; Further, in step S5, the optimization target expression of the integer linear programming model is:

[0008] wherein J is a set of vector instruction numbers, c add is the delay of addition operation, A j is a binary variable indicating whether the jth vector instruction is an addition instruction, c mul is the delay of multiplication operation, M ja binary variable for whether the jth vector instruction is a multiplication instruction, c rotation R is the delay of the rotate operation, j is the number of rotate instructions required by the jth vector instruction, i.e., the total number of rotate instructions after the merging of rotate operations of the same length caused by different dependency edges; Further, in step S5, the expression of the lane-exclusion constraint is:

[0009] where I is the set of scalar node numbers, N is the set of lane numbers within a single vector instruction, X i,j,n is a binary variable for whether the ith scalar node is mapped to the nth lane of the jth vector instruction; Further, in step S5, the expression of the lane-exclusion constraint is:

[0010] where I is the set of scalar node numbers, N is the set of lane numbers within a single vector instruction, X i,j,n is a binary variable for whether the ith scalar node is mapped to the nth lane of the jth vector instruction; Further, in step S5, the node operation type constraint includes the following sub-constraints:

[0011]

[0012]

[0013]

[0014]

[0015] where OP i is a binary variable for whether the ith scalar node is multiplication or addition, OP i = 1 represents addition, OP i = 0 represents multiplication, and BIGM is a sufficiently large constant used to express the logical constraint; Further, in step S5, the expression of the node dependency constraint is:

[0016] where, is the source node of the dependency edge e, is the destination node of the dependency edge e, is a binary variable for identifying whether the source node is mapped to the nth lane of the jth vector instruction, is a binary variable indicating whether the destination node of the dependency edge e is mapped to the jth vector instruction after the jth vector instruction and the source node and the destination node have a lane offset of l; is a binary variable indicating whether the jth vector instruction is mapped to the nth lane of the dependency edge e; Further, in step S5, the rotation instruction overhead constraint comprises the following sub-constraints:

[0017]

[0018]

[0019]

[0020]

[0021]

[0022]

[0023]

[0024]

[0025]

[0026]

[0027]

[0028] wherein, is a binary variable indicating whether the jth vector instruction needs to perform a rotation instruction with length l; if there is at least one dependency edge e such that = 1, then = 1 to combine the same length l rotation operations caused by different dependency edges into one rotation instruction of the jth vector instruction; wherein LEN is a set of rotation lengths allowed by the ciphertext, is a binary variable indicating that the destination node of the dependency edge e is mapped to the jth vector instruction after the jth vector instruction and the source node and the destination node have a lane offset of l, is a binary variable indicating whether the source node of the dependency edge e is mapped to the jth vector instruction, is a binary variable indicating that the destination node of the dependency edge e is mapped to the jth vector instruction after the jth vector instruction and the source node and the destination node have a lane offset of l, is the number of the vector instruction to which the destination node dst is mapped; Further, in step S5, the optimization operation of pruning the solution space through the ASAP attribute and the ALAP attribute is specifically:

[0029]

[0030] wherein, is the ASAP attribute value of the i-th scalar node, is the ALAP attribute value of the i-th scalar node, is the maximum number of vector instructions, X i,j,n is a binary variable indicating whether the i-th scalar node is mapped to the n-th lane of the j-th vector instruction; Further, in step S6, the homomorphic encryption library of the target hardware backend includes a CPU library SEAL or a GPU library HEonGPU.

[0031] The vectorization method for the homomorphic encryption compiler proposed in the present application at least achieves the following beneficial effects: 1) wider application range: without assumptions and constraints on the input program, the method can support a variety of programs with regular or irregular computing modes and different data reuse degrees, breaking through the limitations of most existing methods that only adapt to regular applications (such as AI workloads); 2) complete automation: no manual intervention operations such as sketches are required, and the vectorization of the FHE program is automatically completed by the compiler, reducing the development threshold; 3) better program performance: compared with the non-vectorized scalar program, the method achieves an average performance improvement of 5.95 times on the CPU side and 3.79 times on the GPU side; and compared with existing vectorization methods (Autovesk, HECO, and Coyote), the method respectively achieves a geometric mean performance improvement of 4.93 times (CPU) and 6.47 times (GPU), 5.20 times (CPU) and 5.11 times (GPU), and 3.05 times (CPU) and 4.19 times (GPU); 4) promoting the application and popularization of FHE technology: the above-mentioned characteristics of supporting a wide range of applications, automation, and high performance reduce the difficulty and cost of FHE program development, and promote the practical application of FHE technology in medical, financial, and other data security-sensitive fields. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 is a flowchart of the vectorization method for the homomorphic encryption compiler of the present application; Figure 2 is a comparison diagram of execution time of the present application and existing vectorization methods on a CPU platform; Figure 3A schematic diagram for comparing the execution time of the present application with that of the existing vectorization method on a GPU platform. DETAILED DESCRIPTION

[0033] The technical content of the present application will be more clearly understood and facilitated to be understood by introducing the preferred embodiments of the present application with reference to the accompanying drawings of the specification. The present application can be embodied in many different forms of embodiments, and the protection scope of the present application is not limited to the embodiments mentioned herein.

[0034] In the drawings, the same components have the same reference numerals, and components having similar structures or functions are denoted by similar reference numerals. The size and thickness of each component shown in the drawings are arbitrarily shown, and the present application is not limited to the size and thickness of each component. In order to make the drawing clearer, the thickness of some components is appropriately exaggerated in some places in the drawing.

[0035] The present application provides a vectorization method for homomorphic encryption compiler, which belongs to the compilation optimization method in the homomorphic encryption compiler and is used to solve the vectorization problem in the homomorphic encryption. The method can generate an efficient homomorphic encryption program by modeling the vectorization problem of FHE as an integer linear programming problem, as shown in the following formula (1). Figure 1 The method comprises the following steps: S1: obtaining a source program for cloud-oriented homomorphic encryption calculation written by a developer, wherein the source program supports addition, subtraction, multiplication operations, and loop structures whose loop boundaries are known at the time of compilation; and the programming language of the source program is Python language or C language; S2: converting the source program into an intermediate representation through a compiler front end corresponding to the source program; and performing loop unrolling optimization on the intermediate representation to obtain a scalar intermediate representation without control flow; S3: converting the scalar intermediate representation into a directed acyclic graph G(V, E), wherein V is a node set, each node corresponds to a scalar instruction in the intermediate representation, and E is an edge set, each edge corresponds to a dependency relationship between scalar instructions; S4: calculating the ASAP attribute and the ALAP attribute of each node in the directed acyclic graph by using the ASAP scheduling algorithm and the ALAP scheduling algorithm; and determining the maximum lane width required by the directed acyclic graph, wherein the maximum lane width is the maximum number of nodes allowed to be mapped to the same vector instruction in the directed acyclic graph; S5: constructing an integer linear programming model based on the ASAP attribute, the ALAP attribute, and the maximum lane width; wherein the integer linear programming model aims to minimize the delay of the program after vectorization, and comprises node exclusive constraints, lane exclusive constraints, node operation type constraints, node dependency constraints, and rotation instruction overhead constraints.

[0036] S51: optimization target and constraint condition

[0037] S511: optimization objective

[0038] The optimization objective of the present application is to minimize the vectorized program latency, which is expressed as follows:

[0039] where J is the set of vector instruction numbers, c add is the latency of addition operation, A j is a binary variable indicating whether the jthvector instruction is an addition instruction, c mul is the latency of multiplication operation, M j is a binary variable indicating whether the jthvector instruction is a multiplication instruction, c rotation is the latency of rotation operation, R j is the number of rotation instructions required by the jthvector instruction, i.e., the total number of rotation instructions after the merging of rotation operations of the same length caused by different dependency edges.

[0040] S52: constraint condition

[0041] S521: node exclusive constraint, each scalar node can only be mapped to one lane of one vector instruction, ensuring no duplicate mapping, which is expressed as:

[0042] where I is the set of scalar node numbers, N is the set of lane numbers within a single vector instruction, is a binary variable indicating whether the ithscalar node is mapped to the nthlane of the jthvector instruction.

[0043] S522: lane exclusive constraint, each lane of each vector instruction can only be mapped to one scalar node, avoiding lane resource conflicts, which is expressed as:

[0044] The symbol definitions are the same as above; S523: node operation type constraint Each vector instruction can only be for a single operation type: addition, multiplication, or empty instruction, and the operation type of the mapped scalar node is consistent with the instruction type,

[0045] If the current vector instruction is not mapped by any scalar node, the instruction is an empty instruction.

[0046]

[0047] If at least one of the scalar nodes is mapped into a vector instruction, the vector instruction is either an addition instruction or a multiplication instruction. BIGM is a large enough constant for expressing logical constraints.

[0048]

[0049] The specific vector instruction is either an addition instruction or a multiplication instruction, which is determined by the operation type of the scalar nodes mapped into the vector instruction.

[0050]

[0051]

[0052] where OP i is a binary variable indicating whether the ithscalar node is a multiplication or an addition, OP i = 1 indicates an addition, OP i = 0 indicates a multiplication, and BIGM is a large enough constant for expressing logical constraints.

[0053] S524: Node dependency constraint, for each dependency edge in the input directed acyclic graph, the vector instruction mapped by the destination node is after the vector instruction mapped by the source node, and the expression is:

[0054] where, is the source node of the dependency edge e, is the destination node of the dependency edge e, is a binary variable indicating whether the source node is mapped into the nthlane of the jthvector instruction, is a binary variable indicating whether the destination node is mapped into the nthlane of the jthvector instruction; S525: Rotation instruction overhead constraint, the rotation instruction is performed on the output ciphertext of each vector instruction, and therefore the number of rotation instructions required for each vector instruction is calculated, and a binary variable is introduced to indicate whether the jthvector instruction needs a rotation of length l,

[0055]

[0056] For the same ciphertext, rotation operations caused by different dependency edges but of the same length can be combined into one rotation instruction. A binary variable is used to indicate whether the jthvector instruction needs a rotation of length l due to the requirement of edge e, where, a binary variable to identify whether the jth vector instruction needs to execute a rotate instruction with length l; if there is at least one dependent edge such that =1, then =1 to combine the rotate operations with the same length l caused by different dependent edges into one rotate instruction of the jth vector instruction,

[0057]

[0058] The binary variable E j,e,l is 1: 1) for each edge e, its source node maps to the jth vector instruction. Use to represent that the constraint is satisfied; 2) for each edge e, its destination node maps to any instruction after the jth vector instruction, and the lane offset between the source node and the destination node is exactly l, and l is not equal to 0, and define the variable t j,e,l to represent that the constraint is satisfied,

[0059]

[0060]

[0061]

[0062]

[0063]

[0064]

[0065]

[0066] wherein LEN is a set of rotation lengths allowed by the ciphertext, is a binary variable to identify that the destination node of the dependent edge e maps to the jth vector instruction after the jth vector instruction and the source node maps to the jth vector instruction, is a binary variable to identify whether the source node of the dependent edge e maps to the jth vector instruction, is a binary variable to identify that the destination node of the dependent edge e maps to the jth vector instruction after the jth vector instruction and the source node maps to the jth vector instruction, is the number of the vector instruction to which the destination node dst maps.

[0067] S53: solve space clipping

[0068] The optimization operation is a key supplement to the integer linear programming model construction stage, and the impossible solution space is pruned by introducing ALAP and ASAP attributes to reduce the model solving time, specifically:

[0069]

[0070] wherein, is the ASAP attribute value of the i-th scalar node, is the ALAP attribute value of the i-th scalar node, is the maximum number of vector instructions, X i,j,n is a binary variable indicating whether the i-th scalar node is mapped to the n-th lane of the j-th vector instruction.

[0071] S6: solving the integer linear programming model, generating a vectorized homomorphic encryption program according to the solving result (i.e. the mapping relationship of the scalar node to the vector instruction lane) and the homomorphic encryption library of the target hardware backend; the homomorphic encryption library of the target hardware backend includes the CPU library SEAL or the GPU library HEonGPU.

[0072] To evaluate the technical effect of the present application, test cases used in Coyote are selected, including various kernels with regular and irregular calculation modes and different data reuse degrees, BFV is used as the target FHE scheme, and test environments are built based on CPU (with SEAL library) and GPU (with HEonGPU library) respectively.

[0073] The experiment takes the "average execution time of the program" as the evaluation index, and each vectorized program is run 10 times and the average execution time is taken to reduce the measurement error. The comparison objects include the non-vectorized scalar program, the traditional SIMD vectorization method (Autovesk), and the existing FHE compiler vectorization method (HECO, Coyote), and the experimental results are as shown in Figures 2-3 1. Compared with the non-vectorized scalar program: The present application realizes an average performance improvement of 5.95 times on the CPU side and an average performance improvement of 3.79 times on the GPU side.

[0074] 2. Compared with the existing vectorization method: 2.1 Compared with Autovesk: Autovesk is a vectorization method for traditional SIMD architecture, which does not fully consider the influence of high-overhead rotation operation in FHE, so the present application realizes a geometric mean acceleration of 4.93 times on the CPU side and a geometric mean acceleration of 6.47 times on the GPU side; ​2.2 Compared with HECO: HECO does not consider the influence of data layout, resulting in poor performance, so the present application realizes 5.20 times of geometric mean acceleration on the CPU side and 5.11 times of geometric mean acceleration on the GPU side; 2.3 Compared with Coyote: the method of local search adopted by Coyote limits its performance, and the present application realizes 3.05 times of geometric mean acceleration on the CPU side and 4.19 times of geometric mean acceleration on the GPU side.

[0075] The above describes the preferred embodiments of the present application in detail. It should be understood that those of ordinary skill in the art can make many modifications and changes without creative labor based on the concept of the present application. Therefore, any technical solutions obtained by logical analysis, reasoning or limited experiments based on the prior art according to the concept of the present application shall be within the protection scope defined by the claims.

Claims

1. A vectorization method for homomorphic encryption compilers, characterized in that, The method includes the following steps: S1: Obtain the source code written by the developers for cloud-based homomorphic encrypted computation, which supports addition, subtraction, multiplication operations and loop structures with loop boundaries known at compile time; S2: The source program is converted into an intermediate representation through the compiler front-end corresponding to the source program; loop unrolling optimization is performed on the intermediate representation to obtain a scalar intermediate representation without control flow; S3: Convert the scalar intermediate representation into a directed acyclic graph G(V,E), where V is a set of nodes, each node corresponds to a scalar instruction in the intermediate representation, and E is a set of edges, each edge corresponds to the dependency relationship between scalar instructions; S4: Using the ASAP scheduling algorithm and the ALAP scheduling algorithm, calculate the ASAP attribute and ALAP attribute of each node in the directed acyclic graph; determine the maximum lane width required for the directed acyclic graph, where the maximum lane width is the maximum number of nodes in the directed acyclic graph that are allowed to be mapped to the same vector instruction; S5: Based on the ASAP attribute, ALAP attribute and maximum lane width, construct an integer linear programming model; the integer linear programming model aims to minimize the latency of the vectorized program, and includes node exclusive constraints, lane exclusive constraints, node operation type constraints, node dependency constraints and rotation command overhead constraints, and also includes optimization operations to prune the solution space through ASAP attribute and ALAP attribute. S6: Solve the integer linear programming model, and generate a vectorized homomorphic encryption program based on the solution results and the homomorphic encryption library of the target hardware backend.

2. The vectorization method for homomorphic encryption compilers as described in claim 1, characterized in that, In step S1, the programming language of the source program is Python or C.

3. The vectorization method for homomorphic encryption compilers as described in claim 1, characterized in that, In step S5, the optimization objective expression of the integer linear programming model is: Where J is the set of vector instruction numbers, c add For the delay of the addition operation, A j c is a binary variable indicating whether the j-th vector instruction is an addition instruction. mul M is the delay for the multiplication operation. j c is a binary variable indicating whether the j-th vector instruction is a multiplication instruction. rotation For the delay of the rotation operation, R j The number of rotation instructions required for the j-th vector instruction is the total number of rotation instructions after merging rotation operations of the same length caused by different dependent edges.

4. The vectorization method for homomorphic encryption compilers as described in claim 1, characterized in that, In step S5, the expression for the node exclusive constraint is: Where I is the set of scalar node numbers, N is the set of lane numbers within a single vector command, and X i,j,n Let i be a binary variable indicating whether the i-th scalar node is mapped to the n-th lane of the j-th vector instruction.

5. The vectorization method for homomorphic encryption compilers as described in claim 1, characterized in that, In step S5, the expression for the lane occupancy constraint is: Where I is the set of scalar node numbers, N is the set of lane numbers within a single vector command, and X i,j,n Let i be a binary variable indicating whether the i-th scalar node is mapped to the n-th lane of the j-th vector instruction.

6. The vectorization method for homomorphic encryption compilers as described in claim 1, characterized in that, In step S5, the node operation type constraint includes the following sub-constraints: Among them, OP i For the i-th scalar node to be a binary variable that performs multiplication or addition, OP i =1 represents addition, OP i =0 indicates multiplication, and BIGM is a sufficiently large constant used to express logical constraints.

7. The vectorization method for homomorphic encryption compilers as described in claim 1, characterized in that, In step S5, the expression for the node dependency constraint is: in, For the source node that depends on edge e, For the destination node dependent on edge e, To identify the source node Whether it maps to the binary variable of the nth lane of the j-th vector instruction. To identify the destination node Whether it is mapped to the binary variable of the nth lane of the j-th vector instruction.

8. The vectorization method for homomorphic encryption compilers as described in claim 1, characterized in that, In step S5, the rotation command overhead constraint includes the following sub-constraints: in, A binary variable to identify whether the j-th vector instruction requires a rotation instruction of length l; if there is at least one dependent edge. Make =1, then =1, so as to combine rotation operations of the same length l caused by different dependent edges into a single rotation instruction of the j-th vector instruction; Where LEN is the set of allowed rotation lengths for the ciphertext. To identify the binary variable that identifies the destination node and source node of dependent edge e with lane offset l, where the source node is mapped to the j-th vector instruction and the destination node is mapped to the j-th vector instruction, To identify whether the source node of dependent edge e is mapped to the j-th vector instruction, Let e ​​be a binary variable that identifies the destination node of dependent edge e after the j-th vector instruction, and where the lane offset between the source node and the destination node is l. The vector instruction number mapped to the destination node dst.

9. The vectorization method for homomorphic encryption compilers as described in claim 1, characterized in that, In step S5, the optimization operation of pruning the solution space using ASAP and ALAP attributes specifically includes: in, Let be the ASAP attribute value of the i-th scalar node. Let be the ALAP attribute value of the i-th scalar node. X is the maximum number of vector instructions. i,j,n Let i be a binary variable indicating whether the i-th scalar node is mapped to the n-th lane of the j-th vector instruction.

10. The vectorization method for homomorphic encryption compilers as described in claim 1, characterized in that, In step S6, the homomorphic encryption library of the target hardware backend includes the CPU library SEAL or the GPU library HEonGPU.

Images