A parallel processing system and method for CKKS fully homomorphic encryption key switching

Abstract

This invention discloses a parallel processing system and method for CKKS fully homomorphic cryptography key switching. The system includes an NTT processing unit, a parallel modular reduction hardware unit, a base transformation parallel processing hardware unit, a point-value multiplication unit, and a control unit. The parallel modular reduction hardware unit contains L+1 parallel operation units, each including a shift-addition module, an accumulation module, and a Barrett modular reduction module. It utilizes a special form of small modulus property to convert multiplication into shift and addition operations, performing modular reduction of RNS base extension in parallel. The base transformation parallel processing hardware unit includes an inverse pre-computation module, a temporary matrix calculation module, a matrix multiplication module, and a storage unit. It accelerates base transformation through a parallel Barrett modular multiplication unit and a multiply-accumulate operation array. This invention decomposes large integer modular operations into multiple independent small modulus operations, avoiding carry chain delays and significantly accelerating key switching efficiency while saving hardware resources.

Description

Technical Field

[0001] This invention relates to the field of fully homomorphic encryption technology, and in particular to a parallel processing system and method for CKKS fully homomorphic cryptography key switching. Background Technology

[0002] With increasing concern for data privacy and integrity, fully homomorphic encryption (FHE) technology, as one of the most important and promising privacy protection technologies, is being applied in various privacy computing scenarios. Current classic CKKS-type fully homomorphic cryptographic algorithms support efficient Single Instruction-Multiple-Data (SIMD) homomorphic operations, such as homomorphic addition and homomorphic multiplication, becoming a mainstream solution for privacy-preserving machine learning. SIMD operations package multiple plaintext messages into a single ciphertext, and operations on these plaintexts can be performed using homomorphic addition or homomorphic multiplication.

[0003] In CKKS-type fully homomorphic cryptography, the ciphertext data is all polynomial, and the basic operations in the algorithm correspond to modular addition and modular multiplication of polynomials. Because the parameters chosen for the algorithm need to meet 128-bit or higher security requirements, the ciphertext modulus Q typically needs to be hundreds to thousands of bits wide. To avoid performing large integer modular multiplication operations at such high bit widths, and to further utilize the parallelism of the algorithm hierarchy, the CKKS scheme widely employs the Residue Number System (RNS) technique to divide the large modulus Q into several smaller moduli. (i.e., remainder base) is used for processing. Each small modulus... A prime number modulus of tens of bits can be selected, and the modular Q polynomial can be represented using RNS, reducing the computational bit length of polynomial operations. RNS is a non-carrying number system based on the Chinese Remainder Theorem (CRT), which consists of a set of independent remainder bases. It is confirmed that the elements in the remainder base are pairwise coprime. Modulus M The product of the remainder bases, Modulus M Integers in the range a This can be represented by RNS as ,in They are integers a right The remainder.

[0004] CKKS-type fully homomorphic cryptography involves a complex homomorphic operation—key switching. This operation, used in homomorphic multiplication, reduces the expanded ciphertext dimension from three terms to two. The key switching process involves calculating polynomial modular addition and modular multiplication between the key and ciphertext, which is essentially a polynomial operation. In CKKS-type fully homomorphic cryptography algorithms, the key switching operation accounts for over 80% of the total computation time. Therefore, accelerating the key switching operation is crucial for improving the efficiency of the CKKS algorithm.

[0005] Key switching algorithms, specifically those in CKKS-type fully homomorphic algorithms, allow the direct conversion of ciphertext encrypted with one key into ciphertext encrypted with another key without prior decryption. This can be applied to homomorphic multiplication and automorphic operations. Specifically, if one key... and the corresponding ciphertext encrypted with the public key. and a conversion key KeySwitch can transmit encrypted data. Transform into ciphertext encrypted with key s and the corresponding public key. .

[0006] When the KeySwitch algorithm is used in homomorphic multiplication, the ciphertext produced by the homomorphic multiplication operation is: The generated relinear key is The final ciphertext obtained is When used in automorphism operations, such as rotation operations, the resulting ciphertext... The rotation key is The final ciphertext obtained is .

[0007] The core process of key transformation in the CKKS-type fully homomorphic cryptographic algorithm is as follows: Figure 3 As shown. Figure 3 Steps ①, ③, ⑤, and ⑦ correspond to the conversion between the coefficient form and the point-value form of the polynomial. However, when the ciphertext polynomial is used to compute homomorphic multiplication, the key conversion is necessary. Its modulus space is larger than the original ciphertext space, therefore the KeySwitch algorithm needs to convert a certain component of the ciphertext, such as... or Extended using the radix conversion algorithm (ModUp operation), corresponding Figure 3 The sub-operation in step ②; then multiply the expanded result by the conversion key evk, corresponding to... Figure 3 Step ④ (ModMult operation, completed by the point-value multiplication unit); then the product result is transformed to base transformation algorithm. (ModDown operation) yields temporary ciphertext, corresponding to Figure 3 The sub-operation of step ⑥ in the process; finally, the ciphertext is... With other ciphertext components (or Add the corresponding ones, corresponding ones Figure 3 Step ⑧ (ModAdd operation) yields the correct result of the ciphertext homomorphic multiplication. Before performing the key switching operation, the coefficient polynomial needs to be converted into a two-dimensional matrix in RNS representation. When the modulus representation chosen by the CKKS-type fully homomorphic cryptographic algorithm scheme is... , where each modulus All are prime numbers with tens of bits. In RNS bases The coefficient polynomial can be represented as follows: Represented as a size of ( L +1)× N Two-dimensional matrix , where the matrix's first i row representation Each modulus The coefficient polynomial below; and the first i Line 1 j Columns are elements , representing the coefficient terms of the polynomial. In the process of converting the coefficient polynomial to RNS representation, it is necessary to handle each large coefficient term... Perform modulo reduction and calculation Due to the original polynomial coefficients They are all models Q Large integers within a certain range, when calculated using the Barrett modulo reduction algorithm At that time, among them Much larger Processing extremely large numbers The cyclic shift operation results in very low computational efficiency. Existing technologies have failed to fully utilize the parallel characteristics of RNS and have not designed hardware parallel channels that match the number of small moduli, resulting in long RNS representation conversion processes and becoming one of the performance bottlenecks of key switching operations.

[0008] In the CKKS type fully homomorphic cryptographic algorithm, as shown in the appendix Figure 3The sub-operations in the key switching shown include computationally complex steps ② (ModUp algorithm) and ⑥ (ModDown algorithm). Both sub-operations use the base conversion (BConv) function to perform their respective calculations. In RNS representation, the base conversion function transforms the representation of a polynomial under different RNS bases. During the base conversion process, since the modulus of each row of operations is independent, there is no data dependency between the rows of operations, allowing for parallel execution. However, existing technologies lack effective parallel computing structures to simultaneously process the operations of each RNS channel, and there is no reasonable pre-storage and fast access optimization for the inverse values, resulting in low computational efficiency. Summary of the Invention

[0009] To address the above problems, this invention provides a parallel processing system for CKKS fully homomorphic cryptography key switching, the specific technical solution of which is as follows: The system includes an NTT processing unit that converts the encrypted polynomial between coefficient form and point-value form; The parallel modular reduction hardware unit includes L+1 parallel operation units. Each operation unit includes a shift-add module, an accumulation module, and a Barrett modular reduction module. The shift-add module is configured to convert multiplication operations into shift and addition operations by utilizing the properties of special small modulo numbers. The L+1 parallel operation units are configured to perform the modular reduction operation of the intermediate large integers required for RNS base extension in parallel. The hardware unit for parallel processing of base transformation includes an inverse pre-computation module, a temporary matrix calculation module, a matrix multiplication module, and a storage unit. The inverse pre-computation module includes L+1 parallel Barrett modular multiplication units, the matrix multiplication module includes multiple multiply-accumulate operation arrays, and the storage unit is configured to store the pre-computed inverse values ​​and transformation matrices in close proximity. The dot-valued multiplication unit performs a dot-valued multiplication operation between the ciphertext polynomial under the extended RNS basis and the transformation key. The control unit coordinates the data flow of the parallel modulo reduction hardware unit and the base conversion parallel processing hardware unit, and is configured to reuse the parallel modulo reduction hardware unit and the base conversion parallel processing hardware unit in the ModDown operation. When the system performs a key switching operation, it sequentially completes data processing through the NTT processing unit, the parallel modular reduction hardware unit, the base conversion parallel processing hardware unit, the point value multiplication unit, the base conversion parallel processing hardware unit, the parallel modular reduction hardware unit, and the NTT processing unit.

[0010] Furthermore, the parallel modular reduction hardware unit performs the modular reduction operation of the RNS basis extension, including: The intermediate large integers required for RNS basis expansion are decomposed into basis S, which is determined by the small moduli in the original RNS basis. The shift-add module converts the multiplication operation under the radix S representation into shift and addition operations based on the properties of the special form of small modulus, and obtains the results of each component. The accumulation module receives the results of each component and performs accumulation processing to obtain the accumulated sum; The Barrett modular reduction module receives the accumulated sum data and performs modular reduction operations to obtain the modular operation result after RNS basis expansion.

[0011] Furthermore, the process of decomposing the intermediate large integer into a radix S includes: make , ,in, For small moduli in the RNS base; Large coefficient terms Using the radix S, it is represented as ,in .

[0012] Furthermore, the special form of small module is The form is , where n is a positive integer.

[0013] Furthermore, the conversion of multiplication operations into shift and addition operations includes: based on The binomial expansion property will Multiplication operations are converted into shift and addition operations; When the selected modulus for In this case, increase the step size for shift and addition calculations.

[0014] Furthermore, the basis conversion parallel processing hardware unit performs basis conversion operations including: The inverse pre-computation module uses L+1 parallel Barrett modular multiplication units to calculate the inverse values ​​of each RNS base small module in parallel and store them in the storage unit. The inverse calculation uses Fermat's Little Theorem to transform the inverse into a modular exponentiation problem. The temporary matrix calculation module calls the inverse value in the storage unit to calculate each element of the temporary matrix in parallel, wherein there is no data dependency between the operations of each row; the modulo reduction operation in the temporary matrix calculation module reuses the Barrett modulo reduction module in the parallel modulo reduction hardware unit; The parallel computation of the inverse value under each RNS basis small modulus includes: calculate ,in , It is a small module in the original RNS base.

[0015] Due to the modulus of each row Independent of each other, the L+1 parallel Barrett modular multiplication units perform pre-computation in parallel and store the results in the nearest storage unit; The elements of the parallel computation temporary matrix include: Each row of the two-dimensional matrix output by the parallel modular reduction hardware unit is multiplied by the inverse value pre-stored in the storage unit. Modular reduction is performed on each dot product result, and there is no data dependency between the operations in each row; The L+1 Barrett modulo reduction modules in the parallel modulo reduction hardware unit are reused to perform the modulo reduction operation; The transformation matrix is ​​pre-calculated and stored using multiple multiply-accumulate operation arrays in the matrix multiplication module, and the matrix-vector inner product operation is performed in parallel to obtain the polynomial matrix under the target RNS basis.

[0016] Furthermore, matrix-vector inner product operations are performed in parallel using multiple multiply-accumulate arrays, including: Calculation by The transformation matrix is ​​composed of, where For small moduli in the target RNS basis; The transformation matrix is ​​pre-calculated by the parallel modular reduction hardware unit and stored in the fast access area of ​​the storage unit; The multiplication operation between the transformation matrix and the temporary matrix is ​​divided into a matrix-vector inner product; The multiple multiply-accumulate arrays perform the inner product operation in parallel to obtain the polynomial matrix under the target RNS basis.

[0017] This invention also provides a parallel processing method for CKKS fully homomorphic cryptography key switching. Based on the above-described parallel processing system, the parallel processing method includes: The NTT processing unit converts the encrypted polynomial from coefficient form to point value form. The control unit schedules the parallel modular reduction hardware unit, and uses the L+1 parallel computing units to perform the modular reduction operation of the intermediate large integer required for RNS base extension in parallel, converting the intermediate large integer into the extended RNS base representation; The control unit schedules the basis transformation parallel processing hardware unit, and uses the inverse pre-computation module, temporary matrix calculation module and matrix multiplication module to complete the basis transformation operation in parallel, transforming the extended ciphertext polynomial to the target RNS basis representation. The point-value multiplication unit performs a point-value multiplication operation between the ciphertext polynomial under the extended RNS basis and the transformation key. By reusing the parallel modulo reduction hardware unit and the basis conversion parallel processing hardware unit in the control unit, the ModDown operation is performed to convert the product result from the extended RNS basis back to the original RNS basis. The NTT processing unit converts the result from point value form to coefficient form to complete the key switching.

[0018] Furthermore, the modulo reduction operation of the intermediate large integers required for the parallel execution of the RNS base extension includes: The shift-add module is controlled to convert multiplication operations into shift and addition operations by utilizing the properties of a special type of small module; The accumulation module is controlled to accumulate the results of the shift addition. The Barrett modular reduction module is controlled to perform modular reduction on the accumulated result to obtain the modular operation result.

[0019] Furthermore, the parallel completion of the base transformation operation includes: The L+1 parallel Barrett modular multiplication units in the inverse pre-computation module are controlled to calculate and store the inverse values ​​in parallel. The temporary matrix calculation module is controlled to call pre-stored inverse values ​​to calculate the temporary matrix in parallel; The matrix multiplication module controls the multiply-accumulate operation array to perform matrix-vector inner product operations in parallel.

[0020] The beneficial effects of this invention are as follows: 1. This invention utilizes RNS technology to design a parallel processing system, decomposing the large integer modulo operation in fully homomorphic cryptography into multiple independent operations under smaller modulo operations. These smaller modulo operations are independent of carry dependencies and can be fully parallelized in hardware, avoiding the carry chain delay of large integer operations. A hardware unit capable of parallel processing of modulo reduction under RNS representation is designed, along with a parallel computing structure for calculating the intermediate data matrix during the base transformation sub-operation. This saves hardware resources while accelerating the execution efficiency of some sub-operations in key switching.

[0021] 2. The hardware unit for parallel processing of modulo reduction in this invention significantly reduces the computational complexity of modulo reduction by decomposing the large integer in the middle into a radix S representation and using the properties of small modulo numbers in a special form to convert multiplication operations into shift and addition operations. The L+1 parallel processing units match the number of small modulo numbers in the RNS radix, achieving true hardware parallel acceleration, improving the speed of RNS representation conversion, and solving the problem of long preprocessing time for ModUp and ModDown operations in key switching.

[0022] 3. This invention achieves parallel computation of inverses through L+1 parallel Barrett modular multiplication units in the inverse pre-computation module, reduces access latency through a proximity storage strategy, and achieves parallel matrix-vector inner product operations through a multiply-accumulate operation array. This structure fully utilizes the data-independent nature of operations in each row of RNS, significantly improving the computational efficiency of basis transformations. Attached Figure Description

[0023] Figure 1 This is a schematic diagram of a parallel modular reduction hardware unit computing architecture.

[0024] Figure 2 This is a schematic diagram of the hardware unit computing architecture for base-conversion parallel processing.

[0025] Figure 3 This is a schematic diagram of the core process of key switching. Detailed Implementation

[0026] The technical solutions in the embodiments of the present invention are clearly and completely described in the following description. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0027] In the description of the embodiments of the present invention, it should be noted that the indicated orientation or positional relationship is based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship in which the product of the invention is conventionally placed during use, or the orientation or positional relationship in which those skilled in the art conventionally understand it during use. This is only for the convenience of describing the present invention and simplifying the description, and is not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, it should not be construed as a limitation of the present invention. Furthermore, the terms "first" and "second" are only used to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0028] In the description of the embodiments of the present invention, it should also be noted that, unless otherwise explicitly specified and limited, the terms "set" and "connection" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a direct connection or an indirect connection through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms in the present invention based on the specific circumstances.

[0029] Example 1 Embodiment 1 of the present invention discloses a parallel processing system for CKKS fully homomorphic cryptography key switching, including an NTT processing unit, a parallel modular reduction hardware unit, a base conversion parallel processing hardware unit, a point-value multiplication unit, and a control unit.

[0030] The NTT processing unit performs the conversion between the coefficient form and the point-value form of the polynomial for the key switching operation. At the start of the key switching operation, the NTT processing unit receives the ciphertext polynomial in coefficient form; this ciphertext polynomial is based on the RNS base... The following is a two-dimensional matrix. , where the matrix's first i Row representation polynomial Each modulus The coefficient polynomial under the following conditions, the first i Line 1 j Column elements The first polynomial represents the second polynomial. j Each coefficient term pair The remainder, that is , represents the coefficient terms of the polynomial.

[0031] The NTT processing unit performs an independent NTT transformation on each RNS channel, converting the coefficient form to the point value form. Specifically, for each small module... ,implement: ,in, for The transformation is based on the primitive root of unity, which allows subsequent homomorphic multiplication to be performed point-by-point in the point domain.

[0032] The NTT transformation converts polynomial multiplication from convolution to pointwise multiplication, significantly reducing computational complexity. It also facilitates the use of the parallelism of RNS technology, providing a data foundation for subsequent parallel modular reduction and basis transformation operations.

[0033] like Figure 1 As shown, the parallel modular reduction hardware unit contains L+1 parallel computing units, each computing unit corresponding to a small modulus in the RNS basis. Each processing unit contains three functional modules: Shift-add module: configured to convert multiplication operations into shift-add operations by utilizing the properties of special small modulo operations; Accumulation module: receives the results of each component output by the shift-add module, performs accumulation operations to obtain the accumulated sum; Barrett modulo reduction module: performs the Barrett modulo reduction algorithm on the accumulated sum to obtain the final modulo operation result.

[0034] The L+1 parallel processing units are completely independent in hardware, with no carry dependency, and can simultaneously handle modular reduction operations under different small modulo values. Each dashed box represents a processing unit. The calculation of converting polynomial coefficients to RNS representation is performed in parallel within the L+1 processing units, and the matrix is ​​calculated. Each element in . By using an architecture design with L+1 parallel computing units, large integer modulo operations are decomposed into multiple independent operations under smaller modulo values, avoiding carry chain latency in large integer operations and achieving true hardware parallel acceleration.

[0035] The parallel modular reduction hardware unit performs modular reduction operations for RNS base expansion by: decomposing the intermediate large integers required for RNS base expansion into radix S representations; converting multiplication operations under the radix S representations into shift and addition operations based on the properties of special form small modulo numbers through the shift and addition module; receiving the results of each component and performing accumulation processing through the accumulation module; and receiving the accumulated sum data and performing modular reduction operations through the Barrett modular reduction module.

[0036] Specifically as follows: When the modulus chosen by the CKKS-type fully homomorphic cryptographic algorithm scheme is represented as , where each modulus All are prime numbers with tens of bits. In RNS bases The coefficient polynomial can be represented as follows: Represented as a size of Two-dimensional matrix , where the matrix's first i Line 1 j Columns are elements For terms with large coefficients Modular reduction operations are optimized as follows: First of all, let , It can Using the radix S, it is represented as ,in .

[0037] Then, calculate Furthermore, it can be Represented as:

[0038] Will As input to the Barrett modular reduction algorithm, the corresponding modular reduction operation is performed to obtain the final calculation result.

[0039] Due to the selected small module The special characteristics, such as when each small module is selected At that time, there is As for multiplication terms ,use Due to its special characteristics, multiplication can be converted into shift and addition operations. The binomial expansion is: ,therefore When the selected modulus Therefore, the step size for shift and addition calculations needs to be increased accordingly.

[0040] L+1 parallel processing units start simultaneously, each unit independently processing its corresponding small modulus. Modular reduction and subtraction operations are performed in parallel across multiple computational units to complete the above calculation process.

[0041] like Figure 2 As shown, the base conversion parallel processing hardware unit includes the following functional modules: Inverse pre-computation module: Contains L+1 parallel Barrett modular multiplication units for parallel computation of the inverse values ​​required for basis transformations. Due to the modularity... Since they are all prime numbers, Fermat's Little Theorem can be used to transform the modular inverse problem into a modular exponentiation problem. Furthermore, because the modulus of each row's operation... If all operations are independent, there is no data dependency between the operations performed in each row. The Barrett modular multiplication unit can be used for pre-computation in parallel operation and stored in the nearest storage unit.

[0042] Temporary matrix calculation module: This module calls the pre-stored inverse values ​​in the memory unit to calculate each element of the temporary matrix V in parallel. Calculating the temporary matrix V is equivalent to calculating a two-dimensional matrix using the parallel modular reduction hardware unit. Each row is dot-multiplied by the value pre-stored in the storage unit. The value is then modulo-reduction, and there is still no data dependency between the operations in each row.

[0043] Matrix multiplication module: Contains multiple multiply-accumulate operation arrays, each array containing a multiplier and a Barrett modulo reducer, for parallel execution of matrix-vector inner product operations.

[0044] Storage unit: Configured to store pre-computed inverse values ​​and transformation matrices nearby, supporting fast access and reducing data transfer latency.

[0045] By parallelizing the inverse pre-computation module and employing a proximity-based storage strategy, the bottleneck issues of inverse computation and storage access in basis transformation are resolved. The multiplication-accumulation operation array of the matrix multiplication module enables parallel computation of matrix-vector inner products, accelerating the execution efficiency of the core ModUp and ModDown steps in key switching.

[0046] In RNS representation, basis transformation functions are used to transform the representation of a polynomial under different RNS bases, for example, transforming a ring polynomial. At the base The following indicates Transform to base The following indicates The basis transformation process is represented as follows: , : .

[0047] The radix conversion parallel processing hardware unit can be divided into two steps during the radix conversion operation, as follows: First, calculate the temporary matrix. The details are as follows: For value Due to the modulus Since they are all prime numbers, Fermat's Little Theorem can be used to transform the modular inverse problem into a modular exponentiation problem. Furthermore, because the modulus of each row's operation... Since all operations are independent, there is no data dependency between the operations performed in each row. Pre-computation is performed by the parallel Barrett modular multiplication unit, and the results are stored in the nearest memory unit. In this embodiment, in addition to the multiplier design, the modular reduction and cancellation operations in the Barrett modular multiplication unit can be reused. Figure 1 The diagram shows L+1 Barrett modular reduction modules; Calculating the temporary matrix V is equivalent to using a two-dimensional matrix. Each row is dot-multiplied by the value pre-stored in the storage unit. The value is then reduced modulo by another value, and there is still no data dependency between the operations in each row. This calculation process can continue to reuse L+1 parallel Barrett modular multiplication units, saving hardware resources while achieving parallel acceleration of computation.

[0048] Next is the calculation. The value of . Essentially, it can be viewed as the multiplication of two matrices, that is, a product of . The size of the composition is Matrix multiplication by size The temporary matrix V is used to obtain the base matrix. The following represents the RNS polynomial matrix. The size of the matrix is The matrix. Matrices can be used Figure 1 The parallel structure shown is pre-computed and stored in nearby memory for fast access. The modulus at this point is the new modulus base. The various small modules in the calculation are therefore obtained. The size of the matrix is .

[0049] Finally, the multiplication of two matrices can be divided into matrix-vector inner product, and then multiple arrays of multiply-accumulate operations containing Barrett modulo reduction can be used to complete the operation in parallel.

[0050] After the ModUp operation is completed, the ciphertext polynomial is expanded to the extended RNS basis and represented in point-value form. The point-value multiplication unit receives the expanded ciphertext polynomial point-value vector and the point-value representation of the transformation key evk, and performs point-by-point multiplication at each small modulus of the extended RNS basis. Since the multiplication in the point-value domain is element-wise, this unit can be implemented using a simple parallel multiplier array, with each RNS channel executing independently.

[0051] The control unit generates control signals based on the key switching process (ModUp → Dot-value multiplication → ModDown) to schedule the work of each hardware unit: In the ModUp phase, the control unit starts the parallel modular reduction hardware unit to perform RNS base expansion, and then schedules the base conversion parallel processing hardware unit to complete the base conversion; in the dot-value multiplication phase, the control unit starts the dot-value multiplication unit; in the ModDown phase, the control unit reuses the parallel modular reduction hardware unit and the base conversion parallel processing hardware unit to perform the conversion from the expanded RNS base back to the original RNS base.

[0052] The reuse mechanism is achieved by dynamically configuring the working mode of each module: the parallel modulo reduction hardware unit performs the same modulo reduction operation in ModUp and ModDown; the basis conversion parallel processing hardware unit performs basis conversion operations in opposite directions in ModUp and ModDown.

[0053] By unifying the scheduling of control units and reusing hardware units, hardware resources are significantly saved, avoiding the area and power consumption overhead caused by configuring separate hardware for ModUp and ModDown.

[0054] Example 2 Embodiment 2 of the present invention discloses a parallel processing method for CKKS fully homomorphic cryptography key switching, based on the parallel processing system described in Embodiment 1 above, specifically as follows: The NTT processing unit converts the encrypted polynomial from coefficient form to point value form. Specifically, after system initialization, the control unit loads the RNS base parameters. Configuration information such as extended basis parameters and transformation key evk is pre-calculated and stored, along with inverse values ​​and transformation matrices. The control unit receives the input encrypted polynomial and schedules the NTT processing unit to perform a forward NTT transformation.

[0055] The control unit schedules the parallel modular reduction hardware unit, and uses the L+1 parallel computing units to perform the modular reduction operation of the intermediate large integer required for RNS base extension in parallel, converting the intermediate large integer into the extended RNS base representation.

[0056] In a preferred embodiment, the modulo reduction operation of the intermediate large integers required for parallel execution of RNS base expansion includes: The shift-add module is controlled to convert multiplication operations into shift and addition operations by utilizing the properties of a special type of small module; The accumulation module is controlled to accumulate the results of the shift addition. The Barrett modular reduction module is controlled to perform modular reduction on the accumulated result to obtain the modular operation result.

[0057] The control unit schedules the basis transformation parallel processing hardware unit, and uses the inverse pre-computation module, temporary matrix calculation module and matrix multiplication module to complete the basis transformation operation in parallel, transforming the extended ciphertext polynomial to the target RNS basis representation. In a preferred embodiment, the parallel completion of the base transformation operation includes: The L+1 parallel Barrett modular multiplication units in the inverse pre-computation module are controlled to calculate and store the inverse values ​​in parallel. The temporary matrix calculation module is controlled to call pre-stored inverse values ​​to calculate the temporary matrix in parallel; The matrix multiplication module controls the multiply-accumulate operation array to perform matrix-vector inner product operations in parallel.

[0058] The point-value multiplication unit performs a point-value multiplication operation between the ciphertext polynomial under the extended RNS basis and the transformation key. By reusing the parallel modulo reduction hardware unit and the basis conversion parallel processing hardware unit in the control unit, the ModDown operation is performed to convert the product result from the extended RNS basis back to the original RNS basis. The control unit schedules the NTT processing unit to perform the inverse NTT transformation, converting the result from point value form to coefficient form, and outputting the converted ciphertext to complete the key switching.

[0059] This invention is not limited to the specific embodiments described above. The invention extends to any new feature or combination disclosed in this specification, as well as any new method or process step or combination disclosed herein.

Claims

1. A parallel processing system for CKKS fully homomorphic cryptography key switching, characterized in that, include: The NTT processing unit converts the encrypted polynomial between coefficient form and point-value form. The parallel modular reduction hardware unit includes L+1 parallel operation units. Each operation unit includes a shift-add module, an accumulation module, and a Barrett modular reduction module. The shift-add module is configured to convert multiplication operations into shift and addition operations by utilizing the properties of special small modulo numbers. The L+1 parallel operation units are configured to perform the modular reduction operation of the intermediate large integers required for RNS base extension in parallel. The hardware unit for parallel processing of base transformation includes an inverse pre-computation module, a temporary matrix calculation module, a matrix multiplication module, and a storage unit. The inverse pre-computation module includes L+1 parallel Barrett modular multiplication units, the matrix multiplication module includes multiple multiply-accumulate operation arrays, and the storage unit is configured to store the pre-computed inverse values ​​and transformation matrices in close proximity. The dot-valued multiplication unit performs a dot-valued multiplication operation between the ciphertext polynomial under the extended RNS basis and the transformation key. The control unit coordinates the data flow of the parallel modulo reduction hardware unit and the base conversion parallel processing hardware unit, and is configured to reuse the parallel modulo reduction hardware unit and the base conversion parallel processing hardware unit in the ModDown operation. When the system performs a key switching operation, it sequentially completes data processing through the NTT processing unit, the parallel modular reduction hardware unit, the base conversion parallel processing hardware unit, the point value multiplication unit, the base conversion parallel processing hardware unit, the parallel modular reduction hardware unit, and the NTT processing unit.

2. The parallel processing system for CKKS fully homomorphic cryptographic key switching according to claim 1, characterized in that, The parallel modular reduction hardware unit performs the modular reduction operation of the RNS basis extension, including: The intermediate large integers required for RNS basis expansion are decomposed into basis S, which is determined by the small moduli in the original RNS basis. The shift-add module converts multiplication operations under radix S representation into shift and addition operations based on the properties of special form small modulus, and obtains the results of each component. The accumulation module receives the results of each component and performs accumulation processing to obtain the accumulated sum; The Barrett modular reduction module receives the accumulated sum data and performs modular reduction operations to obtain the modular operation result after RNS basis expansion.

3. The parallel processing system for CKKS fully homomorphic cryptography key switching according to claim 2, characterized in that, Decompose the large integer in the middle into a radix S, including: make , ,in, For small moduli in the RNS base; Large coefficient terms Using the radix S, it is represented as ,in .

4. The parallel processing system for CKKS fully homomorphic cryptography key switching according to claim 3, characterized in that, The special form of small module is The form is , where n is a positive integer.

5. The parallel processing system for CKKS fully homomorphic cryptographic key switching according to claim 4, characterized in that, The conversion of multiplication operations into shift and addition operations includes: based on The binomial expansion property will Multiplication operations are converted into shift and addition operations; When the selected modulus for In this case, increase the step size for shift and addition calculations.

6. The parallel processing system for CKKS fully homomorphic cryptographic key switching according to claim 1, characterized in that, The basis conversion parallel processing hardware unit performs basis conversion operations including: The inverse pre-computation module uses L+1 parallel Barrett modular multiplication units to calculate the inverse values ​​of each RNS base small module in parallel and store them in the storage unit. The inverse calculation uses Fermat's Little Theorem to transform the inverse into a modular exponentiation problem. The temporary matrix calculation module calls the inverse value in the storage unit to calculate each element of the temporary matrix in parallel, wherein there is no data dependency between the operations of each row; The transformation matrix is ​​pre-calculated and stored using multiple multiply-accumulate operation arrays in the matrix multiplication module, and the matrix-vector inner product operation is performed in parallel to obtain the polynomial matrix under the target RNS basis.

7. The parallel processing system for CKKS fully homomorphic cryptography key switching according to claim 6, characterized in that, Matrix-vector inner product operations are performed in parallel using multiple multiply-accumulate arrays, including: Calculation by The transformation matrix is ​​composed of, where For small moduli in the target RNS basis; The transformation matrix is ​​pre-calculated by the parallel modular reduction hardware unit and stored in the fast access area of ​​the storage unit; The multiplication operation between the transformation matrix and the temporary matrix is ​​divided into a matrix-vector inner product; The multiple multiply-accumulate arrays perform the inner product operation in parallel to obtain the polynomial matrix under the target RNS basis.

8. A parallel processing method for CKKS fully homomorphic cryptography key switching, characterized in that, Based on the parallel processing system according to any one of claims 1-7, the parallel processing method includes: The NTT processing unit converts the encrypted polynomial from coefficient form to point value form. The control unit schedules the parallel modular reduction hardware unit, and uses the L+1 parallel computing units to perform the modular reduction operation of the intermediate large integer required for RNS base extension in parallel, converting the intermediate large integer into the extended RNS base representation; The control unit schedules the basis transformation parallel processing hardware unit, and uses the inverse pre-computation module, temporary matrix calculation module and matrix multiplication module to perform the basis transformation operation in parallel, transforming the extended ciphertext polynomial to the target RNS basis representation. The point-value multiplication unit performs a point-value multiplication operation between the ciphertext polynomial under the extended RNS basis and the transformation key. By reusing the parallel modulo reduction hardware unit and the basis conversion parallel processing hardware unit in the control unit, the ModDown operation is performed to convert the product result from the extended RNS basis back to the original RNS basis. The NTT processing unit converts the result from point value form to coefficient form to complete the key switching.

9. The parallel processing method for CKKS fully homomorphic cryptography key switching according to claim 8, characterized in that, The modulo reduction operation of the intermediate large integers required for the parallel execution of RNS base expansion includes: The shift-add module is controlled to convert multiplication operations into shift and addition operations by utilizing the properties of a special type of small module; The accumulation module is controlled to accumulate the results of the shift addition. The Barrett modular reduction module is controlled to perform modular reduction on the accumulated result to obtain the modular operation result.

10. The parallel processing method for CKKS fully homomorphic cryptography key switching according to claim 8, characterized in that, The parallel completion of the base transformation operation includes: The L+1 parallel Barrett modular multiplication units in the inverse pre-computation module are controlled to calculate and store the inverse values ​​in parallel. The temporary matrix calculation module is controlled to call pre-stored inverse values ​​to calculate the temporary matrix in parallel; The matrix multiplication module controls the multiply-accumulate operation array to perform matrix-vector inner product operations in parallel.

Images