A paillier homomorphic encryption processor and a processing method thereof

Abstract

The application discloses a Paillier homomorphic encryption processor and a processing method thereof, and belongs to the technical field of chip design, and comprises a top controller, a global memory system and a plurality of ciphertext processing elements with bit serial reconfigurable data streams; the top controller is used for controlling the data flow in the chip and the calculation of the ciphertext processing elements; the global memory system is used for storing the input and output data required by the calculation in the chip; the ciphertext processing elements are used for calculating the required module operation of the ciphertext; and the top controller controls the data interaction between the global memory system and the plurality of ciphertext processing elements through a bus. The application is an acceleration chip specially used for the Paillier algorithm of homomorphic encryption and based on ASCI, and the calculation mode of bit stream sparsity is supported on the architecture, so that the calculation efficiency and performance are improved.

Description

Technical Field

[0001] This invention belongs to the field of chip design technology, specifically relating to a Paillier homomorphic encryption processor. Background Technology

[0002] Cloud computing currently sits at the heart of a multitude of emerging information applications that leverage vast amounts of personal and institutional data to deliver a variety of reliable, high-performance services. Paillier homomorphic encryption (PHE, partially homomorphic encryption) is one of the key privacy computing technologies that enables ciphertext to enjoy the same practicality as plaintext. Figure 1 In the partial homomorphic encryption scheme shown in (a), the client encrypts its plaintext into ciphertext and then sends it to the server, which performs homomorphic evaluation and returns the encryption result to the client.

[0003] However, this process avoids the disclosure of plaintext at the cost of some computational overhead, and the invention is... Figure 1 (b) lists three main challenges. First, ciphertext field computation requires large integer modular arithmetic operations (e.g., modular multiplication, modular inverse, and modular exponentiation) that are several orders of magnitude higher in energy and latency. Second, clients perform encryption and decryption characterized by independent vector operations, while servers inevitably utilize multiplication and accumulation (MAC) operations for evaluation. Third, the diversity of tasks necessitates computational scalability to meet latency and throughput requirements in the cloud.

[0004] Currently, the homomorphic encryption Paillier algorithm exhibits low performance on general-purpose CPUs and graphics processing units (GPUs). For example... Figure 1 The left half of (a) states that homomorphic encryption means that performing corresponding operations on the ciphertext yields a result equivalent to performing the same operations on the plaintext. Specifically, addition on the plaintext corresponds to modular multiplication on the ciphertext, and multiplication corresponds to modular exponentiation.

[0005] In summary, existing technologies use specific circuits to implement modular exponentiation and modular multiplication operations, but there are no related solutions for implementing sparse bitstream operations. Summary of the Invention

[0006] The purpose of this invention is to provide a Paillier homomorphic encryption processor and its processing method. This invention is an acceleration chip designed based on ASCI specifically for the homomorphic encryption Paillier algorithm. By supporting bit-stream sparse computing in its architecture, it improves computing efficiency and performance.

[0007] To achieve the above objectives, the present invention employs the following technical solution:

[0008] A Paillier homomorphic encryption processor includes: a top controller, a global memory system, and multiple ciphertext processing elements having bit-serialized reconfigurable data streams;

[0009] The top controller is used to control the data flow and computation of the encrypted processing elements inside the chip;

[0010] A global memory system is used to store the input and output data required for internal calculations within the chip.

[0011] Ciphertext processing elements are used to perform modular operations required to process ciphertext.

[0012] The top controller controls the global memory system to interact with multiple encrypted processing elements via a bus.

[0013] As a further improvement of the present invention, each ciphertext processing element includes a weighted buffer, an input buffer, an output buffer, a lookup table unit for parts and items for bit serialization processing, a Montgomery unit, and an extended Euclidean unit.

[0014] The weight buffer is used to store the weights multiplied with the ciphertext;

[0015] The input buffer is used to store the computed ciphertext;

[0016] The output buffer is used to store the calculation results;

[0017] Lookup table unit for parts and items in bit serialization: used to store intermediate settlement results of ciphertext;

[0018] The Montgomery unit performs Montgomery modular multiplication, which is used for Paillier's algorithm and is organized as modular multiplication and modular exponentiation.

[0019] The extended Euclidean unit is used to apply the extended Euclidean algorithm to modular inverse operations.

[0020] As a further improvement of the present invention, the Montgomery unit includes multiple multipliers for computationally intensive Montgomery algorithms, wherein the first stage consists of one multiplier for updating the result of the first stage of the Montgomery algorithm, and the second stage consists of two multipliers for updating the result of the second stage of the Montgomery algorithm.

[0021] As a further improvement of the present invention, the multiplier employs a two-stage Montgomery operation. The first-stage Montgomery operation is used to update the parameter values ​​of the first stage and the relevant intermediate variables for the second stage; the second-stage Montgomery operation is used to perform large integer multiplication of the intermediate Montgomery results.

[0022] As a further improvement of the present invention, the extended Euclidean unit includes a local register file for controlling the dense extended Euclidean array, a lightweight branch detector, and an execution unit; the execution unit includes three adders and a shifter unit for performing operations on each branch in one cycle.

[0023] As a further improvement of the invention, the extended Euclidean unit is also used to forward the update result to the lightweight branch detector in each loop before forwarding it to the pipeline register.

[0024] A processing method for a Paillier homomorphic encryption processor includes: an n-level bit serial mode for multiply-accumulate operations and a pipelined mode for constant-scale operations; the data flow in the two modes is reconfigured by a computing unit controller to reuse the same set of resources;

[0025] The homomorphic encryption Paillier algorithm employs bitstream sparse computation. In the bitstream sparse computation part, the bit sparsity of the weights is achieved by bitwise multiplication of the ciphertext and the weights, and bitwise alignment is performed in the part.

[0026] As a further improvement of the present invention, the n-level bit serial mode is implemented using the weighted bit sparsity via a bit-1 selector; including:

[0027] S1, in both the part and Psum, contains multiple registers, each corresponding to a weight of m units; for each weight, the selector searches for the position of the first unit to indicate the update of the corresponding Psum item;

[0028] S2 aligns the parts and terms by performing Montgomery modular multiplication several times according to their bit positions;

[0029] S3 further handles the negative sign terms of the partial sum by one extended Euclidean and two Montgomery modular multiplications;

[0030] S4 sums up all parts and terms and gets the final result.

[0031] As a further improvement to the present invention, the pipeline mode is reconfigured to perform Paillier's basic modular arithmetic, including:

[0032] Modular multiplication and modular exponentiation are achieved by repeatedly calling the Montgomery modular multiplication unit, while modular inversion is achieved by the extended Euclidean unit. In the case of modular exponentiation, the corresponding weights reach a set unit quantity, and a fast exponentiation algorithm is introduced by skipping sparse bits in the same way by multiplexing the selector of the first unit quantity of the n-level bit serial mode.

[0033] As a further improvement of the present invention, the bitstream sparse computation includes:

[0034] S10, Ciphertext 1*0b00001011+Ciphertext 2*0b10111100;

[0035] First, the ciphertext and weights are multiplied bitwise. Specifically, the ciphertext 1 is multiplied by part of 0, 1, 3 by Montgomery modular multiplication, and the ciphertext 2 is multiplied by part of 2, 3, 4, 5, 7 by Montgomery modular multiplication.

[0036] S10, align the bits from 0 to 7 of the partial sum bitwise, specifically by multiplying the partial sum i by Montgomery modulo i times.

[0037] S10, invert the 7 in the partial sum;

[0038] S10, sum all the partial sums.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] This invention presents an accelerator chip based on ASCI design specifically for the Paillier algorithm in homomorphic encryption. By supporting bit-stream sparsity computation in its architecture, it improves computational efficiency and performance. The Montgomery arithmetic unit uses higher-order multipliers to accelerate higher-order multiplications, and the modular inverse arithmetic unit utilizes forwarding of intermediate results to achieve 100% utilization of the arithmetic unit. The energy efficiency of this accelerator exceeds that of CPUs by several orders of magnitude. For bit sparsity efficiency, this invention evaluates four data patterns with different sparsity rates. The results show that efficient use of skipping bits of 0 achieves a 3.3x speedup at 75% sparsity. The figure also shows a comparison table with previous work on custom hardware designs for homomorphic encryption. This invention's Paillier accelerator (PH-EPU) supports all types of homomorphic encryption (HE) tasks (encryption, decryption, and evaluation) with high flexibility. It also supports dynamic bit widths for ciphertext and weights, while utilizing bit-serial sparsity to optimize performance. Typical computational throughput in Paillier reaches 23 to 68 MOPS (million computations per second) for Montgomery modular multiplication and 38 KOPS (thousand computations per second) for modular exponentiation, with efficiencies of 0.18 to 0.52 μJ / Op and 105.3 μJ / Op, respectively. Compared to current Paillier processors, this represents a 115 to 340-fold increase in throughput and a 30.4 to 87.8-fold increase in energy efficiency for Montgomery modular multiplication.

[0041] Furthermore, in the bitstream sparse computation part, the bit sparsity of the weights can be achieved by bitwise multiplication of the ciphertext and weights in the first part, and bitwise alignment in the partial sum (Psum). Since we process each bit uniformly, a large amount of computation required due to bit alignment is omitted.

[0042] Furthermore, this invention establishes a system-level experimental flow to simulate the complete processing flow between the client and server. The runtime library loads input data and execution instructions onto the card via the host CPU. Attached Figure Description

[0043] Figure 1 Among the PHE (partial homomorphic encryption) schemes presented in the prior art, (a) represents the homomorphic encryption method, and (b) represents the main challenges of the prior art.

[0044] Figure 2 The overall architecture shown;

[0045] Figure 3 The implementations of MU (Montgomery modular multiplication unit) and SU (extended Euclidean unit) are described in detail;

[0046] Figure 4 The data flow inside the BSRD-PE (Bitstream Coefficient Calculation Unit) is described for the following two typical computation modes used in Paillier;

[0047] Figure 5 This demonstrates an efficient task deployment flow on the PE (computing unit) and the chip;

[0048] Figure 6 First, the key basic operations (i.e., Mont (Montgomery modular multiplication) and ModInv (modular exponentiation)) and the efficiency of bit-sequencing optimization are explained;

[0049] Figure 7 Micrographs and characteristics of both the chip and the PCIe card are shown. Detailed Implementation

[0050] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0051] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0052] like Figure 2 As shown, the first objective of this invention is to provide a Paillier homomorphic encryption processor, comprising: a top controller, a global memory system, and multiple ciphertext processing elements having bit-serial reconfigurable data streams;

[0053] The top controller is used to control the data flow and computation of the encrypted processing elements inside the chip;

[0054] Global memory system is used to store the computational input and output data inside the chip;

[0055] Ciphertext processing elements are used to perform the modular operations required to process ciphertext.

[0056] The top controller controls the global memory system to interact with multiple encrypted processing elements via a bus. The embodiment provided in this invention uses a 256-bit bus for data interaction.

[0057] Specifically, the high-performance Paillier homomorphic encryption processor unit (PH-EPU) of the present invention includes:

[0058] 1) It has two efficient modular processing units (i.e., the Montgomery modular multiplication unit and the extended Euclidean unit) with dynamic bit widths for basic Paillier homomorphic operations;

[0059] 2) A highly efficient ciphertext processing element characterized by reconfigurable data streams that enable bit-serial computation for different task modes;

[0060] 3) Apply instruction-based control to scalable computational flows with various workloads.

[0061] As a specific embodiment, the present invention provides a 28nm processor example, which occupies 42.96mm². 2Operating at 500MHz and 0.9V, it supports Paillier encryption, decryption, and homomorphic evaluation. Compared to the 16-core Intel desktop CPU i9-9900, the PH-EPU of this embodiment achieves a speedup of up to 14.9 times, and the 8-chip system-level PCIe card of this embodiment achieves 1 / 22.8 times the latency of the 192-core Intel Xeon Platinum 8260M server CPU.

[0062] Figure 2 The diagram shown illustrates the overall architecture of the chip according to an embodiment of the present invention. The overall architecture includes a top controller, a global memory system with three buffers, and 16 ciphertext processing elements (BSRD-PE) with bit-serial reconfigurable data streams. The top controller manages the data interaction between the input / output buffers and the 16 BSRD-PEs via a 256-bit bus.

[0063] In this application, each ciphertext processing element includes a weighted buffer, an input buffer, an output buffer, a lookup table unit for parts and items for bit serialization processing, a Montgomery unit, and an extended Euclidean unit.

[0064] The weight buffer is used to store the weights multiplied with the ciphertext;

[0065] The input buffer is used to store the computed ciphertext;

[0066] The output buffer is used to store the calculation results;

[0067] Lookup table unit for parts and items in bit serialization: used to store intermediate settlement results of ciphertext;

[0068] The Montgomery unit performs Montgomery modular multiplication for Paillier's algorithm, which is organized into modular multiplication and modular exponentiation; the extended Euclidean unit is used to perform modular inverse operations on the extended Euclidean algorithm.

[0069] Specifically, each BSRD-PE includes a 9KB weight buffer, an 8KB input buffer, a 1KB output buffer, a lookup table for parts and items for bit serialization, a Montgomery modular multiplication unit (MU), and an extended Euclidean unit (SU). The MU performs Montgomery modular multiplication (Mont), which can be organized into modular multiplication and modular exponentiation operations for the Paillier algorithm.

[0070] The Montgomery unit includes multiple multipliers for computationally intensive Montgomery algorithms. The first stage has one multiplier for updating the results of the first stage of the Montgomery algorithm, and the second stage has two multipliers for updating the results of the second stage of the Montgomery algorithm.

[0071] The multiplier employs a two-stage Montgomery operation. The first-stage Montgomery operation is used to update the parameter values ​​of the first stage and the relevant intermediate variables for the second stage. The second-stage Montgomery operation is used to perform large integer multiplication of the intermediate Montgomery results.

[0072] Furthermore, the extended Euclidean unit provided in this application includes a local register file for controlling the dense extended Euclidean array, a lightweight branch detector, and an execution unit; the execution unit includes three adders and a shifter unit for performing operations on each branch in one cycle.

[0073] SU extends the Euclidean modular inverse algorithm (Stein) for modular inverse operations. These two basic execution units address the first modular challenge via dedicated arithmetic hardware. However, using such a common modular exponentiation data stream to perform related multiply-accumulate operations during the evaluation phase is inefficient; therefore, this invention also extends the insertion partial sum (Psum) item lookup table (LUT) coupled with a bit-1 selector to leverage bit-level sparsity. The entire data path facilitates efficient handling of the diverse computational patterns in the second challenge. Horizontally scaled computation for the third challenge is achieved through instruction-based control flow combined with system-level automated scheduling flow.

[0074] Figure 3 The implementation of the MU Montgomery arithmetic unit and the SU modular inverse arithmetic unit is described in detail. The MU mainly consists of three 256-bit multipliers for computationally intensive Montgomery operations. The two-stage Montgomery modular multiplication operation has several similar iterations, the number of which depends on the width (B) of the multiplier.

[0075] To extend this, the extended Euclidean cell is also used in each loop to forward the update result to the lightweight branch detector before forwarding it to the pipeline register.

[0076] Four alternatives to B are evaluated, and the 256-bit B is chosen because it achieves the highest cost efficiency. Therefore, based on the 256-bit operands, the first stage is used to update the first-stage parameter (q) values ​​and the relevant intermediate variables for the second stage. The second stage performs large integer multiplication (4096b × 256b) for the intermediate Montgomery results, occupying 16 cycles using the 256-bit multiplier. The SU contains a local register file for control-intensive extended Euclidean algorithm, a lightweight branch detector (BD), and an execution unit (EU). Only the critical bits for branch detection are input to the BD to eliminate redundant output, while the EU contains three 4102b adders and a shifter unit to perform the operation for each branch in one cycle.

[0077] The Montgomery unit includes multiple multipliers for computationally intensive Montgomery algorithms. The first stage consists of one 256-bit multiplier used to update the results of the first stage of the Montgomery algorithm, and the second stage consists of two 256-bit multipliers used to update the results of the second stage of the Montgomery algorithm.

[0078] To avoid pipeline bubbles from branch detection, the scheme also forwards the update results to the BD stage in each loop before forwarding them to the pipeline register, which ensures the use of SU.

[0079] The present invention provides a specific modular arithmetic unit in an embodiment, wherein the Montgomery arithmetic unit uses a 256-bit high-order multiplier to accelerate high-order multiplication, and the modular inverse arithmetic unit uses the method of forwarding intermediate results to make the utilization efficiency of the arithmetic unit reach 100%.

[0080] In the sparse computation part of the bitstream, the bit sparsity of the weights can be achieved by bitwise multiplication of the ciphertext and weights in the first part. In the part and bitwise alignment, since the present invention processes each bit uniformly, a large amount of computation required due to bit alignment is omitted.

[0081] The Paillier chip architecture features efficient computing units for Montgomery and modular inverse operations, with a bitstream sparse computing architecture within the computing units.

[0082] The present invention also provides a processing method for a Paillier homomorphic encryption processor, comprising: an n-level bit serial mode for multiply-accumulate operations and a pipelined mode for constant-scale operations; the data flow in the two modes is reconfigured by a computing unit controller to reuse the same set of resources;

[0083] The homomorphic encryption Paillier algorithm employs bitstream sparse computation. In the bitstream sparse computation part, the bit sparsity of the weights is achieved by bitwise multiplication of the ciphertext and the weights, and bitwise alignment is performed in the part.

[0084] like Figure 4 The data flow inside the bitstream sparse computation unit is described for the following two typical computation modes for Paillier: a 4-level bit serial mode for correlated multiply-accumulate operations; and a classic pipeline mode for constant-scale operations.

[0085] The data flow in both modes is reconfigured through the compute unit controller, reusing the same set of resources.

[0086] In this process, the n-level bit serial mode is implemented using the bit sparsity of weights via a bit-1 selector; including...

[0087] S1, in both the part and Psum, contains multiple registers, each corresponding to a weight of m units; for each weight, the selector searches for the position of the first unit to indicate the update of the corresponding Psum item;

[0088] S2 aligns the parts and terms by performing Montgomery modular multiplication several times according to their bit positions;

[0089] S3 further handles the negative sign terms of the partial sum by one extended Euclidean and two Montgomery modular multiplications;

[0090] S4 sums up all parts and terms and gets the final result.

[0091] The specific plan is as follows:

[0092] Mode 1 (4-level bit serial mode) improves performance by using weighted bit sparsity via a bit 1 selector.

[0093] Step 1: Based on the 8 bits of the weights, the partial sum (Psum) is decoupled into 8 terms corresponding to the accumulated result. For each weight, the selector searches for the position of bit 1 to indicate the update of the corresponding Psum term.

[0094] Step 2, align the Psum terms by performing a number of Montgomery modular multiplications based on their bit positions.

[0095] After all the weights are completed, since the size of the original (native) Psum data is not considered after step 1, the Psum terms are aligned in step 2 by performing Montgomery modular multiplications based on their bit positions.

[0096] Step 3 further processes the negative sign term of Psum (i.e., Psum7) by one extended Euclidean algorithm and two Montgomery modular multiplications.

[0097] Step 4: Subtract all Psum terms and obtain the final result.

[0098] The pipeline mode is reconfigured to perform Paillier's basic modular operations, including:

[0099] Modular multiplication and modular exponentiation are achieved by repeatedly calling the Montgomery modular multiplication unit, while modular inversion is achieved by the extended Euclidean unit. In the case of modular exponentiation, the corresponding weights reach a set unit quantity, and a fast exponentiation algorithm is introduced by skipping sparse bits in the same way by multiplexing the selector of the first unit quantity of the n-level bit serial mode.

[0100] For example, mode 2 is reconfigured to perform Paillier's basic modular arithmetic, where modular multiplication and exponentiation are implemented by repeatedly calling MU, while modular inversion is implemented by SU. In the case of modular exponentiation, the corresponding weights reach 4096 bits, thus a fast exponentiation algorithm is introduced by multiplexing the bit-1 selector of mode 1 (4-level bit serial mode) to skip sparse bits in the same way.

[0101] The specific bitstream sparse calculation method is as follows: Figure 4 As shown in Mode 1, it includes:

[0102] Step 1: Ciphertext 1 * 0b00001011 + Ciphertext 2 * 0b10111100;

[0103] First, the ciphertext and weights are multiplied bitwise. Specifically, the ciphertext 1 and parts of it are multiplied by Montgomery modularly with 0, 1, and 3, and the ciphertext 2 and parts of it are multiplied by Montgomery modularly with 2, 3, 4, 5, and 7.

[0104] The second step is to align the bits from 0 to 7 of the partial sum. Specifically, this involves multiplying the partial sum i by Montgomery modulo i times.

[0105] The third step is to invert the sum of the parts and the 7;

[0106] The fourth step is to sum all the parts.

[0107] Figure 5 The efficient task deployment flow on the PE and chip is demonstrated. The compiler performs task specification, memory allocation, and instruction generation to produce runtime libraries and instructions for a full-height, full-length (FHFL) PCIe card integrated with the host FPGA and eight PH-EPU chips.

[0108] Typically, for convolution, because the bandwidth requirements of ciphertext are much greater than those of plaintext, chip-level task assignment prioritizes ciphertext broadcasting in the output channels to save bandwidth. At the PE level, this invention uses an optimized search partitioning scheme to determine the parallelism of the height (ParaH), width (ParaW), and channels (ParaK) of the 3D output feature map across 16 PEs. This invention also establishes a system-level experimental flow to simulate the complete processing flow between the client and server. The runtime library loads input data and execution instructions onto the card via the host CPU.

[0109] To illustrate the scalability of the system of this invention, the invention evaluates a series of tasks with different workloads. End-to-end evaluation results, including both software time and hardware time excluding communication time between the client and server, show that the PH-EPU chip and 8-chip card of this invention significantly outperform desktop and server CPUs and exhibit better scalability.

[0110] Figure 6 First, the efficiency of key fundamental operations (i.e., Montgomery modular multiplication and modular inverse) and bit-serialization optimization is explained. The energy efficiency of the accelerator of this invention exceeds that of the CPU by several orders of magnitude. For bit sparsity efficiency, this invention evaluates four data patterns with different sparsity rates.

[0111] The results show that efficient use of bit-0 skipping achieves a 3.3x speedup at a 75% sparsity. The figure also includes a comparison table with previous work on custom hardware designs for homomorphic encryption.

[0112] Therefore, the PH-EPU of this invention supports all types of homomorphic encryption tasks (encryption, decryption, and evaluation), exhibiting high flexibility. It also supports dynamic bit widths for ciphertext and weights, while utilizing bit-serial sparsity to optimize performance. Typical operations in Paillier achieve throughput of 23 to 68 MOPS for Montgomery modular multiplication and 38 KOPS for modular inversion, with efficiencies of 0.18 to 0.52 μJ / Op and 105.3 μJ / Op, respectively. Compared to current Paillier processors, this represents a 115 to 340-fold increase in throughput and a 30.4 to 87.8-fold increase in energy efficiency for Montgomery modular multiplication.

[0113] Figure 7 Microscopic images and characteristics of both the chip and the PCIe card are shown. The images reveal that the chip was manufactured using a UMC 28nm process and has an area of ​​42.96 mm². 2 The operating frequency is 0.5-500MHz. Supported data bit widths are: ciphertext bit widths of 1024, 2048, and 4096 bits, with weights of 2, 4, and 8 bits (bitstream sparse mode), and a maximum of 4096 bits (modular exponentiation mode). Power consumption is 4-12W. Typical throughput in Paillier operations reaches 23 to 68 MOPS in Montgomery modular multiplication calculations. The PCIe board contains 8 chips, provides 120W of power, and typical throughput in Paillier operations reaches 181 to 355 MOPS in Montgomery modular multiplication calculations. DDR3, off-chip, and PCIe bandwidths are 100Gb / s, 12.5Gb / s, and 32Gb / s, respectively.

[0114] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of one or more embodiments comprising…

[0115] The form of a computer program product implemented on a computer-usable storage medium (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0116] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0117] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A Paillier homomorphic encryption processor, characterized in that, include: Top controller, global memory system, and multiple ciphertext processing elements with bit-serial reconfigurable data streams; The top controller is used to control the data flow and computation of the encrypted processing elements inside the chip; A global memory system is used to store the input and output data required for internal calculations within the chip. Ciphertext processing elements are used to perform modular operations required to process ciphertext. The top controller controls the global memory system to interact with multiple encrypted processing elements via a bus; Each ciphertext processing element includes a weighted buffer, an input buffer, an output buffer, a lookup table unit for parts and items for bit serialization processing, a Montgomery unit, and an extended Euclidean unit. The weight buffer is used to store the weights multiplied with the ciphertext; The input buffer is used to store the computed ciphertext; The output buffer is used to store the calculation results; Lookup table unit for parts and items in bit serialization: used to store intermediate settlement results of ciphertext; The Montgomery unit performs Montgomery modular multiplication, which is used for Paillier's algorithm and is organized as modular multiplication and modular exponentiation. The extended Euclidean unit is used to apply the extended Euclidean algorithm to modular inverse operations; An n-level bit serial mode is used for multiply-accumulate operations, and a pipelined mode is used for constant-scale operations; the data flow in both modes is reconfigured by the compute unit controller to reuse the same set of resources. The homomorphic encryption Paillier algorithm employs bitstream sparse computation. In the bitstream sparse computation part, the bit sparsity of the weights is achieved by bitwise multiplication of the ciphertext and the weights, and bitwise alignment is performed in the part. The n-level bit serial mode is performed using the bit sparsity of weights via a bit-1 selector; include S1, Psum, contains multiple registers, each corresponding to a weight of m units; For each weight, the selector searches for the position of the first unit quantity to indicate the update of the corresponding Psum item; S2, aligns the parts and terms by performing Montgomery modular multiplication several times according to their bit positions; S3 further handles the negative sign terms of the partial sum by one extended Euclidean and two Montgomery modular multiplications; S4, sum all parts and terms and get the final result; The pipeline mode is reconfigured to perform Paillier's basic modular operations, including: Modular multiplication and modular exponentiation are achieved by repeatedly calling the Montgomery modular multiplication unit, while modular inversion is achieved by the extended Euclidean unit. In the case of modular exponentiation, the corresponding weights reach a set unit quantity, and a fast exponentiation algorithm is introduced by skipping sparse bits in the same way by multiplexing the selector of the first unit quantity of the n-level bit serial mode.

2. The Paillier homomorphic encryption processor according to claim 1, characterized in that, The Montgomery unit includes multiple multipliers for computationally intensive Montgomery algorithms, wherein the first stage consists of one multiplier for updating the results of the first stage of the Montgomery algorithm, and the second stage consists of two multipliers for updating the results of the second stage of the Montgomery algorithm.

3. The Paillier homomorphic encryption processor according to claim 2, characterized in that, The multiplier employs a two-stage Montgomery operation. The first-stage Montgomery operation is used to update the parameter values ​​of the first stage and the relevant intermediate variables for the second stage. The second-stage Montgomery operation is used to perform large integer multiplication of the intermediate Montgomery results.

4. The Paillier homomorphic encryption processor according to claim 1, characterized in that, The extended Euclidean unit includes a local register file for controlling the dense extended Euclidean array, a lightweight branch detector, and an execution unit; the execution unit includes three adders and a shifter unit for performing operations on each branch in one cycle.

5. The Paillier homomorphic encryption processor according to claim 1, characterized in that, The extended Euclidean unit is also used in each loop to forward the update result to the lightweight branch detector before forwarding it to the pipeline register.

6. The processing method of the Paillier homomorphic encryption processor according to any one of claims 1 to 5, characterized in that, include: The bitstream sparse computation includes: S10, Ciphertext 1*0b00001011+Ciphertext 2*0b10111100; First, the ciphertext and weights are multiplied bitwise. Specifically, the ciphertext 1 is multiplied by part of 0, 1, 3 by Montgomery modular multiplication, and the ciphertext 2 is multiplied by part of 2, 3, 4, 5, 7 by Montgomery modular multiplication. S20, align the bits from 0 to 7 of the partial sum bitwise, specifically by multiplying the partial sum i by Montgomery modulo i times. S30, invert the 7 in the partial sum; S40 sums all the parts.

Images