Processing method and chip for automorphism operation in homomorphic encryption

Abstract

The embodiment of the present specification provides a processing method and a chip for automorphism operation in full homomorphic encryption. The method comprises: dividing, by a full homomorphic processing chip, an input array of automorphism operation into M first groups according to preset parameters, and dividing a result array to be determined element value into M second groups; and performing a first operation on the M second groups in turn according to an output order; wherein the first operation for the current second group comprises: determining a current first group corresponding to the current second group in the M first groups according to a first mapping relationship; reading a plurality of first element values in the current first group in the input array from off-chip storage of the full homomorphic processing chip and storing them in on-chip memory; and rearranging the plurality of first element values into a plurality of second element values as the current second group output to the off-chip storage according to a second mapping relationship. An acceleration effect can be achieved.

Description

TECHNICAL FIELD

[0001] One or more embodiments of the present specification relate to the field of computers, and in particular, to a processing method and chip for automorphism operation in fully homomorphic encryption. BACKGROUND

[0002] Fully homomorphic encryption (FHE) is a privacy computing technology that allows general-purpose computation on ciphertext to obtain a computation result in the ciphertext, and its security is based on mathematical difficult problems, and no additional trust assumption is needed to achieve the data "available, controllable, and invisible". However, fully homomorphic encryption has deficiencies in performance. Its computing performance is usually 4 to 5 orders of magnitude lower than plaintext computation. Therefore, in order to enable fully homomorphic encryption to be used in actual scenarios, the algorithm and application thereof need to be accelerated.

[0003] Homomorphic operations of fully homomorphic encryption include homomorphic addition, homomorphic multiplication, rescaling, relinearization, and rotation. Through the combination of these homomorphic operations, various homomorphic applications can be implemented, including homomorphic matrix multiplication, homomorphic neural network, and the like. The homomorphic operations are also composed of basic operations at a lower level, which are directed to a polynomial in the ciphertext. The basic operations include modular multiplication, modular addition, modular subtraction, automorphism, number-theoretic transform (NTT), and inverse number-theoretic transform (INTT). Optimization of the basic operations at the lower level can produce more significant acceleration effects on homomorphic operations and homomorphic applications. Automorphism operation is part of rotation operation, and has a significant impact on the performance of rotation operation. It is necessary to provide an optimization scheme for processing of automorphism operation in fully homomorphic encryption to produce an acceleration effect. SUMMARY

[0004] One or more embodiments of the present specification describe a processing method and chip for automorphism operation in fully homomorphic encryption, which can produce an acceleration effect.

[0005] In a first aspect, a processing method for automorphism operation in fully homomorphic encryption is provided, which is executed by a fully homomorphic processing chip, and the method comprises:

[0006] According to the preset parameter, the input array of the isomorphism operation is divided into M first groups, and the result array to be determined element value is divided into M second groups;

[0007] According to the output order, the M second groups are sequentially executed with the first operation respectively; wherein, the first operation of the current second group includes:

[0008] According to the first mapping relationship, the current first group corresponding to the current second group in the M first groups is determined;

[0009] The plurality of first element values in the current first group in the input array are read from the off-chip storage of the fully homomorphic processing chip and stored in the on-chip memory;

[0010] According to the second mapping relationship, the plurality of first element values are rearranged into a plurality of second element values as the output of the current second group to the off-chip storage.

[0011] In a possible implementation, each element in the input array is a polynomial coefficient in the fully homomorphic encryption.

[0012] In a possible implementation, the input array of the isomorphism operation is divided into M first groups according to the preset parameter, and the result array to be determined element value is divided into M second groups, including:

[0013] According to the preset parallel degree of parallel processing of the input array, M is determined as the number of elements in the input array divided by the parallel degree; the number of elements in the input array is the same as the number of elements in the result array;

[0014] The input array is divided into M first groups according to the element index order, each first group has the same number of elements as the value of the parallel degree, and the result array is divided into M second groups according to the element index order, each second group has the same number of elements as the value of the parallel degree.

[0015] In a possible implementation, the current first group corresponding to the current second group in the M first groups is determined according to the first mapping relationship, including:

[0016] According to the first mapping relationship between a plurality of most significant bits of two element indexes and a plurality of most significant bits of the element index of the current second group, a plurality of most significant bits of the element index of the current first group are determined, and the number of the most significant bits is adapted to M.

[0017] Further, the plurality of most significant bits of the element index of the current first group are determined, including:

[0018] reversing the order of bits of a number of most significant bits of an element index of the current second group, to obtain a first reversed bit sequence corresponding thereto;

[0019] determining a first intermediate index according to the first reversed bit sequence and a pre-set Galois parameter;

[0020] extracting a number of least significant bits of the first intermediate index to obtain a second intermediate index;

[0021] reversing the order of bits of the second intermediate index to obtain a second reversed bit sequence corresponding thereto, and taking the second reversed bit sequence as a number of most significant bits of an element index of the current first group.

[0022] In a possible implementation, the rearranging the plurality of first element values into a plurality of second element values according to the second mapping relationship and outputting the current second group to the off-chip storage includes:

[0023] determining, for each second element index in the current second group, a number of least significant bits of a first element index in the current first group to which the second element index is mapped according to a second mapping relationship between a number of least significant bits of two element indexes; and selecting, according to the number of least significant bits of the first element index, a first element value of the first element index from the plurality of first element values as a second element value of the second element index having a mapping relationship with the first element index;

[0024] combining the plurality of second element values obtained by the parallel execution into the current second group in the order of the second element indexes and outputting the current second group to the off-chip storage in sequence.

[0025] Further, the determining a number of least significant bits of a first element index in the current first group to which the second element index is mapped includes:

[0026] reversing the order of a number of least significant bits of the second element index in the current second group to obtain a third reversed bit sequence corresponding thereto;

[0027] splicing the first reversed bit sequence and the third reversed bit sequence to obtain a third intermediate index; the first reversed bit sequence being obtained by reversing the order of bits of a number of most significant bits of an element index of the current second group;

[0028] determining a fourth intermediate index according to the third intermediate index and a pre-set Galois parameter;

[0029] extracting a number of most significant bits of the fourth intermediate index to obtain a fifth intermediate index;

[0030] The order of each bit of the fifth intermediate index is reversed to obtain a corresponding fourth reversed bit sequence, which is mapped to a number of least significant bits of the first element index in the current first group as the second element index.

[0031] In a possible implementation, the on-chip memory includes a BRAM or a URAM, and the off-chip storage includes a DDR or a HBM.

[0032] In a second aspect, a full homomorphic processing chip is provided, including a processor and an on-chip memory.

[0033] The processor is configured to divide an input array of a self-similar operation into M first groups according to a preset parameter, and divide a result array to be determined for an element value into M second groups; and perform a first operation on the M second groups in sequence according to an output order; wherein the first operation on a current second group includes:

[0034] According to a first mapping relationship, a current first group corresponding to the current second group in the M first groups is determined.

[0035] The processor is configured to read a plurality of first element values in the current first group in the input array from off-chip storage of the full homomorphic processing chip and store the plurality of first element values in the on-chip memory.

[0036] According to a second mapping relationship, the plurality of first element values are rearranged into a plurality of second element values, which are output to the off-chip storage as the current second group.

[0037] In a third aspect, a computer readable storage medium is provided, which stores a computer program. When the computer program is executed in a computer, the computer is caused to execute the method of the first aspect.

[0038] In a fourth aspect, a computing device is provided, including a memory and a processor. The memory stores executable code, and the processor executes the executable code to implement the method of the first aspect.

[0039] According to the method and the chip provided in the embodiments of the present specification, the homomorphic processing chip first divides the input array of the automorphism operation into M first groups according to preset parameters, and divides the result array to be determined element value into M second groups; then, according to the output order, the first operation is performed on the M second groups respectively and sequentially; wherein, the first operation for the current second group includes: determining the current first group corresponding to the current second group in the M first groups according to the first mapping relationship; reading the plurality of first element values in the current first group in the input array from the off-chip storage of the homomorphic processing chip and storing them in the on-chip memory; rearranging the plurality of first element values into a plurality of second element values as the output of the current second group to the off-chip storage according to the second mapping relationship. As can be seen from the above, the embodiments of the present specification divide the input array and the result array into a plurality of groups respectively, determine the current first group corresponding to the current second group by using the first mapping relationship, and then map the plurality of first element values in the current first group to the correct output position by using the second mapping relationship, so that the on-chip memory only needs to store the element values of one group at a time, without occupying additional on-chip memory space, which is beneficial to parallel processing and can produce acceleration effect. BRIEF DESCRIPTION OF DRAWINGS

[0040] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiment description. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without creative labor.

[0041] Figure 1 The schematic diagram of the implementation scene of one embodiment disclosed in the present specification;

[0042] Figure 2 The schematic diagram of the implementation scene of another embodiment disclosed in the present specification;

[0043] Figure 3 The flow chart of the processing method of the automorphism operation in the homomorphic encryption according to one embodiment is shown.

[0044] Figure 4 The schematic block diagram of the homomorphic processing chip according to one embodiment is shown. DETAILED DESCRIPTION

[0045] The scheme provided in the present specification will be described below in combination with the drawings.

[0046] Figure 1An implementation scenario of an embodiment disclosed in the specification is shown. The implementation scenario relates to processing of automorphism operation in fully homomorphic encryption, which is performed by a fully homomorphic processing chip. Among them, fully homomorphic encryption: is an encryption technology that has special properties, allowing computing operations on encrypted data without decrypting the data. This means that calculations can be performed while keeping data encrypted, without revealing the plaintext content of the data. Automorphism: operation on homomorphic ciphertext polynomial, is an important step of rotation operation. It rearranges the positions of the input coefficient vector according to the rotation distance. In the embodiment of the specification, the above homomorphic ciphertext polynomial can be obtained after RNS processing. RNS: a method of dividing a large integer into several small integers according to the Chinese remainder theorem, commonly used in large number representation in some cryptographic algorithms. In FHE, a polynomial with a large integer coefficient is usually divided into several polynomials with small integer coefficients by RNS.

[0047] Reference Figure 1 The automorphism needs to process the coefficient array of the polynomial, for example, each element a(0), a(1), …, a(7) in the input array corresponds to a polynomial, and after the input array is processed by the automorphism, each element a(0), a(1), …, a(7) in the result array corresponds to another polynomial. It can be understood that the element a(0) in the input array and the element a(0) in the result array are not the same element, and they are only used to identify the position of the element in an array. When each element of the result array is written in sequence, each element of the corresponding input array is out of order. For example, the element a(0) of the result array corresponds to the element a(4) of the input array, the element a(1) of the result array corresponds to the element a(5) of the input array, …, and the element a(7) of the result array corresponds to the element a(3) of the input array. This makes it difficult to retrieve multiple elements in the input array using on-chip memory at the same time, while the result array can be simply partitioned and processed in parallel. In the embodiment of the specification, the parallelism corresponding to each element in the input array is provided, which can adjust the parallelism according to the time required by the automorphism operation.

[0048] Figure 2 An implementation scenario of another embodiment disclosed in the specification is shown. The implementation scenario relates to processing of automorphism operation in fully homomorphic encryption, which is performed by a fully homomorphic processing chip. Among them, the input array and the result array are divided into several groups respectively, and the groups of the input array and the groups of the result array have a corresponding relationship, so that the multiple elements included in a group of the input array can be mapped to the correct position in the result array in parallel, and the on-chip memory only needs to store the element values of one group at a time, without occupying additional on-chip memory space, which is conducive to parallel processing and can produce acceleration effect.

[0049] Referring to Figure 2 The element index of an element in an array is represented in binary, for example, the element index of element a(0) can be represented as 000, the element index of element a(1) can be represented as 001, the number of bits of the element index is related to the number of elements in the array, Figure 2 The input array in (a) is divided into 2 groups, and the input array in (b) is divided into 4 groups, and the input array in (c) is divided into 8 groups, and the input array in (d) is divided into 16 groups. The input array in (e) is divided into 32 groups, and the input array in (f) is divided into 64 groups. The input array in (g) is divided into 128 groups, and the input array in (h) is divided into 256 groups. The input array in (i) is divided into 512 groups, and the input array in (j) is divided into 1024 groups. The input array in (k) is divided into 2048 groups, and the input array in (1) is divided into 4096 groups. The input array in (m) is divided into 8192 groups, and the input array in (n) is divided into 16384 groups. The input array in (o) is divided into 32768 groups, and the input array in (p) is divided into 65536 groups. The input array in (q) is divided into 131072 groups, and the input array in (r) is divided into 262144 groups. The input array in (s) is divided into 524288 groups, and the input array in (t) is divided into 1048576 groups. The input array in (u) is divided into 2097152 groups, and the input array in (v) is divided into 4194304 groups. The input array in (w) is divided into 8388608 groups, and the input array in (x) is divided into 16777216 groups. The input array in (y) is divided into 33554432 groups, and the input array in (z) is divided into 67108864 groups. Figure 2 The input array and the result array are divided into 2 groups respectively, and for the 1 most significant bit of the element index, when the 1 most significant bit of the element index in the result array is 1, the 1 most significant bit of the element index in the corresponding input array is 0, so that the corresponding groups in the input array and the result array can be found according to the 1 most significant bit of the element index. Figure 2 The input array and the result array are divided into 4 groups respectively, and for the 2 most significant bits of the element index, when the 2 most significant bits of the element index in the result array are 00, the 2 most significant bits of the element index in the corresponding input array are 10, so that the corresponding groups in the input array and the result array can be found according to the 2 most significant bits of the element index. By analogy, the array can be divided into 2 x groups according to the x most significant bits of the element index, each group containing 2 y elements, where y = log2 N - x, N is the number of elements in the array.

[0050] According to the embodiments of the present specification, by sequentially traversing each group of the result array, the current group of the input array corresponding to the current group of the result array can be determined respectively, and all elements in the current group of the input array can be extracted in parallel. Since the elements of the result array are sequential, burst-mode mode transmission can be used, and the elements of the input array need to be buffered on-chip. According to the fact that each group of the input array has 2 y elements, the on-chip buffer is partitioned into 2 y parts, so that all elements in the current group of the input array can be taken out in one cycle, then mapped to the correct position of the result array and output in parallel. Only the current group of the input array of the auto- isomorphic operation needs to be stored in the on-chip memory, and the result array uses off-chip storage, without the need for additional on-chip memory for buffering. In addition, the parallelism can also be adjusted by modifying the value of y.

[0051] Figure 3 A processing method flow chart of automorphism operation in homomorphic encryption according to an embodiment is shown, which is executed by a homomorphic processing chip, and the method can be based on Figure 1 The implementation scenario is shown. As Figure 3 The processing method of automorphism operation in homomorphic encryption in the embodiment includes the following steps: step 31, according to a preset parameter, dividing an input array of automorphism operation into M first groups, and dividing a result array to be determined element value into M second groups; step 32, according to an output order, respectively and sequentially executing a first operation on the M second groups; wherein the first operation for the current second group includes: step 321, determining a current first group corresponding to the current second group in the M first groups according to a first mapping relationship; step 322, reading a plurality of first element values in the current first group in the input array from off-chip storage of the homomorphic processing chip and storing them in on-chip memory; step 323, rearranging the plurality of first element values into a plurality of second element values as the current second group output to the off-chip storage according to a second mapping relationship. The specific execution mode of each of the above steps is described below.

[0052] First, in step 31, according to a preset parameter, an input array of automorphism operation is divided into M first groups, and a result array to be determined element value is divided into M second groups. It can be understood that the preset parameter can include a preset parallel degree for parallel processing of the input array, and according to the parallel degree, the specific value of M can be determined.

[0053] In one example, each element in the input array is a polynomial coefficient in homomorphic encryption.

[0054] In this example, automorphism operation can be used to implement various homomorphic operations and homomorphic applications, and the input array can be represented as a[N], which includes N elements.

[0055] In one example, the input array of automorphism operation is divided into M first groups and the result array to be determined element value is divided into M second groups according to the preset parameter, including:

[0056] According to a preset parallel degree for parallel processing of the input array, M is determined as the number of elements in the input array divided by the parallel degree; the number of elements in the input array is the same as the number of elements in the result array;

[0057] The input array is divided into M first groups according to the element index order, and the number of elements in each first group is the same as the parallelism value. The result array is divided into M second groups according to the element index order, and the number of elements in each second group is the same as the parallelism value.

[0058] In this example, the number of groups and the number of elements in each group can be flexibly determined based on the degree of parallelism. For instance, the degree of parallelism is used to indicate parallel processing of the y least significant bits of the element index; correspondingly, the degree of parallelism is 2. y M is Each group has 2 y Each element.

[0059] For example, in Figure 2 As shown in (a), the input array has 8 elements, and the parallelism is used to indicate parallel processing for the two least significant bits of the element indices. Accordingly, the parallelism is 4. The input array is divided into two groups, each with 4 elements, and the result array is also divided into two groups, each with 4 elements. For example, one group of the input array includes element indices 000, 001, 010, and 011. Figure 2 As shown in (b), the input array has 8 elements, and the parallelism is used to indicate parallel processing for the least significant bit of the element index. Accordingly, the parallelism is 2. The input array is divided into 4 groups, each with 2 elements, and the result array is divided into 4 groups, each with 2 elements. Taking one group of the input array as an example, the elements included are indices 000 and 001.

[0060] Then, in step 32, the first operation is performed on each of the M second groups in the output order. It can be understood that the elements of the result array are output in index order.

[0061] The first operation for the current second group includes:

[0062] Step 321: Based on the first mapping relationship, determine the current first group among the M first groups that corresponds to the current second group. It can be understood that the first mapping relationship reflects the mapping relationship between a group in the input array and a group in the result array.

[0063] In one example, determining the current first group corresponding to the current second group among M first groups based on the first mapping relationship includes:

[0064] According to a first mapping relationship between a number of most significant bits of the element index of the current second group and a number of most significant bits of the element index of the current first group, the number of most significant bits is adapted to M.

[0065] In this example, each element index of the same group has the same number of most significant bits, which can be used as a group identifier. The more the number of groups, the more the number of bits of the most significant bits. For example, in Figure 2 As shown in (a), the input array and the result array are divided into two groups respectively. For the one most significant bit of the element index, when the one most significant bit of the element index in the result array is 1, the one most significant bit of the element index in the corresponding input array is 0. Figure 2 As shown in (b), the input array and the result array are divided into four groups respectively. For the two most significant bits of the element index, when the two most significant bits of the element index in the result array are 00, the two most significant bits of the element index in the corresponding input array are 10.

[0066] Further, the determining the number of most significant bits of the element index of the current first group comprises:

[0067] Reversing the order of each bit of the number of most significant bits of the element index of the current second group to obtain a first reversed bit sequence corresponding thereto;

[0068] Determining a first intermediate index according to the first reversed bit sequence and a pre-set Galois parameter;

[0069] Obtaining a second intermediate index by intercepting a number of least significant bits of the first intermediate index;

[0070] Reversing the order of each bit of the second intermediate index to obtain a second reversed bit sequence corresponding thereto, and taking the second reversed bit sequence as the number of most significant bits of the element index of the current first group.

[0071] In this example, parallel automorphism in the form of NTT can be realized. The above processing process can be realized by the following code:

[0072]

[0073] In the above code, j represents the group identifier of the current second group, i.e. the number of most significant bits of the element index of the current second group, reversed represents the first reversed bit sequence, galois_elt represents the Galois parameter, and each idx_high obtained through a plurality of processes represents the first intermediate index, the second intermediate index and the number of most significant bits of the element index of the current first group in turn.

[0074] Step 322, reading the plurality of first element values in the current first group in the input array from the off-chip storage of the full homomorphic processing chip and storing the plurality of first element values in the on-chip memory. It can be understood that, in a period of time, the on-chip memory only needs to cache the element values of one group, and does not need to cache the element values of the entire input array, which is suitable for the condition of scarce on-chip memory resources.

[0075] In one example, the on-chip memory includes BRAM or URAM, and the off-chip storage includes DDR or HBM.

[0076] In this example, only for optional implementation of the on-chip memory and the off-chip storage, it can be understood that the on-chip memory is not limited to including BRAM or URAM, and the off-chip storage is not limited to including DDR or HBM.

[0077] BRAM (block random access memory): a special random access memory (RAM) resource in a field programmable gate array (FPGA), fixedly distributed in a specific position inside the FPGA.

[0078] URAM (UltraRAM): UltraRAM is a unique storage resource in an UltraScale Plus chip.

[0079] DDR: double data rate SDRAM, usually a memory chip grain located outside the FPGA chip.

[0080] HBM: high bandwidth memory, usually a memory chip grain located outside the FPGA chip, which has a higher read-write bandwidth rate than DDR.

[0081] Step 323, rearranging the plurality of first element values as a plurality of second element values according to a second mapping relationship, and outputting the plurality of second element values as a current second group to the off-chip storage. It can be understood that the order of the element values is determined, that is, the element index corresponding to the element values is determined.

[0082] In one example, the rearranging the plurality of first element values as a plurality of second element values according to a second mapping relationship, and outputting the plurality of second element values as a current second group to the off-chip storage includes:

[0083] According to a second mapping relationship between a plurality of least significant bits of two element indexes, for each second element index in the current second group, it is determined that the second element index maps to a plurality of least significant bits of a first element index in the current first group; according to the plurality of least significant bits of the first element index, a first element value of the first element index is selected from the plurality of first element values as a second element value of the second element index having a mapping relationship with the first element index;

[0084] The plurality of second element values obtained by the parallel execution are combined in the order of the second element indexes to form the current second group, and are sequentially output to the off-chip storage.

[0085] In this example, each element index of the same group has the same plurality of most significant bits, and by determining the plurality of least significant bits of the second element index mapped to the first element index, the first element index having a mapping relationship with the second element index can be determined, and the plurality of first element values have been stored in the on-chip memory, so that this processing process can be executed in parallel. For example, in Figure 2 (a) of FIG. 1 shows that one group of the input array includes element indexes 000, 001, 010, 011, and one group of the result array includes element indexes 100, 101, 110, 111, the two groups have a mapping relationship, wherein 1 most significant bit of the element indexes can be used to identify the group, the two groups have a first mapping relationship between 1 most significant bit of the element indexes, and the two groups have a second mapping relationship between 2 least significant bits of the element indexes. Figure 2 (b) of FIG. 1 shows that one group of the input array includes element indexes 000, 001, and one group of the result array includes element indexes 100, 101, the two groups have a mapping relationship, wherein 2 most significant bits of the element indexes can be used to identify the group, the two groups have a first mapping relationship between 2 most significant bits of the element indexes, and the two groups have a second mapping relationship between 1 least significant bit of the element indexes.

[0086] Further, the determining that the second element index maps to the plurality of least significant bits of the first element index in the current first group comprises:

[0087] For the plurality of least significant bits of the second element index in the current second group, the order of the plurality of least significant bits is reversed to obtain a third reversed bit sequence corresponding thereto;

[0088] The first reversed bit sequence and the third reversed bit sequence are spliced to obtain a third intermediate index; the first reversed bit sequence is obtained by reversing the order of each bit for the plurality of most significant bits of the element index in the current second group.

[0089] determining a fourth intermediate index according to the third intermediate index and the preset Galois parameter;

[0090] extracting several most significant bits of the fourth intermediate index to obtain a fifth intermediate index;

[0091] reversing the order of each bit of the fifth intermediate index to obtain a fourth reversed bit sequence corresponding to the fifth intermediate index, and taking the fourth reversed bit sequence as several least significant bits of the first element index in the current first group mapped to the second element index.

[0092] In this example, parallel automorphism in the form of NTT can be implemented. The above processing procedure can be implemented by the following code:

[0093]

[0094] In the above code, j represents the group identifier of the current second group, i.e. several most significant bits of the element index of the current second group, reversed represents the first reversed bit sequence, galois_elt represents the Galois parameter, and each idx_high obtained through multiple processing represents the first intermediate index, the second intermediate index, and several most significant bits of the element index of the current first group in turn. i represents several least significant bits of the element index of the current second group, idl_revs_bit[i] represents the third reversed bit sequence, reversed_low represents the third intermediate index, and each idx_low obtained through multiple processing represents the fourth intermediate index, the fifth intermediate index, and several least significant bits of the element index of the current first group in turn, and a[N] represents the input array. represents the result array.

[0095] According to the method provided in the embodiments of the present specification, the homomorphic processing chip first divides an input array of a self-morphism operation into M first groups according to preset parameters, and divides a result array in which element values are to be determined into M second groups; then, a first operation is performed on the M second groups in sequence according to an output order; wherein the first operation for a current second group includes: determining a current first group corresponding to the current second group from the M first groups according to a first mapping relationship; reading a plurality of first element values in the current first group from the input array from off-chip storage of the homomorphic processing chip and storing the plurality of first element values in on-chip memory; and rearranging the plurality of first element values into a plurality of second element values as output of the current second group to the off-chip storage according to a second mapping relationship. As can be seen from the above, according to the embodiments of the present specification, the input array and the result array are divided into a plurality of groups respectively, the current first group corresponding to the current second group can be determined by using the first mapping relationship, and the plurality of first element values in the current first group are mapped to correct output positions by using the second mapping relationship, the on-chip memory only needs to store the element values of one group at a time, without occupying additional on-chip memory space, which is beneficial to parallel processing and can produce an acceleration effect.

[0096] According to another aspect, embodiments also provide a homomorphic processing chip for performing the method provided in the embodiments of the present specification. Figure 4 A schematic block diagram of a homomorphic processing chip according to one embodiment is shown. As shown, the chip 400 includes: Figure 4

[0097] a processor 41 and on-chip memory 42;

[0098] The processor 41 is configured to divide an input array of a self-morphism operation into M first groups and divide a result array in which element values are to be determined into M second groups according to preset parameters; and perform a first operation on the M second groups in sequence according to an output order; wherein the first operation for a current second group includes:

[0099] determining a current first group corresponding to the current second group from the M first groups according to a first mapping relationship;

[0100] reading a plurality of first element values in the current first group from the input array from off-chip storage of the homomorphic processing chip and storing the plurality of first element values in on-chip memory 42;

[0101] rearranging the plurality of first element values into a plurality of second element values as output of the current second group to the off-chip storage according to a second mapping relationship.

[0102] Optionally, as one embodiment, each element in the input array is a polynomial coefficient in homomorphic encryption.​

[0103] Optionally, as an embodiment, the processor 41 is specifically used for:

[0104] determining M as the number of elements in the input array divided by the parallelism degree of parallel processing of the input array according to the parallelism degree of parallel processing of the input array preset in advance; the number of elements in the input array is the same as the number of elements in the result array;

[0105] dividing the input array into M first groups in the order of element indexes, each first group having the same number of elements as the value of the parallelism degree, and dividing the result array into M second groups in the order of element indexes, each second group having the same number of elements as the value of the parallelism degree.

[0106] Optionally, as an embodiment, the processor 41 is specifically used for determining the several most significant bits of the element index of the current first group according to the first mapping relationship between the several most significant bits of two element indexes and the several most significant bits of the element index of the current second group.

[0107] Further, the determination of the several most significant bits of the element index of the current first group comprises:

[0108] reversing the order of each bit of the several most significant bits of the element index of the current second group to obtain a corresponding first reversed bit sequence;

[0109] determining a first intermediate index according to the first reversed bit sequence and a preset Galois parameter;

[0110] obtaining a second intermediate index by intercepting the several least significant bits of the first intermediate index;

[0111] reversing the order of each bit of the second intermediate index to obtain a corresponding second reversed bit sequence, and taking the second reversed bit sequence as the several most significant bits of the element index of the current first group.

[0112] Optionally, as an embodiment, the processor 41 is specifically used for:

[0113] according to a second mapping relationship between the several least significant bits of two element indexes, for each second element index in the current second group, performing in parallel: determining the several least significant bits of the first element index in the current first group to which a second element index maps; and according to the several least significant bits of the first element index, selecting the first element value of the first element index from the plurality of first element values as the second element value of the second element index having a mapping relationship with the first element index.

[0114] The plurality of second element values obtained by parallel execution are combined into a current second group in order of the second element indexes and sequentially output to the off-chip storage.

[0115] Further, the determining of the several least significant bits of the first element indexes in the current first group to which the second element indexes are mapped comprises:

[0116] For the several least significant bits of the second element indexes in the current second group, the order of the several least significant bits is reversed to obtain a third reversed bit sequence corresponding thereto;

[0117] The first reversed bit sequence and the third reversed bit sequence are spliced to obtain a third intermediate index; the first reversed bit sequence is obtained by reversing the order of the several most significant bits of the element indexes in the current second group;

[0118] The third intermediate index and a preset Galois parameter are used to determine a fourth intermediate index;

[0119] The several most significant bits of the fourth intermediate index are intercepted to obtain a fifth intermediate index;

[0120] The order of the bits of the fifth intermediate index is reversed to obtain a fourth reversed bit sequence corresponding thereto, which is used as the several least significant bits of the first element indexes in the current first group to which the second element indexes are mapped.

[0121] Optionally, as an embodiment, the on-chip memory comprises a BRAM or a URAM, and the off-chip storage comprises a DDR or a HBM.

[0122] According to the chip provided by the embodiments of the present application, the processor 41 of the homomorphic processing chip first divides the input array of the automorphism operation into M first groups according to preset parameters, and divides the result array of the element value to be determined into M second groups; then, the first operation is performed on the M second groups in sequence according to the output order; wherein, the first operation for the current second group includes: determining the current first group corresponding to the current second group in the M first groups according to the first mapping relationship; reading the plurality of first element values in the current first group in the input array from the off-chip storage of the homomorphic processing chip and storing them in the on-chip memory 42; and rearranging the plurality of first element values into a plurality of second element values as the output of the current second group to the off-chip storage according to the second mapping relationship. As can be seen from the above, according to the embodiments of the present application, the input array and the result array are divided into a plurality of groups respectively, the current first group corresponding to the current second group can be determined by using the first mapping relationship, and the plurality of first element values in the current first group are mapped to the correct output position by using the second mapping relationship, so that the on-chip memory only needs to store the element values of one group at a time, without occupying additional on-chip memory space, which is beneficial to parallel processing and can produce an acceleration effect.

[0123] According to another aspect, embodiments also provide a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method described in conjunction with Figure 3 According to another aspect, embodiments also provide a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method described in conjunction with

[0124] According to another aspect, embodiments also provide a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method described in conjunction with Figure 3 According to another aspect, embodiments also provide a computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method described in conjunction with

[0125] Those skilled in the art should be aware that the functions described in the above one or more examples can be implemented in hardware, software, firmware or any combination thereof. When implemented in software, the functions can be stored in a computer readable medium or transmitted as one or more instructions or codes on a computer readable medium.

[0126] The above detailed description sets forth the purposes, technical solutions and beneficial effects of the present application. It should be understood that the above detailed description is only a specific implementation of the present application and is not used to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made on the basis of the technical solutions of the present application shall be included in the protection scope of the present application.

Claims

1. A processing method of automorphism operation in homomorphic encryption, executed by a homomorphic processing chip, comprising: dividing an input array of the automorphism operation into M first groups according to preset parameters, and dividing a result array to be determined element values into M second groups; respectively sequentially performing a first operation on the M second groups according to an output order; wherein the first operation for a current second group comprises: determining a current first group corresponding to the current second group from the M first groups according to a first mapping relationship; reading a plurality of first element values in the current first group from the input array into on-chip memory from off-chip storage of the homomorphic processing chip; rearranging the plurality of first element values into a plurality of second element values as the current second group output to the off-chip storage according to a second mapping relationship.

2. The method of claim 1, wherein, Each element in the input array is a polynomial coefficient in homomorphic encryption.

3. The method of claim 1, wherein, The dividing of the input array of the automorphism operation into M first groups according to preset parameters, and the dividing of the result array to be determined element values into M second groups, comprises: determining M as the number of elements in the input array divided by a parallel degree for parallel processing of the input array according to the preset parallel degree; the number of elements in the input array is the same as the number of elements in the result array; dividing the input array into M first groups according to element index order, each first group having the same number of elements as the value of the parallel degree, and dividing the result array into M second groups according to element index order, each second group having the same number of elements as the value of the parallel degree.

4. The method of claim 1, wherein, The determining of the current first group corresponding to the current second group from the M first groups according to the first mapping relationship comprises: determining a plurality of most significant bits of an element index of the current first group according to a first mapping relationship between a plurality of most significant bits of two element indexes and a plurality of most significant bits of an element index of the current second group, the number of the most significant bits being adapted to M.

5. The method of claim 4, wherein, The determining of the plurality of most significant bits of the element index of the current first group comprises: reversing the order of each bit of the plurality of most significant bits of the element index of the current second group to obtain a corresponding first reversed bit sequence; determining a first intermediate index according to the first reversed bit sequence and a preset Galois parameter; obtaining a second intermediate index by truncating a plurality of least significant bits of the first intermediate index; reversing the order of each bit of the second intermediate index to obtain a corresponding second reversed bit sequence, which is used as the plurality of most significant bits of the element index of the current first group.

6. The method of claim 1, wherein, The rearranging of the plurality of first element values into a plurality of second element values as the current second group output to the off-chip storage according to the second mapping relationship comprises: According to a second mapping relationship between a plurality of least significant bits of a second element index, for each second element index in a current second group, perform in parallel: determining a plurality of least significant bits of a first element index in a current first group to which the second element index is mapped; and according to the plurality of least significant bits of the first element index, selecting a first element value of the first element index from the plurality of first element values as a second element value of the second element index having a mapping relationship with the first element index; Combine the plurality of second element values obtained by parallel execution into the current second group in the order of the second element indexes, and output to the off-chip storage in sequence.

7. The method of claim 6, wherein, The determining of the plurality of least significant bits of the first element index in the current first group to which the second element index is mapped comprises: For a plurality of least significant bits of a second element index in a current second group, reverse the order of the plurality of least significant bits to obtain a corresponding third reversed bit sequence; Splice the first reversed bit sequence and the third reversed bit sequence to obtain a third intermediate index; the first reversed bit sequence is obtained by reversing the order of each bit for a plurality of most significant bits of an element index of the current second group; According to the third intermediate index and a pre-set Galois parameter, determine a fourth intermediate index; Intercept a plurality of most significant bits of the fourth intermediate index to obtain a fifth intermediate index; Reverse the order of each bit of the fifth intermediate index to obtain a corresponding fourth reversed bit sequence, which is used as the plurality of least significant bits of the first element index in the current first group to which the second element index is mapped.

8. The method of claim 1, wherein, The on-chip memory comprises a BRAM or a URAM, and the off-chip storage comprises a DDR or a HBM.

9. An all-homomorphic processing chip comprising: A processor and an on-chip memory; The processor is configured to divide an input array of a self-similar operation into M first groups according to a pre-set parameter, and divide a result array to be determined element values into M second groups; According to an output order, perform a first operation on the M second groups in sequence respectively; wherein the first operation on a current second group comprises: According to a first mapping relationship, determine a current first group corresponding to the current second group in the M first groups; Read a plurality of first element values in the current first group in the input array from the off-chip storage of the full homomorphic processing chip and store them in the on-chip memory; According to a second mapping relationship, rearrange the plurality of first element values into a plurality of second element values and output to the off-chip storage as the current second group.

10. A computer readable storage medium having stored thereon a computer program which, when executed in a computer, causes the computer to perform the method of any one of claims 1-8.

11. A computing device comprising a memory and a processor, the memory having stored therein executable code which, when executed by the processor, implements the method of any one of claims 1-8.

Images