Acceleration device and method for fully homomorphic encryption operation

Abstract

The invention provides an acceleration device and method for fully homomorphic encryption operation, and the device comprises an acceleration chip which is provided with a plurality of modular arithmetic unit combinations which are used for executing modular operation of fast number theory transformation in a fully homomorphic encryption algorithm, and each combination comprises a modular adder, a modular arithmetic unit and a modular arithmetic unit, the modular addition module is configured to execute modular addition operation according to an addend, an addend and a modulus based on a modular addition instruction; the modular subtraction device is configured to execute modular subtraction operation according to the minuend, the subtrahend and the modulus based on the modular subtraction instruction; a modular multiplier configured to perform a modular multiplication operation according to the multiplicand, the multiplier, and the modulus based on the modular multiplication instruction; according to the technical scheme of the invention, the modular adder, the modular subtractor and the modular multiplier are arranged to respectively complete modular addition operation, modular subtraction operation and modular multiplication operation of fast number theory transformation with the maximum calculation overhead in the fully homomorphic encryption algorithm; the problem that when corresponding operation is completed in a general processor, multiple sets of instructions need to replace one instruction, and time overhead is increased can be solved, and the calculation time of a fully homomorphic encryption algorithm is shortened.

Description

Technical Field

[0001] The present invention relates to the field of computer architecture, specifically to the field of homomorphic encryption operations, and more specifically to an acceleration device and method for fully homomorphic encryption operations. Background Art

[0002] With the increasing popularity of cloud storage and cloud computing, more and more users choose to store and compute large-scale data in the cloud. Due to the unreliability of the cloud, in order to protect sensitive data, users usually choose to encrypt the data stored in the cloud. However, traditional encryption technology uses keys to encrypt data, but encrypted data is only safe during storage and transmission. Due to the uncertainty of the computing environment, the leakage of keys will still cause privacy exposure and data theft. Therefore, fully homomorphic encryption has gradually become an effective encryption method in the cloud computing process.

[0003] Fully Homomorphic Encryption (FHE) algorithms can perform calculations without decrypting encrypted data. Effective fully homomorphic encryption algorithms can greatly reduce the problem of sensitive data exposure, and have the same effect on internal and external users accessing the system. Using fully homomorphic encryption can protect the privacy of users from being affected by data processors: data processors process data in ciphertext and obtain the final result of data processing (ciphertext); it can achieve that visitors cannot view the plaintext of the data being processed, but can only see the final result of data processing. In cloud computing and distributed systems that require data protection, fully homomorphic encryption technology plays an important role because users can let the server perform calculations without accessing the original unencrypted data.

[0004] However, the algorithm of fully homomorphic encryption is highly complex and requires a lot of mathematical calculations. The computational overhead of fully homomorphic encryption operations is much greater than that of plaintext operations, which limits its application in large-scale data processing. A carefully optimized FHE algorithm is 4 to 6 orders of magnitude slower than a plaintext algorithm without encryption. This slowdown makes the fully homomorphic encryption algorithm difficult to deploy in practical applications despite its advantages such as data privacy protection and computation outsourcing.

[0005] It should be noted that this background technology is only used to introduce the relevant information of the present invention to help understand the technical solution of the present invention, but it does not mean that the relevant information is necessarily the prior art. The relevant information is submitted and disclosed together with the present invention solution. If there is no evidence that the relevant information has been disclosed before the application date of the present invention, the relevant information shall not be regarded as the prior art. Summary of the invention

[0006] Therefore, the purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide an acceleration device and method for fully homomorphic encryption operations. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] The embodiments of the present invention are further described below with reference to the accompanying drawings, in which:

[0008] Figure 1 A schematic diagram of a process flow related to the NTT algorithm in a fully homomorphic encryption acceleration solution according to an embodiment of the present invention;

[0009] Figure 2 is a schematic diagram of butterfly transformation layering according to an embodiment of the present invention;

[0010] Figure 3 is a schematic diagram of a calculation order after butterfly transformation according to an embodiment of the present invention;

[0011] Figure 4 A schematic diagram of butterfly change (data scale is 16) according to an embodiment of the present invention;

[0012] Figure 5 A schematic diagram of bit reversal according to an embodiment of the present invention;

[0013] Figure 6 A schematic diagram of a calculation flow of a butterfly operation according to an embodiment of the present invention;

[0014] Figure 7 A schematic diagram of an instruction shuffling process according to an embodiment of the present invention;

[0015] Figure 8 A schematic diagram of a calculation core data acquisition process and data mapping according to an embodiment of the present invention;

[0016] Fig. 9 A schematic diagram of a calculation core data mapping according to an embodiment of the present invention;

[0017] Fig.10 A schematic diagram of the format of modular addition, modular subtraction, and modular multiplication instructions according to an embodiment of the present invention;

[0018] Fig.11 A schematic diagram of a 64-bit instruction format of modular addition, modular subtraction, and modular multiplication according to an embodiment of the present invention;

[0019] Fig.12 is a schematic structural diagram of an acceleration device according to an embodiment of the present invention;

[0020] Fig.13 is another structural schematic diagram of an acceleration device according to an embodiment of the present invention;

[0021] Fig.14 is a schematic diagram of the structure of a modular adder / subtractor according to an embodiment of the present invention;

[0022] Fig.15 A schematic diagram of a data path of a modular adder / subtractor according to an embodiment of the present invention;

[0023] Fig.16 A schematic diagram of the structure of a modular multiplier according to an embodiment of the present invention;

[0024] Fig.17 A schematic diagram of a data path of a modular multiplier according to an embodiment of the present invention;

[0025] Fig.18 A schematic diagram of computing kernel data dependency according to an embodiment of the present invention;

[0026] Fig.19 A data dependency diagram of a 4×4 NTT computing core array according to an embodiment of the present invention;

[0027] Fig. 20 A schematic diagram of single computing core data stream transmission according to an embodiment of the present invention;

[0028] Fig.21 Schematic diagram of data transmission of computing core No. 0 according to an embodiment of the present invention;

[0029] Fig. 22 Schematic diagram of data correspondence of a 4×4 computing core array according to an embodiment of the present invention. DETAILED DESCRIPTION

[0030] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below through specific embodiments in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0031] As mentioned in the background technology section, fully homomorphic encryption is difficult to deploy in actual applications due to its high computational overhead. Therefore, accelerating the fully homomorphic encryption operation can enable it to be deployed in the actual operation process. This will greatly improve the security of cloud and distributed system computing. In this regard, the present invention constructs an acceleration device for fully homomorphic encryption operations, which includes: a plurality of modular operator combinations, each modular operator combination includes: a modular adder, a modular subtractor and a modular multiplier, based on modular addition instructions, modular subtraction instructions or modular multiplication instructions, the modular operator combination can perform modular operations related to fast number theory transformations, and fast number theory transformations are the computational process with the highest computational overhead in fully homomorphic encryption technology. By accelerating this key computational bottleneck, the purpose of accelerating fully homomorphic encryption can be achieved; and the problem of increasing time overhead by replacing one instruction with multiple sets of instructions when completing the corresponding operation in a general-purpose processor can be avoided; thereby, the running time of the fully homomorphic encryption operation is reduced, so that it can be deployed in actual applications.

[0032] Since the method of the present invention is mainly to accelerate the NTT algorithm, the NTT algorithm is briefly introduced here. Figure 1 The schematic diagram of the overall execution process of an improved NTT algorithm of the present invention is shown. The nodes corresponding to each box represent the tasks to be completed. The entire acceleration process is to first separately process the two matrices required to be calculated by the NTT algorithm; for distinction, they are named matrices A and B ( Figure 1 Not shown, in the first half of the flowchart, the first loop processes matrix A, and the second loop processes matrix B), and then dot multiplication (multiplication) is performed on the two matrices to obtain a multiplication result matrix C (which is the second half of the flowchart), and then the multiplication result matrix C is processed to obtain the final calculation result. Schematically, first, two matrices need to be processed separately. When taking the matrix for the first time, take matrix A first, and then perform relevant data preprocessing operations on matrix A, namely, butterfly change, matrix taking (these two are the improved data preprocessing processes), combined modular operation (layered, a series of combined modular operations are performed on each of them), data transmission (there is data dependency between each node, and this method is used to solve data dependency), and then perform combined modular operation (after the array conversion is realized, another operation is still required to complete the processing of a matrix). This is the operation on a matrix. At this time, the processing of matrix A is completed, and the intermediate result matrix of matrix A is stored back in the memory; then determine whether the calculation processing of the two matrices is completed. If not, it is necessary to take matrix B, and then repeat the operation on matrix A. If it has been completed, it is necessary to access the memory, take out the intermediate result matrices of the two matrices, perform point multiplication and modular, and obtain a multiplication result matrix C, and then perform inverse NTT operation on the multiplication result matrix C (in actual hardware, the calculation process of the above NTT operation is repeated) to obtain the final output result. It should be noted that Figure 1 What is shown is only one NTT algorithm supported by the acceleration device of the present invention. The acceleration device can also be applied to modular addition, modular subtraction and / or modular multiplication operations in other NTT algorithms.

[0033] Figure 1In the calculation, the most complex and time-consuming parts are NTT calculation and inverse NTT calculation. From the perspective of calculation process and hardware design, the difference between inverse NTT calculation and NTT calculation is very small. Reusable design can be adopted for NTT calculation and inverse NTT calculation, so as to achieve the purpose of reducing hardware layout, reducing area and power consumption. Inverse NTT calculation and NTT calculation both need to go through the processes of matrix acquisition, butterfly change, combination module operation, data transmission, etc. The calculation process is the same as NTT calculation, but the selected parameters are different. NTT calculation uses the properties of primitive roots and needs to use primitive roots for calculation; inverse NTT calculation needs to use the inverse elements corresponding to the primitive roots for calculation. In the process of NTT calculation and inverse NTT calculation, it is necessary to iteratively calculate the primitive roots and inverse elements. This process is realized in the compilation process, and then the results to be used are directly placed in the memory and called when needed. In addition, there is no difference in principle for inverse NTT calculation, so the previous acceleration design for NTT calculation can still be used. In the whole acceleration scheme process, it can be regarded as three NTT calculations.

[0034] In addition to constructing a modular operator combination to accelerate modular operations, embodiments of the present invention can also accelerate the butterfly change and / or data dependency in the NTT algorithm. The following introduces three improved acceleration points in the NTT algorithm: butterfly change (NTT algorithm data preprocessing process), modular operation (high-frequency operation in the NTT algorithm), and data dependency (data dependency relationship between different parallel computing cores in the NTT algorithm). However, it should be noted that the three improved acceleration points do not have to be used at the same time, and can be selected according to the needs of the implementer in specific applications.

[0035] 1) NTT algorithm data preprocessing method

[0036] In order to reduce the time overhead of NTT algorithm data preprocessing, such as Figure 1 As shown in S1, the present invention extracts the butterfly change process separately and combines it with the matrix fetching process into one link, and completes the data preprocessing process of the NTT algorithm through instruction shuffling in the compilation stage.

[0037] To perform NTT operations, you need to perform butterfly transformation (data preprocessing) on ​​the data first to obtain the data arrangement order and calculation order. Figure 2 As shown in , the data is grouped according to the parity of the subscript number (or subscript). Each time the grouping is performed, a layer is obtained. In the new layer, the data in each group is rearranged, and in the new group, the data is grouped according to the parity of the subscript number. This grouping process is iterated until there are only two elements to be calculated in each group, which is the bottom layer. Figure 2The rightmost layer is the bottom layer diagram, and the two data in each group are a group. The data arrangement order of the bottom layer is the final arrangement order before the NTT operation. During the calculation process of the NTT algorithm, the data arrangement order of the bottom layer will not be changed, and there is no need to exchange the data position. Take the third layer as an example: Figure 2 The process from the second layer to the third layer in the figure is to perform parity grouping for the rearranged order in the second layer, and extract the even group and the odd group respectively as a new group. The red and blue blocks are used in the figure to distinguish the data belonging to the even group and the odd group. In the second group, there are two parts. The upper part is the even group in the first layer. The lower part is the odd group in the first layer. These two groups will be regrouped in the process of changing to the third layer, and they will be divided into four groups at the third layer. After the third layer, the data of each group is still grouped according to the subscript number. Take the top even group of the third layer as an example. Although all the groups are even numbers at this time, the subscript number has parity. Therefore, grouping is performed according to the subscript number. At this time, 0, 8 and the data in the even position are a new group, and 4, 12 and the data in the new odd position are another new group. This process will continue until there are only two data in each group in the bottom layer. At this time, the two data in the bottom layer are the two corresponding data that need to be operated in the subsequent calculation. At this point, the data preprocessing process is completed. The reasons and beneficial effects of adopting this grouping rule are: it reduces the amount of data that needs to be calculated in subsequent calculations, reduces the overall time complexity, and determines the calculation order of the overall data and the order of the data finally stored back in this process. The data arrangement order at the bottom level is the order when it is finally stored back. For every two data to be calculated, two results will be obtained after the calculation. These two results can be directly stored back to the location where the data is retrieved, reducing the time overhead caused by subsequent data transformations.

[0038] It should be noted that Figure 2 In the figure, n in the bottom layer represents the overall data size. Because the data size is unknown, it is impossible to infer the value of the subscript number of each group of two data below. Therefore, some groups of data in the bottom layer are replaced by A, B, C, D, E, etc. (A1 and A2 are a group, and the rest are similar and will not be repeated here). In fact, they all represent the specific subscript numbers of the corresponding data.

[0039] During the data preprocessing process, the calculation order of the subsequent modular operations is determined. In different layers, the interval between the two numbers to be calculated is also different. Figure 3As shown, it is a schematic diagram of the calculation order, and the two data of the same group to be calculated are of the same color block. In the bottom layer, the data of the same group are adjacent. After calculating two numbers, two more numbers can be taken backwards, such as taking data X1 and X2 for the first time, taking data X3 and X4 for the second time, and taking data X5 and X6 for the third time...; in the second bottom layer, the data of the same group are separated by one data. After the current four data items are calculated in pairs, it is necessary to start from the fifth item to ensure that each data in each layer is calculated only once, such as taking data X1 and X3 for the first time, taking data X2 and X4 for the second time, and taking data X5 and X7 (not shown) for the third time...;. The following layers are analogous to this, until each group of data in the first layer is calculated, and an NTT calculation is completed.

[0040] According to an example of the present invention, see Figure 4 , taking the data size of 16 as an example, the schematic diagram of the butterfly transformation process. Before performing NTT operation on an array, a butterfly transformation (bit inversion) is required first. Each time the NTT transformation is performed, the original polynomial needs to be decomposed into an odd function and an even function. The odd function and the even function decomposed in each layer are collectively referred to as a function. Each step can be called a layer, and Step 1 is the highest layer. The initial matrix arrangement is as follows Figure 4 As shown in Step 1 in the figure, as the butterfly changes downward, when it reaches the Step 2 layer, it is split into two functions based on parity. The terms in the two newly emerged functions, according to the arrangement in Step 1, only have a single odd term and an even term, but each function itself can be split again according to the properties of parity. When the butterfly changes to the lowest Step 4 layer, there are only two terms in each function, the 0th term is paired with the 8th term, and the 4th term is paired with the 12th term. From this, we can find a pattern that 0-15 requires exactly 4 binary bits to represent (the larger the data scale, the more binary bits are required).

[0041] The subscript numbers before the first layer transformation and the last layer are expressed in binary and compared with each other, and the following can be obtained: Figure 5 The bit reversal diagram shown. The last layer, from top to bottom, is the left-right reversal of the initial arrangement order. If we can find the left-right reversal of the binary bit of the item number index, we can determine which two items are paired in the last layer.

[0042] Figure 6The schematic calculation process of butterfly operation is shown. From a macro perspective, NTT calculation is a process of merging calculations from the bottom up. Taking Step 4 to Step 3 as an example, the matrix is ​​first butterfly-transformed to the situation of Step 4, and then the calculation is started from the bottom layer. The red box in Step 4 is regarded as a function, and the two data in a box are calculated one by one. After all the functions in the Step 4 layer are calculated, the function calculation of the Step 3 layer begins. In Step 3 in the figure, the red box represents a newly combined group, and the data in the two blue boxes are the objects of the new round of calculations, that is, the step length of the function is doubled. When calculating the bottom layer, the step length is 1, and the group is calculated once. For each layer upward, the step length will be multiplied by 2, and the number of calculations in the group will also be multiplied by 2. In the figure, at the Step4 layer, the first group of data is calculated for the data with subscripts 0 and 8 in the original data. After rising to the Step3 layer, the two groups of data with subscripts 0, 8, 4, and 12 in the original data are combined into a new group of data, but the order of the data after the butterfly transformation is not changed. At this time, the step size is expanded to 2, and it is necessary to calculate once for the data with subscripts 0 and 4, and calculate once for the data with subscripts 8 and 12. The Step2 layer is similar to the Step1 layer, and the step size and the number of calculations within the group will be further expanded.

[0043] If the data is transformed by changing the storage order of data according to the prior art, it needs to be implemented through multiple memory accesses or multiple transmissions in the computing core, which will greatly increase the time cost. Therefore, the present invention reduces the number of memory accesses or data exchanges of the computing core through instruction shuffling, realizes data preprocessing through one memory access, and does not need to complete data arrangement and adjustment of the computing order through data transmission before calculation.

[0044] According to an embodiment of the present invention, this embodiment can complete the butterfly change process through the instruction shuffle mechanism, and transform the address offset of the instruction fetch accordingly. The instruction shuffle mechanism includes: obtaining the data scale to be calculated by the computing core, rounding the data scale to be calculated upward to the minimum power of 2, and obtaining the rounded data scale L; generating an original array, the number of items of the original array is equal to the rounded data scale, the subscript number of each item in the original array is from 0 to L-1, and each subscript number corresponds to a fetch instruction; generating a transformation array, the number of items of the transformation array corresponds to the number of items of the original array, and the subscript number of each item in the transformation array is equal to the left-right flip result of the binary expression of the subscript number of the corresponding item of the original array; exchanging the address offset of the data fetched by the instruction fetch corresponding to each subscript number in the original array with the address offset of the data fetched by the instruction fetch corresponding to the subscript number of the corresponding item in the transformation array, and obtaining the instruction fetch after instruction shuffle, wherein the instruction fetch after instruction shuffle is set to be executed in sequence. The technical solution of this embodiment can at least achieve the following beneficial technical effects: the data preprocessing process of the NTT algorithm is completed by instruction shuffling in the compilation stage. The time overhead of data preprocessing is reduced, and the order of calculation (execution in sequence) and the arrangement of the final data are clarified in this process, and there is no need to arrange the data after calculation.

[0045] Instruction shuffling needs to be cycled twice. The first cycle generates a transformation array to mark the position to which each bit needs to be transformed, and the second cycle traverses the entire instruction to be transformed. Instruction shuffling needs to be cycled twice. The first cycle generates a transformation array to mark the position to which each bit needs to be transformed, and the second cycle traverses the entire instruction to be transformed. First, obtain the size of the data to be calculated, and then take the smallest power of 2 length upward to ensure that each group has two data for calculation at the bottom layer of the butterfly transformation. In the first step, since each i needs to be converted to its inverted bit, its highest bit (the leftmost bit) will become the second highest bit, so it is necessary to obtain this information from the inverted bit of i / 2, take out the inverted bit representation corresponding to i / 2 from the temp array, and shift it right again by one bit. At this time, a length-1 bit number is obtained, and then the highest bit is filled with 0. In the second step, if the current traversed i is an odd number, the highest bit of temp[i] is set to 1, otherwise the highest bit is 0 (this is because after the odd number is transformed, the high bit is 1, and after the even number is transformed, the high bit is 0, so it is necessary to judge the parity). In the third step, combine the binary results of the first and second steps through an OR operation to get the inversion of i. Perform the above three steps for each i to get a transformation array temp of the instruction shuffle order. The second loop traversal needs to compare the subscript of the instruction fetch with the transformation array temp. If the subscript of the instruction fetch is smaller, it is necessary to complete an instruction shuffle and exchange the address offset of the data fetched on the chip with the instruction corresponding to temp[i]. When all instructions are shuffled, they are executed in order to ensure the correctness of the calculation order.

[0046] Figure 7The schematic flow of an instruction shuffle is shown. The instruction shuffle needs to be looped twice. The first loop generates a transformation array temp (also called temp array) to mark the position to which each bit needs to be transformed. The second loop traverses the entire instruction to be transformed. First, obtain the size of the data to be calculated, and then take the smallest power of 2 length upward to ensure that each group has two data to be calculated at the bottom layer of the butterfly transformation. Step 1, since each i needs to be converted to its inverted bit, its highest bit (the leftmost bit) will become the second highest bit, so it is necessary to obtain this information from the inverted bit of i / 2, take out the inverted bit representation corresponding to i / 2 from the temp array, and shift it right again by one bit. At this time, a length-1 bit number is obtained, and then the highest bit is filled with 0. Step 2, if the currently traversed i is an odd number, set the highest bit of temp[i] to 1, otherwise the highest bit is 0 (this is because after the odd number is transformed, the high bit is 1, and after the even number is transformed, the high bit is 0, so it is necessary to judge the parity). Step 3, combine the binary results of step 1 and step 2 through the OR operation to get the inversion of i. Perform the above three steps for each i, and you can get a transformation array temp of the instruction shuffle order. The second loop traversal needs to compare the subscript of the instruction fetched with the transformation array temp. If the subscript of the instruction fetched is smaller, it is necessary to complete an instruction shuffle and exchange the address offset of the data fetched on the chip with the instruction corresponding to temp[i]. When all instructions are shuffled, they are executed in order to ensure the correctness of the calculation order.

[0047] In schematic form, assume that the size of the data to be calculated is 16, and then round up to the smallest power of 2 to ensure that each group at the bottom level has two data to calculate. Since 16 is a power of 2, the rounding up here is still 16. The first loop needs to generate a transformation array temp, which is used to determine which instruction needs to be transformed in the second loop. The first loop traverses from 0 to 2 4 All items i with a value of -1 must be traversed in order here, because subsequent operations will also require the use of the results of the previous array.

[0048] Since the size of the data to be calculated is usually very large, the time overhead of instruction shuffling and subsequent NTT algorithm calculation in the computing core will be very large. Figure 8 As shown, in order to improve the parallelism of computing resources, the present invention arranges data in a matrix manner and retrieves data in column groups. Figure 8The left side shows the data fetching process of 1 to n NTT computing cores (also referred to as computing cores). The first step is to write the data of the first NTT computing core into the register corresponding to the instruction after the instruction shuffle. When the data to be calculated of a single computing core is written, the calculation can be started without waiting for the unified operation of all computing cores. The second step is to determine whether all computing cores have finished fetching data. If there are still some that have not finished fetching data, the next computing core will be accessed in sequence to start fetching data; if all computing cores have finished fetching data, the fetching is completed. Figure 8 The right side shows the data mapping of the NTT computing core fetching data. In the embodiment, the column length A and row length B of the matrix stored in the data storage unit need to be set to an integer multiple of the number of computing cores to ensure that all computing cores can be calculated in parallel and reduce the waiting time caused by uneven distribution of computing resources. When each computing core takes data, it takes n columns of matrices according to the preset multiples (i.e., the multiples of the matrix row, column scale and the number of computing cores) and puts them into the register of the computing core. At this time, the data taken in has completed the data preprocessing requirements of the NTT algorithm. It can be directly calculated by taking two numbers as a group each time in the arranged order. In theory, it is also necessary to shuffle the computing instructions in each computing core, but since the data taken into each computing core after grouping by column is of equal length, and the data has been stored in the register, it is only necessary to set the register of the computing instruction operand to the register written by the instruction fetch when shuffling the instructions.

[0049] According to an example of the present invention, see Fig. 9 , shows a schematic diagram of data acquisition mapping using a 4×4 scale (including NTT computing cores 0 to 15) computing core array as an example. When acquiring data, the entire matrix has been stored in the on-chip storage unit. Fig. 9 The NTT computing core No. 1 in the figure takes the data from the second column, which is the first red box on the right, and the NTT computing core No. 15 takes the data from the last column. The reason why the length of the rows and columns is set to 16 is to meet the condition of the power of 2, to ensure that the butterfly can be split with equal length, without wasting resources, and to ensure that all 16 NTT computing cores are in operation. If the data range is set to be greater than 256, that is, the length of the rows and columns is greater than 16, it is necessary to increase the number of columns taken by each NTT computing core in proportion, and calculate multiple columns at the same time. If the scale of data to be processed exceeds the upper limit of the on-chip load, the data needs to be segmented and the column data can be taken into the NTT computing core in the form of a matrix, so that calculations of any scale can be completed.

[0050] 2)NTT algorithm module customized instructions and data path design

[0051] See again Figure 1As shown in S2, after completing the data preprocessing, it is necessary to perform modular operations on the data in groups. The embodiment of the present invention designs three dedicated modular instructions, modular addition, modular subtraction, and modular multiplication, to complete the modular operations in the NTT algorithm calculation and complete the calculation acceleration through hardware.

[0052] The schematic format of modular addition, modular subtraction, and modular multiplication instructions is as follows: Fig.10 As shown. Modular addition, modular subtraction, and modular multiplication instructions include a total of 6 fields: the first field is the opcode (i.e., instruction field), which is used to identify the type of instruction; the second field is the identification bit, which is used to select the modulus (the modulus is stored in a fixed register through an immediate instruction); the following three fields are operand fields, operand 1 is used to determine the register subscript of the addend, minuend, or multiplicand; operand 2 is used to determine the register subscript of the addend, subtrahend, or multiplier; operand 3 is used to determine the register subscript for saving the result. In addition, a reserved bit field can be selectively set at the end as needed. In different systems, depending on the specific implementation, the instruction can be 32bit, 64bit, or 128bit, etc. Therefore, the role of the reserved bit field is to fill the instruction length and reserve the length for subsequent instruction expansion.

[0053] Among them, the operation completed by the modular addition instruction is:

[0054] value(Operand index2)=int((value(Operand index 0)+value(Operand index 1))%m)

[0055] The operations performed by the modulo subtraction instruction are:

[0056] value(Operand index2)=int((value(Operand index 0)-value(Operand index 1))%m)

[0057] The operations performed by the modular multiplication instruction are:

[0058] value(Operand index2)=int((value(Operand index 0)×value(Operand index 1))%m)

[0059] In the above three instructions, Operand index represents the operand. Operand index 0 is operand 0, which can be addend, subtrahend or multiplicand; Operand index 1 is operand 1, which can be addend, subtrahend or multiplier; Operand index 2 is operand 2, which is the location where the result is stored, and m is the modulus.

[0060] This embodiment combines complex instructions into modular addition, modular subtraction, and modular multiplication instructions. When performing modular addition, modular subtraction, and modular multiplication operations, there is no need to split the instructions into a set of multiple instructions (such as addition, subtraction, comparison, multiplication, etc.), thereby reducing the number of instructions and time overhead, thereby accelerating the fully homomorphic encryption calculation.

[0061] According to an example of the present invention, taking the instruction word length of 64 bits as an example, see Fig.11 , modular addition, modular subtraction, and modular multiplication instructions include a total of 6 fields: the top 8 bits are the opcode (i.e., instruction field), which is used to identify the type of instruction; the second field is the identification bit, with a length of 4, which is used to select the modulus (the modulus is stored in a fixed register through an immediate instruction); the following three fields are operand fields, all of which are 12 bits long. Operand 1 is used to determine the register subscript of the addend, minuend, or multiplicand; operand 2 is used to determine the register subscript of the addend, subtrahend, or multiplier; operand 3 is used to determine the register subscript for saving the result; the last field is a reserved bit field, with a length of 16 bits, which is not used temporarily. Its function is to fill the instruction length (here it is filled to the power of 2 - 64 bits), and at the same time reserve length for subsequent instruction expansion.

[0062] According to one embodiment of the present invention, see Fig.12 , provides an acceleration device for fully homomorphic encryption operations, including: an acceleration chip and / or an acceleration client ( Fig.12Not shown). The acceleration chip includes: an instruction control core, including an I / O interface and an instruction control unit, which allocates instructions through the instruction control unit; an instruction storage module, which is used to import instructions in the external memory onto the chip after compilation is completed; a data storage module, which is used to import data in the external memory onto the chip after compilation is completed and store the calculation results in the data storage back to the off-chip host after completing the relevant calculations; a computing array, including multiple computing cores, the computing cores are connected through an on-chip network, and each computing core includes: an instruction memory, which is used to store fetch instructions, calculation instructions, transmission instructions and storage instructions allocated to the current computing core; a register group, which is used to store data, including input data and calculation results; one or more modular operators. An acceleration client is deployed on an off-chip host including a general-purpose processor, and the off-chip host is configured to: based on the acceleration client, store the original data of the fully homomorphic encryption operation and compile the operation data and control program of the acceleration device for the fully homomorphic encryption operation, and the control program includes the fetch instructions, calculation instructions, transmission instructions and storage instructions for completing the fully homomorphic encryption operation. The modular operator combination is used to perform modular operations of fast number theory transformations in the fully homomorphic encryption algorithm. Each modular operator combination includes: a modular adder, which includes: configured to obtain an addend, an addend and a modulus, and perform a modular addition operation based on the addend, the addend and the modulus; a modular subtractor, which is configured to obtain a minuend, a subtrahend and a modulus, and perform a modular subtraction operation based on the minuend, the subtrahend and the modulus; a modular multiplier, which is configured to obtain a multiplicand, a multiplier and a modulus, and perform a modular multiplication operation based on the multiplicand, the multiplier and the modulus.

[0063] According to one embodiment of the present invention, the modular adder includes: an adder, used to add the addend and the addend to obtain a first result; a subtractor, used to calculate the first result minus the modulus to obtain a second result; a comparator, used to compare whether the first result is greater than the modulus to obtain a comparison result; a selector, used to obtain the first result, the second result and the comparison result, and when the comparison result is yes, output the second result as the modular addition result; otherwise, output the first result as the modular addition result.

[0064] According to one embodiment of the present invention, a modular subtractor includes: a subtractor, used to calculate the difference between a minuend and a subtrahend to obtain a first result; an adder, used to add the first result to the modulus to obtain a second result; a comparator, used to compare whether the first result is less than zero to obtain a comparison result; a selector, used to obtain the first result, the second result and the comparison result, and when the comparison result is yes, output the second result as the modular subtraction result; otherwise, output the first result as the modular subtraction result.

[0065] In order to further reduce the hardware layout, Fig.12 According to one embodiment of the present invention, see Fig.13The device is provided with an analog adder / subtractor, and the analog adder / subtractor includes: a first adder / subtractor, a second adder / subtractor, a comparator and a selector. The analog adder / subtractor is selectively configured as the analog adder or the analog subtractor according to a control signal, including: when the control signal is a first value, the analog adder / subtractor is configured as the analog adder, wherein: the first adder / subtractor is configured as an adder, for adding the addend and the addend to obtain a first result, the second adder / subtractor is configured as a subtractor, for calculating the first result minus the modulus to obtain a second result, the comparator is used to compare whether the first result is greater than the modulus to obtain a comparison result, and the selector is used to obtain the first result, the second result, and the second result. The control signal is a second value, and the modulo adder / subtractor is configured as the modulo subtractor, wherein: the first adder / subtractor is configured as a subtractor, which is used to calculate the difference between the minuend and the subtrahend to obtain the first result; the second adder / subtractor is configured as an adder, which is used to add the modulo to the first result to obtain the second result; the comparator is used to compare whether the first result is less than zero to obtain the comparison result; the selector is used to obtain the first result, the second result and the comparison result, and when the comparison result is yes, the second result is output as the modulo subtraction result; otherwise, the first result is output as the modulo subtraction result. For both modulo addition and modulo subtraction, the addition / subtraction operation is performed first and then the modulo is taken. For the modulo addition operation, an addition is first performed, and then the modulo is taken. Similarly, for the modulo subtraction, a subtraction is first performed, and then the modulo is taken. Based on the computational characteristics of the complement code, modular addition and modular subtraction can be implemented in the same hardware using hardware adders / subtractors. This not only allows the number of adders or subtractors to be configured according to the actual homomorphic encryption algorithm's demand for modular addition and modular subtraction operations, but also allows the homomorphic encryption algorithm to be better accelerated. In addition, the purpose of reducing hardware layout is also achieved.

[0066] In the acceleration device, the off-chip host is used to perform compilation. After the off-chip host completes the compilation, the instruction storage module and the data storage module import the instructions and data in the external memory to the chip. After all calculations are completed, the calculation results in the data storage are stored back to the off-chip host. NTT's customized computing array consists of n computing cores, arranged in a matrix manner. Each computing core has a data transmission path with adjacent computing cores in the four directions of up, down, left, and right (the computing cores at the boundary position can only transmit in two or three directions). When a computing core completes the calculation, it will transmit the data with data dependencies in the direction of the data transmission instruction. Each computing core also acts as a node on the data transmission path. After receiving the data, it will continue to package and pass it to the corresponding register.

[0067] Inside each computing core, there is an on-chip network, instruction memory, register group and n groups of modular operators. The function of the on-chip network is to connect adjacent computing cores and on-chip storage to complete the collection and forwarding of instructions and data. The instruction memory stores fetch instructions, calculation instructions, transmission instructions, and storage instructions, which will be executed in sequence during the execution of instructions. First, the data in the on-chip cache is fetched into the register of the computing core by column; then a series of calculation instructions (i.e. modular multiplication, modular addition, and modular subtraction instructions) are executed on the data by group; after the calculation is completed, the data will be transmitted to complete the transposition of the entire matrix; when the data transmission is completed, each computing core can immediately start the second calculation as long as it has the data that needs to be calculated at present; finally, when all calculations are completed, the storage instruction will be executed to store the calculated data back to the on-chip storage in sequence. The registers in the computing core save all the data to be calculated taken from the on-chip storage, as well as the modulus and some pre-calculated parameters. These parameters are stored in the corresponding registers together with the execution of the instruction fetch by storing immediate values. In the computing core, there are also m groups (such as 32 groups, 64 groups or 128 groups, etc.) of modular operators, each of which contains a modular multiplier and a modular adder / subtractor, and can perform operations on m groups of data at the same time. When executing the modular instruction calculation, it is realized by the modular multiplier and the modular adder / subtractor. Schematically, in the execution process of some NTT algorithms, the modulus can be uniformly stored in multiple registers at the front. When the instruction is executed, the modulus in the corresponding register is input to the modular multiplier, and the operand 1 and operand 2 in the instruction will also find the corresponding register and output to the modular multiplier. After executing the modular multiplication instruction, the modular multiplier outputs the calculated result to the modular adder / subtractor as the second operand of the modular adder / subtractor, and also outputs the modulus to the modular adder / subtractor. First, the modular addition operation is performed, and the modular addition operation is selected by the instruction type control word, and the operand 1 is found from the register according to the instruction. After completing the modular addition instruction, the first output r1 is obtained, which is stored back in the register group, and the modular subtraction operation is selected according to the instruction control word. At this time, the operand at the input end remains unchanged. After the modular subtraction operation is completed, the second output can be stored back in the register group. Each computing core contains several groups of modular operators that can be calculated in parallel, so it is possible to calculate multiple groups of data at the same time. When multiple columns of data are taken in at the same time, the calculation can also be completed synchronously. This improves the parallelism of the calculation.

[0068] According to one embodiment of the present invention, the modular addition and modular subtraction instructions are implemented by a modular adder / subtractor, and the structure of the modular adder / subtractor is as follows: Fig.14 As shown. The four input terminals on the left, from top to bottom, represent the addend / minuend x, addend / subtrahend y, control c and modulus m. The rightmost output terminal outputs the modulus addition / subtraction result r, that is, r = x + y mod m or r = x - y mod m. If the machine word length is M, the value range of modulus m is 0 ≤ m ≤ 2M-1 , the value range of the addend / minuend x is 0≤x<m, the value range of the addend / subtrahend y is 0≤y<m, and the control c is used to control how to use the adder / subtractor, thereby determining whether the operation is a modular addition or a modular subtraction.

[0069] The operation forms required for modular addition and modular subtraction are similar, except that the order and position of addition and subtraction are opposite. For modular addition, first perform an addition. When the addition result exceeds the modulus m, you need to perform another subtraction to subtract the modulus m. Since both the addend x and the addend y are smaller than the modulus m, the result at this time must meet the conditions. Similarly, for modular subtraction, first perform a subtraction. When the subtraction result is less than 0, you need to perform another addition to add the modulus m. Since both the addend x and the addend y are smaller than the modulus m, the result must be greater than 0 after adding the modulus m. Therefore, control c, in modular addition, controls adder / subtractor 1 to add and adder / subtractor 2 to subtract. In modular subtraction, the opposite is true, adder / subtractor 1 to subtract and adder / subtractor 2 to add. The comparator is used to compare whether the input is greater than the modulus m in modular addition, and is used to compare whether the input is less than 0 in modular subtraction.

[0070] According to an example of the present invention, taking the completion of a 64-bit modulo adder / subtractor as an example, the schematic data path is as follows: Fig.15 The four input terminals on the left, from top to bottom, represent the addend / minuend x (64 bits), addend / subtrahend y (64 bits), control c (2 bits) and modulus m (64 bits). The rightmost output terminal outputs the modulus addition / subtraction result r, i.e. r = x + y mod m or r = x - y mod m. The machine word length is 64, and the value range of modulus m is 0 ≤ m ≤ 2 63 , the value range of the addend / minuend x is 0≤x<m, the value range of the addend / subtrahend y is 0≤y<m, and the control c is used to control how to use the adder / subtractor, thereby determining whether the operation is a modular addition or a modular subtraction. The high bit of the 2 bits is used to determine whether adder / subtractor 1 performs addition or subtraction. Since the operations of the two adders / subtractors are different in modular addition and modular subtraction, the low bit is needed to determine whether adder / subtractor 2 performs addition or subtraction again.

[0071] For modular multiplication, if the modular multiplier uses division operation to the second level when taking the modulus, the computational overhead is large. It can be seen that for the modular operation r = x·y mod m, if x·y = km+r, we only need to calculate k, and then subtract km from x·y to get the result of the modular operation. Therefore, we can use the Gaussian rounding function to make In this way, k can be obtained, but division is still used here, and division is an operation with very high time consumption, so the embodiment of the present invention uses multiplication and shift to approximate the division operation to obtain k'. The part with the largest computational cost is Therefore, we need to find a number p such that (Right now ). p can be obtained by simply shifting m, so there is no need to perform a real "division" operation. In the NTT algorithm, the first input value of the modular multiplication operation can be calculated in advance, that is, for this modular multiplication operation, the first input is a fixed value. Therefore, we can let Where k is the machine word length of the accelerator, x is the multiplicand, and m is the modulus. The first step is to calculate Then the second step is to determine the relationship between r and m. If r>m, then r=r-m, ensuring that the final result is within the range of the modulus. In the NTT algorithm, the modulus m of some modular multiplication operations is often the same. Therefore, pre-calculating a preprocessing number p can greatly improve the operation efficiency.

[0072] According to one embodiment of the present invention, the modular multiplication instruction is implemented by a modular multiplier, which includes: a first low-word multiplier, used to determine the first product of the multiplicand and the multiplier and take the low M bits of the first product as the first intermediate result; a high-word multiplier, used to calculate the second product of the multiplier and the preprocessed number and take the high M bits of the second product as the second intermediate result; a second low-word multiplier, used to calculate the third product of the second intermediate result and the modulus and take the low M bits of the third product as the third intermediate result, a first subtractor, used to calculate the difference between the first intermediate result and the third intermediate result to obtain a fourth intermediate result; a second subtractor, used to calculate the difference between the fourth intermediate result and the modulus to obtain a fifth intermediate result; a comparator, used to compare whether the fourth intermediate result is greater than the modulus to obtain a comparison result; a selector, used to obtain the fourth intermediate result, the fifth intermediate result and the comparison result, when the comparison result is yes, the fifth intermediate result is output as the modular multiplication result; otherwise, the fourth intermediate result is output as the modular multiplication result.

[0073] The structure of the modular multiplier is as follows Fig.16 As shown. The four input terminals on the left, from top to bottom, represent the multiplicand x, multiplier y, preprocessing number p and modulus m respectively. The rightmost output terminal outputs the modular multiplication result r, that is, r = x·y mod m. Assuming the machine word length is M, the value range of the modulus m is 0≤m≤2 M-1 , the value range of the multiplicand x is 0≤x<m, the value range of the multiplier y is 0≤y<m, and the value of the preprocessing number p is The value of the preprocessing number p is determined by the multiplicand x and the modulus m, and the high-order part of the multiplicand is saved.

[0074] Fig.16In the figure, six pipeline levels are divided by red dotted lines. The two areas on the left contain two pipeline levels respectively, and the two areas on the right contain one pipeline level respectively. First, in the first two pipeline levels, the multiplicand x and the multiplier y are multiplied by the low-word multiplier 1, and the low M bits of the result are retained. At the same time, the multiplier is processed separately, and the multiplier y is multiplied by the preprocessing number p. The preprocessing number p is determined by the multiplicand x and the modulus m, so the calculation result of the high-word multiplier 1 is saved. Then, in the third and fourth pipeline stages, the calculation result of the high word multiplier 1 needs to be multiplied with the modulus m by the low word multiplier 2 to take the low bit. The calculation result at this time is the first step. Therefore, we only need to perform one more subtraction. In the fifth pipeline stage, the subtraction operation is implemented by subtractor 1. Since two roundings are performed downwards during the calculation process, there is a situation where the final temporary result r′ is larger than the modulus m, so it is necessary to compare again. In the sixth pipeline stage, the modulus and the temporary result r′ (that is, the output result of subtractor 1 stored in the register) are compared by a comparator. If the temporary result r′ is larger than the modulus m, another subtraction is required. After subtractor 2 completes the last subtraction, the selector determines whether the final output r is the output result of subtractor 1 or the output result of subtractor 2 through the output result of the comparator.

[0075] According to an example of the present invention, taking the completion of a 64-bit modular multiplier as an example, the schematic data path is as follows: Fig.17 As shown. The four input terminals on the left, from top to bottom, represent the modulus m (64 bits), multiplicand x (64 bits), multiplier y (64 bits) and preprocessing number p (64 bits). The rightmost output terminal outputs the modular multiplication result r (64 bits), that is, r = x·y mod m. The machine word length is 64, and the value range of the modulus m is 0≤m≤2 63 , the value range of the multiplicand x is 0≤x<m, the value range of the multiplier y is 0≤y<m, and the value of the preprocessing number p is The value of the preprocessing number p is determined by the multiplicand x and the modulus m, and the high-order part of the multiplicand is saved.

[0076] Fig.17 In the figure, six pipeline levels are divided by red dotted lines. The two areas on the left contain two pipeline levels respectively, and the two areas on the right contain one pipeline level respectively. First, in the first two pipeline levels, the multiplicand x and the multiplier y are multiplied by the low-word multiplier 1, and the low 64-bit result is retained. At the same time, the multiplier is processed separately, and the multiplier y is multiplied by the preprocessing number p. The preprocessing number p is determined by the multiplicand x and the modulus m, so the calculation result of the high-word multiplier 1 is saved. Then, in the third and fourth pipeline stages, the calculation result of the high word multiplier 1 needs to be multiplied with the modulus m by the low word multiplier 2 to take the low bit. The calculation result at this time is the first step. Therefore, we only need to perform one more subtraction. In the fifth pipeline stage, the subtraction operation is implemented by subtractor 1. Since two roundings are performed downwards during the calculation process, there is a situation where the final temporary result r′ is larger than the modulus m, so it is necessary to compare again. In the sixth pipeline stage, the modulus and the temporary result r′ (that is, the output result of subtractor 1 stored in the register) are compared by a comparator. If the temporary result r′ is larger than the modulus m, another subtraction is required. After subtractor 2 completes the last subtraction, the selector determines whether the final output r is the output result of subtractor 1 or the output result of subtractor 2 through the output result of the comparator.

[0077] In short, taking the machine word length of 64 bits as an example:

[0078] The output of low-word multiplier 1 is the lower 64 bits of x·y, abbreviated as Z1 (corresponding to the first intermediate result);

[0079] The inputs of high-word multiplier 1 are: multiplicand y, multiplier The output is: The result of multiplication: The high 64 bits of Abbreviated as Z2 (corresponding to the second intermediate result);

[0080] The output of low word multiplier 2 is: The lower 64 bits of , abbreviated as Z3 (corresponding to the third intermediate result);

[0081] Output of subtractor 1: Z1-Z3=Z4 (corresponding to the fourth intermediate result);

[0082] The output of subtractor 2: Z4-m=Z5 (corresponding to the fifth intermediate result).

[0083] 3) NTT customized data flow design

[0084] According to one embodiment of the present invention, the acceleration device is configured as follows: during a fully homomorphic encryption operation, if there is a computing core whose result is the input data required by another computing core, then a transmission instruction is called to directly transmit the result of the one computing core to the other computing core through the on-chip network. Direct transmission refers to the transmission of data from computing core to adjacent computing core through the on-chip network hop by hop until the data reaches the destination computing core. The technical solution of this embodiment can at least achieve the following beneficial technical effects: in view of the data dependency relationship between the computing cores, a path for direct data transmission through the on-chip network is designed, which reduces the number of memory accesses of the computing unit and improves the overall computing acceleration effect.

[0085] After the first column NTT operation is completed on the matrix, the matrix needs to be transposed before the second column NTT operation. Therefore, there is a data dependency between any two NTT calculation cores. Figure 1 As shown in S3, data with data dependency needs to be transmitted. In order to reduce the time overhead caused by data dependency, this embodiment designs an NTT customized data flow, which uses the overlap of instructions in time and space to cover up the time overhead caused by network congestion during part of the data transmission process. The usual method to solve large-scale data dependency is to store the data back to the on-chip register in a transposed order, and then retrieve the data back to each computing core. However, the time overhead of memory access is greater than the data movement between computing cores. Therefore, the present invention reduces the number of memory accesses by half by designing the transmission path of the data flow, and because the instructions overlap in time and space, it ensures that there will be no congestion during data transmission.

[0086] Fig.18 It shows that there is a data dependency between every two computing cores. After calculating the NTT operation by column blocks, the entire matrix needs to be transposed. Fig.18 In the figure, the matrix on the left is the data arrangement before transposition, the red box is used to mark the data taken into each computing core by column, and the blue box is the data division for the second calculation. Fig.18 The data of the column-by-column blocks are the same after the matrix on the right is transposed. Therefore, it can be found that there is an intersection between each red box and each blue box, that is, there is a small matrix data dependency relationship between every two computing cores. After the first column-by-column block NTT calculation is completed, the computing core that owns this small matrix needs to pass it to the corresponding computing core according to the intersection of the red and blue boxes on the left side of the figure.

[0087] Fig.18 The middle part is the data dependency between every two computing cores. However, it is impossible to establish a data path between any two computing cores, which will make the arrangement between the computing cores too complicated and increase a lot of meaningless overhead. Therefore, the present invention designs a computing core array and its data flow, requiring the computing cores to be arranged in a rectangular manner, only retaining the transmission path between adjacent matrices, and using the computing core as an intermediate node, thereby playing the role of data transfer.

[0088] According to an example of the present invention, taking a 4×4 NTT computing core array as an example, the data dependency is as follows: Fig.19As shown. In the actual calculation process, after calculating two numbers, broadcasting will begin after ensuring that the two numbers will not be used again. After each calculation, the two numbers calculated will be sent to the corresponding NTT computing core. Take data No. 0 and No. 8 in each NTT computing core as an example. When each PE calculates the results of data No. 0 and No. 8 through a series of calculation instructions, the NTT computing core sends its currently calculated data No. 0 and No. 8 to NTT computing core No. 0 and NTT computing core No. 8 respectively through data transmission instructions between computing cores (which can be called copy instructions). Until all NTT computing cores have calculated data No. 7 and No. 15 and broadcasted them, the second calculation can be started. The copy instruction overlaps with a series of computing instructions in time and space, which can cover up the network congestion transmission delay caused by part of the data transmission, so the time overhead is much smaller than re-fetching data after accessing the memory. Fig.19 In the figure, the two numbers inside each circle in the middle represent the subscript number range of the data corresponding to the calculation and verification, such as [0,15] in the first circle represents the data with subscript numbers 0-15; the numbers in each circle on the right represent the subscript number of the data corresponding to the calculation and verification, and the value of i is 0-15.

[0089] Fig. 20 The data transmission process of one of the computing cores is shown. The computing core array is arranged in the form of a matrix. After each computing core completes the calculation, it passes all the data with data dependency relationship under the matrix to the computing core directly below it, making the computing core a transit node. After the computing core completes the calculation, it transmits the data it needs to transmit and the data it needs to forward according to the data dependency relationship. After receiving the data transmitted vertically, each computing core retains the rows of data where the data of this computing core is located, and continues to transmit the data of non-this row downward or upward. The horizontal data is divided into nodes based on the data required by this computing core and transmitted to the left and right directions respectively. The trigger mechanism of each computing core is that when the resources to be calculated in a computing core are ready, the calculation can be started, and when the data is calculated, the transmission can be started directly. Therefore, there is no need for a unified waiting time, which greatly reduces the congestion of data during transmission. When the computing core array is initialized and fetched, there is a time sequence, so there is no situation where all computing cores transmit data uniformly after the calculation is completed, and the time overhead will not be increased due to large-scale network congestion.

[0090] According to an example of the present invention, taking NTT computing core No. 0 as an example, the data transmission direction is as follows: Fig.21As shown. In the NTT computing core array, there are only four directions for data transmission: up, down, left, and right. NTT computing core No. 0 is located in the upper left corner of the entire array, so it can only transmit data to the right and bottom. In addition, each NTT computing core can only establish data connections with 4 NTT computing cores, and there is no way to establish node relationships with the other 15 NTT computing cores. Therefore, it is necessary to rely on other NTT computing cores as bridges for data transmission. NTT computing core No. 0 is located in the upper left corner of the entire array, so after the data is transposed, the data with the subscript position 0 will still be retained, so the matrix can be divided according to the position of data No. 0 in the matrix. In the first row of the array, the three data on the left side of 0 correspond to the three on the right side of the 16 NTT computing cores, so these three data are all transmitted to NTT computing core No. 1, and then NTT computing core No. 1 continues to transmit data to the right in the same way. The 2nd, 3rd, and 4th rows of data are the data of the bottom three rows in the NTT computing core array, so all 12 data are passed to NTT computing core No. 4, and then NTT computing core No. 4 continues to pass data downward and to the right in this way until all the data are passed to the corresponding NTT computing core.

[0091] Fig. 22 This is the corresponding relationship diagram of the 4×4 NTT calculation kernel array data. Fig. 22 The left side is the data arrangement order in each NTT computing core, and the right side is the corresponding NTT computing core number. The same position in the matrix corresponds to the NTT computing core number to be transmitted. Each NTT computing core will only receive different subscripts once, so the data can be placed in the corresponding register according to the transmitted NTT computing core number, thus completing the matrix transposition process. When all the data is stored, the second calculation can be started.

[0092] In order to verify the effect of the acceleration device of the present invention, the inventor also conducted the following comparative experiments:

[0093] According to the design of the fully homomorphic encryption accelerator, an accelerator was completed and tested. In addition, the benchmark selected was the GPU Tesla V100-SXM2-16GB. The NTT operation was completed through the GPU server using Cuda. The calculation time of different data sizes was measured on the accelerator (16 computing cores) implemented in this study and the GPU.

[0094] This experiment conducted a total of 23 different data sizes from 64B to 256MB, and recorded the calculation time of the acceleration device of the present invention and the GPU. Due to the change in data scale, there is a large gap in the calculation time of different data scales, and it is impossible to make a horizontal comparison. Therefore, the calculation time of the GPU is normalized, and the corresponding acceleration device operation time is processed year-on-year. Compared with the GPU (V100), the acceleration device implemented by the present invention greatly shortens the calculation time and reduces the calculation time overhead. In particular, when the data scale is 32KB (that is, the data volume is 16×16×32), the acceleration effect reaches the maximum, and an acceleration effect of 165.41 times is achieved compared to the GPU. Since 16 computing cores are used in the acceleration device implemented by the present invention, the program on the accelerator side is based on 16×16×32, that is, 2 13 Therefore, the acceleration effect is most obvious when the data scale is 32KB (16×16×32×32bit), and it also stably accelerates NTT calculations at other data scales. At all test scales, it maintains an acceleration effect of more than 40 times compared to GPU V100.

[0095] It should be noted that although the above describes the various steps in a specific order, it does not mean that the various steps must be executed in the above specific order. In fact, some of these steps can be executed concurrently or even in a different order as long as the required functions can be achieved.

[0096] The present invention may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present invention.

[0097] Computer readable storage medium can be a tangible device that holds and stores instructions used by an instruction execution device. Computer readable storage medium can include, for example, but is not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. More specific examples (non-exhaustive list) of computer readable storage medium include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, for example, a punch card or a protruding structure in a groove on which instructions are stored, and any suitable combination thereof.

[0098] The embodiments of the present invention have been described above, and the above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The selection of terms used herein is intended to best explain the principles of the embodiments, practical applications, or technical improvements in the market, or to enable other persons of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. An acceleration device for fully homomorphic encryption operations, It is characterized in that include: An acceleration chip is provided with a plurality of modular operator combinations for performing modular operations of fast number theory transformations in a fully homomorphic encryption algorithm, wherein each modular operator combination includes: A modular adder configured to obtain an addend, an addend and a modulus based on a modular addition instruction, and perform a modular addition operation according to the addend, the addend and the modulus; A modular subtractor configured to obtain a minuend, a subtrahend and a modulus based on a modular subtraction instruction, and perform a modular subtraction operation according to the minuend, the subtrahend and the modulus; The modular multiplier is configured to obtain a multiplicand, a multiplier and a modulus based on a modular multiplication instruction, and perform a modular multiplication operation according to the multiplicand, the multiplier and the modulus.

2. The device according to claim 1, It is characterized in that The module adder comprises: an adder, configured to add the summand and the addend to obtain a first result; A subtractor, used for calculating the first result minus the modulus to obtain a second result; A comparator, used for comparing whether the first result is greater than the modulus, and obtaining a comparison result; The selector is used to obtain the first result, the second result and the comparison result, and when the comparison result is yes, output the second result as the modular addition result; otherwise, output the first result as the modular addition result.

3. The device according to claim 1, It is characterized in that The module reducer comprises: a subtractor for calculating the difference between the minuend and the subtrahend to obtain a first result; an adder, configured to add the modulus to the first result to obtain a second result; A comparator, used for comparing whether the first result is less than zero, and obtaining a comparison result; The selector is used to obtain the first result, the second result and the comparison result, and when the comparison result is yes, output the second result as the modular subtraction result; otherwise, output the first result as the modular subtraction result.

4. The device according to claim 1, It is characterized in that The device is provided with a modular adder / subtractor, the modular adder / subtractor comprising: a first adder / subtractor, a second adder / subtractor, a comparator and a selector, the modular adder / subtractor is selectively configured as the modular adder or the modular subtractor according to a control signal, and comprises: When the control signal is a first value, the modulo adder / subtractor is configured as the modulo adder, wherein: The first adder / subtractor is configured as an adder for adding the augend and the addend. Get the first result, The second adder / subtractor is configured as a subtractor for calculating the first result minus the modulus to obtain a second result, A comparator is used to compare whether the first result is greater than the modulus to obtain a comparison result. A selector, used to obtain the first result, the second result and the comparison result, and when the comparison result is yes, output the second result as the modular addition result; otherwise, output the first result as the modular addition result; When the control signal is a second value, the modulo adder / subtractor is configured as the modulo subtractor, wherein: The first adder / subtractor is configured as a subtractor for calculating the difference between the minuend and the subtrahend to obtain a first result. The second adder / subtractor is configured as an adder for adding the modulus to the first result to obtain The second result, A comparator, used for comparing whether the first result is less than zero, and obtaining a comparison result; The selector is used to obtain the first result, the second result and the comparison result. When the comparison result is yes, the second result is output as the modular subtraction result; otherwise, the first result is output as the modular subtraction result.

5. The device according to claim 1, It is characterized in that The modular multiplier comprises: A first low-word multiplier, for determining a first product of the multiplicand and the multiplier and taking the low M bits of the first product as a first intermediate result; The high word multiplier is used to calculate the second product of the multiplier and the preprocessing number and take the high M bits of the second product as the second intermediate result, wherein the preprocessing number M is the machine word length of the accelerator, x is the multiplicand, and m is the modulus; a second low word multiplier, for calculating a third product of the second intermediate result and the modulus and taking the lower M bits of the third product as the third intermediate result, A first subtractor, used for calculating the difference between the first intermediate result and the third intermediate result to obtain a fourth intermediate result; a second subtractor, used for calculating the difference between the fourth intermediate result and the modulus to obtain a fifth intermediate result; A comparator, used for comparing whether the fourth intermediate result is greater than the modulus, and obtaining a comparison result; The selector is used to obtain the fourth intermediate result, the fifth intermediate result and the comparison result, and when the comparison result is yes, the fifth intermediate result is output as the modular multiplication result; otherwise, the fourth intermediate result is output as the modular multiplication result.

6. The device according to any one of claims 1 to 5, It is characterized in that The acceleration chip comprises: The instruction control core includes an I / O interface and an instruction control unit, through which instructions are dispatched; The instruction storage module is used to import the instructions in the external memory onto the chip after the compilation is completed; A data storage module is used to import the data in the external memory into the chip after the compilation is completed and to store the calculation results in the data storage back to the off-chip host after the relevant calculation is completed; A computing array includes a plurality of computing cores, wherein the computing cores are connected via an on-chip network, and each computing core includes: An instruction memory, used to store fetch instructions, calculation instructions, transmission instructions and storage instructions allocated to the current computing core; A register group, used to store data, including input data and calculation results; At least one of said modular operators is combined.

7. The device according to claim 6, It is characterized in that The device is configured to: During the fully homomorphic encryption operation, if the result calculated by one computing core is the input data required by another computing core, the transmission instruction is called to directly transmit the result calculated by the one computing core to the other computing core through the on-chip network. Direct transmission means that the computing cores transmit data to adjacent computing cores hop by hop through the on-chip network until the data reaches the destination computing core.

8. The device according to claim 7, It is characterized in that The device also includes: An acceleration client is deployed on an off-chip host including a general-purpose processor, and the off-chip host is configured to: based on the acceleration client, store the original data of the fully homomorphic encryption operation and compile the operation data and control program of the acceleration device used for the fully homomorphic encryption operation, and the control program includes fetch instructions, calculation instructions, transmission instructions and storage instructions for completing the fully homomorphic encryption operation.

9. The device according to claim 8, It is characterized in that The off-chip host is configured to: when receiving a request to accelerate a fully homomorphic encryption algorithm with a butterfly process, merge the butterfly process and the matrix fetching process through an instruction shuffling mechanism in the compilation stage, and the instruction shuffling mechanism includes: Obtain the original data scale to be calculated by the calculation core, round the original data scale upward to the smallest power of 2, and obtain the rounded data scale L; Generate an original array, the number of items in the original array is equal to the rounded data size, the subscript number of each item in the original array ranges from 0 to L-1, and each subscript number corresponds to a fetch instruction; Generate a transformation array, the number of items in the transformation array corresponds to the number of items in the original array, and the subscript number of each item in the transformation array is equal to the left-right flip result of the binary expression of the subscript number of the corresponding item in the original array; The on-chip address offset of the data fetched by the instruction corresponding to each subscript number in the original array is exchanged with the on-chip address offset of the data fetched by the instruction corresponding to the subscript number of the corresponding item in the transformed array to obtain the instruction fetch after instruction shuffling, wherein the instruction fetch after instruction shuffling is set to be executed in sequence.

10. A method for accelerating fully homomorphic encryption, the method being executed in a device as claimed in any one of claims 1 to 9, the method include: Obtain the calculations that need to be completed by the fully homomorphic encryption algorithm, and dispatch at least part of the modular operation calculation process to the modular operator combination to complete it, wherein the modular operation is modular addition operation, modular subtraction operation and / or modular multiplication operation.

Images