A key exchange acceleration method and configurable accelerator for fully homomorphic encryption

Abstract

The present invention relates to the field of information security technology, and discloses a key exchange acceleration method and a configurable accelerator for fully homomorphic encryption. The method of the present invention decomposes the key exchange calculation in fully homomorphic encryption into two parts: iterative calculation and pipeline calculation. Through the reasonable arrangement of the calculation timing, the two types of calculations respectively avoid the access conflict to the off-chip memory bandwidth resources and the on-chip memory cache space, so that the iterative calculation and pipeline calculation in the two groups of key exchanges can be executed in parallel, thereby improving the execution efficiency of the computing device. In order to efficiently execute the above-mentioned acceleration method, the present invention provides a configurable accelerator for executing number theory transformation and basis transformation in iterative calculation. The configurable accelerator reconstructs the data path through the calculation mode selection signal, and combines the multipliers, modular adders, modular subtractors in the configurable butterfly operation unit and the multipliers in the rotation factor generator to realize the basis transformation calculation function to improve flexibility.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a key exchange acceleration method and a configurable accelerator for fully homomorphic encryption. Background Art

[0002] In cloud computing, big data and other scenarios, data usually needs to be uploaded to a remote server for storage and calculation. Although traditional encryption technology can provide a certain degree of security during data transmission, when it is necessary to calculate the encrypted data, it is usually necessary to decrypt the data first, which creates the risk of data leakage. Compared with traditional encryption algorithms, fully homomorphic encryption is a cryptographic technology that can directly perform arbitrary calculations on encrypted data without decrypting the data. Therefore, it has broad prospects in the field of privacy protection and is considered a major breakthrough in the field of cryptography in the 21st century.

[0003] Although fully homomorphic encryption technology has made certain theoretical and practical progress, it still faces problems such as high computational complexity and low efficiency. In fully homomorphic encryption, encrypted data, or ciphertext, encryption polynomial, and ciphertext polynomial are kept in an encrypted state for various fully homomorphic encryption calculations, such as homomorphic multiplication, homomorphic addition, key exchange, bootstrapping, and rotation. Among them, key exchange is an important step in fully homomorphic encryption calculations. In privacy protection scenarios such as federated learning, key exchange occupies more than 70% of the computational workload and off-chip memory access bandwidth, which is one of the main bottlenecks of fully homomorphic encryption. Secondly, different fully homomorphic encryption parameter configurations will cause changes in the proportion of computational workloads in number theory transformation and basis transformation steps in key exchange, posing severe challenges to the efficient execution of accelerators. Summary of the invention

[0004] In order to accelerate the calculation of key exchange in fully homomorphic encryption, reasonably allocate the access bandwidth of off-chip memory, and adapt to the dynamic changes in the proportion of number theory transformation and basis transformation calculation brought about by different fully homomorphic encryption parameter configurations, the embodiment of the present application first provides a key exchange acceleration method for fully homomorphic encryption, which is characterized by comprising:

[0005] The encryption calculation in the key exchange step of fully homomorphic encryption is decomposed into two parts: iterative calculation and pipeline calculation. Among them, the iterative calculation includes two parts: number theory transformation and basis transformation of the ciphertext in the key exchange step; the pipeline calculation includes four parts: binary multiplication of the ciphertext in the key exchange step, calculation of key multiplication, ciphertext summation, ciphertext subtraction and multiplication, and ciphertext addition.

[0006] When executing the key exchange step, the iterative calculation under the current key exchange step and the pipeline calculation under the next key exchange step are executed in parallel.

[0007] The embodiment of the present application also provides a configurable accelerator, which is applied to the above-mentioned key exchange acceleration method for fully homomorphic encryption, including an on-chip memory, a data rearrangement module, a rotation factor generator and a butterfly operation unit array, characterized in that: the butterfly operation unit array is for multiplexing number theory transformation and basis transformation in iterative calculation, including n configurable butterfly operation units; the configurable butterfly operation unit can be configured into CT butterfly operation, GS butterfly operation, basis transformation point multiplication or basis transformation multiplication and accumulation calculation mode in response to its calculation mode selection signal; the butterfly operation unit array outputs 2n point CT (Cooley-Tu) per iteration The invention relates to a butterfly operation result of a base transformation (key) mode or a GS (Gentleman-Sande) mode; the rotation factor generator comprises n multipliers corresponding to the n configurable butterfly operation units one by one, and generates the rotation factors required for number theory transformation under different moduli online based on the original rotation factors; and is combined with the multipliers in the n configurable butterfly operation units into two groups of n-length point multiplication calculation units to realize the vector point multiplication in the base transformation; and is combined with the multipliers, modular adders, and modular subtractors in the n configurable butterfly operation units into n groups of 2-point multiplication-accumulation iteration units to realize the matrix multiplication in the base transformation.

[0008] The beneficial effects of the present invention are:

[0009] In existing methods, key exchange usually contains more than 100 megabytes of encrypted data, which places great demands on the access bandwidth of the off-chip memory of the computer device, becoming the main bottleneck hindering accelerated computing. The key exchange acceleration method for fully homomorphic encryption provided by the present invention decomposes the key exchange step into two parts: iterative calculation and pipeline calculation. Iterative calculation mainly occupies on-chip storage for data caching, and pipeline calculation mainly occupies off-chip memory bandwidth for data reading and writing. The two parts of the calculation avoid access conflicts to off-chip memory bandwidth resources and on-chip memory cache space, respectively, so that the iterative calculation under the current key exchange step and the pipeline calculation under the next key exchange step are executed in parallel, thereby improving the execution efficiency of the computing device.

[0010] The present invention also provides a configurable accelerator applied to the key exchange acceleration method for fully homomorphic encryption, and the above-mentioned iterative calculation part is executed by the configurable accelerator to improve the execution efficiency of the above-mentioned iterative calculation. The core computing unit butterfly operation unit array in the configurable accelerator is a multiplexer of number theory transformation and base transformation, and can be configured into one of the four computing modes of CT butterfly operation, GS butterfly operation, base transformation point multiplication and base transformation multiplication and accumulation through the computing mode selection signal, so as to realize the flexible selection of the two computing modes of number theory transformation and base transformation. Therefore, when the parameter change of fully homomorphic encryption causes the calculation amount proportion of number theory transformation and base transformation to change, the corresponding calculation load matching can be performed by adjusting the calculation function of the configurable accelerator. The rotation factor generator in the configurable accelerator can generate all the rotation factors required for number theory transformation using an original rotation factor, which greatly saves the storage space of the on-chip memory. The modular adder and modular subtractor in the configurable accelerator can be combined into a large bit width adder by responding to the bit width extension signal to perform addition under non-finite fields in the base transformation, so as to achieve efficient utilization of computing resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 This is a schematic diagram of the algorithm flow of key exchange in the fully homomorphic encryption algorithm;

[0012] Figure 2 Schematic diagram of a key exchange acceleration method for fully homomorphic encryption;

[0013] Figure 3 This is the parallel acceleration timing diagram of key exchange pipeline calculation and iterative calculation in fully homomorphic encryption;

[0014] Figure 4 This is a schematic diagram of the change in the computational complexity of number theory transformation and basis transformation under different fully homomorphic encryption parameters;

[0015] Figure 5 is a schematic diagram of a configurable accelerator architecture;

[0016] Figure 6 A schematic diagram of a twiddle factor generator in a configurable accelerator;

[0017] Figure 7 It is a circuit diagram of a configurable butterfly operation unit;

[0018] Figure 8 The circuit diagram of a w-bit modular adder and a w-bit modular subtractor is a 2w-bit ordinary adder. DETAILED DESCRIPTION

[0019] The technical solution of the present invention is further described in detail below in conjunction with the embodiments and drawings.

[0020] Embodiment 1

[0021] In fully homomorphic encryption, the finite field ℤ is the basic algebraic structure that defines encryption operations. Specifically, the finite field Defined on q, where q is a large integer and usually prime, then the finite field The set of elements in is {0, 1, 2, ...q-1}. All operations in , such as addition, subtraction, and multiplication, are performed based on the modulus q, that is, the calculation result needs to be modulo q to remain in the aforementioned set of elements. Since the bit width of q is usually large, the RNS system (Residue Number System) is used in fully homomorphic encryption to improve the calculation efficiency. The RNS system reduces the calculation complexity by decomposing the aforementioned large integer q into parallel operations under multiple small moduli. The basic principle is to convert the finite field The number under, assuming it is x, is represented by multiple coprime moduli q i The sequence (x mod q1,x mod q2,...,x mod q L ), which is convenient for parallel computing and reduces the cost of large number operations, where {q1,q2,q3,…q L} is called the modulus basis of the RNS system, and mod represents the modulo operation.

[0022] Figure 1 The figure shows the algorithm flow diagram of key exchange in a conventional fully homomorphic encryption algorithm, whose input is two encrypted ciphertext vectors, namely (a0, a1) and (b0, b1). Among them, a0, a1, b0, b1 are the representations of the N-point encryption polynomial after the aforementioned RNS decomposition, including L+1 N-point encryption polynomials. The coefficients of each polynomial are in different finite fields, and different finite fields correspond to different moduli. In key exchange, there are usually two modulus bases {q1, q2, q3, …q L} and {p1,p2,p3,…p K}. Where L-1 is equal to the depth of the fully homomorphic encryption calculation, and K represents the number of moduli in the temporary modulus basis for key exchange.

[0023] In the fully homomorphic encryption algorithm, the key exchange calculation can be mainly decomposed into Figure 1and steps 1 to 11 shown in Table 1. Among them, ModRaise number theory transformation, ModRaise number theory transformation (inverse), ModDown number theory transformation, ModDown number theory transformation (inverse) are basically consistent with the general number theory transformation calculation process, mainly including a large number of butterfly operations. Basis transformation is a special calculation in homomorphic encryption, which is used to switch the encrypted data between the aforementioned different modulus bases. The calculation process of ModRaise basis transformation is basically the same as that of ModDown basis transformation, mainly including two parts: step 1 vector multiplication and step 2 matrix multiplication. There is a data dependency relationship between steps 1 to 11, and they need to be executed strictly in the calculation order specified in the key exchange algorithm. Their time complexity analysis is shown in Table 1. It should be noted that in steps 3.2 and 8.2, in the matrix multiplication of step 2 in the basis transformation, the multiplication and accumulation calculation between row and column vectors is in the real number field, while other calculations are in the finite field. In steps 1 to 11, number theory transformation and basis transformation involve transformations in the time domain and frequency domain and operations on vectors and matrices respectively, with the highest time complexity, and the amount of calculation increases rapidly in a multiplicative relationship with the growth of the fully homomorphic calculation depth L and the number of encryption polynomial points N, so it is suitable for iterative calculation. In other steps, the time complexity is linearly related to the number of encryption polynomial points N, and the complexity is low, but the demand for data reading and writing is large. For example, in the calculation of key multiplication in step 5, only multiplication calculations under finite fields are required, and the calculation complexity is very small, but the size of the calculated key is about 100MB to 500MB, so it is considered to be a key bandwidth bottleneck in key exchange and is suitable for pipeline calculation.

[0024] Table 1 Computational steps of typical key exchange algorithms in fully homomorphic encryption

[0025]

[0026] Based on the above key exchange calculation characteristics, in order to solve the key exchange calculation speed bottleneck, as shown in the attached Figure 2 As shown, this embodiment provides a key exchange acceleration method for fully homomorphic encryption, comprising the following steps:

[0027] The encryption calculation in the key exchange step of fully homomorphic encryption is decomposed into two parts: iterative calculation and pipeline calculation. Among them, the iterative calculation includes two parts: number theory transformation and basis transformation of the ciphertext in the key exchange step; the pipeline calculation includes four parts: binary multiplication of the ciphertext in the key exchange step, calculation of key multiplication, ciphertext summation, ciphertext subtraction and multiplication, and ciphertext addition.

[0028] When executing the key exchange step, the iterative calculation under the current key exchange step and the pipeline calculation under the next key exchange step are executed in parallel.

[0029] Furthermore, before performing iterative calculations, the computing device occupies the bandwidth of the off-chip memory to perform read and write operations on the encrypted data, and uses the on-chip memory to perform ping-pong caching on the encrypted data; after the encrypted data caching is completed, the computing device releases the bandwidth of the off-chip memory, accesses the encrypted data cached in the on-chip memory to perform multiple rounds of calculations, and does not occupy the read and write bandwidth of the off-chip memory during the multiple rounds of calculations, until all the encrypted data in the on-chip memory are iterated, and then the next ping-pong caching is performed;

[0030] Pipeline computing does not involve operations such as transformation, vector, and matrix, so it only needs to use general modular computing circuits to perform simple ciphertext addition, subtraction, and multiplication under finite fields. Specifically, when performing pipeline computing, the computing device occupies the bandwidth of the off-chip memory to read large-capacity parameters such as ciphertext polynomials and calculation keys, performs encryption calculations, and writes the calculation results back to the off-chip memory in real time, without occupying the on-chip memory cache space for data caching.

[0031] Furthermore, based on decomposing the encryption calculation under the key exchange step in fully homomorphic encryption into two parts, iterative calculation and pipeline calculation, when executing the key exchange step more than twice, the encrypted data that needs to perform the key exchange is divided into two groups, A and B, and the two different calculation modes in the key exchange of the two groups of encrypted data A and B are executed in parallel, that is, when the two groups of encrypted data A and B execute the key exchange step, the iterative calculation and pipeline calculation of the encrypted data of group A are respectively executed in parallel with the pipeline calculation and iterative calculation of the encrypted data of group B. The pipeline calculation and iterative calculation of the same group of ciphertext data are executed alternately according to the established calculation order in the key exchange.

[0032] Specifically, the first pipeline calculation of group A's encrypted data is calculated first, and then the pipeline calculation result of group A's encrypted data is used as the input for the next iterative calculation of group A's encrypted data, and the first iterative calculation of group A's encrypted data and the first pipeline calculation of group B's encrypted data are performed simultaneously, and then the second pipeline calculation of group A's encrypted data and the first iterative calculation of group B's encrypted data are performed simultaneously, and so on, until the key exchange calculation process is completed.

[0033] The key exchange acceleration method for fully homomorphic encryption of this embodiment decomposes the encryption calculation under the key exchange step in fully homomorphic encryption into two parts: iterative calculation and pipeline calculation. The iterative calculation and pipeline calculation respectively avoid access conflicts to off-chip memory bandwidth resources and on-chip memory cache space, so that the iterative calculation in the current key exchange and the pipeline calculation in the next key exchange can be executed in parallel, thereby improving the execution efficiency of the computing device.

[0034] like Figure 3The figure shows a parallel acceleration timing diagram of key exchange pipeline calculation and iterative calculation in fully homomorphic encryption, where the vertical axis represents the hardware device that performs the calculation, and the horizontal axis represents the time sequence of performing the key exchange calculation. During the time periods T1, T4, T6, T8, and T10, the computing device needs to pre-read the encrypted data required for the iterative calculation of group A or B into the on-chip memory and alternately read and write the off-chip memory to achieve ping-pong caching of the encrypted data and the intermediate calculation results generated by the iterative calculation. During the time periods T2, T3, T5, T7, and T9, since there is no data dependency between the encrypted data group that performs the key exchange iterative calculation steps 2, 3, 4, 7, 8, and 9 and the other encrypted data group that performs the key exchange pipeline calculation steps 1, 5, 6, 10, and 11, and the two types of calculations defined in the key exchange acceleration method do not need to occupy the read and write bandwidth of the on-chip memory and the off-chip memory at the same time, they can be executed in parallel, achieving the effect of parallel accelerated calculation and optimization of bandwidth resources.

[0035] Embodiment 2

[0036] As attached Figure 4 As shown in the figure, under different fully homomorphic encryption parameters, the proportion of number theory transformation and basis transformation calculation in iterative calculation changes significantly, which brings severe challenges to the execution of hardware devices.

[0037] To solve the above problems and effectively improve the computational efficiency of the key exchange acceleration method for fully homomorphic encryption of the present invention, this embodiment provides a configurable accelerator applied to the above key exchange acceleration method for fully homomorphic encryption, which is used to improve the execution efficiency of the iterative calculation part.

[0038] The configurable accelerator includes an on-chip memory, a data rearrangement module, a rotation factor generator, and a butterfly operation unit array that multiplexes number theory transformation and basis transformation. The data rearrangement module is a common structure in existing accelerators that support number theory transformation, and the on-chip memory is also a common structure in existing accelerators, which will not be further introduced in this embodiment.

[0039] In this embodiment, the butterfly operation unit array is the core unit for performing number theory transformation in iterative calculation, and multiplexes number theory transformation and basis transformation in the iterative calculation part. Figure 5As shown, the butterfly operation unit array includes n configurable butterfly operation units (BFU in the figure). The above-mentioned configurable butterfly operation unit can be configured into one of the four calculation modes of CT butterfly operation, GS butterfly operation, basis transformation point multiplication and basis transformation multiplication and accumulation by responding to the calculation mode selection signal that controls its internal data selector. The butterfly operation unit array outputs the butterfly operation result of 2n-point CT mode or GS mode every iteration. The rotation factor generator includes n multipliers, which correspond one-to-one to the above-mentioned n configurable butterfly operation units, and online generates the rotation factors required for number theory transformation under different moduli based on the original rotation factors. The data rearrangement module sorts the encrypted polynomial coefficients output by the on-chip memory according to the rules of the butterfly operation in the number theory transformation. After After iterations, the accelerator can be configured to complete the calculation of an N-point number theory transformation.

[0040] Furthermore, the original rotation factors are used as the base to generate the rotation factors required for number theory transformation under different moduli online. The specific method is as follows:

[0041] For an input encryption polynomial of length N, before the number theory transformation begins, the original rotation factor is input as the base, and the n multipliers in the rotation factor generator are used to perform square calculations and modulo calculations on the original rotation factor in turn to generate 1, 2, 4, 8 up to N / 2 powers of the original rotation factor as a set of global rotation factors, which are stored in a set of registers.

[0042] Before the start of the i-th iteration of the number theoretic transformation, the log2N-1-i-th global rotation factor is taken as the initial value of the n iteration rotation factors required by the n butterfly operation units of this number theoretic transformation iteration, and is stored in another set of registers.

[0043] The n iterative twiddle factors stored in the register are multiplied by the n multipliers in the twiddle factor generator according to the spacing. Multiply by the log2N-1-ith global rotation factor and perform log2n-log2N+1+i updates modulo each other as the iterative rotation factor required for the first group of n butterfly operations in the i-th iteration of the number theory transformation. Where j represents the j-th update.

[0044] The n iterative twiddle factors stored in the register are multiplied by the kth power of the log2N-ith global twiddle factor using the n multipliers in the twiddle factor generator and updated modulo 1 time, which is the iterative twiddle factor required for the kth group of n butterfly operations in the i-th iteration of the number theory transformation.

[0045] The advantage of the above-mentioned method for generating rotation factors is that only one original rotation factor is needed to generate all the 2 required by the number theory transformation online. N-1 rotation factor, reducing the time and on-chip storage space required to read the rotation factor. Figure 6 The schematic diagram of the rotation factor generator described in the figure elaborates the specific implementation steps of the rotation factor generation method in the rotation factor generator.

[0046] Calculation process[1]:

[0047] Input: Ciphertext , and assume that the original rotation factor = ,

[0048] The number of configurable butterfly units , the number of points of number theory transformation = N

[0049] Output: Number Theoretic Transformation

[0050] / / Initialize the global twiddle factor GTF (Global Twiddle Factor):

[0051]

[0052] 3: Endfor

[0053] / / Start calculating number theory transformation:

[0054]

[0055] / / Precompute the iterative twiddle factor STF (Stage Twiddle Factor) for the i-th stage transform iteration:

[0056]

[0057] 10: Endfor

[0058] / / Start the i-th iteration of the mathematical transformation:

[0059]

[0060] / / Execute butterfly calculation

[0061]

[0062] 18: Endfor

[0063] 19:

[0064] 20: Endfor

[0065] 21: Endfor

[0066] Specifically, for an input encryption polynomial of length N, as shown in lines 0 to 3 of the calculation process [1], before the number theory transformation begins, assume that the original rotation factor of the input is ,use As the base, it is input to the n multipliers in the rotation factor generator, squared and modulo, to generate There are log2N rotation factors in total, and they are stored in the attached Figure 6 The first group of registers shown in the figure is the global twiddle factor (GTF) required for the entire number theory transformation. As shown in lines 5 to 10 of the calculation process [1], before the start of the i-th iteration of the number theory transformation, the log2N-1-i-th GTF is used, that is, And saved in the second group of registers shown in the figure, as the initial value of all n iterative twiddle factors (Stage Twiddle Factor, hereinafter referred to as STF) required for this number theoretic transformation iteration. Multiply by the log2N-1-jth GTF in sequence, that is , and modulo log2n-log2N+1+i updates are performed as the STF required for the first group of n butterfly operations in the i-th iteration of the number theory transformation. The parameter j represents the j-th update of the STF. The update process of the STF is implemented by the input data selector of the register storing the STF. If log2n-log2N+1+i is less than 1, the step of generating the first group of STF is omitted and the STF is taken. is the only STF. Further, as shown in line 19 of the calculation process [1], the above STF is multiplied by the log2N-ith GTF in sequence, that is, , raised to the kth power and modulo, as the STF required for the kth group of n butterfly operations in the i-th iteration of the number theory transformation. If log2N-i is greater than log2N-1, the step of generating the kth group of STF is omitted and The advantage of the rotation factor generation method is that only one original rotation factor is required. All 2 required number theory transformations can be generated online N -1 twiddle factor , reducing the time and on-chip storage space for reading the rotation factors.

[0067] The configurable accelerator realizes number theoretic transformation through the factor generator and the butterfly operation unit array, and reconstructs the data path under the original number theoretic transformation mode by using the factor generator and the data selector in the butterfly operation unit array, so as to realize the flexible switching of the following two basis transformation calculation functions, thereby achieving time-sharing multiplexing of computing resources to cope with the changes in the proportion of number theoretic transformation and basis transformation calculation under different fully homomorphic encryption parameters.

[0068] Function 1: Combine the multipliers in the n configurable butterfly operation units and the n multipliers in the rotation factor generator into two groups of n-length point multiplication calculation units to realize the vector point multiplication in the basis transformation.

[0069] Function 2: Combine the multipliers, modular adders, modular subtractors in the n configurable butterfly operation units with the n multipliers in the rotation factor generator into n groups of 2-point multiplication-accumulation iteration units to realize matrix multiplication in basis transformation.

[0070] Assuming that the modular adder and the modular subtractor in the configurable butterfly operation unit are w bits respectively, further, the embodiment of the present application combines the w-bit modular adder and the w-bit modular subtractor into a 2w-bit ordinary adder to meet the needs of large-bit width multiplication and accumulation calculations in the basis transformation calculation function 2 of the configurable accelerator, thereby improving the circuit calculation efficiency.

[0071] Specifically, a bit width extension signal is configured to perform an OR operation with a carry signal in the modulo adder as a selection signal of an output data selector inside the modulo adder, so that the modulo adder performs the low w bits of 2w-bit ordinary addition in the base transformation mode and performs w-bit finite field addition in the number theory transformation mode. Secondly, the carry of the low w-bit adder in the modulo adder is spliced ​​with the high w bits of the input 2w-bit addend through a data selector between the modulo adder and the modulo subtractor as the input of the w-bit adder in the modulo subtractor to perform the high w bits of 2w-bit ordinary addition. At the same time, the aforementioned bit width extension signal is used as a reset signal of the high w-bit addition result register, so that the register keeps the output valid in the base transformation mode and resets to 0 in the number theory transformation mode. Finally, the output of the modulo adder is spliced ​​with the output of the adder in the modulo subtractor as the calculation result of the 2w-bit ordinary addition.

[0072] Embodiment 3

[0073] Next, we combine the basis transformation formulas [1], [2], [3] and the attached Figure 5 , Attachment Figure 6 , Attachment Figure 7 , attached Figure 8 The specific implementation of the configurable functions of the configurable accelerator structure is explained in a bottom-up order.

[0074] The basis transformation operation in fully homomorphic encryption refers to the transformation of encrypted data from a modulus basis {q1,q2,q3,…q L}Convert to another modulus base {p1,p2,p3,…p K} to quickly change the size of the modulus. Specifically, as shown in formula [1], it is the base conversion (hereinafter referred to as Bconv) algorithm, where the input is the encrypted ciphertext polynomial matrix c, the size of which is L×N, and each row of the matrix is ​​in the modulus basis {q1,q2,q3,…q L} is defined under the finite field. The basis transformation parameters include a vector of length L and a matrix of size K×L [P] K,L are all constants, through the current modulus basis {q1,q2,q3,…q L} and the target modulus basis {p1,p2,p3,…p K}Calculated according to formula [2].

[0075] Formula[1]:

[0076] Formula [2]:

[0077] To further simplify the calculation process of the above formula [1], the modulo operator is defined as follows: mod A⊗B, where A is the aforementioned modulus basis and B is the encryption polynomial matrix:

[0078]

[0079] Based on the above operator definitions, the basis transformation algorithm can be simplified to step one, vector dot multiplication, and step two, matrix multiplication, as shown in equations [3] and [4].

[0080] Formula [3]:

[0081] Formula [4]:

[0082] Wherein, formula [3] includes the parameter matrix [q] K,K Multiplication with the input encryption matrix, due to the parameter matrix [q] K,K is a diagonal matrix, so this step can be simplified to the parameter vector Perform vector multiplication with each column of the input ciphertext matrix c and modulo the final result matrix, which is defined as the basis transformation step 1. Formula [4] is the result matrix U of formula [3] and the parameter matrix [P] K,L Matrix multiplication requires a large number of multiplication and accumulation operations, and the final result matrix is ​​modulo, which is defined as the basis transformation step two.

[0083] In order to meet the above calculation requirements, the design is as shown in the attached Figure 7The configurable butterfly operation unit shown in the figure includes four operation units: a multiplier, a Barrett reduction module (MR shown in the figure, which realizes the modular calculation of the multiplier result), a modular adder, and a modular subtractor. The two inputs of the adder, the two inputs of the multiplier, and the one input and one output of the subtractor are respectively controlled by the six two-to-one data selectors a, e, b, c, d, and f shown in the figure. Specifically, when the selection signals of data selectors a to f are respectively input as 000110 (that is, when the calculation mode selection signal of the configurable butterfly operation unit is 000110), the configurable butterfly operation unit enters mode 1 to realize the butterfly operation of the CT mode, and the output is as follows:

[0084] Out1=In1+In2*twist factor;

[0085] Out2=In1-In2*twist factor;

[0086] Specifically, when the selection signals of data selectors a to f are respectively input as 001001 (i.e., when the calculation mode selection signal of the configurable butterfly operation unit is 001001), the configurable butterfly operation unit enters mode 2, realizes the butterfly operation of GS mode, and the output is as follows:

[0087] Out1=In1+In2;

[0088] Out2=(In1-In2)*twist factor;

[0089] Specifically, when the selection signals of the data selectors a to f are respectively input as 010110 (i.e., when the calculation mode selection signal of the configurable butterfly operation unit is 010110), the configurable butterfly operation unit enters mode 3 to realize the conversion with the basis transformation parameter vector The point product of is as follows:

[0090] Out1=In2*basis transformation parameter; (dot multiplication: calculation basis transformation step 1)

[0091] Out2=NA;

[0092] Specifically, when the selection signals of the data selectors a to f are respectively input as 110110 (i.e., when the calculation mode selection signal of the configurable butterfly operation unit is 110110), the configurable butterfly operation unit enters mode 4 to realize the conversion parameter matrix [P] with the basis. K,L The multiplication and accumulation of , the output is as follows:

[0093] Out1=In1+In2*basis transformation parameter; (multiplication and accumulation: calculation basis transformation step 2)

[0094] Out2=NA;

[0095] Furthermore, as attached Figure 5In the configurable accelerator shown, n configurable butterfly operation units are combined into a butterfly operation unit array. In the number theory transformation mode, the butterfly operation unit array receives 2n encrypted polynomial coefficients from the on-chip memory and rearranged, and performs butterfly operations in 2n point CT or GS mode in parallel. The rotation factors required for number theory transformation under different moduli are generated online by n multipliers in the rotation factor generator. In the basis transformation mode, the 2n encrypted polynomial coefficients output by the on-chip memory are evenly divided into 2 groups, of which the first group of n coefficients are input to the rotation factor generator, and the second group of n coefficients are input to the butterfly operation unit array.

[0096] When executing the basis transformation step 1, the configurable butterfly operation unit is set to mode 3, and the n multipliers and n configurable butterfly operation units in the rotation factor generator independently perform two groups of n-length vector dot products and write them back to the original address of the on-chip memory. When executing the basis transformation step 2, the configurable butterfly operation unit is set to mode 4, and the configurable butterfly operation unit is set to mode 4 through the attached Figure 5 , Attachment Figure 6 The data selector between the rotation factor generator and the butterfly operation unit array shown in the figure combines the multiplier in the rotation factor generator and the configurable butterfly operation unit into n groups of multiplication and accumulation iteration units. Each group of multiplication and accumulation iteration units inputs the two encrypted polynomial coefficients of the aforementioned basis transformation step 1 in the on-chip memory and an intermediate calculation result in the configurable butterfly operation unit output register, and performs two multiplications and two additions. After iterations, the final result of the basis transformation is output to the on-chip memory.

[0097] The calculation process [2] shows the calculation steps of modular addition and modular subtraction in the butterfly operation unit. The input A, B and the output C, D are all integers with a width of w bits. Lines 0 to 3 of the calculation process [2] are modular addition calculations, and lines 4 to 7 are modular subtraction calculations.

[0098]

[0099] It can be seen that in the w-bit modular addition and w-bit modular subtraction calculations, each includes two w-bit wide ordinary addition operations, C0=A+B; and D1=D0+q;. Based on this, the embodiment of the present application provides the following calculation process [3] to realize the switching between w-bit modular addition, w-bit modular subtraction and 2w ordinary addition. Among them, the input SEL is a 1-bit selection signal. When SEL=1, the low w bits of the output C and D are the results of the w-bit modular addition and modular subtraction respectively; when SEL=0, the output C is the result of 2w-bit ordinary addition. In the calculation process [3], the number of additions and subtractions required is exactly the same as that of the calculation process [2]. Therefore, in the execution of the accelerator circuit, no additional adders or subtractors are required. Only one OR gate and one two-choice data selector need to be added to realize the calculation process [3].

[0100] Calculation process[3]:

[0101]

[0102] 7: ; (Use SEL as output reset instead in circuit implementation)

[0103]

[0104] In the aforementioned configurable accelerator, the computation process[3] is performed by the attached Figure 8 The accelerator circuit shown is executed. Specifically, a bit width extension signal is configured to perform an OR operation with the carry signal of the subtractor in the modulo adder as the selection signal of the output data selector of the modulo adder, so that the modulo adder performs the low w bits of the 2w-bit ordinary addition in the base transformation mode and performs the w-bit finite field addition in the number theory transformation mode. Secondly, the carry of the low w-bit adder in the modulo adder is spliced ​​with the high w bits of the input 2w-bit addend through a data selector between the modulo adder and the modulo subtractor as the input of the w-bit adder in the modulo subtractor to perform the high w bits of the 2w-bit ordinary addition. At the same time, the aforementioned bit width extension signal is used as the reset signal of the high w-bit addition result register, so that the register keeps the output valid in the base transformation mode and resets to 0 in the number theory transformation mode. Finally, the output of the modulo adder is spliced ​​with the output of the adder in the modulo subtractor as the calculation result of the 2w-bit ordinary addition.

Claims

1. A key exchange acceleration method for fully homomorphic encryption, characterized in that: include: The encryption calculation in the key exchange step of fully homomorphic encryption is decomposed into two parts: iterative calculation and pipeline calculation. Among them, the iterative calculation includes two parts: number theory transformation and basis transformation of the ciphertext in the key exchange step; the pipeline calculation includes four parts: binary multiplication of the ciphertext in the key exchange step, calculation of key multiplication, ciphertext summation, ciphertext subtraction and multiplication, and ciphertext addition. When executing the key exchange step, the iterative calculation under the current key exchange step and the pipeline calculation under the next key exchange step are executed in parallel; Before performing iterative calculations, the off-chip memory bandwidth is used to perform read and write operations on encrypted data, and the on-chip memory is used to perform ping-pong caching on the encrypted data; after the encrypted data caching is completed, the off-chip memory bandwidth is released, and the encrypted data cached in the on-chip memory is accessed to perform multiple rounds of calculations, during which the off-chip memory read and write bandwidth is not used until all encrypted data in the on-chip memory are iterated, and then the next ping-pong caching is performed; When performing pipeline calculations, the off-chip memory bandwidth is used to read parameters, perform encryption calculations, and write the calculation results back to the off-chip memory in real time, without occupying the on-chip memory cache space for data caching.

2. The key exchange acceleration method for fully homomorphic encryption according to claim 1, characterized in that: When the key exchange step is executed more than twice, the encrypted data that need to execute the key exchange step will be divided into two groups; when different groups of encrypted data execute the key exchange step, the iterative calculation and pipeline calculation of one group of encrypted data are executed in parallel with the pipeline calculation and iterative calculation of the other group of encrypted data; when the same group of encrypted data executes the key exchange step, the pipeline calculation and iterative calculation are executed alternately.

3. The key exchange acceleration method for fully homomorphic encryption according to claim 2, characterized in that: When different groups of encrypted data execute the key exchange step, the pipeline calculation under the current key exchange step of one of the groups of encrypted data is first calculated, and then the pipeline calculation under the current key exchange step of one of the groups of encrypted data is used as the input of the iterative calculation under the next key exchange step of one of the groups of encrypted data, and the iterative calculation under the current key exchange step of one of the groups of encrypted data and the pipeline calculation under the current key exchange step of another group of encrypted data are performed simultaneously, and then the pipeline calculation under the next key exchange step of one of the groups of encrypted data and the iterative calculation under the current key exchange step of the other group of encrypted data are performed simultaneously.

4. A configurable accelerator, applied to the key exchange acceleration method for fully homomorphic encryption according to any one of claims 1 to 3, comprising an on-chip memory, a data rearrangement module, a rotation factor generator and a butterfly operation unit array, characterized in that: The butterfly operation unit array is used for multiplexing number theory transformation and basis transformation in iterative calculation, and includes n configurable butterfly operation units; the configurable butterfly operation unit is configured to be a CT butterfly operation, a GS butterfly operation, a basis transformation point multiplication or a basis transformation multiplication-accumulation calculation mode in response to its calculation mode selection signal; the butterfly operation unit array outputs a butterfly operation result of 2n points in CT mode or GS mode each iteration; the rotation factor generator includes n multipliers corresponding to the n configurable butterfly operation units one by one, and generates the rotation factors required for number theory transformation under different moduli online based on the original rotation factors; and is combined with the multipliers in the n configurable butterfly operation units into two groups of point multiplication calculation units with a length of n, so as to realize the vector point multiplication in the basis transformation; and is combined with the multipliers, modular adders and modular subtractors in the n configurable butterfly operation units into n groups of 2-point multiplication-accumulation iterative units, so as to realize the matrix multiplication in the basis transformation.

5. The configurable accelerator according to claim 4, characterized in that: The configurable butterfly operation unit comprises a w-bit modular adder and a w-bit modular subtractor, and the w-bit modular adder and the w-bit modular subtractor are combined into a 2w-bit width adder.

6. The configurable accelerator according to claim 5, characterized in that: The modulo adder comprises an output data selector, wherein a selection signal of the output data selector comes from a signal obtained by performing an OR operation on a bit width extension signal and a carry signal in a w-bit modulo adder. The modulo adder responds to a signal obtained by performing an OR operation on the bit width extension signal and the carry signal in the w-bit modulo adder to perform the low w bits of 2w-bit ordinary addition in base transformation and performs w-bit finite field addition in number theory transformation; the carry of the low w-bit adder in the modulo adder is spliced ​​with the high w bits of the input 2w-bit addend through a data selector between the modulo adder and the modulo subtractor as the input of the w-bit adder in the modulo subtractor to perform the high w bits of 2w-bit ordinary addition; the bit width extension signal is used as a reset signal of a high w-bit addition result register to keep the output of the register valid in base transformation mode and reset to 0 in number theory transformation mode; the output of the modulo adder is spliced ​​with the output of the adder in the modulo subtractor as the calculation result of the 2w-bit width adder.

Images