Self-isomorphic mapping hardware accelerator and acceleration method based on fully homomorphic encryption

Abstract

The invention discloses a self-isomorphic mapping hardware accelerator based on fully homomorphic encryption and an acceleration method. The accelerator comprises a polynomial storage area, a Tag and Se < l > reloading unit, a read address calculation unit, a permutation network and a cache unit. The method comprises the step of completing self-isomorphic mapping of a polynomial according to an architecture parallelism degree configured during compiling and a maximum polynomial degree to be supported after compiling according to an input actual polynomial degree and a self-isomorphic parameter. According to the embodiment of the invention, the overhead of domain conversion and the overhead of a bit inversion arrangement coefficient can be reduced, and the calculation burden of homomorphic rotation is reduced. The method can be widely applied to the technical field of homomorphic encryption.

Description

Technical Field

[0001] The present application relates to the field of homomorphic encryption technology, and in particular to a self-isomorphic mapping hardware accelerator and acceleration method based on fully homomorphic encryption. Background Art

[0002] Fully homomorphic encryption is a technology that can perform operations directly on encrypted data, supporting algebraic operations equivalent to plaintext without decryption. However, the computational complexity of fully homomorphic encryption schemes is much higher than that of traditional encryption algorithms, especially when performing complex operations such as homomorphic multiplication and homomorphic rotation, which involves a large number of polynomial operations, increasing the storage and computational burden and resulting in low computational efficiency. In machine learning applications based on the CKKS fully homomorphic encryption scheme, homomorphic rotation is one of the key operators. It is used to perform circular shifts on encrypted plaintext vectors to construct higher-level fully homomorphic operations. However, homomorphic rotation operations rely on complex polynomial automorphism mappings. The automorphism mappings under different rotation indexes k are different, resulting in irregular data access patterns and making hardware implementation complicated. At present, efficient hardware acceleration designs for automorphism mapping include the vectorization method of automorphism mapping in the coefficient domain and arbitrary automorphism mapping of polynomials in the NTT domain. However, the vectorization method of automorphism mapping in the coefficient domain requires domain conversion before and after the mapping. The computational complexity of domain conversion O(nlog2n) is much greater than the computational complexity of automorphism mapping O(n), which will bring non-negligible additional computational overhead to the homomorphic rotation operation; and it is necessary to judge whether the permuted coefficients need to be negated, and further convert the negative coefficients into congruent positive numbers through the modular adder, so it also consumes the computing resources of p negation judges and p modular adders. For arbitrary automorphism mapping of polynomials in the NTT domain, it will take about 2×(n / p) cycles to complete the automorphism mapping of a polynomial, and building SPN requires 2×p×log2p 2-to-1 multiplexers and a cache with a capacity of n. In addition, they require that the polynomial coefficients in the NTT domain are arranged in natural order, which requires the bit-reversal arrangement of the polynomial coefficients in advance in the coefficient domain, with a computational complexity of O(n), which brings additional overhead for the irregular arrangement of coefficients.

[0003] In summary, the technical problems existing in the relevant technologies need to be improved. Summary of the invention

[0004] The main purpose of the embodiments of the present application is to propose a self-isomorphic mapping hardware accelerator and acceleration method based on fully homomorphic encryption, which can reduce the domain conversion overhead and the overhead of bit reversal permutation coefficients, and reduce the computational burden of homomorphic rotation.

[0005] To achieve the above-mentioned purpose, an embodiment of the present application proposes an automorphic mapping hardware accelerator based on fully homomorphic encryption on one hand, the accelerator includes a polynomial storage area, a Tag and Sel reload unit, a read address calculation unit, a permutation network and a cache unit, the first output end of the Tag and Sel reload unit is connected to the input end of the read address calculation unit, the second output end of the Tag and Sel reload unit is connected to the first input end of the permutation network, the first output end of the read address calculation unit is connected to the first input end of the polynomial storage area, the second output end of the read address calculation unit is connected to the second input end of the permutation network, the output end of the polynomial storage area is connected to the third input end of the permutation network, the output end of the permutation network is connected to the input end of the cache unit, and the output end of the cache unit is connected to the second input end of the polynomial storage area, wherein:

[0006] The Tag and Sel reload units are used to perform calculation reload according to the first unit activation signal, the running configurable polynomial degree and the automorphism parameters, and generate the value of the Tag Table register and the value of the Sel Table register;

[0007] The read address calculation unit is used to calculate according to the second unit activation signal, the degree of the running configurable polynomial, the automorphism parameter and the value of the Tag Table register to generate a first half area read enable signal, a second half area read enable signal, a half area read address signal and a Col granularity replacement enable signal;

[0008] The polynomial storage area is used to read data according to the first half area read enable signal, the second half area read enable signal and the half area read address signal, and generate the first half area read data valid signal, the second half area read data valid signal and the filtered half area read data;

[0009] The replacement network is used to perform replacement according to the filtered half-area read data, the first half-area read data valid signal, the second half-area read data valid signal, the Col granularity replacement enable signal and the value of the Sel Table register to generate a replacement result and a replacement result valid signal;

[0010] The cache unit is used to cache according to the permutation result, the permutation result valid signal and the running configurable polynomial degree, output the first half area write back enable signal, the second half area write back enable signal and the half area write back data and transmit them back to the polynomial storage area to complete the self-similar mapping of the polynomial.

[0011] In some embodiments, the compilation configurable architectural parallelism of the automorphism mapping hardware accelerator is p, the maximum polynomial degree of the automorphism mapping hardware accelerator is N, the operation configurable polynomial degree of the automorphism mapping hardware accelerator is n, and the automorphism parameters of the automorphism mapping hardware accelerator are [5 k ] 2n .

[0012] In some embodiments, the Tag and Sel reload unit includes a first unit controller, a Tag computing core, a position index identification register and a source data source identification register, the first output end of the first unit controller is connected to the input end of the Tag computing core, the second output end of the first unit controller is connected to the first input end of the position index identification register, the third output end of the first unit controller is connected to the first input end of the source data source identification register, the first output end of the Tag computing core is connected to the second input end of the position index identification register, and the second output end of the Tag computing core is connected to the second input end of the source data source identification register, wherein:

[0013] The first unit controller is used to control the operation of the Tag calculation core, the location index identification register and the source data source identification register according to the first unit activation signal and the degree of the running configurable polynomial, and generate a first parameter signal, a first enable signal, a reload first enable signal and a reload second enable signal;

[0014] The tag calculation core is used to obtain the first parameter signal, the first enable signal and the automorphic parameter and perform calculations to generate a position index identifier and a source data source identifier;

[0015] The position index identification register is used to update the register value according to the reload first enable signal and the position index identification, and output the value of the Tag Table register;

[0016] The source data origin identification register is used to update the register value according to the overloaded second enable signal and the source data origin identification, and output the value of the Sel Table register.

[0017] In some embodiments, the read address calculation unit includes a second unit controller and a read address calculation core, and the output end of the second unit controller is connected to the input end of the read address calculation core, wherein:

[0018] The second unit controller is used to control the operation of the read address calculation core according to the second unit activation signal and the degree of the running configurable polynomial, and generate a second parameter signal, a second enable signal, the first half area read enable signal and the second half area read enable signal;

[0019] The read address calculation core is used to perform calculations according to the second parameter signal, the second enable signal, the automorphic parameter and the value of the Tag Table register to generate the half-block read address signal and the Col granularity replacement enable signal.

[0020] In some embodiments, the polynomial storage area includes a plurality of random access memories, and the plurality of random access memories are equally divided to obtain a polynomial storage first half area and a polynomial storage second half area, wherein:

[0021] The polynomial storage first half area is used to read data according to the first half area read enable signal and the half area read address signal to generate the first half area read data valid signal;

[0022] The polynomial storage second half area is used to read data according to the second half area read enable signal and the half area read address signal to generate the second half area read data valid signal;

[0023] The first half area read data valid signal and the second half area read data valid signal are used as selection signals for half area read data for screening, and the screened half area read data is output.

[0024] In some embodiments, the polynomial storage area is composed of p Bank units, each of which includes at least one Bank unit with a depth of The actual filling depth of the random access memory in the bank unit is

[0025] In some embodiments, the permutation network is a p×p banyan permutation network with a total of log2p stages, each stage consisting of p 2-to-1 multiplexers, and pipeline registers inserted between stages.

[0026] In some embodiments, the cache unit includes a cache area and a third unit controller, and the output end of the third unit controller is connected to the input end of the cache area, wherein:

[0027] The cache area is used to use the replacement result valid signal as a unified write enable signal of the cache and use the replacement result as write data of the cache group;

[0028] The third unit controller is used to calculate the actual filling depth of several random access memories according to the degree of the running configurable polynomial, count the unified write enable signal of the cache, use the counter value as the unified write address of the cache to write the write data of the cache group, output the first half area write back enable signal, the second half area write back enable signal and the half area write back data and transmit them back to the polynomial storage area to complete the self-similar mapping of the polynomial.

[0029] In some embodiments, the total cache capacity of the cache unit is Include cache groups, each of which includes at least one cache group with a depth of of random access memory.

[0030] To achieve the above purpose, another aspect of the embodiment of the present application proposes an acceleration method for a self-isomorphic mapping hardware accelerator based on fully homomorphic encryption, the method comprising the following steps:

[0031] Configure the polynomial degree and automorphism parameters, activate the Tag and Sel reload units, reload the location index identification register and the source data source identification register, and generate the value of the Tag Table register and the value of the Sel Table register;

[0032] Configure the polynomial degree and the automorphism parameter, combine the value of the Tag Table register, activate the read address generation unit, and obtain the first half area read enable signal, the second half area read enable signal, the half area read address signal and the Col granularity replacement enable signal;

[0033] Acquire half-area read data, a first-half-area read data valid signal and a second-half-area read data valid signal from a polynomial storage area according to the first-half-area read enable signal, the second-half-area read enable signal and the half-area read address signal;

[0034] Filtering a replacement network selection parameter from the SelTable register according to the valid signal of the first half area read data and the valid signal of the second half area read data, combining the Col granularity replacement enable signal with the replacement network selection parameter, performing Col granularity replacement and Bank granularity recursive replacement on the half area read data, and obtaining a replacement result and a replacement result valid signal;

[0035] According to the permutation result valid signal, the permutation result is written into the cache, and after all the permutation results are loaded into the cache, the permutation results are read out from the cache in sequence and written back to the corresponding half area of ​​the polynomial storage area to complete the automorphism mapping of the polynomial.

[0036] The embodiments of the present application include at least the following beneficial effects: The present application provides a self-isomorphic mapping hardware accelerator and acceleration method based on fully homomorphic encryption, which generates the value of the Tag Table register and the value of the Sel Table register by overloading the Tag and Sel overload units, and generates the first half area read enable signal, the second half area read enable signal, the half area read address signal and the Col granularity permutation enable signal by the read address calculation unit, and then performs data screening through the polynomial storage area, and finally performs permutation through the permutation network to generate a permutation result and a permutation result valid signal, allowing efficient polynomial self-isomorphic mapping, while avoiding the domain conversion overhead and the bit reversal permutation coefficient overhead, reducing the computational burden of homomorphic rotation. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 It is a structural diagram of a self-isomorphic mapping hardware accelerator based on fully homomorphic encryption provided in an embodiment of the present application;

[0038] Figure 2 It is a schematic diagram of the steps of an acceleration method of a self-isomorphic mapping hardware accelerator based on fully homomorphic encryption provided in an embodiment of the present application;

[0039] Figure 3 It is a schematic diagram of the distribution of polynomial coefficient indexes in the NTT domain when N=64, p=8, and n=64 provided in an embodiment of the present application;

[0040] Figure 4 It is a schematic diagram of the structure of the Tag calculation core provided in the embodiment of the present application;

[0041] Figure 5 is a schematic diagram of the structure of a dynamic bit reversal component (bitrev) provided in an embodiment of the present application;

[0042] Figure 6 It is a structural diagram of a dynamic right shift component (div2fd) provided in an embodiment of the present application;

[0043] Figure 7 It is a pseudo code schematic diagram of the Tag and Sel overload unit provided in the embodiment of the present application;

[0044] Figure 8 It is a structural diagram of a read address calculation core provided in an embodiment of the present application;

[0045] Fig. 9 is a pseudo code schematic diagram of a read address calculation unit provided in an embodiment of the present application;

[0046] Fig.10 It is a pseudo code diagram of the permutation network provided in the embodiment of the present application. DETAILED DESCRIPTION

[0047] In order to make the purpose, technical solutions and advantages of the present application clearer, the present application is further described in detail below in conjunction with the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not intended to limit the present application. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the embodiments of the present application. They are only examples of systems and methods consistent with some aspects of the embodiments of the present application as detailed in the attached claims.

[0048] It is understood that the terms "first", "second", etc. used in this application can be used to describe various concepts in this article, but unless otherwise specified, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another concept. For example, without departing from the scope of the embodiment of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the words "if" and "if" as used herein can be interpreted as "at the time of" or "when" or "in response to determination".

[0049] The terms "at least one", "multiple", "each", "any", etc. used in this application, at least one includes one, two or more, multiple includes two or more, each refers to each of the corresponding multiple, and any refers to any one of the multiple.

[0050] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by those skilled in the art to which this application belongs. The terms used herein are only for the purpose of describing the embodiments of this application and are not intended to limit this application.

[0051] Before describing the embodiments of the present application in detail, some nouns and terms involved in the embodiments of the present application are first described. The nouns and terms involved in the embodiments of the present application are subject to the following explanations.

[0052] Homomorphic rotation is one of the key operators in machine learning applications based on the CKKS fully homomorphic encryption scheme. It is used to perform circular shifts on encrypted plaintext vectors to build higher-level fully homomorphic operations such as bootstrapping, matrix-vector multiplication, and convolution. However, homomorphic rotation operations rely on complex polynomial automorphism mappings. The automorphic mappings under different rotation indices k are different, resulting in irregular data access patterns and making hardware implementation complicated. In order to adapt to different rotation indices, each data storage location needs to be connected to a series of different data storage locations, further increasing the complexity of wiring and hardware costs. In addition, the CKKS fully homomorphic encryption scheme usually places the ciphertext polynomial in the NTT domain (evaluation domain) to accelerate the calculation of polynomial multiplication. If the automorphic mapping is performed in the coefficient domain, it is necessary to first convert the ciphertext polynomial from the NTT domain to the coefficient domain, and then convert it back to the NTT domain after completing the automorphic mapping. The computational complexity of performing NTT / INTT on a polynomial of degree n is O(nlog2n), and this frequent domain conversion further increases the computational overhead of homomorphic rotation operations. Therefore, it is crucial to design efficient hardware acceleration for automorphic mapping.

[0053] There are some deficiencies in the related art, such as the self-similar mapping vectorization method HFAuto in the coefficient domain. They regard the ciphertext polynomial of degree n as a vector of length n, and divide the vector into n / p sub-vectors of length p under the parallelism p, so as to use p BRAMs with a depth of n / p to store a ciphertext polynomial. It proves the feasibility of vectorizing polynomial self-similar mapping under this storage structure. HFAuto performs self-similar mapping of polynomials in the coefficient domain, but its disadvantage is that domain conversion is required before and after the mapping, and the computational complexity of domain conversion O(nlog2n) is much greater than the computational complexity of self-similar mapping O(n), which will bring non-negligible additional computational overhead to the homomorphic rotation operation; secondly, it is necessary to judge whether the permuted coefficients need to be negated, and further convert the negative coefficients into congruent positive numbers through the modulo adder, so the computing resources of p negation judges and p modulo adders are also consumed.

[0054] In addition, for arbitrary self-morphic mapping of polynomials in the NTT domain, a streaming permutation network (SPN) is chosen instead of an expensive Crossbar to perform parallel permutation of coefficients. The implementation of SPN is based on the benes permutation network structure, which can achieve arbitrary data permutation with high throughput. The execution process of SPN is as follows: First, n coefficients flow into the first spatial permutation network in n / p cycles, and the routing table in the control logic unit completes the data routing control. The output of the first spatial permutation network is written into p buffers according to the address generated by the AGU; secondly, after the results of the first spatial permutation are all written into the buffer area, the second spatial permutation begins, and p are read from the buffer area each cycle and sent to the second spatial permutation network for the second spatial permutation, which also takes n / p cycles. Therefore, it will take about 2×(n / p) cycles to complete a polynomial self-morphic mapping, and the construction of SPN requires 2×p×log2p 2-to-1 multiplexers and a buffer with a capacity of n. In addition, they require that the polynomial coefficients in the NTT domain are arranged in natural order, which requires the bit-reversal arrangement of the polynomial coefficients in advance in the coefficient domain, with a computational complexity of O(n), which brings additional overhead for the irregular arrangement of coefficients.

[0055] In view of this, the embodiment of the present application provides a self-similar mapping hardware accelerator based on fully homomorphic encryption, which uses a simpler permutation network to efficiently implement vectorized self-similar mapping in the NTT domain, avoiding the overhead of domain conversion and the overhead of bit reversal permutation coefficients. This architecture has higher scalability and flexibility.

[0056] Firstly, the embodiment of the present invention performs rigorous mathematical analysis for constructing a vectorized self-isomorphic mapping scheme in the NTT domain.

[0057] For the polynomial a(x)=a0+a1x+...+a n-1 x n-1 ∈R q , where the quotient ring R q =Z q / (x n +1), which has coefficients in the coefficient domain represented by a=(a[0], a[1], ..., a[n-1]), where a[j]=a j , integer j∈[0,n). Its point value representation in the NTT domain is A=(A[0], A[1], ..., A[n-1]), and for i∈[0,n), A[i]=a(ψ bitrev (i))modq, The original root g satisfies g q-1 ≡1(modq), and bitrev(·) is the bit reversal operation on the binary representation of i.

[0058] In order to cyclically shift the hidden plaintext slot left by k units, an automorphism mapping is performed on a(x) We get the polynomial a′(x), which has a point-valued representation A′=(A′[0], A′[1], ..., A′[n-1]) in the NTT domain, and for i′∈[0, n) we have make:

[0059]

[0060] Then we have:

[0061]

[0062] Therefore, the automorphic mapping with rotation index k can be completed in the NTT domain through the permutation of A→A′. However, the automorphic mapping is irregular, and in order to avoid Write-After-Read conflicts, additional storage space is required to cache the permutation results.

[0063] The polynomial coefficient storage structure in the NTT domain of the present invention is as follows: when the architecture parallelism is p, each polynomial storage area has p banks, and each bank has 2 RAMs (in order to meet the data bandwidth of NTT / INTT calculation), and the filling depth of each RAM is Where n is the degree of the polynomial, and p, n and fd are all powers of 2. Assume that the coefficients of the polynomial to be automorphically mapped are stored in storage area A, and the permutation results are cached in storage area A'. In storage area A', the coefficient index i'∈[0,n) is specifically distributed in the c'th column of the r'th row in Bankb', that is, Bankb', Row r', Col c', denoted as A'(b', r', c'), where c′=i′mod2, that is, i′=b′×(2×fd)+r′×2+c′. Similarly, the coefficient index i∈[0,n) in the storage area A is specifically distributed in Bank b, Row r, Col c, denoted as A(b, r, c). Then when performing the automorphism mapping, we have

[0064] Reference Figure 1 , Figure 1 A flowchart of a self-isomorphic mapping hardware accelerator based on fully homomorphic encryption provided by an embodiment of the present invention, referring to Figure 1The accelerator includes a polynomial storage area, a Tag and Sel reload unit, a read address calculation unit, a permutation network and a cache unit. The first output end of the Tag and Sel reload unit is connected to the input end of the read address calculation unit, the second output end of the Tag and Sel reload unit is connected to the first input end of the permutation network, the first output end of the read address calculation unit is connected to the first input end of the polynomial storage area, the second output end of the read address calculation unit is connected to the second input end of the permutation network, the output end of the polynomial storage area is connected to the third input end of the permutation network, the output end of the permutation network is connected to the input end of the cache unit, and the output end of the cache unit is connected to the second input end of the polynomial storage area.

[0065] First, it should be noted that the embodiment of the present invention provides a self-similar mapping hardware accelerator based on fully homomorphic encryption. The architecture parallelism p and the maximum polynomial degree N can be configured at compile time, and the actual polynomial degree n (2p≤n≤N) and the self-similar parameters [5 k ] 2n , where p, N, n are all powers of 2, where:

[0066] The Tag and Sel reload units are used to calculate and reload according to the activation signal of the first unit, the degree of the configurable polynomial and the automorphism parameters, and generate the value of the Tag Table register and the value of the Sel Table register;

[0067] Specifically, the Tag and Sel reload unit includes a first unit controller, a Tag computing core, a position index identification register and a source data source identification register. The first output end of the first unit controller is connected to the input end of the Tag computing core, the second output end of the first unit controller is connected to the first input end of the position index identification register, the third output end of the first unit controller is connected to the first input end of the source data source identification register, the first output end of the Tag computing core is connected to the second input end of the position index identification register, and the second output end of the Tag computing core is connected to the second input end of the source data source identification register, wherein the first unit controller is used to control the Tag computing core, the position index identification register and the source data source identification register according to the first unit activation signal and the degree of the running configurable polynomial, and generate the first parameter signal, the first enable signal, the reload first enable signal and the reload second enable signal; the Tag computing core is used to obtain the first parameter signal, the first enable signal and the automorphic parameter and perform calculations to generate the position index identification and the source data source identification; the position index identification register is used to update the register value according to the reload first enable signal and the position index identification, and output the Tag. The source data source identification register is used to update the register value according to the overloaded second enable signal and the source data source identification, and output the value of the Sel Table register.

[0068] In this embodiment, inside the Tag and Sel reload unit: the unit controller is responsible for controlling the entire unit. It calculates the parameters log2n, fd and log2fd according to the effective activation signal and the polynomial degree n, and updates the internal state machine, thereby providing the parameters (log2n, fd, log2fd, [5 k ] 2n) and enable signals, and generates a reload enable signal for each register in the Tag Table and Sel Table; the Tag calculation core, according to the parameters and enable signals provided by the unit controller, calculates the position index identifier (tag) and source data source identifier (sel) of BankO~(p-1) in sequence, and sends them to the input of the Tag Table and Sel Table respectively as the write data of the register; the Tag Table, which contains p registers, receives p tag reload enable signals provided by the unit controller and the write data provided by the Tag calculation core, and updates the corresponding register values. The tag[b] register value is used as the position identifier index of Bank b and is provided to the read address calculation unit for Bank b read address generation, where b∈[0,p); the Sel Table, which contains p registers, receives p sel reload enable signals provided by the unit controller and the write data provided by the Tag calculation core, and updates the corresponding register values. The sel[b′] register value is used as the source data source identifier of Bankb′ and is provided to the permutation network for data selection signal generation, where b′∈[0,p).

[0069] The structure of the Tag calculation core is as follows Figure 4 As shown, the structure of the dynamic bit reversal component is as follows Figure 5 As shown, the structure of the dynamic right shift unit is as follows Figure 6 As shown. The number of pipeline stages of the dynamic bit reversal component log2N is determined by the compile-time parameter N. At runtime, according to the input parameter log2n, the binary representation of the input data din is bit-reversed by log2n bits, and the output result dout = bitrev (din). The number of pipeline stages of the dynamic right shift component 1 + log2FD is determined by the compile-time parameter OK, at runtime, according to the input parameter log2fd, the input data i is right-shifted by 1+log2fd bits, and the output result is

[0070] Before performing polynomial automorphism mapping, according to the parameters n and [5 k ] 2n , calculate the Tag, and overload the Tag Table and Sel Table. The pseudo code for overloading Tag and Sel is as follows Figure 7 As shown in the figure, the calculation of Tag and the reloading of Sel are active demand queries, which query Bank b′=0,1,...,p-1 in turn to find out which Bank the source operands are from, and load the valid b into the sel[b′] register in the Sel Table, which will be used to generate the data selection signal of the permutation network later. The reloading of Tag belongs to the passive demand query matching, that is, querying Bank idx b= 0, 1, ..., p-1 source operand is required by which Bankb', when idx b When it is equal to the valid b value, the coefficient index representing Bank b′, i′=b′×(2×fd), is reloaded into the tag[b] register in the Tag Table as the location index identifier of Bank b, providing the initial value of the variable for the read address calculation unit.

[0071] The read address calculation unit is used to calculate according to the second unit activation signal, the degree of the running configurable polynomial, the automorphism parameter and the value of the Tag Table register to generate a first half area read enable signal, a second half area read enable signal, a half area read address signal and a Col granularity replacement enable signal;

[0072] Specifically, the read address calculation unit includes a second unit controller and a read address calculation core, the output end of the second unit controller is connected to the input end of the read address calculation core, wherein the second unit controller is used to control the operation of the read address calculation core according to the second unit activation signal and the degree of running the configurable polynomial, the second parameter signal, the second enable signal, the first half area read enable signal and the second half area read enable signal; the read address calculation core is used to calculate according to the second parameter signal, the second enable signal, the self-similar parameters and the value of the Tag Table register to generate a half-area read address signal and a Col granularity replacement enable signal.

[0073] In this embodiment, inside the read address calculation unit: the unit controller is responsible for controlling the entire unit. It calculates the parameters log2n and fd according to the effective activation signal and the polynomial degree n, and updates the internal state machine, thereby providing parameters (log2n, fd, [5 k ] 2n , tag) and enable signal, and generates the first half read enable signal and the second half enable signal. The read address calculation core calculates the corresponding Bank read address and the Col granularity replacement enable signal of the read data pair according to the parameters and enable signal provided by the unit controller.

[0074] The structure of the read address calculation core is as follows Figure 8 The pseudo code for reading address calculation is as follows Fig. 9 As shown, the goal is to make the write-back address r' of the Bank in the half area increase in natural order, so as to carry out the calculation task of the Bank read address r. Specifically:

[0075] for Before the calculation of the read address in the first half of the area begins, the unit controller sends the value of register tag[u] in the Tag Table to the tag input of the uth read address calculation core, and provides a low-level enable signal en to initialize the index variable i′ to tag[u]. In the fd-1 cycles thereafter, en is pulled high, so that i′ increments by 2 every cycle. When i′ increments to tag[u]+2×(fd-1), the unit controller inserts a pipeline bubble for one cycle, and sends the value of register tag[u+p / 2] to the tag input of the uth read address calculation core, and pulls en low at the same time, preparing to start the calculation of the read address in the second half of the area, that is, i′ is successfully initialized to tag[u+p / 2] in the next cycle, and in the fd-1 cycles thereafter, en is pulled high, so that i′ increments by 2 every cycle. At the same time, when i′ is a valid value, the unit controller will mark the data valid signal valid as a high level, and realize its synchronous pipeline with the read address calculation core, and when i′ is an invalid value, valid will be marked as a low level.

[0076] The data valid signal ren at the same level as the read address r will be used to generate the first half read enable signal ren0 and the second half read enable signal ren1. The initial value of the half-area selection signal rsel is 0, indicating that the first half area is selected, thereby generating a valid ren0 = (ren&~rsel). After the calculation of the first half area read address is completed, since the mark valid is low when the unit controller inserts a cycle pipeline bubble, after the falling edge of ren is detected, rsel is inverted and becomes 1, indicating that the second half area is selected, thereby generating a valid ren1 = (ren&rsel). When the calculation of the second half area read address is completed, the falling edge of ren is detected, and rsel is inverted and becomes 0, preparing for the next read address generation task.

[0077] Since there is a one-cycle delay in reading data from a Bank, it is necessary to enable the c cache for one beat of Col granularity permutation and then send it to the input of the permutation network synchronously with the half-block read data of the polynomial storage area.

[0078] The polynomial storage area is used to read data according to the first half area read enable signal, the second half area read enable signal and the half area read address signal, and generate the first half area read data valid signal, the second half area read data valid signal and the filtered half area read data;

[0079] Specifically, the polynomial storage area includes a plurality of random access memories, which are equally divided to obtain a polynomial storage first half area and a polynomial storage second half area, wherein the polynomial storage first half area is used to read data according to a first half area read enable signal and a half area read address signal, and generate a first half area read data valid signal; the polynomial storage second half area is used to read data according to a second half area read enable signal and a half area read address signal, and generate a second half area read data valid signal; the first half area read data valid signal and the second half area read data valid signal are used as selection signals for half area read data for screening, and the screened half area read data is output.

[0080] Furthermore, it should be noted that the polynomial storage area is composed of p Bank units, and the Bank unit includes at least one depth The actual filling depth of the random access memory in the bank unit is

[0081] In this embodiment, it is used to store all coefficients of a polynomial. It consists of p banks, each of which contains two banks with a depth of The actual filling depth fd of each RAM is determined by the actual polynomial degree n input at runtime, that is, n is a power of 2, and 2p≤n≤N. The storage area is divided into the first half and the second half Figure 3 The distribution of polynomial coefficient indexes in the NTT domain when N=64, p=8, n=64 is given, where the coefficient index i=23 is specifically located at Bank 2, Row 3, Col 1. The first half area includes Bank 0-3, and the second half area includes Bank 4-7.

[0082] Specifically, the uth read address signal is used as Banku and The read address of According to the effective read address signal and two half-area read enable signals, the p / 2 coefficient pairs to be replaced are read out from the corresponding half-area. However, there is a one-cycle delay in the read operation, so the first half-area read enable signal and the second half-area read enable signal are cached for one beat and used as the first half-area read data valid signal and the second half-area read data valid signal, respectively, and sent to the input end of the replacement network. At the same time, the first half-area read data valid signal is used as the half-area read data selection signal. If it is valid, the first half-area read data is screened out, otherwise, the second half-area read data is screened out, and the screened half-area read data is sent to the input end of the replacement network. In addition, according to the effective half-area write enable signal and write address signal, p / 2 write-back data pairs can be written back to the corresponding half-area.

[0083] The replacement network is used to perform replacement according to the filtered half-area read data, the first half-area read data valid signal, the second half-area read data valid signal, the Col granularity replacement enable signal and the value of the Sel Table register to generate a replacement result and a replacement result valid signal;

[0084] Specifically, the permutation network is a p×p banyan permutation network with a total of log2p stages, each stage consisting of p 2-to-1 multiplexers, and pipeline registers are inserted between stages.

[0085] In this embodiment, the pseudo code of the permutation network algorithm is as follows: Fig.10 As shown, specifically: the first level of the permutation network (s=0) performs Col-granular permutation on a pair of read data of the same Bank according to the Col-granular permutation enable of the read data pair. In addition, the sel register value participating in the pipeline is screened out according to the valid signal of the read data in the first half area. When it is at a high level, the sel[0]~sel[p / 2-1] permutation network selection parameters of SelTable are screened out. Otherwise, the sel[p / 2]~sel[p-1] permutation network selection parameters are screened out and stored in the pipeline register. At the same time, the valid signal of the read data in the first half area and the valid signal of the read data in the second half area are or-operated as data valid identification and stored in the pipeline register. The next logp-1 level generates the data selection signal of the multiplexer at each level according to the sel register value of each level of the pipeline, and completes the recursive permutation of the coefficients at the Bank granularity. After the permutation result and the valid signal of the permutation result of the last level are stored, they are sent to the input end of the cache unit to prepare for the cache of the permutation result.

[0086] The cache unit is used to cache according to the permutation result, the permutation result valid signal and the running configurable polynomial degree, output the first half area write back enable signal, the second half area write back enable signal and the half area write back data and transmit them back to the polynomial storage area to complete the self-similar mapping of the polynomial.

[0087] Specifically, the cache unit includes a cache area and a third unit controller, the output end of the third unit controller is connected to the input end of the cache area, wherein the cache area is used to use the replacement result valid signal as a unified write enable signal of the cache, and use the replacement result as the write data of the cache group; the third unit controller is used to calculate the actual filling depth of several random access memories according to the degree of running a configurable polynomial, and count the unified write enable signal of the cache, use the counter value as the unified write address of the cache to write the write data of the cache group, output the first half area write back enable signal, the second half area write back enable signal and the half area write back data and transmit them back to the polynomial storage area, so as to complete the self-similar mapping of the polynomial.

[0088] Furthermore, it should be noted that the total cache capacity of the cache unit is Include cache groups, each of which includes at least one cache group with a depth of of random access memory.

[0089] In this embodiment, when all permutation results of the half area are loaded into the cache, the permutation results can be read out from the cache in sequence and written back to the corresponding half area of ​​the polynomial storage area. When all permutation results of the second half area are written back to the second half area of ​​the polynomial storage area, it means that the automorphism mapping of the polynomial is completed.

[0090] Specifically, inside the cache unit: the permutation result valid signal is used as the unified write enable of the cache, and the u-th pair of permutation results is used as the write data of cache group u, where u∈[0,p / 2); the unit controller calculates fd according to the polynomial degree n, and counts the valid cache write enable signals, and uses the counter value as the unified write address of the cache (the initial value of the counter is 0). When the write address increases to (fd-1) and the cache write enable is valid, the write address will be cleared, and the write-back state machine will switch from the idle state (IDLE) to the write-first-half state (WB0). When the write-back state machine is in the WB0 state, a valid cache read enable signal, a cache read address, and a valid first-half write-back enable signal are generated. When the cache read address increases to (fd-1), the write-back state machine will switch from WB0 to the write-second-half state (WB1), and the cache read address will be cleared. When the write-back state machine is in the WB1 state, a valid cache enable signal, a cache read address, and a valid second-half write-back enable signal are generated. When the cache read address increases to (fd-1), the write-back state machine will switch from WB1 to IDLE.

[0091] In summary, the vectorized automorphic mapping scheme in the NTT domain constructed by the present invention is to obtain source operands from A based on the active demand of A′. The scheme has the following characteristics:

[0092] 1) Divide the polynomial coefficient index into the first half and the second half Then the coefficient permutation will only occur in the same half area. All have msb(i′)=0, so in the calculation When lsb(bitrev(i′))=0, [5 k ] 2n is an odd number, is an even number, n is an even number, so lsb(idx ω )=0. And i=bitrev(idx ω ) then msb(i)=0. Similarly, for msb(i′)=1, and msb(i)=1. This means that A′[i′]←A[i] always has or Coefficient permutation only occurs within the same half-block, that is, coefficient permutation always occurs in the first half-block. Between banks, Based on this characteristic, the present invention divides the polynomial automorphism mapping task into the first half coefficient replacement task and the second half coefficient replacement task, and performs two rounds of coefficient replacement tasks in a pipeline to time-share computing resources and cache resources, thereby reducing resource overhead.

[0093] 2) It can realize the recursive permutation of coefficients at the Bank granularity. When the coefficient storage area is divided into 2×fd granularity, for the coefficients in the storage area A′ located in Bank For all A′[i′], the source operand comes from Bank b in memory area A, where:

[0094]

[0095] Similarly, the coefficient storage area is divided with u×(2×fd) as the granularity, where is a power of 2, then:

[0096]

[0097] Therefore, from the perspective of obtaining source operands from each bank in A', source operand screening can be implemented in a divide-and-conquer manner. Based on this feature, the present invention uses a p×p banyan permutation network to implement recursive permutation of Bank granularity. Compared with the benes permutation network with the same bandwidth, the present invention can save the resources of a banyan permutation network.

[0098] 3) Perform coefficient replacement at the row granularity (Row granularity) and column granularity (Col granularity), that is, coefficient replacement within the Bank. For A′[i′] and A′[i′+1] (i′ is an even number), the source operand comes from Bankb, Rowr in storage area A, where:

[0099]

[0100] Therefore, on the basis of the Bank granularity coefficient replacement (as described in Feature 2), it is also necessary to replace the coefficients of the Row granularity and Col granularity within the Bank. Starting from the perspective of obtaining the source operand from Bankb' in A', calculate which row (denoted as r) of Bankb in A the source operand required by Rowr' comes from. At the same time, further determine which of A(b,r,0) and A(b,r,1) the source operands of A'(b′,r′,0) and A'(b′,r′,1) come from. Specifically, taking the even index i′ in Rowr' as a representative, calculate the source operand source index i, and then get and c = imod2. Let r be the read address of Bank b in a, and let c be the Col permute enable of the read data {A(b,r,0),A(b,r,1)}.

[0101] Based on this characteristic, the embodiment of the present invention designs a position index identifier (Tag) and a source data source identifier (Sel) reload unit (Tag and Sel reload unit). Under different polynomial degrees and rotation indices, the Tag of each Bank is calculated from the perspective of the source data in the Bank being needed, and a Tag Table is formed, which is subsequently used for generating the read address of the Bank. For example, the source data in Bank 0 and Bank 1 are respectively needed by Bank 3 and Bank 2 during this self-similar mapping process, so the Tags of Bank0 and Bank 1 are set to 3 and 2 respectively. At the same time, from the perspective of the Bank actively obtaining the source data, the Sel of each Bank is calculated to form a Sel Table, which is subsequently used for generating data selection signals at all levels of the replacement network. For example, during this self-similar mapping process, Bank 2 and Bank 3 need to obtain the source data in Bank 1 and Bank0 respectively, so the Sel of Bank 2 and Bank 3 is set to 1 and 0 respectively. In addition, the present invention designs a read address calculation unit, which generates a read enable and a read address for each Bank in the polynomial storage area according to the input polynomial degree, automorphism parameters and Tag Table, and provides a Col permutation enable for the read data for the permutation network.

[0102] In summary, the present invention constructs a vectorized automorphic mapping scheme in the NTT domain, which supports polynomial automorphic mappings with arbitrary rotation index k. Based on the vectorized automorphic mapping scheme in the NTT domain, the present invention proposes a self-morphic mapping hardware accelerator and acceleration method based on fully homomorphic encryption to efficiently realize polynomial self-morphic mapping in the NTT domain and avoid domain conversion overhead and bit reversal coefficient permutation overhead.

[0103] See also Figure 2The embodiment of the present application also provides an acceleration method of a self-isomorphic mapping hardware accelerator based on fully homomorphic encryption, which can realize the above-mentioned self-isomorphic mapping hardware accelerator based on fully homomorphic encryption, and the method includes the following steps:

[0104] S100, configure the polynomial degree and automorphism parameters, activate the Tag and Sel reload units, reload the position index identification register and the source data source identification register, and generate the value of the Tag Table register and the value of the Sel Table register;

[0105] S200, configuring the polynomial degree and the automorphism parameter, combining the value of the Tag Table register, activating the read address generation unit, and obtaining the first half area read enable signal, the second half area read enable signal, the half area read address signal and the Col granularity replacement enable signal;

[0106] S300, acquiring half-area read data, a first-half-area read data valid signal and a second-half-area read data valid signal from a polynomial storage area according to a first-half-area read enable signal, a second-half-area read enable signal and a half-area read address signal;

[0107] S400, filtering out a replacement network selection parameter from the Sel Table register according to the valid signal of the first half area read data and the valid signal of the second half area read data, combining the Col granularity replacement enable signal and the replacement network selection parameter, performing Col granularity replacement and Bank granularity recursive replacement on the half area read data, and obtaining a replacement result and a replacement result valid signal;

[0108] S500, writing the permutation result into the cache according to the permutation result valid signal, until all the permutation results are loaded into the cache, reading the permutation results from the cache in sequence, and writing them back to the corresponding half area of ​​the polynomial storage area, completing the automorphism mapping of the polynomial;

[0109] In summary, the acceleration method of the embodiment of the present invention is summarized as follows:

[0110] First, configure the polynomial degree n and automorphism parameters [5 k ] 2n , activate the Tag and Sel reload units, complete the reload of TagTable and Sel Table, and further configure the polynomial degree n and automorphism parameters [5 k ] 2n, activate the read address generation unit, obtain the half-block read address, the first half-block read enable signal and the second half-block read enable signal, and the Col granularity replacement enable signal of the read data pair, and then obtain the half-block read data, the first half-block read data valid signal, and the second half-block read data valid signal from the polynomial storage area according to the half-block read address, the first half-block read enable signal and the second half-block read enable signal. In the replacement network, according to the first half-block read data valid signal, the replacement network selection parameter is screened. According to the Col granularity replacement enable signal and the data selection signals at each level, the half-block read data is subjected to Col granularity replacement and Bank granularity recursive replacement to obtain the replacement result and the replacement result valid signal. Finally, according to the replacement result valid signal, the replacement result is written into the cache. After all the half-block replacement results are loaded into the cache, the replacement results are read out from the cache in sequence and written back to the corresponding half-block of the polynomial storage area. The result of the polynomial automorphism mapping will be stored in the polynomial storage area.

[0111] Therefore, the embodiments of the present invention have the following advantages:

[0112] 1) A vectorized automorphism mapping scheme in the NTT domain is constructed, which allows efficient polynomial automorphism mapping while avoiding the domain conversion overhead and the overhead of bit-reversal permutation coefficients, and reducing the computational burden of homomorphic rotations.

[0113] 2) The constructed scheme allows the present invention to use a simpler Banyan permutation network to implement recursive permutation of coefficients, which can save the resources of a Banyan permutation network compared to a Benes permutation network of the same bandwidth.

[0114] 3) The proposed automorphism mapping hardware acceleration architecture provides compile-time configurability and runtime configurability, and has higher scalability and flexibility. According to the architecture parallelism p configured at compile time and the maximum polynomial degree N to be supported, the corresponding hardware acceleration architecture can be generated to adapt to different resource constraints. After compilation, the actual polynomial degree n and automorphism parameters [5 k ] 2n , completing any automorphism mapping of polynomials.

[0115] It can be understood that the contents of the above method embodiments are all applicable to the present system embodiments, the functions specifically implemented by the present system embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0116] The preferred embodiments of the present invention are described above with reference to the accompanying drawings, but the scope of the rights of the present invention is not limited thereto. Any modification, equivalent substitution and improvement made by a person skilled in the art without departing from the scope and essence of the present invention should be within the scope of the rights of the present invention.

Claims

1. A self-isomorphic mapping hardware accelerator based on fully homomorphic encryption, characterized in that: The accelerator comprises a polynomial storage area, a Tag and Sel reload unit, a read address calculation unit, a permutation network and a cache unit, wherein a first output end of the Tag and Sel reload unit is connected to an input end of the read address calculation unit, a second output end of the Tag and Sel reload unit is connected to a first input end of the permutation network, a first output end of the read address calculation unit is connected to a first input end of the polynomial storage area, a second output end of the read address calculation unit is connected to a second input end of the permutation network, an output end of the polynomial storage area is connected to a third input end of the permutation network, an output end of the permutation network is connected to an input end of the cache unit, and an output end of the cache unit is connected to a second input end of the polynomial storage area, wherein: The Tag and Sel reload units are used to perform calculation reload according to the first unit activation signal, the running configurable polynomial degree and the automorphism parameters, and generate the value of the Tag Table register and the value of the Sel Table register; The read address calculation unit is used to calculate according to the second unit activation signal, the degree of the running configurable polynomial, the automorphism parameter and the value of the Tag Table register to generate a first half area read enable signal, a second half area read enable signal, a half area read address signal and a Col granularity replacement enable signal; The polynomial storage area is used to read data according to the first half area read enable signal, the second half area read enable signal and the half area read address signal, and generate the first half area read data valid signal, the second half area read data valid signal and the filtered half area read data; The replacement network is used to perform replacement according to the filtered half-area read data, the first half-area read data valid signal, the second half-area read data valid signal, the Col granularity replacement enable signal and the value of the Sel Table register to generate a replacement result and a replacement result valid signal; The cache unit is used to cache according to the permutation result, the permutation result valid signal and the running configurable polynomial degree, output the first half area write back enable signal, the second half area write back enable signal and the half area write back data and transmit them back to the polynomial storage area to complete the self-similar mapping of the polynomial.

2. The accelerator according to claim 1, characterized in that The compilation configurable architecture parallelism of the automorphism mapping hardware accelerator is p, the maximum polynomial degree of the automorphism mapping hardware accelerator is N, the running configurable polynomial degree of the automorphism mapping hardware accelerator is n, and the automorphism parameters of the automorphism mapping hardware accelerator are [5 k ] 2n .

3. The accelerator according to claim 1, characterized in that The Tag and Sel reload unit includes a first unit controller, a Tag computing core, a position index identification register and a source data source identification register, wherein the first output end of the first unit controller is connected to the input end of the Tag computing core, the second output end of the first unit controller is connected to the first input end of the position index identification register, the third output end of the first unit controller is connected to the first input end of the source data source identification register, the first output end of the Tag computing core is connected to the second input end of the position index identification register, and the second output end of the Tag computing core is connected to the second input end of the source data source identification register, wherein: The first unit controller is used to control the operation of the Tag calculation core, the location index identification register and the source data source identification register according to the first unit activation signal and the degree of the running configurable polynomial, and generate a first parameter signal, a first enable signal, a reloaded first enable signal and a reloaded second enable signal; The tag calculation core is used to obtain the first parameter signal, the first enable signal and the automorphic parameter and perform calculations to generate a position index identifier and a source data source identifier; The position index identification register is used to update the register value according to the reload first enable signal and the position index identification, and output the value of the Tag Table register; The source data origin identification register is used to update the register value according to the overloaded second enable signal and the source data origin identification, and output the value of the Sel Table register.

4. The accelerator according to claim 1, characterized in that The read address calculation unit includes a second unit controller and a read address calculation core, wherein the output end of the second unit controller is connected to the input end of the read address calculation core, wherein: The second unit controller is used to control the operation of the read address calculation core according to the second unit activation signal and the degree of the running configurable polynomial, and generate a second parameter signal, a second enable signal, the first half area read enable signal and the second half area read enable signal; The read address calculation core is used to perform calculations according to the second parameter signal, the second enable signal, the automorphic parameter and the value of the Tag Table register to generate the half-block read address signal and the Col granularity replacement enable signal.

5. The accelerator according to claim 1, characterized in that: The polynomial storage area includes a plurality of random access memories, and the plurality of random access memories are equally divided to obtain a polynomial storage first half area and a polynomial storage second half area, wherein: The polynomial storage first half area is used to read data according to the first half area read enable signal and the half area read address signal to generate the first half area read data valid signal; The polynomial storage second half area is used to read data according to the second half area read enable signal and the half area read address signal to generate the second half area read data valid signal; The first half area read data valid signal and the second half area read data valid signal are used as selection signals for half area read data for screening, and the screened half area read data is output.

6. The accelerator according to claim 5, characterized in that The polynomial storage area is composed of p Bank units, and the Bank unit includes at least one depth of The actual filling depth of the random access memory in the bank unit is 7. The accelerator according to claim 1, characterized in that The permutation network is a p×p banyan permutation network, with a total of log2p stages, each stage consisting of p 2-to-1 multiplexers, and pipeline registers inserted between stages.

8. The accelerator according to claim 1, characterized in that The cache unit includes a cache area and a third unit controller, and the output end of the third unit controller is connected to the input end of the cache area, wherein: The cache area is used to use the replacement result valid signal as a unified write enable signal of the cache and use the replacement result as write data of the cache group; The third unit controller is used to calculate the actual filling depth of several random access memories according to the degree of the running configurable polynomial, count the unified write enable signal of the cache, use the counter value as the unified write address of the cache to write the write data of the cache group, output the first half area write back enable signal, the second half area write back enable signal and the half area write back data and transmit them back to the polynomial storage area to complete the self-similar mapping of the polynomial.

9. The accelerator according to claim 8, characterized in that The total cache capacity of the cache unit is Include cache groups, each of which includes at least one cache group with a depth of of random access memory.

10. An acceleration method for a self-isomorphic mapping hardware accelerator based on fully homomorphic encryption, characterized in that: The method comprises the following steps: Configure the polynomial degree and automorphism parameters, activate the Tag and Sel reload units, reload the location index identification register and the source data source identification register, and generate the value of the Tag Table register and the value of the Sel Table register; Configure the polynomial degree and the automorphism parameter, combine the value of the Tag Table register, activate the read address generation unit, and obtain the first half area read enable signal, the second half area read enable signal, the half area read address signal and the Col granularity replacement enable signal; Acquire half-area read data, a first-half-area read data valid signal and a second-half-area read data valid signal from a polynomial storage area according to the first-half-area read enable signal, the second-half-area read enable signal and the half-area read address signal; Filtering a replacement network selection parameter from the SelTable register according to the valid signal of the first half area read data and the valid signal of the second half area read data, combining the Col granularity replacement enable signal with the replacement network selection parameter, performing Col granularity replacement and Bank granularity recursive replacement on the half area read data, and obtaining a replacement result and a replacement result valid signal; According to the permutation result valid signal, the permutation result is written into the cache, and after all the permutation results are loaded into the cache, the permutation results are read out from the cache in sequence and written back to the corresponding half area of ​​the polynomial storage area to complete the automorphism mapping of the polynomial.

Images