Hardware accelerator for key switching algorithm in CKKS homomorphic encryption algorithm

Abstract

The invention discloses a hardware accelerator for a key switching algorithm in a CKKS homomorphic encryption algorithm, and belongs to the field of privacy calculation and fully homomorphic encryption hardware acceleration. The hardware accelerator comprises an NTT / INTT circuit and a peripheral polynomial operation circuit, and the NTT / INTT circuit is used for achieving domain transformation of polynomials and comprises a plurality of parallel butterfly operation cores and an NTT control module for generating memory addresses and data flow control. The butterfly operation core comprises a storage array, a calculation array and a peripheral digital circuit; the storage array is used for storing twiddle factors, and the calculation array is used for calculating partial products of multiplication of the twiddle factors and polynomial coefficients. According to the hardware accelerator, highly parallel key switching operation can be realized, the problem of overhigh storage overhead of full-pipeline data streams caused by data dependence in other works is solved, and the area and power consumption of a circuit are effectively reduced.

Description

Technical Field

[0001] The present invention belongs to the technical field of privacy computing and fully homomorphic encryption hardware acceleration, and specifically relates to a hardware accelerator for a key switching algorithm in a CKKS homomorphic encryption algorithm. Background Art

[0002] With the rapid development of information technology, the digital economy has exploded around the world, and the status of data as a new production factor has become increasingly prominent. The open sharing and efficient circulation of data have become the key path to drive economic development and release productivity potential. However, due to data security issues, there are data islands between data subjects and even within data subjects, which leads to the inability to effectively circulate data and the difficulty in realizing the value of data. Therefore, how to protect data privacy and prevent the leakage of sensitive information while meeting the demand for data flow has become a major challenge in big data applications.

[0003] Homomorphic encryption (HE) is a special encryption technology that can perform calculations on encrypted data without decrypting the data, and the result obtained after decryption is the same as the result of the same calculation on the original data. Based on the above characteristics, this technology has important application value in cloud computing, privacy protection and other fields.

[0004] Homomorphic encryption algorithms introduce a certain amount of noise during encryption, but during the calculation process of the ciphertext, the noise will continue to expand until it obscures the valid information and cannot be correctly decrypted. In response to this, the cryptography community proposed a fully homomorphic encryption (FHE) scheme, which continuously refreshes the ciphertext noise through an operation called "bootstrapping" to support any number of operations. At present, the academic community has proposed a variety of fully homomorphic encryption algorithms, among which the CKKS (Cheon-Kim-Kim-Song) algorithm has the most advanced computing efficiency due to its support for floating-point operations and batch processing, and is widely used in the field of privacy protection.

[0005] In the CKKS algorithm, the input information to be encrypted is a complex domain vector, which can represent floating point numbers or complex numbers. The information is first encoded into a polynomial on an integer ring (the polynomial is called plaintext) through batch encoding technology, and scaled to ensure accuracy. The polynomial plaintext is then encrypted into ciphertext, and subsequent ciphertext operations can be performed. The decryption process is to first decrypt the ciphertext into plaintext, and then decode it into a readable message value.

[0006] However, the calculation algorithm between ciphertexts is very complicated in mathematical principle, which leads to the high calculation delay of CKKS algorithm. Specific research work shows that in the ciphertext calculation process of CKKS algorithm, the key switching operation accounts for more than 90% of the total calculation delay and is the main bottleneck of algorithm delay. Therefore, accelerating the key switching will be of great significance to the further application of CKKS algorithm.

[0007] Key switching mainly includes fast number theory transformation and its inverse transformation (NTT and INTT) and point value modular operation of polynomials, among which NTT mainly includes butterfly operation core. In recent years, researchers have begun to focus on the design of hardware accelerators for key switching operations to provide better acceleration effects. Summary of the invention

[0008] In order to solve the problems in the prior art, the present invention proposes a hardware accelerator for the key switching algorithm in the CKKS homomorphic encryption algorithm.

[0009] The hardware accelerator for the key switching algorithm in the CKKS homomorphic encryption algorithm of the present invention includes an NTT / INTT circuit and a peripheral polynomial operation circuit;

[0010] The NTT / INTT circuit is used to realize the domain transformation of polynomials, and includes multiple parallel butterfly operation cores, multiple on-chip memories and a register group for storing polynomial coefficients, and an NTT control module for generating memory addresses and data flow control; the peripheral polynomial operation circuit includes a point value modular addition module, a point value modular multiplication module and a point value modular subtraction module, each module is used to perform corresponding point value operations; the external input ciphertext and the external input modulus are calculated by the hardware accelerator's INTT, NTT, polynomial point value modular multiplication, modular addition, and modular subtraction to obtain the output ciphertext of the key switching operation;

[0011] The butterfly operation core includes a storage array, a calculation array and a peripheral digital circuit; the storage array is used to store rotation factors, and the calculation array is used to calculate the partial product of the multiplication of the rotation factors and the polynomial coefficients; the peripheral digital circuit consists of a rotation factor write control circuit, an address decoding and read address generation circuit, a shift addition circuit and a modular reduction circuit.

[0012] Compared with the prior art, the present invention has the following beneficial effects:

[0013] (1) The present invention proposes a new key switching algorithm accelerator architecture, which realizes highly parallel key switching operations based on the designed NTT and finite state machine, and proposes a corresponding key switching algorithm data flow and pipeline architecture, which solves the problem of excessive storage overhead of the full pipeline data flow caused by data dependency in other works, and effectively reduces the circuit area and power consumption.

[0014] (2) The present invention proposes a new modular reduction scheme in a modular reduction circuit, using a 2 32 –2 b ±2 c The modulus in the +1 form only requires addition, subtraction, and shift operations, avoiding multiplication operations that have higher computational overhead.

[0015] (3) The present invention proposes a new NTT data flow design scheme in the NTT / INTT circuit, which combines the horizontal data flow with the vertical data flow to reduce the number of read and write times of intermediate data, and adopts a reusable rotation factor storage scheme to reduce the number of memory accesses, thereby effectively reducing the total delay and power consumption of the NTT operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 It is a schematic diagram of the overall architecture of the hardware accelerator for the key switching algorithm in the CKKS homomorphic encryption algorithm of the present invention;

[0017] Figure 2 This is a schematic diagram of the overall architecture of the butterfly computing core;

[0018] Figure 3 This is a schematic diagram of the overall architecture of the NTT circuit;

[0019] Figure 4 Schematic diagram of a 512-point NTT rotation factor storage array with a parallelism of 16;

[0020] Figure 5 This is a comprehensive diagram of the horizontal and vertical processing of NTT data flows;

[0021] Figure 6 Schematic diagram of the key switching process performed by the entire accelerator;

[0022] Figure 7 This is a diagram of the key switching data flow. DETAILED DESCRIPTION

[0023] The present invention is further described and illustrated below in conjunction with specific embodiments. The embodiments are merely exemplary of the present disclosure and do not define the scope of limitation. The technical features of each embodiment of the present invention may be combined accordingly without conflicting with each other.

[0024] Figure 1The overall architecture of the hardware accelerator (i.e., key switching circuit) of the present invention includes an NTT / INTT circuit and a peripheral polynomial operation circuit. Among them, the NTT / INTT circuit is the core computing module of the key switching circuit, which is mainly used to realize the domain transformation of the polynomial and accelerate the efficiency of polynomial multiplication calculation. The NTT / INTT circuit is composed of multiple parallel butterfly operation cores, and each butterfly operation core is responsible for butterfly operation. The peripheral polynomial operation circuit includes a point value modular addition module, a point value modular multiplication module, and a point value modular subtraction module, which are respectively used to perform corresponding point value operations. The external input ciphertext (Ciphertext) C0, C1 and the external input modulus P are calculated by the INTT, NTT, polynomial point value modular multiplication, modular addition, and modular subtraction of the key switching circuit to obtain the output ciphertext C′0 and C′1 of the key switching operation.

[0025] To facilitate understanding of the present invention, the following embodiments are all based on the parameter settings of the number of polynomial coefficients N being 8192, the security level λ being 128 bits, and the multiplication depth being 6 to introduce the key switching circuit. Under this parameter setting, according to the requirements of the CKKS algorithm, the total modulus bit width Q required is 218 bits, and the modulus q bit width of the remainder polynomial after RNS decomposition is 32 bits, so the bit width of the input and output data is 32 bits. After comprehensive consideration of the calculation delay, area, and power consumption, it is finally determined that the degree of parallelism PARA (Degree of Parallelism) of the butterfly operation core is 128.

[0026] The designs of the butterfly operation core, the NTT circuit data flow and the overall key switching algorithm data flow will be introduced in turn below.

[0027] Figure 2 The butterfly computing core architecture of this embodiment is divided into a storage array (ie Figure 2 The storage array is used to store the twiddle factors, and the calculation array is used to calculate the partial product of the twiddle factors and the polynomial coefficients. The peripheral digital circuit consists of a twiddle factor write control circuit, an address decoding and read address generation circuit, a shift addition circuit, and a modular reduction circuit.

[0028] Each butterfly calculation requires the input of two polynomial coefficients A and B. Before the calculation, the corresponding rotation factor W needs to be written into the storage array through the rotation factor write control circuit. Then, according to the address generated by the address decoding and read address generation circuit, the corresponding rotation factor W is read out and the partial product is calculated with the input polynomial B in the calculation array. Subsequently, the partial product result will be calculated by shift addition to obtain the 64-bit multiplication result of the rotation factor and the polynomial coefficient, that is, B×W, and then reduced to 32 bits by the modular reduction circuit and calculated with another input polynomial A, and finally the polynomial coefficient output results A+B·Wmod q and AB·Wmod q are obtained, completing a butterfly calculation, where q is the modulus.

[0029] In each butterfly calculation process, a modular reduction operation needs to be performed on the full-precision result output by the shift-add circuit, and the modular reduction operation is the most complicated part of the butterfly calculation. In order to optimize the circuit overhead, the present invention proposes a new modular reduction algorithm, and the specific principle is as follows:

[0030] Since the modulus q used in the present invention has a bit width of 32 bits, that is, the range of q should be 2 31 and 2 32 Therefore, in the modular reduction algorithm of the present invention, q=2 32 -2 b ±2 c +1, b and c are preset constants, that is:

[0031] 2 32 =2 b ±2 c -1(mod q)

[0032] Let the input 64-bit number to be subtracted be x, and the high 32 bits of x be x high , the lower 32 bits are x low , we can get the modular reduction formula:

[0033] x mod q = (x high 2 32 +x low )mod q

[0034] =x high 2 32 mod q+x low mod q

[0035] =x high ·(2 b ±2 c -1)+x low mod q

[0036] =x high <<b±xhigh <<cx high +x low mod q

[0037] Among them, for x low mod q has:

[0038]

[0039] Therefore, the entire modular reduction only requires shift circuits, adders and comparators, avoiding the multiplication operations with higher computational overhead in traditional Montgomery reduction and Barrett reduction, and significantly improving computational efficiency.

[0040] NTT / INTT circuits can be built based on butterfly computing cores. Figure 3 As shown, the NTT / INTT circuit designed by the present invention includes 128 butterfly operation cores, 128 on-chip memories and a register group for storing polynomial coefficients, and an NTT control module for generating memory addresses and data flow control.

[0041] For N-point NTT / INTT operations, that is, when the length of a single input polynomial coefficient is N / 2, the operation process can be divided into log2N levels of butterfly calculation operations. In each level of butterfly operation, N / 2 butterfly operation cores will perform N / 2 butterfly calculations on a total of N coefficients from two input polynomials. Each level of butterfly calculation needs to obtain the result data from the specific butterfly operation core of the previous level as input, resulting in data dependency when multiple butterfly calculations are executed in parallel. As the number of levels increases, when the distance of the dependent data exceeds the degree of parallelism, the data must first be stored back to the memory, and then retrieved from the memory to execute the next level of butterfly calculation, resulting in a large amount of memory access overhead.

[0042] In order to reduce memory access overhead and improve operation efficiency, the present invention proposes a new NTT / INTT calculation process in the NTT / INTT circuit. The scheme divides the data flow into two parts: horizontal processing and vertical processing.

[0043] Horizontal processing is parallel processing of the first log2 PARA+1 level butterfly operations of the NTT / INTT circuit (PARA is the degree of parallelism). In the log2 PARA+1 level butterfly operation, the butterfly operation core of each level only needs to read the corresponding data from the register group, and the data will be written back to the memory only after the log2 PARA+1 level calculation is completed.

[0044] Vertical processing is to process the remaining levels sequentially one by one. In vertical processing, all butterfly cores process the same level and only access memory before and after the butterfly calculation.

[0045] In the s-th level butterfly calculation of NTT / INTT, the number of rotation factors is 2 s-1 , and each rotation factor participates in N / 2 in this layer s In order to reduce the number of rotation factor updates and reduce power consumption, the present invention proposes a new reusable rotation factor storage solution.

[0046] When the parallelism is PARA, the first log2 PARA+1 level butterfly calculation of NTT / INTT is performed in a horizontal processing manner, so the number of rotation factors of each level in the horizontal processing does not exceed PARA. To simplify the access logic, the present invention stores the rotation factors required for each level of butterfly calculation in the horizontal processing at the same depth of PARA storage arrays.

[0047] Figure 4 Taking NTT / INTT with 512 points and a parallelism of 16 as an example, the storage array of rotation factors is given. At this time, the first five levels of butterfly calculations are horizontal processing, and each copy of the rotation factors required for each level of butterfly calculation will be filled in the same depth of the storage array in sequence according to the high and low indexes. Therefore, the rotation factors required for horizontal processing are stored in the first log2 PARA+1 depth of PARA storage arrays ( Figure 4 D0-D4), easy to control and handle.

[0048] The vertical processing requires more rotation factors, so the present invention adopts a cross-level sharing method for storage. The rotation factors of the last level butterfly calculation of NTT / INTT will be stored after the horizontal processing rotation factors. Starting from the log2 PARA+1 row, the rotation factors with even exponents are first stored in the N / (4PARA)-1 row, that is, Figure 4 Then, the rotation factors with odd indices are stored in the next N / (4PARA) rows, i.e. Figure 4 D12-D19 in the butterfly core. Therefore, the depth of the memory array used in the butterfly core is N / (2PARA)+log2 PARA. The twiddle factors stored in SRAM are updated only once during the entire NTT / INTT calculation process. The SRAM needs to be updated with new twiddle factors only when the modulus is replaced or the hardware is reconfigured to perform a new NTT / INTT.

[0049] Figure 5 A schematic diagram of the overall data flow of 16-point NTT / INTT with a parallelism of 2 designed according to the above scheme is given. The first and second level butterfly calculations use horizontal processing, and the third and fourth level butterfly calculations use vertical processing.

[0050] Based on the above NTT / INTT circuit, the present invention proposes a new key switching accelerator architecture. Figure 1The architecture diagram has been given. The key switching method based on the hardware accelerator of the present invention comprises the following steps:

[0051] 1) Perform NTT and INTT operations on the external input ciphertext C0.

[0052] 2) Point-wise multiplication (PWM) is performed on the calculation results of NTT and INTT, wherein the modular reduction algorithm proposed in the present invention is applied.

[0053] 3) Accumulate the point value multiplication results.

[0054] 4) Perform NTT and INTT operations on the accumulated results.

[0055] 5) Perform subtraction, multiplication, and addition (SMA) operations with the external input modulus P to obtain the key switching results C′0 and C′1.

[0056] In a specific embodiment, Figure 6 As shown in the figure, the key switching accelerator architecture can be divided into two functional modules: modulus increase and modulus switching, according to the different execution functions. These two modules have similar structures. For the sake of clarity, the corresponding parts of the specific key switching operations are numbered in the figure. The modulus chain length of each ciphertext in the figure is 4, which can be expanded as needed in actual applications. At the same time, the key switching process performed by the entire accelerator can be decomposed into five steps from operation (1) to operation (5).

[0057] Operation (1) is the modulus rise of NTT and INTT, and the result of the INTT calculation is stored in the INTT result register. The NTT module is equipped with a modular multiplier for NTT pre-processing and INTT post-processing.

[0058] Operation (2) is point value multiplication, which includes four point value multiplication units. Each multiplication unit includes a common multiplier and a modular reduction unit. The modular reduction process applies the method proposed in the present invention for the modular form of 2. 32 -2 b ±2 c +1 for the optimized modular reduction algorithm.

[0059] Operation (3) is polynomial accumulation, which includes several polynomial accumulation units to generate accumulation results for four polynomials stored in the point value multiplication unit result register.

[0060] Operation (4) is analog-to-digital switching NTT and INTT, with two NTT modules specifically used for NTT and INTT operations.

[0061] Operation (5) is polynomial subtraction, multiplication and addition (SMA), which is used to perform polynomial addition and subtraction and modular multiplication of polynomial and digital in the final stage of modular switching, and finally obtain key switching results C′0 and C′1.

[0062] The present invention proposes a new key switching algorithm data flow and pipeline architecture. Figure 7 A schematic diagram of the data flow of the workflow of this study is given. In the data flow of the present invention, the four INTT modules in step 1 receive four remainder polynomials respectively to perform INTT operations, and then perform NTT operations on the INTT results in step 2, and then perform point value multiplication operations in step 3 and accumulate the four results. While performing point value multiplication operations in steps 5 to 7, the INTT module in the modulus switching stage is reused as an NTT module to perform NTT operations, and the results of both operations are simultaneously used as the input of SMA, and finally the output result of the key switching algorithm is obtained.

[0063] The present invention solves two data dependency problems existing in the existing fully parallel data paths. The first data dependency problem is that the existing architecture data flow will overwrite the first remainder polynomial when the second remainder polynomial is subjected to INTT operation, resulting in the need to use an extra storage resource, while the data flow of the present invention simultaneously performs INTT operation on four remainder polynomials in step 1 and continuously saves the result until the entire key switching algorithm is executed, so there is no need to perform additional storage for the input remainder polynomial. The second data dependency problem is that the point value multiplication operation result of the existing architecture data flow needs to be saved for multiple NTT cycles before the SMA operation can be performed, while the result of the point value multiplication operation in the present invention can directly participate in the SMA operation without consuming additional storage space, thereby solving the second data dependency problem.

[0064] The above-mentioned embodiments only express several implementation methods of the present invention, and the description is relatively specific and detailed, but it cannot be understood as limiting the scope of the present invention. For ordinary technicians in this field, several modifications and improvements can be made without departing from the concept of the present invention, which all belong to the protection scope of the present invention.

Claims

1. A hardware accelerator for the key switching algorithm in the CKKS homomorphic encryption algorithm, characterized in that: Including NTT / INTT circuit and peripheral polynomial operation circuit, The NTT / INTT circuit is used to realize the domain transformation of polynomials, and includes multiple parallel butterfly operation cores, multiple on-chip memories and a register group for storing polynomial coefficients, and an NTT control module for generating memory addresses and data flow control; the peripheral polynomial operation circuit includes a point value modular addition module, a point value modular multiplication module and a point value modular subtraction module, each module is used to perform corresponding point value operations; the external input ciphertext and the external input modulus are calculated by the hardware accelerator's INTT, NTT, polynomial point value modular multiplication, modular addition, and modular subtraction to obtain the output ciphertext of the key switching operation; The butterfly computing core includes a storage array, a computing array and a peripheral digital circuit; The storage array is used to store the rotation factors, and the calculation array is used to calculate the partial product of the multiplication of the rotation factors and the polynomial coefficients; the peripheral digital circuit is composed of a rotation factor write control circuit, an address decoding and read address generation circuit, a shift addition circuit and a modular reduction circuit.

2. The hardware accelerator according to claim 1, characterized in that: In the butterfly operation core, for each butterfly calculation process, two polynomial coefficients A and B need to be input. Before the operation, the corresponding rotation factor W is written into the storage array through the rotation factor write control circuit. Then, according to the address generated by the address decoding and read address generation circuit, the corresponding rotation factor W is read out, and a partial product calculation is performed on it and the input polynomial B in the calculation array; then, the partial product result is subjected to shift addition calculation to obtain a 64-bit multiplication result of the rotation factor and the polynomial coefficient, that is, B×W, and then it is reduced to 32 bits through the modular reduction circuit and calculated with another input polynomial A, and finally the polynomial coefficient output results A+B·Wmodq and AB·Wmod q are obtained, completing a butterfly calculation, wherein q is the modulus.

3. The hardware accelerator according to claim 2, characterized in that: The bit width of the modulus q is 32 bits. When the modulus reduction circuit performs the modulus reduction algorithm, q=2 32 -2 b ±2 c +1, b and c are preset constants, that is: 2 32 =2 b ±2 c -1(mod q) Let the input 64-bit number to be subtracted be x, and the high 32 bits of x be x high , the lower 32 bits are x low , we get the modular reduction formula: x mod q=(x high ·2 32 +x low )mod q =x high ·2 32 mod q+x low mod q =x high ·(2 b ±2 c -1)+x low mod q =x high <<b±x high <<c-x high +x low mod q Among them, for x low mod q has:

4. The hardware accelerator according to claim 1, characterized in that: The NTT / INTT circuit includes 128 butterfly operation cores, 128 on-chip memories and a register group for storing polynomial coefficients, and an NTT control module for generating memory addresses and data flow control.

5. The hardware accelerator according to claim 1, characterized in that: The NTT / INTT circuit divides the NTT / INTT calculation process into two parts: horizontal processing and vertical processing; Horizontal processing is parallel processing of the first log2 PARA+1 level butterfly operations of the NTT / INTT circuit, where PARA is the degree of parallelism. Within the log2 PARA+1 level butterfly operation, the butterfly operation core of each level only needs to read the corresponding data from the register group, and the data will be written back to the memory only after the log2 PARA+1 level calculation is completed. Vertical processing means processing the remaining levels sequentially step by step. In vertical processing, all butterfly cores process the same level and only access memory before and after the butterfly calculation.

6. The hardware accelerator according to claim 5, characterized in that: The number of rotation factors at each level in the horizontal processing does not exceed PARA, and the rotation factors required for the butterfly calculation at each level of the horizontal processing are stored in the same depth of PARA storage arrays.

7. The hardware accelerator according to claim 5 or 6, characterized in that: The vertical processing adopts a cross-level sharing manner to store the rotation factors. The rotation factors calculated by the last level butterfly of the NTT / INTT circuit will be stored after the horizontal processing rotation factors; starting from the position with a depth of log2 PARA+1 in the storage array, the rotation factors with even indices are first stored at a depth of log2 PARA+1 to a depth of log2 PARA+N / (4PARA)-1, and then the rotation factors with odd indices are stored at the next depth of log2 PARA+N / (4PARA) to a depth of log2 PARA+N / (2PARA)-1. Since the depth is numbered from 0, the total depth of the storage array used in the butterfly operation core is log2 PARA+N / (2PARA).

Images