A hardware accelerator for key switching algorithm in CKKS homomorphic encryption algorithm
By designing a hardware accelerator to optimize the key switching operation of the CKKS homomorphic encryption algorithm, the problem of high key switching latency was solved, and more efficient computing performance was achieved.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-18
- Publication Date
- 2026-03-31
AI Technical Summary
The key switching operation in the CKKS homomorphic encryption algorithm has a high computational latency, especially since the key switching operation accounts for more than 90% of the total computational latency, becoming the main bottleneck of the algorithm's latency.
A hardware accelerator was designed, including NTT/INTT circuits and peripheral polynomial operation circuits. It adopts a new modulo reduction circuit, a rotation factor storage scheme and data flow design, and optimizes the butterfly operation core to reduce computational overhead and power consumption.
It effectively reduces circuit area and power consumption, improves the parallelism of key switching operations, reduces memory access times and total latency, and enhances computational efficiency.
Smart Images
Figure CN119766410B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of privacy computing and fully homomorphic encryption hardware acceleration technology, specifically relating to a hardware accelerator for the key switching algorithm in the CKKS homomorphic encryption algorithm. Background Technology
[0002] With the rapid development of information technology and the explosive growth of the digital economy globally, data has become an increasingly prominent new factor of production. Open sharing and efficient circulation of data have become key pathways to drive economic development and unleash productivity potential. However, data silos exist between data subjects, and even within data subjects themselves, due to data security issues, hindering effective data circulation and preventing the realization of data value. Therefore, how to meet the needs of data flow while protecting data privacy and preventing the leakage of sensitive information has become a major challenge in big data applications.
[0003] Homomorphic encryption (HE) is a special encryption technique that allows computation on encrypted data without decryption, and the result obtained after decryption is identical to the result of performing the same computation on the original data. Based on these characteristics, this technology has significant application value in fields such as cloud computing and privacy protection.
[0004] Homomorphic encryption algorithms introduce noise during encryption, but this noise continues to expand during ciphertext computation, eventually obscuring the valid information and making decryption impossible. To address this, cryptographers have proposed Fully Homomorphic Encryption (FHE) schemes, which use an operation called "bootstrapping" to continuously refresh the ciphertext noise, enabling arbitrary computations. Currently, several FHE algorithms have been proposed, among which the CKKS (Cheon-Kim-Kim-Song) algorithm, due to its support for floating-point operations and batch processing, boasts state-of-the-art computational efficiency and is widely used in privacy protection.
[0005] In the CKKS algorithm, the input information to be encrypted is a complex field vector, which can represent floating-point numbers or complex numbers. This information is first encoded into a polynomial over an integer ring (this polynomial is called plaintext) using batch encoding techniques, and then scaled to ensure precision. The polynomial plaintext is then encrypted into ciphertext, allowing for subsequent ciphertext operations. The decryption process involves first decrypting the ciphertext back into plaintext, and then decoding it into a readable message value.
[0006] However, the computation algorithm between ciphertexts is mathematically very complex, resulting in a still relatively high computational latency for the CKKS algorithm. Specific research shows that the key-switch operation accounts for over 90% of the total computational latency in the CKKS algorithm, making it the most significant bottleneck. Therefore, accelerating the key-switch operation is crucial for the further application of the CKKS algorithm.
[0007] Key switching primarily involves fast number-theoretic transforms and their inverse transforms (NTT and INTT) and point-valued modular arithmetic of polynomials, with NTT mainly comprising a butterfly kernel. In recent years, researchers have begun to focus on hardware accelerator design for this key switching operation to provide better acceleration. Summary of the Invention
[0008] To address the problems in the prior art, this invention proposes a hardware accelerator for the key switching algorithm in the CKKS homomorphic encryption algorithm.
[0009] The hardware accelerator for the key switching algorithm in the CKKS homomorphic encryption algorithm of the present invention includes an NTT / INTT circuit and a peripheral polynomial operation circuit.
[0010] The NTT / INTT circuit is used to implement the domain transformation of the polynomial. It includes multiple parallel butterfly operation cores, multiple on-chip memories for storing polynomial coefficients and a register group, and an NTT control module for generating memory addresses and controlling data flow. The peripheral polynomial operation circuit includes a point-value modular addition module, a point-value modular multiplication module, and a point-value modular subtraction module, each module being used to perform the corresponding point-value operation. The external input ciphertext and the external input modulus are processed by the hardware accelerator's INTT, NTT, polynomial point-value modular multiplication, modular addition, and modular subtraction to obtain the output ciphertext for the key switching operation.
[0011] The butterfly-shaped arithmetic core includes a storage array, a computation array, and peripheral digital circuitry; the storage array is used to store rotation factors, the computation array is used to calculate the partial product of the rotation factors and polynomial coefficients; the peripheral digital circuitry consists of a rotation factor write control circuit, an address decoding and address generation circuit, a shift addition circuit, and a modulo reduction circuit.
[0012] Compared with the prior art, the beneficial effects of the present invention are as follows:
[0013] (1) This invention proposes a new key switching algorithm accelerator architecture. Based on the designed NTT and finite state machine, it realizes highly parallel key switching operations and proposes a corresponding key switching algorithm data flow and pipeline architecture. This solves the problem of excessive storage overhead of full pipeline data flow caused by data dependency in other work and effectively reduces the circuit area and power consumption.
[0014] (2) This invention proposes a new modulus reduction scheme in a modulus reduction circuit, employing a form such as 2 32 -2 b ±2 c Modulo operations in the form of +1 only require addition, subtraction, and shifting operations, avoiding the more computationally expensive multiplication operations.
[0015] (3) This invention proposes a new NTT data flow design scheme in NTT / INTT circuits, which adopts a combination of horizontal and vertical data flow to reduce the number of intermediate data reads and writes, and adopts a reusable rotation factor storage scheme to reduce the number of memory accesses, effectively reducing the total delay and power consumption of NTT operations. Attached Figure Description
[0016] Figure 1 This is a schematic diagram of the overall architecture of the hardware accelerator for the key switching algorithm in the CKKS homomorphic encryption algorithm according to the present invention.
[0017] Figure 2 This is a schematic diagram of the overall architecture of the butterfly-shaped computing core;
[0018] Figure 3 This is a schematic diagram of the overall NTT circuit architecture;
[0019] Figure 4 A schematic diagram of an NTT rotation factor memory array with 512 points and a parallelism of 16.
[0020] Figure 5 This is a comprehensive schematic diagram of NTT's horizontal and vertical data stream processing.
[0021] Figure 6 A schematic diagram of the key switching process performed by the entire accelerator;
[0022] Figure 7 This is a schematic diagram of the key switching data stream. Detailed Implementation
[0023] The present invention will be further described and illustrated below with reference to specific embodiments. The embodiments described are merely examples of the content of this disclosure and do not limit the scope of the invention. The technical features of each embodiment in the present invention can be combined accordingly, provided that there is no mutual conflict.
[0024] Figure 1The overall architecture of the hardware accelerator (i.e., key switching circuit) of this invention includes an NTT / INTT circuit and a peripheral polynomial operation circuit. The NTT / INTT circuit is the core computation module of the key switching circuit, mainly used to implement polynomial domain transformations and accelerate polynomial multiplication calculation efficiency. The NTT / INTT circuit consists of multiple parallel butterfly operation cores, each responsible for performing butterfly operations. The peripheral polynomial operation circuit includes a point-value modular addition module, a point-value modular multiplication module, and a point-value modular subtraction module, each used to perform corresponding point-value operations. The external input ciphertexts C0 and C1 and the external input modulus P are processed by the key switching circuit using INTT, NTT, polynomial point-value modular multiplication, modular addition, and modular subtraction to obtain the output ciphertexts C′0 and C′1 of the key switching operation.
[0025] To facilitate understanding of this invention, the following embodiments describe the key switching circuit with parameters of 8192 polynomial coefficients N, a security level λ of 128 bits, and a multiplication depth of 6. Under these parameter settings, according to the CKKS algorithm requirements, the total modulus bit width Q is 218 bits, and the modulus q of the remainder polynomial after RNS decomposition is 32 bits. Therefore, the bit width of both input and output data is 32 bits. After comprehensively considering computational delay, area, and power consumption, the final parallelism (PARA) of the butterfly operation core was determined to be 128.
[0026] The design of the butterfly processing core, the NTT circuit data stream, and the overall key switching algorithm data stream will be introduced in turn.
[0027] Figure 2 The butterfly-shaped computing core architecture of this embodiment is divided into a memory array (i.e., Figure 2 The system consists of a rotation factor SRAM storage array, a computation array, and peripheral digital circuitry. The storage array stores the rotation factor, and the computation array calculates the partial product of the rotation factor and the polynomial coefficients. The peripheral digital circuitry comprises a rotation factor write control circuit, an address decoding and read address generation circuit, a shift-address circuit, and a modulo-reduction circuit.
[0028] Each butterfly calculation requires two polynomial coefficients, A and B, as input. Before the calculation, the corresponding twitch factor W is written into the storage array via a twitch factor write control circuit. Then, based on the address generated by the address decoding and read address generation circuits, the corresponding twitch factor W is read out and partially multiplied by the input polynomial B in the calculation array. Subsequently, the partial product result is processed by shift addition to obtain a 64-bit multiplication result of the twitch factor and the polynomial coefficients, i.e., B × W. This result is then reduced to 32 bits by a modulo reduction circuit and calculated with the other input polynomial A. Finally, the polynomial coefficient output results A + B·W mod q and AB·W mod q are obtained, completing one butterfly calculation, where q is the modulus.
[0029] In each butterfly calculation, a modulo reduction operation is required on the full-precision result output by the shift-add circuit, and this modulo reduction operation is the most complex part of the butterfly calculation. To optimize circuit overhead, this invention proposes a novel modulo reduction algorithm, the specific principle of which is as follows:
[0030] Since the modulus q used in this invention has a bit width of 32 bits, the range of q should be within 2^32 bits. 31 and 2 32 Therefore, in the modulo reduction algorithm of this invention, q = 2 is taken. 32 -2 b ±2 c +1, b and c are preset constants, that is:
[0031] 2 32 =2 b ±2 c -1 (mod q)
[0032] Let the input 64-bit subtrahend to be reduced be x, and let the high 32 bits of x be xi. high The lower 32 bits are x low We can obtain the modulo reduction formula:
[0033] x mod q=(x high ·2 32 +x low )mod q
[0034] =x high ·2 32 mod q+x low mod q
[0035] =x high ·(2 b ±2 c -1)+x low mod q
[0036] =x high <<b±xhigh <<cx high +x low mod q
[0037] Where, for x low mod q has:
[0038]
[0039] Therefore, the entire modulo reduction only requires a shift circuit, an adder, and a comparator, avoiding the computationally expensive multiplication operations found in traditional Montgomery and Barrett reductions, thus significantly improving computational efficiency.
[0040] NTT / INTT circuits can be built based on the butterfly-shaped computing core. For example... Figure 3 As shown, the NTT / INTT circuit designed in this invention includes 128 butterfly operation cores, 128 on-chip memories for storing polynomial coefficients and a register group, as well as an NTT control module for generating memory addresses and controlling data flow.
[0041] For an N-point NTT / INTT operation, where the coefficient length of a single input polynomial is N / 2, the operation can be divided into log2N levels of butterfly computation operations. In each level of butterfly computation, N / 2 butterfly cores perform N / 2 butterfly computations on the N coefficients from the two input polynomials. Each level of butterfly computation requires the result data to be obtained from a specific butterfly core in the previous level as input, leading to data dependencies when multiple butterfly computations are executed in parallel. As the number of levels increases, when the distance between dependent data exceeds the parallelism, the data must first be stored back in memory and then retrieved from memory to execute the next level of butterfly computation, resulting in significant memory access overhead.
[0042] To address this issue and reduce memory access overhead while improving operational efficiency, this invention proposes a novel NTT / INTT calculation process within the NTT / INTT circuit. This scheme divides the data flow into two parts: horizontal processing and vertical processing.
[0043] Lateral processing refers to the parallel processing of the first log2 PARA+1 levels of butterfly operations (PARA stands for parallelism) of NTT / INTT circuits. Within the log2 PARA+1 level butterfly operation, each level of butterfly operation core only needs to read the corresponding data from the register set, and the data is only written back to memory after the log2 PARA+1 level calculation is completed.
[0044] Vertical processing involves processing the remaining levels sequentially, level by level. In vertical processing, all butterfly cores process the same levels and access memory only before and after the butterfly computation.
[0045] In the s-th level butterfly calculation of NTT / INTT, the number of rotation factors is 2. s-1 And each rotation factor participates in N / 2 in this layer. s To reduce the number of twitch factor updates and lower power consumption, this invention proposes a novel reusable twitch factor storage scheme.
[0046] When the parallelism is PARA, the first log2 PARA+1 stages of butterfly computation in NTT / INTT are performed in a lateral processing manner. Therefore, the number of rotation factors in each stage of lateral processing does not exceed PARA. To simplify the access logic, this invention stores the rotation factors required for each stage of butterfly computation in lateral processing at the same depth of PARA memory arrays.
[0047] Figure 4 Taking an NTT / INTT array with 512 points and a parallelism of 16 as an example, a rotation factor storage array is given. In this case, the first five levels of butterfly computation are lateral processing. The rotation factor required for each level of butterfly computation is filled into the same depth of the storage array for each replication according to the exponent's magnitude. Therefore, the rotation factor required for lateral processing is stored at the first log2 PARA+1 depth of the PARA storage array (…). Figure 4 The middle part (D0-D4) is easy to control and process.
[0048] Vertical processing requires more rotation factors, so this invention employs a cross-level sharing method for storage. The rotation factors calculated in the last butterfly stage of NTT / INTT are stored after the horizontal processing rotation factors. Starting from row log2 PARA+1, rotation factors with even exponents are first stored in row N / (4PARA)-1, i.e. Figure 4 D5-D11 in the table. Then, the rotation factors with odd exponents are stored in the following N / (4PARA) rows, i.e. Figure 4 The SRAM array consists of D12-D19. Therefore, the depth of the memory array used in the butterfly operation core is N / (2PARA)+log2PARA. During the entire NTT / INTT calculation, the rotation factor stored in SRAM is updated only once. The SRAM only needs to be updated with a new rotation factor when the modulus is changed or the hardware is reconfigured to execute a new NTT / INTT.
[0049] Figure 5 A schematic diagram of the overall data flow of 16-point NTT / INTT with a parallelism of 2 designed according to the above scheme is given. The first and second level butterfly calculations adopt horizontal processing, while the third and fourth level butterfly calculations adopt vertical processing.
[0050] Based on the above NTT / INTT circuit, this invention proposes a new key switching accelerator architecture. Figure 1An architecture diagram has already been provided. The key switching method based on the aforementioned hardware accelerator of this invention includes the following steps:
[0051] 1) Perform NTT and INTT operations on the external input ciphertext C0.
[0052] 2) Point-wise multiplication (PWM) is performed on the NTT and INTT calculation results, in which the modulus reduction algorithm proposed in this invention is applied.
[0053] 3) Accumulate the results of point-value multiplication calculations.
[0054] 4) Perform NTT and INTT operations on the accumulated result.
[0055] 5) Perform subtraction, multiplication, and addition (SMA) operations with the external input modulus P to obtain the key switching results C′0 and C′1.
[0056] In one specific embodiment, such as Figure 6 As shown, the key switching accelerator architecture can be divided into two functional modules based on the different functions performed: modulus-to-digital conversion and modulus-to-digital conversion. These two modules have similar structures. For clarity, the corresponding parts of the specific key switching operations are numbered in the figure. The modulus chain length of each ciphertext in the figure is 4, which can be extended as needed in practical applications. At the same time, the key switching process performed by the entire accelerator can be decomposed into five steps, from operation (1) to operation (5).
[0057] Operation (1) involves modulo-increasing NTT and INTT, with the result of the INTT calculation stored in the INTT result register. The NTT module is equipped with a modular multiplier for NTT preprocessing and INTT postprocessing.
[0058] Operation (2) is a point-value multiplication, comprising four point-value multiplication units. Each multiplication unit contains a regular multiplier and a modular reduction unit. The modular reduction process applies the method proposed in this invention for modulo 2. 32 -2 b ±2 c +1 optimized modulo reduction algorithm.
[0059] Operation (3) is a polynomial accumulation, which includes several polynomial accumulation units and generates the accumulation result for the four polynomials stored in the result register of the point value multiplication unit.
[0060] Operation (4) is analog-to-digital switching between NTT and INTT, with a total of two NTT modules, specifically for NTT and INTT operations.
[0061] Operation (5) is polynomial subtraction, multiplication and addition (SMA), which is used to perform polynomial addition and subtraction and polynomial-digital modular multiplication in the final stage of the analog-to-digital switching, and finally obtain the key switching results C′0 and C′1.
[0062] This invention proposes a novel key switching algorithm data stream and pipeline architecture. Figure 7 A schematic diagram of the workflow data flow of this research is provided. In the data flow of this invention, in step 1, the four INTT modules respectively receive four remainder polynomials and perform INTT operations. Immediately afterwards, in step 2, NTT operations are performed on the INTT results. Then, in step 3, point-value multiplication is performed and the four results are accumulated. While performing point-value multiplication operations in steps 5 to 7, the INTT module in the modulus-to-digital switching stage is reused as an NTT module to perform NTT operations. The results of both operations are used as inputs to SMA, and finally, the output result of the key switching algorithm is obtained.
[0063] This invention addresses two data dependency issues present in existing fully parallel data paths. The first issue is that in existing architectures, the data stream overwrites the first remainder polynomial during the INTT operation on the second remainder polynomial, necessitating the use of additional storage resources. In contrast, this invention performs INTT operations on all four remainder polynomials simultaneously in step 1 and continuously saves the results until the entire key switching algorithm is complete, thus eliminating the need for additional storage of the input remainder polynomials. The second issue is that existing architectures require saving the results of point-value multiplication operations for multiple NTT cycles before performing SMA operations. In this invention, the results of point-value multiplication operations can directly participate in SMA operations without consuming additional storage space, thereby resolving the second data dependency issue.
[0064] The above-described embodiments are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. Those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention.
Claims
1. A hardware accelerator for a key-switching algorithm in a CKKS homomorphic encryption algorithm, characterized in that, The NTT / INTT circuit and the peripheral polynomial operation circuit, The NTT / INTT circuit is used for realizing domain transformation of a polynomial, and includes a plurality of parallel butterfly operation cores, a plurality of on-chip memories for storing polynomial coefficients and a register group, and an NTT control module for generating memory addresses and data flow control; the peripheral polynomial operation circuit includes a point value module addition module, a point value module multiplication module and a point value module subtraction module, each of which is used for performing a corresponding point value operation; after the INTT, NTT, polynomial point value module multiplication, module addition and module subtraction calculations of the hardware accelerator, the externally input ciphertext and the externally input modulus are calculated to obtain the output ciphertext of the key switching operation; The butterfly operation core includes a storage array, a calculation array and a peripheral digital circuit; The storage array is used for storing rotation factors, and the calculation array is used for calculating partial products of rotation factor and polynomial coefficient multiplication; the peripheral digital circuit is composed of a rotation factor write control circuit, an address decoding and read address generation circuit, a shift addition circuit and a modulus reduction circuit; In the butterfly operation core, two polynomial coefficients are needed as input for each butterfly calculation and Before the operation, the corresponding rotation factor is written into the storage array by the rotation factor write control circuit, then the corresponding rotation factor is read out according to the address generated by the address decoding and read address generation circuit, and then the partial product calculation is performed in the calculation array with the input polynomial ; subsequently, the partial product result will be subjected to shift-add calculation to obtain the 64-bit multiplication result of the rotation factor and the polynomial coefficient, i.e. , which is then reduced to 32 bits by the modulo reduction circuit and calculated with another input polynomial A to finally obtain the polynomial coefficient output result and , completing one butterfly calculation, wherein q is the modulus; The module number The module number , b, c are preset constants, that is, ； Let the input 64-bit subtrahend be... ,remember The high 32 bits are The lower 32 bits are This yields the modulo reduction formula: ； wherein, for there is: 。 2. The hardware accelerator of claim 1, wherein, The NTT / INTT circuit includes 128 butterfly operation cores, 128 on-chip memories for storing polynomial coefficients and a register group, and an NTT control module for generating memory addresses and data flow control.
3. The hardware accelerator of claim 1, wherein, The NTT / INTT circuit divides the NTT / INTT calculation process into two parts of horizontal processing and vertical processing; The front stage of the transversal processing, i.e. the parallel processing NTT / INTT circuit, is a butterfly operation wherein is the parallelism; in the butterfly operation of each stage, the butterfly operation core of each stage only needs to read the corresponding data from the register group, and the data is only written back to the memory after the stage calculation is completed; The vertical processing is a step-by-step sequential processing of the remaining levels, in the vertical processing, all butterfly operation cores process the same level, and only access the memory before and after the butterfly calculation.
4. The hardware accelerator of claim 3, wherein, The number of rotation factors for each stage in transversal processing is not more than The rotation factors required for the butterfly computation of each stage in transversal processing are stored in the same depth of the memory array.
5. The hardware accelerator according to claim 3 or 4, c h a r a c t e r i z e d by The vertical processing stores the rotation factors in a cross-level sharing manner, and the rotation factors of the last level butterfly calculation of the NTT / INTT circuit are stored after the rotation factors of the horizontal processing; from a location in the storage array at depth , the rotation factors of even index are first stored at depth to depth , and then the rotation factors of odd index are stored at the next Since the depths are numbered starting from 0, the total depth of the storage array used in the butterfly operation core is .