Ciphertext level parallel method and system for fully homomorphic encryption application

Abstract

The invention discloses a fully homomorphic encryption application-oriented ciphertext level parallelization method, which comprises the following steps of: for fully homomorphic encryption FHE ciphertext vectors corresponding to ciphertexts, specifying initial cavitation bubble positions in the FHE vectors corresponding to input ciphertexts and output ciphertexts by utilizing a specific field computer language; analyzing and tracking the dynamically changing cavitation bubble position corresponding to each ciphertext by using the data stream, and confirming the final cavitation bubble position of the ciphertext; the operation sequence of the ciphertext is fused to the maximum extent by adopting a global fusion strategy, a plurality of ciphertext vectors are packaged into an integral FHE vector by utilizing cavitation bubble positions in the FHE ciphertext vectors, and the maximum profitability of ciphertext level parallelism is obtained. The invention provides an accurate analysis method, and the cavitation positions of all ciphertexts are automatically analyzed to ensure the legality of ciphertext level parallelism and the profitability of ciphertext level parallelism.

Description

Technical Field

[0001] This application relates to the field of fully homomorphic encryption compilation optimization and ciphertext-level parallelism, and particularly to a ciphertext-level parallel method and system for fully homomorphic encryption applications. Background Art

[0002] Fully homomorphic encryption (FHE) is an emerging encryption scheme that allows computations to be performed on encrypted data without first decrypting it. This property enables applications to be securely offloaded to untrusted cloud servers. FHE schemes such as TFHE only support boolean operations, while BGV / BFV, GSW, and FHEW support integer operations. The recent CKKS and RNS-CKKS schemes have enabled floating-point operations by scaling floating-point representations to integers, enhancing the practicality of FHE in machine learning. Despite these advancements, the speed of encrypted computations remains very slow, typically around 10,000 times slower than unencrypted computations on a CPU.

[0003] To improve the performance of FHE applications, the CKKS and RNS-CKKS schemes provide plaintext-level parallelism techniques at the algorithmic level, which support encoding n floating-point numbers (n = N / 2, where N is the degree of the polynomial ring, usually sized between 2^12 and 2^17) into an FHE vector for encryption. Homomorphic operations on the encrypted ciphertext are equivalent to operating on n floating-point numbers simultaneously, thereby improving the performance of FHE applications. Current FHE compilers such as ANT-ACE, CHET, and EVA all utilize plaintext-level parallelism techniques to optimize FHE programs.

[0004] Although plaintext-level parallelism techniques improve the performance of FHE to some extent, it is often difficult to fully utilize an FHE vector of length n, resulting in a large number of bubbles in the FHE vector. These bubbles are typically caused by homomorphic reduction and the inability of input ciphertexts to pack enough floating-point numbers. These bubbles waste a large amount of computing resources, and plaintext-level parallelism alone cannot solve this limitation because during the homomorphic computation of FHE, intermediate ciphertexts cannot be decrypted and repacked into their FHE vectors.

[0005] Therefore, there is an urgent need to propose an accurate analysis method that can automatically analyze the positions of all ciphertext bubbles to ensure the legality of ciphertext-level parallelism. In addition, since ciphertexts must be processed as a whole, expensive rotation operations are usually required to avoid conflicts, which necessitates a detailed cost-benefit analysis to ensure the profitability of ciphertext-level parallelism. Summary of the Invention

[0006] To solve the problems of the correctness and profitability of ciphertext fusion in ciphertext-level parallelism in the above-mentioned prior art, the present invention proposes a ciphertext-level parallel method for fully homomorphic encryption applications.

[0007] In a first aspect, an embodiment of the present application provides a ciphertext-level parallel method for fully homomorphic encryption applications. The method includes:

[0008] For the fully homomorphic encryption (FHE) ciphertext vector corresponding to the ciphertext, use a domain-specific language (DSL) to specify the initial bubble positions in the FHE vectors corresponding to the input ciphertext and the output ciphertext.

[0009] Use data flow analysis to track the dynamically changing bubble positions corresponding to each ciphertext and confirm the final bubble positions of the ciphertext.

[0010] Adopt a global fusion strategy to maximize the fusion of the operation sequences of the ciphertexts. By using the bubble positions in the FHE ciphertext vector, pack multiple ciphertext vectors into an overall FHE vector to obtain the maximum profitability of ciphertext-level parallelism.

[0011] In a specific embodiment of the present invention, for the fully homomorphic encryption (FHE) ciphertext vector corresponding to the ciphertext, using a domain-specific computer language to specify the initial bubble positions in the FHE vectors corresponding to the input ciphertext and the output ciphertext, the steps further include:

[0012] Through multiple tensor attributes of the FHE vector, use a domain-specific language (DSL) to specify the zero-valued bubble positions of the input ciphertext and the non-zero-valued bubble positions of the output ciphertext; wherein, the tensor attributes include: Layout attribute, ValidSlots attribute, and Offset attribute.

[0013] In a specific embodiment of the present invention, for the step of using data flow analysis to track the dynamically changing bubble positions corresponding to each ciphertext and confirm the final bubble positions of the ciphertext, the steps further include:

[0014] Use forward data flow analysis to analyze the positions of zero-valued bubbles in all ciphertexts; use a forward data flow analysis to traverse all homomorphic operations in the execution order, and apply derivation rules to each homomorphic operation to derive the final positions of zero-valued bubbles.

[0015] Use backward data flow analysis to analyze the positions of non-zero-valued bubbles in all ciphertexts; use a backward data flow analysis algorithm to traverse all homomorphic operations through the chain, and apply derivation rules to each homomorphic operation to derive the final positions of non-zero-valued bubbles.

[0016] For the same ciphertext, perform a bitwise AND operation on the bubble position analysis results of the forward data flow analysis and the backward data flow analysis to obtain the final bubble position analysis result.

[0017] In a specific embodiment of the present invention, for the step of using data flow analysis to track the dynamically changing bubble positions corresponding to each ciphertext and confirm the final bubble positions of the ciphertext, the steps further include:

[0018] Check the correctness of ciphertext-level parallelism while ensuring program data dependencies; adopt a combination of multiple types of homomorphic transformations so that the ciphertext can be fused under the combination of homomorphic transformations. The requirement is that the valid values in each ciphertext are retained and maintained at different positions in the final fused ciphertext. Among them, the multiple homomorphic transformations include: rotation, multiplication and addition of ciphertext and plaintext for masking.

[0019] In a specific embodiment of the present invention, the above-mentioned global fusion strategy is adopted to maximize the operation sequence before the fusion ciphertext is recombined. By using the bubble positions in the FHE ciphertext vector, multiple ciphertext vectors are packed into an overall FHE vector to obtain the maximum profitability of ciphertext-level parallelism. The steps include:

[0020] Decompose the operation sequence before the fusion ciphertext is maximally recombined;

[0021] By sequentially processing the FHE loops in the intermediate representation of the compiler to select the fusion plan, after reaching the last loop, the optimal plan is selected from the remaining plans according to the preset cost model to obtain the maximum profitability of ciphertext-level parallelism.

[0022] In a specific embodiment of the present invention, the above-mentioned step of selecting the fusion plan by sequentially processing the FHE loops in the intermediate representation of the compiler further includes:

[0023] Starting from the first loop, generate two plans, including: a plan to maximize the current loop benefit, and a plan to minimize the ciphertext decomposition overhead outside the current loop;

[0024] According to the preset cost model, evaluate the plans in all loops and abandon any plan with a negative benefit in the current loop;

[0025] If a plan is abandoned and no plan has been generated in the current loop, at most two new plans will be created for the current loop. After reaching the last loop, the optimal plan is selected from the remaining plans according to the cost model.

[0026] In a specific embodiment of the present invention, before the above-mentioned step of using data flow analysis to track the dynamically changing bubble positions corresponding to each ciphertext and confirm the final bubble positions of the ciphertext, it further includes:

[0027] Automatically convert the bubble positions represented by the domain-specific language DSL into a bitmap form, where 0 represents that the position is a bubble and 1 represents that the position is a valid value; and standardize the form of each homomorphic operation to include: a first data source, a second data source, and multiple types of homomorphic operations between the first data source and the second data source. Among them, the first data source is a ciphertext, the second data source is a ciphertext or a plaintext, and the plaintext may be a scalar or a vector. The multiple homomorphic operations include addition, multiplication, and rotation.

[0028] In a second aspect, an embodiment of the present application provides a ciphertext-level parallel system for fully homomorphic encryption applications. Using the ciphertext-level parallel method for fully homomorphic encryption applications as described above, the system includes:

[0029] Bubble position specifying module: For the fully homomorphic encryption (FHE) ciphertext vector corresponding to the ciphertext, use a domain-specific computer language to specify the initial bubble positions in the FHE vectors corresponding to the input ciphertext and the output ciphertext;

[0030] Bubble position tracking module: Use data flow analysis to track the dynamically changing bubble positions corresponding to each ciphertext and confirm the final bubble positions of the ciphertext;

[0031] Ciphertext parallel module: Use a global fusion strategy to maximize the fusion of the operation sequences of the ciphertexts. By using the bubble positions in the FHE ciphertext vectors, pack multiple ciphertext vectors into an overall FHE vector to obtain the maximum profitability of ciphertext-level parallelism.

[0032] In a third aspect, an embodiment of the present application provides a computer-readable storage medium with a computer program stored thereon. When the program is executed by a processor, it implements the steps of the ciphertext-level parallel method for fully homomorphic encryption applications.

[0033] In a fourth aspect, an embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, it implements the steps of the ciphertext-level parallel method for fully homomorphic encryption applications as described above.

[0034] Compared with the related prior art, it has the following outstanding beneficial effects:

[0035] 1) The method of the present invention proposes to use DSL to specify the bubbles in the input and output ciphertexts. The present invention proposes a set of DSL to facilitate users to specify the bubble positions in the FHE vectors corresponding to the input ciphertext and the output ciphertext;

[0036] 2) The method of the present invention proposes to use data flow analysis to accurately track the bubble positions corresponding to each ciphertext to ensure the correctness of ciphertext fusion;

[0037] 3) The method of the present invention uses a global fusion strategy to improve the profitability of ciphertext-level parallelism; To improve the profitability of ciphertext-level parallelism, the present invention adopts a global fusion strategy to maximize the operation sequence before ciphertext recombination to reduce expensive recombination operations (homomorphic rotation, homomorphic multiplication for masking), thereby improving the profitability of ciphertext-level parallelism. Description of the Drawings

[0038] The accompanying drawings described herein are used to provide a further understanding of the present application, and constitute a part of the present application. The schematic embodiments of the present application and their descriptions are used to explain the present application, and do not constitute an improper limitation of the present application. In the drawings:

[0039] Figure 1 It is a schematic diagram of the dynamically changing cavitation position of the present invention;

[0040] Figure 2 It is a schematic diagram of the ciphertext-level parallel method of the present invention for fully homomorphic encryption applications;

[0041] Figure 3 It is a schematic diagram of the DSL grammar representing cavitation of the present invention;

[0042] Figure 4a It is two layout schematic diagrams in the cavitation representation of the FHE4*8 matrix of the present invention;

[0043] Figure 4b For the present invention Figure 4a It is a schematic diagram of three cavitation patterns in row-major order;

[0044] Figure 5 It is a schematic diagram of the derivation rule of the zero-valued cavitation of the present invention;

[0045] Figure 6 It is a schematic diagram of the derivation rule of the non-zero-valued cavitation of the present invention;

[0046] Figure 7 It is a schematic diagram of the ciphertext-level parallel system of the present invention for fully homomorphic encryption applications;

[0047] Figure 8 It is a schematic diagram of the computer hardware of the present invention. Detailed implementation manners

[0048] In the present invention, "at least one" means one or more, and "a plurality" means two or more. "At least one of the following" or its similar expressions refer to any combination of these items, including any combination of single item (s) or plural items (s). For example, at least one of a, b, or c can represent: a, b, c, a - b, a - c, b - c, or a - b - c, where a, b, c can be single or multiple.

[0049] It should also be understood that the term "and / or" in this text is merely a description of the relationship between associated objects, indicating that three relationships can exist. For example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone. Here, A and B can be singular or plural. Additionally, the character " / " in this text generally represents an "or" relationship between the associated objects before and after, but it may also represent an "and / or" relationship. The specific meaning can be understood by referring to the context before and after.

[0050] It should also be understood that in various embodiments of the present invention, the magnitudes of the sequence numbers of the above processes do not imply the order of execution. The order of execution of each process should be determined by its function and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.

[0051] In several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the displayed or discussed couplings or direct couplings or communication connections to each other can be through some interfaces. The indirect couplings or communication connections of the devices or units can be in electrical, mechanical, or other forms.

[0052] The units described as separate components may or may not be physically separated. The components displayed as units may or may not be physical units, that is, they can be located in one place or distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0053] In addition, in each embodiment of the present invention, the functional units can be integrated in one processing unit, or each unit can exist physically alone, or two or more units can be integrated in one unit.

[0054] When the above-mentioned function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical discs that can store program codes.

[0055] To make the above features and effects of the present invention more clearly and understandably described, specific embodiments are hereinafter given and will be described in detail in conjunction with the accompanying drawings of the specification. This specification discloses one or more embodiments including the features of the present invention. The disclosed embodiments are only for illustrative purposes. The protection scope of the present invention is not limited to the disclosed embodiments, and the present invention is defined by the appended claims.

[0056] The following is a system embodiment corresponding to the above method embodiment, and this embodiment can be implemented in cooperation with the above embodiment. The relevant technical details mentioned in the above embodiment are still valid in this embodiment, and in order to avoid repetition, they will not be elaborated here. Correspondingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiment.

[0057] The method of the present invention aims to propose an accurate analysis method to automatically analyze the bubble positions of all ciphertexts to ensure the legality of ciphertext-level parallelism. In addition, since the ciphertext must be processed as a whole, expensive rotation operations usually need to be introduced to avoid conflicts, which requires a detailed cost-benefit analysis to ensure the profitability of ciphertext-level parallelism.

[0058] The method of the present invention can solve the problems of the correctness and profitability of ciphertext fusion in ciphertext-level parallelism. To maintain correctness during the ciphertext fusion process, it is necessary to ensure that the non-bubble positions in the FHE vectors of the candidate ciphertexts do not conflict during the fusion process. However, as Figure 1 shown, the bubble positions in the ciphertext vector change dynamically during the program execution, and it is difficult for users to specify the bubble positions of all ciphertexts;

[0059] According to the bubble positions specified by the user through DSL, the present invention traverses all homomorphic operations using a forward and a backward data flow analysis to analyze the bubble positions of the FHE vectors corresponding to all ciphertexts. Specifically, the forward data flow analysis starts from the input ciphertext to analyze all zero-valued bubbles, and the backward data flow analysis starts from the output ciphertext to analyze all non-zero-valued bubbles. The intersection of the two analysis results for the same ciphertext is the final bubble position of the ciphertext. When fusing ciphertexts, it is only necessary to ensure that the values of non-bubble positions are not changed in the fused ciphertext according to the analysis results to ensure the correctness of ciphertext fusion.

[0060] To reduce the bubbles in the FHE vector, the present invention discovers that if the FHE vector corresponding to a ciphertext is regarded as a whole and multiple ciphertext vectors are packed together using the bubbles in the FHE vector, another dimension of data parallelism, i.e., ciphertext-level parallelism, can be achieved. This parallel technology effectively reduces the bubbles in the FHE vector and thus improves the performance of FHE applications. However, the correctness and profitability of this technology depend on the dynamically changing bubble positions in the FHE vector. To maintain the correctness and profitability of ciphertext-level parallelism, the present invention uses DSL (abbreviation for Domain-Specific Language) to specify the bubbles in the input and output ciphertexts, monitors the homomorphic operations on each program execution path through data flow analysis, and thus accurately tracks the status (whether there is a bubble) of each slot in the FHE vector of all intermediate ciphertexts. In terms of reducing bubbles, the present invention can not only ensure the legality of ciphertext fusion, but also design a profitable parallel scheme through cost-benefit analysis considering the costs of homomorphic operations and plaintext encoding.

[0061] The operating environment in the specific embodiment of the present invention is as follows:

[0062] The present invention implements ciphertext-level parallelism based on EVA and finally descends to the operators in the SEAL library. Therefore, it is necessary to install the EVA compiler and the SEAL library above version 3.6. In addition, since the FHE operators require a large amount of memory overhead, the hardware running the present invention requires at least 128GB of memory.

[0063] Embodiment 1

[0064] As Figure 2 shown, the embodiment of the present application provides a ciphertext-level parallel method for fully homomorphic encryption applications. The method includes:

[0065] Step 101, for the fully homomorphic encryption FHE ciphertext vector corresponding to the ciphertext, use a domain-specific computer language to specify the initial bubble positions in the FHE vectors corresponding to the input ciphertext and the output ciphertext;

[0066] Step 102: Use data flow analysis to track the dynamically changing bubble positions corresponding to each ciphertext and confirm the final bubble positions of the ciphertexts.

[0067] Step 103: Adopt a global fusion strategy to maximize the fusion of the operation sequences of the ciphertexts. By using the bubble positions in the FHE ciphertext vectors, pack multiple ciphertext vectors into an overall FHE vector to obtain the maximum profitability of ciphertext-level parallelism.

[0068] In a specific embodiment of the present invention, the above step 101 includes:

[0069] Through multiple tensor attributes of the FHE vector, use the domain-specific language DSL to specify the zero-valued bubble positions of the input ciphertext and the non-zero-valued bubble positions of the output ciphertext; wherein, the tensor attributes include: Layout attribute, ValidSlots attribute, and Offset attribute.

[0070] In a specific embodiment of the present invention, use DSL to represent the zero-valued bubbles of the input ciphertext and the non-zero-valued bubbles of the output ciphertext. As Figure 3 shown, representing an n-dimensional tensor by an FHE vector includes the following three attributes: {Layout}, {ValidSlots}, and {Offset}.

[0071] {Layout}: To pack the elements in an n-dimensional plaintext tensor A into the FHE vector, this field specifies their positions with n comma-separated items from the 1st dimension to the nth dimension, and the format of each item is elms:stride. The i-th item details the number of elements (elms) in the i-th dimension and their placement stride (stride). For example, as Figure 4a shown, the row-major representation of a 4×8 matrix is {8:1,4:8}, and the elements are arranged with strides of 1 and 8. The column-major matrix {8:4,4:1} can be represented in a similar way.

[0072] {ValidSlots}: This field is used to specify the valid values of A in a given {Layout}, listing n items from the 1st dimension to the nth dimension. Each item can be defined in one of the following three ways.

[0073] ■ Unit. Each dimension uses the elms:stride format to represent the number of valid values in that dimension and their stride. In Figure 4b it, the first bubble pattern is shown as {4:2,2:16}, with 4 valid slots per row and 2 valid slots per column, arranged with strides of 2 and 16 respectively.

[0074] ■Nest. The nested mode describes the bubble mode according to the grouping mode. First, the bubble mode of each group is specified, followed by the number of groups and the step size. For Figure 4b the second mode in

[0075] its row sub-pattern is (2:1, 2:4), with 2 valid slots shown in each group, a step size of 1, and two groups arranged with a step size of 4. Figure 4b The third mode in

[0076] {Offset} field represents the offset of the position of the first valid value among the valid values specified by {ValidSlots}, and the default value is 0.

[0077] In the specific embodiment of the present invention, before the above step 102, it further includes:

[0078] Automatically convert the bubble positions represented by the domain-specific language (DSL) into a bitmap form, where 0 represents that the position is a bubble, and 1 represents that the position is a valid value; and standardize the form of each homomorphic operation to include: a first data source, a second data source, and various types of homomorphic operations between the first data source and the second data source. Among them, the first data source is a ciphertext, the second data source is a ciphertext or a plaintext, and the plaintext may be a scalar or a vector. The various types of homomorphic operations include addition, multiplication, and rotation.

[0079] In the specific embodiment of the present invention, the compiler automatically converts the bubble positions represented by the domain-specific language (DSL) into the form of a bitmap for convenient subsequent analysis. Among them, 0 represents that the position is a bubble, and 1 represents that the position is a valid value. In addition, each homomorphic operation will be automatically standardized into the form of, where <src 1 > is a ciphertext, is a ciphertext or a plaintext, and the plaintext may be a scalar or a vector, <op>May include four homomorphic operations: {+, ×, <<, >>}.

[0080] In a specific embodiment of the present invention, step 102 further includes:

[0081] Use forward data flow analysis to analyze the positions of all zero-value bubbles in the ciphertext; use a forward data flow analysis to traverse all homomorphic operations in the execution order, and apply derivation rules to each homomorphic operation to derive the final positions of the zero-value bubbles;

[0082] In a specific embodiment of the present invention, forward data flow analysis is used to analyze the positions of all zero-value bubbles in the ciphertext. Since the zero-value bubbles in the input ciphertext may propagate to other ciphertexts on some execution paths and be eliminated on other paths, it is necessary to use a forward data flow analysis to traverse all homomorphic operations in the execution order, as Figure 5 shown, for each homomorphic operation apply Figure 5 the derivation rules of <dst>The position of the air bubble. Specifically, for the homomorphic rotation operation, shift the air bubble in <src 1 > to <dst>, where <src 1 > indicates the only definite value from the source operand. For the homomorphic addition operation, the bitwise AND operation is used to propagate the bubble to <dst>。When is a scalar, it represents the bitmap of the void position is a vector of all 1s with a length of N / 2. When is a vector, it represents the bitmap of the void position consists of ones and the trailing . For the homomorphic multiplication operation, bitwise AND is used for the propagation of voids.

[0083] Use backward data flow analysis to analyze the positions of non-zero voids in all ciphertexts; use a backward data flow analysis algorithm to traverse all homomorphic operations through the chain, and apply the derivation rules for each homomorphic operation to derive the final positions of non-zero voids;

[0084] In the specific embodiments of the present invention, backward data flow analysis is used to analyze the positions of non-zero voids in all ciphertexts. The non-zero voids in the output ciphertext can be propagated to other ciphertexts through the use-def relationship. Therefore, a backward data flow analysis algorithm needs to be used to traverse the homomorphic operations that can be reached through the output through the use-def chain, as Figure 6 shown. For each homomorphic operation apply Figure 6 derivation rules from <dst>Derive <src 1 > or The cavitation position. Specifically, for the homomorphic rotation operation, <dst>The bubbles in are transferred to <src 1 > using shift operations. For homomorphic addition and multiplication operations, directly <dst>The bubbles in 1 > or when is also a ciphertext).

[0085] For the same ciphertext, the analysis results of the bubble positions in the forward data flow analysis and the backward data flow analysis are bitwise ANDed to obtain the final analysis result of the bubble position.

[0086] Check the correctness of ciphertext-level parallelism on the premise of ensuring program data dependence; adopt a combination of multiple types of homomorphic transformations, and the requirement for the ciphertext to be fusible under the combination of homomorphic transformations is that the valid values in each ciphertext are retained and maintained at different positions in the final fused ciphertext. Among them, multiple types of homomorphic transformations include: rotation, multiplication and addition of ciphertext plaintext for mask.

[0087] For the same ciphertext, the analysis results of the forward data flow analysis step and the backward data flow analysis step are bitwise ANDed to obtain the final analysis result.

[0088] In the specific embodiment of the present invention, the correctness of ciphertext-level parallelism is checked on the premise of ensuring program data dependence. Considering n candidate ciphertexts <a 1 >…<a n > for fusibility. T = {t 1 …t n} represents a combination of the following three types of homomorphic transformations: (1) rotation, (2) multiplication of ciphertext plaintext for mask, (3) addition. The requirement for these ciphertexts to be fusible under transformation T is that the valid values in each ciphertext are retained and maintained at different positions in the final fused ciphertext. In order to maintain the original calculation in ciphertext-level parallelism, consider the homomorphic operation H = {<c i > = <a i > <op><b i >|1 ≤ i ≤ n}, where <a 1 >… <a n > and <b 1 >… <b n > are all fusible under T. Applying t to <a i > and <b i > respectively produces <a' i > and <b' i >. Consider the following fusion transformation: i >

[0089]

[0090] Here and They are respectively <a 1 >…<a n > and <b 1 >…<b n > the results of fusion, <c>The fusion result of the original operations in H should be encapsulated. The condition for this fusion transformation to be considered legal is that <c' i > = <a' i > <op><b' i >The calculated effective value is not only retained, but also retained in <c>at different positions. In particular, for homomorphic rotation, all second operands are required to be the same.

[0091] In a specific embodiment of the present invention, step 103 described above includes:

[0092] Decompose the operation sequence before maximizing the fusion ciphertext recombination;

[0093] By sequentially processing the loops of FHE in the intermediate representation of the compiler to select a fusion plan, after reaching the last loop, select the optimal plan from the remaining plans according to a preset cost model to obtain the maximum profitability of ciphertext-level parallelism.

[0094] In a specific embodiment of the present invention, for the step of selecting a fusion plan by sequentially processing the loops of FHE in the intermediate representation of the compiler, the step further includes:

[0095] Starting from the first loop, generate two plans, including: a plan to maximize the current loop profit, and a plan to minimize the ciphertext decomposition overhead outside the current loop;

[0096] According to the preset cost model, evaluate the plans in all loops and abandon any plan with a negative profit in the current loop;

[0097] If a plan is abandoned and no plan has been generated in the current loop, at most two new plans will be created for the current loop. After reaching the last loop, select the optimal plan from the remaining plans according to the cost model.

[0098] In a specific embodiment of the present invention, a global packing strategy is used to improve the profitability of ciphertext-level parallelism. The key to improving the profitability of ciphertext-level parallelism lies in maximizing the operation sequence of the fusion ciphertext before decomposition, thereby reducing the overhead of ciphertext recombination. This is because ciphertext recombination requires expensive homomorphic multiplication and rotation. Currently, the present invention selects a fusion plan by sequentially processing the loops of FHE applications in the intermediate representation of the compiler. Starting from the first loop, it generates at most two plans: one is a plan to maximize the profit of the current loop, and the other is a plan to minimize the ciphertext decomposition overhead outside the current loop. According to the cost model described later, these plans are evaluated in all loops, and any plan with a negative profit in the current loop is abandoned. If a plan is abandoned and no plan has been generated in the current loop, at most two new plans will be created for the current loop. After reaching the last loop, select the optimal plan from the remaining plans according to the cost model.

[0099] As shown in Table 1, the cost model of the present invention quantifies the cost of homomorphic operations and scalar / vector encoding according to the time complexity and normalizes it to O(N * logN * r 2 )). If P is a fusion plan that contains k operations op 1 …op k , then the cost of this plan is where is the overhead of each operation op in the following table i .

[0100] Table 1 Overhead of Each Homomorphic Operation

[0101] Operation Overhead Rotation 1 Addition 1 / logN*r Scalar Encode 1 / logN*r Vector Encode 1 / r Ciphertext - Plaintext Multiplication 1 / logN*r Ciphertext - Ciphertext Multiplication 1

[0102] In summary, the present invention has positive technical effects compared with the prior art. After evaluating seven common fully homomorphic encryption applications (including 3 machine learning applications), compared with the current state-of-the-art fully homomorphic encryption compiler EVA that only utilizes plaintext-level parallelism [3] , the present invention can achieve a maximum speedup of 18.0x and an average of 3.4x (geometric mean). In addition, compared with EVA, the present invention can reduce the number of homomorphic instructions by an average of 55.9%.

[0103] Embodiment 2

[0104] Such as< / c> < / op> < / c> Figure 7 As shown in Figure 7 , an embodiment of the present application provides a ciphertext-level parallel system for fully homomorphic encryption applications, which adopts the ciphertext-level parallel method for fully homomorphic encryption applications as described above. The system includes:

[0105] Bubble position specifying module 201: For the fully homomorphic encryption (FHE) ciphertext vector corresponding to the ciphertext, use a specific domain computer language to specify the initial bubble positions in the FHE vectors corresponding to the input ciphertext and the output ciphertext.

[0106] Bubble position tracking module 202: Use data flow analysis to track the dynamically changing bubble positions corresponding to each ciphertext and confirm the final bubble positions of the ciphertext.

[0107] Ciphertext parallel module 203: Maximize the fusion of the operation sequences of ciphertexts by adopting a global fusion strategy, and pack multiple ciphertext vectors into an overall FHE vector by using the bubble positions in the FHE ciphertext vectors to obtain the maximum profitability of ciphertext-level parallelism.

[0108] Embodiment III

[0109] An embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the steps of the ciphertext-level parallel method for fully homomorphic encryption applications as described above are implemented.

[0110] Embodiment IV

[0111] An embodiment of the present application provides an electronic device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the steps of the ciphertext-level parallel method for fully homomorphic encryption applications as described above are implemented.

[0112] In addition, the ciphertext-level parallel method for fully homomorphic encryption applications described in combination with Figure 1 the embodiments of the present application can be implemented by an electronic device, such as a computer device. Figure 8 FIG. [ID number] is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present application.

[0113] In some of these embodiments, the computer device may further include a communication interface 83 and a bus 80. Among them, as Figure 8 shown, the processor 81, the memory 82, and the communication interface 83 are connected through the bus 80 and complete communication with each other.

[0114] Specifically, the above-mentioned processor 81 may include a central processing unit (CPU), or an application specific integrated circuit (ASIC), or may be configured as one or more integrated circuits for implementing the embodiments of the present application.

[0115] The memory 82 can be used to store or cache various data files required for processing and / or communication, as well as possible computer program instructions executed by the processor 81.

[0116] The processor 81 reads and executes the computer program instructions stored in the memory 82 to implement any one of the acceleration methods of the diffusion model in the above embodiments.

[0117] The technical features of the above embodiments can be combined arbitrarily. For the sake of brevity of description, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, it should be considered as the scope recorded in this specification.

[0118] The above embodiments only represent several implementation manners of the present application. The description is relatively specific and detailed, but it should not be construed as a limitation on the scope of the invention patent. It should be noted that for those of ordinary skill in the art, without departing from the concept of the present application, several modifications and improvements can still be made, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application should be subject to the appended claims. < / op> < / dst> < / dst> < / dst> < / dst> < / dst> < / dst> < / op>

Claims

1. A ciphertext-level parallel method for fully homomorphic encryption applications, characterized in that: The method comprises: For the fully homomorphic encrypted FHE ciphertext vector corresponding to the ciphertext, the domain-specific language DSL is used to specify the initial bubble position in the FHE vector corresponding to the input ciphertext and the output ciphertext; Use data flow analysis to track the dynamically changing bubble positions corresponding to each ciphertext and confirm the final bubble positions of the ciphertext; A global fusion strategy is adopted to maximize the operation sequence of fused ciphertexts, and multiple ciphertext vectors are packaged into an overall FHE vector by utilizing the bubble positions in the FHE ciphertext vectors, thereby obtaining the maximum profitability of ciphertext-level parallelism.

2. The ciphertext-level parallel method for fully homomorphic encryption applications according to claim 1, characterized in that: The step further includes specifying the initial bubble position in the FHE vector corresponding to the input ciphertext and the output ciphertext using a domain specific language DSL for the fully homomorphically encrypted FHE ciphertext vector corresponding to the ciphertext; Through multiple tensor attributes of the FHE vector, the zero-value bubble position of the input ciphertext and the non-zero-value bubble position of the output ciphertext are specified using the domain-specific language DSL; wherein the tensor attributes include: Layout attribute, ValidSlots attribute and Offset attribute.

3. The ciphertext-level parallel method for fully homomorphic encryption applications according to claim 1, characterized in that: The step of using data flow analysis to track the dynamically changing bubble position corresponding to each ciphertext and confirming the final bubble position of the ciphertext also includes: Use forward data flow analysis to analyze the positions of zero-value bubbles in all ciphertexts; use a forward data flow analysis to traverse all homomorphic operations in execution order, and apply the inference rules to each homomorphic operation to deduce the final zero-value bubble position; Use backward data flow analysis to analyze the positions of non-zero bubbles in all ciphertexts; use a backward data flow analysis algorithm to traverse all homomorphic operations through the chain, apply the inference rules to each homomorphic operation, and deduce the final non-zero bubble position; For the same ciphertext, the bubble position analysis results of the forward data flow analysis and the backward data flow analysis are bitwise ANDed to obtain the final bubble position analysis result.

4. The ciphertext-level parallel method for fully homomorphic encryption applications according to claim 1, characterized in that: The step of using data flow analysis to track the dynamically changing bubble position corresponding to each ciphertext and confirming the final bubble position of the ciphertext also includes: The correctness of ciphertext-level parallelism is checked under the premise of ensuring program data dependency; a combination of multiple types of homomorphic transformations is adopted to make the ciphertext fused under the combination of homomorphic transformations, and the requirement is that the valid values ​​in each ciphertext are retained and kept in different positions of the final fused ciphertext, wherein the multiple homomorphic transformations include: rotation, ciphertext multiplication and addition for mask.

5. The ciphertext-level parallel method for fully homomorphic encryption applications according to claim 1, characterized in that: The global fusion strategy is adopted to maximize the operation sequence before the fusion ciphertext is reorganized, and multiple ciphertext vectors are packaged into an overall FHE vector by using the bubble positions in the FHE ciphertext vector to achieve ciphertext level parallelism and obtain the maximum profitability of ciphertext level parallelism. The steps include: Decomposition maximizes the sequence of operations before fusion ciphertext reorganization; The fusion plan is selected by processing the FHE loops in sequence in the compiler intermediate representation. After reaching the last loop, the optimal plan is selected from the remaining plans according to the preset cost model to obtain the maximum profitability of ciphertext-level parallelism.

6. The ciphertext-level parallel method for fully homomorphic encryption applications according to claim 5, characterized in that: The step of selecting a fusion plan by sequentially processing the loops of FHE in the compiler intermediate representation also includes: Starting from the first loop, two plans are generated, including: a plan that maximizes the current loop's revenue, and a plan that minimizes the cost of decomposing the ciphertext outside the current loop; According to a preset cost model, the plans are evaluated in all cycles, and any plan with a negative benefit in the current cycle is abandoned; If a plan is abandoned and no plan has been generated for the current cycle, up to two new plans are created for the current cycle. After reaching the last cycle, the best plan is selected from the remaining plans according to the cost model.

7. The ciphertext-level parallel method for fully homomorphic encryption applications according to claim 3, characterized in that: The step of using data flow analysis to track the dynamically changing bubble position corresponding to each ciphertext and confirming the final bubble position of the ciphertext also includes: Automatically convert the bubble position represented by the domain-specific language DSL into a bitmap format, where 0 represents that the position is a bubble and 1 represents that the position is a valid value; and standardize the format of each homomorphic operation to include: a first data source, a second data source, and multiple types of homomorphic operations between the first data source and the second data source, where the first data source is a ciphertext, the second data source is a ciphertext or a plaintext, the plaintext may be a scalar or a vector, and multiple homomorphic operations include addition, multiplication, and rotation.

8. A ciphertext-level parallel system for fully homomorphic encryption applications, using the ciphertext-level parallel method for fully homomorphic encryption applications as claimed in any one of claims 1 to 7, characterized in that: The system comprises: The bubble position specification module is used to specify the initial bubble position in the FHE vector corresponding to the input ciphertext and the output ciphertext using a specific domain computer language for the fully homomorphically encrypted FHE ciphertext vector corresponding to the ciphertext; Cavitation position tracking module: used to track the dynamically changing cavitation position corresponding to each ciphertext by using data flow analysis to confirm the final cavitation position of the ciphertext; Ciphertext parallel module: used to maximize the operation sequence of fused ciphertexts by adopting a global fusion strategy, and to pack multiple ciphertext vectors into an overall FHE vector by utilizing the bubble positions in the FHE ciphertext vectors, so as to obtain the maximum profitability of ciphertext-level parallelism.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the ciphertext-level parallel method for fully homomorphic encryption applications described in any one of claims 1-7 are implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, it implements the steps of the ciphertext-level parallel method for fully homomorphic encryption applications as described in any one of claims 1 to 7.

Images