RISC-V-based BFV homomorphic calculation acceleration system

Abstract

The invention discloses a BFV homomorphic calculation acceleration system based on RISC-V. The BFV homomorphic calculation acceleration system comprises a user-defined extension instruction module, an instruction parser module and a BFV homomorphic calculation hardware acceleration module. And the custom extension instruction module is used for designing and defining a group of RISC-V custom extension instructions for BFV homomorphic calculation key operations, generating an instruction sequence according to the safety parameters and the operation types, and transmitting the instruction sequence to the instruction parser module. And the instruction parser module is used for identifying and parsing the received self-defined extension instruction in an instruction decoding stage. And the BFV homomorphic calculation hardware acceleration module is used for executing polynomial calculation and modular computation operation according to the tasks distributed by the instruction parser module. According to the method, the calculation efficiency and security of the BFV homomorphic encryption algorithm are remarkably improved, and a high-performance hardware-level guarantee is provided for encrypted data.

Description

Technical Field

[0001] The present invention relates to the field of encryption algorithm optimization, and in particular to an acceleration system for BFV homomorphic computing based on RISC-V. Background Art

[0002] RISC-V is an open-source instruction set architecture (ISA). Unlike traditional commercial ISAs, RISC-V is provided as open source. Its design is simple, modular, and efficient, making it suitable for a wide range of applications, from microcontrollers to high-performance computing. It employs a streamlined instruction set (RISC-V) concept, reducing the number of instructions, optimizing performance and power consumption, while reducing hardware implementation complexity. RISC-V's openness allows businesses and developers to use and modify it without paying licensing fees, driving the rapid development of the ecosystem. RISC-V has been widely adopted in fields such as the Internet of Things, artificial intelligence, and edge computing, and has garnered widespread attention from the chip industry and academia, becoming recognized as a key trend in future computing.

[0003] The BFV algorithm (Brakerski-Fan-Vercauteren algorithm) is a classic homomorphic encryption algorithm and a key tool in the field of encryption. It is a public key encryption algorithm that allows direct addition and multiplication operations on ciphertext, using different keys for encryption and decryption. The BFV algorithm is based on the Ring Learning with Errors (RLWE) problem. By performing encryption and ciphertext operations on plaintext, it enables secure computation without exposing sensitive information. The algorithm includes key generation, encryption, decryption, addition, and multiplication operations, with noise management and analog-to-digital switching as its core technologies.

[0004] Because privacy protection requires the use of the BFV algorithm in some application scenarios, this computing model can have a certain impact on system performance, especially as noise accumulation can reduce computational efficiency. Therefore, optimizing the BFV algorithm, particularly in homomorphic operations and noise control, will enable the system to improve processing performance while maintaining privacy protection.

[0005] With the widespread application of the BFV algorithm, more and more research has focused on the optimization design of the algorithm. At the same time, in hardware implementation, research has explored how to reduce the large number of polynomial operations involved in the BFV algorithm to more efficiently support privacy-preserving computing tasks. Summary of the Invention

[0006] The purpose of the present invention is to fill the deficiencies of the above-mentioned prior art and provide an acceleration system for BFV homomorphic computing based on RISC-V to solve the problem of high computational cost when implementing the BFV algorithm in hardware.

[0007] The above-mentioned system is realized by the following technical solutions:

[0008] An acceleration system for BFV homomorphic computing based on RISC-V, including:

[0009] The custom extension instruction module is responsible for designing and defining a set of RISC-V custom extension instructions for key BFV homomorphic computation operations. Based on the RISC-V instruction set extension, eight custom extension instructions are defined, categorized by function into three categories: initialization instructions, data load / store instructions, and computation instructions. Initialization instructions configure polynomial ring parameters and hardware unit states; data load / store instructions load polynomial ring parameters into a cache; and computation instructions map BFV homomorphic operations to hardware acceleration units. Based on security parameters and operation types, an instruction sequence is generated and passed to the instruction parser module.

[0010] The instruction parser module is responsible for identifying and parsing received custom extension instructions during the instruction decoding phase. During the pipeline decoding phase, the instruction parser identifies BFV instructions and parses operands, generating hardware control signals and dispatching tasks to the parameter loading unit, NTT computation unit, homomorphic operation control unit, and modular reducer, ensuring that each task is dynamically assigned to the appropriate unit.

[0011] The BFV homomorphic computing hardware acceleration module is used to perform polynomial calculations and modular operations according to tasks assigned by the custom instruction parser module. The BFV homomorphic computing hardware acceleration module includes a state machine control and management submodule, a data storage submodule, and a homomorphic operation submodule. The data storage submodule includes a parameter loading unit, a data buffer, and a data write-back unit. The homomorphic operation submodule includes a homomorphic operation control unit, an NTT calculation unit, and a modular reducer. Based on control signals, the parameter loading unit reads data, the butterfly operation unit performs the NTT transformation, the operation unit performs addition / multiplication, and the modular reducer handles modular operations. Finally, the write-back unit outputs the result and sends back a completion signal, triggering subsequent operations and ultimately accelerating the BFV algorithm.

[0012] Furthermore, the custom extended instruction module accelerates the RISC-V custom extended instructions for BFV homomorphic computing, which is used to efficiently control and execute key operations in the BFV algorithm. The custom extended instruction module is specifically as follows:

[0013] The RISC-V custom extension instruction design for accelerating BFV homomorphic computing includes eight custom instructions, namely, initializing the BFV module instruction (BFV_INIT), loading data instruction (BFV_LOAD), executing NTT instruction (BFV_NTT), executing inverse NTT instruction (BFV_INTT), executing homomorphic addition instruction (BFV_ADD), executing homomorphic multiplication instruction (BFV_MUL), linear reconstruction instruction (BFV_RELIN) and writing back data instruction (BFV_STORE).

[0014] The initialization class instructions include initialization BFV module instructions, which are used to configure the polynomial ring parameters (modulus q, dimension n, plaintext modulus t) and the hardware acceleration unit status; the data loading / storage class instructions include load data instructions and write back data instructions, which are used to load polynomial coefficients from registers or memory to the data buffer, or write the calculation results back to the storage unit; the operation class instructions include execute NTT instructions, execute inverse NTT instructions, execute homomorphic addition instructions, execute homomorphic multiplication instructions, and linear reconstruction instructions. All operation class instructions are encoded as direct operation codes of the hardware acceleration unit.

[0015] The initialization BFV module instruction is designed as an I-type instruction, the load data instruction and the write back data instruction are designed as S-type instructions, and other instructions are designed as R-type instructions.

[0016] Furthermore, the instruction parser module is used to parse and distribute BFV instructions during the instruction decoding stage and assign tasks to the hardware acceleration subsystem, as follows:

[0017] The custom instruction parser is located in the instruction decoding stage of the RISC-V pipeline architecture. It serves as a hardware extension of the RISC-V basic instruction set decoding module and is used to quickly identify and parse accelerated BFV-specific instructions.

[0018] Furthermore, the BFV homomorphic computing hardware acceleration module is used to perform polynomial calculations and modular operations, as follows:

[0019] First, preload and initialize parameters. According to the control signal distributed by the instruction parser module, the parameter loading unit reads the polynomial ring parameters (modulus q, dimension n) and key data (private key s, public key pk, linear reconstruction key evk) from the register or memory and stores them in the data buffer.

[0020] Secondly, according to the control signal distributed by the instruction parser module, polynomial operations are performed. If it is an NTT instruction or an inverse NTT instruction: the butterfly operation unit (7-stage ctbf pipeline) is started, and the polynomial coefficient transformation is completed according to the divide-and-conquer strategy, and the intermediate results are temporarily stored in the cache; if it is a homomorphic addition instruction: the polynomial adder is called, and the input ciphertext coefficients are modularly added component by component, and the results are directly written to the output buffer; if it is a homomorphic multiplication instruction, it is executed in two stages. First, the tensor product is calculated, and the polynomial multiplication is accelerated by the NTT unit to generate the intermediate terms (d0, d1, d2); then a linear reconstruction operation is performed, combined with the linear reconstruction key evk, and the final ciphertext (c0, c1) is generated through modular multiplication and addition operations, where the polynomial c0 contains the encrypted plaintext and noise, and the polynomial c1 is the encrypted version of the random polynomial.

[0021] Finally, modular operation or data write-back is performed based on the generated ciphertext. The modular reducer performs modular operation on the intermediate result to ensure that the data complies with the encryption constraints. The write-back unit transfers the final ciphertext result to the target storage address and feeds back a completion signal to the instruction parser.

[0022] The BFV homomorphic computing hardware acceleration module is located in the instruction execution stage of the RISC-V pipeline architecture. The module design includes a state machine control management module, a data storage module and a homomorphic operation module.

[0023] Furthermore, the state machine control management submodule is responsible for coordinating the work of each hardware module in the BFV acceleration subsystem. The state machine initialization and parameter configuration are as follows:

[0024] Configure the initial state of the three-stage state machine and set seven transfer conditions, including idle state (IDLE), parameter loading state (PARAM_LOAD), data preparation state (DATA_PREP), NTT calculation state (NTT_CALC), homomorphic operation state (HOM_OP), data write back state (DATA_WRITE) and completion state (DONE).

[0025] The polynomial ring parameters (modulus q, dimension n, circuit depth h) are loaded from registers or memory to the data buffer via the parameter loading unit.

[0026] Initialize the working mode of the NTT calculation unit and the modular reducer, and set the pipeline stages and register distribution of the butterfly operation unit.

[0027] The state machine is a three-stage state machine, and its design includes 7 transition states. Its main functions include global state management, multi-module collaboration, data loading and storage control, and homomorphic operation support.

[0028] Furthermore, the data storage submodule is designed to include a parameter loading unit, a data buffer, and a data write-back unit, as follows:

[0029] The parameter loading unit is responsible for loading the parameters required for calculation from the register or memory, including the size n of the modular polynomial ring, the modulus q of the ciphertext polynomial coefficient, and the circuit depth h.

[0030] The data buffer is used to temporarily store the polynomial calculation from the homomorphic operation control unit and the conversion results of the NTT calculation unit.

[0031] The data write-back unit writes the calculation results of the BFV homomorphic computing hardware acceleration subsystem back from the operation unit to the external memory or register file.

[0032] Transfer the final ciphertext or decrypted plaintext to the target storage address, external memory or register file through the write-back unit;

[0033] Reset the data buffer to release hardware resources.

[0034] Send a completion signal to the state machine to trigger the parsing and execution of the next instruction.

[0035] The parameter loading unit, data buffer and data write-back unit work together to build an efficient data flow channel to support the execution of complex computing tasks.

[0036] Furthermore, the homomorphic operation submodule design includes a homomorphic operation control unit, an NTT calculation unit, and a modular reducer, and the homomorphic operation control is performed in stages as follows:

[0037] According to the current instruction type, switch the state machine to the corresponding operation stage.

[0038] If it is an encryption or decryption instruction, the ciphertext polynomial coefficients or the private key s are loaded into the data buffer.

[0039] If it is a homomorphic operation instruction, the input ciphertext pair (c0, c1) and the linear reconstruction key evk are loaded.

[0040] Start the butterfly operation unit and complete the polynomial coefficient transformation according to the divide-and-conquer strategy, and temporarily store the intermediate results in the buffer;

[0041] If homomorphic addition is performed, the polynomial adder is called to perform modular addition operations on the ciphertext coefficients component by component;

[0042] If homomorphic multiplication is performed, it is divided into two sub-steps. First, tensor product calculation is performed to generate intermediate terms (d0, d1, d2) through the NTT unit; second, linear reconstruction processing is performed, and modular multiplication and addition operations are performed in combination with EVK to generate the final ciphertext (c0, c1).

[0043] Perform Barrett reduction on the intermediate results, ensuring that the data meets the q-norm constraint.

[0044] The homomorphic operation control unit is responsible for parsing homomorphic operation instructions, executing addition and multiplication homomorphic operations and linear reconstruction, and managing data flow and operation scheduling.

[0045] The NTT calculation unit implements number theory transformation and inverse transformation, accelerating polynomial multiplication.

[0046] The modular reducer adopts a separate design to complete large integer modular operations, optimize the reduction efficiency, and ensure that the results meet the requirements of the encryption algorithm.

[0047] Furthermore, the design of the NTT computing unit includes an NTT computing control unit and a butterfly computing unit, as follows:

[0048] The NTT calculation control unit can control the operation performed in the current state to be an NTT operation or an inverse NTT operation.

[0049] The butterfly operation unit is the core of the polynomial multiplication architecture, which is composed of 7 butterfly units ctbf, and a different number of registers are inserted into each ctbf.

[0050] Beneficial effects of the present invention:

[0051] This invention significantly improves the computational efficiency and security of the BFV homomorphic encryption algorithm by expanding the RISC-V instruction set, designing dedicated hardware acceleration modules, and optimizing data flow control. Specifically, eight custom instructions map BFV core operations to hardware atomic instructions. Combined with the instruction parser, the dynamic scheduling acceleration unit reduces homomorphic multiplication latency and supports high-dimensional polynomial operations. A seven-stage butterfly operation unit pipeline collaborates with memory to implement NTT / inverse NTT transformations, improving polynomial multiplication efficiency. A three-stage state machine and dynamic resource allocation strategy reduce resource conflicts and support parallel encryption and decryption tasks. A configurable modular reducer uses algorithmic optimization to reduce modular operation latency and supports dynamic switching of moduli to adapt to different security requirements. The modular design based on the RISC-V open source architecture provides high-performance hardware-level protection for encrypted data. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 The eight RISC-V custom extension instructions of the present invention that accelerate BFV homomorphic computing;

[0053] Figure 2 This is a diagram of the five-stage pipeline infrastructure of the present invention;

[0054] Figure 3 The module composition of the BFV homomorphic computing hardware acceleration subsystem in the present invention;

[0055] Figure 4 These are the seven transition states of the state machine control management module of the present invention;

[0056] Figure 5 This is a pseudocode example of the present invention, calling a custom extension instruction to complete BFV homomorphic calculation;

[0057] Figure 6 Schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0058] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.

[0059] The following is a detailed description of an acceleration system for BFV homomorphic computing based on RISC-V based on the accompanying drawings.

[0060] A RISC-V-based BFV homomorphic computing acceleration system, comprising:

[0061] The custom extended instruction module defines eight custom instructions based on the RISC-V instruction set architecture extension, including initialization instructions (I-type), data load / store instructions (S-type), and operation instructions (R-type). Initialization instructions configure the polynomial ring parameters (modulus q, dimension n, plaintext modulus t) and the initial state of the hardware acceleration unit; data load instructions load polynomial coefficients from registers or memory into the data buffer, while store instructions write the operation results back to the target address; operation instructions (NTT transformation, homomorphic addition, homomorphic multiplication, and inverse NTT transformation) are directly mapped to the operation logic of the hardware acceleration unit through opcodes. After inputting the security parameters (n, q, t) and the algorithm operation type (encryption / decryption / homomorphic operation), an instruction sequence consisting of opcodes and operands is generated and passed to the instruction parser.

[0062] During the RISC-V pipeline decoding phase, the instruction parser module uses a hardware-extended instruction parser to identify BFV-specific and basic instructions, parse operand addresses and modulus parameters, generate hardware control signals, and distribute them to the corresponding modules. The parameter loading unit reads the polynomial ring parameters (n, q) and key data (s, pk, evk). Upon receiving the instruction, the NTT computation unit triggers the 7-stage butterfly pipeline. The homomorphic operation control unit activates the corresponding logic based on the instruction type (addition or multiplication). The modular reducer handles the modular operation of the intermediate results. The input is the instruction sequence generated by S1, and the output is the hardware acceleration unit enable signal, data address, and operation type encoding, ensuring dynamic allocation of tasks to various functional modules.

[0063] The BFV homomorphic computation hardware acceleration module performs hardware-accelerated computations in stages. First, the parameter loading unit reads the polynomial parameters and key data into a buffer based on control signals. Operations are then performed based on the instruction type: If it is an NTT / inverse NTT instruction, the butterfly unit performs the polynomial coefficient transformation using a divide-and-conquer strategy, temporarily storing the intermediate results in a buffer. If it is a homomorphic addition instruction, the polynomial adder is called to perform modular addition on the ciphertext coefficients component by component and write the result to the output buffer. If it is a homomorphic multiplication instruction, the NTT unit first calculates the tensor product (d0, d1, d2), and then performs modular multiplication and addition with the linear reconstruction key (evk) to generate the final ciphertext. The modular reducer uses the Barrett algorithm to reduce intermediate values in real time. After ensuring that the data meets the encryption constraints, the write-back unit transfers the result to the target address and sends a completion signal back to the instruction parser to trigger subsequent instructions. Inputs are distributed control signals and pre-stored data, and outputs are the ciphertext result, decrypted plaintext, or a status flag.

[0064] Key generation is the initial step in BFV homomorphic encryption, aiming to generate the necessary encryption and decryption parameters. First, a private key polynomial s is generated by sampling from a uniform distribution {-1, 0, 1}, whose dimension is determined by the parameter n. Subsequently, when generating the public key, a polynomial a (modulo q) and an error polynomial e (following a discrete Gaussian distribution) are randomly selected, and the public key components are calculated:

[0065] pk0=-(a·s+e)mod q, pk1=a

[0066] Finally, when generating the linear reconstruction key evk, a new random polynomial a' and error e' are introduced, through the formula:

[0067] evk=(a'+s 2 +e')mod q

[0068] Ensure that the ciphertext dimension of subsequent homomorphic multiplication is controllable.

[0069] The encryption process converts the plaintext into a format that can be operated in the ciphertext domain. First, the plaintext m is scaled and modulo t to be encoded into the polynomial mpoly Next, sample the random polynomial u (with coefficients of 0 / 1) and the error polynomials e1, e2. Finally, use the public key to calculate the ciphertext pair:

[0070] c0=(pk0·u+e1+m poly )mod q,c1=(pk1·u+e2)mod q

[0071] This step ensures the security of plaintext and the feasibility of homomorphic operations.

[0072] Homomorphic addition allows the direct addition of two ciphertexts. When the ciphertexts (c0, c1) and (c0', c1') are input, a modular addition operation is performed coefficient by coefficient:

[0073]

[0074] Output new ciphertext (c0 add ,c1 add ), which corresponds to the addition result of the plaintext domain, and the noise growth is linear and controllable.

[0075] Homomorphic multiplication is the core complex operation of BFV and needs to be combined with linear reconstruction key optimization. After inputting two ciphertexts (c0, c1) and (c0', c1'), the tensor product is first calculated:

[0076] d0=(c0·c0')mod q, d1=(c0·c1'+c1·c0')mod q, d2=(c1·c1')mod q

[0077] Then, evk is used to perform linear reconstruction to generate new ciphertext:

[0078]

[0079] This process reduces the ciphertext dimension from 3 items to 2 items, ensuring the efficiency of subsequent operations.

[0080] Decryption uses the private key to restore the plaintext information. Input the ciphertext (c0, c1) and the private key s and calculate the decryption polynomial:

[0081] m'=(c0+c1·s)mod q

[0082] The plaintext is then decoded by scaling and modulo:

[0083] m=[t / q·m']mod t

[0084] This step requires precise modular control to eliminate noise effects.

[0085] The custom extended instruction module accelerates the RISC-V custom extended instructions for BFV homomorphic computing and is used to efficiently control and execute key operations in the BFV algorithm. The details are as follows:

[0086] like Figure 1 The RISC-V custom extension instruction design for accelerating BFV homomorphic computing shown in the figure includes eight custom instructions, namely, initializing the BFV module instruction, loading polynomial data into the data memory instruction, executing the NTT instruction, executing the inverse NTT instruction, executing the homomorphic addition instruction, executing the homomorphic multiplication instruction, the linear reconstruction instruction and the write back data instruction.

[0087] The initialization BFV module instruction is designed as an I-type instruction, the load polynomial data to data memory instruction and the write back data instruction are designed as S-type instructions, and other instructions are designed as R-type instructions. Each instruction adopts a 32-bit encoding format and cooperates with the RVV standard instruction to perform BFV key operations.

[0088] The instruction parser module, a custom instruction parser subsystem, is used to parse and distribute BFV instructions during the instruction decoding phase and assign tasks to hardware acceleration units, as follows:

[0089] The custom instruction parser subsystem is located in the instruction decoding stage of the RISC-V pipeline architecture. As a hardware extension of the RISC-V basic instruction set decoding module, it is used to quickly identify and parse the accelerated BFV dedicated instructions, use 32-bit registers to implement state parsing, and quickly parse the precision and data flow strategy configured in the zimm and uimm fields in the instructions through combinational logic, and pass the decoding results to the execution stage.

[0090] The BFV homomorphic computing hardware acceleration module and the BFV homomorphic computing hardware acceleration subsystem are used to perform polynomial calculations and modular operations, as follows:

[0091] like Figure 2 and Figure 3 The BFV homomorphic computing hardware acceleration subsystem is located in the instruction execution stage of the RISC-V pipeline architecture. The module design includes a state machine control management module, a data storage module, and a homomorphic operation module.

[0092] The system achieves full-process acceleration through state machine control, data flow coordination, and modular hardware operations. The specific steps are as follows:

[0093] The initial state of the three-stage state machine is configured, and seven transition conditions (including parameter loading, NTT calculation, homomorphic operation, and result writeback) are set. The polynomial ring parameters (modulus q, dimension n, and circuit depth h) are loaded from registers or memory into the data buffer via the parameter loading unit. The operating modes of the NTT calculation unit and modular reducer are initialized, and the butterfly unit's seven-stage CTBF pipeline and register layout are set. After inputting the security parameters (n, q, h) and state machine configuration instructions, the parameter cache completion signal and hardware module ready status are output, ensuring data readiness and hardware resource coordination for subsequent operations.

[0094] like Figure 5 The state machine switches to the corresponding operation stage based on the instruction type (encryption, decryption, homomorphic addition / multiplication): If the instruction is encryption or decryption, the ciphertext polynomial coefficients or private key s are loaded into the data buffer; if the instruction is a homomorphic operation, the input ciphertext pair (c0, c1) and the linear reconstruction key evk are loaded. The operation is then performed according to the instruction type: the butterfly operation unit is activated to complete the NTT / inverse NTT transformation and temporarily store the intermediate results; the polynomial adder is called to perform modular addition of the ciphertext coefficients; for homomorphic multiplication instructions, the process is divided into two stages: first, the tensor product (d0, d1, d2) is generated through the NTT unit, and then modular multiplication and addition is performed in conjunction with evk to generate the final ciphertext (c0, c1). The modular reducer performs Barrett reduction on the intermediate results in real time to ensure that the data meets the modular q constraint. It then outputs the intermediate operation result and a state machine stage completion flag, providing the data foundation for the next stage.

[0095] The final ciphertext or decrypted plaintext is transferred to the target storage address, external memory, or register file via the write-back unit. The data buffer is reset and hardware resources are released. A completion signal is then sent to the state machine to trigger the parsing and execution of the next instruction. After the computation result and the write-back target address are input, a write-back completion signal and a buffer reset status are output, forming a closed loop of "compute → storage → feedback." Based on the feedback signal, the state machine returns to an idle state, awaiting new instruction input, ensuring efficient scheduling and resource reuse in the multi-tasking pipeline.

[0096] The state machine control management module is responsible for coordinating the work of each hardware module in the BFV acceleration unit.

[0097] like Figure 4 The state machine shown is a three-stage state machine, which is designed to include 7 transition states. Its main functions include global state management, multi-module collaboration, data loading and storage control, and homomorphic operation support.

[0098] like Figure 3 The data storage module design shown includes a parameter loading unit, a data buffer and a data write-back unit, as follows:

[0099] The parameter loading unit is responsible for loading the parameters required for calculation from the register or memory, including the size n of the modular polynomial ring, the modulus q of the ciphertext polynomial coefficient, and the circuit depth h;

[0100] The data buffer is used to temporarily store loaded operands and intermediate results, including the results of polynomial calculations and NTT conversions. It has a designed capacity of approximately 600KB and supports 128-bit or 256-bit data block storage, and is used to cache loaded operands and NTT conversion intermediate results.

[0101] The data write-back unit writes the calculation result from the operation unit back to the external memory or register file.

[0102] like Figure 3 The homomorphic operation module design shown includes a homomorphic operation control unit, an NTT calculation unit, and a modular reducer, as follows:

[0103] The homomorphic operation control unit is responsible for parsing homomorphic operation instructions, coordinating each module to perform addition, multiplication homomorphic operations and linear reconstruction, managing data flow and operation scheduling, implementing BFV homomorphic addition and multiplication through a 32-bit ALU and multi-precision operation unit, and dynamically scheduling the NTT module, modular reducer and linear reconstruction unit; the NTT calculation unit consists of a 32-bit NTT controller and 7 butterfly operation units (CTBF), each of which contains several 128-bit wide registers to support parallel data processing.

[0104] The NTT computing unit implements number theory transformation and inverse transformation to accelerate polynomial multiplication;

[0105] The modular reducer adopts a separate design to complete large integer modular operations, optimize reduction efficiency, and ensure that the results meet the requirements of the encryption algorithm. It adopts the Barrett reduction algorithm and uses a separate design composed of a 64-bit adder and a shifter to ensure that the large integer modular operation accuracy meets the 128-bit requirement.

[0106] The design of the NTT computing unit includes an NTT computing control unit and a butterfly computing unit, as follows:

[0107] The NTT calculation control unit can control the operation performed in the current state to be NTT operation or inverse NTT operation;

[0108] The butterfly operation unit is the core of the polynomial multiplication module architecture, which is composed of 7 butterfly units ctbf, and a different number of registers are inserted into each ctbf.

[0109] The overall structure of the system of the present invention is as follows Figure 6As shown in Table 1 below, the effectiveness of the BFV homomorphic encryption hardware acceleration system based on RISC-V of the present invention is verified by designing comparative experiments, which are tested on Xilinx Zynq UltraScale+FPGA (with integrated RISC-V soft core) and Intel Core i7-12700K (pure software implementation) platforms. The experiment adopts polynomial dimension n={1024,2048,4096}, ciphertext modulus q={2 30 ,2 60} and plaintext modulus t = 2 8 , covering key generation, encryption, decryption, homomorphic addition / multiplication and other operations, testing single operation latency and batch operation throughput, and analyzing resource occupancy and power consumption. Experimental results show that the hardware acceleration system of the present invention has a homomorphic multiplication latency of only 85μs, which is 92.9% lower than the pure software implementation (1200μs); the throughput reaches 450Ops / s, which is 9 times that of the software; the dynamic power consumption is only 3.5W, and the energy efficiency ratio is as high as 4.2GOPS / W, which is significantly better than the CPU (95W, 0.3GOPS / W). In summary, the present invention performs well in computing latency, throughput, energy efficiency and functional integrity, proving its application effect and advantages in the field of homomorphic encryption.

[0110] Table 1

[0111]

Claims

1. An acceleration system for BFV homomorphic computing based on RISC-V, characterized in that: Includes custom extended instruction module, instruction parser module and BFV homomorphic computing hardware acceleration module; The custom extension instruction module is used to define a set of RISC-V custom extension instructions for key operations of BFV homomorphic computing, generate an instruction sequence based on security parameters and operation type, and pass it to the instruction parser module; The instruction parser module is used to identify and parse the received custom extended instructions during the instruction decoding stage and distribute tasks; The BFV homomorphic computing hardware acceleration module is used to perform polynomial calculations and modular operations according to the tasks distributed by the instruction parser module.

2. The acceleration system for BFV homomorphic computing based on RISC-V according to claim 1, characterized in that: The custom extended instruction module defines eight custom extended instructions based on the RISC-V instruction set extension, and divides the custom extended instructions into initialization instructions, data load / store instructions, and operation instructions according to their functions; The initialization class instructions configure the polynomial ring parameters and the hardware unit status; the data load / store class instructions load the polynomial ring parameters into the cache; and the operation class instructions map the BFV homomorphic operation to the hardware acceleration unit.

3. The acceleration system for BFV homomorphic computing based on RISC-V according to claim 2, characterized in that: The instruction parser module identifies BFV instructions and parses operands in the pipeline decoding stage, generates hardware control signals, and distributes tasks to the parameter loading unit, NTT calculation unit, homomorphic operation control unit and modular reducer to ensure that each task is dynamically allocated to the corresponding unit.

4. The acceleration system for BFV homomorphic computing based on RISC-V according to claim 3, characterized in that: The BFV homomorphic computing hardware acceleration module is designed to include a state machine control management submodule, a data storage submodule, and a homomorphic operation submodule; The data storage submodule design includes a parameter loading unit, a data buffer and a data write-back unit. The homomorphic operation submodule design includes a homomorphic operation control unit, an NTT calculation unit and a modular reducer. According to the control signal, the parameter loading unit reads data, the butterfly operation unit performs the NTT transformation, the operation unit performs addition / multiplication, and the modular reducer processes the modular operation; finally, the write-back unit outputs the result and feeds back a completion signal to trigger subsequent operations, ultimately completing the accelerated implementation of the BFV algorithm.

5. The acceleration system for BFV homomorphic computing based on RISC-V according to claim 4, characterized in that: The specific implementation process of the custom extended instruction module is as follows: The RISC-V custom extension instruction design for accelerating BFV homomorphic computing includes eight custom instructions, namely, initializing the BFV module instruction, loading data instruction, executing NTT instruction, executing inverse NTT instruction, executing homomorphic addition instruction, executing homomorphic multiplication instruction, linear reconstruction instruction, and writing back data instruction; The initialization class instructions include initialization BFV module instructions, which are used to configure polynomial ring parameters and hardware acceleration unit status; the data loading / storage class instructions include load data instructions and write back data instructions, which are used to load polynomial coefficients from registers or memory to data buffers, or write calculation results back to storage units; the operation class instructions include execute NTT instructions, execute inverse NTT instructions, execute homomorphic addition instructions, execute homomorphic multiplication instructions, and linear reconstruction instructions. All operation class instructions are encoded as direct operation codes of the hardware acceleration unit; The initialization BFV module instruction is designed as an I-type instruction, the load data instruction and the write back data instruction are designed as S-type instructions, and other instructions are designed as R-type instructions.

6. The acceleration system for BFV homomorphic computing based on RISC-V according to claim 5, characterized in that: The instruction parser module is specifically implemented as follows: the custom instruction parser module is located in the instruction decoding stage of the RISC-V pipeline architecture, and serves as a hardware extension of the RISC-V basic instruction set decoding module to identify and parse the accelerated BFV special instructions.

7. The acceleration system for BFV homomorphic computing based on RISC-V according to claim 6, characterized in that: The BFV homomorphic computing hardware acceleration module is specifically implemented as follows: First, preload and initialize parameters. According to the control signal distributed by the instruction parser module, the parameter loading unit reads the polynomial ring parameters and key data from the register or memory and stores them into the data buffer. The key data includes the private key s, the public key pk, and the linear reconstruction key evk. Secondly, according to the control signal distributed by the instruction parser module, polynomial operations are performed. If it is an NTT instruction or an inverse NTT instruction: the butterfly operation unit is started, and the polynomial coefficient transformation is completed according to the divide-and-conquer strategy, and the intermediate results are temporarily stored in the cache; if it is a homomorphic addition instruction: the polynomial adder is called, and the input ciphertext coefficients are modularly added component by component, and the results are directly written to the output buffer; if it is a homomorphic multiplication instruction, it is executed in two stages. First, the tensor product is calculated, and the polynomial multiplication is accelerated by the NTT unit to generate intermediate terms; then a linear reconstruction operation is performed, combined with the linear reconstruction key evk, and the final ciphertext (c0, c1) is generated through modular multiplication and addition operations, where c0 contains the encrypted plaintext and noise, and c1 is the encrypted version of the random polynomial. Finally, modular operation or data write-back is performed based on the generated ciphertext. The modular reducer performs modular operation on the intermediate result to ensure that the data complies with the encryption constraints. The write-back unit transfers the final ciphertext result to the target storage address and feeds back a completion signal to the instruction parser.

Images