Efficient privacy intersection method and device based on fully homomorphic encryption

Abstract

The invention provides an efficient privacy intersection method based on fully homomorphic encryption, and the method comprises the steps: privacy set intersection hardware comprises a host and an accelerator, and the accelerator comprises a memory intensive region and a calculation intensive region; according to the query ciphertext x, the calculation-intensive region obtains a power required by the query ciphertext x to execute privacy set intersection; the memory intensive region reads a plaintext coefficient of the database from the DRAM, and performs plaintext multiplication and homomorphic addition operation with the power to generate a sub-polynomial result; the computation-intensive region reads the sub-polynomial result and performs homomorphic multiplication operation with the high-order x power to obtain a ciphertext result containing a plurality of polynomials; performing homomorphic addition aggregation on the ciphertext results of the multiple polynomials and the sub-polynomial results without multiplication by the computation-intensive region to obtain an aggregated ciphertext; and the computation-intensive region executes a relinearization Relin operation on the aggregated ciphertext, converts the aggregated ciphertext into a standard 2-polynomial ciphertext and returns the standard 2-polynomial ciphertext to the host.

Description

Technical Field

[0001] The present invention relates to the technical field of privacy protection and encryption computing acceleration hardware design, and in particular to an efficient privacy intersection method, device, client, electronic device, computer-readable storage medium and computer program product based on fully homomorphic encryption. Background Art

[0002] In the current era of big data, data processing efficiency and security have become crucial. Privacy computing has emerged to address the issue of data privacy leaks in complex environments. Private Set Intersection (PSI) is a fundamental cryptographic protocol in privacy computing that allows two or more parties to compute the intersection of their datasets without disclosing their original data.

[0003] Among the many PSI implementations, those based on fully homomorphic encryption (FHE) are widely used due to their strong security guarantees. In a typical FHE-based PSI protocol, there is a sender (e.g., a service provider) with a large dataset and a receiver (e.g., a user) with a smaller dataset. The protocol flow is as follows: the receiver first encrypts each element of its set Y = y1, y2, ..., y|Y| using an FHE scheme (such as the BFV scheme), obtaining a ciphertext set Y′ = c1, c2, ..., c|Y|, and sends it to the sender. The sender holds a large dataset X. For each ciphertext ci sent by the receiver, the sender must compute an interpolation polynomial FX(ci) = ∏m∈X(m-ci). This computational process, known as polynomial evaluation, is the core and most complex computational component of the entire PSI protocol. After the calculation is completed, the sender returns the result to the receiver. If the receiver finds that the result of a certain FX(ci) is zero after decryption, it means that the corresponding element yi exists in the intersection X∩Y.

[0004] To accelerate computationally intensive tasks like FHE, academia and industry have developed a variety of general-purpose FHE hardware accelerators, such as Poseidon and FAB. These accelerators are typically designed as PCIe expansion cards connected to the host system. When processing large-scale PSI applications, their working modes are as follows: Figure 1As shown in the figure: Because the accelerator's own onboard memory (such as DRAM) has limited capacity and cannot accommodate an entire large database (for example, tens or even hundreds of GB), the database must be stored on the host's storage device (such as an SSD or HDD). During the computation process, data needs to be read from the host storage via the system's PCIe bus and transferred to the accelerator's onboard memory for processing. To support complex FHE operations (such as bootstrapping) and large encryption parameters (such as polynomial dimension N = 2^16), these general-purpose accelerators are typically equipped with a large amount of computing and storage resources.

[0005] Although general-purpose FHE accelerators can perform PSI calculations, directly applying them to handle large-scale PSI tasks faces the following three significant problems and shortcomings, which are precisely the technical issues to be addressed by this invention:

[0006] Severe data transfer overhead and PCIe bottlenecks: When processing large-scale databases, data cannot be loaded all at once into the accelerator's onboard memory and must be continuously streamed from the host SSD during computation. This process relies heavily on the system's busy PCIe bus, and the data transfer itself consumes a significant amount of execution time. More critically, the data access pattern in PSI computations lacks temporal locality, meaning each database entry is used only once in a query, with no opportunity for reuse. This makes it extremely difficult to mask PCIe communication overhead through methods like prefetching, and data transfer becomes a performance bottleneck for the entire system.

[0007] Low hardware utilization and resource waste: General-purpose FHE accelerators are designed to support the complete FHE scheme, including complex operations such as bootstrapping and automorphism, and are equipped with massive computing and storage resources for this purpose. However, the core computation of PSI applications—polynomial evaluation—only uses a subset of FHE operations and does not require these complex functions. In addition, PSI applications typically use smaller encryption parameters than general-purpose scenarios (for example, the polynomial dimension N = 2^13). Therefore, using these general-purpose accelerators that are "overdesigned" for complex scenarios to perform relatively simple PSI tasks will result in a large amount of computing, storage, and bandwidth resources being idle, resulting in "computing power inversion" and serious waste of hardware resources.

[0008] Inherent computational redundancy in the PSI protocol: In existing PSI protocols (including the state-of-the-art APSI protocol), to control the size growth of the ciphertext after homomorphic multiplication (Hmul), a relinearization (Relin) operation is typically performed immediately after each Hmul operation. Relinearization is one of the most time-consuming operations in FHE schemes. However, in PSI's polynomial evaluation computation mode, all Hmul operations typically occur at the same computational depth and do not cause an exponential explosion in the ciphertext size. Therefore, performing a Relin operation immediately after each Hmul is "unnecessary" and constitutes "significant redundant computation," significantly affecting the overall efficiency of the protocol. Summary of the Invention

[0009] This invention aims to address the core issues of poor performance and energy efficiency faced by existing technologies when executing large-scale Fully Homomorphic Encryption-based Private Set Intersection (FHE-based PSI) applications. Specifically, this invention addresses the following three technical problems:

[0010] 1. Huge latency overhead and system PCIe bus bottleneck caused by data transmission between the host and accelerator.

[0011] 2. When general FHE accelerators perform PSI tasks, they suffer from low hardware resource utilization and significant resource waste due to over-design of functions.

[0012] 3. In the existing PSI protocol calculation process, there is a serious computational redundancy problem caused by performing unnecessary relinearization operations after each homomorphic multiplication.

[0013] In view of the shortcomings of existing technologies, such as Figure 4 As shown, the present invention proposes an efficient privacy intersection method based on fully homomorphic encryption, which includes:

[0014] In the initial step, the private set intersection hardware includes a host and an accelerator. The accelerator includes a memory-intensive area and a compute-intensive area. The memory-intensive area is used to perform operations with low computational complexity but high data throughput requirements. The compute-intensive area is used to perform core homomorphic operations with high complexity. The query ciphertext x is sent to the accelerator.

[0015] The subpolynomial calculation step: This computation-intensive area obtains the power required to perform privacy set intersection on the query ciphertext x based on the query ciphertext x. The memory-intensive area reads the plaintext coefficients from the database from DRAM and performs plaintext multiplication (PMul) and homomorphic addition (Hadd) operations on the power to generate the subpolynomial result and write it to the PEIR buffer.

[0016] Homomorphic multiplication step: This computationally intensive area reads the sub-polynomial result from the PEIR buffer and performs a homomorphic multiplication Hmul operation with a high-order power of x to obtain a ciphertext result containing multiple polynomials.

[0017] In the relinearization step, the computationally intensive region uses its internal HAccumulate unit for aggregating multiple sub-polynomial results to perform homomorphic addition aggregation on the ciphertext results of the multiple polynomials and the sub-polynomial results that do not require multiplication to obtain the aggregated ciphertext; the computationally intensive region performs a relinearization Relin operation on the aggregated ciphertext to convert it into a standard 2-polynomial ciphertext, which is used as the privacy set intersection result of the query ciphertext x, written back to DRAM, and returned to the host.

[0018] The efficient privacy intersection method based on fully homomorphic encryption, wherein the relinearization step includes:

[0019] For the sub-polynomial result that does not require multiplication, the reading of its corresponding plaintext coefficient plain_a is arranged at the end of all data reading processes and is read from the PEIR buffer.

[0020] The efficient privacy intersection method based on fully homomorphic encryption, wherein the query ciphertext x and the plaintext coefficients of the database are both images, text, audio, or video data, and the privacy set intersection result represents the intersection data between the query ciphertext x and the plaintext coefficients of the database.

[0021] like Figure 5 As shown, the present invention also proposes an efficient privacy intersection module based on fully homomorphic encryption, which includes:

[0022] In the initial module, the private set intersection hardware includes a host and an accelerator. The accelerator includes a memory-intensive area and a compute-intensive area. The memory-intensive area is used to perform operations with low computational complexity but high data throughput requirements. The compute-intensive area is used to perform core homomorphic operations with high complexity. The query ciphertext x is sent to the accelerator.

[0023] The sub-polynomial calculation module, a computationally intensive area, obtains the power required to perform privacy set intersection on the query ciphertext x based on the query ciphertext x. The memory-intensive area reads the plaintext coefficients from the database from DRAM, performs plaintext multiplication (PMul) and homomorphic addition (Hadd) operations on the power, generates the sub-polynomial result, and writes it to the PEIR buffer.

[0024] Homomorphic multiplication module, this computationally intensive area reads the sub-polynomial result from the PEIR buffer and performs a homomorphic multiplication Hmul operation with a high-order power of x to obtain a ciphertext result containing multiple polynomials;

[0025] The relinearization module uses its internal HAccumulate unit for aggregating multiple sub-polynomial results to perform homomorphic addition aggregation on the ciphertext results of the multiple polynomials and the sub-polynomial results that do not require multiplication to obtain the aggregated ciphertext. The computationally intensive area performs a relinearization Relin operation on the aggregated ciphertext to convert it into a standard 2-polynomial ciphertext, which is used as the privacy set intersection result of the query ciphertext x, written back to DRAM, and returned to the host.

[0026] The efficient privacy intersection module based on fully homomorphic encryption, wherein the relinearization module includes:

[0027] For the sub-polynomial result that does not require multiplication, the reading of its corresponding plaintext coefficient plain_a is arranged at the end of all data reading processes and is read from the PEIR buffer.

[0028] The efficient privacy intersection module based on fully homomorphic encryption, wherein the query ciphertext x and the plaintext coefficients of the database are both images, text, audio, or video data, and the privacy set intersection result represents the intersection data between the query ciphertext x and the plaintext coefficients of the database.

[0029] The present invention also proposes a client for use with any of the above-mentioned efficient privacy intersection devices based on fully homomorphic encryption.

[0030] The present invention also proposes an electronic device, which includes the aforementioned efficient privacy intersection device based on fully homomorphic encryption. The electronic device may be connected to an information display device, which is used to display the evaluation results using display parameters and attributes set by the user or through an artificial intelligence model.

[0031] The present invention also proposes a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of the efficient privacy intersection method based on fully homomorphic encryption are implemented.

[0032] The present invention also proposes a computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the steps of the efficient privacy intersection method based on fully homomorphic encryption are implemented.

[0033] The present invention achieves a significant breakthrough in performance and energy efficiency through the aforementioned software and hardware collaborative design. Compared with the prior art, the present invention has the following significant beneficial effects:

[0034] Significant performance improvement: Compared to a software solution running on a high-performance multi-core CPU (Intel Xeon W-1370), the system of this invention achieves a performance acceleration of approximately 47.99 times when processing datasets of varying sizes. It also significantly surpasses the most advanced general-purpose FPGA-based FHE accelerator, achieving a 1.79x improvement over Poseidon and a 1.93x improvement over FAB, respectively.

[0035] Excellent energy efficiency: The present invention's advantages are even more pronounced in terms of energy efficiency, measured by the Energy-Delay Product (EDP) (lower values ​​are better). Compared to FAB, the present invention's energy efficiency is up to 10.95 times higher, and compared to Poseidon, it's up to 7.96 times higher. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is a diagram of the accelerator's working mode when processing large-scale PSI applications;

[0037] Figure 2 A comparison diagram of the differences between the present invention and the prior art;

[0038] Figure 3 A schematic diagram of the overall architecture and internal calculation logic of the system of the present invention;

[0039] Figure 4 Flow chart of the method of the present invention;

[0040] Figure 5 This is a module diagram of the device of the present invention;

[0041] Figure 6 This is a schematic structural diagram of a first electronic device of the present invention;

[0042] Figure 7 This is a schematic diagram of the application environment structure of the first electronic device of the present invention;

[0043] Figure 8 This is a schematic structural diagram of a second electronic device according to the present invention.

[0044] Reference numerals:

[0045] A-First electronic device;

[0046] B-Efficient privacy intersection device based on fully homomorphic encryption;

[0047] C-data acquisition equipment;

[0048] D-information display device;

[0049] 1000- second electronic device;

[0050] Ⅰ-computing unit;

[0051] II-ROM;

[0052] III-RAM;

[0053] IV-bus;

[0054] V-interface;

[0055] VI-input unit;

[0056] VII-output unit;

[0057] VIII-Storage medium;

[0058] IX-Communication unit. DETAILED DESCRIPTION

[0059] It should be noted that, in this application, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus.

[0060] Without further constraints, an element defined by the phrase "comprises a..." does not preclude the existence of additional identical elements in the process, method, article or apparatus that includes the element.

[0061] The processor described in the present invention is the control center of an electronic device and can be a single processor or a collective term for multiple processing elements. For example, it can be one or more central processing units (CPUs), an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present invention, such as one or more digital signal processors (DSPs) or one or more field-programmable gate arrays (FPGAs).

[0062] Optionally, the processor can perform various functions of the electronic device by running or executing a software program stored in the memory, and calling data stored in the memory.

[0063] In a specific implementation, as an embodiment, the processor may include one or more CPUs. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). The processor here may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions). Electronic devices may include: servers, desktop computers, laptops, smartphones, tablet computers, embedded computers, etc., wherein the embedded computers include vehicles and robots, etc.

[0064] The memory is used to store the software program for executing the solution of the present invention, and the execution is controlled by the processor. The specific implementation method can refer to the above method embodiment and will not be repeated here.

[0065] It should be noted that the structure of the electronic device shown in the drawings of the present invention does not constitute a limitation thereto, and the actual knowledge structure recognition device may include more or fewer components than shown in the drawings, or a combination of certain components, or a different arrangement of components.

[0066] The above embodiments can be implemented in whole or in part through software, hardware (such as circuits), firmware, or any other combination. When implemented using software, the above embodiments can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer program are loaded or executed on a computer, the processes or functions described in accordance with the embodiments of the present invention are generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via a wired method (such as infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that contains a collection of one or more available media. The available medium can be a magnetic medium (such as a floppy disk, hard disk, or magnetic tape), an optical medium (such as a DVD), or a semiconductor medium. The semiconductor medium can be a solid-state drive.

[0067] It should also be understood that the term "and / or" in this document simply describes an association between related objects, indicating that three possible relationships exist. For example, "A and / or B" can represent: A alone, A and B together, or B alone. A and B can be singular or plural. Furthermore, the character " / " in this document generally indicates an "or" relationship between the related objects, but it may also indicate an "and / or" relationship. For specific understanding, please refer to the context.

[0068] In this disclosure, "at least one" means one or more, and "plurality" means two or more. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single or plural items. For example, "at least one of a, b, or c" can mean: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or plural.

[0069] It should also be understood that in various embodiments of the present invention, the size of the serial numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0070] In the several embodiments provided by the present invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another device, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interface, indirect coupling or communication connection of the device or unit, which can be electrical, mechanical or other forms.

[0071] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0072] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0073] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0074] During an in-depth study of the prior art, the inventors discovered that the above three problems do not exist in isolation, but are interrelated, pointing to a deeper fundamental contradiction: there is a fundamental mismatch between the "load-compute-store" computing paradigm commonly adopted by the prior art and the "streaming" data processing mode unique to the PSI application itself.

[0075] The improvement ideas of existing technologies are often isolated: some work focuses on improving the computing speed of FHE (such as developing faster general accelerators), while other work may be committed to improving the bus transmission rate (such as adopting a higher-speed PCIe standard). Figure 1 The PSI end-to-end execution flow shown recognizes that bottlenecks exist in multiple links: data movement (PCIe bus), hardware architecture (resource utilization), and algorithm execution (computational redundancy).

[0076] This analysis reveals that optimizing any single link cannot fundamentally solve the problem. Even the fastest accelerator won't perform as well if it's constantly starving for data. Even the fastest bus will remain inefficient if it's feeding an algorithm riddled with redundant computations.

[0077] Therefore, the key to this invention lies in the "reconstruction problem." Rather than following the conventional wisdom of "how to make FHE computations faster," this invention raises a fundamentally new question: "What would be an ideal, end-to-end, system-level solution for a specific workload like FHE-PSI?" This shift in perspective prompted the inventors to break away from the framework of general-purpose acceleration and pioneer a "hardware and software co-design" approach that deeply integrates algorithm optimization, hardware architecture, and data flow. This approach aims to simultaneously address these three issues, eliminating redundant computations through algorithmic optimization and improving resource utilization through architectural innovation, thereby achieving a breakthrough in overall system-level performance. This constitutes the non-obvious core concept of this invention that distinguishes it from existing technologies.

[0078] In order to achieve the above technical effects, the present invention proposes the following key technical points:

[0079] Key Point 1: A PSI calculation method with lazy relinearization. This invention proposes an optimization method for polynomial evaluation in FHE-PSI. This method changes the standard calculation mode and reduces the amount of computation by postponing the execution of time-consuming relinearization (Relin) operations. Specifically, instead of performing Relin immediately after each homomorphic multiplication (Hmul), it only performs a unified, combined Relin operation on the final aggregate result after completing all necessary Hmul and homomorphic addition (Hadd) aggregation calculations. This method significantly reduces the total number of relinearization operations without affecting the correctness of the PSI protocol. Since Relin is one of the most time-consuming operations in FHE, this optimization can effectively reduce the overall computational complexity and execution time of the PSI protocol.

[0080] Key Point 2: A PSI accelerator system based on near data processing (NDP); This invention proposes a hardware accelerator system specifically for FHE-PSI, integrated within a computational storage device (CSD). Its core architectural feature is the physical colocation of the computational unit and the storage unit (SSD), directly connecting the SSD controller and computational logic via a point-to-point (P2P) data path, completely bypassing the host CPU and system PCIe bus when processing databases. Its internal computational logic is divided into two highly specialized and pipelined regions: a memory-bound (MB) region for processing simple polynomial operations and a computation-bound (CB) region for processing complex homomorphic operations. By pushing computation to the source of the data, this architecture fundamentally eliminates the data movement latency bottleneck, a major issue in existing technologies. At the same time, the specially designed MB and CB areas can perfectly match the PSI computing mode, ensuring that hardware resources are efficiently utilized, avoiding the waste of resources of general accelerators, and thus significantly improving the computing throughput and system energy efficiency.

[0081] To illustrate the above-mentioned features and effects of the present invention more clearly and easily, the following embodiments are specifically described below with reference to the accompanying drawings. This specification discloses one or more embodiments incorporating the features of the present invention. The disclosed embodiments are for illustrative purposes only. The scope of protection of the present invention is not limited to the disclosed embodiments; the present invention is defined by the appended claims.

[0082] 1. Core Algorithm - Delay Relinearization

[0083] The lazy relinearization method proposed in this paper is a key algorithm optimization for achieving high-performance PSI calculations. Its core idea is to minimize the number of expensive relinearization operations by rearranging the calculation pattern. Figure 2 The difference between this optimization method and the existing technology is intuitively demonstrated.

[0084] Existing technology calculation process (such as Figure 2 (shown in the upper part): In traditional PSI polynomial evaluation, for example, to evaluate a 12th-degree polynomial, the polynomial is decomposed into multiple sub-polynomials. The computation process usually follows a fixed pattern of "multiplication-relinearization". For example, when an intermediate result is compared with the power of the query ciphertext (such as x 3After performing homomorphic multiplication (Hmul), a Relin operation is immediately performed, reducing the number of polynomials in the resulting ciphertext from three to two, facilitating subsequent computations. In this example with a 12th-degree polynomial, a total of three Hmul operations are required, and therefore three Relin operations are also required. Given that Relin is one of the most computationally expensive operations in FHE, this frequent call severely restricts overall performance.

[0085] The optimization process of the present invention (such as Figure 2 The LazyRelin method proposed in this paper breaks this fixed pattern. After performing an Hmul operation (e.g., Hmul x3, Hmul x6, Hmul x9), this method does not immediately perform a Relin operation. Instead, it allows the resulting ciphertext to temporarily remain in a state containing three polynomials. These unrelinearized intermediate results are then directly used in the subsequent homomorphic addition (Hadd) aggregation. Only after all multiplication and addition steps are completed, forming the final aggregate ciphertext, is the Relin operation performed on this final result, once and for all.

[0086] In this way, Figure 2 In the example of evaluating a 12-degree polynomial, three Relin operations are reduced to just one, significantly reducing computational overhead. This approach slightly increases the computational complexity of homomorphic addition (PA) because the addition operates on ciphertexts containing three polynomials instead of two. However, since the computational complexity of addition is much lower than that of Relin, this cost is negligible. This optimization is possible because all Hmul operations in the PSI polynomial evaluation operate at the same computational depth, preventing a chain reaction in the ciphertext size. Therefore, delaying the Relin operation is safe and correct.

[0087] 2. Core Hardware System - Ares Accelerator Architecture:

[0088] The Ares accelerator system proposed in this paper is a near data processing (NDP) hardware architecture optimized for PSI. It is designed to physically address data movement bottlenecks and efficiently execute the LazyRelin algorithm. The system can be implemented on a computational storage device (CSD), such as Samsung's SmartSSD, which integrates an FPGA chip, DRAM memory, and NAND flash memory. Figure 3 (a) shows the overall architecture and internal computing logic of the system.

[0089] System-level architecture (such as Figure 3(a) (left half): The core of the Ares system proposed in this paper is a CSD that integrates storage, memory, and computation. Unlike traditional accelerators, the PCIe switch chip within this CSD not only connects to the host but also establishes a point-to-point (P2P) link between the FPGA computing circuit and the SSD controller. When executing a PSI query, large-scale databases stored in NAND flash memory can be directly loaded into the FPGA's on-chip buffer and DRAM via this P2P link. The data flow completely bypasses the host CPU and the system PCIe bus, thus eliminating data transmission bottlenecks.

[0090] Internal computing architecture (such as Figure 3 (a) (right half): Ares' computational circuit is carefully divided into two functionally specific, pipelined regions to match the computational flow of the LazyRelin algorithm:

[0091] Memory-Bound Region (MB Region): This region is responsible for performing operations with low computational complexity but high data throughput requirements. Specifically, it reads the database's plaintext coefficients and query ciphertext powers from DRAM and efficiently computes each subpolynomial using a cascade of plaintext multiplication (PMul) and homomorphic addition (Hadd) units. These operations are characterized by simple computation but require access to a large amount of data.

[0092] Computation-Bound Region (CB Region): This region is responsible for performing core homomorphic operations with extremely high computational complexity. It includes a dedicated module for executing Hmul (including NTT, modular multiplication, modular addition, and other units) and an HAccumulate unit for aggregating the results of multiple subpolynomials, as shown in the second unit of the CB Region in the architecture diagram. Crucially, the final, single Relin operation is also completed in this region. This region also has a separate evaluation key (EVK) buffer for storing the key required for Relin.

[0093] Polynomial Evaluation Intermediate Result Buffer (PEIR Buffer): This is a unidirectional, asynchronous FIFO buffer that serves as a bridge between the MB and CB areas. Sub-polynomial ciphertexts computed in the MB are stored in the PEIR buffer, which is then read sequentially by the CB area for subsequent Hmul calculations. Its capacity does not need to be large (for example, it is designed to cache three ciphertexts) because the performance of the MB and CB areas is carefully balanced, resulting in a bubble-free deep pipeline.

[0094] Scheduler: This is a finite state machine (FSM) that is responsible for communicating with the host driver, receiving query tasks and parameters, and controlling the state transition and data flow of the entire computing process.

[0095] The advancement of this architectural design lies in its high degree of specialization and resource efficiency. By stripping away complex functionality not required for PSI tasks (such as bootstrapping), Ares is able to achieve higher specialized performance with fewer hardware resources. Compared to general-purpose FHE accelerators, Ares consumes significantly less logic resources (LUTs), memory resources (BRAM), and digital signal processing units (DSPs), typically by a factor of 2 to 5. This "higher performance with fewer resources" result demonstrates the non-obvious and immense superiority of this invention's specialized design for specific applications.

[0096] 3. Software and Hardware Collaborative Workflow

[0097] The greatest innovation of this invention lies in the deep synergy and perfect fit between the LazyRelin algorithm and the Ares hardware architecture. The algorithm creates a unique computing model, while the hardware provides an optimal execution pipeline for this model. This synergy is the fundamental reason for the performance breakthrough achieved by this invention and the key difference between it and existing technologies. Ablation experiments have shown that applying the LazyRelin algorithm on a general-purpose accelerator only brings a slight performance improvement of approximately 3%. However, on the Ares architecture tailored for this algorithm, the performance improvement is nearly doubled, fully demonstrating the tremendous value of software and hardware synergy. Figure 3 (b) shows this collaborative workflow in detail. Taking the evaluation of a 12th-degree polynomial as an example, the entire process is divided into three pipeline stages:

[0098] Phase 1: Subpolynomial calculation

[0099] The host sends the user's query ciphertext x to Ares; the query ciphertext x is the ciphertext of the small-scale data to be queried, which needs to be matched with the data in the large database;

[0100] CB area: After receiving x, based on the requirements of the PSI algorithm, calculate the subsequent required powers, such as calculating all powers (such as x 1 ,x 2 ,x 3 ,...), or calculate x 1 ,x 2 ,x 3 ,x 6 ,x 9By combining these powers, we can obtain all powers from 1 to 12 by multiplying them together. This eliminates the need to calculate all powers, reducing the number of multiplications, which are expensive operations in homomorphic encryption. As long as the same user uses the same key for multiple queries, the value x can be reused. Therefore, this step only needs to be performed once for multiple queries by the same user.

[0101] MB area: At the same time, the MB area reads the plaintext coefficients of the database from DRAM (such as Figure 2 a0, a1, a2, b0, b1, b2, c0, c1, c2, d0, d1, d2), and perform PMul and Hadd operations with the power of x calculated in the CB area to generate a sub-polynomial result (such as Hmac_b = b0 + b1x 1 +b2x 2 Since the present invention uses near-memory computing, all calculations are performed in the SmartSSD, that is, the solid-state drive. All hardware mentioned in the article, including DRAM, is also in the SmartSSD.

[0102] Since the PSI algorithm protects the privacy of small-scale queries x rather than the privacy of the database, the database does not need to be encrypted and the database is the plaintext coefficient.

[0103] The calculated sub-polynomial ciphertext is written to the PEIR buffer, awaiting processing in the next stage. The PEIR buffer is the portion of the PEIR buffer sandwiched between the MB and CB regions in the architecture diagram.

[0104] Phase 2: Homomorphic Multiplication (Hmul)

[0105] CB area: Read the subpolynomial result (such as PEIR_b) from the PEIR buffer and compare it with the high-order power of x (such as x 3 ,x 6 ,x 9 ) to perform Hmul operation. For example, execute Hmul_b=PEIR_b×x 3 The higher order powers come from the specific PSI algorithm parameter settings. Figure 2 The power in the second layer.

[0106] The output of this stage is multiple unrelinearized ciphertext results containing three polynomials. These results are temporarily stored in the local buffer of the CB area. Normally, a ciphertext contains two polynomials. If the two ciphertexts are multiplied without relinearization, the ciphertext will become three polynomials. Because the present invention delays relinearization, the ciphertext contains three polynomials.

[0107] Phase 3: Aggregation and final relinearization

[0108] CB region: Use the HAccumulate unit inside it to perform homomorphic addition aggregation on all Hmul results produced in stage 2 and sub-polynomial results that do not require multiplication (see optimization point below).

[0109] After all the results are accumulated, the CB region performs a Relin operation on the final aggregated ciphertext, converting it into a standard, decryptable 2-polynomial ciphertext. Homomorphically encrypted data can be any value worth computing, including images, videos, audio, and text. The output 2-polynomial ciphertext can be a matching result between images, videos, audio, or text.

[0110] The final result is written back to DRAM through the output buffer and returned to the host.

[0111] Subtle optimization in the process: It is worth noting that in stage 1, for sub-polynomials that do not need to participate in the multiplication operation in stage 2 (such as Figure 2 a0+a1x in 1 +a2x 2 ), the reading of its corresponding plaintext coefficient (plain_a) is intentionally arranged at the end of all data reading processes, that is, reading plain_a refers to the calculation of the sub-polynomial a0+a1x 1 +a2x 2 Because this sub-polynomial doesn't participate in the second-layer calculation, placing it last allows for overlap in read and calculation time. This allows the Hadd aggregation phase in phase 3 to proceed directly after plain_a completes its Hmac_a calculation, eliminating the need to wait in the PEIR buffer for a long time, thus making more efficient use of limited memory bandwidth. While this detail may be minor, its cumulative effect can positively impact overall performance when processing large-scale databases containing thousands of polynomial evaluations.

[0112] The following is a system embodiment corresponding to the above method embodiment. This embodiment can be implemented in conjunction with the above embodiment. The relevant technical details mentioned in the above embodiment are still valid in this embodiment and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiment.

[0113] like Figure 5 As shown, the present invention also proposes an efficient privacy intersection module based on fully homomorphic encryption, which includes:

[0114] In the initial module, the private set intersection hardware includes a host and an accelerator. The accelerator includes a memory-intensive area and a compute-intensive area. The memory-intensive area is used to perform operations with low computational complexity but high data throughput requirements. The compute-intensive area is used to perform core homomorphic operations with high complexity. The query ciphertext x is sent to the accelerator.

[0115] The sub-polynomial calculation module, a computationally intensive area, obtains the power required to perform privacy set intersection on the query ciphertext x based on the query ciphertext x. The memory-intensive area reads the plaintext coefficients from the database from DRAM, performs plaintext multiplication (PMul) and homomorphic addition (Hadd) operations on the power, generates the sub-polynomial result, and writes it to the PEIR buffer.

[0116] Homomorphic multiplication module, this computationally intensive area reads the sub-polynomial result from the PEIR buffer and performs a homomorphic multiplication Hmul operation with a high-order power of x to obtain a ciphertext result containing multiple polynomials;

[0117] The relinearization module uses its internal HAccumulate unit for aggregating multiple sub-polynomial results to perform homomorphic addition aggregation on the ciphertext results of the multiple polynomials and the sub-polynomial results that do not require multiplication to obtain the aggregated ciphertext. The computationally intensive area performs a relinearization Relin operation on the aggregated ciphertext to convert it into a standard 2-polynomial ciphertext, which is used as the privacy set intersection result of the query ciphertext x, written back to DRAM, and returned to the host.

[0118] The efficient privacy intersection module based on fully homomorphic encryption, wherein the relinearization module includes:

[0119] For the sub-polynomial result that does not require multiplication, the reading of its corresponding plaintext coefficient plain_a is arranged at the end of all data reading processes and is read from the PEIR buffer.

[0120] The efficient privacy intersection module based on fully homomorphic encryption, wherein the query ciphertext x and the plaintext coefficients of the database are both images, text, audio, or video data, and the privacy set intersection result represents the intersection data between the query ciphertext x and the plaintext coefficients of the database.

[0121] The present invention also proposes a client for use with any of the above-mentioned efficient privacy intersection devices based on fully homomorphic encryption.

[0122] like Figure 6 As shown, the present invention further proposes a first electronic device A in another embodiment, which includes the above-mentioned efficient privacy intersection device B based on fully homomorphic encryption.

[0123] like Figure 7 As shown, the first electronic device A can also be connected to the data acquisition device C and the information display device D through a wired or wireless information transmission scheme. The data acquisition device C is used to collect and obtain the data for the intersection of the privacy sets to be encrypted, and the information display device D is used to display the privacy set intersection results obtained by the analysis of the present invention.

[0124] The information display device D can organize and process the data output by the first electronic device A based on the information display mechanism to improve the readability of the data output by the first electronic device A. The information display mechanism can be manually preset, for example, the data output by the first electronic device A is visually displayed, which can be based on the display parameters and / or attributes set by the user. The display parameters can be, for example, the display data range, and the display attributes can be, for example, the display font, color, whether to scroll, etc. The user is presented with the key information specified by the user, and the user can understand this information more promptly without having to access the secondary page or scroll the page, saving the user's operation. Or the information display mechanism can be an artificial intelligence AI display model, which can learn the user's key information based on the user's previous usage habits, such as viewing time, number of clicks, number of edits, etc., and then automatically present the user with rich and necessary key information.

[0125] The present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a readable storage medium. When the computer program is executed by a processor, the computer can execute the efficient privacy intersection method based on fully homomorphic encryption provided by the above methods.

[0126] In another embodiment, the present invention further proposes a storage medium VIII for storing a computer program for executing the efficient privacy intersection method based on fully homomorphic encryption. It should be understood that the storage medium in the embodiment of the present invention can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of random access memory (RAM) are available, such as static RAM (SRAM), dynamic random access memory (DRAM), synchronous DRAM (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link DRAM (SLDRAM), and direct RAM bus RAM (DR RAM).

[0127] Figure 8 A schematic block diagram of a second electronic device 1000 that can be used to implement an embodiment of the present invention is shown. The second electronic device 1000 electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The second electronic device 1000 can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein. The second electronic device 1000 may be the same as or different from the first electronic device A.

[0128] The second electronic device 1000 includes a computing unit I, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory II (ROM) or a computer program loaded from a storage medium VIII into a random access memory (RAM) III. Various programs and data required for the operation of the device 1000 can also be stored in the RAM III. The computing unit I, ROM II, and RAM III are connected to each other via a bus IV. An input / output (I / O) interface V is also connected to the bus IV.

[0129] Multiple components in the second electronic device 1000 are connected to the I / O interface V, including: an input unit VI, such as a keyboard and mouse; an output unit VII, such as various types of displays and speakers; a storage medium VIII, such as a magnetic disk and optical disk; and a communication unit IX, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit IX allows the second electronic device 1000 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0130] Computing unit I can be various general and / or special processing components with processing and computing capabilities. Some examples of computing unit I include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. Computing unit I performs the various methods and processes described above, such as method steps S1-S4. For example, in some embodiments, the method can be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as a storage medium VIII. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 1000 via ROM II and / or communication unit IX. When the computer program is loaded into RAM III and executed by computing unit I, one or more steps of the method described above can be performed. Alternatively, in other embodiments, computing unit I can be configured to execute the method in any other appropriate manner (e.g., by means of firmware).

[0131] Although the embodiments of the present invention have been disclosed above, they are not limited to the applications listed in the description and implementation methods. They can be fully applied to various fields suitable for the present invention. For those familiar with the art, additional modifications can be easily implemented. Therefore, without departing from the general concept defined by the claims and the scope of equivalents, the present invention is not limited to the specific details and illustrations shown and described herein.

Claims

1. An efficient privacy intersection method based on fully homomorphic encryption, characterized by: include: In the initial step, the privacy set intersection hardware includes a host and an accelerator, and the accelerator includes a memory-intensive area and a computation-intensive area; The memory-intensive area is used to perform operations with low computational complexity but high data throughput requirements; the computation-intensive area is used to perform core homomorphic operations with high complexity. Send the query ciphertext x to the accelerator; The subpolynomial calculation step: This computation-intensive area obtains the power required to perform privacy set intersection on the query ciphertext x based on the query ciphertext x. The memory-intensive area reads the plaintext coefficients from the database from DRAM and performs plaintext multiplication (PMul) and homomorphic addition (Hadd) operations on the power to generate the subpolynomial result and write it to the PEIR buffer. Homomorphic multiplication step: This computationally intensive area reads the sub-polynomial result from the PEIR buffer and performs a homomorphic multiplication Hmul operation with a high-order power of x to obtain a ciphertext result containing multiple polynomials. In the relinearization step, the computationally intensive region uses its internal HAccumulate unit for aggregating multiple sub-polynomial results to perform homomorphic addition aggregation on the ciphertext results of the multiple polynomials and the sub-polynomial results that do not require multiplication to obtain the aggregated ciphertext; the computationally intensive region performs a relinearization Relin operation on the aggregated ciphertext to convert it into a standard 2-polynomial ciphertext, which is used as the privacy set intersection result of the query ciphertext x, written back to DRAM, and returned to the host.

2. The efficient privacy intersection method based on fully homomorphic encryption as described in claim 1 is characterized in that: The relinearization step includes: For the sub-polynomial result that does not require multiplication, the reading of its corresponding plaintext coefficient plain_a is arranged at the end of all data reading processes and is read from the PEIR buffer.

3. The efficient privacy intersection method based on fully homomorphic encryption as claimed in claim 1, characterized in that: The query ciphertext x and the plaintext coefficients of the database are both images, text, audio, or video data, and the intersection result of the privacy set represents the intersection data between the query ciphertext x and the plaintext coefficients of the database.

4. An efficient privacy intersection module based on fully homomorphic encryption, characterized by: include: Initial module, the privacy set intersection hardware includes a host and an accelerator, and the accelerator includes a memory-intensive area and a computation-intensive area; The memory-intensive area is used to perform operations with low computational complexity but high data throughput requirements; the computation-intensive area is used to perform core homomorphic operations with high complexity; the query ciphertext x is sent to the accelerator; The sub-polynomial calculation module, a computationally intensive area, obtains the power required to perform privacy set intersection on the query ciphertext x based on the query ciphertext x. The memory-intensive area reads the plaintext coefficients from the database from DRAM, performs plaintext multiplication (PMul) and homomorphic addition (Hadd) operations on the power, generates the sub-polynomial result, and writes it to the PEIR buffer. Homomorphic multiplication module, this computationally intensive area reads the sub-polynomial result from the PEIR buffer and performs a homomorphic multiplication Hmul operation with a high-order power of x to obtain a ciphertext result containing multiple polynomials; The relinearization module uses its internal HAccumulate unit for aggregating multiple sub-polynomial results to perform homomorphic addition aggregation on the ciphertext results of the multiple polynomials and the sub-polynomial results that do not require multiplication to obtain the aggregated ciphertext. The computationally intensive area performs a relinearization Relin operation on the aggregated ciphertext to convert it into a standard 2-polynomial ciphertext, which is used as the privacy set intersection result of the query ciphertext x, written back to DRAM, and returned to the host.

5. The efficient privacy intersection module based on fully homomorphic encryption as described in claim 4 is characterized in that: The relinearization module includes: For the sub-polynomial result that does not require multiplication, the reading of its corresponding plaintext coefficient plain_a is arranged at the end of all data reading processes and is read from the PEIR buffer.

6. The efficient privacy intersection module based on fully homomorphic encryption as described in claim 4 is characterized in that: The query ciphertext x and the plaintext coefficients of the database are both images, text, audio, or video data, and the intersection result of the privacy set represents the intersection data between the query ciphertext x and the plaintext coefficients of the database.

7. A client, used for any one of the efficient privacy intersection devices based on fully homomorphic encryption described in claims 4-6.

8. An electronic device, characterized in that: It includes an efficient privacy intersection device based on fully homomorphic encryption as described in claims 4-6, and the electronic device is connected to an information display device, which is used to display the evaluation results using display parameters and attributes set by the user or through an artificial intelligence model.

9. A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the efficient privacy intersection method based on fully homomorphic encryption as described in any one of claims 1-3.

10. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the efficient privacy intersection method based on fully homomorphic encryption described in any one of claims 1 to 3 are implemented.

Images