An efficient privacy intersection method and device based on homomorphic encryption

Abstract

The application provides an efficient privacy intersection method based on full homomorphic encryption, comprising: a privacy set intersection hardware including a host and an accelerator, the accelerator including a memory-intensive area and a calculation-intensive area; the calculation-intensive area obtains a power order required by the privacy set intersection according to the query ciphertext x; the memory-intensive area reads the plaintext coefficients of the database from the DRAM and performs plaintext multiplication and homomorphic addition operation with the power order to generate a sub-polynomial result; the calculation-intensive area reads the sub-polynomial result and performs homomorphic multiplication operation with the power order of high-order x to obtain a ciphertext result containing multiple polynomials; the calculation-intensive area performs homomorphic addition aggregation on the ciphertext result of the multiple polynomials and the sub-polynomial result without multiplication to obtain an aggregated ciphertext; and the calculation-intensive area performs a relinearization Relin operation on the aggregated ciphertext to convert it into a standard 2 polynomial ciphertext and returns it to the host.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of privacy protection and encryption calculation acceleration hardware design, and particularly relates to an efficient privacy intersection method and device based on full homomorphic encryption, a client, an electronic device, a computer readable storage medium and a computer program product. BACKGROUND

[0002] In the current era of big data, the efficiency and security of data processing become crucial. To deal with the problem of data privacy leakage in complex environments, privacy calculation emerges as the times require. Privacy set intersection (PSI) is a basic cryptographic protocol in privacy calculation, which allows two or more participants to calculate the intersection of their data sets without leaking their original data.

[0003] Among many PSI implementation schemes, the scheme based on full homomorphic encryption (FHE) is widely used due to its strong security guarantee. In a typical FHE-based PSI protocol, there is usually a sender (e.g., a service provider) holding a large data set and a receiver (e.g., a user) holding a small data set. The protocol flow is as follows: the receiver first encrypts each element in its set Y = y1, y2,..., y|Y| using the FHE scheme (such as the BFV scheme) to obtain the ciphertext set Y' = c1, c2,..., c|Y|, and sends it to the sender. The sender holds a large-scale data set X. For each ciphertext ci sent by the receiver, the sender needs to calculate an interpolation polynomial FX(ci) = ∏m∈X(m-ci). This calculation process is called "polynomial evaluation", which is the most core and complex part of the entire PSI protocol. After the calculation is completed, the sender returns the result to the receiver, and the receiver decrypts it. If it finds that the result of a certain FX(ci) is zero, it means that the corresponding element yi exists in the intersection X∩Y.

[0004] In order to accelerate the FHE computationally intensive task, academia and industry have developed a variety of general FHE hardware accelerators, such as Poseidon and FAB. These accelerators are usually designed as PCIe expansion cards connected to the host system. When processing large-scale PSI applications, their working mode is as follows: Figure 1As shown: Due to the limited on-board memory (such as DRAM) capacity of the accelerator itself, it cannot accommodate the entire large database (e.g. up to tens of GB or even hundreds of GB), so the database must be stored on the host's storage device (such as SSD or HDD). During the computation process, the data needs to be read from the host storage through the system's PCIe bus and transferred to the on-board memory of the accelerator for processing. These general-purpose accelerators are usually configured with a large amount of computing and storage resources in order to support complex FHE operations (such as bootstrapping operations) and larger encryption parameters (such as polynomial dimension N = 2^16).

[0005] Although general-purpose FHE accelerators can perform PSI computations, there are three significant problems and shortcomings when directly applying them to handle large-scale PSI tasks, which are the technical problems to be solved by the present application:

[0006] • Severe data transfer overhead and PCIe bottleneck: When processing large-scale databases, the data cannot be loaded into the on-board memory of the accelerator at once and must be continuously streamed from the host SSD during the computation process. This process relies heavily on the busy PCIe bus of the system, and the data transfer itself consumes a large amount of execution time. More critically, the data access pattern in PSI computation lacks temporal locality, i.e. each database entry is only used once in a query without the opportunity for reuse. This makes it extremely difficult to mask the PCIe communication overhead through pre-fetching, etc., and data transfer becomes the performance bottleneck of the entire system.

[0007] • Low hardware utilization and resource waste: The design goal of general-purpose FHE accelerators is to support complete FHE schemes, including complex operations such as bootstrapping and homomorphic automorphism, and they are configured with a large amount of computing and storage resources for this purpose. However, the core computation of PSI applications - polynomial evaluation, only uses a subset of FHE operations and does not require the above complex functions. In addition, PSI applications usually use smaller encryption parameters (e.g. polynomial dimension N = 2^13) than general-purpose scenarios. Therefore, using these "over-designed" general-purpose accelerators for complex scenarios to perform relatively simple PSI tasks will result in a large amount of computing, storage and bandwidth resources being idle, causing "computing power inversion" and serious waste of hardware resources.

[0008] • Inherent computational redundancy in PSI protocols: In existing PSI protocols (including the state-of-the-art APSI protocol), in order to control the ciphertext size growth after Homomorphic Multiplication (Hmul), a Relinearization (Relin) operation is usually performed immediately after each Hmul operation. Relinearization is one of the most time-consuming operations in FHE schemes. However, in the polynomial evaluation computation mode of PSI, all Hmul operations usually occur at the same computation depth and do not lead to an exponential explosion of ciphertext size. Therefore, performing a Relin operation immediately after each Hmul is "unnecessary", which constitutes a "significant redundant computation" and greatly affects the overall efficiency of the protocol. SUMMARY

[0009] The present application aims to solve the core problems of low performance and poor energy efficiency ratio faced by the prior art when executing large-scale FHE-based PSI applications. Specifically, the present application aims to solve the following three technical problems:

[0010] 1. The huge delay overhead and system PCIe bus bottleneck problem caused by data transmission between the host and the accelerator.

[0011] 2. The low hardware resource utilization and significant resource waste problem caused by over-designed functions of the general FHE accelerator when performing PSI tasks.

[0012] 3. The serious computational redundancy problem caused by unnecessary relinearization operations after each homomorphic multiplication in the existing PSI protocol computation process.

[0013] In view of the deficiencies of the prior art, as shown in Figure 4 The present application proposes an efficient FHE-based privacy intersection method, which includes:

[0014] An initial step, the privacy set intersection hardware includes a host and an accelerator, the accelerator includes a memory-intensive area and a computation-intensive area; the memory-intensive area is used to perform operations with low computational complexity but high data throughput requirements; the computation-intensive area is used to perform complex core homomorphic operations; the query ciphertext x is sent to the accelerator;

[0015] A sub-polynomial calculation step, the computation-intensive area obtains the power required by the query ciphertext x to perform the privacy set intersection according to the query ciphertext x; the memory-intensive area reads the plaintext coefficients of the database from the DRAM and performs plaintext multiplication PMul and homomorphic addition Hadd operations with the power to generate sub-polynomial results and write them to the PEIR buffer;

[0016] a homomorphic multiplication step, the compute-intensive region reads the sub-polynomial results from the PEIR buffer and performs a homomorphic multiplication Hmul operation with the higher order powers of x to obtain a ciphertext result containing multiple polynomials;

[0017] a relinearization step, the compute-intensive region uses its internal HAccumulate unit to aggregate the ciphertext results of the multiple polynomials and the sub-polynomial results without multiplication by homomorphic addition to obtain an aggregated ciphertext; the compute-intensive region performs a relinearization Relin operation on the aggregated ciphertext to convert it into a standard 2 polynomial ciphertext as the private set intersection result of the query ciphertext x, writes it back to the DRAM, and returns it to the host.

[0018] The efficient private set intersection method based on fully homomorphic encryption, wherein the relinearization step comprises:

[0019] For the sub-polynomial results without multiplication, the reading of the corresponding plaintext coefficients plain_a is arranged at the end of all data reading processes and is read from the PEIR buffer.

[0020] The efficient private set intersection method based on fully homomorphic encryption, wherein the query ciphertext x and the plaintext coefficients of the database are image, or text, or audio, or video data, and the private set intersection result represents the intersection data between the query ciphertext x and the plaintext coefficients of the database.

[0021] As shown in Figure 5 The present application further provides an efficient private set intersection module based on fully homomorphic encryption, comprising:

[0022] An initial module, the private set intersection hardware comprises a host and an accelerator, the accelerator comprising a memory-intensive region and a compute-intensive region; the memory-intensive region is used to perform operations with low computational complexity but high data throughput requirements; the compute-intensive region is used to perform core homomorphic operations with high complexity; the query ciphertext x is sent to the accelerator;

[0023] A sub-polynomial calculation module, the compute-intensive region obtains the power required for the query ciphertext x to perform the private set intersection according to the query ciphertext x; the memory-intensive region reads the plaintext coefficients of the database from the DRAM and performs plaintext multiplication PMul and homomorphic addition Hadd operations with the power to generate sub-polynomial results and write them into the PEIR buffer;

[0024] A homomorphic multiplication module, the computation-intensive region reads the sub-polynomial result from the PEIR buffer and performs a homomorphic multiplication Hmul operation with a high-order power of x to obtain a ciphertext result containing multiple polynomials;

[0025] A relinearization module, the computation-intensive region uses its internal HAccumulate unit for aggregating multiple sub-polynomial results to perform homomorphic addition aggregation on the ciphertext result of the multiple polynomials and the sub-polynomial result without multiplication to obtain an aggregated ciphertext; the computation-intensive region performs a relinearization Relin operation once on the aggregated ciphertext to convert it into a standard 2 polynomial ciphertext as a private set intersection result of the query ciphertext x, writes it back to the DRAM, and returns it to the host.

[0026] The efficient full homomorphic encryption-based private intersection module, wherein the relinearization module comprises:

[0027] For the sub-polynomial result without multiplication, the reading of the corresponding plaintext coefficient plain_a is arranged at the end of all data reading processes and is read from the PEIR buffer.

[0028] The efficient full homomorphic encryption-based private intersection module, wherein the query ciphertext x and the plaintext coefficients of the database are image, or text, or audio, or video data, and the private set intersection result represents intersection data between the query ciphertext x and the plaintext coefficients of the database.

[0029] The application further provides a client for the efficient full homomorphic encryption-based private intersection device.

[0030] The application further provides an electronic device comprising the efficient full homomorphic encryption-based private intersection device, and the electronic device is connected with an information display device for displaying the evaluation result in a user-set display parameter, attribute, or through an artificial intelligence model.

[0031] The application further provides a computer readable storage medium storing a computer program, and the computer program is executed by a processor to implement the steps of the efficient full homomorphic encryption-based private intersection method.

[0032] The application further provides a computer program product comprising a computer program, and the computer program is executed by a processor to implement the steps of the efficient full homomorphic encryption-based private intersection method.

[0033] The application realizes a great breakthrough in performance and energy efficiency through the above-mentioned software and hardware collaborative design. Compared with the prior art, the application has the following remarkable beneficial effects:

[0034] Extremely high performance improvement: Compared with the software solution running on a high-performance multi-core CPU (Intel Xeon W-1370), the system of the present application can achieve about 47.99 times performance acceleration when processing different sizes of data sets. Compared with the current most advanced FPGA-based general FHE accelerator, the performance of the present application also achieves a substantial breakthrough, which is 1.79 times higher than Poseidon and 1.93 times higher than FAB.

[0035] Excellent energy efficiency: In terms of energy efficiency, the advantage of the present application is more prominent in terms of energy-delay product (EDP) as a measure (the lower the better). Compared with FAB, the energy efficiency of the present application is improved by 10.95 times at most; compared with Poseidon, the energy efficiency is improved by 7.96 times at most. BRIEF DESCRIPTION OF DRAWINGS

[0036] Figure 1 The working mode diagram of the accelerator when processing large-scale PSI applications;

[0037] Figure 2 The difference comparison diagram between the present application and the prior art;

[0038] Figure 3 The overall architecture and internal computing logic diagram of the system of the present application;

[0039] Figure 4 The flowchart of the method of the present application;

[0040] Figure 5 The module diagram of the device of the present application;

[0041] Figure 6 The structure schematic diagram of the first electronic equipment of the present application;

[0042] Figure 7 The application environment structure schematic diagram of the first electronic equipment of the present application;

[0043] Figure 8 The structure schematic diagram of the second electronic equipment of the present application.

[0044] Reference signs:

[0045] A-First electronic equipment;

[0046] B-Private intersection device based on efficient homomorphic encryption;

[0047] C-Data acquisition equipment;

[0048] D-Information display equipment;

[0049] 1000-Second electronic equipment;

[0050] I - a calculation unit;

[0051] II - a ROM;

[0052] III - a RAM;

[0053] IV - a bus;

[0054] V - an interface;

[0055] VI - an input unit;

[0056] VII - an output unit;

[0057] VIII - a storage medium;

[0058] IX - a communication unit. DETAILED DESCRIPTION

[0059] It should be noted that the relational terms herein, such as first and second, and the like, are used solely to distinguish one from another entity or action without necessarily requiring or implying any actual relationship or order between such entities or actions. Moreover, the terms "comprises", "comprising", or any other variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but can include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0060] Without further limitation, an element defined by the phrase "comprising a" does not exclude the presence of additional identical elements in the process, method, article, or apparatus including the element.

[0061] The processor of the present application is the control center of the electronic device, which can be one processor or a collective term of multiple processing elements. For example, it can be one or more central processing units (CPU), or an application specific integrated circuit (ASIC), or one or more integrated circuits configured to implement embodiments of the present application, such as one or more digital signal processors (DSP), or one or more field-programmable gate arrays (FPGA).

[0062] Optionally, the processor can perform various functions of the electronic device by running or executing software programs stored in the memory and calling data stored in the memory.

[0063] In a particular implementation, as one example, the processors can include one or more CPUs. Each of the processors can be a single-CPU or a multi-CPU. The processor(s) can refer to one or more devices, circuits, and / or processing cores for processing data, such as computer program instructions. The electronic device can include a server, a desktop computer, a laptop computer, a smartphone, a tablet computer, an embedded computer, and the like, including vehicles and robots.

[0064] The memory is used to store the software program for implementing the solution of the present application, and is controlled by the processor to execute. The specific implementation can refer to the method embodiments described above, and will not be described here.

[0065] It should be noted that the structure of the electronic device shown in the drawings of the present application does not constitute a limitation thereon, and the actual knowledge structure recognition device can include more or fewer components than shown, or combine certain components, or different component arrangements.

[0066] The above embodiments can be implemented, in whole or in part, by software, hardware (such as a circuit), firmware, or any combination thereof. When implemented by software, the above embodiments can be implemented, in whole or in part, in the form of a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, they produce the processes or functions described in the embodiments of the present application in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable devices. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another, for example, the computer instructions can be transferred from one website, computer, server or data center to another website, computer, server or data center by wired (such as infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. containing one or more available medium collections. The available medium can be a magnetic medium (such as a floppy disk, a hard disk, a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium. The semiconductor medium can be a solid state disk.

[0067] It should also be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0068] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0069] It should also be understood that, in various embodiments of the present invention, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0070] In the several embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0071] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0072] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0073] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the parts that contribute to the prior art or parts of the technical solutions can be embodied in the form of a software product, which is stored in a storage medium and includes instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in various embodiments of the present application. The aforementioned storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0074] The inventors found that the above three problems are not isolated, but are interrelated and point to a deeper and more fundamental contradiction: the fundamental mismatch between the "load-compute-store" computing paradigm universally adopted by the prior art and the "streaming" data processing mode inherent in PSI applications.

[0075] The improvement ideas of the prior art are often isolated: some works focus on improving the computing speed of FHE (such as developing faster general-purpose accelerators), and some works may focus on improving the bus transmission rate (such as using a faster PCIe standard). However, the inventors, through analysis Figure 1 The end-to-end execution flow of PSI shown in the figure, recognized that the bottleneck exists in multiple links: data movement (PCIe bus), hardware architecture (resource utilization), and algorithm execution (computational redundancy).

[0076] This analysis process reveals that optimization of any single link cannot fundamentally solve the problem. A faster accelerator cannot perform if it is in a "starvation" state waiting for data; a faster bus cannot be efficient if it is supplying an algorithm that is inherently full of redundant computations.

[0077] Therefore, the key of the present application is the "reconstruction problem". Instead of following the old idea of "how to make FHE calculation faster", the present application proposes a completely new problem: "what should be the ideal, end-to-end, system-level solution for FHE-PSI, this change of perspective prompts the inventor to break out of the framework of general acceleration, and to creatively propose a "software and hardware collaborative design" scheme that must integrate algorithm optimization, hardware architecture and data flow depth. The scheme aims to solve the above three problems at the same time, eliminate redundant calculations through algorithm-level optimization, eliminate data movement bottlenecks and improve resource utilization through architectural-level innovation, and thus achieve a system-level overall performance breakthrough. This constitutes the core idea of the present application that is different from the prior art and has non-obviousness.

[0078] In order to achieve the above technical effects, the present application proposes the following key technical points:

[0079] Key point 1, a PSI calculation method of lazy relinearization; the present application proposes an optimization method for polynomial evaluation calculation in FHE-PSI. This method changes the standard calculation mode, reduces the amount of calculation by postponing the execution of time-consuming relinearization (Relin) operation. Specifically, it does not perform Relin immediately after each homomorphic multiplication (Hmul), but performs a unified and combined Relin operation only on the final aggregated result after completing all necessary Hmul and homomorphic addition (Hadd) aggregation calculations. This method significantly reduces the total number of Relin operation executions without affecting the correctness of the PSI protocol. Since Relin is one of the most time-consuming operations in FHE, this optimization can effectively reduce the overall calculation complexity and execution time of the PSI protocol.

[0080] Key point 2, a PSI accelerator system based on near-data processing (NDP); the present application proposes a hardware accelerator system dedicated to FHE-PSI, which is integrated inside a computational storage device (CSD). Its core architecture feature is to physically co-locate the computing unit with the storage unit (SSD) and directly connect the SSD controller with the computing logic through a point-to-point (P2P) data path, thereby completely bypassing the host CPU and system PCIe bus when processing databases. The internal computing logic is divided into two highly specialized and pipelined regions: a memory-bound (MB) region for processing simple polynomial operations and a computation-bound (CB) region for processing complex homomorphic operations. This architecture fundamentally eliminates the main data movement delay bottleneck in the prior art by pushing the computation to the data source. At the same time, the specially designed MB and CB regions can perfectly match the computing mode of PSI, ensuring efficient use of hardware resources and avoiding the waste of resources of general-purpose accelerators, thereby greatly improving the computing throughput and system energy efficiency.

[0081] To make the above features and effects of the present application more explicit and easy to understand, the following embodiments are specifically described below, and the detailed description is made in conjunction with the accompanying drawings. The present application discloses one or more embodiments containing the features of the present application. The disclosed embodiments are only for illustration. The protection scope of the present application is not limited to the disclosed embodiments, and the present application is defined by the appended claims.

[0082] I. Core algorithm - lazy relinearization

[0083] The lazy relinearization method proposed by the present application is a key algorithm optimization for high-performance PSI computation. The core idea is to minimize the number of expensive relinearization (Relin) operations by rearranging the computing mode. Figure 2 Intuitively shows the difference between the optimization method and the prior art.

[0084] Prior art computing flow (as shown in the upper half of Figure 2 In traditional PSI polynomial evaluation, for example, a 12th order polynomial is evaluated, the polynomial is decomposed into multiple sub-polynomials. The computing flow usually follows a fixed pattern of "multiplication-relinearization". For example, when an intermediate result is multiplied by the power of a query ciphertext (such as x 3After performing homomorphic multiplication (Hmul), a Relin operation is immediately executed, reducing the number of polynomials in the ciphertext from 3 to 2 to facilitate subsequent computations. In this example of a 12th-degree polynomial, a total of 3 Hmul operations are required, and therefore 3 Relin operations are also needed. Considering that Relin is one of the most computationally expensive operations in FHE, such frequent calls severely limit overall performance.

[0085] The optimized process of this invention (e.g.) Figure 2 (As shown in the lower half): The LazyRelin method proposed in this invention breaks the above-mentioned fixed pattern. After performing Hmul operations (e.g., Hmul x3, Hmul x6, Hmul x9), this method does not immediately perform a Relin operation. Instead, it allows the ciphertext of the computation result to temporarily remain in a state containing three polynomials. Subsequently, these unrelinearized intermediate results directly participate in subsequent homomorphic addition (Hadd) aggregation. Only after all multiplication and addition steps are completed, forming a final aggregated ciphertext, is a single Relin operation performed on this final result.

[0086] In this way, Figure 2 In the example of evaluating a 12th-degree polynomial shown, the Relin operation, which originally required 3 times, is reduced to only 1 time, significantly reducing computational overhead. As a trade-off, this method slightly increases the computational cost of homomorphic addition (PA) because the addition operation deals with ciphertext containing 3 polynomials instead of 2. However, since the computational complexity of addition is much lower than that of Relin, this cost is negligible. This optimization is feasible because all Hmul operations in PSI polynomial evaluation are at the same computational depth, preventing a cascading increase in ciphertext size; therefore, delaying the Relin operation is safe and correct.

[0087] II. Core Hardware System - Ares Accelerator Architecture:

[0088] The Ares accelerator system proposed in this invention is a near-data processing (NDP) hardware architecture optimized for PSI. It is designed to physically address data movement bottlenecks and efficiently execute the LazyRelin algorithm. This system can be implemented on a compute storage device (CSD), such as Samsung's SmartSSD, which integrates an FPGA chip, DRAM memory, and NAND flash memory. Figure 3 (a) illustrates the overall architecture and internal computing logic of the system.

[0089] System-level architecture (such as) Figure 3(a) Left half): The core of the Ares system proposed by the present application is a CSD that integrates storage, memory and computation. Unlike traditional accelerators, the PCIe switch inside the CSD not only connects the host, but also establishes a point-to-point (P2P) link between the FPGA computing circuit and the SSD controller. When performing a PSI query, the large-scale database stored in the NAND flash can be directly loaded into the on-chip buffer and DRAM of the FPGA through this P2P link, and the data stream does not pass through the host CPU and system PCIe bus at all, thereby rooting out the data transmission bottleneck.

[0090] Internal computing architecture (as shown in Figure 3 (a) Right half): The computing circuit of Ares is carefully divided into two function-specific, pipelined regions to match the computation flow of the LazyRelin algorithm:

[0091] Memory-Bound (MB Region): This region is responsible for performing operations with low computational complexity but high data throughput requirements. Specifically, it reads the plaintext coefficients of the database and the powers of the query ciphertext from the DRAM, and efficiently computes the individual sub-polynomials through cascaded plaintext multiplication (PMul) and homomorphic addition (Hadd) units. These operations are characterized by simple computation but huge data access.

[0092] Computation-Bound (CB Region): This region is responsible for performing core homomorphic operations with extremely high computational complexity. It contains a dedicated module for performing Hmul (containing NTT, modular multiplication, and modular addition units) and an HAccumulate unit for aggregating the results of multiple sub-polynomials, as shown in the second unit of the CB Region in the architecture diagram. Most importantly, the final and only Relin operation is also completed in this region. The region is also equipped with an independent evaluation key (EVK) buffer for storing the keys required for Relin.

[0093] Polynomial Evaluation Intermediate Result Buffer (PEIR Buffer): This is a one-way, asynchronous FIFO buffer that serves as a bridge between the MB region and the CB region. The sub-polynomial ciphertext results calculated by the MB region are stored in the PEIR buffer, which are then sequentially read by the CB region for subsequent Hmul computation. Its capacity does not need to be very large (for example, designed to cache 3 ciphertexts), because the performance of the MB and CB regions is carefully designed to be balanced, forming a bubble-free deep pipeline.

[0094] Scheduler: This is a finite state machine (FSM) responsible for communicating with the host-side driver, receiving queries and parameters, and controlling the state transition and data flow of the entire computing process.

[0095] The advancement of this architecture design lies in its high specialization and resource efficiency. By stripping away the complex functions (such as bootstrapping) that are not needed for PSI tasks, Ares can achieve higher specialized performance with less hardware resources. Compared with general-purpose FHE accelerators, Ares significantly reduces the consumption of logic resources (LUT), storage resources (BRAM), and digital signal processing units (DSP), typically by 2 to 5 times. This result of "achieving higher performance with less resources" precisely proves the non-obviousness and great superiority of the present invention's specialization design for specific applications.

[0096] III. Software and hardware collaborative workflow

[0097] The greatest innovation of the present invention lies in the deep synergy and perfect fit between the above-mentioned LazyRelin algorithm and the Ares hardware architecture. The algorithm creates a unique computing mode, while the hardware provides the optimal execution pipeline for this mode. This synergy effect is the fundamental reason for the performance breakthrough of the present invention and is the key to its differentiation from existing technologies. Ablation experiments have shown that applying the LazyRelin algorithm on a general-purpose accelerator can only bring about a weak performance improvement of about 3%; however, on the Ares architecture tailored for this algorithm, the performance improvement is nearly doubled, fully embodying the great value of software and hardware collaboration. Figure 3 (b) Detailed demonstration of this collaborative workflow, taking a 12th-degree polynomial evaluation as an example, the entire process is divided into three pipeline stages:

[0098] Stage 1: Sub-polynomial calculation

[0099] The host sends the user's query ciphertext x to Ares; the query ciphertext x is the ciphertext of small-scale data that needs to be queried, which needs to be matched with the data in the large database;

[0100] CB area: After receiving x, based on the requirements of the PSI algorithm, calculate the subsequent required powers, such as calculating all powers (e.g., x 1 ,x 2 ,x 3 ,...), or calculating x 1 ,x 2 ,x 3 ,x 6 ,x 9By combining these powers, all powers from 1 to 12 can be obtained through multiplication, eliminating the need to calculate all powers and reducing the number of multiplications, which are very expensive operations in homomorphic encryption. Since the same user can use the same key multiple times, the 'x' in these queries can be reused. Therefore, for multiple queries from the same user, this step only needs to be performed once.

[0101] MB region: At the same time, the MB region reads the plaintext coefficients (e.g., ...) from the database in DRAM. Figure 2 The polynomials a0, a1, a2, b0, b1, b2, c0, c1, c2, d0, d1, d2 are used, and the powers of x calculated from the CB region are subjected to PMul and Hadd operations to generate a subpolynomial result (e.g., Hmac_b = b0 + b1x). 1 +b2x 2 Because this invention uses near-memory computing, all calculations are performed in the SmartSSD, which is a solid-state drive. All hardware mentioned in the article, including DRAM, is in the SmartSSD.

[0102] Since the PSI algorithm protects the privacy of small-scale queries x rather than the privacy of the database, the database does not need to be encrypted; the database is essentially plaintext coefficients.

[0103] The computed subpolynomial ciphertext is written to the PEIR buffer, awaiting processing in the next stage. The PEIR buffer is the portion of the PEIR buffer sandwiched between the MB and CB Regions in the architecture diagram.

[0104] Phase 2: Homomorphic Multiplication (Hmul)

[0105] CB region: Reads subpolynomial results (e.g., PEIR_b) from the PEIR buffer and compares them with higher powers of x (e.g., x). 3 ,x 6 ,x 9 Perform the Hmul operation. For example, execute Hmul_b = PEIR_b × x 3 Higher-order powers originate from specific PSI algorithm parameter settings; higher-order powers refer to... Figure 2 The powers in the second layer.

[0106] The output of this stage is multiple unrelinearized ciphertext results containing three polynomials, which are temporarily stored in the local buffer of the CB region. Normally, a ciphertext contains two polynomials; if two ciphertexts are multiplied without relinearization, the resulting ciphertext will contain three polynomials. Because this invention delays relinearization, it results in three polynomials.

[0107] Phase 3: Aggregation and Final Relinearization

[0108] CB region: Using its internal HAccumulate unit, all Hmul results generated in stage 2, as well as subpolynomial results that do not require multiplication (see optimization points below), are homomorphically aggregated.

[0109] After all the results are summed together, the CB region performs a Relin operation on this final aggregated ciphertext, converting it into a standard, decryptable 2-polynomial ciphertext. Data in homomorphic encryption can be any computable value, including images, videos, audio, and text. The output 2-polynomial ciphertext can be the matching results between images, videos, audio, text, etc.

[0110] The final result is written back to DRAM via the output buffer and then returned to the host.

[0111] Elegant optimizations in the process: It is worth noting that in stage 1, for subpolynomials that do not need to participate in the multiplication operations in stage 2 (such as...) Figure 2 a0+a1x 1 +a2x 2 The reading of its corresponding plaintext coefficient (plain_a) is intentionally arranged at the end of all data reading processes; that is, reading plain_a refers to calculating the subpolynomial a0+a1x. 1 +a2x 2 Because this sub-polynomial does not participate in the second-level calculations, calculating it last allows for some overlap in read and compute time. The advantage of this is that once plain_a completes its Hmac_a calculation, it can directly proceed to the Had aggregation in stage 3 without waiting for a long time in the PEIR buffer, thus making more efficient use of limited memory bandwidth. This seemingly small detail has a cumulative effect on overall performance when dealing with large-scale databases containing thousands of polynomial evaluations.

[0112] The following are system embodiments corresponding to the above method embodiments. This embodiment can be implemented in conjunction with the above embodiments. The relevant technical details mentioned in the above embodiments are still valid in this embodiment, and will not be repeated here to reduce repetition. Accordingly, the relevant technical details mentioned in this embodiment can also be applied to the above embodiments.

[0113] like Figure 5 As shown, this invention also proposes an efficient privacy intersection module based on fully homomorphic encryption, which includes:

[0114] An initial module, the privacy set intersection hardware includes a host and an accelerator, the accelerator includes a memory-intensive area and a computation-intensive area; the memory-intensive area is used to perform operations with low computational complexity but high data throughput requirements; the computation-intensive area is used to perform core homomorphic operations with high complexity; the query ciphertext x is sent to the accelerator;

[0115] A sub-polynomial calculation module, the computation-intensive area obtains the power order required by the query ciphertext x to perform the privacy set intersection; the memory-intensive area reads the plaintext coefficients of the database from the DRAM and performs plaintext multiplication PMul and homomorphic addition Hadd operations with the power order to generate sub-polynomial results and write them into the PEIR buffer;

[0116] A homomorphic multiplication module, the computation-intensive area reads the sub-polynomial results from the PEIR buffer and performs homomorphic multiplication Hmul operations with the power order of x to obtain a ciphertext result containing multiple polynomials;

[0117] A relinearization module, the computation-intensive area uses its internal HAccumulate unit for aggregating multiple sub-polynomial results to perform homomorphic addition aggregation on the ciphertext results of the multiple polynomials and the sub-polynomial results without multiplication to obtain aggregated ciphertext; the computation-intensive area performs one relinearization Relin operation on the aggregated ciphertext to convert it into a standard 2 polynomial ciphertext as the privacy set intersection result of the query ciphertext x, writes it back to the DRAM, and returns it to the host.

[0118] The efficient privacy intersection module based on fully homomorphic encryption, wherein the relinearization module includes:

[0119] For the sub-polynomial result without multiplication, the reading of the corresponding plaintext coefficient plain_a is arranged at the end of all data reading processes and is read from the PEIR buffer.

[0120] The efficient privacy intersection module based on fully homomorphic encryption, wherein the query ciphertext x and the plaintext coefficients of the database are image, or text, or audio, or video data, and the privacy set intersection result represents the intersection data between the query ciphertext x and the plaintext coefficients of the database.

[0121] The application further provides a client for the any one of the efficient privacy intersection devices based on fully homomorphic encryption.

[0122] As shown in Figure 6 The application further provides a first electronic device A, which includes the efficient privacy intersection device B based on fully homomorphic encryption.

[0123] AsFigure 7 As shown, the first electronic device A can also be connected with the data collection device C and the information display device D through wired or wireless information transmission scheme, the data collection device C is used for collecting data to obtain the intersection of the privacy sets to be encrypted, and the information display device D is used for displaying the intersection result of the privacy sets obtained by the analysis of the application.

[0124] The information display device D can process the data output by the first electronic device A based on an information display mechanism to improve the readability of the data output by the first electronic device A. The information display mechanism can be manually preset, for example, the data output by the first electronic device A is visually displayed, which can display the specified information of the user according to the display parameters and / or attributes set by the user, the display parameters can be, for example, the display data range, the display attributes can be, for example, the display font, color, whether to scroll and play, etc. The user can understand the information more timely without accessing the secondary page or scrolling the page, which saves the operation of the user. Or the information display mechanism can be an artificial intelligence AI display model, which can learn the key information of the user according to the previous use habits of the user, such as the viewing time, the number of clicks, the number of edits, etc., and then automatically present the user with rich and necessary key information.

[0125] The application further provides a computer program product, the computer program product comprises a computer program, the computer program can be stored on a readable storage medium, when the computer program is executed by a processor, the computer can execute the efficient privacy intersection method based on full homomorphic encryption provided by the above-mentioned methods.

[0126] The present application also proposes, in another embodiment, a storage medium VIII for storing a computer program for implementing the efficient privacy intersection method based on homomorphic encryption. It should be understood that the storage medium in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically EPROM (EEPROM), or a flash memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example, but not limitation, many forms of random access memory (RAM) are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced SDRAM (ESDRAM), synchlink DRAM (SLDRAM), and direct rambus RAM (DR RAM).

[0127] Figure 8 A schematic block diagram of a second electronic device 1000 that can be used to implement embodiments of the present application is shown. The second electronic device 1000 is intended to represent various forms of digital computers, such as laptops, desktops, tablets, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The second electronic device 1000 can also represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, wearable devices, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be examples only, and are not intended to limit the inventiveness described and / or claimed in this document. The second electronic device 1000 can be the same as or different from the first electronic device A.

[0128] The second electronic device 1000 includes a computing unit I that can perform various appropriate actions and processes in accordance with a computer program stored in a read-only memory II (ROM) or a computer program loaded into a random access memory (RAM) III from a storage medium VIII. Various programs and data required for the operation of the device 1000 can also be stored in the RAM III. The computing unit I, the ROM II, and the RAM III are connected to each other through a bus IV. An input / output (I / O) interface V is also connected to the bus IV.

[0129] Various components in the second electronic device 1000 are connected to the I / O interface V, including an input unit VI such as a keyboard, a mouse, etc., an output unit VII such as various types of displays, a speaker, etc., a storage medium VIII such as a magnetic disk, an optical disk, etc., and a communication unit IX such as a network card, a modem, a wireless communication transceiver, etc. The communication unit IX allows the second electronic device 1000 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0130] The computing unit I can be various general and / or special-purpose processing components having processing and computing capabilities. Some examples of the computing unit I include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various computing units running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The computing unit I performs various methods and processes described above, such as the method steps S1-S4. For example, in some embodiments, the methods can be implemented as a computer software program tangibly embodied in a machine-readable medium, such as the storage medium VIII. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 1000 via the ROM II and / or the communication unit IX. When the computer program is loaded into the RAM III and executed by the computing unit I, one or more steps of the methods described above can be performed. Alternatively, in other embodiments, the computing unit I can be configured to perform the methods by any other appropriate means, such as by means of firmware.

[0131] While the embodiments of the present application have been disclosed as above, they are not limited to only the uses listed in the specification and the embodiments, and can be fully applied to various fields suitable for the present application, and additional modifications can be easily made by those skilled in the art, and thus the present application is not limited to specific details and the figures shown and described herein, without departing from the general concept defined by the claims and the equivalent scope.

Claims

1. A highly efficient privacy-preserving intersection method based on fully homomorphic encryption, characterized in that, include: The initial step involves finding the intersection of privacy sets using hardware including a host and an accelerator, which includes memory-intensive and compute-intensive regions. This memory-intensive region is used to perform operations with low computational complexity but high data throughput requirements; this computationally intensive region is used to perform high-complexity core homomorphic operations, sending the query ciphertext x to the accelerator. The subpolynomial computation step involves the computationally intensive region obtaining the power required to perform privacy set intersection on the query ciphertext x based on the query ciphertext x; the memory-intensive region reading the plaintext coefficients from the database from DRAM and performing plaintext multiplication (PMul) and homomorphic addition (Hadd) operations with the power to generate the subpolynomial result and write it to the PEIR buffer. The homomorphic multiplication step involves the computationally intensive region reading the subpolynomial result from the PEIR buffer and performing a homomorphic multiplication Hmul operation with the higher-order powers of x to obtain a ciphertext result containing multiple polynomials. In the relinearization step, the computationally intensive region uses its internal HAccumulate unit, which is used to aggregate the results of multiple subpolynomials, to perform homomorphic addition on the ciphertext results of the multiple polynomials and the subpolynomial results that do not require multiplication, to obtain aggregated ciphertext. The computationally intensive region then performs a relinearization Relin operation on the aggregated ciphertext, converting it into standard 2-polynomial ciphertext, which is used as the intersection result of the privacy set of the query ciphertext x, written back to DRAM, and returned to the host.

2. The efficient privacy-preserving intersection method based on fully homomorphic encryption as described in claim 1, characterized in that, The relinearization step includes: For the result of the subpolynomial that does not require multiplication, the reading of its corresponding plaintext coefficient plain_a is arranged at the end of all data reading processes, and is only read from the PEIR buffer.

3. The efficient privacy-preserving intersection method based on fully homomorphic encryption as described in claim 1, characterized in that, The ciphertext x of the query and the plaintext coefficients of the database are both image, text, audio, or video data. The intersection result of the privacy set represents the intersection data between the ciphertext x of the query and the plaintext coefficients of the database.

4. A highly efficient privacy-preserving intersection device based on fully homomorphic encryption, characterized in that, include: The initial module, the privacy set intersection hardware, includes a host and an accelerator, which includes memory-intensive regions and computationally intensive regions; This memory-intensive region is used to perform operations with low computational complexity but high data throughput requirements; this computationally intensive region is used to perform high-complexity core homomorphic operations; the query ciphertext x is sent to the accelerator; The subpolynomial computation module, a computationally intensive region, obtains the power required to perform privacy set intersection on the query ciphertext x based on the query ciphertext x; the memory-intensive region reads the plaintext coefficients from the database from DRAM and performs plaintext multiplication (PMul) and homomorphic addition (Hadd) operations with the power to generate the subpolynomial result and write it to the PEIR buffer. The homomorphic multiplication module reads the subpolynomial result from the PEIR buffer and performs a homomorphic multiplication Hmul operation with the higher-order powers of x to obtain a ciphertext result containing multiple polynomials. The relinearization module, a computationally intensive region, uses its internal HAccumulate unit, which aggregates the results of multiple subpolynomials, to perform homomorphic addition on the ciphertext results of the multiple polynomials and the subpolynomial results that do not require multiplication, to obtain aggregated ciphertext. The computationally intensive region then performs a relinearization Relin operation on the aggregated ciphertext, converting it into standard 2-polynomial ciphertext, which is used as the intersection result of the privacy set of the query ciphertext x, written back to DRAM, and returned to the host.

5. The efficient privacy intersection device based on fully homomorphic encryption as described in claim 4, characterized in that, The relinearization module includes: For the result of the subpolynomial that does not require multiplication, the reading of its corresponding plaintext coefficient plain_a is arranged at the end of all data reading processes, and is only read from the PEIR buffer.

6. The efficient privacy intersection device based on fully homomorphic encryption as described in claim 4, characterized in that, The ciphertext x of the query and the plaintext coefficients of the database are both image, text, audio, or video data. The intersection result of the privacy set represents the intersection data between the ciphertext x of the query and the plaintext coefficients of the database.

7. An electronic device, characterized in that, The device includes the efficient privacy intersection apparatus based on fully homomorphic encryption as described in any one of claims 4-6, wherein the electronic device is connected to an information display device, which displays the intersection result of the privacy set using user-set display parameters, attributes, or through an artificial intelligence model.

8. A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the efficient privacy intersection method based on fully homomorphic encryption as described in any one of claims 1-3.

9. A computer program product, comprising a computer program, characterized in that, When executed by a processor, the computer program implements the steps of the efficient privacy intersection method based on fully homomorphic encryption as described in any of claims 1-3.

Images