TFHE fully homomorphic bootstrap operation acceleration method and device

Abstract

The invention discloses a TFHE fully homomorphic bootstrap operation acceleration method and device. According to the method, a plurality of to-be-bootstrapped ciphertexts form batches with fixed sizes, the batches serve as a whole and are input into a bootstrapping pipeline structure to be processed, meanwhile, all the ciphertexts in each batch share bootstrapping key data loaded at a time, and the off-chip storage access frequency and bandwidth requirements are effectively reduced. Each stage of the bootstrap operation is configured to be an independent calculation module, and the calculation modules are sequentially connected according to a predetermined sequence to form a pipeline structure, so that different batches of ciphertexts can be processed at the same time in different stages of a pipeline, and the utilization rate and throughput rate of hardware resources are remarkably improved. Besides, a data handling strategy from the off-chip memory to the on-chip ping-pong buffer area is introduced, calculation interruption caused by waiting for data loading is avoided through overlapping of calculation and handling time, and the efficiency of bootstrap operation is further improved.

Description

Technical Field

[0001] The present application relates to the field of fully homomorphic encryption technology, and in particular to a TFHE fully homomorphic bootstrapping operation acceleration method and device. Background Art

[0002] Fully homomorphic encryption is an encryption technique that allows computations to be performed directly on ciphertext, producing the same result as the plaintext upon decryption. The core principle of fully homomorphic encryption lies in its ability to support arithmetic and logical operations on encrypted data, such as addition and multiplication, while maintaining the correct results after decryption. This provides an excellent solution for the need for "available but invisible" data. However, as various homomorphic operations are performed, noise accumulates in the data. When this accumulation reaches a certain level, it affects the accuracy of the ciphertext. To prevent this noise accumulation, homomorphic encryption algorithms employ bootstrapping. The idea behind bootstrapping is that when a maximum number of homomorphic operations on the ciphertext is reached, the ciphertext is decrypted and then re-encrypted through re-encryption, removing the noise and resetting the encryption state, thereby restoring the data's validity. By iteratively invoking bootstrapping, an arbitrary number of homomorphic operations can be performed on the ciphertext, and various fully homomorphic encryption schemes employ different bootstrapping schemes.

[0003] TFHE is a fully homomorphic encryption scheme based on the LWE ciphertext. It enables efficient logical operations through rapid bootstrapping of Boolean circuits. Compared to other homomorphic encryption schemes, TFHE offers the fastest bootstrapping operation and supports arbitrary Boolean circuits composed of logic gates, making it suitable for hardware acceleration. However, due to the strong data dependencies of the bootstrapping algorithm, a serialized design is required, resulting in high latency and low throughput. Summary of the Invention

[0004] To address the problems of high latency and low throughput in existing homomorphic encryption accelerators, the embodiments of the present application provide a TFHE fully homomorphic bootstrapping operation acceleration method and device. This application uses a structured data processing method to optimize the data scheduling path of the circuit, alleviate data handling bottlenecks, improve overall computing efficiency and power consumption efficiency, and has good versatility and scalability.

[0005] In a first aspect, a TFHE fully homomorphic bootstrapping operation acceleration method is provided, the method comprising:

[0006] S1, multiple ciphertexts to be bootstrapped are grouped into batches of fixed size and fed into the bootstrapping pipeline structure as a whole for processing. At the same time, all ciphertexts in each batch share the bootstrapping key data that is loaded once;

[0007] S2 uses a serialized pipeline structure to process each batch, allowing different ciphertexts to flow in parallel in different modules;

[0008] S3 introduces a data transfer strategy from off-chip memory to on-chip ping-pong buffer. During each round of execution, the bootstrap key required for the current round is read from one buffer, and the data required for the next round is synchronously transferred from off-chip memory to another buffer. By overlapping the calculation and transfer time within the pipeline structure, calculation interruptions caused by waiting for data loading are avoided.

[0009] Optionally, in S1, multiple ciphertexts to be bootstrapped are grouped into batches of fixed size, specifically including:

[0010] A preset number of ciphertexts to be bootstrapped are grouped into a batch, and the batch is input as a whole into the bootstrapped pipeline structure for processing.

[0011] Optionally, in S2, a serialized pipeline structure is used to process each batch, specifically including:

[0012] The blind rotation, CMux operation, sample extraction, and key switching stages in the bootstrap operation are mapped to independent computing units respectively; in each cycle, a structure is formed in which multiple ciphertexts are executed in parallel at different stages of the pipeline.

[0013] Optionally, in S3, a data transfer strategy from an off-chip memory to an on-chip ping-pong buffer is introduced, specifically including:

[0014] During each round of CMux execution, the bootstrap key required for the current round is read from a buffer, and the data required for the next round is moved from the off-chip memory to another buffer.

[0015] Optionally, in S2, different ciphertexts flow in parallel in different modules, specifically including:

[0016] Through timing control, different ciphertexts enter the various stages of the pipeline in sequence, realizing parallel processing of multiple ciphertexts at different stages of the pipeline.

[0017] In a second aspect, a TFHE fully homomorphic bootstrapping operation acceleration device is provided, the device comprising:

[0018] The loading module is used to group multiple ciphertexts to be bootstrapped into batches of fixed size and input them into the bootstrapped pipeline structure as a whole for processing. At the same time, all ciphertexts in each batch share the bootstrapped key data loaded once;

[0019] The processing module is used to process each batch using a serialized pipeline structure, so that different ciphertexts flow in parallel in different modules;

[0020] The transport module is used to introduce a data transport strategy from off-chip memory to the on-chip ping-pong buffer. During each round of execution, the bootstrap key required for the current round is read from one buffer, and the data required for the next round is synchronously transported from the off-chip memory to another buffer. With the help of the time overlap of calculation and transportation in the pipeline structure, calculation interruptions caused by waiting for data loading are avoided.

[0021] In a third aspect, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, any of the methods described in the first aspect is implemented.

[0022] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, any method described in the first aspect is implemented.

[0023] In a fifth aspect, a computer program product is provided, on which a computer program is stored, and when the computer program is executed by a processor, any of the methods described in the first aspect is implemented.

[0024] The beneficial effects of the technical solution provided by the embodiments of the present application include grouping multiple ciphertexts to be bootstrapped into batches of fixed size and processing them using a pipeline structure, so that different batches of ciphertexts can be processed simultaneously at different stages of the pipeline. This batch processing and pipeline design significantly improves the utilization of hardware resources, reduces module idle time, and thus greatly improves the overall throughput. For example, at an operating frequency of 500MHz, the batch operation throughput of the bootstrapped pipeline accelerator implemented in this application can reach 877 bootstrapped ciphertexts per second, with excellent energy efficiency performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] To more clearly illustrate the embodiments of this application or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are merely illustrative, and those skilled in the art can derive other implementation drawings based on the provided drawings without inventive effort.

[0026] Figure 1 A flowchart of the steps of a TFHE fully homomorphic bootstrapping operation acceleration method provided in an embodiment of the present application;

[0027] Figure 2 A schematic diagram of a bootstrap pipeline accelerator based on batch processing provided in an embodiment of the present application;

[0028] Figure 3 A schematic diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0029] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0030] In the description of the present application, the terms "including", "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or apparatus comprising a series of steps or units is not necessarily limited to those steps or units that have been explicitly listed, but may also include other steps or units that are not explicitly listed but are inherent to these processes, methods, products or apparatuses, or steps or units that are added based on further optimization schemes conceived in the present application.

[0031] To address the high latency and low throughput issues of existing homomorphic encryption accelerators, this application proposes a batch bootstrapping pipeline acceleration method and architecture for TFHE fully homomorphic encryption systems. Through structured data processing, this application optimizes the circuit's data scheduling path, alleviates data handling bottlenecks, and improves overall computing and power efficiency, demonstrating excellent versatility and scalability.

[0032] This application uses the TFHE encryption scheme (Torus-based Fully Homomorphic Encryption) as its background and optimizes the underlying hardware for the "programmable bootstrapping" operation, which carries the greatest computational overhead. The bootstrapping operation primarily includes blind rotations, CMux operations, sample extraction, and key switching. These stages have strict data dependencies, and traditional architectures employ serial scheduling, leading to issues such as underutilization of arithmetic unit resources. To address this, this application employs a multi-batch, high-throughput, streaming, serial pipeline computing architecture. By batching multiple pending TLWE ciphertexts and streaming them into the bootstrapping accelerator, each module continuously receives valid data input, eliminating idle resources caused by inter-module waiting. Furthermore, each batch uses the same set of bootstrapping key GGSW ciphertexts, significantly improving overall computational throughput.

[0033] Please refer to Figure 1 , which shows a flowchart of a TFHE fully homomorphic bootstrapping operation acceleration method provided by an embodiment of the present application. The method may include the following steps:

[0034] S1, multiple ciphertexts to be bootstrapped are grouped into batches of fixed size and input into the bootstrapped pipeline structure as a whole for processing. At the same time, all ciphertexts in each batch share the bootstrapped key data that is loaded once.

[0035] Bootstrapping is a re-encryption operation in fully homomorphic encryption that removes noise from ciphertext and restores its validity, thereby enabling any number of homomorphic operations on the ciphertext. Batching involves combining multiple ciphertexts to be bootstrapped into a fixed-size set, which is then fed into the bootstrapping pipeline as a whole for processing, improving processing efficiency and throughput.

[0036] The plurality of ciphertexts to be bootstrapped are grouped into batches of a fixed size, specifically comprising grouping a preset number of ciphertexts to be bootstrapped into a batch, and inputting the batch as a whole into the bootstrapped pipeline structure for processing. In this embodiment, the preset number is preferably 16.

[0037] Specifically, in this step, TLWE ciphertexts are loaded in batches and shared with secret keys, where TLWE is a type of ciphertext in a torus-based fully homomorphic encryption (FHE) scheme. Multiple TLWE ciphertexts are grouped into batches of fixed size and input into the bootstrap pipeline structure as a whole for processing. Since TLWE ciphertexts are small in size and easy to cache, while GGSW keys are large in size (about tens of kB), all ciphertexts in each batch share the GGSW bootstrap key data that is loaded once, effectively reducing the frequency and bandwidth requirements of off-chip storage accesses. For a batch, the number of TLWE ciphertexts should be determined based on the latency of the accelerator. The best effect is achieved when the number of input ciphertexts matches the latency. This application selects a batch of 16 TLWE ciphertexts to be bootstrapped.

[0038] S2 uses a serialized pipeline structure to process each batch, so that different ciphertexts flow in parallel in different modules.

[0039] A serialized pipeline structure is used to process each batch, specifically assigning the blind rotation, CMux operation, sample extraction, and key switching phases of the bootstrapping operation to independent computational units. Within each cycle, multiple ciphertexts are executed in parallel at different stages of the pipeline. Timing control allows different ciphertexts to enter each stage of the pipeline in sequence, enabling parallel processing of multiple ciphertexts at different stages of the pipeline.

[0040] Specifically, this step utilizes a streaming serial pipeline structure. The accelerator employs a serialized pipeline structure, with each functional module (blind rotation, CMux, FFT / IFFT, etc.) corresponding to an independent computational unit. During each cycle, different ciphertexts flow in parallel through different modules, creating a "multiple ciphertexts executed in parallel at different stages of the pipeline" architecture, achieving high arithmetic unit utilization.

[0041] S3 introduces a data transfer strategy from off-chip memory to on-chip ping-pong buffer. During each round of execution, the bootstrap key required for the current round is read from one buffer, and the data required for the next round is synchronously transferred from off-chip memory to another buffer. By overlapping the calculation and transfer time within the pipeline structure, calculation interruptions caused by waiting for data loading are avoided.

[0042] Specifically, this step optimizes overlapping computation and data transfer. Because the GGSW key cannot be fully cached on-chip, this application introduces a data transfer strategy that involves transferring data from a DDR (Double Data Rate, typically a type of dynamic random access memory) to an on-chip ping-pong buffer. During each CMux round, the GGSW key required for the current round is read from one buffer, while the data required for the next round is simultaneously transferred from the DDR to another buffer. This overlap of computation and transfer time within the pipeline structure effectively avoids interruptions to CMux computations caused by waiting for data loading, eliminating the potential for off-chip access delays to pipeline execution.

[0043] In this application, the serial pipeline computing logic based on the bootstrap accelerator reduces the idle time of the arithmetic unit and maximizes the throughput by inputting the TLWE ciphertexts to be bootstrapped in batches. The bootstrap accelerator includes analog-to-digital switching, blind selection conversion, sample extraction, and key switching. Due to the strong dependency of data in each module, a serialized design is required. The pipeline architecture allows multiple ciphertexts to be bootstrapped to run simultaneously in different modules, so that each module has data to process, avoiding idle resources.

[0044] The TLWE ciphertexts to be bootstrapped are input in batches. The two most important inputs in the bootstrapped operation are the TLWE ciphertexts to be bootstrapped and the bootstrapped key GGSW ciphertext, which are used to perform the CMux operation. By batching multiple TLWE ciphertexts into a pipeline structure, the present invention enables them to share the GGSW key data that is loaded once, significantly reducing the number of off-chip accesses and improving the overall hardware accelerator's throughput, energy efficiency, and memory bandwidth utilization. To further improve the processing efficiency of the blind rotation phase of the bootstrapped operation, the present invention utilizes a GGSW ciphertext transfer mechanism from off-chip DDR to an on-chip ping-pong buffer. A strategy that overlaps computation and transfer time is used to avoid latency associated with off-chip accesses.

[0045] Experimental verification shows that at an operating frequency of 500 MHz, the bootstrap pipeline accelerator implemented in this application has a delay of 18.2 ms and a batch operation throughput of 877 bootstrap ciphertexts per second, with excellent energy efficiency performance.

[0046] This application uses the above innovative technologies to achieve a high-throughput, low-resource, and non-storage-bottleneck TFHE bootstrap acceleration solution, which is particularly suitable for large-scale homomorphic encryption computing needs in scenarios such as cloud computing, privacy-preserving AI reasoning, and encrypted databases. Figure 2 A schematic diagram of a bootstrap pipeline accelerator based on batch processing is given.

[0047] The present application also provides a block diagram of a TFHE fully homomorphic bootstrap operation acceleration device. The system may include:

[0048] The loading module is used to group multiple ciphertexts to be bootstrapped into batches of fixed size and input them into the bootstrapped pipeline structure as a whole for processing. At the same time, all ciphertexts in each batch share the bootstrapped key data loaded once;

[0049] The processing module is used to process each batch using a serialized pipeline structure, so that different ciphertexts flow in parallel in different modules;

[0050] The transport module is used to introduce a data transport strategy from off-chip memory to the on-chip ping-pong buffer. During each round of execution, the bootstrap key required for the current round is read from one buffer, and the data required for the next round is synchronously transported from the off-chip memory to another buffer. With the help of the time overlap of calculation and transportation in the pipeline structure, calculation interruptions caused by waiting for data loading are avoided.

[0051] The specific definitions of the TFHE fully homomorphic bootstrap operation acceleration device can be found in the definitions of the TFHE fully homomorphic bootstrap operation acceleration method above and will not be repeated here. Each module in the aforementioned TFHE fully homomorphic bootstrap operation acceleration device can be implemented in whole or in part via software, hardware, or a combination thereof. Each of these modules can be embedded in or independent of a processor in a computer device in hardware form, or stored in a computer device memory in software form, so that the processor can call and execute the corresponding operations of each module.

[0052] In one embodiment, an electronic device is provided. The electronic device may be a computer, and its internal structure diagram may be as follows: Figure 3As shown. The electronic device includes a processor, memory, and a network interface connected via a system bus. The processor of the device is used to provide computing and control capabilities. The memory of the device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program, and a database. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The database of the computer device is used for TFHE fully homomorphic bootstrap operation acceleration data. The network interface of the computer device is used to communicate with an external terminal via a network connection. When executed by the processor, the computer program implements a TFHE fully homomorphic bootstrap operation acceleration method.

[0053] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0054] In one embodiment of the present application, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned TFHE fully homomorphic bootstrapping operation acceleration method are implemented.

[0055] In one embodiment of the present application, a computer program product is provided, including a computer program / instructions, which, when executed by a processor, implements the steps of the above-mentioned TFHE fully homomorphic bootstrapping operation acceleration method.

[0056] The computer-readable storage medium and computer program product provided in this embodiment have similar implementation principles and technical effects to those of the above-mentioned method embodiments, and are not described in detail here.

[0057] Those skilled in the art will understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application may include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in M ​​forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), memory bus (RaMbus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0058] The technical features of the above-mentioned embodiments can be combined arbitrarily. In order to make the description concise, not all possible combinations of the technical features in the above-mentioned embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0059] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that a person of ordinary skill in the art may make various modifications and improvements without departing from the spirit of the present application, and these modifications and improvements fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A TFHE fully homomorphic bootstrap operation acceleration method, characterized in that: The method comprises: S1, multiple ciphertexts to be bootstrapped are grouped into batches of fixed size and fed into the bootstrapping pipeline structure as a whole for processing. At the same time, all ciphertexts in each batch share the bootstrapping key data that is loaded once; S2 uses a serialized pipeline structure to process each batch, allowing different ciphertexts to flow in parallel in different modules; S3 introduces a data transfer strategy from off-chip memory to on-chip ping-pong buffer. During each round of execution, the bootstrap key required for the current round is read from one buffer, and the data required for the next round is synchronously transferred from off-chip memory to another buffer. By overlapping the calculation and transfer time within the pipeline structure, calculation interruptions caused by waiting for data loading are avoided.

2. The method according to claim 1, characterized in that In S1, multiple ciphertexts to be bootstrapped are grouped into batches of fixed size, specifically including: A preset number of ciphertexts to be bootstrapped are grouped into a batch, and the batch is input as a whole into the bootstrapped pipeline structure for processing.

3. The method according to claim 1, characterized in that In S2, a serialized pipeline structure is used to process each batch, including: The blind rotation, CMux operation, sample extraction, and key switching stages in the bootstrap operation are mapped to independent computing units respectively; in each cycle, a structure is formed in which multiple ciphertexts are executed in parallel at different stages of the pipeline.

4. The method according to claim 3, characterized in that In S3, a data transfer strategy from off-chip memory to on-chip ping-pong buffer is introduced, specifically including: During each round of CMux execution, the bootstrap key required for the current round is read from a buffer, and the data required for the next round is moved from the off-chip memory to another buffer.

5. The method according to claim 1, wherein In S2, different ciphertexts flow in parallel in different modules, including: Through timing control, different ciphertexts enter the various stages of the pipeline in sequence, realizing parallel processing of multiple ciphertexts at different stages of the pipeline.

6. A TFHE fully homomorphic bootstrap operation acceleration device, characterized in that: The device comprises: The loading module is used to group multiple ciphertexts to be bootstrapped into batches of fixed size and input them into the bootstrapped pipeline structure as a whole for processing. At the same time, all ciphertexts in each batch share the bootstrapped key data loaded once; The processing module is used to process each batch using a serialized pipeline structure, so that different ciphertexts flow in parallel in different modules; The transport module is used to introduce a data transport strategy from off-chip memory to the on-chip ping-pong buffer. During each round of execution, the bootstrap key required for the current round is read from one buffer, and the data required for the next round is synchronously transported from the off-chip memory to another buffer. With the help of the time overlap of calculation and transportation in the pipeline structure, calculation interruptions caused by waiting for data loading are avoided.

7. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the method according to any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium, characterized in that A computer program is stored thereon, and when the computer program is executed by a processor, the method according to any one of claims 1 to 5 is implemented.

9. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the method according to any one of claims 1 to 5 is implemented.

Images