A method and apparatus for accelerating TFHE fully homomorphic bootstrap computation

Abstract

This application discloses a method and apparatus for accelerating TFHE fully homomorphic bootstrapping operations. The method groups multiple ciphertexts to be bootstrapping into fixed-size batches and inputs them as a whole into a bootstrapping pipeline structure for processing. Simultaneously, all ciphertexts within each batch share a single-loaded bootstrapping key, effectively reducing the frequency and bandwidth requirements of off-chip memory access. Each stage of the bootstrapping operation is configured as an independent computation module and connected sequentially in a predetermined order to form a pipeline structure. This allows different batches of ciphertexts to be processed simultaneously at different stages of the pipeline, significantly improving hardware resource utilization and throughput. Furthermore, this application introduces a data transfer strategy from off-chip memory to an on-chip ping-pong buffer. By overlapping computation and transfer times, computation interruptions caused by waiting for data loading are avoided, further improving the efficiency of the bootstrapping operation.

Description

Technical Field

[0001] This application relates to the field of fully homomorphic encryption technology, and in particular to a TFHE fully homomorphic bootstrap computation acceleration method and apparatus. Background Technology

[0002] Fully homomorphic encryption (HCI) is an encryption technique that allows direct computation on ciphertext and yields the same result as the plaintext upon decryption. The core principle of HCI lies in its support for arithmetic and logical operations on encrypted data, including addition and multiplication, while the result remains correct after decryption. This provides an excellent solution for the requirement of "usable but not visible" data. However, as various homomorphic operations are performed, noise accumulates in the data. When this noise reaches a certain level, it affects the accuracy of the ciphertext. To prevent noise accumulation, HCI proposes a bootstrap operation. The idea behind bootstrap is that when the number of homomorphic operations on the ciphertext reaches its limit, the ciphertext is decrypted and then re-encrypted through re-encryption, thus clearing the noise and resetting the encryption state, thereby restoring the validity of the data. Iterative calls to bootstrap allow for any number of homomorphic operations on the ciphertext, and the bootstrap schemes vary among different HCI schemes.

[0003] TFHE is a fully homomorphic encryption scheme based on LWE ciphertext, capable of achieving efficient logic operations through rapid bootstrapping evaluation of Boolean circuits. Compared to other homomorphic encryption schemes, TFHE boasts the fastest bootstrapping operation and supports arbitrary Boolean circuits composed of logic gates, making it suitable for hardware-accelerated processing. However, due to the strong data dependencies in the bootstrapping algorithm, a serialized design is required, resulting in excessively high latency and low throughput. Summary of the Invention

[0004] To address the issues of high latency and low throughput in existing homomorphic encryption accelerators, this application provides a TFHE fully homomorphic bootstrap computing acceleration method and apparatus. This application optimizes the data scheduling path of the circuit through structured data processing, alleviates data transfer bottlenecks, and improves overall computing efficiency and power efficiency, exhibiting good versatility and scalability.

[0005] Firstly, a method for accelerating TFHE fully homomorphic bootstrapping computation is provided, which includes:

[0006] S1, multiple ciphertexts to be bootstrapping are grouped into a fixed-size batch and input as a whole into the bootstrap pipeline structure for processing. At the same time, all ciphertexts in each batch share the bootstrap key data loaded once.

[0007] S2 employs a serialized pipeline structure to process each batch, allowing different ciphertexts to flow in parallel across different modules;

[0008] S3 introduces a data transfer strategy from off-chip memory to on-chip ping-pong buffers. During each round of execution, the bootstrap key required for the current round is read from one buffer, and the data required for the next round is synchronously transferred from off-chip memory to another buffer. By leveraging the overlap of computation and transfer times within the pipeline structure, computation interruptions caused by waiting for data loading are avoided.

[0009] Optionally, in S1, multiple ciphertexts to be bootstrapping are grouped into a batch of fixed size, specifically including:

[0010] A batch of a preset number of ciphertexts to be bootstrapped is formed, and the batch is input as a whole into the bootstrap pipeline structure for processing.

[0011] Optionally, in S2, a serialized pipeline structure is used to process each batch, specifically including:

[0012] The blind rotation, CMux operation, sample extraction, and key switching stages in the bootstrap operation are each assigned to an independent computing unit; in each cycle, a structure is formed in which multiple ciphertexts are executed in parallel at different stages of the pipeline.

[0013] Optionally, in S3, a data transfer strategy from off-chip memory to on-chip ping-pong buffer is introduced, specifically including:

[0014] During each round of CMux execution, the bootstrap key required for the current round is read from one buffer, while the operation of moving the data required for the next round from off-chip memory to another buffer is initiated.

[0015] Optionally, in S2, different ciphertexts flow in parallel in different modules, specifically including:

[0016] By controlling the timing, different ciphertexts are sequentially entered into different stages of the pipeline, enabling parallel processing of multiple ciphertexts at different stages of the pipeline.

[0017] Secondly, a TFHE fully homomorphic bootstrap computation acceleration device is provided, the device comprising:

[0018] The loading module is used to combine multiple ciphertexts to be bootstrapping into a fixed-size batch and input them as a whole into the bootstrap pipeline structure for processing. At the same time, all ciphertexts in each batch share the bootstrap key data loaded once.

[0019] The processing module is used to process each batch using a serialized pipeline structure, allowing different ciphertexts to flow in parallel in different modules;

[0020] The data transfer module is used to introduce a data transfer strategy from off-chip memory to on-chip ping-pong buffers. During each round of execution, the bootstrap key required for the current round is read from one buffer, and the data required for the next round is synchronously transferred from off-chip memory to another buffer. By leveraging the overlap of computation and data transfer times within the pipeline structure, computation interruptions caused by waiting for data loading are avoided.

[0021] Thirdly, an electronic device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement any of the methods described in the first aspect above.

[0022] Fourthly, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements any of the methods described in the first aspect above.

[0023] Fifthly, a computer program product is provided, on which a computer program is stored, wherein the computer program, when executed by a processor, implements any of the methods described in the first aspect above.

[0024] The beneficial effects of the technical solution provided in this application include grouping multiple ciphertexts to be bootstrapping into fixed-size batches and processing them using a pipeline structure, allowing different batches of ciphertexts to be processed simultaneously at different stages of the pipeline. This batch processing and pipeline design significantly improves the utilization of hardware resources, reduces module idle time, and thus greatly improves the overall throughput. For example, at an operating frequency of 500MHz, the batch processing throughput of the bootstrap pipeline accelerator implemented in this application can reach 877 bootstrap ciphertexts per second, demonstrating excellent energy efficiency. Attached Figure Description

[0025] To more clearly illustrate the embodiments of this application or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are merely exemplary, and those skilled in the art can derive other embodiments based on the provided drawings without creative effort.

[0026] Figure 1 A flowchart illustrating the steps of a TFHE fully homomorphic bootstrap computation acceleration method provided in this application embodiment;

[0027] Figure 2 A schematic diagram of a bootstrap pipeline accelerator based on batch processing concept provided for embodiments of this application;

[0028] Figure 3 This is a schematic diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0029] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0030] In the description of this application, the terms "comprising," "having," and any variations thereof are intended to cover non-exclusive inclusion, such as a process, method, system, product, or apparatus that includes a series of steps or units, not necessarily limited to those steps or units that are expressly listed, but may also include other steps or units that are not expressly listed but are inherent to these processes, methods, products, or apparatuses, or steps or units added based on further optimizations conceived in this application.

[0031] To address the issues of high latency and low throughput in existing homomorphic encryption accelerators, this application proposes a batch processing bootstrapping pipeline acceleration method and architecture for TFHE fully homomorphic encryption systems. This application optimizes the data scheduling path of the circuit through structured data processing, alleviates data transport bottlenecks, and improves overall computational and power efficiency, exhibiting good versatility and scalability.

[0032] This application focuses on the TFHE encryption scheme (Torus-based Fully Homomorphic Encryption) and optimizes the underlying hardware for the computationally most expensive "programmable bootstrapping" operation. The bootstrapping operation mainly includes blind rotation, CMux computation, sample extraction, and key switching, with strict data dependencies between each stage. Traditional architectures use a serial scheduling scheme, leading to insufficient utilization of arithmetic unit resources. To address this, this application employs a multi-batch, high-throughput streaming serial pipelined computing structure. By grouping multiple unprocessed TLWE ciphertexts into batches and feeding them into the bootstrapping accelerator in batches, each module continuously receives valid data input, eliminating resource idleness caused by waiting between modules. Furthermore, using the same bootstrapping key GGSW ciphertext within the same batch significantly improves the overall computational throughput.

[0033] Please refer to Figure 1 The document illustrates a flowchart of a TFHE fully homomorphic bootstrap computation acceleration method provided in an embodiment of this application. This method may include the following steps:

[0034] S1 groups multiple ciphertexts to be bootstrapping into a fixed-size batch and inputs them as a whole into the bootstrap pipeline structure for processing. At the same time, all ciphertexts in each batch share the bootstrap key data loaded once.

[0035] Bootstrapping refers to a re-encryption operation in fully homomorphic encryption, used to remove noise from ciphertext and restore its validity, thereby supporting any number of homomorphic operations on the ciphertext. Batch refers to combining multiple ciphertexts to be bootstrapping into a fixed-size set, inputting it as a whole into the bootstrapping pipeline for processing, in order to improve processing efficiency and throughput.

[0036] Multiple ciphertexts to be bootstrapping are grouped into a fixed-size batch. Specifically, this involves grouping a preset number of ciphertexts to be bootstrapping into a single batch and inputting this batch as a whole into the bootstrapping pipeline structure for processing. In this embodiment, the preset number is preferably 16.

[0037] Specifically, in this step, TLWE ciphertext is loaded in batches and the key is shared. TLWE is a ciphertext type in a torus-based fully homomorphic encryption (FHE) scheme. Multiple TLWE ciphertexts are grouped into fixed-size batches and input as a whole into the bootstrap pipeline structure for processing. Since TLWE ciphertexts are small and easy to cache, while GGSW keys are large (approximately tens of kB), all ciphertexts within each batch share a single-loaded GGSW bootstrap key, effectively reducing the frequency and bandwidth requirements of off-chip memory access. The number of TLWE ciphertexts in a batch depends on the accelerator's latency; optimal performance is achieved when the number of input ciphertexts matches the latency. This application selects 16 TLWE ciphertexts to be bootstrapped as a batch input.

[0038] S2 employs a serialized pipeline structure to process each batch, allowing different ciphertexts to flow in parallel across different modules.

[0039] The system employs a serialized pipeline structure to process each batch. Specifically, it assigns independent computational units to the blind rotation, CMux operation, sample extraction, and key switching stages of the bootstrapping operation. Within each cycle, multiple ciphertexts are executed in parallel at different stages of the pipeline. Through timing control, different ciphertexts are sequentially entered into different stages of the pipeline, achieving parallel processing of multiple ciphertexts at different stages.

[0040] Specifically, this step employs a streaming serial pipeline structure. The accelerator internally uses a serialized pipeline structure, with each functional module (blind spin, CMux, FFT / IFFT, etc.) corresponding to an independent computation unit. In each cycle, different ciphertexts flow in parallel within different modules, thus forming a structure where "multiple ciphertexts are executed in parallel at different stages of the pipeline," achieving high arithmetic unit utilization.

[0041] S3 introduces a data transfer strategy from off-chip memory to on-chip ping-pong buffers. During each round of execution, the bootstrap key required for the current round is read from one buffer, and the data required for the next round is synchronously transferred from off-chip memory to another buffer. By leveraging the overlap of computation and transfer times within the pipeline structure, computation interruptions caused by waiting for data loading are avoided.

[0042] Specifically, this step involves overlapping computation and data transport optimization. Since the GGSW key cannot be fully cached on-chip, this application introduces a data transport strategy from DDR (DDR stands for Double Data Rate, typically referring to a type of dynamic random access memory) to an on-chip ping-pong buffer (a buffer is a temporary storage area used to temporarily store data during data transfer. The main function of a buffer is to solve the problem of data transfer speed mismatch or to provide temporary storage space during data processing). During each round of CMux execution, the GGSW key required for the current round is read from one buffer, and the data required for the next round is synchronously transported from DDR to another buffer. By leveraging the time overlap between computation and transport within the pipeline structure, computational interruptions caused by waiting for data loading in CMux are effectively avoided, and the blockage of pipeline execution by off-chip access latency is eliminated.

[0043] This application utilizes a serial pipelined computation logic based on a bootstrap accelerator. By batch inputting the TLWE ciphertext to be bootstrapped, it reduces the idle time of the arithmetic unit and maximizes throughput. The bootstrap accelerator includes analog-to-digital switching, blind selection conversion, sample extraction, and key switching. Due to the strong dependency of data in each module, a serial design is required. The pipelined architecture allows multiple ciphertexts to be bootstrapped to run simultaneously in different modules, ensuring that each module has data to process and avoiding resource idleness.

[0044] The TLWE ciphertext to be bootstrapping is input in batches. The two most important inputs in the bootstrapping operation are the TLWE ciphertext to be bootstrapping and the bootstrapping key GGSW ciphertext, which are used for CMux operations. This invention significantly reduces the number of off-chip accesses and improves the overall throughput, energy efficiency, and memory bandwidth utilization of the hardware accelerator by batch inputting multiple TLWE ciphertexts into the pipeline structure, allowing them to share the one-time loaded GGSW key data. To further improve the processing efficiency of the blind spin stage in the bootstrapping operation, this invention adopts a GGSW ciphertext transfer mechanism from off-chip DDR to on-chip ping-pong buffer, and avoids the waiting time caused by off-chip accesses by using a strategy of overlapping computation and transfer times.

[0045] Experiments have verified that, at a working frequency of 500MHz, the bootstrap pipeline accelerator implemented in this application has a latency of 18.2ms and a batch processing throughput of 877 bootstrap ciphertexts per second, demonstrating excellent energy efficiency.

[0046] This application, through the aforementioned innovative technologies, achieves a high-throughput, low-resource, and storage-bottlenecked TFHE bootstrapping acceleration solution, which is particularly suitable for large-scale homomorphic encrypted computing needs in scenarios such as cloud computing, privacy-preserving AI inference, and encrypted databases. Figure 2 A schematic diagram of a bootstrap pipeline accelerator based on the batch processing concept is presented.

[0047] This application also provides a block diagram of a TFHE fully homomorphic bootstrap computing acceleration device. The system may include:

[0048] The loading module is used to combine multiple ciphertexts to be bootstrapping into a fixed-size batch and input them as a whole into the bootstrap pipeline structure for processing. At the same time, all ciphertexts in each batch share the bootstrap key data loaded once.

[0049] The processing module is used to process each batch using a serialized pipeline structure, allowing different ciphertexts to flow in parallel in different modules;

[0050] The data transfer module is used to introduce a data transfer strategy from off-chip memory to on-chip ping-pong buffers. During each round of execution, the bootstrap key required for the current round is read from one buffer, and the data required for the next round is synchronously transferred from off-chip memory to another buffer. By leveraging the overlap of computation and data transfer times within the pipeline structure, computation interruptions caused by waiting for data loading are avoided.

[0051] Specific limitations regarding the TFHE fully homomorphic bootstrap computing acceleration device can be found in the above description of the limitations of the TFHE fully homomorphic bootstrap computing acceleration method, and will not be repeated here. Each module in the aforementioned TFHE fully homomorphic bootstrap computing acceleration device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independent of the processor in the computer device, or stored in software in the memory of the computer device, so that the processor can call and execute the operations corresponding to each module.

[0052] In one embodiment, an electronic device is provided, which may be a computer, and its internal structure diagram may be as follows: Figure 3As shown, the electronic device includes a processor, memory, and a network interface connected via a system bus. The processor provides computational and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores the operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage medium. The database of the computer device is used for TFHE (Fully Homomorphic Bootstrap) computation acceleration data. The network interface of the computer device is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements a TFHE computation acceleration method.

[0053] Those skilled in the art will understand that, Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0054] In one embodiment of this application, a computer-readable storage medium is provided, on which a computer program is stored, which, when executed by a processor, implements the steps of the above-described TFHE fully homomorphic bootstrap operation acceleration method.

[0055] In one embodiment of this application, a computer program product is provided, including a computer program / instructions, which, when executed by a processor, implements the steps of the above-described TFHE fully homomorphic bootstrap computation acceleration method.

[0056] The computer-readable storage medium and computer program product provided in this embodiment are similar in implementation principle and technical effect to the above method embodiments, and will not be repeated here.

[0057] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in M ​​forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), memory bus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0058] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0059] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for accelerating TFHE fully homomorphic bootstrap computation, characterized in that, The method includes: S1, multiple ciphertexts to be bootstrapping are grouped into a fixed-size batch and input as a whole into the bootstrap pipeline structure for processing. At the same time, all ciphertexts in each batch share the bootstrap key data loaded once. S2 employs a serialized pipeline structure to process each batch, allowing different ciphertexts to flow in parallel across different modules; S3 introduces a data transfer strategy from off-chip memory to on-chip ping-pong buffers. During each round of execution, the bootstrap key required for the current round is read from one buffer, and the data required for the next round is synchronously transferred from off-chip memory to another buffer. By leveraging the overlap of computation and transfer times within the pipeline structure, computation interruptions caused by waiting for data loading are avoided. In S2, a serialized pipeline structure is used to process each batch, specifically including: The blind rotation, CMux operation, sample extraction, and key switching stages in the bootstrap operation are each assigned to an independent computing unit; within each cycle, a structure is formed in which multiple ciphertexts are executed in parallel at different stages of the pipeline. In S3, a data transfer strategy from off-chip memory to on-chip ping-pong buffer is introduced, specifically including: During each round of CMux execution, the bootstrap key required for the current round is read from one buffer, while the operation of moving the data required for the next round from off-chip memory to another buffer is initiated.

2. The method according to claim 1, characterized in that, In S1, multiple ciphertexts to be bootstrapped are grouped into a batch of fixed size, specifically including: A batch of a preset number of ciphertexts to be bootstrapped is formed, and the batch is input as a whole into the bootstrap pipeline structure for processing.

3. The method according to claim 1, characterized in that, In S2, different ciphertexts flow in parallel across different modules, specifically including: By controlling the timing, different ciphertexts are sequentially entered into different stages of the pipeline, enabling parallel processing of multiple ciphertexts at different stages of the pipeline.

4. A TFHE fully homomorphic bootstrap computing acceleration device, characterized in that, The device includes: The loading module is used to combine multiple ciphertexts to be bootstrapping into a fixed-size batch and input them as a whole into the bootstrap pipeline structure for processing. At the same time, all ciphertexts in each batch share the bootstrap key data loaded once. The processing module is used to process each batch using a serialized pipeline structure, allowing different ciphertexts to flow in parallel in different modules; The data transfer module is used to introduce a data transfer strategy from off-chip memory to on-chip ping-pong buffer. During each round of execution, the bootstrap key required for the current round is read from one buffer, and the data required for the next round is synchronously transferred from off-chip memory to another buffer. By leveraging the overlap of computation and transfer times within the pipeline structure, computation interruptions caused by waiting for data loading are avoided. A serialized pipeline structure is used to process each batch, specifically including: The blind rotation, CMux operation, sample extraction, and key switching stages in the bootstrap operation are each assigned to an independent computing unit; within each cycle, a structure is formed in which multiple ciphertexts are executed in parallel at different stages of the pipeline. The data transfer strategy introduced from off-chip memory to on-chip ping-pong buffer specifically includes: During each round of CMux execution, the bootstrap key required for the current round is read from one buffer, while the operation of moving the data required for the next round from off-chip memory to another buffer is initiated.

5. An electronic device, characterized in that, It includes a memory and a processor, the memory storing a computer program that, when executed by the processor, implements the method as described in any one of claims 1 to 3.

6. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 3.

7. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the method described in any one of claims 1 to 3.

Images