Fully homomorphic hardware acceleration engine and fully homomorphic acceleration method and device

Abstract

The embodiment of the invention discloses a fully homomorphic hardware acceleration engine and a fully homomorphic acceleration method and device. In the embodiment of the invention, the fully homomorphic hardware acceleration engine comprises at least one basic operator; wherein the basic operator comprises six one-out-of-multiple selectors, two modular addition units, two modular reduction units, a plurality of register units, a multiplier unit and a modular reduction unit; the one-out-of-multiple selector selects a corresponding data path according to a received equipment selection signal and is used for realizing switching of different modes of the basic operator; the modular addition unit is used for realizing additive operation logic; the modular subtraction unit is used for realizing subtraction operation logic; the register unit is used for caching data; the multiplier unit is used for realizing multiplication operation logic; and the modular reduction unit is used for realizing modular reduction operation logic. Through the method, the basic operator can be dynamically configured under the condition of fully homomorphic acceleration, and the utilization rate of hardware resources is improved.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and more specifically, to a fully homomorphic hardware acceleration engine, a fully homomorphic acceleration method, and a device. Background Art

[0002] As more and more data needs to be calculated and processed on cloud servers, data security and privacy are receiving increasing attention from users, especially for applications with high security and privacy requirements. Not only other users on the cloud server, but even the cloud server itself is considered untrustworthy by users. Effectively protecting user data security and privacy has become an important requirement in cloud computing.

[0003] In the existing technology, privacy protection is performed by using Fully Homomorphic Encryption (FHE), which can directly perform various arithmetic operations on encrypted data, such as addition, multiplication, and rotation. Users can run tasks securely on cloud servers without exposing plaintext data. The data scale will expand dramatically during the encryption process, and the algorithm is complex. The architecture of general-purpose processors cannot adapt to operations such as Number Theoretic Transforms (NTT) and Inverse Number Theoretic Transforms (INTT) in fully homomorphic encryption. Currently, dedicated basic operators are used to accelerate FHE operations, that is, when executing NTT, the corresponding basic operator is set for NTT, and when executing INTT, the corresponding basic operator is set for INTT. Complex operations involve multiple basic operators. The current mainstream fully homomorphic encryption includes TFHE scheme and CKKS scheme. Among them, the above-mentioned TFHE scheme is an FHE scheme based on gate-level operations, which is programmable bootstrapping. Bootstrapping (PBS) is the basic operation in the above-mentioned TFHE scheme; the above-mentioned CKKS scheme is an FHE scheme that supports complex / real number encryption, and key switching (KeySwitch) is the key operation in the above-mentioned CKKS scheme; the above-mentioned PBS and KeySwitch both include NTT and MAC calculations, but the proportions are different. If it is necessary to support the above-mentioned CKKS scheme and the above-mentioned TFHE scheme at the same time under the same basic operator configuration, the basic operator corresponding to NTT will work at full load, while the basic operator corresponding to MAC will be unloaded, or the basic operator corresponding to MAC will work at full load, while the basic operator corresponding to NTT will be unloaded, and the utilization rate of hardware resources will be low.

[0004] To sum up, how to improve the utilization of hardware resources under fully homomorphic acceleration is a problem that needs to be solved at present. Summary of the Invention

[0005] In view of this, embodiments of the present invention provide a fully homomorphic hardware acceleration engine, a fully homomorphic acceleration method and an apparatus, which can dynamically configure basic operators under fully homomorphic acceleration to improve the utilization of hardware resources.

[0006] In a first aspect, an embodiment of the present invention provides a fully homomorphic hardware acceleration engine, which includes at least one basic operator; wherein the basic operator includes six multiple-choice selectors, two modular addition units, two modular subtraction units, multiple register units, a multiplier unit and a modular reduction unit; the multiple-choice selector selects the corresponding data path according to the received device selection signal to realize the switching of different modes of the basic operator; the modular addition unit is used to implement the addition operation logic; the modular subtraction unit is used to implement the subtraction operation logic; the register unit is used to cache data; the multiplier unit is used to implement the multiplication operation logic; and the modular reduction unit is used to implement the modular reduction operation logic.

[0007] Optionally, the device selection signal includes a number theoretic transformation NTT mode selection signal, an inverse number theoretic transformation INTT mode selection signal, a multiplication-accumulation operation MAC mode selection signal and a multiplication MUL mode selection signal.

[0008] Optionally, the modes of the basic operators include number theoretic transformation NTT mode, inverse number theoretic transformation INTT mode, MAC mode and multiplication MUL mode.

[0009] Optionally, in response to the mode of the basic operator being the number theory transformation NTT mode, the modules in the basic operator that are in the on state include: six multiple-choice selectors, a second modular addition unit, a second modular subtraction unit, multiple register units, a multiplier unit and a modular reduction unit; wherein the six multiple-choice selectors include a first multiple-choice selector, a second multiple-choice selector, a third multiple-choice selector, a fourth multiple-choice selector, a fifth multiple-choice selector and a sixth multiple-choice selector; the first multiple-choice selector receives input data N1 to be calculated; the second multiple-choice selector receives input data N2 to be calculated; the third multiple-choice selector receives a first auxiliary parameter; the fourth multiple-choice selector is used to receive the intermediate data of the input data N1 stored in the register unit after passing through multiple stages of pipeline; the multiplier unit is used to receive the intermediate data of the input data N1 according to the received input data. The input data IN2 and the first auxiliary parameter are used to perform a multiplication operation logic to generate product data; the modular reduction unit is used to perform a modular reduction operation logic according to the received product data to generate modular reduction data; the second modular addition unit is used to perform an addition operation according to the received intermediate data and the modular reduction data to generate sum data; the second modular subtraction unit is used to perform a subtraction operation according to the received intermediate data and the modular reduction data to generate difference data; the fifth multi-selector is used to receive the sum data and send it to the register unit; the sixth multi-selector is used to receive the difference data and send it to the register unit; the multiple register units are used to cache the data output by the multi-selector or multiplier unit connected thereto, and output the first output data OUT1 and the second output data OUT2.

[0010] Optionally, in response to the mode of the basic operator being the number theory transformation INTT mode, the modules in the basic operator that are in the on state include: six multiple-choice selectors, a first modular addition unit, a first modular subtraction unit, a plurality of register units, a multiplier unit and a modular reduction unit; wherein the six multiple-choice selectors include a first multiple-choice selector, a second multiple-choice selector, a third multiple-choice selector, a fourth multiple-choice selector, a fifth multiple-choice selector and a sixth multiple-choice selector; the first multiple-choice selector receives input data N1 to be calculated; the second multiple-choice selector receives input data N2 to be calculated; the third multiple-choice selector receives a second auxiliary parameter; the fourth multiple-choice selector is used to receive the input data The intermediate data N1 is stored in the register unit after passing through multiple stages of pipeline; the multiplier unit is used to perform multiplication operation logic according to the received input data IN2 and the second auxiliary parameter to generate product data; the modular reduction unit is used to perform modular reduction operation logic according to the received product data to generate modular reduction data; the fifth multi-selector is used to receive the data output by the fourth multi-selector and send it to the register unit; the sixth multi-selector is used to receive the modular reduction data and send it to the register unit; the multiple register units are used to cache the data output by the multi-selector or multiplier unit connected thereto, and output the first output data OUT1 and the second output data OUT2.

[0011] Optionally, in response to the mode of the basic operator being the multiplication MUL mode, the modules in the basic operator that are in the on state include: three multiple-choice selectors, multiple register units, a multiplier unit and a modular reduction unit; wherein the three multiple-choice selectors include a second multiple-choice selector, a third multiple-choice selector and a sixth multiple-choice selector; the second multiple-choice selector receives the input data N2 to be calculated; the third multiple-choice selector receives a third auxiliary parameter; the multiplier unit is used to perform multiplication operation logic according to the received input data IN2 and the third auxiliary parameter to generate product data; the modular reduction unit is used to perform modular reduction operation logic according to the received product data to generate modular reduction data; the sixth multiple-choice selector is used to receive the modular reduction data and send it to the register unit; the multiple register units are used to cache the data output by the multiplier unit and output second output data OUT2.

[0012] Optionally, in response to the mode of the basic operator being a multiplication-accumulation operation MAC mode, the modules in the basic operator that are in a conductive state include: four multiple-choice selectors, a second modular addition unit, a plurality of register units, a multiplier unit, and a modular reduction unit; wherein the four multiple-choice selectors include a second multiple-choice selector, a third multiple-choice selector, a fourth multiple-choice selector, and a fifth multiple-choice selector; the second multiple-choice selector receives input data N2 to be calculated; the third multiple-choice selector receives a fourth auxiliary parameter; the multiplier unit is used to perform multiplication according to the received input data IN2 and the fourth auxiliary parameter. The modular reduction unit is used to perform modular reduction operation logic according to the received product data to generate modular reduction data; the second modular addition unit is used to receive the modular reduction data and the output data of the fifth multiple-choice selector, generate sum data, and send it to the register unit and the fourth multiple-choice selector; the fifth multiple-choice selector is used to receive the sum data and send it to the register unit; the multiple register units are used to cache the multiple-choice selectors connected thereto and output the first output data OUT1; the fourth multiple-choice selector is used to receive the first output data OUT1.

[0013] In a second aspect, an embodiment of the present invention provides a method for fully homomorphic hardware acceleration, the method comprising: obtaining an operation instruction stream, wherein the operation instruction stream comprises at least two basic operation logics; determining the execution order of the basic operation logics in the operation instruction stream; and sending device selection information of the basic operation logic to a basic operator according to the execution order of the basic operation logic, wherein the basic operator switches its own mode according to the device selection information.

[0014] Optionally, the basic operation logic includes number theory transformation NTT, inverse number theory transformation INTT, multiplication-accumulation operation MAC and multiplication MUL.

[0015] In a third aspect, an embodiment of the present invention provides a method for fully homomorphic hardware acceleration, the method comprising: receiving device selection information, wherein the device selection information is information corresponding to the basic operation logic of the basic operator; and switching its own mode according to the device selection information.

[0016] Optionally, the method further includes: receiving input data and basic auxiliary parameters, wherein the device selection information is bound to the input data.

[0017] In a fourth aspect, an embodiment of the present invention provides a device for fully homomorphic hardware acceleration, the device comprising: an acquisition unit for acquiring an operation instruction stream, wherein the operation instruction stream includes at least two basic operation operation logics; a determination unit for determining the execution order of the basic operation operation logics in the operation instruction stream; and a sending unit for sending device selection information of the basic operation operation logic to a basic operator according to the execution order of the basic operation operation logic, and the basic operator switches its own mode according to the device selection information.

[0018] Optionally, the basic operation logic includes number theory transformation NTT, inverse number theory transformation INTT, multiplication-accumulation operation MAC and multiplication MUL.

[0019] In the fifth aspect, an embodiment of the present invention provides a device for fully homomorphic hardware acceleration, which includes: a receiving unit for receiving device selection information, wherein the device selection information is information corresponding to the basic operation logic of the basic operator; and a switching unit for switching its own mode according to the device selection information.

[0020] Optionally, the receiving unit is further configured to: receive input data and basic auxiliary parameters, wherein the device selection information is bound to the input data.

[0021] In the sixth aspect, an embodiment of the present invention provides an electronic device comprising a memory and a processor, the memory being used to store one or more computer program instructions, wherein the one or more computer program instructions are executed by the processor to implement a method as described in any one of the second aspect, any possibility of the second aspect, the third aspect, and any possibility of the third aspect.

[0022] In the seventh aspect, an embodiment of the present invention provides a computer-readable storage medium on which computer program instructions are stored, and when the computer program instructions are executed by a processor, they implement a method as described in any one of the second aspect, any possibility of the second aspect, the third aspect, and any possibility of the third aspect.

[0023] In an embodiment of the present invention, the fully homomorphic hardware acceleration engine includes at least one basic operator; wherein, the basic operator includes six multiple-choice selectors, two modular addition units, two modular subtraction units, multiple register units, a multiplier unit, and a modular reduction unit; the multiple-choice selector selects the corresponding data path according to the received device selection signal, so as to realize the switching of different modes of the basic operator; the modular addition unit is used to realize the addition operation logic; the modular subtraction unit is used to realize the subtraction operation logic; the register unit is used to cache data; the multiplier unit is used to realize the multiplication operation logic; the modular reduction unit is used to realize the modular reduction operation logic. Through the above method, the basic operators can be dynamically configured in the case of fully homomorphic acceleration to improve the utilization rate of hardware resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The above and other objects, features and advantages of the present invention will become more apparent through the following description of the embodiments of the present invention with reference to the accompanying drawings, in which:

[0025] Figure 1 This is a schematic diagram of a dense state operation calculation flow of a matrix-vector multiplication operation in the prior art;

[0026] Figure 2 This is a schematic diagram of the proportion of NTT and MAC in an embodiment of the present invention;

[0027] Figure 3 2 is a schematic diagram of the structure of a basic operator in NTT mode according to an embodiment of the present invention;

[0028] Figure 4 This is a schematic diagram of the structure of a basic operator in INTT mode according to an embodiment of the present invention;

[0029] Figure 5 Schematic diagram of the structure of a basic operator in MUL mode in an embodiment of the present invention;

[0030] Figure 6 This is a schematic diagram of the structure of a basic operator in MAC mode according to an embodiment of the present invention;

[0031] Figure 7 is a schematic structural diagram of a basic operator in an embodiment of the present invention;

[0032] Figure 8 This is a flow chart of a method for fully homomorphic hardware acceleration according to an embodiment of the present invention;

[0033] Figure 9 This is a flow chart of another method for fully homomorphic hardware acceleration according to an embodiment of the present invention;

[0034] Figure 10Schematic diagram of a fully homomorphic hardware acceleration device according to an embodiment of the present invention;

[0035] Figure 11 is a schematic diagram of another fully homomorphic hardware acceleration device according to an embodiment of the present invention;

[0036] Figure 12 is a schematic diagram of an electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] The present application is described below based on the following embodiments, but the present application is not limited to these embodiments. In the detailed description of the present application below, certain specific details are described in detail. Those skilled in the art can fully understand the present application without the description of these details. To avoid obscuring the essence of the present application, well-known methods, processes, procedures, components, and circuits are not described in detail.

[0038] Furthermore, persons of ordinary skill in the art will appreciate that the figures provided herein are for illustration purposes only and are not necessarily drawn to scale.

[0039] Unless the context clearly requires otherwise, words like “include”, “comprising” and the like throughout this application should be interpreted as including rather than exclusive or exhaustive; that is, as meaning “including but not limited to”.

[0040] In the description of this application, it should be understood that the terms "first", "second", etc. are used for descriptive purposes only and should not be understood to indicate or imply relative importance. In addition, in the description of this application, unless otherwise specified, "plurality" means two or more.

[0041] In the existing technology, fully homomorphic encryption (FHE) is used for privacy protection. Various arithmetic operations such as addition, multiplication, and rotation can be directly performed on encrypted data. Users can run tasks securely on cloud servers without exposing plaintext data at any time. The data scale will expand rapidly during the encryption process, and the algorithm is complex. The speed of ciphertext calculation is much lower than that of inscription calculation. The architecture of general-purpose processors such as CPUs or GPUs cannot adapt to operations such as Number Theoretic Transforms (NTT) and Inverse Number Theoretic Transforms (INTT) in fully homomorphic encryption. Currently, dedicated basic operators (also known as dedicated hardware modules) are used to accelerate FHE operations to meet the needs of practical applications. In fully homomorphic encryption (also known as secret state or homomorphic) operations, complex operations involve multiple basic operators. For example, when executing NTT, a corresponding basic operator is set for NTT, and when executing INTT, a corresponding basic operator is set for INTT. Complex operations may involve multiple basic operators. Figure 1 It is a dense operation calculation process of matrix-vector multiplication operation. The calculation engine mainly implements hardware operations including NTT and INTT. Figure 1 It also includes a polynomial multiplication module, a rescale module, an automorphic module, a multiplication unit (MULT MONO), a conversion of ciphertext or problem based on ring learning error (RLWE) to ciphertext or problem based on normal learning error (LWE) (RLWE-to-LWE), dynamic function switching (Mod switch) and a reduce buffer (Reduce Buffer). The NTT and INTT used in the above-mentioned cipher operation calculation process are both dedicated.

[0042] The current mainstream fully homomorphic encryption schemes include TFHE and CKKS. Among them, the TFHE scheme is a FHE scheme based on gate-level operations, which is programmable. Bootstrapping (PBS) is the basic operation in the above-mentioned TFHE scheme; the above-mentioned CKKS scheme is an FHE scheme that supports complex / real number encryption, and key switching (KeySwitch) is the key operation in the above-mentioned CKKS scheme; the above-mentioned PBS and KeySwitch both include NTT and multiply-accumulate (MAC) operations. In the encrypted hardware acceleration engine, NTT adopts multi-stage butterfly operations, and MAC is implemented using a multiplier array. Due to the above differences, special hardware modules are usually selected in the design of the hardware acceleration engine to support NTT and MAC operations. However, the proportions of NTT and MAC in the CKKS scheme and the TFHE scheme are different. If it is necessary to support the above-mentioned CKKS scheme and the above-mentioned TFHE scheme at the same time under the same basic operator configuration, the basic operator corresponding to NTT will work at full load, while the basic operator corresponding to MAC will be unloaded, or the basic operator corresponding to MAC will work at full load, while the basic operator corresponding to NTT will be unloaded. For example, Figure 2 As shown in the figure, when running KeySwitch for CKKS, the computational load of NTT accounts for 59.2% of the total computational load, while MAC accounts for 40.8%. When running PBS for TFHE, NTT accounts for an average of 75.5% of the total computational load, and MAC accounts for the remaining 24.5%. If the same hardware configuration is used to support CKKS and TFHE, the utilization of hardware resources will be low.

[0043] In addition, each operation in the NTT operation requires auxiliary parameters to participate in the operation. For an N=2 16 When the length of a single data item is 64 bits, the data to be calculated and the auxiliary parameters reach the same order of magnitude, that is, the lengths of the data to be calculated and the auxiliary parameters are both N=2. 16, the required storage capacity is 512KB; in order to reduce bandwidth storage pressure, the online generation of auxiliary parameters is usually adopted, that is, placing more basic operators (mainly modular multiplication units) to derive the auxiliary parameters required for each round of calculation in real time. Through real-time derivation, less than 1% of the basic auxiliary parameters are needed to complete the overall operation; however, the demand for auxiliary parameters increases exponentially in each round of calculation, which also leads to uneven utilization of hardware resources. For example, for a base-32 operation unit, NTT itself requires 32 modular multiplication units, while the hardware used to derive auxiliary parameters requires 15 modular multiplication units; in actual calculations, the magnitude of auxiliary parameters required for each round of calculation increases exponentially. The amount of auxiliary parameters required in the previous round of calculation is relatively small. Only the calculations in the last four stages will fully utilize all the hardware resources for calculating and deriving auxiliary parameters. For example, as shown in Table 1, in stages 1-4, the utilization rate of 15 modular multiplication units is 0.02%, and in stages 5-8, the utilization rate of 15 modular multiplication units is 0.02%. The resource utilization of each modular multiplication unit is 0.39%. In the 9th to 12th stages, the resource utilization of the 15 modular multiplication units is 6.25%. In the 13th to 16th stages, the utilization of the 15 modular multiplication units is 100%. The average resource utilization of the 15 modular multiplication units is 26.6%. The resource utilization of the entire 47 modular multiplication units will also drop to (32 / 47)*100%+(15 / 47)*26.6%=76%. The above method not only requires more basic operators, but also causes a large area overhead due to hardware acceleration.

[0044] Table 1

[0045] stage 1-4 5-8 9-12 13-16 average value Resource utilization 0.02％ 0.39％ 6.25％ 100％ 26.6％

[0046] To sum up, how to improve the utilization of hardware resources under fully homomorphic acceleration is a problem that needs to be solved at present.

[0047] In order to solve the above problems, an embodiment of the present invention proposes a fully homomorphic hardware acceleration engine, which includes at least one basic operator. The structure of the basic operator is as follows: Figure 3As shown, it includes six multiple-choice selectors, two modular addition units, two modular subtraction units, multiple register units, a multiplier unit and a modular reduction unit; specifically, the six multiple-choice selectors include a first multiple-choice selector 301, a second multiple-choice selector 302, a third multiple-choice selector 303, a fourth multiple-choice selector 304, a fifth multiple-choice selector 305 and a sixth multiple-choice selector 306, and the multiple-choice selectors select corresponding data paths according to the received device selection signal to realize the switching of different modes of the basic operator; the two modular addition units include a first modular addition unit 307 and a second modular addition unit 308, and the modular addition units are used to realize the addition operation logic, for example, for realizing the operation operation logic of c=a+b mod p; the two modular addition units include a first modular subtraction unit 309 and a second modular subtraction unit 310, and the modular subtraction units are used to realize the subtraction operation logic, for example, for realizing c=ab mod The multiplier unit 311 is used to implement the multiplication operation logic, for example, to implement the operation logic of c=a*b; the modular reduction unit (MR) 312 is used to implement the modular reduction operation logic, for example, to implement the operation logic of d=c mod p based on the Barrett algorithm. The modular reduction unit can also send files to itself or forward messages; the register unit 313 is used to cache data. The basic operator includes multiple register units, and only one of the register units is used as an example here.

[0048] In the above Figure 3 In the example, the input data to be calculated of the basic operator are N1 and N2, the device selection signal SEL and the auxiliary parameters are bound to the input data to be calculated and input into the basic operator together, and the output data of the basic operator are OUT1 and OUT2. The above data are selected according to different device selection signals SEL. Figure 3 The conduction status of each unit.

[0049] In one possible implementation, the device selection signal includes a number theoretic transformation NTT mode selection signal, an inverse number theoretic transformation INTT mode selection signal, a multiplication-accumulation operation MAC mode selection signal, and a multiplication MUL mode selection signal; assuming that the NTT mode selection signal is 00, that is, SEL=00; the INTT mode selection signal is 01, that is, SEL=01; the multiplication MUL mode selection signal is 10, that is, SEL=10; and the multiplication-accumulation operation MAC mode selection signal is 11, that is, SEL=11. This is only an exemplary description, and the specific values ​​are determined according to actual conditions.

[0050] In an embodiment of the present invention, the modes of the basic operators include a number theoretic transformation NTT mode, an inverse number theoretic transformation INTT mode, a MAC mode, and a multiplication MUL mode.

[0051] In a possible implementation, the mode responsive to the basic operator is a number theoretic transformation NTT mode, specifically as follows: Figure 4 As shown, the modules in the conductive state in the basic operator include: six multiple-to-one selectors, a second modular addition unit 308, a second modular subtraction unit, a plurality of register units, a multiplier unit and a modular reduction unit;

[0052] Among them, the six multiple-choice selectors include a first multiple-choice selector 301, a second multiple-choice selector 302, a third multiple-choice selector 303, a fourth multiple-choice selector 304, a fifth multiple-choice selector 305 and a sixth multiple-choice selector 306; the first multiple-choice selector 301 receives the input data N1 to be calculated; the second multiple-choice selector 302 receives the input data N2 to be calculated; the third multiple-choice selector 303 receives the first auxiliary parameter ψ; the fourth multiple-choice selector 304 is used to receive the intermediate data of the input data N1 after passing through multiple stages of pipeline and stored in the register unit; the multiplier unit 311 is used to perform multiplication operation logic according to the received input data IN2 and the first auxiliary parameter to generate product data; the modular reduction unit 3 12 is used to perform a modular reduction operation logic according to the received product data to generate modular reduction data; the second modular addition unit 308 is used to perform an addition operation according to the received intermediate data and the modular reduction data to generate sum data; the second modular reduction unit 310 is used to perform a subtraction operation according to the received intermediate data and the modular reduction data to generate difference data; the fifth multi-select selector 305 is used to receive the sum data and send it to the register unit; the sixth multi-select selector 306 is used to receive the difference data and send it to the register unit; the multiple register units 313 are used to cache the data output by the multi-select selector or multiplier unit connected thereto, and output the first output data OUT1 and the second output data OUT2; in the above Figure 4 In the figure, the cells in the on state and the connection relationship are represented by bold lines.

[0053] In a possible implementation, the mode responsive to the basic operator is the number theory transformation INTT mode, specifically as follows Figure 5As shown, the modules in the conductive state in the basic operator include: six multiple-choice selectors, a first modular addition unit 307, a first modular subtraction unit 309, multiple register units 313, a multiplier unit 311 and a modular reduction unit 312; wherein the six multiple-choice selectors include a first multiple-choice selector 301, a second multiple-choice selector 302, a third multiple-choice selector 303, a fourth multiple-choice selector 304, a fifth multiple-choice selector 305 and a sixth multiple-choice selector 306; the first multiple-choice selector 301 receives the input data N1 to be calculated; the second multiple-choice selector 302 receives the input data N2 to be calculated; the third multiple-choice selector 303 receives the second auxiliary parameter ψ -1 ; The fourth multiple-choice selector 304 is used to receive the intermediate data of the input data N1 after passing through multiple stages of pipeline and stored in the register unit; the multiplier unit 311 is used to perform multiplication operation logic according to the received input data IN2 and the second auxiliary parameter to generate product data; the modular reduction unit 312 is used to perform modular reduction operation logic according to the received product data to generate modular reduction data; the fifth multiple-choice selector 305 is used to receive the data output by the fourth multiple-choice selector and send it to the register unit; the sixth multiple-choice selector 306 is used to receive the modular reduction data and send it to the register unit; the multiple register units 313 are used to cache the data output by the multiple-choice selector or multiplier unit connected thereto, and output the first output data OUT1 and the second output data OUT2; in the above Figure 5 In the figure, the cells in the on state and the connection relationship are represented by bold lines.

[0054] In a possible implementation, the mode in response to the basic operator is the multiplication MUL mode, specifically as follows Figure 6As shown, the modules in the conductive state in the basic operator include: three multiple-choice selectors, multiple register units 313, a multiplier unit 311 and a modular reduction unit 312; wherein the three multiple-choice selectors include a second multiple-choice selector 302, a third multiple-choice selector 303 and a sixth multiple-choice selector 306; the second multiple-choice selector 302 receives the input data N2 to be calculated; the third multiple-choice selector 303 receives the third auxiliary parameter Y10, that is, the auxiliary parameter in the multiplication MUL mode; the multiplier unit 311 is used to perform multiplication operation logic according to the received input data IN2 and the third auxiliary parameter to generate product data; the modular reduction unit 312 is used to perform modular reduction operation logic according to the received product data to generate modular reduction data; the sixth multiple-choice selector 306 is used to receive the modular reduction data and send it to the register unit; the multiple register units 313 are used to cache the data output by the multiplier unit and output the second output data OUT2. Figure 6 In the figure, the cells in the on state and the connection relationship are represented by bold lines.

[0055] In a possible implementation, the mode of the basic operator is a multiplication-accumulation operation MAC mode, specifically as follows: Figure 7 As shown, the modules in the conductive state in the basic operator include: four multiple-choice selectors, a second modular addition unit 308, multiple register units 313, a multiplier unit 311 and a modular reduction unit 312; wherein the four multiple-choice selectors include a second multiple-choice selector 302, a third multiple-choice selector 303, a fourth multiple-choice selector 304 and a fifth multiple-choice selector 305; the second multiple-choice selector 302 receives the input data N2 to be calculated; the third multiple-choice selector 303 receives the fourth auxiliary parameter Y11, that is, the auxiliary parameter in the multiplication MAC mode; the multiplier unit 311 is used to calculate the value of the multiplication MAC mode according to the received input data IN2 and the fourth auxiliary parameter , perform multiplication operation logic to generate product data; the modular reduction unit 312 is used to perform modular reduction operation logic according to the received product data to generate modular reduction data; the second modular addition unit 308 is used to receive the modular reduction data and the output data of the fifth multiple-choice selector, generate sum data, and send it to the register unit and the fourth multiple-choice selector; the fifth multiple-choice selector 305 is used to receive the sum data and send it to the register unit; the multiple register units 313 are used to cache the multiple-choice selectors connected thereto and output the first output data OUT1; the fourth multiple-choice selector 304 is used to receive the first output data OUT1, in the above Figure 7 In the figure, the cells in the on state and the connection relationship are represented by bold lines.

[0056] In the embodiment of the present invention, a complete computing task is completed through an instruction stream, which can be designed manually or generated by a computer. In the fully homomorphic acceleration method, the server interacting with the basic operator in the fully homomorphic acceleration engine will execute the following Figure 8 The process shown is specifically a flowchart of a fully homomorphic acceleration method, including the following steps:

[0057] Step S801: Obtain an operation instruction stream.

[0058] Specifically, the operation instruction stream includes at least two basic operation logics, and the basic operation logics include number theory transformation NTT, inverse number theory transformation INTT, multiplication-accumulation operation MAC and multiplication MUL.

[0059] In an embodiment of the present invention, the operation instruction stream includes a hardware unit data stream of a multi-stage pipeline, and the hardware unit data stream includes input data to be calculated, auxiliary parameters, and device selection information corresponding to basic operation logic.

[0060] Assume that, taking the KeySwitch hardware implementation process as an example, the continuous operation of INTT-BASE CONV-NTT can be completed by the fully homomorphic hardware acceleration engine; wherein, the INTT in the INTT-BASE CONV-NTT continuous operation is a whole INTT operation, which mainly involves the INTT mode and MUL mode of the basic operator, the INTT mode participates in the INTT operation of the polynomial, and the MUL mode is used to derive the auxiliary parameters of the current round. The arrangement of the device selection information corresponding to the basic operation operation logic in the operation instruction stream is as follows: MUL->INTT->…MUL->INTT->MUL; the BASE CONV in the INTT-BASE CONV-NTT continuous operation is a whole BASE CONV operation, which mainly involves the MUL mode and MAC mode of the basic operator. The main algorithm operation of the BASE CONV is two stages, and the arrangement of the device selection information corresponding to the basic operation operation logic in the operation instruction stream is as follows: MUL->MAC, wherein the MUL mode is used to calculate and temporarily store the results, and the MAC mode is used to perform MAC summation with the temporarily stored results; the INTT-BASE The NTT in the CONV-NTT continuous operation is a whole NTT operation, which mainly involves the NTT mode and MUL mode of the basic operator. The NTT mode participates in the NTT operation of the polynomial, and the MUL mode is used to derive the auxiliary parameters of the current round. The arrangement of the device selection information corresponding to the basic operation logic in the operation instruction stream is as follows: MUL->NTT->…MUL->NTT; in the embodiment of the present invention, the above operation instruction stream is only an example, and the specific operation is determined according to the actual situation. The embodiment of the present invention does not limit it.

[0061] Step S802: Determine the execution order of the basic operation logic in the operation instruction stream.

[0062] Step S803: Send device selection information of the basic operation logic to the basic operator according to the execution order of the basic operation logic, wherein the basic operator switches its own mode according to the device selection information.

[0063] In a possible implementation, the method of accelerating the basic operator based on full homomorphism includes the following steps: Figure 9 As shown, the following steps are included:

[0064] Step S901: Receive device selection information.

[0065] Specifically, the device selection information is information corresponding to the basic operation logic of the basic operator.

[0066] In a possible implementation, the basic operator receives input data and basic auxiliary parameters while receiving the device selection information, wherein the device selection information is bound to the input data.

[0067] Step S902: Switch the own mode according to the device selection information.

[0068] Through the above embodiment, by dynamically configuring the basic operator (also known as the operation unit), the basic operator is switched between the four modes of NTT / INTT / MUL / MAC to achieve resource reuse, and according to the instruction stream dynamically arranged in the algorithm stage, the bubble cycle of the basic operator is reduced, thereby improving resource utilization; the MUL mode is inserted in the operation gap of the NTT / INTT mode to pre-generate the auxiliary parameters of the next round, thereby achieving parallel calculation and auxiliary parameter generation, eliminating the waiting or idleness of hardware resources; the NTT butterfly operation and the MAC multiplier array are integrated into the same hardware acceleration engine, and the data flow is switched through the mode configuration of the basic operator to reduce the redundancy of hardware resources. In addition, by adjusting the number of basic operators in the hardware acceleration engine, it can support dynamic adjustment of parameters such as polynomial length and basis size, adapt to the diverse needs of different FHE schemes, and fully improve the resource utilization of the basic operators.

[0069] In an embodiment of the present invention, a fully homomorphic hardware acceleration device is provided, such as Figure 10 As shown, specifically including:

[0070] An acquisition unit 1001, a determination unit 1002 and a sending unit 1003; wherein the acquisition unit 1001 is used to acquire an operation instruction stream, wherein the operation instruction stream includes at least two basic operation operation logics; the determination unit 1002 is used to determine the execution order of the basic operation operation logics in the operation instruction stream; the sending unit 1003 is used to send device selection information of the basic operation operation logic to the basic operator according to the execution order of the basic operation operation logic, wherein the basic operator switches its own mode according to the device selection information.

[0071] Furthermore, the basic operation logic includes number theoretic transformation NTT, inverse number theoretic transformation INTT, multiplication-accumulation operation MAC and multiplication MUL.

[0072] In an embodiment of the present invention, a fully homomorphic hardware acceleration device is provided, such as Figure 11 As shown, it specifically includes: a receiving unit 1101 and a switching unit 1102; wherein, the receiving unit 1101 is used to receive device selection information, wherein the device selection information is information corresponding to the basic operation logic of the basic operator; the switching unit 1102 is used to switch its own mode according to the device selection information.

[0073] Furthermore, the receiving unit is further configured to receive input data and basic auxiliary parameters, wherein the device selection information is bound to the input data.

[0074] Figure 12 Schematic diagram of the structure of the electronic device in the embodiment of the present invention. Figure 12 As shown, it includes a general computer hardware structure, which includes at least a processor 1201 and a memory 1202. The processor 1201 and the memory 1202 are connected via a bus 1203. The memory 1202 is suitable for storing instructions or programs executable by the processor 1201. The processor 1201 can be a standalone microprocessor or a collection of one or more microprocessors. Thus, the processor 1201 executes the instructions stored in the memory 1202, thereby executing the method flow of the embodiment of the present invention described above to process data and control other devices. The bus 1203 connects the above-mentioned multiple components together, and at the same time connects the above-mentioned components to the display controller 1204 and the display device and the input / output (I / O) device 1205. The input / output (I / O) device 1205 can be a mouse, keyboard, modem, network interface, touch input device, somatosensory input device, printer, and other devices known in the art. Typically, the input / output device 1205 is connected to the system via an input / output (I / O) controller 1206.

[0075] The instructions stored in the memory 1202 are executed by at least one processor 1201 to implement: receiving device selection information, wherein the device selection information is information corresponding to the basic operation logic of the basic operator; and switching its own mode according to the device selection information.

[0076] Specifically, the electronic device includes: one or more processors 1201 and a memory 1202, Figure 11 Take a processor 1201 as an example. The processor 1201 and the memory 1202 may be connected via a bus or other means. Figure 12 In the example above, a bus connection is used. Memory 1202, as a non-volatile computer-readable storage medium, can be used to store non-volatile software programs, non-volatile computer executable programs, and modules. Processor 1201 executes the non-volatile software programs, instructions, and modules stored in memory 1202 to execute various functional applications and data processing of the device, thereby implementing the above-mentioned method for determining fully homomorphic hardware acceleration.

[0077] The memory 1202 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store a list of options, etc. In addition, the memory 1202 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other non-volatile solid-state storage device. In some embodiments, the memory 1202 may optionally include a memory remotely located relative to the processor 1201, and these remote memories may be connected to an external device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0078] One or more modules are stored in the memory 1202 and, when executed by one or more processors 1201, perform the fully homomorphic hardware acceleration method in any of the above method embodiments.

[0079] As will be appreciated by those skilled in the art, various aspects of embodiments of the present invention may be implemented as systems, methods, or computer program products. Thus, various aspects of embodiments of the present invention may take the form of a complete hardware implementation, a complete software implementation (including firmware, resident software, microcode, etc.), or an implementation combining software aspects with hardware aspects, which may all be generally referred to herein as a "circuit," "module," or "system." Additionally, various aspects of embodiments of the present invention may take the form of a computer program product implemented in one or more computer-readable media having computer-readable program code implemented thereon.

[0080] Any combination of one or more computer-readable media can be utilized. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination thereof. More specific examples (non-exhaustive enumeration) of computer-readable storage media will include the following: an electrical connection with one or more wires, a portable computer floppy disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the context of an embodiment of the present invention, a computer-readable storage medium can be any tangible medium that can contain or store a program used by an instruction execution system, device, or apparatus, or a program used in conjunction with an instruction execution system, device, or apparatus.

[0081] A computer-readable signal medium may include a propagated digital signal having computer-readable program code embodied therein, such as in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electromagnetic, optical, or any suitable combination thereof. A computer-readable signal medium may be any computer-readable medium that is not a computer-readable storage medium and that can communicate, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or apparatus.

[0082] Program code embodied on a computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0083] The computer program code for performing the operations for various aspects of the embodiments of the present invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, Smalltalk, C++, etc., and conventional procedural programming languages ​​such as "C" programming language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer as a stand-alone software package; partially on the user's computer and partially on a remote computer; or entirely on a remote computer or server. In the latter case, the remote computer can be connected to the user's computer through any type of network including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0084] The flowchart legends and / or block diagrams of the methods, devices (systems) and computer program products according to embodiments of the present invention described above describe various aspects of embodiments of the present invention. It will be understood that each block of the flowchart legends and / or block diagrams and the combination of blocks in the flowchart legends and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer or other programmable data processing device to produce a machine so that the instructions (executed by the processor of the computer or other programmable data processing device) create a device for implementing the function / action specified in the flowchart and / or block diagram block or block.

[0085] These computer program instructions may also be stored in a computer-readable medium that can direct a computer, other programmable data processing device or other apparatus to operate in a particular manner, so that the instructions stored in the computer-readable medium produce an article of manufacture including instructions for implementing the functions / actions specified in the flowchart and / or block diagram blocks or blocks.

[0086] The computer program instructions may also be loaded onto a computer, other programmable data processing device, or other apparatus to cause a series of operable steps to be performed on the computer, other programmable device, or other apparatus to produce a computer-implemented process, such that the instructions executed on the computer or other programmable device provide a process for implementing the functions / actions specified in the flowchart and / or block diagram block or blocks.

[0087] The foregoing is merely a preferred embodiment of the present application and is not intended to limit the present application. Persons skilled in the art will readily appreciate that the present application is susceptible to various modifications and variations. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present application shall be included within the scope of protection of the present application.

[0088] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with the relevant laws, regulations and standards of the relevant countries and regions, and provide corresponding operation portals for users to choose to authorize or refuse. The user's refusal to process personal information other than the necessary information for basic functions will not affect the user's use of basic functions.

Claims

1. A fully homomorphic hardware acceleration engine, characterized in that: The fully homomorphic hardware acceleration engine includes at least one basic operator; The basic operator includes six multiple-choice selectors, two modular addition units, two modular subtraction units, multiple register units, a multiplier unit and a modular reduction unit; The multiple-choice-one selector selects a corresponding data path according to the received device selection signal, so as to realize the switching of different modes of the basic operator; The modular addition unit is used to implement addition operation logic; The modular subtraction unit is used to implement subtraction operation logic; The register unit is used to cache data; The multiplier unit is used to implement multiplication operation logic; The modular reduction unit is used to implement modular reduction operation logic.

2. The fully homomorphic hardware acceleration engine according to claim 1, characterized in that: The device selection signal includes a number theoretic transformation NTT mode selection signal, an inverse number theoretic transformation INTT mode selection signal, a multiplication-accumulation operation MAC mode selection signal and a multiplication MUL mode selection signal.

3. The fully homomorphic hardware acceleration engine according to claim 2, characterized in that: The modes of the basic operators include number theoretic transformation NTT mode, inverse number theoretic transformation INTT mode, MAC mode and multiplication MUL mode.

4. The fully homomorphic hardware acceleration engine according to claim 3, characterized in that: In response to the mode of the basic operator being the number theoretic transform (NTT) mode, the modules in the basic operator that are in a conductive state include: six multiple-to-one selectors, a second modular addition unit, a second modular subtraction unit, a plurality of register units, a multiplier unit, and a modular reduction unit; The six multiple-choice selectors include a first multiple-choice selector, a second multiple-choice selector, a third multiple-choice selector, a fourth multiple-choice selector, a fifth multiple-choice selector and a sixth multiple-choice selector; The first multiple-to-one selector receives input data N1 to be calculated; The second multiple-choice selector receives input data N2 to be calculated; The third one-of-a-kind selector receives a first auxiliary parameter; The fourth multiple-to-one selector is used to receive the intermediate data of the input data N1 after passing through multiple stages of pipeline and stored in the register unit; The multiplier unit is used to perform a multiplication operation logic according to the received input data IN2 and the first auxiliary parameter to generate product data; The modular reduction unit is used to perform modular reduction operation logic according to the received product data to generate modular reduced data; The second modular addition unit is used to perform an addition operation according to the received intermediate data and the modular reduction data to generate sum value data; The second modular reduction unit is configured to perform a subtraction operation on the received intermediate data and the modular reduced data to generate difference data; The fifth multiple-choice selector is used to receive the sum value data and send it to the register unit; The sixth multiple-to-one selector is used to receive the difference data and send it to the register unit; The plurality of register units are used to buffer data output by the multiple-selector or multiplier unit connected thereto, and output first output data OUT1 and second output data OUT2.

5. The fully homomorphic hardware acceleration engine according to claim 3, characterized in that: In response to the mode of the basic operator being the number theory transformation INTT mode, the modules in the basic operator that are in a conductive state include: six multiple-to-one selectors, a first modular addition unit, a first modular subtraction unit, a plurality of register units, a multiplier unit, and a modular reduction unit; The six multiple-choice selectors include a first multiple-choice selector, a second multiple-choice selector, a third multiple-choice selector, a fourth multiple-choice selector, a fifth multiple-choice selector and a sixth multiple-choice selector; The first multiple-to-one selector receives input data N1 to be calculated; The second multiple-choice selector receives input data N2 to be calculated; The third multiple-choice selector receives a second auxiliary parameter; The fourth multiple-to-one selector is used to receive the intermediate data of the input data N1 after passing through multiple stages of pipeline and stored in the register unit; The multiplier unit is used to perform multiplication operation logic according to the received input data IN2 and the second auxiliary parameter to generate product data; The modular reduction unit is used to perform modular reduction operation logic according to the received product data to generate modular reduced data; The fifth one-of-a-kind selector is configured to receive data output by the fourth one-of-a-kind selector and send the data to the register unit; The sixth multiple-to-one selector is configured to receive the modular reduction data and send it to the register unit; The plurality of register units are used to buffer data output by the multiple-selector or multiplier unit connected thereto, and output first output data OUT1 and second output data OUT2.

6. The fully homomorphic hardware acceleration engine according to claim 3, characterized in that: In response to the mode of the basic operator being the multiplication MUL mode, the modules in the basic operator that are in a conductive state include: three multiple-to-one selectors, a plurality of register units, a multiplier unit, and a modular reduction unit; The three multiple-choice selectors include a second multiple-choice selector, a third multiple-choice selector, and a sixth multiple-choice selector; The second multiple-choice selector receives input data N2 to be calculated; The third multiple-choice selector receives a third auxiliary parameter; The multiplier unit is used to perform a multiplication operation logic according to the received input data IN2 and the third auxiliary parameter to generate product data; The modular reduction unit is used to perform modular reduction operation logic according to the received product data to generate modular reduced data; The sixth multiple-to-one selector is configured to receive the modular reduction data and send it to the register unit; The plurality of register units are used to buffer the data output by the multiplier unit and output second output data OUT2.

7. The fully homomorphic hardware acceleration engine according to claim 3, characterized in that: In response to the mode of the basic operator being a multiplication-accumulation operation MAC mode, the modules in the basic operator that are in a conductive state include: four multiple-to-one selectors, a second modular addition unit, a plurality of register units, a multiplier unit, and a modular reduction unit; The four multiple-choice selectors include a second multiple-choice selector, a third multiple-choice selector, a fourth multiple-choice selector, and a fifth multiple-choice selector; The second multiple-choice selector receives input data N2 to be calculated; The third one-of-a-kind selector receives a fourth auxiliary parameter; The multiplier unit is used to perform a multiplication operation logic according to the received input data IN2 and the fourth auxiliary parameter to generate product data; The modular reduction unit is used to perform modular reduction operation logic according to the received product data to generate modular reduced data; The second modular addition unit is used to receive the modular reduction data and the output data of the fifth multiple-choice selector, generate sum data, and send it to the register unit and the fourth multiple-choice selector; The fifth multiple-choice selector is used to receive the sum value data and send it to the register unit; The plurality of register units are used to cache the multiple-to-one selectors connected thereto and output the first output data OUT1; The fourth one-of-many selector is configured to receive the first output data OUT1 .

8. A fully homomorphic acceleration method, characterized in that: The method comprises: Acquire an operation instruction stream, wherein the operation instruction stream includes at least two basic operation logics; Determining the execution order of the basic operation logic in the operation instruction stream; According to the execution order of the basic operation logic, device selection information of the basic operation logic is sent to the basic operator, wherein the basic operator switches its own mode according to the device selection information.

9. The method according to claim 8, characterized in that The basic operation logic includes number theory transformation NTT, inverse number theory transformation INTT, multiplication and accumulation operation MAC and multiplication MUL.

10. A fully homomorphic acceleration method, characterized in that: The method comprises: Receiving device selection information, wherein the device selection information is information corresponding to a basic operation logic of a basic operator; Switch the own mode according to the device selection information.

11. The method according to claim 10, characterized in that The method further comprises: Input data and basic auxiliary parameters are received, wherein the device selection information is bound to the input data.

12. A fully homomorphic acceleration device, characterized in that: The device comprises: An acquisition unit, configured to acquire an operation instruction stream, wherein the operation instruction stream includes at least two basic operation logics; a determining unit, configured to determine an execution order of the basic operation logic in the operation instruction stream; The sending unit is used to send the device selection information of the basic operation logic to the basic operator according to the execution order of the basic operation logic, and the basic operator switches its own mode according to the device selection information.

13. A fully homomorphic acceleration device, characterized in that: The device comprises: A receiving unit, configured to receive device selection information, wherein the device selection information is information corresponding to a basic operation logic of a basic operator; The switching unit is used to switch its own mode according to the device selection information.

Images