HPS hardware system and homomorphic ciphertext operation method and device, storage medium and computer equipment

Abstract

The HPS hardware system and the homomorphic ciphertext operation method and device, the storage medium and the computer equipment provided by the application include a promotion calculation unit, a scaling calculation unit and a cross-level routing channel; the promotion calculation unit can promote residual data in a small modulus system from a small modulus base to a large modulus base, and the scaling calculation unit can scale residual data in a large modulus system from a large modulus base to a small modulus base; both the calculation units are composed of multiple processing blocks, so that the multi-precision operation of the homomorphic ciphertext can be converted into concurrent small integer arithmetic operation, thereby improving the calculation efficiency; in addition, the residual data output by the scaling calculation unit after scaling can be returned to the promotion calculation unit through the cross-level routing channel to complete the final base conversion, so that the hardware pipeline path of the ciphertext promotion can be directly reused in the ciphertext scaling stage, and the resource reuse rate is maximized.

Description

Technical Field

[0001] This application relates to the field of homomorphic encryption technology, and in particular to an HPS hardware system and a homomorphic ciphertext operation method, apparatus, storage medium and computer equipment. Background Technology

[0002] With the deep integration of new power systems and cloud computing, the privacy protection of massive amounts of smart meter and power grid operation data is becoming increasingly prominent. Homomorphic encryption (HE) technology has become an ideal solution for power privacy computing because it allows direct analysis and computation of ciphertext, such as electricity statistics or load forecasting. However, in some mainstream homomorphic encryption schemes (such as Fan-Vercauteren, FV), the homomorphic multiplication operation of ciphertext is extremely complex, which is a core bottleneck restricting the performance of power grid data processing systems.

[0003] To efficiently process the ultra-large bit-width polynomial coefficients corresponding to encrypted power data in hardware, existing techniques typically employ a residual number system (RNS) to transform large integers into multiple independent parallel operations on small-modulus residuals. However, in FV ciphertext multiplication, two critical basis transformation operations are necessary: ​​first, scaling the polynomial coefficients from a small-modulus system q to a large-modulus system Q; and second, scaling the result back from Q to q after the operation.

[0004] Existing hardware architectures typically rely on the traditional Chinese Remainder Theorem (CRT) to implement basis transformation, first reconstructing the residual into a large integer. However, this inevitably introduces multiplication, accumulation, and division operations for multi-precision long integers, resulting in large integer circuits consuming massive logic resources, extremely long combinational logic delays, difficulty in achieving efficient pipelines, and limited overall throughput, failing to meet the real-time computing needs of massive high-frequency data from the power grid. Summary of the Invention

[0005] The purpose of this application is to at least solve one of the above-mentioned technical defects, in particular the technical defect that the existing technology has difficulty in achieving efficient pipelined operation during homomorphic ciphertext operation basis conversion, resulting in limited overall throughput and inability to meet the real-time computing needs of massive high-frequency data from the power grid.

[0006] This application provides an HPS hardware system, which includes an boosting computing unit, a scaling computing unit, and a cross-level routing channel;

[0007] Both the lifting calculation unit and the scaling calculation unit are composed of multiple processing blocks, which are used to perform concurrent small integer arithmetic operations on the corresponding residual data.

[0008] The enhancement calculation unit is used to enhance the residual data under the small module system to the residual data under the large module system;

[0009] The scaling calculation unit is used to scale the residual data under the large module system to the residual data under the small module system;

[0010] The two ends of the cross-level routing channel are connected to the boosting calculation unit and the scaling calculation unit, respectively, and are used to route the residual data output by the scaling calculation unit to the boosting calculation unit across levels.

[0011] Optionally, the boosting calculation unit includes a pre-multiplication module, an accumulation module, a summation and integer module, a modulo expansion module, and a residual correction module;

[0012] The pre-multiplication module, the summation and integer extraction block, the modulo expansion block, and the residual correction block are connected in sequence;

[0013] One end of the accumulation module is connected to the pre-multiplication module, and the other end is connected to the residual correction block;

[0014] The accumulation module contains multiple multiply-accumulate hardware circuits, and the summation module contains an on-chip ROM.

[0015] Optionally, the scaling calculation unit includes a multiplication accumulation block, a multiplication integer accumulation block, a multiplication fetch module, and a three-addition fetch module;

[0016] The multiplication accumulation block, the multiplication integer block, and the multiplication fetch module are respectively connected to the three-addition fetch module;

[0017] The multiplication accumulator block and the multiplication accumulator block both use multiplication accumulator hardware circuits without modulo reduction and subtraction functions, while the multiplication fetch module uses multiplication accumulator hardware circuits with modulo reduction and subtraction functions.

[0018] Optionally, the cross-level routing channel further includes:

[0019] The cross-level routing channel employs a bit-width adaptation circuit to convert the bit width of the residual data output by the scaling calculation unit after scaling, so as to adapt to the bit-width format of the boosting calculation unit.

[0020] This application also provides a homomorphic ciphertext operation method, applied to the HPS hardware system described in the above embodiments, the method comprising:

[0021] Obtain the small module coefficient residual in the small module system, and perform module boosting on the small module coefficient residual in the boosting calculation unit to obtain the large module coefficient residual;

[0022] The large modulus coefficient residual is processed by homomorphic operation using the large modulus system to obtain the large modulus result residual, and the large modulus result residual is modulo-scaled by the scaling calculation unit to obtain the intermediate result residual;

[0023] The intermediate result residuals are transmitted back to the boosting calculation unit through a cross-level routing channel for final base transformation to obtain the small modulus result residuals.

[0024] Optionally, the boosting calculation unit includes a pre-multiplication module, an accumulation module, a summation and integer module, a modulo expansion module, and a residual correction module;

[0025] The step of performing modulus boosting on the small modulus coefficient residual through the boosting calculation unit to obtain the large modulus coefficient residual includes:

[0026] The pre-multiplication module sequentially pre-multiplies and moduloes each residual in the small modulus coefficient residual to generate a first intermediate result.

[0027] The second intermediate result is obtained by performing a summation operation on each product term in the first intermediate result in parallel through the multiply-accumulate hardware circuits in the accumulation module.

[0028] The first intermediate result is multiplied by a pure integer array by the summation and integer retrieval block and the reciprocal of the high-precision constant pre-stored in the on-chip ROM to obtain an integer quotient.

[0029] The integer quotient is expanded by the modular expansion block to generate an expanded coefficient residual.

[0030] The residual correction block is used to subtract and correct the extended coefficient residual and the second intermediate result to obtain the large modulus coefficient residual.

[0031] Optionally, the scaling calculation unit includes a multiplication accumulation block, a multiplication integer accumulation block, a multiplication fetch module, and a three-addition fetch module;

[0032] The step of performing modular scaling on the large modulus result residual through the scaling calculation unit to obtain the intermediate result residual includes:

[0033] The multiplication accumulation block sequentially multiplies and sums each residual in the large modulus result residual with each constant in the pre-stored first constant sequence to obtain the accumulated value.

[0034] The multiplication accumulation block sequentially multiplies and sums each residual in the large modulus result residual with each constant in the pre-stored second constant sequence, and then rounds the summation result to obtain the rounded value.

[0035] The multiplication module sequentially multiplies each residual in the large modulus result residual with each constant in the pre-stored third constant sequence to obtain the preprocessed result residual.

[0036] The three-addition module sums and moduloes the accumulated value, the rounded value, and the preprocessing result residual to obtain the intermediate result residual.

[0037] This application also provides a homomorphic ciphertext operation method apparatus, including:

[0038] The module is used to obtain the small module coefficient residual in the small module system, and to perform module enhancement on the small module coefficient residual through the enhancement calculation unit to obtain the large module coefficient residual;

[0039] The module is used to perform homomorphic operation processing on the large modulus coefficient residual using the large modulus system to obtain the large modulus result residual, and to perform modulus scaling on the large modulus result residual through the scaling calculation unit to obtain the intermediate result residual;

[0040] The base transformation module is used to transmit the intermediate result residual back to the boosting calculation unit through the cross-level routing channel for final base transformation to obtain the small modulus result residual.

[0041] This application also provides a storage medium storing computer-readable instructions, which, when executed by one or more processors, cause the one or more processors to perform the steps of the homomorphic ciphertext operation method as described in any of the above embodiments.

[0042] This application also provides a computer device, including: one or more processors, and memory;

[0043] The memory stores computer-readable instructions, which, when executed by the one or more processors, perform the steps of the homomorphic ciphertext operation method as described in any of the above embodiments.

[0044] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0045] The HPS hardware system, homomorphic ciphertext operation method, apparatus, storage medium, and computer equipment provided in this application include an HPS hardware system comprising a boosting computation unit, a scaling computation unit, and a cross-level routing channel. The boosting computation unit can boost residual data in a small-modulus system from a small-modulus base to a large-modulus base, while the scaling computation unit can scale residual data in a large-modulus system from a large-modulus base to a small-modulus base. Both computation units consist of multiple processing blocks, thus transforming multi-precision operations on homomorphic ciphertexts into concurrent small-integer arithmetic operations, thereby improving computational efficiency. Furthermore, the cross-level routing channel allows the scaled residual data output by the scaling computation unit to be transmitted back to the boosting computation unit across levels to complete the final base transformation. This directly reuses the hardware pipeline path of ciphertext boosting during the ciphertext scaling stage, maximizing resource reuse. Attached Figure Description

[0046] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0047] Figure 1 This application provides a schematic diagram of the structure of an HPS hardware system according to an embodiment of the present application.

[0048] Figure 2 This is a schematic diagram of a homomorphic ciphertext operation method provided in an embodiment of this application;

[0049] Figure 3 A schematic diagram of the architecture of a boosting computation unit based on small integer arithmetic provided in an embodiment of this application;

[0050] Figure 4 A schematic diagram of the architecture of a scaling computation unit based on small integer arithmetic provided in an embodiment of this application;

[0051] Figure 5 A schematic diagram of the architecture of an improvement computing unit based on multi-precision arithmetic provided in an embodiment of this application;

[0052] Figure 6 A schematic diagram of the architecture of a scaling computation unit based on multi-precision arithmetic provided in an embodiment of this application;

[0053] Figure 7 A schematic diagram of a homomorphic ciphertext processing device provided in an embodiment of this application;

[0054] Figure 8 This is a schematic diagram of the internal structure of a computer device provided in an embodiment of this application. Detailed Implementation

[0055] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0056] Existing hardware architectures typically rely on the traditional Chinese Remainder Theorem (CRT) to implement basis transformation, first reconstructing the residual into a large integer. However, this inevitably introduces multiplication, accumulation, and division operations for multi-precision long integers, resulting in large integer circuits consuming massive logic resources, extremely long combinational logic delays, difficulty in achieving efficient pipelines, and limited overall throughput, failing to meet the real-time computing needs of massive high-frequency data from the power grid.

[0057] Based on this, this application proposes the following technical solution, as detailed below:

[0058] In one embodiment, such as Figure 1 As shown, Figure 1 This is a schematic diagram of the structure of an HPS hardware system provided in an embodiment of this application; this application provides an HPS hardware system, including an boost computing unit, a scaling computing unit, and a cross-level routing channel.

[0059] Both the boosting and scaling computation units consist of multiple processing blocks used to perform concurrent small integer arithmetic operations on the corresponding residual data.

[0060] The boosting unit is used to boost residual data from a small-module system to a large-module system.

[0061] The scaling calculation unit is used to scale residual data from a large-modulus system to residual data from a small-modulus system.

[0062] The two ends of the cross-level routing channel are connected to the boosting calculation unit and the scaling calculation unit, respectively, and are used to transmit the residual data output by the scaling calculation unit after scaling back to the boosting calculation unit across levels.

[0063] In this embodiment, the computer device can perform hardware acceleration processing of the base transformation task in the homomorphic ciphertext multiplication process based on the HPS (Halevi-Polyakov-Shoup) hardware system. The HPS hardware system mainly consists of a lifting computation unit, a scaling computation unit, and a cross-level routing channel. Both the lifting and scaling computation units are composed of multiple processing blocks, which can completely transform time-consuming multi-precision operations into multiple concurrent small integer arithmetic operations. The cross-level routing channel is located between the lifting and scaling computation units, allowing the ciphertext scaling operation to directly import and fully reuse the underlying hardware pipeline path of the ciphertext lifting unit, thereby improving the efficiency of homomorphic ciphertext operations.

[0064] It should be noted that the HPS hardware system in this application refers to the complete mapping of the HPS approximation algorithm to custom hardware. It can make full use of the algorithm's parallelism and completely transform time-consuming multi-precision operations into multiple concurrent small integer arithmetic operations.

[0065] Specifically, the boosting computation unit can be used to perform basis boosting operations from a small-module system q to a large-module system Q. During the operation, the boosting computation unit can first decompose the polynomial coefficients into multiple small-module residual data, and then use the pre-calculated transformation constants stored in each processing block to generate new residual values ​​for the large-module system through concurrent small-integer multiplication and accumulation. Since the entire transformation process is always completed within the residual domain, there is no need for large-integer reconstruction and division recovery as in traditional CRTs, thus significantly reducing hardware logic complexity. Similarly, multiple processing blocks in the scaling computation unit can perform basis scaling operations from a large-module system Q to a small-module system q.

[0066] Furthermore, the cross-level routing channel enables the cross-level backhaul of residual data between different computation stages. Since the scaled residual data output by the scaling computation unit is obtained based on the additional extended auxiliary modulus base, this application also needs to convert it to the original modulus base. Here, this application can directly route the scaled residual data output by the scaling computation unit across levels through the cross-level routing channel and input it into the boosting computation unit, perfectly reusing the existing hardware pipeline path of the boosting computation section to complete the final base conversion, thereby maximizing the resource reuse rate of the chip logic unit.

[0067] Furthermore, to improve pipeline processing capabilities, a cascaded pipeline structure can be adopted between the processing blocks in the two computing units. Therefore, while the subsequent processing block receives the calculation results from the previous processing block and performs the corresponding calculations, the previous processing block can continue to perform subsequent data calculations. This ensures that the operation cycle within each processing block is strictly controlled within the minimum clock cycle, thus forming a seamless pipeline and ensuring that the data source is continuously output with high throughput.

[0068] In the above embodiments, the HPS hardware system includes an enhancement computing unit, a scaling computing unit, and a cross-level routing channel. The enhancement computing unit can enhance the residual data in the small-modulus system from a small-modulus base to a large-modulus base, while the scaling computing unit can scale the residual data in the large-modulus system from a large-modulus base to a small-modulus base. Both computing units are composed of multiple processing blocks, thus transforming the multi-precision operation of homomorphic ciphertext into concurrent small integer arithmetic operations, thereby improving computational efficiency. In addition, the cross-level routing channel can transmit the residual data output by the scaling computing unit back to the enhancement computing unit to complete the final base conversion, thereby directly reusing the hardware pipeline path of ciphertext enhancement during the ciphertext scaling stage and maximizing resource reuse.

[0069] In one embodiment, such as Figure 1 As shown, the boosting calculation unit may include a pre-multiplication module, an accumulation module, a summation and integer module, a modulo expansion module, and a residual correction module.

[0070] The pre-multiplication module, the summation and integerization block, the modulo expansion block, and the residual correction block are connected in sequence.

[0071] One end of the accumulation module is connected to the pre-multiplication module, and the other end is connected to the residual correction block.

[0072] The accumulation module contains multiple multiply-accumulate hardware circuits, while the summation module is equipped with on-chip ROM.

[0073] In this embodiment, the processing block of the boosting computing unit may include a pre-multiplication module, an accumulation module, a summation and integer retrieval block, a modular multiplication extension block, and a residual correction block. The pre-multiplication module, summation and integer retrieval block, modular multiplication extension block, and residual correction block are connected sequentially to form a pipeline path; one end of the accumulation module is connected to the pre-multiplication module, and the other end is connected to the residual correction block, forming a bypass accumulation path.

[0074] Specifically, the pre-multiply-fetch module is mainly responsible for calling pre-stored pre-computation constants to perform small integer modular multiplication operations. By splitting large integer operations into multiple small integer modular multiplication operations, the data bit width of a single operation is reduced, thereby reducing the size of the hardware multiplier. The accumulator-fetch module has multiple multiply-accumulate hardware circuits deployed inside, which are mainly responsible for parallel execution of multiply-accumulate processing. Compared with the traditional CRT base conversion process that uses long integer serial accumulation, this structure can use multiple small integer multiply-accumulate units to synchronously complete partial sum calculations, thereby reducing the timing pressure caused by the long bit width carry chain and improving the overall pipeline processing efficiency.

[0075] Furthermore, the summation and rounding block is primarily responsible for performing approximate summation and rounding operations. This block is equipped with on-chip ROM, which pre-stores high-precision reciprocals of constants. During computation, the summation and rounding block can use these reciprocals to perform integer array multiplication, thus completely avoiding division and floating-point operations and reducing the probability of approximation errors. The modulo expansion block is primarily responsible for expanding the summation and rounding results to large-modulus systems. This process is always completed within the small integer domain, so there is no need to restore the original large integer data, thereby avoiding the large bit-width data path in traditional CRT architectures. The residual correction block is primarily responsible for performing error correction on the expanded residual results, ensuring that the final output meets the residual range requirements corresponding to large-modulus systems.

[0076] In one embodiment, such as Figure 1 As shown, the scaling calculation unit may include a multiplication accumulation block, a multiplication integer accumulation block, a multiplication fetch module, and a three-addition fetch module.

[0077] The multiplication accumulation block, multiplication integer accumulation block, and multiplication fetch module are respectively connected to the three-addition fetch module.

[0078] Among them, the multiplication accumulator block and the multiplication accumulator block both use multiplication accumulator hardware circuits without modulo reduction and subtraction functions, while the multiplication fetch module uses multiplication accumulator hardware circuits with modulo reduction and subtraction functions.

[0079] In this embodiment, the processing block of the scaling calculation unit may include a multiplication accumulation block, a multiplication integer block, a multiplication fetch module, and a three-addition fetch module. The multiplication accumulation block, the multiplication integer block, and the multiplication fetch module are respectively connected to the three-addition fetch module, thereby forming a multi-path parallel convergence data processing structure. Among them, the multiplication accumulation block and the multiplication integer block both adopt multiplication accumulation hardware circuits without modulo reduction and subtraction functions, while the multiplication fetch module adopts multiplication accumulation hardware circuits with modulo reduction and subtraction functions.

[0080] Specifically, the multiplication-accumulation block is mainly responsible for performing multiplication-accumulation operations, while the multiplication-integer block is mainly responsible for performing multiplication-accumulation and rounding operations. Both of these processing blocks can use multiplication-accumulation hardware circuits without modulo reduction functionality, thereby avoiding the additional logic overhead caused by frequent modulo reduction during overshoot in each multiplication-accumulation calculation and improving pipeline processing efficiency. The multiplication-integer module is mainly responsible for generating scaled residual results for small modulus systems. It can use multiplication-accumulation hardware circuits with modulo reduction functionality, performing modulo reduction processing simultaneously with multiplication-accumulation, thereby quickly outputting residual data that meets the target modulus range requirements, reducing the pressure on subsequent normalization processing, and reducing the cache overhead caused by intermediate result bit width expansion.

[0081] Furthermore, the three-addition module is mainly responsible for performing fusion calculations and modular normalization on the data output by the multiplication accumulation block, the multiplication integer block, and the multiplication retrieval module, so as to uniformly correct the approximation errors generated during the scaling process and improve the numerical stability and accuracy of the scaling results.

[0082] In one embodiment, the cross-level routing channel may further include:

[0083] The cross-level routing channel employs a bit-width adaptation circuit to convert the bit width of the residual data output by the scaling calculation unit after scaling, so as to adapt to the bit-width format of the boosting calculation unit.

[0084] In this embodiment, a bit width adaptation circuit is provided in the cross-level routing channel. This circuit can be connected between the output end of the scaling calculation unit and the input end of the boosting calculation unit. It is used to perform bit width conversion on the intermediate result residual output by the scaling calculation unit so that it conforms to the fixed bit width format required by the input port of the boosting calculation unit.

[0085] For example, the residual data output by the scaling computation unit consists of 7 residual values. Since the multiplication-accumulation operation during pre-scaling may cause bit-width expansion, each residual is represented as a 48-bit unsigned integer under the auxiliary modulus base p. However, the expected residual bit width at the input of the pre-multiplication module of the boosting computation unit is a 30-bit unsigned integer, which is the standard bit width under a small modulus system. In this case, the bit-width adaptation circuit can truncate each input 48-bit residual value, retaining the lower 30 bits of valid data and discarding the higher 18 bits. It should be noted that since subsequent base conversion operations are not sensitive to small errors in the higher bits and the overall algorithm error is controlled within a certain range... The following truncation will not affect the correctness of the final result.

[0086] Furthermore, if the boosting unit requires a signed number as input, the bit width adaptation circuit uses the most significant bit of the truncated 30-bit data as the sign bit, expands it to a 32-bit signed integer format, and then sends it to the boosting unit. Conversely, if the residual bit width output by the scaling unit is less than the bit width required by the boosting unit, the bit width adaptation circuit can pad the high-order bits of the low-order data with zeros to form a 30-bit integer.

[0087] In one embodiment, such as Figure 2 As shown, Figure 2 This application provides a schematic diagram of a homomorphic ciphertext operation method according to an embodiment of the present application; the present application also provides a homomorphic ciphertext operation method applied to an HPS hardware system, the method specifically including the following:

[0088] S110: Obtain the small module coefficient residual in the small module system, and perform module boosting on the small module coefficient residual in the boosting calculation unit to obtain the large module coefficient residual.

[0089] S120: Use the large modulus system to perform homomorphic operation on the large modulus coefficient residuals to obtain the large modulus result residuals, and use the scaling calculation unit to perform modulus scaling on the large modulus result residuals to obtain intermediate result residuals.

[0090] S130: The intermediate result residual is sent back to the boosting calculation unit through the cross-level routing channel for the final base transformation to obtain the small modulus result residual.

[0091] In this embodiment, when performing homomorphic ciphertext operations based on the HPS hardware system, the computer device can first obtain the small modulus coefficient residual in the small modulus system, and then perform modulus boosting on the small modulus coefficient residual in the boosting calculation unit to obtain the large modulus coefficient residual. Then, the large modulus system is used to perform homomorphic operation processing on the large modulus coefficient residual to obtain the large modulus result residual. The large modulus result residual is then modulus scaled by the scaling calculation unit to obtain the intermediate result residual. Finally, the intermediate result residual can be sent back to the boosting calculation unit through the cross-level routing channel for the final base transformation to obtain the small modulus result residual.

[0092] Specifically, the computer device can obtain the small modulus coefficient residuals under the small modulus system. These small modulus coefficient residuals can be represented as six residuals, and the small modulus system can be composed of six 30-bit small moduli. Subsequently, the computer device can input these residuals into the boosting calculation unit for modulus boosting, transforming these six residuals into seven residuals under the large modulus system, i.e., large modulus coefficient residuals. This allows the large modulus system to perform homomorphic operations on the large modulus coefficient residuals, generating large modulus result residuals. It should be noted that the large modulus system consists of thirteen 30-bit moduli.

[0093] Furthermore, the computer device can input the large-module result residuals generated by the large-module system into the scaling computation unit for module scaling to obtain intermediate result residuals. Since these intermediate result residuals are still under the auxiliary module basis expanded during the scaling process, the computer device needs to send the intermediate result residuals back to the boosting computation unit through a cross-level routing channel, and start the boosting computation unit to execute a complete basis transformation pipeline, converting the seven residuals under the auxiliary module basis into six residuals under the small-module system, as the final small-module residual result.

[0094] Based on this, this application can achieve efficient reuse of hardware resources in the ciphertext base conversion process. It reduces hardware design complexity and timing pressure by splitting multi-precision operations into multiple concurrent small integer arithmetic operations, and improves the hardware path of the computing unit through cross-level routing reuse to avoid redundant configuration of additional hardware resources. While ensuring the accuracy of the operation, it significantly improves the throughput of homomorphic ciphertext base conversion, reduces hardware resource overhead, and achieves efficient hardware acceleration of homomorphic encrypted ciphertext operations.

[0095] For example, at a clock speed of 200MHz, the computation time for ciphertext boosting and scaling of a 4096th-order polynomial can be compressed to approximately 82 microseconds. Furthermore, referencing optimized software implementations of high-end general-purpose processors such as the 1.8GHz Intel i5, the HPS hardware system equipped with this application can perform 400 homomorphic multiplications per second, achieving a performance leap of over 13 times, while maintaining a dynamic power consumption as low as 2.2W under full load single-core concurrent execution.

[0096] In a specific embodiment, the performance difference between the solution implemented based on the HPS hardware system and the traditional implementation solution can be shown in Table 1:

[0097] Table 1

[0098]

[0099] In Table 1, the boosting computing unit and scaling computing unit of this application require only approximately 99,000 and 99,000 clock cycles, respectively, with latency of 82.6 microseconds and 82.7 microseconds, respectively; while traditional solutions require lower parameters. Downtime up to 5.0 milliseconds, at higher parameters The latency reaches 11.9 milliseconds. This clearly demonstrates that this application, through a pure small integer pipeline architecture and hardware reuse design, reduces the latency of ciphertext lifting and scaling operations by two orders of magnitude, significantly improving the processing speed of homomorphic encryption operations.

[0100] In the above embodiments, this application can improve the residual data in the small-modulus system to a large-modulus system by using the boosting computing unit, and can scale the residual data in the large-modulus system from a large-modulus system to a small-modulus system by using the scaling computing unit. Since both computing units are composed of multiple processing blocks, this application can transform the multi-precision operation of homomorphic ciphertext into concurrent small integer arithmetic operations, thereby improving computational efficiency. In addition, the residual data output by the scaling computing unit after scaling can be sent back to the boosting computing unit across levels to complete the final base conversion through the cross-level routing channel, thereby directly reusing the hardware pipeline path of ciphertext boosting in the ciphertext scaling stage and maximizing resource reuse.

[0101] In one embodiment, the boosting calculation unit in step S110 may include a pre-multiplication module, an accumulation module, a summation and integer extraction block, a modulus expansion block, and a residual correction block; wherein, the process of boosting the small modulus coefficient residual to obtain the large modulus coefficient residual through the boosting calculation unit may include:

[0102] S111: The pre-multiplication and modulo operation is performed sequentially on each residual in the small modulus coefficient residuals by the pre-multiplication and modulo operation module to generate the first intermediate result.

[0103] S112: The second intermediate result is obtained by performing a summation operation on each product term in the first intermediate result in parallel through the multiply-accumulate hardware circuits in the accumulator module.

[0104] S113: The integer quotient is obtained by performing a pure integer array multiplication on the first intermediate result and the reciprocal of the high-precision constant pre-stored in the on-chip ROM through summation and integer taking.

[0105] S114: Modular expansion of the integer quotient is performed through a modular expansion block to generate the expansion coefficient residual.

[0106] S115: The residual of the extended coefficient and the second intermediate result are corrected by subtraction through the residual correction block to obtain the residual of the large modulus coefficient.

[0107] In this embodiment, the boosting calculation unit may include a pre-multiplication module, an accumulation module, a summation and integer extraction block, a modulo expansion block, and a residual correction block. After the computer device inputs the small modulus coefficient residuals into the boosting calculation unit, the pre-multiplication module can sequentially perform pre-multiplication and modulo extraction on each residual in the small modulus coefficient residuals to generate a first intermediate result. The accumulation module can then perform summation operations on each product term in the first intermediate result in parallel through its built-in multiplication and accumulation hardware circuits to obtain a second intermediate result. Subsequently, the summation and integer extraction block can perform pure integer array multiplication on the first intermediate result and the reciprocal of a high-precision constant pre-stored in the on-chip ROM to obtain an integer quotient. The modulo expansion block can then perform modulo expansion on the integer quotient to generate an expanded coefficient residual. Finally, the residual correction block performs subtraction correction on the expanded coefficient residual and the second intermediate result to obtain a large modulus coefficient residual.

[0108] Specifically, such as Figure 3 As shown, Figure 3 A schematic diagram of an architecture for a small integer arithmetic-based boosting computation unit provided in an embodiment of this application; Figure 3 In the middle, the pre-multiplication module receives these six residuals. Then, for each residual With internally stored pre-calculated constants Perform multiplication operations and use the modulo operator. The result is modulo-simplified to generate the first intermediate result. This process consumes a total of six clock cycles. The operation process of the pre-multiplication module can be represented as follows:

[0109] ;

[0110] The accumulation module contains seven parallel multiply-accumulate hardware circuits, each using pre-stored, pre-calculated constants. Perform multiplication and summation on the first intermediate result, and then apply the summation to a target modulus. Modulo operation is performed to output the second intermediate result in parallel. The operation process of the accumulation module can be represented as follows:

[0111] ;

[0112] Summation and integer extraction can read the reciprocal of a high-precision constant pre-stored in the on-chip ROM. , the first intermediate result Perform pure integer array multiplication with these constants, sum them up, and then round down to obtain the integer quotient. The process of summing and taking the integer part can be represented as follows:

[0113] ;

[0114] Modulo extension blocks can convert integer quotients Multiply by its constant q, and respectively with respect to Modulus calculation to generate extended coefficient residuals The operation process of the modulo expansion block can be represented as follows:

[0115] ;

[0116] The residual correction block can simultaneously receive the second intermediate result from the accumulator module and the expansion coefficient residual from the modulo expansion block, for each pair Performing the subtraction operation ultimately outputs a large-scale coefficient residual. The operation process of the residual correction block can be represented as follows:

[0117] .

[0118] In one embodiment, the scaling calculation unit in step S120 may include a multiplication accumulation block, a multiplication integer accumulation block, a multiplication fetch module, and a three-addition fetch module; wherein, the process of performing modular scaling on the large modulus result residual through the scaling calculation unit to obtain the intermediate result residual may include:

[0119] S121: The cumulative value is obtained by multiplying and summing each residual in the large modulus result residual with each constant in the pre-stored first constant sequence through the multiplication accumulation block.

[0120] S122: The residuals in the large modulus result residuals are multiplied and summed sequentially with the constants in the pre-stored second constant sequence by multiplication and accumulation blocks, and the summation result is rounded to obtain the rounded value.

[0121] S123: The multiplication module is used to multiply each residual in the large modulus result residual with each constant in the pre-stored third constant sequence to obtain the preprocessed result residual.

[0122] S124: The cumulative value, the rounded value, and the preprocessing result residual are summed and moduloed by the three-addition module to obtain the intermediate result residual.

[0123] In this embodiment, the scaling calculation unit may include a multiplication accumulation block, a multiplication integer accumulation block, a multiplication extract module, and a three-addition extract module. After the computer device inputs the large modulus result residual into the scaling calculation unit, the multiplication accumulation block can sequentially multiply and sum each residual in the large modulus result residual with each constant in the pre-stored first constant sequence to obtain an accumulated value. The multiplication integer accumulation block can sequentially multiply and sum each residual in the large modulus result residual with each constant in the pre-stored second constant sequence, and round the summation result to obtain a rounded value. The multiplication extract module can sequentially multiply and take the modulus of each residual in the large modulus result residual with each constant in the pre-stored third constant sequence to obtain a preprocessed result residual. Finally, the three-addition extract module can sum and take the modulus of the accumulated value, rounded value, and preprocessed result residual output by the first three processing modules to obtain an intermediate result residual.

[0124] Specifically, such as Figure 4 As shown, Figure 4 A schematic diagram of an architecture for a small integer arithmetic scaling calculation unit provided in an embodiment of this application; Figure 4 In the multiplication accumulation block, the first constant sequence is pre-stored. It receives the modulus located at The large modulus result residuals, i.e., seven residual values. Then, each residual can be... With the corresponding constant Multiply the products and sum all the product terms to obtain the cumulative value. The operation process of the multiplication accumulation block can be represented as follows:

[0125] ;

[0126] The multiplication accumulation block contains a pre-stored sequence of the first constant. It can convert each residual With the corresponding constant Multiply and sum the results, then round the sum to the nearest integer, discarding the decimal part. Among them, constants It is split into an integer part and a fractional part with 60 digits of precision, approximating real number operations with pure integer multiplication. The process of accumulating the multiplication block can be represented as follows:

[0127] ;

[0128] The multiplication module has a pre-stored third constant sequence. It can convert each residual Multiply by the corresponding constant and take the modulus of the result. Generate preprocessing result residuals The operation process of the multiplication module can be represented as follows:

[0129] ;

[0130] The three-add module can add values ​​from the multiplication accumulator block. The integer value from the multiplication accumulation block and the preprocessing result residual from the multiplication module Perform summation and modulo operation to obtain intermediate residuals. The operation process of the three-addition module can be represented as follows:

[0131] .

[0132] Furthermore, Figure 4 The last processing block in the process represents the base conversion operation. It is not a separate hardware circuit, but rather it sends the seven residuals under the auxiliary modulus base p output by Block4 directly to the input of the ciphertext lifting calculation unit through a cross-level routing channel. It fully reuses the existing five-stage processing block pipeline of the lifting calculation unit, thereby converting the residuals under the auxiliary modulus base p into the final residuals under the original modulus base q, realizing the final step of scaling back from the large modulus system to the small modulus system.

[0133] In one specific embodiment, the architecture of the boosting computing unit and scaling computing unit of this application is not limited to that shown below. Figure 2 and Figure 3 The small integer arithmetic architecture described herein can be applied to any other unit architecture capable of concurrent execution, and no restrictions are imposed here. For example... Figure 5 and Figure 6 As shown, Figure 5 A schematic diagram of the architecture of an improvement computing unit based on multi-precision arithmetic provided in an embodiment of this application; Figure 6 This is a schematic diagram of the architecture of a scaling computation unit based on multi-precision arithmetic provided in an embodiment of this application. Figure 5 and Figure 6 The example uses a unit architecture consisting of multiple processing blocks. This application can compute concurrent solutions under a large modulus system Q to reconstruct the complete large integer. Subsequently, when performing the critical target modulus division operation, it abandons the conventional divider logic and instead performs the calculation by multiplying the reconstructed ultra-large integer dividend (e.g., up to 390 bits) with the reciprocal of a pre-computed extremely high-precision constant (e.g., with a precision greater than 571 bits) using a long integer. Furthermore, considering that this multi-precision long integer multiplication circuit is extremely large, and that the ciphertext lifting and scaling operations are not executed concurrently in the time sequence of homomorphic computation, Figure 5 and Figure 6 The multiplexing mechanism configured in the chip allows these two computing units to share this massive multi-precision division hardware in a time-sharing manner, thereby effectively limiting the excessive expansion of the overall chip logic area while adopting a long integer reconstruction approach.

[0134] The following describes the homomorphic ciphertext operation method apparatus provided in the embodiments of this application. The homomorphic ciphertext operation method apparatus described below can be referred to in correspondence with the homomorphic ciphertext operation method described above.

[0135] In one embodiment, such as Figure 7 As shown, Figure 7 This application provides a schematic diagram of a homomorphic ciphertext processing device according to an embodiment of the present application. The present application also provides a homomorphic ciphertext processing device, including a modulus-to-digital enhancement module 210, a modulus-to-digital scaling module 220, and a base conversion module 230, specifically comprising the following:

[0136] Modulus enhancement module 210 is used to obtain the small modulus coefficient residual in the small modulus system, and to enhance the small modulus coefficient residual through the enhancement calculation unit to obtain the large modulus coefficient residual.

[0137] Modulus scaling module 220 is used to perform homomorphic operation processing on the large modulus coefficient residual using the large modulus system to obtain the large modulus result residual, and to perform modulus scaling on the large modulus result residual through the scaling calculation unit to obtain the intermediate result residual.

[0138] The base transformation module 230 is used to transmit the intermediate result residual back to the boosting calculation unit through the cross-level routing channel for the final base transformation, so as to obtain the small modulus result residual.

[0139] In the above embodiments, this application can improve the residual data in the small-modulus system to a large-modulus system by using the boosting computing unit, and can scale the residual data in the large-modulus system from a large-modulus system to a small-modulus system by using the scaling computing unit. Since both computing units are composed of multiple processing blocks, this application can transform the multi-precision operation of homomorphic ciphertext into concurrent small integer arithmetic operations, thereby improving computational efficiency. In addition, the residual data output by the scaling computing unit after scaling can be sent back to the boosting computing unit across levels to complete the final base conversion through the cross-level routing channel, thereby directly reusing the hardware pipeline path of ciphertext boosting in the ciphertext scaling stage and maximizing resource reuse.

[0140] In one embodiment, the modulus-to-digital conversion module 210 may include:

[0141] The pre-multiplication and modulus submodule is used to perform pre-multiplication and modulus on each residual in the small modulus coefficient residual in sequence to generate the first intermediate result.

[0142] The accumulator module is used to perform a summation operation on each product term in the first intermediate result in parallel through the multiply-accumulate hardware circuits in the accumulator module to obtain the second intermediate result.

[0143] The summation and integer submodule is used to perform pure integer array multiplication on the first intermediate result and the reciprocal of the high-precision constant pre-stored in the on-chip ROM to obtain the integer quotient.

[0144] The modular expansion submodule is used to perform modular expansion on integer quotients through modular expansion blocks to generate expanded coefficient residuals.

[0145] The residual correction submodule is used to perform subtraction correction on the extended coefficient residual and the second intermediate result through the residual correction block to obtain the large modulus coefficient residual.

[0146] In one embodiment, the modulus scaling module 220 may include:

[0147] The multiplication-accumulation submodule is used to multiply and sum the residuals in the large modulus result residuals with the constants in the pre-stored first constant sequence in turn to obtain the accumulated value.

[0148] The multiplication accumulation submodule is used to multiply and sum the residuals in the large modulus result residuals with the constants in the pre-stored second constant sequence, and then round the summation result to obtain the rounded value.

[0149] The multiplication and modulus submodule is used to multiply each residual in the large modulus result residual with each constant in the pre-stored third constant sequence to obtain the preprocessed result residual.

[0150] The three-addition modulo submodule is used to sum and modulo the accumulated value, the rounded value, and the preprocessed result residual to obtain the intermediate result residual.

[0151] In one embodiment, this application also provides a storage medium storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the homomorphic ciphertext operation method as described in any of the above embodiments.

[0152] In one embodiment, this application also provides a computer device storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the homomorphic ciphertext operation method as described in any of the above embodiments.

[0153] Indicatively, such as Figure 8As shown, Figure 8 This is a schematic diagram of the internal structure of a computer device 300 provided in an embodiment of this application. The computer device 300 can be provided as a server. (Refer to...) Figure 8 The computer device 300 includes a processing component 302, which further includes one or more processors, and memory resources represented by memory 301 for storing instructions executable by the processing component 302, such as application programs. The application programs stored in memory 301 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 302 is configured to execute instructions to perform the homomorphic ciphertext operation methods of any of the above embodiments.

[0154] The computer device 300 may also include a power supply component 303 configured to perform power management of the computer device 300, a wired or wireless network interface 304 configured to connect the computer device 300 to a network, and an input / output (I / O) interface 305. The computer device 300 may operate on an operating system stored in memory 301, such as Windows Server™, Mac OS X™, Unix™, Linux™, Free BSD™, or similar.

[0155] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0156] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0157] The various embodiments in this specification are described in a progressive manner. Each embodiment focuses on the differences from other embodiments. The various embodiments can be combined as needed, and the same or similar parts can be referred to each other.

[0158] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An HPS hardware system, characterized in that, The HPS hardware system includes an boost computing unit, a scaling computing unit, and a cross-level routing channel; Both the lifting calculation unit and the scaling calculation unit are composed of multiple processing blocks, which are used to perform concurrent small integer arithmetic operations on the corresponding residual data. The enhancement calculation unit is used to enhance the residual data under the small module system to the residual data under the large module system; The scaling calculation unit is used to scale the residual data under the large module system to the residual data under the small module system; The two ends of the cross-level routing channel are connected to the boosting calculation unit and the scaling calculation unit, respectively, and are used to route the residual data output by the scaling calculation unit to the boosting calculation unit across levels.

2. The HPS hardware system according to claim 1, characterized in that, The boosting calculation unit includes a pre-multiplication module, an accumulation module, a summation and integer module, a modulo expansion module, and a residual correction module; The pre-multiplication module, the summation and integer extraction block, the modulo expansion block, and the residual correction block are connected in sequence; One end of the accumulation module is connected to the pre-multiplication module, and the other end is connected to the residual correction block; The accumulation module contains multiple multiply-accumulate hardware circuits, and the summation module contains an on-chip ROM.

3. The HPS hardware system according to claim 1, characterized in that, The scaling calculation unit includes a multiplication accumulation block, a multiplication integer accumulation block, a multiplication fetch module, and a three-addition fetch module; The multiplication accumulation block, the multiplication integer block, and the multiplication fetch module are respectively connected to the three-addition fetch module; The multiplication accumulator block and the multiplication accumulator block both use multiplication accumulator hardware circuits without modulo reduction and subtraction functions, while the multiplication fetch module uses multiplication accumulator hardware circuits with modulo reduction and subtraction functions.

4. The HPS hardware system according to claim 1, characterized in that, The cross-level routing channel also includes: The cross-level routing channel employs a bit-width adaptation circuit to convert the bit width of the residual data output by the scaling calculation unit after scaling, so as to adapt to the bit-width format of the boosting calculation unit.

5. A homomorphic ciphertext operation method, applied to the HPS hardware system as described in any one of claims 1-4, characterized in that, The method includes: Obtain the small module coefficient residual in the small module system, and perform module boosting on the small module coefficient residual in the boosting calculation unit to obtain the large module coefficient residual; The large modulus coefficient residual is processed by homomorphic operation using the large modulus system to obtain the large modulus result residual, and the large modulus result residual is modulo-scaled by the scaling calculation unit to obtain the intermediate result residual; The intermediate result residuals are transmitted back to the boosting calculation unit through a cross-level routing channel for final base transformation to obtain the small modulus result residuals.

6. The homomorphic ciphertext operation method according to claim 5, characterized in that, The boosting calculation unit includes a pre-multiplication module, an accumulation module, a summation and integer extraction block, a modulo expansion block, and a residual correction block; the summation and integer extraction block is equipped with an on-chip ROM. The step of performing modulus boosting on the small modulus coefficient residual through the boosting calculation unit to obtain the large modulus coefficient residual includes: The pre-multiplication module sequentially pre-multiplies and moduloes each residual in the small modulus coefficient residual to generate a first intermediate result. The second intermediate result is obtained by performing a summation operation on each product term in the first intermediate result in parallel through the multiply-accumulate hardware circuits in the accumulation module. The first intermediate result is multiplied by a pure integer array by the summation and integer retrieval block and the reciprocal of the high-precision constant pre-stored in the on-chip ROM to obtain an integer quotient. The integer quotient is expanded by the modular expansion block to generate an expanded coefficient residual. The residual correction block is used to subtract and correct the extended coefficient residual and the second intermediate result to obtain the large modulus coefficient residual.

7. The homomorphic ciphertext operation method according to claim 5, characterized in that, The scaling calculation unit includes a multiplication accumulation block, a multiplication integer accumulation block, a multiplication fetch module, and a three-addition fetch module; The step of performing modular scaling on the large modulus result residual through the scaling calculation unit to obtain the intermediate result residual includes: The multiplication accumulation block sequentially multiplies and sums each residual in the large modulus result residual with each constant in the pre-stored first constant sequence to obtain the accumulated value. The multiplication accumulation block sequentially multiplies and sums each residual in the large modulus result residual with each constant in the pre-stored second constant sequence, and then rounds the summation result to obtain the rounded value. The multiplication module sequentially multiplies each residual in the large modulus result residual with each constant in the pre-stored third constant sequence to obtain the preprocessed result residual. The three-addition module sums and moduloes the accumulated value, the rounded value, and the preprocessing result residual to obtain the intermediate result residual.

8. A homomorphic ciphertext operation method apparatus, applied to the HPS hardware system as described in any one of claims 1-4, characterized in that, include: The module is used to obtain the small module coefficient residual in the small module system, and to perform module enhancement on the small module coefficient residual through the enhancement calculation unit to obtain the large module coefficient residual; The module is used to perform homomorphic operation processing on the large modulus coefficient residual using the large modulus system to obtain the large modulus result residual, and to perform modulus scaling on the large modulus result residual through the scaling calculation unit to obtain the intermediate result residual; The base transformation module is used to transmit the intermediate result residual back to the boosting calculation unit through the cross-level routing channel for final base transformation to obtain the small modulus result residual.

9. A storage medium, characterized in that: The storage medium stores computer-readable instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of the homomorphic ciphertext operation method as described in any one of claims 5 to 7.

10. A computer device, characterized in that, include: One or more processors, and memory; The memory stores computer-readable instructions, which, when executed by the one or more processors, perform the steps of the homomorphic ciphertext operation method as described in any one of claims 5 to 7.

Images