A homomorphic encryption processor architecture design method and system

Abstract

The application discloses a full homomorphic encryption processor architecture design method, which comprises the following steps: a homomorphic processor HPU is taken as an extension unit of the processor by extending a processor core; input homomorphic encryption instructions are divided into different types of instructions after being decoded by a decoding module, input into different homomorphic instruction execution units, and transmitted to corresponding hardware units by a multi-emission control module according to data dependency determined by a dependency management module; a homomorphic computation minimum kernel CMK of full homomorphic encryption computation is extracted, a hierarchical homomorphic instruction set H-ISA is constructed based on the abstraction of the CMK, and the H-ISA comprises bottom microinstructions and upper macroinstructions; and a reusable homomorphic instruction execution unit HIU is constructed according to the common computation kernel of full homomorphic encryption. The application enables the application of a multi-FHE scheme to be executed on a unified architecture, and the kernel design can reuse the homomorphic computation unit with high utilization.

Description

Technical Field

[0001] This invention relates to the field of fully homomorphic encryption, and more specifically to a fully homomorphic encryption processor architecture design method and electronic device. Background Technology

[0002] Fully Homomorphic Encryption (FHE) enables computation on ciphertext without decryption, keeping the data "usable but not visible" throughout the computation process. It is suitable for scenarios such as finance, healthcare, privacy-focused machine learning, and secure inference. Typical FHE schemes include BFV, BGV, CKKS, and TFHE. BFV, BGV, and CKKS are primarily designed for arithmetic circuits and support batch computation in Single-Instruction-Multiple-Data (SIMD) format. TFHE is primarily designed for Boolean circuits and supports lookup table mapping and noise refresh through Programmable Bootstrapping (PBS). Different schemes vary significantly in ciphertext format, computation flow, key materials, and application scenarios.

[0003] FHE computation typically involves performing polynomial addition, multiplication, number-theoretic transformations (NTTs), inverse number-theoretic transformations (INTTs), automorphism, key switching, and bootstrapping on large modulus integer rings. Even with highly optimized software libraries, FHE applications can still be orders of magnitude slower than plaintext computations, thus requiring dedicated hardware to improve performance. Existing hardware solutions mainly include GPUs, FPGAs, ASIC accelerators, and fixed-function accelerators for specific schemes or operators.

[0004] Existing FHE accelerators typically employ two approaches: one allocates dedicated hardware resources for different FHE schemes, while the other reuses some computing resources through a unified processing unit array. While these approaches can improve performance to some extent, they are essentially auxiliary acceleration devices connected to the host CPU, requiring frequent coordination, data movement, and synchronization between the host runtime, drivers, and compilers. For CKKS, BFV, TFHE, and hybrid FHE applications, differences in control flow, ciphertext format, and computational kernels make it difficult to unify the software stack and hardware microarchitecture, leading to system fragmentation, insufficient programmability, and unstable hardware utilization.

[0005] The problems and shortcomings of existing technologies include:

[0006] 1) Insufficient generalization capability of fixed-function or single-solution accelerators: Existing architectures are often optimized individually for CKKS, TFHE or a certain core operator, making it difficult to reuse the same execution base across arithmetic FHE, Boolean FHE and hybrid FHE applications.

[0007] 2) The separation of control and computation leads to high coordination overhead: Traditional FHE accelerators are usually passively receiving tasks as CPU peripherals or coprocessors, and the host needs to be responsible for a lot of scheduling, synchronization and data orchestration, which limits the compiler from performing unified optimization.

[0008] 3) Insufficient instruction-level abstraction: Existing accelerators mostly expose coarse-grained APIs or fixed pipelines, lacking a unified instruction layer for the minimum kernel of FHE computation, making it difficult to balance low-level performance with high-level programming convenience.

[0009] 4) Lack of collaborative management at the homomorphic data granularity in computation and storage: The FHE ciphertext, key, NTT table and intermediate polynomial data are large in volume. If only general cache or simple DMA is used for relocation, it is easy to cause low on-chip storage utilization, frequent data movement and prominent memory access bottlenecks.

[0010] 5) Mixed workloads with multiple schemes are difficult to execute efficiently: CKKS / BFV and other schemes are based on RLWE ciphertext format, while TFHE often uses LWE ciphertext format. The conversion, sampling and extraction and repackaging of the two require a unified representation conversion and scheduling mechanism, which the existing architecture does not support.

[0011] In summary, existing FHE hardware accelerators face technical challenges such as difficulty in uniformly supporting multiple FHE schemes, difficulty in achieving efficient control and scheduling within the processor, and difficulty in reducing homomorphic data movement while maintaining programmability. Therefore, there is an urgent need to construct a new processor-based hardware architecture for fully homomorphic encryption and design a hierarchical homomorphic instruction set H-ISA, which has become the current key research focus. Summary of the Invention

[0012] This invention aims to address the technical challenges of existing FHE hardware accelerators in uniformly supporting multiple FHE schemes, efficiently controlling and scheduling within the processor, and minimizing homomorphic data movement while maintaining programmability. Specifically, it addresses the following: how to abstract the heterogeneous computational processes of different FHE schemes such as CKKS, BFV, BGV, and TFHE into unified processor instructions and hardware execution units; how to achieve FHE instruction-level scheduling, dependency management, data movement, and computational overlap without relying on frequent orchestration during host runtime; how to reduce the data movement overhead of ciphertext, keys, NTT tables, and intermediate results through polynomial-level on-chip memory management; how to balance underlying hardware performance with the ease of upper-level FHE program development, enabling multi-scheme and hybrid scheme applications to execute on a unified architecture; and how to design reusable and highly utilized homomorphic computation units for typical FHE cores such as NTT, Auto Homomorphic, SQM, and SE.

[0013] In a first aspect, embodiments of this application provide a fully homomorphic encryption processor architecture design method, the method comprising:

[0014] The hardware architecture construction steps of the fully homomorphic encryption processor are as follows: The homomorphic processor (HPU) is used as an extension unit of the processor. The HPU includes an instruction buffer module, a decoding module, a dependency management module, a multi-issue control module, and multiple homomorphic instruction units. The input homomorphic encryption instructions are decoded by the decoding module and divided into different types of instructions. These instructions are then input into different homomorphic instruction execution units, and the multi-issue control module issues them to the corresponding hardware units according to the data dependency relationship determined by the dependency management module.

[0015] Homomorphic instruction set architecture construction steps: Extract the minimum homomorphic computation kernel CMK of fully homomorphic cryptographic computation, and based on the abstraction of CMK, construct the hierarchical homomorphic instruction set H-ISA. H-ISA includes: low-level micro-instructions used to describe the basic operations in FHE computation, and high-level macro-instructions used to describe the commonly used operations in the FHE framework. Macro-instructions include multiple micro-instructions.

[0016] Homomorphic instruction unit construction steps: Based on the common computing kernel of fully homomorphic encryption, a reusable homomorphic instruction execution unit (HIU) is constructed, including a modular addition unit, a modular multiplication unit, a number theory transformation / inverse number theory transformation unit, an automatic isomorphism unit, a sampling extraction unit, and a modular reduction unit.

[0017] Optionally, in this embodiment of the invention, the fully homomorphic encryption processor architecture design method further includes:

[0018] On-chip data management steps: An on-chip temporary storage memory is set up inside the HPU to temporarily store ciphertext, polynomials, keys and intermediate results. Data is moved between main memory and on-chip temporary storage memory through homomorphic instructions, and the order of data movement and computation execution is ensured by synchronization instructions.

[0019] Optionally, the HPU also includes: a RoCC interface, a load channel, a storage channel, an execution channel, a local homomorphic memory management unit, a local address translation backup buffer, an on-chip temporary storage memory, a configuration register, a direct memory access module, a read-only data channel, an input buffer module, and a result buffer module;

[0020] RoCC interface: Connected to the processor core and instruction buffer module, it is used to transmit homomorphic instructions to the HPU through the RoCC command channel, and complete the conversion between the general processor instruction stream and the HPU internal command stream.

[0021] The instruction buffer module connects to the RoCC interface and the dependency management module. It is used to temporarily store homomorphic instructions that have not yet been decoded or whose launch conditions have not yet been met, and to decouple the instruction launch rate of the processor core from the internal execution rate of the HPU.

[0022] The dependency management module connects the instruction buffer module and the decoding module, and is also connected to the multi-issue control module, loading channel, storage channel, execution channel, and the completion feedback end of each homomorphic instruction execution unit. It is used to determine whether there are data dependencies, address conflicts, or resource conflicts between the instruction to be issued and the instruction in transit.

[0023] The decoding module is connected to the dependency management module and to the loading channel, storage channel, execution channel, and multi-issue control module respectively. The decoding module is used to determine whether an instruction is a microinstruction or a macroinstruction based on the instruction opcode, and then determine the specific operation based on the function code.

[0024] The multi-issue control module is connected to the decoding module, dependency management module, loading channel, storage channel, execution channel, on-chip temporary storage arbitration terminal, and each homomorphic instruction execution unit. It is used to receive instructions that have been decoded by the decoding module and whose dependency conditions are met, and decide whether to issue instructions based on whether the direct memory access module is idle, whether the target execution unit is idle, whether the on-chip temporary storage port is available, and whether there is a memory conflict between different instructions.

[0025] Optionally, in this embodiment of the invention, the microinstructions include:

[0026] The computation microinstructions include: using the processor core's custom opcode space, polynomial addition, polynomial subtraction, polynomial multiplication, scalar and polynomial multiplication, forward and inverse number theory transformations, automatic isomorphism, and sample extraction;

[0027] Data movement and synchronization instructions include: load instructions and store instructions, used to move polynomials between main memory and on-chip temporary storage; and synchronization instructions, used to constrain the order between memory movement operations and computation operations.

[0028] Configuration and status commands include parameter configuration commands and status reading commands. The HPU exposes relevant parameters through parameter configuration commands and queries the HPU's running status through status reading commands.

[0029] Optionally, in this embodiment of the invention, a macro instruction is a semantic package including: the same underlying HIU as the microinstruction multiplexing; and a short sequence composed of CMK primitives; the macro instruction includes:

[0030] CKKS-type macro instructions: Modulus boosting instruction, Modulus deflating instruction, Plaintext multiplication instruction, Scalar multiplication instruction, Ciphertext multiplication instruction, Homomorphic addition instruction, Homomorphic subtraction instruction, Rotation instruction, Key switching instruction, and Relinearization instruction;

[0031] TFHE macro instructions: Homomorphic CMUX gate instruction, LWE key switching instruction, LWE homomorphic addition instruction, LWE homomorphic subtraction instruction, and LWE plaintext multiplication instruction.

[0032] Optionally, the HPU instantiates multiple classes of HIU, each class of HIU implementing one or more basic instructions in H-ISA; HIU include:

[0033] Shared Quotient and Modulo Subtraction (SQM) Homomorphic Instruction Unit: Used to perform division and modulo operations simultaneously within the same instruction frame;

[0034] Sampling and Extraction SE Homomorphic Instruction Unit: Used to implement ciphertext conversion between different FHE schemes, supporting conversion from RLWE format to LWE format.

[0035] Optionally, in this embodiment of the invention, the on-chip temporary storage memory is divided into multiple independent storage banks, each storage bank having an independent address selection and read / write control terminal; the multiple storage banks are respectively connected to the first direct memory access module, the second direct memory access module, and the execution channel through storage bank selection logic or cross switches;

[0036] The first direct memory access module corresponds to the data loading direction. One end of it is connected to the secondary cache or external main memory through the system storage channel, and the other end is connected to the write end of the on-chip temporary storage memory. The first direct memory access module is used to generate continuous or segmented burst read requests according to the external source address, on-chip destination address and polynomial number given by the load instruction, and write the returned data sequentially to the physical memory determined by the local MMU.

[0037] The second direct memory access module corresponds to the data storage direction. One end of it is connected to the read end of the on-chip temporary storage memory, and the other end is connected to the L2 cache or external main memory through the system storage channel. The second direct memory access module is used to read a specified on-chip object and generate a burst write request to external main memory.

[0038] Secondly, embodiments of this application provide a fully homomorphic encryption processor architecture design system, employing the fully homomorphic encryption processor architecture design method described above. The system includes:

[0039] The hardware architecture building module for the fully homomorphic encryption processor uses the homomorphic processor (HPU) as an extension unit of the processor. The HPU includes an instruction buffer module, a decoding module, a dependency management module, a multi-issue control module, and multiple homomorphic instruction units. The input homomorphic encryption instructions are decoded by the decoding module and divided into different types of instructions. These instructions are then input into different homomorphic instruction execution units, and the multi-issue control module issues them to the corresponding hardware units according to the data dependencies determined by the dependency management module.

[0040] Homomorphic instruction set architecture building module: Extract the minimum homomorphic computation kernel CMK of fully homomorphic encryption computation, and build a hierarchical homomorphic instruction set H-ISA based on the abstraction of CMK. H-ISA includes: low-level micro-instructions used to describe the basic operations in FHE computation, and high-level macro-instructions used to describe the commonly used operations in the FHE framework. Macro-instructions include multiple micro-instructions.

[0041] Homomorphic Instruction Unit Construction Module: Based on the common computing kernel of fully homomorphic encryption, a reusable homomorphic instruction execution unit (HIU) is constructed, including a modular addition unit, a modular multiplication unit, a number-theoretic transformation / inverse number-theoretic transformation unit, an automatic isomorphism unit, a sampling extraction unit, and a modular reduction unit.

[0042] Thirdly, embodiments of this application provide a homomorphic processor HPU, which serves as an extension unit of the processor. The HPU includes: an instruction buffer module, a decoding module, a dependency management module, a multi-issue control module, and multiple homomorphic instruction units. Input homomorphic encryption instructions are decoded by the decoding module, divided into different types of instructions, input to different homomorphic instruction execution units, and issued to corresponding hardware units by the multi-issue control module according to the data dependency relationship determined by the dependency management module.

[0043] Fourthly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. A homomorphic processor (HPU) is used as an extension unit of the processor. The HPU includes an instruction buffer module, a decoding module, a dependency management module, a multi-issue control module, and multiple homomorphic instruction units. Input homomorphic encryption instructions, after being decoded by the decoding module, are divided into different types of instructions, input to different homomorphic instruction execution units, and issued to corresponding hardware units by the multi-issue control module according to the data dependency relationships determined by the dependency management module.

[0044] Compared with existing technologies, it has the following outstanding advantages:

[0045] 1) The method and system of this invention propose a processor-based hardware architecture for constructing fully homomorphic encryption.

[0046] Technical benefits: Unlike traditional methods that use FHE hardware as a fixed-function accelerator or peripheral, this invention abstracts FHE computation into a homomorphic processor architecture that can be executed by processor instructions, enabling FHE tasks to be completed under a unified instruction, control, and scheduling framework, thereby improving the architecture's versatility and programmability.

[0047] 2) The method and system of this invention propose the design of a hierarchical homomorphic instruction set H-ISA.

[0048] Technical benefits: The kernel expresses basic homomorphic computations such as polynomial addition, multiplication, NTT, INTT, auto-isomorphism, and sampling extraction through microinstructions, and expresses upper-level FHE operations such as ciphertext multiplication, key switching, rotation, relinearization, and TFHE condition selection through macroinstructions, thus balancing the execution efficiency of the underlying hardware and the convenience of upper-level software calls.

[0049] 3) The method and system of this invention propose to construct reusable homomorphic computing units.

[0050] Technical benefits: The core operations in different FHE schemes such as CKKS, BFV, BGV, and TFHE are abstracted into a set of reusable homomorphic computing kernels and mapped to dedicated computing units such as modular addition, modular multiplication, NTT, automatic isomorphism, sampling extraction, and modular reduction, avoiding the need to design independent hardware for different FHE schemes and improving hardware resource utilization.

[0051] 4) The method and system of this invention propose an on-chip data management approach that combines computing and storage.

[0052] Technical benefits: By using on-chip scratchpad, local address management, DMA transfer, and explicit synchronization instructions, polynomial-level management is achieved for ciphertext, polynomials, keys, and intermediate results, reducing off-chip data transfer and alleviating memory access bottlenecks in FHE computation. Attached Figure Description

[0053] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0054] Figure 1 This is a schematic diagram of the fully homomorphic encryption processor architecture design method of the present invention;

[0055] Figure 2a This is a schematic diagram of the overall system architecture of an embodiment of the present invention;

[0056] Figure 2b This is a schematic diagram illustrating a plaintext multiplication programming example according to an embodiment of the present invention;

[0057] Figure 3 This is a schematic diagram of the H-ISA microinstruction definition according to an embodiment of the present invention;

[0058] Figure 4 This is a schematic diagram illustrating the H-ISA macro instruction definition in an embodiment of the present invention;

[0059] Figure 5 This is a schematic diagram of the microarchitecture of the shared quotient and modulus reduction unit in an embodiment of the present invention;

[0060] Figure 6 This is a schematic diagram of the microarchitecture of the sampling and extraction unit in an embodiment of the present invention;

[0061] Figure 7 This is a schematic diagram of the fully homomorphic encryption processor architecture design system of the present invention;

[0062] Figure 8 This is a schematic diagram of the computer hardware of the present invention. Detailed Implementation

[0063] In this invention, "at least one" means one or more, and "more than one" means two or more. "At least one of the following" or similar expressions refer to any combination of these items, including any combination of a single item or a plurality of items. For example, at least one of a, b, or c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be a single item or multiple items.

[0064] It should also be understood that the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. A and B can be singular or plural. Additionally, the character " / " in this article generally indicates an "or" relationship between the preceding and following related objects, but it can also represent an "and / or" relationship. Please refer to the context for a more accurate understanding.

[0065] It should also be understood that, in various embodiments of the present invention, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0066] In the embodiments provided by this invention, it should be understood that the disclosed devices, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0067] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0068] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0069] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0070] To make the above-mentioned features and effects of the present invention clearer and easier to understand, specific embodiments are described below in conjunction with the accompanying drawings. This specification discloses one or more embodiments incorporating the features of the present invention. The disclosed embodiments are merely illustrative. The scope of protection of the present invention is not limited to the disclosed embodiments, but is defined by the appended claims.

[0071] In their research on hardware acceleration of multiple FHE schemes, the inventors of this invention discovered that although different FHE schemes superficially possess different ciphertext structures and algorithmic flows, their underlying computation can be abstracted into a finite number of reusable homomorphic computational minimal kernels (CMKs), including modular addition / subtraction, modular multiplication, NTT / INTT, auto-isomorphism, sample extraction (SE), and shared quotient modulo (SQM). If these minimal kernels are elevated to executable homomorphic instructions, and then dependency checking, scheduling, and memory management are performed by the processor front-end, it is possible to transition from a fixed-function accelerator to a programmable homomorphic processor.

[0072] Furthermore, the inventors recognized that defining only low-level microinstructions is insufficient to support actual FHE program development. FHE software frameworks typically organize programs using procedural interfaces such as ciphertext multiplication, relinearization, modulus enhancement, modulus descent, homomorphic rotation, key switching, and TFHE conditional multiplexing gates. Therefore, this invention proposes a hierarchical homomorphic instruction set: low-level microinstructions directly correspond to CMKs and data movement, synchronization, and configuration; upper-level macroinstructions correspond to commonly used operations in the FHE framework and can be expanded into microinstruction sequences that maintain CMK semantics.

[0073] To address the issues of large FHE data volume, complex memory access patterns, and low on-chip memory utilization, this invention further combines homomorphic instruction execution with polynomial-level on-chip temporary registers, a local homomorphic memory management unit (MMU), a local address translation buffer (TLB), and a DMA migration mechanism to form a processor architecture that coordinates computation and storage.

[0074] The system of this application embodiment will be described in detail below with reference to specific embodiments:

[0075] like Figure 1 and Figure 2a , Figure 2bAs shown, this invention provides a Homomorphic Processing Unit (HPU) that integrates into the system as a processor extension unit of the Reduced Instruction Set Computer (RISC-V) fifth generation, and receives homomorphic instructions issued by the RISC-V processor core through the Rocket Custom Coprocessor (RoCC) interface. The general-purpose processor core handles loops, branches, address calculations, function calls, and other general integer operations, while the HPU handles computations related to ciphertext, polynomials, and homomorphic keys, data transfer, dependency management, and execution scheduling. Through this division of labor, ordinary program control is still performed by the general-purpose processor, while computationally intensive, latency-prone, and large-granularity fully homomorphic encryption operations are performed by the HPU at the instruction level.

[0076] like Figure 1 As shown, a fully homomorphic encryption processor architecture design method is proposed, the method comprising:

[0077] Step 101 of constructing the hardware architecture of the fully homomorphic encryption processor: The homomorphic processor HPU is used as an extension unit of the processor. The HPU includes: an instruction buffer module, a decoding module, a dependency management module, a multi-issue control module, and multiple homomorphic instruction units. The input homomorphic encryption instructions are decoded by the decoding module and divided into different types of instructions. These instructions are then input into different homomorphic instruction execution units and issued to the corresponding hardware units by the multi-issue control module according to the data dependency relationship determined by the dependency management module.

[0078] Optionally, the HPU also includes: a RoCC interface, a load channel, a storage channel, an execution channel, a local homomorphic memory management unit, a local address translation backup buffer, an on-chip temporary storage memory, a configuration register, a direct memory access module, a read-only data channel, an input buffer module, and a result buffer module;

[0079] Specifically, such as Figure 2a As shown in the specific embodiment of the present invention, the system architecture of the present invention includes a RISC-V processor core, a level 1 cache, a level 2 cache, external main memory, and an HPU. The RISC-V processor core is connected to the level 1 cache, the level 1 cache is connected to the level 2 cache, and the level 2 cache is further connected to the external main memory, thereby forming the storage hierarchy of the general-purpose processor. The external main memory can be Double Data Rate Synchronous Dynamic Random Access Memory (DDR SDRAM) or High Bandwidth Memory (HBM).

[0080] The HPU includes at least a RoCC interface, an instruction buffer module, a dependency management module, a decoding module, a multiple issue control module, a load channel, a storage channel, an execution channel, a local homomorphic memory management unit, a local address translation back buffer, on-chip temporary storage, a configuration register, a direct memory access module, a read-only data channel, an input buffer module, a result buffer module, and multiple homomorphic instruction execution units.

[0081] 1. RoCC interface

[0082] The RoCC interface is physically connected between the RISC-V processor core and the instruction buffer module of the HPU. After the RISC-V processor core executes a custom-coded homomorphic instruction, it transmits the instruction code, source operand register value, destination operand information, and valid control signals to the HPU through the RoCC command channel.

[0083] The RoCC interface logically performs the conversion between the general processor instruction stream and the HPU's internal command stream. When the HPU instruction buffer is full or temporarily unable to receive new instructions, the RoCC interface returns a backpressure signal to the processor core; when an instruction is received, the RoCC interface writes it into the instruction buffer module. For implementations that require querying execution status or returning control information, the HPU can also return a running, completed, or abnormal status to the processor core through the RoCC response channel.

[0084] 2. Instruction buffer module

[0085] The instruction buffer module's input is connected to the RoCC interface, and its output is connected to the dependency management module. This module is used to temporarily store homomorphic instructions that have not yet been decoded or whose issue conditions have not yet been met, and to decouple the processor core's instruction issue rate from the HPU's internal execution rate.

[0086] Each instruction buffer entry stores at least the instruction opcode, function code, source operand, destination operand, operand address, instruction validity bits, and instruction type information. For macro instructions, the entry may also store a third source operand and the macro instruction expansion state.

[0087] When a valid instruction exists in the instruction buffer, the instruction buffer module sends candidate instructions to the dependency management module in program order. For implementations that preserve program semantics, the dependency management module can also select suitable instructions from multiple buffer entries for parallel issuance.

[0088] 3. Dependency Management Module

[0089] The dependency management module is physically connected between the instruction buffer module and the decoding module, and is also connected to the multi-issue control module, loading channel, storage channel, execution channel, and completion feedback terminals of each homomorphic instruction execution unit.

[0090] The dependency management module is used to determine whether there are data dependencies, address conflicts, or resource conflicts between the instruction to be launched and the instructions in transit. In a preferred embodiment, each instruction is parsed into one or more source objects and one destination object, and the dependency management module records the validity status, read status, and write status of the in-transit objects.

[0091] When the source address of the instruction to be issued is the same as the destination address of a preceding incomplete instruction, it indicates a write-after-read dependency, and the instruction to be issued needs to wait for the preceding write operation to complete. When the destination address of the instruction to be issued is the same as the source address or destination address of a preceding incomplete instruction, it indicates a read-after-write dependency or a write-after-write dependency, respectively, and the instruction to be issued also needs to wait. For load and store instructions, dependency judgment can be performed according to the polynomial object address range. When the polynomial address ranges accessed by two instructions overlap and at least one instruction performs a write operation, it is determined that a conflict exists.

[0092] After an instruction is issued, the dependency management module marks the corresponding target object as busy. When the direct memory access module or the homomorphic instruction execution unit returns a completion signal, the corresponding busy state is cleared, and the system re-evaluates whether subsequent instructions can be issued.

[0093] 4. Decoding Module

[0094] The input of the decoding module is connected to the dependency management module, and the output is connected to the loading channel, storage channel, execution channel and multi-issue control module, respectively.

[0095] The decoding module first determines whether the instruction is a microinstruction or a macroinstruction based on the instruction opcode, and then determines the specific operation based on the function code. The decoding result includes at least the instruction type, source address, destination address, operation length, target execution unit, whether on-chip temporary memory is accessed, whether external main memory is accessed, whether a read-only key or number theory transformation table is required, and whether synchronous wait is required, among other control information.

[0096] For microinstructions, the decoding module directly generates the control signals for the corresponding homomorphic instruction execution unit. For macroinstructions, the macroinstruction expansion logic within the decoding module converts the macroinstruction into a finite-length microinstruction sequence based on the macroinstruction type and parameters in the configuration register. This microinstruction sequence is still scheduled by the dependency management module and the multiple-issue control module in the same manner as ordinary microinstructions; therefore, macroinstructions do not require an additional independent computational data path.

[0097] The decoding module divides data transfer instructions into loading and storage classes, homomorphic computation instructions into execution classes, sends configuration instructions to the configuration register, and sends synchronization instructions to the synchronization control logic of the multi-issue control module.

[0098] 5. Multi-transmission control module

[0099] The multi-issue control module is connected to the decoding module, dependency management module, loading channel, storage channel, execution channel, on-chip temporary storage arbitration terminal, and each homomorphic instruction execution unit.

[0100] The multiple issue control module receives decoded instructions that meet the dependency conditions, and decides whether to issue the instructions based on whether the direct memory access module is idle, whether the target execution unit is idle, whether the on-chip temporary storage port is available, and whether there are memory conflicts between different instructions.

[0101] When a load instruction, a store instruction, and a compute instruction access data objects that do not conflict with each other, and the corresponding hardware resources are all in a receptive state, the multi-issue control module allows them to simultaneously enter the load channel, store channel, and execute channel, thereby achieving overlapping execution of data loading, result writing back, and homomorphic computation. When two instructions access the same on-chip memory or use the same homomorphic instruction execution unit that cannot be executed in parallel, the multi-issue control module retains one instruction, and the others continue to wait.

[0102] The multi-issue control module also receives completion signals from each execution channel and transmits the completion information to the dependency management module. For synchronization instructions, the multi-issue control module stops issuing related instructions after the synchronization instruction until all specified loading, calculation, and storage operations are completed.

[0103] 6. Load channel, storage channel, and execution channel

[0104] The loading channel, storage channel, and execution channel correspond to respectively Figure 3 The Load, Store, and EXE logic modules within it.

[0105] The load channel is connected to the first direct memory access module and is used to perform operations that move encrypted, polynomial, or intermediate data from external main memory to on-chip temporary storage. The load channel receives the external main memory source address, the on-chip temporary storage destination address, and the data length, and converts the address and length into a direct memory access request.

[0106] The storage channel is connected to the second direct memory access module and is used to write the calculation results in the on-chip temporary storage memory back to the L2 cache or external main memory. The storage channel receives the on-chip source address, the external main memory destination address, and the data length, and initiates a write-back operation after the calculation of the corresponding object is completed.

[0107] The execution channel is connected to each homomorphic instruction execution unit. The execution channel reads data from the on-chip temporary memory according to the source object address obtained by decoding, sends it to the target homomorphic instruction execution unit through the input buffer module, and writes the execution result back to the specified on-chip address through the result buffer module.

[0108] Homomorphic instruction set architecture construction step 102: Extract the minimum homomorphic computation kernel CMK of fully homomorphic encryption computation, and based on the abstraction of CMK, construct the hierarchical homomorphic instruction set H-ISA. H-ISA includes: low-level micro-instructions used to describe the basic operations in FHE computation, and high-level macro-instructions used to describe the commonly used operations in the FHE framework. Macro-instructions include multiple micro-instructions.

[0109] Optionally, in this embodiment of the invention, the microinstructions include:

[0110] The computation microinstructions include: using the processor core's custom opcode space, polynomial addition, polynomial subtraction, polynomial multiplication, scalar and polynomial multiplication, forward and inverse number theory transformations, automatic isomorphism, and sample extraction;

[0111] Data movement and synchronization instructions include: load instructions and store instructions, used to move polynomials between main memory and on-chip temporary storage; and synchronization instructions, used to constrain the order between memory movement operations and computation operations.

[0112] Configuration and status commands include parameter configuration commands and status reading commands. The HPU exposes relevant parameters through parameter configuration commands and queries the HPU's running status through status reading commands.

[0113] Optionally, in this embodiment of the invention, a macro instruction is a semantic package including: the same underlying HIU as the microinstruction multiplexing; and a short sequence composed of CMK primitives; the macro instruction includes:

[0114] CKKS-type macro instructions: Modulus boosting instruction, Modulus deflating instruction, Plaintext multiplication instruction, Scalar multiplication instruction, Ciphertext multiplication instruction, Homomorphic addition instruction, Homomorphic subtraction instruction, Rotation instruction, Key switching instruction, and Relinearization instruction;

[0115] TFHE macro instructions: Homomorphic CMUX gate instruction, LWE key switching instruction, LWE homomorphic addition instruction, LWE homomorphic subtraction instruction, and LWE plaintext multiplication instruction.

[0116] Specifically, in this embodiment of the invention, the implementation of the microinstruction layer includes:

[0117] like Figure 3 As shown, the microinstructions defined in this invention are used to directly control the homomorphic instruction execution unit, the direct memory access module, and the configuration module. The microinstructions include computation-related microinstructions, data transfer and synchronization-related microinstructions, and configuration and status-related microinstructions.

[0118] 1. Computational microinstructions

[0119] Computational microinstructions use the RISC-V Custom-0 opcode space. Figure 3 In the illustrated embodiment, the opcode field is 0001011, the function field funct3 is 100, and different operations are distinguished by funct7:

[0120] When funct7 is 0000000, it represents the polynomial addition instruction fhe.add;

[0121] When funct7 is 0000001, it represents the polynomial subtraction instruction fhe.sub;

[0122] When funct7 is 0000010, it represents the polynomial multiplication instruction fhe.mult;

[0123] When funct7 is 0000011, it represents the scalar and polynomial multiplication instruction fhe.smult;

[0124] When funct7 is 0000100, it represents the number theory transformation instruction fhe.ntt;

[0125] When funct7 is 0000101, it represents the inverse number theory transformation instruction fhe.intt;

[0126] When funct7 is 0000110, it indicates the automatic isomorphism instruction fhe.auto;

[0127] When funct7 is 0000111, it represents the sampling extraction command fhe.se.

[0128] For `fhe.add`, `fhe.sub`, and `fhe.mult`, the register values ​​specified by `rs1` and `rs2` represent the addresses of the two source polynomials, respectively, and the register value specified by `rd` represents the address of the destination polynomial. For `fhe.smult`, `rs1` represents the address of the source polynomial, `rs2` represents the scalar data, and `rd` represents the address of the destination polynomial.

[0129] For fhe.ntt, fhe.intt, fhe.auto, and fhe.se, rs1 represents the source object address, rd represents the destination object address, and the unused rs2 field is set to the zero register. For implementations that allow in-place execution, the source object address and the destination object address can be the same.

[0130] After recognizing the above instructions, the decoding module generates selection signals for modular addition unit, modular multiplication unit, number theory transformation unit, automatic isomorphism unit, or sampling extraction unit, and sends the source address and destination address to the dependency management module and the local MMU.

[0131] 2. Data migration and synchronization microinstructions

[0132] When funct7 is 0001000, it represents the load instruction fhe.load; when funct7 is 0001001, it represents the store instruction fhe.store; when funct7 is 0001010, it represents the synchronization instruction fhe.fence.

[0133] For `fhe.load` and `fhe.store`, the general-purpose register value specified by `rs1` represents the external main memory virtual address. The other operand register value selected by the `rd` field can be divided into a quantity field and an on-chip address field, where the high-order bits represent the polynomial quantity to be moved, and the low-order bits represent the on-chip temporary storage virtual address. Figure 3 In the illustrated embodiment, the high 6 bits represent the polynomial number, and the low 26 bits represent the on-chip virtual address.

[0134] When fhe.load is executed, the decoding module sends the external main memory address, the on-chip destination address, and the polynomial quantity into the load channel; when fhe.store is executed, the decoding module sends the on-chip source address, the external destination address, and the polynomial quantity into the storage channel.

[0135] `fhe.fence` does not require data operands. When this instruction is executed, the multi-issue control module checks the load, store, and compute instructions issued before `fhe.fence`. If there are related operations that have not yet been completed, `fhe.fence` waits; once all specified operations are completed, `fhe.fence` terminates, allowing subsequent instructions to continue being issued. Therefore, `fhe.fence` can guarantee the order of data movement and homomorphic computation.

[0136] 3. Configuration and Status Microinstructions

[0137] Configuration and status microinstructions use the Custom-1 custom opcode space. Figure 3 In the embodiment shown, the opcode field is 0101011 and the function field funct3 is 100.

[0138] When funct7 is 0000000, it represents the parameter configuration instruction fhe.cfg. The rs1 register of this instruction provides RLWE-related parameters, where the lower 16 bits represent the polynomial order, the next 6 bits represent the number of decomposition levels, and the following 6 bits represent the maximum modulus chain length; the rs2 register provides LWE-related parameters in the same way. The decoding module writes these parameters into the configuration register.

[0139] When funct7 is 0000001, it represents the status read instruction fhe.status. In implementations that set the status read instruction, the HPU writes the running or completed status to a specified register; for example, a value of 0 indicates that the task is still running, and a value of 1 indicates that the specified task has been completed. In implementations that use synchronization instructions without setting explicit status reads, synchronization between the processor core and the HPU can also be achieved solely through fhe.fence.

[0140] Specifically, in this embodiment of the invention, the implementation of the macro instruction layer includes:

[0141] like Figure 4 As shown, macro instructions target procedural operations within a fully homomorphic encryption software framework. Macro instructions use a Custom-2 opcode space, with the opcode field being 1011011. The high 5 bits (funct5) distinguish macro operations, rs1, rs2, and rs3 provide the source ciphertext address, plaintext address, number theory transformation table address, evaluation key address, or other auxiliary parameters, and rd provides the destination address.

[0142] exist Figure 4 In the illustrated embodiment, the correspondence between funct5 and macro instructions includes:

[0143] 00000 corresponds to the modulus upscaling instruction fhe.modup;

[0144] 00001 corresponds to the modulus down instruction fhe.moddown;

[0145] 00010 corresponds to the plaintext multiplication instruction fhe.pmult;

[0146] 00011 corresponds to the scalar multiplication instruction fhe.smult;

[0147] 00100 corresponds to the ciphertext multiplication instruction fhe.cmult;

[0148] 00101 corresponds to the homomorphic addition instruction fhe.hadd;

[0149] 00110 corresponds to the homomorphic subtraction instruction fhe.hsub;

[0150] 00111 corresponds to the rotation command fhe.rotate;

[0151] 01000 corresponds to the key switching command fhe.ks;

[0152] 01001 corresponds to the relinearization instruction fhe.relin;

[0153] 01010 corresponds to the TFHE homomorphic conditional multiplexing instruction fhe.cmux;

[0154] 01011 corresponds to the LWE key switching command fhe.lwe.ks;

[0155] 01100 corresponds to the LWE homomorphic addition instruction fhe.lwe.hadd;

[0156] 01101 corresponds to the LWE homomorphic subtraction instruction fhe.lwe.sub;

[0157] 01110 corresponds to the LWE plaintext multiplication instruction fhe.lwe.pmult.

[0158] Macro instructions only encapsulate commonly used processes consisting of a minimal computational kernel, without adding new computational semantics independent of microinstructions. After recognizing the macro instruction, the decoding module selects the corresponding microprogram based on the macro instruction type.

[0159] For example, ciphertext multiplication macro instructions can be expanded into micro instructions such as source ciphertext loading, forward number theory transformation, pointwise modular multiplication, modular addition and accumulation, inverse number theory transformation, key switching or relinearization, and result storage; rotation macro instructions can be expanded into micro instructions such as autoisomorphism, number theory transformation, modular multiplication and accumulation, inverse number theory transformation, and key switching; and modular descent macro instructions can be expanded into micro instructions such as inverse number theory transformation, shared quotient and modular reduction, modular multiplication, and modular addition and subtraction.

[0160] The TFHE conditional multiplexing operation can be expanded into microinstructions such as factorization, number-theoretic transformation, outer product modular multiplication, modular addition accumulation, and inverse number-theoretic transformation; the LWE key switching can be expanded into multiple scalar modular multiplication and modular addition accumulation microinstructions. Therefore, the procedural operations in CKKS, BFV, BGV, and TFHE are ultimately completed on the same set of homomorphic instruction execution units.

[0161] Homomorphic instruction unit construction step 103: Based on the common computing kernel of fully homomorphic encryption, construct a reusable homomorphic instruction execution unit HIU, including a modular addition unit, a modular multiplication unit, a number theory transformation / inverse number theory transformation unit, an automatic isomorphism unit, a sampling extraction unit, and a modular reduction unit.

[0162] Optionally, the HPU instantiates multiple classes of HIU, each class of HIU implementing one or more basic instructions in H-ISA; HIU include:

[0163] Shared Quotient and Modulo Subtraction (SQM) Homomorphic Instruction Unit: Used to perform division and modulo operations simultaneously within the same instruction frame;

[0164] Sampling and Extraction SE Homomorphic Instruction Unit: Used to implement ciphertext conversion between different FHE schemes, supporting conversion from RLWE format to LWE format.

[0165] Specifically, in a specific embodiment of the present invention, the aforementioned homomorphic instruction execution unit and its connection relationship include:

[0166] The HPU is configured with a modular addition unit, a modular multiplication unit, a number-theoretical transformation / inverse number-theoretical transformation unit, an auto-isomorphism unit, a sampling extraction unit, and a shared quotient and modular reduction unit. These execution units are collectively referred to as the Homomorphic Instruction Unit (HIU).

[0167] The input terminals of each homomorphic instruction execution unit are connected to the input buffer module, and the output terminals are connected to the result buffer module. The input buffer module receives the source polynomial read from the on-chip temporary storage memory, the number theory transformation table or key data provided by the read-only data channel, and the parameters provided by the configuration register. The result buffer module is connected to the write terminal of the on-chip temporary storage memory to temporarily store the execution results and write them back to the destination object after obtaining write permission.

[0168] The multi-issue control module sends a start signal, operation type, source address identifier, and destination address identifier to each execution unit. Each execution unit indicates whether it can receive a new operation through a ready signal and indicates that the result has been written to the result buffer module or on-chip temporary memory through a completion signal.

[0169] 1. Modular Addition Unit

[0170] The modular addition unit is used to perform modular addition and subtraction of polynomials coefficient by coefficient. Modular addition first calculates the sum of the two coefficients using an adder, then uses a comparator to determine if the result is greater than or equal to the current modulus; if the result is not less than the modulus, the modulus is subtracted once using a subtractor. Modular subtraction first calculates the difference between the two coefficients; if the result is negative, the current modulus is added to it using an adder.

[0171] The modular addition unit simultaneously receives data from two source polynomials from the input buffer module, performs parallel operations according to the same coefficient positions, and writes the result back to the destination polynomial through the result buffer module. The modular addition unit can be used for homomorphic addition, homomorphic subtraction, and key-switching accumulation operations in CKKS, BFV, BGV, and TFHE.

[0172] 2. Modular Multiplication Unit

[0173] The modular multiplication unit is used to perform coefficient-wise multiplication between two polynomials or between a polynomial and a scalar. The modular multiplication unit first generates a wide-bit-width product through a multiplier, and then feeds the product and the current modulus into the shared quotient and modular reduction unit to obtain the coefficients after modular reduction.

[0174] A dedicated data connection is established between the modular multiplication unit and the shared quotient and modular reduction units. The modular multiplication unit sends the product as the minuend to the shared quotient and modular reduction units, which return the remainder as the final modular multiplication result. For scalar multiplication, the second source operand is provided by the scalar field in the instruction or a general-purpose register.

[0175] 3. Number Theory Transformation and Inverse Number Theory Transformation Unit

[0176] The number-theory transformation / inverse number-theory transformation unit is used to convert data between polynomial coefficient representation and number-theory transformation representation. This unit reads the polynomial to be transformed from on-chip temporary memory and reads the twiddle factor of the corresponding series from the read-only data channel.

[0177] The number theory transformation unit internally includes butterfly operation data paths, modular multiplication data paths, modular addition and subtraction data paths, series control logic, and address generation logic. The address generation logic generates a pair of on-chip addresses for the butterfly input coefficients based on the polynomial order and the current transformation series; the butterfly operation data paths perform addition, subtraction, and twitch factor multiplication on the two input coefficients; and the transformation result is written back to the on-chip temporary memory in the order required for the next transformation series.

[0178] In a preferred embodiment, the number-theoretic transformation unit merges some transformation stages using the recursive relationship of the rotation factors of adjacent stages, reducing the number of modular multiplications of the rotation factors. The number-theoretic transformation unit and the inverse number-theoretic transformation unit can share the butterfly arithmetic unit, the modular multiplication unit, and the address generation logic, and select the forward or inverse transformation data stream through control signals.

[0179] 4. Automatic isomorphic unit

[0180] The auto-isomorphism unit is used to perform index permutation, ciphertext slot rotation, and structured rearrangement of polynomial coefficients. The address generation logic of the auto-isomorphism unit calculates the destination index corresponding to each source coefficient based on the auto-isomorphism parameters and controls the on-chip temporary memory to read and write according to the calculated index.

[0181] In a preferred embodiment, the autoisomorphism unit divides the long polynomial into multiple subvectors, first performing permutations between the subvectors, and then performing index adjustments within the subvectors, thereby transforming irregular accesses of coefficients into larger-granularity subvector shifts. The autoisomorphism unit can also share a partial index rearrangement network with the number theory transformation unit to correct the data arrangement in sampling extraction or hybrid scheme transformations.

[0182] 5. Shared Providers and Modular Reduction Units

[0183] The Shared Quotient Modulo (SQM) unit outputs both an integer quotient and a modulo remainder, which are used for modulus switching, factorization, modulus boosting, modulus descent, and reduction of modular multiplication results.

[0184] like Figure 5 As shown, this unit receives the dividend *a*, the modulus *p*, and a parameter *μ* pre-calculated based on the modulus. Let... The pre-calculated parameters can be taken as follows: .

[0185] The shared quotient and modulo reduction unit first truncates the high-order bits of the dividend and multiplies them with the parameter μ, obtaining the approximate quotient q from the high-order bits of the product; then it calculates the product of the approximate quotient and the modulus, and subtracts the low k+1 bits of the product from the low k+1 bits of the dividend to obtain the approximate remainder r.

[0186] The comparator determines whether the approximate remainder is negative or greater than or equal to the modulus. When the approximate remainder is negative, the multiplexer selects the remainder to add. The result is then calculated; when the approximate remainder is not less than the modulus, the modulus is subtracted from the remainder using a subtractor, and the quotient is increased or corrected accordingly. The corrected quotient and remainder are output from two separate output terminals.

[0187] This unit requires only two narrow-bit multipliers; subsequent corrections are mainly handled by adders, subtractors, comparators, and multiplexers. The comparison and correction loops can be expanded into a pipeline, allowing the pipeline to generate a set of quotients and remainders cycle by cycle once it is full.

[0188] 6. Sampling and Extraction Unit

[0189] The Sample Extraction (SE) unit is used to convert ciphertext based on the Ring Learning With Errors (RLWE) problem into one or more ciphertexts based on the Learning With Errors (LWE) problem. It is the representation conversion unit when performing mixed computation between CKKS / BFV and TFHE.

[0190] For the i-th coefficient to be extracted, the sampling extraction process requires cyclically shifting the input polynomial by i+1 positions and performing a negative operation on the coefficients that cross the polynomial boundary. Since mixed homomorphic computation may require continuously extracting LWE ciphertexts close to the polynomial order, rearranging all coefficients using a barrel shifter each time would result in significant area and data movement overhead.

[0191] like Figure 6 As shown, this invention stores multiple data segments of the input ciphertext into first-in-first-out (FIFO) buffers based on block random access memory, with each FIFO buffer connected end-to-end to form a circular shift path. Each clock cycle, data moves from the output of one buffer to the input of the next, thus shifting the entire polynomial cycle by one position.

[0192] A sign selection logic is set at the position where the coefficient needs to be negative. The sign selection logic controls the adder / subtractor to choose between the original coefficient and the modulus minus the original coefficient to obtain the negative value in the finite ring. Through continuous shifting and sign selection, LWE ciphertext corresponding to different extraction positions can be generated sequentially.

[0193] When multiple data rows are read in parallel, resulting in inconsistent data arrangement in the row and column directions, the sampling extraction unit sends the data to the number theory transformation unit or the autoisomorphism unit, which restores the target data format through index rearrangement. Thus, a logically coordinated data path is formed between the sampling extraction unit, the number theory transformation unit, and the autoisomorphism unit.

[0194] Optionally, in this embodiment of the invention, the fully homomorphic encryption processor architecture design method further includes:

[0195] On-chip data management step 104: Set up an on-chip temporary storage memory inside the HPU to temporarily store ciphertext, polynomials, keys and intermediate results. Data is moved between main memory and on-chip temporary storage memory through homomorphic instructions, and the order of data movement and calculation execution is ensured by synchronization instructions.

[0196] Optionally, in this embodiment of the invention, the on-chip temporary storage memory is divided into multiple independent storage banks, each storage bank having an independent address selection and read / write control terminal; the multiple storage banks are respectively connected to the first direct memory access module, the second direct memory access module, and the execution channel through storage bank selection logic or cross switches;

[0197] The first direct memory access module corresponds to the data loading direction. One end of it is connected to the secondary cache or external main memory through the system storage channel, and the other end is connected to the write end of the on-chip temporary storage memory. The first direct memory access module is used to generate continuous or segmented burst read requests according to the external source address, on-chip destination address and polynomial number given by the load instruction, and write the returned data sequentially to the physical memory determined by the local MMU.

[0198] The second direct memory access module corresponds to the data storage direction. One end of it is connected to the read end of the on-chip temporary storage memory, and the other end is connected to the L2 cache or external main memory through the system storage channel. The second direct memory access module is used to read a specified on-chip object and generate a burst write request to external main memory.

[0199] Specifically, such as Figure 2a As shown in the specific embodiment of the present invention, the above-mentioned storage system and address translation relationship include:

[0200] 1. On-chip temporary storage memory

[0201] The HPU internally uses on-chip static random access memory (SRAM) as on-chip temporary storage to store ciphertext polynomials, plaintext polynomials, intermediate results, and reusable data objects.

[0202] like Figure 2a As shown, the on-chip temporary storage is divided into multiple independent memory banks. Each memory bank has its own address selection and read / write control terminals. The multiple memory banks are connected to the first direct memory access module, the second direct memory access module, and the execution channel respectively through memory bank selection logic or crossbar switches.

[0203] After dividing the on-chip temporary storage into multiple memory banks, source and destination polynomials located in different memory banks can be accessed in parallel. The multi-issue control module determines whether there is a port conflict based on the memory bank number in the address translation result. When multiple requests access the same single-port memory bank, the arbitration logic selects one of the requests, and the unselected request remains valid and is re-initiated in a subsequent cycle.

[0204] Data in the on-chip temporary storage is organized at a polynomial granularity or a polynomial paging granularity. A ciphertext can consist of one or more polynomial objects, and a polynomial object can occupy one or more physical pages. This organization method allows ciphertexts with different parameters to be allocated on-chip space according to their actual length, avoiding the waste of storage space caused by fixed partitions.

[0205] 2. Local homomorphic memory management unit and local address translation back buffer

[0206] The inputs of the Local Homomorphic Memory Management Unit (MMU) are connected to the decoding module, load channel, storage channel, and execution channel, while the outputs are connected to the memory selection logic of the on-chip temporary storage. The Local MMU internally includes a Local Address Translation Lookaside Buffer (TLB).

[0207] Homomorphic instructions use on-chip virtual addresses to represent ciphertext, polynomials, and intermediate objects. An on-chip virtual address includes at least a virtual page number and an offset within the page. Upon receiving an on-chip virtual address, the local MMU first queries the local TLB. If a match is found, the physical page number, memory bank number, and physical offset within the page are obtained from the TLB entry. If a match is not found, the local page table is read using the Page Table Walker (PTW) module, and the obtained mapping is written to the local TLB.

[0208] The mapping entries in the local page table can include the valid bit, physical page number, memory bank number, object length, read / write attributes, and object status. On-chip memory space is allocated and reclaimed using polynomial pages as the basic unit, enabling the same address management mechanism to support different polynomial orders, different modular chain lengths, and different ciphertext compositions.

[0209] The external main memory virtual address carried in the instruction can be obtained through processor-side address translation logic or processor-side page table traversal interface. Figure 1 The PTW connection in the code represents the physical interface between the HPU address translation module and the processor system page table traversal logic. Therefore, load and store operations simultaneously obtain the physical addresses of both external main memory and on-chip temporary storage, which are then passed to the direct memory access module for transfer.

[0210] 3. First and second direct memory access modules

[0211] The first direct memory access module corresponds to the data loading direction. One end of it is connected to the L2 cache or external main memory through the system storage channel, and the other end is connected to the write end of the on-chip temporary storage memory. The first direct memory access module generates continuous or segmented burst read requests based on the external source address, on-chip destination address, and polynomial number given by the load instruction, and writes the returned data sequentially to the physical memory determined by the local MMU.

[0212] The second direct memory access module corresponds to the data storage direction. One end is connected to the read end of the on-chip temporary storage memory, and the other end is connected to the L2 cache or external main memory through the system storage channel. The second direct memory access module reads a specified on-chip object and generates a burst write request to external main memory.

[0213] The two direct memory access modules employ independent request state machines and data buffers, allowing for simultaneous loading and storing operations when addresses and memory banks do not conflict. After completing a polynomial or set of polynomial transfers, the direct memory access module returns a completion flag to the multi-issue control module and the dependency management module.

[0214] 4. Third Direct Memory Access Module and Read-Only Data Channel

[0215] Number theory transformation tables, evaluation keys, rotation keys, relinearization keys, key switching keys, and bootstrap keys typically involve large amounts of data and are repeatedly accessed in read-only mode during a homomorphic operation.

[0216] To avoid the aforementioned read-only data occupying the capacity of general on-chip temporary storage and to prevent a large amount of read-only data from entering the general cache and causing cache pollution, this invention provides a third direct memory access module and an independent read-only data channel. The third direct memory access module is physically connected between the external main memory and the read-only data buffer. The read-only data buffer is further connected to the input buffer module and execution units such as the number theory transformation unit, the modular multiplication unit, and the automatic isomorphism unit.

[0217] When an instruction execution requires a number-theoretic transformation table or an evaluation key, the multi-issue control module initiates the third direct memory access module based on the auxiliary address in the instruction. The third direct memory access module can preload the necessary data into a read-only buffer or stream the data directly to the target homomorphic instruction execution unit. This read-only channel is independent of the ordinary ciphertext loading channel, allowing key reading to be performed in parallel with ciphertext computation.

[0218] 5. Configure registers

[0219] The configuration registers are connected to the decoding module, the multiple issue control module, the local MMU, and each homomorphic instruction execution unit. The configuration registers store common parameters for the current homomorphic computation task, including the polynomial order, the number of decomposition levels, the maximum modulus chain length, the current modulus, the number of moduli, and the pre-calculated parameters required for shared quotient and modulo reduction operations.

[0220] The decoding module determines the data length and number of iterations required to process an instruction based on the configuration register; the local MMU determines the number of pages required for the object based on the polynomial order and the length of the modular chain; the number theory transformation unit determines the transformation series based on the polynomial order; and the modular addition, modular multiplication, shared quotient, and modular reduction units read the current modulus and related pre-calculated parameters from the configuration register.

[0221] The following examples illustrate the mapping method and encryption process used in the embodiments of this application:

[0222] I. Mapping methods for multiple fully homomorphic encryption schemes

[0223] For RLWE-based ciphertext schemes such as CKKS, BFV, and BGV, polynomial addition and subtraction are mapped to modular addition units, polynomial multiplication is mapped to number theory transformation units, modular multiplication units, modular addition units, and inverse number theory transformation units, ciphertext rotation is mapped to auto-isomorphism units and key switching micro-instruction sequences, and modular boosting and modular descent are mapped to number theory transformation units, modular multiplication units, modular addition units, and shared quotient and modular reduction units.

[0224] For the TFHE scheme, modular switching is mainly mapped to the shared quotient and modular reduction unit; the outer product operation is mapped to the number theory transformation unit, modular multiplication unit, modular addition unit, and shared quotient and modular reduction unit; blind rotation consists of multiple outer product operations and rotation or index update; sample extraction is directly mapped to the sample extraction unit; LWE key switching consists of modular multiplication and modular addition accumulation operations; programmable bootstrapping is completed by the combination of microinstruction sequences corresponding to modular switching, outer product, blind rotation, sample extraction, and key switching.

[0225] For conversions between different fully homomorphic encryption schemes, the conversion from RLWE ciphertext to LWE ciphertext is accomplished through a sampling extraction unit. Repackaging from LWE ciphertext to RLWE ciphertext can be achieved through a combination of modular addition, modular multiplication, number theory transformation, autoisomorphism, and shared quotient and modular reduction units. The autoisomorphism unit performs structured rotations on the repackaging key, allowing multiple LWE components to be accumulated at different positions in the RLWE polynomial.

[0226] II. The complete execution process of plaintext multiplication operations

[0227] Figure 2b The code provides a programming and execution example of plaintext multiplication. The upper-level program provides a plaintext multiplication interface in the form of a C++ function. The function parameters include the output ciphertext address, the input ciphertext address, and the input plaintext address. When the function is called, the output ciphertext address is written to general-purpose register a0, the input ciphertext address is written to general-purpose register a1, and the input plaintext address is written to general-purpose register a2.

[0228] The first step involves the processor core executing the first `fhe.load` instruction, sending the external main memory address `a1` of the input ciphertext and the on-chip destination address to the HPU. This instruction is written to the instruction buffer module via the RoCC interface, and after dependency management and decoding, it enters the load channel. The local MMU translates the on-chip virtual address into physical memory and physical line address. The first direct memory access module reads the input ciphertext from the L2 cache or external main memory and writes it to the on-chip temporary storage memory.

[0229] In the second step, the processor core executes the second `fhe.load` instruction to load the input plaintext from external main memory into another on-chip object in the same manner. If the two destination objects are located in different on-chip memory, the two load requests can be executed consecutively or in parallel.

[0230] Third, the processor core executes the fhe.fence instruction. The multi-issue control module checks the two aforementioned load requests and only allows subsequent multiplication operations to begin after both the first direct memory access module returns a completion signal, thus preventing the computation unit from reading data that has not yet been fully loaded.

[0231] The fourth step involves executing the `fhe.mult` microinstruction or the `fhe.pmult` macroinstruction. The decoding module obtains the on-chip source addresses of the ciphertext and plaintext and registers the destination address as busy. The on-chip temporary storage reads the ciphertext and plaintext data respectively and sends them to the modular multiplication unit via the input buffer module. The modular multiplication unit calculates the coefficient-wise product and performs modular reduction using the shared quotient and modular reduction unit. If the input data is not in the number-theoretical transformation domain, the macroinstruction expansion logic can also insert number-theoretical transformation and inverse number-theoretical transformation microinstructions before and after the modular multiplication, respectively. The calculation result is written to the destination on-chip object via the result buffer module.

[0232] Fifth, execute the fhe.store instruction. The dependency management module confirms that the target object has been computed and allows the store instruction to enter the memory channel. The second direct memory access module reads the result from the on-chip temporary memory and writes it to the external main memory address specified by a0.

[0233] The sixth step involves executing the `fhe.fence` instruction again. The processor core waits for the result to be written back before returning to the upper-level function. Thus, an upper-level fully homomorphic encryption framework function is transformed into a sequence of instructions for loading, synchronizing, computing, storing, and resynchronizing.

[0234] In the above process, if subsequent operations use different data objects and different hardware resources than the current operation, the multi-issue control module can load the next set of input data in advance during the current modular multiplication execution, or write the previous set of results back to external main memory at the same time, thus forming an overlapping pipeline of "load-compute-store".

[0235] III. Other Implementation Methods

[0236] The above architecture can be implemented in a field-programmable gate array (FPGA) or an application-specific integrated circuit (ASIC). On-chip temporary memory can be implemented using block random access memory (BRAM), super random access memory (MARAM), or compile-formatted SRAM; external memory can be DDR memory or HBM; processor expansion interfaces, in addition to RoCC, can also use equivalent internal processor interfaces capable of transmitting custom instructions and operands.

[0237] Without altering the logical functions and connections of each module, the number of on-chip memory banks, the number of coefficients processed in parallel per cycle, the number of homomorphic instruction execution units, the instruction buffer depth, and the number of direct memory access channels can be adjusted. Multiple homomorphic instruction execution units can share modular multipliers, quotient and modulo-reduction units, or on-chip memory ports, or multiple parallel instances can be configured for high throughput requirements.

[0238] The above implementation forms an instruction control path through the processor expansion interface, dependency management, and multi-issue control module; a data storage path through the local MMU, local TLB, on-chip multi-bank SRAM, and direct memory access module; and a computation data path through the input buffer, homomorphic instruction execution unit, and result buffer. These three paths work together to enable the computation, data transfer, and control scheduling of different fully homomorphic encryption schemes to be completed within a unified processor architecture.

[0239] As described above, the method of the present invention can be implemented well.

[0240] Compared with the prior art, the technical solution proposed in this invention has the following advantages:

[0241] Improved the versatility of FHE hardware architecture: Through a unified homomorphic processor architecture and H-ISA instruction set, the same hardware platform can support multiple FHE schemes such as CKKS, BFV, BGV, and TFHE, as well as hybrid FHE applications.

[0242] Improved execution efficiency of FHE computation: By abstracting the core FHE operations into reusable homomorphic computation kernels and mapping them to dedicated hardware computing units, the execution efficiency of key operations such as NTT, modular multiplication, automatic isomorphism, and sampling extraction is improved.

[0243] It reduces the complexity of software and hardware coordination: Through a two-level interface of macro instructions and micro instructions, the upper-level FHE program can express complex homomorphic operations in a manner close to framework calls, while the lower-level hardware schedules and executes them in a fine-grained instruction manner.

[0244] Reduced FHE data migration overhead: Improved data locality of ciphertext and intermediate results through on-chip scratchpad and polynomial granularity data management mechanism, reducing performance loss caused by frequent access to off-chip storage.

[0245] Secondly, such as Figure 7 As shown, this application provides a fully homomorphic encryption processor architecture design system, employing the fully homomorphic encryption processor architecture design method described above. The system includes:

[0246] Fully Homomorphic Encryption Processor Hardware Architecture Building Module 201: The homomorphic processor HPU is used as an extension unit of the processor. The HPU includes: an instruction buffer module, a decoding module, a dependency management module, a multi-issue control module, and multiple homomorphic instruction units. The input homomorphic encryption instructions are decoded by the decoding module and divided into different types of instructions. These instructions are then input into different homomorphic instruction execution units, and the multi-issue control module issues them to the corresponding hardware units according to the data dependency relationship determined by the dependency management module.

[0247] Homomorphic instruction set architecture construction module 202: Extract the minimum homomorphic computation kernel CMK of fully homomorphic encryption computation, and construct a hierarchical homomorphic instruction set H-ISA based on the abstraction of CMK. H-ISA includes: low-level micro-instructions used to describe the basic operations in FHE computation, and high-level macro-instructions used to describe the commonly used operations in the FHE framework. Macro-instructions include multiple micro-instructions.

[0248] Homomorphic instruction unit construction module 203: Based on the common computing kernel of fully homomorphic encryption, a reusable homomorphic instruction execution unit HIU is constructed, including a modular addition unit, a modular multiplication unit, a number theory transformation / inverse number theory transformation unit, an automatic isomorphism unit, a sampling extraction unit, and a modular reduction unit;

[0249] On-chip data management module 204: An on-chip temporary storage memory is set up inside the HPU to temporarily store ciphertext, polynomials, keys and intermediate results. Data is moved between main memory and on-chip temporary storage memory through homomorphic instructions, and the order of data movement and calculation execution is guaranteed by synchronization instructions.

[0250] Thirdly, embodiments of this application provide a homomorphic processor HPU, which serves as an extension unit of the processor. The HPU includes: an instruction buffer module, a decoding module, a dependency management module, a multi-issue control module, and multiple homomorphic instruction units. Input homomorphic encryption instructions are decoded by the decoding module, divided into different types of instructions, input to different homomorphic instruction execution units, and issued to corresponding hardware units by the multi-issue control module according to the data dependency relationship determined by the dependency management module.

[0251] Fourthly, embodiments of this application provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. A homomorphic processor (HPU) is used as an extension unit of the processor. The HPU includes an instruction buffer module, a decoding module, a dependency management module, a multi-issue control module, and multiple homomorphic instruction units. Input homomorphic encryption instructions, after being decoded by the decoding module, are divided into different types of instructions, input to different homomorphic instruction execution units, and issued to corresponding hardware units by the multi-issue control module according to the data dependency relationships determined by the dependency management module.

[0252] In some embodiments, the computer device may further include a communication interface 83 and a bus 80. For example, Figure 8 As shown, the processor 81, memory 82, and communication interface 83 are connected through bus 80 and complete communication with each other.

[0253] Specifically, the processor 81 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0254] The memory 82 can be used to store or cache various data files that need to be processed and / or communicated, as well as possible computer program instructions executed by the processor 81.

[0255] The processor 81 reads and executes computer program instructions stored in the memory 82 to implement any of the operating system kernel sensitive resource isolation methods for the ARM platform in the above embodiments.

[0256] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0257] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A method for designing a fully homomorphic encryption processor architecture, characterized in that, The method includes: The hardware architecture construction steps of the fully homomorphic encryption processor are as follows: The homomorphic processor HPU is used as an extension unit of the processor. The HPU includes: an instruction buffer module, a decoding module, a dependency management module, a multi-issue control module, and multiple homomorphic instruction units. The input homomorphic encryption instructions are decoded by the decoding module and divided into different types of instructions. These instructions are then input into different homomorphic instruction execution units and issued to the corresponding hardware units by the multi-issue control module according to the data dependency relationship determined by the dependency management module. Homomorphic instruction set architecture construction steps: Extract the minimum homomorphic computation kernel CMK of fully homomorphic encryption computation, and construct a hierarchical homomorphic instruction set H-ISA based on the abstraction of the CMK. The H-ISA includes: low-level micro-instructions for describing basic operations in FHE computation, and high-level macro-instructions for describing commonly used operations in the FHE framework. The macro-instructions include multiple of the micro-instructions. Homomorphic instruction unit construction steps: Based on the common computing kernel of fully homomorphic encryption, a reusable homomorphic instruction execution unit (HIU) is constructed, including a modular addition unit, a modular multiplication unit, a number theory transformation / inverse number theory transformation unit, an automatic isomorphism unit, a sampling extraction unit, and a modular reduction unit.

2. The fully homomorphic encryption processor architecture design method according to claim 1, characterized in that, The method further includes: On-chip data management steps: An on-chip temporary storage memory is set up inside the HPU to temporarily store ciphertext, polynomials, keys and intermediate results. Data is moved between main memory and on-chip temporary storage memory through homomorphic instructions, and the order of data movement and computation execution is ensured by synchronization instructions.

3. The fully homomorphic encryption processor architecture design method according to claim 1 or 2, characterized in that, The HPU also includes: a RoCC interface, a loading channel, a storage channel, an execution channel, a local homomorphic memory management unit, a local address translation backup buffer, an on-chip temporary storage memory, a configuration register, a direct memory access module, a read-only data channel, an input buffer module, and a result buffer module; The RoCC interface is connected to the processor core and the instruction buffer module. It is used to transmit homomorphic instructions to the HPU through the RoCC command channel, and to complete the conversion between the general processor instruction stream and the HPU internal command stream. The instruction buffer module is connected to the RoCC interface and the dependency management module. It is used to temporarily store homomorphic instructions that have not yet been decoded or have not yet met the launch conditions, and to decouple the instruction launch rate of the processor core from the internal execution rate of the HPU. The dependency management module connects the instruction buffer module and the decoding module, and is also connected to the multi-issue control module, the loading channel, the storage channel, the execution channel, and the completion feedback terminal of each homomorphic instruction execution unit. It is used to determine whether there is data dependency, address conflict or resource conflict between the instruction to be issued and the instruction in transit. The decoding module is connected to the dependency management module and to the loading channel, storage channel, execution channel, and multi-issue control module respectively. The decoding module is used to determine whether an instruction is a microinstruction or a macroinstruction based on the instruction opcode, and then determine the specific operation based on the function code. The multi-issue control module is connected to the decoding module, dependency management module, loading channel, storage channel, execution channel, on-chip temporary storage arbitration terminal, and each homomorphic instruction execution unit. It is used to receive instructions that have been decoded by the decoding module and whose dependency conditions are met, and decide whether to issue instructions based on whether the direct memory access module is idle, whether the target execution unit is idle, whether the on-chip temporary storage port is available, and whether there is a memory conflict between different instructions.

4. The fully homomorphic encryption processor architecture design method according to claim 1 or 2, characterized in that, The microinstructions include: The computation microinstructions include: using the processor core's custom opcode space, polynomial addition, polynomial subtraction, polynomial multiplication, scalar and polynomial multiplication, forward and inverse number theory transformations, automatic isomorphism, and sample extraction; Data movement and synchronization instructions include: load instructions and store instructions, used to move polynomials between main memory and on-chip temporary storage; and synchronization instructions, used to constrain the order between memory movement operations and computation operations. Configuration and status commands include parameter configuration commands and status reading commands. The HPU exposes relevant parameters through parameter configuration commands and queries the HPU's running status through status reading commands.

5. The fully homomorphic encryption processor architecture design method according to claim 1 or 2, characterized in that, The macro instruction is a semantic package including: the same underlying HIU as the microinstruction reuse; and a short sequence of CMK primitives; the macro instruction includes: CKKS-type macro instructions: Modulus boosting instruction, Modulus deflating instruction, Plaintext multiplication instruction, Scalar multiplication instruction, Ciphertext multiplication instruction, Homomorphic addition instruction, Homomorphic subtraction instruction, Rotation instruction, Key switching instruction, and Relinearization instruction; TFHE macro instructions: Homomorphic CMUX gate instruction, LWE key switching instruction, LWE homomorphic addition instruction, LWE homomorphic subtraction instruction, and LWE plaintext multiplication instruction.

6. The fully homomorphic encryption processor architecture design method according to claim 1 or 2, characterized in that, The HPU instantiates multiple HIU classes, each HIU implementing one or more basic instructions in H-ISA; the HIU includes: Shared Quotient and Modulo Subtraction (SQM) Homomorphic Instruction Unit: Used to perform division and modulo operations simultaneously within the same instruction frame; Sampling and Extraction SE Homomorphic Instruction Unit: Used to implement ciphertext conversion between different FHE schemes, supporting conversion from RLWE format to LWE format.

7. The fully homomorphic encryption processor architecture design method according to claim 2, characterized in that, The on-chip temporary storage is divided into multiple independent memory banks, each memory bank having an independent address selection and read / write control terminal; the multiple memory banks are connected to the first direct memory access module, the second direct memory access module and the execution channel respectively through memory bank selection logic or cross switches; The first direct memory access module corresponds to the data loading direction. One end of it is connected to the secondary cache or external main memory through the system storage channel, and the other end is connected to the write end of the on-chip temporary storage memory. The first direct memory access module is used to generate continuous or segmented burst read requests according to the external source address, on-chip destination address and polynomial number given by the load instruction, and write the returned data sequentially to the physical memory determined by the local MMU. The second direct memory access module corresponds to the data storage direction. One end of it is connected to the read end of the on-chip temporary storage memory, and the other end is connected to the L2 cache or external main memory through the system storage channel. The second direct memory access module is used to read a specified on-chip object and generate a burst write request to external main memory.

8. A fully homomorphic encryption processor architecture design system, employing the fully homomorphic encryption processor architecture design method as described in any one of claims 1-7, characterized in that, The system includes: The hardware architecture construction module for the fully homomorphic encryption processor includes a homomorphic processor (HPU) as an extension unit of the processor. The HPU comprises an instruction buffer module, a decoding module, a dependency management module, a multi-issue control module, and multiple homomorphic instruction units. The input homomorphic encryption instructions are decoded by the decoding module, divided into different types of instructions, input to different homomorphic instruction execution units, and issued to the corresponding hardware units by the multi-issue control module according to the data dependency relationship determined by the dependency management module. Homomorphic instruction set architecture construction module: Extract the minimum homomorphic computation kernel CMK of fully homomorphic encryption computation, and construct a hierarchical homomorphic instruction set H-ISA based on the abstraction of the CMK. The H-ISA includes: low-level micro-instructions for describing basic operations in FHE computation, and high-level macro-instructions for describing commonly used operations in the FHE framework. The macro-instructions include multiple of the micro-instructions. Homomorphic Instruction Unit Construction Module: Based on the common computing kernel of fully homomorphic encryption, a reusable homomorphic instruction execution unit (HIU) is constructed, including a modular addition unit, a modular multiplication unit, a number-theoretic transformation / inverse number-theoretic transformation unit, an automatic isomorphism unit, a sampling extraction unit, and a modular reduction unit.

9. A homomorphic processor (HPU), characterized in that, The HPU serves as an extension unit of the processor. The HPU includes an instruction buffer module, a decoding module, a dependency management module, a multi-issue control module, and multiple homomorphic instruction units. The input homomorphic encryption instructions are decoded by the decoding module, divided into different types of instructions, input to different homomorphic instruction execution units, and issued to the corresponding hardware units by the multi-issue control module according to the data dependency relationship determined by the dependency management module.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The homomorphic processor (HPU) is used as an extension unit of the processor. The HPU includes an instruction buffer module, a decoding module, a dependency management module, a multi-issue control module, and multiple homomorphic instruction units. The input homomorphic encryption instructions are decoded by the decoding module, divided into different types of instructions, input to different homomorphic instruction execution units, and issued to the corresponding hardware units by the multi-issue control module according to the data dependency relationship determined by the dependency management module.

Images