Cryptoprocessor for Fully Homomorphic Encryption (FHE) Applications

Abstract

Cryptographic processor chips, systems, and related methods are disclosed. In one embodiment, a cryptographic processor is disclosed. The cryptographic processor includes a first cryptographic processing module for performing a first logical operation. The first cryptographic processing module includes a first input circuit for receiving ciphertext input symbols. A first pipeline stage performs a first operation on the ciphertext input symbols to generate a first stage output. An on-chip memory temporarily stores the first stage output and provides the first stage output in a pipelined manner to a second pipeline stage. The second pipeline stage is configured to perform a second operation on the first stage output in a pipelined manner relative to the first pipeline stage.

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application is a non-provisional application claiming priority to U.S. Provisional Application No. 63 / 289,783, entitled "CRYPTOGRAPHIC PROCESSOR FOR FULLY HOMOMORPHIC ENCRYPTION (FHE) APPLICATIONS," filed on December 15, 2021, and is incorporated by reference herein in its entirety.

[0002] TECHNICAL FIELD The present disclosure relates to cryptographic processors, and more particularly to homomorphic cryptographic processors and related methods. [Background technology]

[0003] Fully homomorphic encryption (FHE) allows computations to be performed on encrypted data without a third party having to decrypt the data first. This form of encryption allows users to store private encrypted data, for example on a remote server, while processing the encrypted data at the data storage facility. Fully homomorphic encryption is well suited to cloud-based computing environments.

[0004] While there are high hopes for protecting the privacy of data owners, operations involving encrypted data require a large amount of computation. Summary of the Invention

[0005] Cryptographic processor chips, systems, and related methods are disclosed. In one embodiment, a cryptographic processor is disclosed. The cryptographic processor includes a first cryptographic processing module that performs a first logical operation. The first cryptographic processing module includes a first input circuit for receiving ciphertext input symbols from an on-chip memory. A first pipeline stage performs a first operation on the ciphertext input symbols to generate a first stage output. The first stage output is provided to a second pipeline stage in a pipelined manner. The second pipeline stage is configured to perform a second operation on the first stage output in a pipelined manner to the first pipeline stage. Constants used to perform the operations are stored in an on-chip memory associated with each pipeline stage. By employing multiple stages in conjunction with the on-chip memory, the first cryptographic processing module is able to perform cryptographic operations such as ciphertext multiplication, rotation, and addition in a fully pipelined manner. This feature significantly reduces the processing time for performing cryptographic operations to a level similar to the processing time associated with non-ciphertext operations.

[0006] In another embodiment, a first input circuit of the cryptographic processor receives ciphertext input symbols synchronously with an instruction clock signal, and a new set of input ciphertext symbols is presented to the first input circuit on each cycle of the instruction clock signal.

[0007] In yet another embodiment, the first cryptographic processing module is configured to perform a ciphertext multiplication operation, a ciphertext rotation operation, or a ciphertext addition operation.

[0008] In a further embodiment, the storage circuit includes a bit-wide configured input interface for receiving at least one entire ciphertext or key modulus per cycle of the system clock.

[0009] In another embodiment, the cryptographic processor further includes at least one Chinese Remainder Theorem (CRT) processing stage.

[0010] In yet another embodiment, the first cryptographic processing module is configured as a Residue Number System (RNS) architecture.

[0011] In a further embodiment, the first cryptographic processing module includes a number of processing slices defining a number of processing channels, each channel performing operations on signals up to 64 bits wide concurrently with the other processing channels.

[0012] In another embodiment, the first cryptographic processing module is configured as a large arithmetic word size (LAWS) architecture.

[0013] In a further embodiment, the first cryptographic processing module includes a single processing slice defining a single processing channel for performing operations on signals greater than 64 bits wide.

[0014] In yet another embodiment, the cryptographic processor further includes a second processing module that performs a second logical operation different from the first logical operation.

[0015] In another embodiment, the storage circuitry includes on-chip register circuitry configured to temporarily store the input of each stage.

[0016] In a further embodiment, the first cryptographic processing module produces an output with a predetermined latency of execution cycles and a constant throughput.

[0017] In yet another embodiment, the first pipeline stage includes a number theoretic transform (NTT) circuit stage for performing an NTT circuit as the first operation, the NTT circuit stage configured to exhibit a predetermined parallelism, and the second pipeline stage configured to use a number of inputs and outputs that match the predetermined parallelism of the NTT circuit stage.

[0018] In a further embodiment, a cryptographic processor includes a first cryptographic processing module with a first input circuit for receiving ciphertext input symbols. A number theoretic transform (NTT) stage performs an NTT operation on the received ciphertext input symbols to generate an NTT stage output. The NTT stage is configured to provide a predetermined parallelism. A second circuit stage receives the NTT stage output in a pipelined manner. The second pipeline stage is configured to use a number of inputs and outputs that match the predetermined parallelism of the NTT circuit.

[0019] In another embodiment, a first input circuit of the cryptographic processor receives the ciphertext input symbols synchronously with an instruction clock signal, where a new set of input ciphertext symbols is presented to the first input circuit for each cycle of the instruction clock signal.

[0020] In yet another embodiment, the first cryptographic processing module is configured to perform a ciphertext addition operation, a ciphertext multiplication operation, or a ciphertext rotate operation.

[0021] In a further embodiment, the first cryptographic processing module is configured as a Residue Number System (RNS) architecture and includes multiple processing slices defining multiple processing channels, each channel performing operations on signals up to 64 bits wide simultaneously with the other processing channels.

[0022] In another embodiment, the first cryptographic processing module is configured as a large arithmetic word size (LAWS) architecture and includes a single processing slice defining a single processing channel for performing operations on signals greater than 64 bits wide.

[0023] In a further embodiment, the first cryptographic processing module produces an output with a predetermined latency of execution cycles and a constant throughput.

[0024] In a further embodiment, a method of operation in a cryptographic processor includes receiving ciphertext input symbols at a first input circuit, performing a number theoretic transform (NTT) operation on the received ciphertext input symbols at an NTT stage to generate an NTT stage output configured to exhibit a predetermined parallelism, and receiving the NTT stage output in a pipelined manner at a second pipeline stage configured to use a number of inputs and outputs that match the predetermined parallelism of the NTT circuit.

[0025] In yet another embodiment, an integrated circuit (IC) chip includes a processing circuit for performing a processing operation on an input ciphertext. An on-chip storage is coupled to the processing circuit via a transfer interface. The transfer interface exhibits a predetermined bit width configured to deliver at least one complete ciphertext or key coefficient to the processing circuit per cycle.

[0026] In one embodiment, the on-chip storage takes the form of embedded static random access memory (SRAM).

[0027] In another embodiment, the on-chip storage further includes a memory interface configured with a bit width matching the predetermined bit width for communicating with the external storage, the on-chip storage forwarding the first set of ciphertext and / or key modulus to the processing circuit on each cycle simultaneously with receiving a second set of input ciphertext and / or key modulus from the external storage via the memory interface.

[0028] In a further embodiment, the external storage includes at least one high bandwidth memory (HBM) device.

[0029] In yet another embodiment, the on-chip storage is configured to store a subset of the roots of unity and inverse roots of unity of the synchronous transformation, with additional roots of unity being generated by the processing circuitry as modular products of the subset of the stored roots.

[0030] Embodiments of the present disclosure are illustrated by way of example, and not by way of limitation, in the accompanying drawings in which like reference numbers refer to similar elements and in which: [Brief description of the drawings]

[0031] [Figure 1] 1 illustrates an embodiment of an integrated circuit (IC) crypto processor that performs fully homomorphic encryption (FHE) processing. [Diagram 2] 2 illustrates one embodiment of the ciphertext addition module of FIG. 1. [Diagram 3] 3 illustrates a pipeline timing diagram corresponding to the Ciphertext Addition module illustrated in FIG. 2. [Figure 4A] 2 illustrates a first portion of an embodiment of a Residue Number System (RNS) ciphertext multiplication module that corresponds to the ciphertext multiplication module of FIG. 1 . [Figure 4B] 4B illustrates a second portion of the Residue Number System (RNS) ciphertext multiplication module of FIG. 4A. [Figure 5A] 4C shows a first portion of a pipeline timing diagram corresponding to the ciphertext multiplication module shown in FIG. 4A and FIG. 4B. [Figure 5B] 5B shows a second portion of the pipeline timing diagram of FIG. 5A. [Figure 6A] 2 illustrates a first portion of an embodiment of a large arithmetic word size (LAWS) ciphertext multiplication module that corresponds to the ciphertext multiplication module of FIG. 1 . [Figure 6B] 6B illustrates a second portion of the large arithmetic word size (LAWS) ciphertext multiplication module of FIG. 6A. [Figure 7A] FIG. 6C illustrates a first portion of a pipeline timing diagram corresponding to the ciphertext multiplication module illustrated in FIGS. 6A and 6B. [Figure 7B] FIG. 7B is a second portion of the pipeline timing diagram of FIG. 7A. [Figure 8A] 2 illustrates a first portion of an embodiment of an RNS-based ciphertext rotation module that corresponds to the ciphertext rotation module of FIG. 1 . [Figure 8B]FIG. 8B is a second portion of the RNS-based ciphertext rotation module of FIG. [Figure 9A] FIG. 8C illustrates a first portion of a pipeline timing diagram corresponding to the ciphertext rotation module shown in FIGS. 8A and 8B. [Figure 9B] FIG. 9B is a second portion of the pipeline timing diagram of FIG. 9A. [Figure 10A] 2 illustrates a first portion of an embodiment of a LAWS-based ciphertext rotation module that corresponds to the ciphertext rotation module of FIG. 1 . [Figure 10B] 10B illustrates a second portion of the LAWS-based ciphertext rotation module of FIG. 10A. [Figure 11A] FIG. 14 illustrates a first portion of a pipeline timing diagram corresponding to the ciphertext rotation module shown in FIGS. 10A and 10B. [Figure 11B] 11B shows a second portion of the pipeline timing diagram of FIG. 11A. [Figure 12] 1 illustrates one embodiment of a LAWS-based circuit having NTT and iNTT with eSRAM blocks for storing powers of unity. [Figure 13] 4 illustrates a further embodiment of a cryptographic processing circuit. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0032] With reference to FIG. 1, one embodiment of an integrated circuit (IC) crypto processor generally designated 100 employs an on-chip ciphertext (Ctxt) addition module 102, a ciphertext multiplication module 104, and a ciphertext rotation module 106 connected to an on-chip bus 108. An on-chip memory 110 is provided to temporarily store and provide data to the computing modules in a manner that, in one embodiment, allows for full pipeline operation of each module. In some embodiments, the on-chip memory 108 employs a memory interface at least as wide as the input ciphertext or key modulus. In some embodiments, the bus 108 exhibits a bit width that matches the bit width of the memory interface associated with the on-chip memory 110. Additionally, the crypto processor 100 uses control logic 112 to coordinate the operation of the modules and control data transfers to and from external entities via a processor interface 114. This general architecture provides a cycle-accurate crypto processor that provides hardware acceleration for the computation of homomorphic operations providing processing speeds similar to those associated with non-cryptographic operations.

[0033] As described in more detail below, in one embodiment, the ciphertext addition, multiplication, and rotation modules are configured as fully pipelined modules, with ciphertext data being processed on each instruction clock cycle. The ciphertext addition module typically uses a single stage circuit, while the ciphertext multiplication and rotation modules use multiple stages of circuitry that operate in a fully pipelined manner in conjunction with on-chip memory. In one embodiment, to provide input ciphertext and / or key coefficient operands to the full pipeline modules with sufficient bandwidth to support a full pipeline architecture, the memory interface of the on-chip memory 110 is configured to transmit at least one complete ciphertext or key coefficient per pipeline cycle.

[0034] The ciphertexts are

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0035] In the various module embodiments described below, the input ciphertext is generally represented as

number

number

number

[0036] In some embodiments, such as those shown in FIGS. 4A-4B and 6A-6B,

number

number

number

[0037] Figure 2 illustrates one embodiment of the ciphertext addition module 102 corresponding to that shown in Figure 1. Ciphertext addition may be defined by the following relationship 1, which generally utilizes modular addition for each coefficient of the corresponding polynomial in each ciphertext. This relationship is the same for both RNS and Large Arithmetic Word Size (LAWS) architectures. In all relationships, the bit size of each operation is listed in the right margin. Two input indices (e.g., 204) from each input polynomial are processed in parallel, reflecting the input structure of the Number Theoretic Transform (NTT) functions for the addition and rotation functions of the ciphertexts,

number

number

number

number

number

number

[0038] Figure 3 shows a pipeline diagram of the critical latency associated with the ciphertext addition module 102 of Figure 2. Every processor cycle, indicated by a number between 0 and 8199, a new coefficient pair is read and, after a latency of 9 cycles (determined by the ModAdd block), a coefficient pair is generated, such as at 306. All inputs to the ciphertext addition functions (e.g., 308) in Figure 3 are processed in parallel, so

number

[0039] 4A, one embodiment of a ciphertext multiplication module 400 is shown, which corresponds to the ciphertext multiplication module 104 of FIG. 1. In an RNS embodiment, ciphertext multiplication can be defined by the following relationship 2a, which corresponds to the hardware stages shown in FIG. 4A and FIG. 4B: Two input indices, such as 402, from each input polynomial are processed in parallel to match the throughput of the NTT function provided by a stage of NTT circuitry 406,

number

number

number

number

[0040] 4A, a particular stage of the CRT circuit 404 receives the input index 402 and performs a CRT function on the index, including a transformation to the RNS domain. The results are sent to a first stage of the NTT circuit 406. An NTT operation is performed on each polynomial, followed by multiplication by a stage of the Barrett module multiplication circuit 408. For a first subset of the indexes, the results of the Barrett multiplication are fed to a stage of the inverse NTT module 410, which performs the inverse NTT function, and then passes the results to a stage of the inverse CRT circuit 412. For a second subset of the indexes, the results of the Barrett multiplication are fed to a stage of the modular addition circuit 414, which feeds the inverse NTT circuit 416. The results of the iNTT circuit are then fed to the iCRT circuit 412. While the input indexes are being processed by the various stages, the set of input keys at 418 are temporarily queued, such as in a FIFO pipeline register 420.

[0041] 4B, the set of input keys is temporarily stored in the FIFO pipeline register 420 and then provided to the second stage of the CRT circuit 424. In the same processor cycle, a first subset of the input indexes is provided from the iCRT circuit 412 stage to the second stage of the CRT circuit 424 for parallel processing with the input keys. The remaining output from the iCRT circuit 412 is provided to the second set of FIFO pipeline registers 422. Similar to the processing of the input indexes described above, an NTT operation is performed on the input keys and the unique set of indexes by the second stage of the NTT circuit 426, and then a multiplication is performed by the second stage of the Barrett module multiplication circuit 428. The result of the Barrett multiplication is provided to the second stage of the inverse NTT module 430, which performs the inverse NTT function before passing the result to the second stage of the inverse CRT circuit 432. The result generated by the second stage of the iCRT circuit 432 is provided to the bit shift module 434 stage, and the bit shifted result is provided to the modular adder 436 stage. The modular adder 436 stages are also provided with the queued outputs from the FIFO pipeline registers 422 .

[0042] 4B, a stage of modular adder circuit 436 performs an addition function and provides the result to a second stage of bit shift circuit 438. The bit shift circuit 438 stage performs a bit shift operation to generate the resulting multiplier output. Relation 2a below provides a more detailed functional description of how the circuits of Figures 4A and 4B operate.

number

[0043] For RNS-based architecture implementations, ciphertext multiplication typically involves first converting all polynomials to the RNS domain and NTT domain to perform polynomial multiplication. Referring to relation 2a, all operations in both loops are 64-bit operations, and in the first iteration of the "for" loop involving np channels,

number

number

number

number

number

number

number

[0044] Further referring to FIG. 4A and FIG. 4B, since the operations between the RNS channels are independent, each iteration of the “for” loop in relation 2a can be executed in parallel to

number

number

number

number

number

number

[0045] 4A and 4B and with continued reference to relationship 2a, while modular multiplication and addition take their operands from two different polynomials, CRT circuits 404 and 424 and NTT circuits 406 and 426 each take their two inputs from the same polynomial.

number

number

number

number

number

[0046] Further, with reference to FIGS. 4A and 4B and relationship 2a,

number

number

number

number

number

number

number

number

number

[0047] 5A and 5B show respective portions of a pipeline diagram for the critical latency of the RNS embodiment of the ciphertext multiplication module of FIG. 4A and FIG. 4B, corresponding to relationship 2a. The critical latency is created by the multiplication of the input ciphertext polynomial, which is also multiplied by the key polynomial, so

number

number

[0048] 5A and 5B, in one embodiment, the ciphertext multiplication block 104 has a throughput of four coefficients per cycle and a latency of 40,513 cycles for the RNS embodiment of the ciphertext multiplication module. As in FIG. 3, the pipeline diagram in FIG. 5A and 5B shows the path of the coefficients through the ciphertext multiplication module 104, not the actual inputs of the function itself. The largest contributors to the latency of the RNS embodiment are the NTT and iNTT operations. In fact, in the RNS embodiment, the two NTT operations and the iNTT operation account for over 97% of the ciphertext multiplication cycle count. It is therefore clear that the most effective way to speed up ciphertext multiplication is to speed up the NTT and iNTT operations.

[0049] 6A and 6B, a LAWS embodiment of a ciphertext multiplication module 600 is shown. Generally speaking, in a LAWS embodiment, ciphertext multiplication can be defined by the following relationship 2b, which corresponds to the hardware stages shown in Figures 6A and 6B: Two input indices, such as 602, from each input polynomial are processed in parallel to match the throughput of the NTT function provided by a stage of NTT circuitry 604,

number

number

number

number

[0050] 6A, the input indices at 602 are fed to a first stage of an NTT circuit 604, where an NTT operation is performed on each polynomial, followed by multiplication by a stage of a Barrett module multiplication circuit 610. For a first subset of the indices, the results of the Barrett multiplication are fed to a stage of an inverse NTT module 612, which performs an inverse NTT function. For a second subset of the indices, the results of the Barrett multiplication are fed to a stage of a modular addition circuit 614, which in turn is fed to an inverse NTT circuit 616. While the input indices are being processed by the various stages, the set of input keys at 606 are temporarily queued in a FIFO pipeline register 608.

[0051] Referring to FIG. 6B, the set of input keys is temporarily stored in the FIFO pipeline register 608 and then provided to the second stage of the NTT circuit 618. In the same processor cycle, a first subset of the input indexes is provided from the iNTT circuit 612 stage to the second stage of the NTT circuit 618 for parallel processing with the input keys. The remaining output from the iNTT circuit 612 is provided to the second set of FIFO pipeline registers 620. Similar to the processing of the input indexes described above, an NTT operation is performed by the second stage of the NTT circuit 618 on the input keys and the unique set of indexes, and then a multiplication is performed by the second stage of the Barrett module multiplication circuit 622. The result of the Barrett multiplication is provided to the second stage of the inverse NTT module 624, which performs the inverse NTT function before passing the result to the bit shift module 626 stage, which provides the bit shifted result to the modular adder 628 stage. The modular adder 628 stage is also provided with the queue output from the FIFO pipeline register 620.

[0052] 6B, a stage of modular adder circuit 628 performs an addition function and provides the result to a second stage of bit shift circuit 630. The bit shift circuit 630 stage performs a bit shift operation to generate the resulting multiplier output. Relation 2b below provides a more detailed functional description of how the circuits of Figures 6A and 6B operate.

number

[0053] 6A, 6B, and relationship 2b, the LAWS-based architecture of the ciphertext multiplication module 104 does not convert the polynomial coefficients to the RNS domain, but instead converts them directly to the NTT domain to perform the polynomial multiplication. Thus, in relationship 2b, each of the BarrettModMult function calls represents a 512-bit or 1024-bit coefficient-by-coefficient multiplication. In both relationships 2a and 2b, all operations performed on the polynomial after the CRT transformation and before the iCRT transformation are 64-bit operations, and all operations performed on the polynomial without performing the CRT transformation are 512-bit or 1024-bit operations depending on the modulus.

[0054] Comparing the RNS and LAWS embodiments, the main advantage of the RNS embodiment of the ciphertext multiplication module is that all modular additions and multiplications are 64-bit operations rather than 512-bit or 1024-bit operations. The main advantage of the LAWS embodiment is that all modular additions and multiplications are 64-bit operations rather than 512-bit or 1024-bit operations.

number

[0055] 7A and 7B show the respective portions of the critical latency pipeline diagram of the LAWS-based ciphertext multiplication module of FIG. 6A and FIG. 6B corresponding to the relationship 2b. The double slashes between the hexagons are used to represent the operations that take a long time to run. At each cycle, a new coefficient pair is read and a coefficient pair is generated after each cycle of 42,517 cycles of latency (dominated by NTT and iNTT operations). Note that the NTT, BarrettModMult, and iNTT operations in the LAWS implementation all use 512-bit and 1024-bit multiplications instead of 64-bit multiplications, resulting in longer execution times than the RNS embodiment of FIG. 4A and FIG. 4B. The largest contributors to the latency of the LAWS embodiment are the NTT and iNTT operations, as in the RNS embodiment. In the LAWS embodiment, the NTT and iNTT operations account for more than 99% of the number of ciphertext multiplication cycles. It is therefore clear that the most effective way to speed up the LAWS embodiment of ciphertext multiplication is to speed up the NTT and iNTT operations.

[0056] Further, with reference to FIGS. 7A and 7B, similar to the ciphertext addition module, to maximize the throughput of the NTT, all polynomials are processed in parallel with two coefficients and the indices are N / 2 apart.

[0057] Further, with reference to FIGS. 7A and 7B, in a LAWS-based embodiment of the ciphertext multiplication module, the critical latency is created by the multiplication of the input ciphertext polynomial, which must also be multiplied by the key polynomial,

number

[0058] Although the LAWS embodiment has fewer stages of critical latency than the RNS embodiment, each modular multiplication in the RNS implementation is only 64-bit, whereas in the LAWS embodiment the multiplication is a 512-bit or 1024-bit operation. Individual large bit size operations in the LAWS embodiment have longer latencies than the RNS embodiment, resulting in a lower total latency for the RNS embodiment. The latency of both the RNS and LAWS embodiments is low enough to meet the objectives of most applications, but without parallel instantiation, there is a significant silicon footprint (area) savings when employing the LAWS embodiment.

[0059] 8A and 8B, there is shown one embodiment of a ciphertext rotation module 800, which corresponds to the ciphertext rotation module 106 of Figure 1. In an RNS embodiment, the ciphertext rotation may be defined by the following relationship 3a, which corresponds to the hardware stages shown in Figures 8A and 8B:

number

[0060] In general, ciphertext rotation in the RNS context is similar to ciphertext multiplication, since all polynomial multiplications are performed in the NTT domain and include CRT transformations to perform 64-bit operations. However, in some embodiments, unlike the ciphertext multiplication module 104, there are no polynomial multiplications modulo q, only modulo Q, so all RNS domain operations are np key It is executed in parallel.

number

number

number

[0061] With further reference to FIG. 8A, two input indices from each input polynomial, such as 802, are processed in parallel to match the throughput of the NTT function,

number

[0062] With continued reference to FIGS. 8A and 8B, the stage of Rot circuit 804 is

number

number

number

number

number

[0063] 9A shows a first portion of a pipeline diagram of the critical latency of an RNS embodiment of the ciphertext rotation module 800 of FIGS. 8A and 8B, corresponding to relationship 3a. The critical latency includes the multiplication of the polynomial that is the output of the Rot block by the key polynomial,

number

number

[0064] 9A and 9B, it can be seen that for this RNS embodiment, the throughput of the ciphertext rotation block is a factor of four per cycle, with a latency of 28,569 cycles. Again, as with ciphertext multiplication, the majority of the cycles for the RNS embodiment can be attributed to the NTT circuitry 810 and iNTT circuitry 814 stages, as these two account for 69% of the total cycles for the RNS embodiment. This percentage is lower than that for ciphertext multiplication, because for the LAWS embodiment, a pipeline bubble between the Rot 804 and the CRT 808 or NTT 1004 causes the modules to take N / 2=8,192 cycles. As with ciphertext multiplication, the most efficient way to speed up ciphertext rotation is to speed up the NTT 810 and iNTT 814 modules.

[0065] 10A, there is shown a LAWS embodiment of a ciphertext rotation module 1000. In a LAWS embodiment, the rotation of the ciphertext may be defined by the following relationship 3b, which corresponds to the hardware stages shown in FIGS. 10A and 10B: Two input indices, such as 1002, from each input polynomial are processed in parallel to match the throughput of the NTT function performed by a stage of the NTT circuit 1004,

number

number

[0066] As with the RNS embodiment, the Rot circuit 1006 stage of FIG. 10A implements the relation 3b

number

number

number

number

[0067] 11A and 11B show a pipeline diagram of the critical latency of a LAWS embodiment of the ciphertext rotation module 1000 of FIGS. 10A and 10B, which corresponds to relationship 3b. Similar to the RNS embodiment, the critical latency of the LAWS embodiment is

number

number

[0068] As further shown in Figures 11A and 11B, the LAWS embodiment of the ciphertext rotation module 1000 exhibits a latency of 29,780 cycles. The double slashes between the hexagons are used to represent long running operations. A new coefficient pair is loaded each cycle, and a coefficient pair is also generated each cycle, after a latency of 29,780 cycles. The number of cycles saved in the LAWS embodiment by not performing a CRT or iCRT transform is offset by the larger bit size of the multiplication, resulting in a slightly longer run time for the LAWS implementation than for the RNS embodiment.

[0069] 12 shows one embodiment of a stage of an NTT circuit 1202 and a stage of an iNTT circuit 1204 with eSRAM blocks 1206 and 1208 for storing roots of unity in a LAWS architecture. The eSRAM blocks 1206 and 1208 are used to store the roots of unity and the inverse roots of unity, while the distributed eSRAM C block 1210 represents a number of smaller eSRAMs that store other constants. In the RNS architecture, the eSRAM B blocks 1206 and 1208 also store the np or np arithmetic operations of all the modules shown. keyEach wire represents a 1024-bit bus, with 3log 2 N modular multipliers are used for on-the-fly root generation of powers of unity (three multipliers per logN stage in the NTT or iNTT circuit). Multiple eSRAM A blocks (not shown) are used to store ciphertext or key polynomials used as input to the ciphertext addition, ciphertext multiplication, or ciphertext rotation modules.

[0070] As described in the various embodiments above, the ciphertext multiplication, addition, and rotation modules operate in a fully pipelined manner to efficiently perform ciphertext calculations. Since typical ciphertext and key coefficients are often hundreds to thousands of bits wide, employing an appropriate memory architecture to store the constants and coefficients used in the calculations is an important consideration. In one particular embodiment, a wide memory device compliant with the High Bandwidth Memory 2 standard (such as HBM2E) with a 1024-bit wide bus is used to transfer the 512-bit ciphertext coefficients from external memory to the on-chip memory during processing. All on-chip eSRAM blocks are 2048-bit or 1024-bit wide, allowing the transfer of multiple 512-bit intermediate ciphertext coefficients or 1024-bit key coefficients per cycle. The cryptoprocessor employs a unique memory architecture strategy by reading an entire wordline of large-width memory per cycle, continuously feeding new inputs into a deeply pipelined design to generate a new output per cycle.

[0071] FIG. 13 illustrates one embodiment of a ciphertext processing circuit 1300, showing a ciphertext multiplication module 1302 coupled to multiple on-chip eSRAM blocks 1304 and 1306. External memory in the form of high bandwidth memory (HBM) devices 1308 and 1310 delivers at least one complete ciphertext or key coefficient per cycle to the on-chip eSRAM memory. The ciphertext multiplication module 1302 also includes a memory interface 1312 that receives at least one entire specified ciphertext coefficient per cycle, in keeping with the wide width of the eSRAM, and receives at least one entire specified key coefficient per cycle via interface 1314. The ciphertext multiplication module transmits the multiplication result per cycle via one or more output interfaces having the same width as the input interfaces 1312 and 1314. Additional processing modules, such as a rotation module 1316 and an addition module 1318, may be interconnected to the multiplication module 1302, along with further distributed on-chip eSRAM devices.

[0072] Various further details related to the various embodiments described above are provided below. The number of cycles for each of these modules with required input bit sizes, obtained from Verilog simulations, are used to determine the relative performance of the RNS and LAWS embodiments of the benchmarks described below. All the modules described below utilize constants stored in the distributed eSRAM blocks described above for their execution. Here, we assume that the required constants are always available when needed.

[0073] In some embodiments, the CRT and iCRT modules can be implemented using the ModAdd and BarrettModMult modules. Furthermore, because iCRT employs conditional subtraction, pipeline registers can be used to ensure that the value arrives at the output after the same number of cycles regardless of whether the condition is executed or not. This results in constant execution time for the presented design, which provides security benefits. A pipeline implementation can take advantage of these registers, since the number of cycles required for an operation must always be determined in advance. Both algorithms were implemented such that operations are performed in parallel across all RNS channels. This parallelism involves the use of np or np-n of all modular multiplication, multiplication, reduction, and modular addition modules within parallel loop iterations. key This involves instantiating copies. Therefore, the latency of the CRT module is multiplied by log 2 np or log 2 np key The latency of the iCRT module is the sum of the latency of the addition and Barrett reduction. The latency of the iCRT module is the sum of the latency of the BarrettModMult, multiplication, and log 2 np or log 2 np key This is the sum of the latencies of modular addition, Barrett reduction, and modular subtraction. Because iCRT arithmetic uses more modular arithmetic, its latency is almost twice that of the CRT module.

[0074] Both algorithms

number

number

number

number

number

number

number

[0075] NTT and iNTT can be implemented using a feed-forward architecture. In one embodiment, a two-parallel radix-2 implementation of NTT is employed, which uses an on-the-fly root-of-one generation scheme to save eSRAM area. However, it is assumed that all stored roots of one are generated before inference begins, so their generation does not contribute to the cycle counts presented. Each NTT and iNTT circuit has

number

number

[0076] The latency of a feedforward implementation of NTT or iNTT is dominated by the pipeline registers that are used in conjunction with MUXes to align the correct inputs to each stage of the transform in the NTT or iNTT circuit. For a radix-2 implementation of the transform, for the chosen parameters, the total number of cycles across all stages is

number

[0077]

number

number

number

number

number

number

number

[0078] In the BarrettModMult module, by using the appropriate wiring connections, all moduli by powers of two can be realized without logic gates.

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

[0079] The bit shifting was implemented using a pipelined logarithmic funnel shifter constructed from a tree of MUXes. As the name suggests, it takes log to perform a bit shift of n bits. 2 It takes n cycles, which is 2 n This also corresponds to truncation division by

[0080] Most of the blocks in the ciphertext multiplication and rotation modules are NTT, iNTT, CRT, iCRT, and BarrettModMult. All NTT and iNTT butterflies contain modular multiplication coupled with modular addition or subtraction. Furthermore, CRT and iCRT are primarily composed of multiplications and reductions, with the reductions also including multiplications. Thus, the ciphertext multiplication and rotation operations are dominated by the multiplication module. The only functions that do not involve multiplications are the bit shifts and ciphertext additions described above.

[0081] Based on a comparison of common large integer multipliers for cryptographic applications, we chose to implement the schoolbook multiplier as a shift-and-add array multiplier. The schoolbook multiplier is chosen because it provides a compromise between high operating frequency and low gate complexity, and therefore small area.

[0082] The schoolbook multiplier uses MUXes to compute all partial products in parallel, and then sums the partial products in an adder tree using adder modules, described below. The adder tree has log 2 Since n stages are required, where n is the bit size of the operands, the latency of each multiplication is proportional to the logarithm of the bit size of the operands. This proportional latency explains why the execution time of an RNS implementation of an individual operation is faster than the LAWS latency, because each 64-bit multiplication takes approximately 10 times longer than a 512-bit multiplication.

number

[0083] The modular addition and subtraction modules employ modified pipeline ripple carry adders and are reported to be capable of implementing large integer multiplications on Intel Arria 10 FPGAs fabricated using TSMC's 20 nm technology process. The reported design can compute additions or subtractions with a fixed latency of four cycles for operand bit widths ranging from 260 bits to 2,052 bits and perform 1,028-bit additions at a frequency of 554 MHz. Therefore, we assume that additions for designs with a minimum size of 64 bits and no more than 2,052 bits also have a fixed latency of four cycles. Modular additions are implemented by additions followed by conditional subtractions, and modular subtractions are implemented by subtractions followed by conditional additions. Thus, the overall latency of a modular addition or subtraction is nine cycles, as one cycle is required to evaluate the Boolean condition.

[0084] The modified pipeline ripple-carry adder also includes register duplication to ensure drive strength for large fan-out, which can cause signal propagation delays and ultimately timing violations. Because the multiplication module is primarily composed of addition modules, and the multiplication module is the basic building block for most of the other modules mentioned above, it is important to consider large fan-out in the addition module.

[0085] RNS implementations of each of the ciphertext addition, multiplication, and rotation operations using the above modules were designed using Verilog and simulated in Mentor Modelsim version 10.7c. Known-answer tests for each of these operations were then performed with known input ciphertexts, output ciphertexts, keys, and constants, and cycle counts for each module were recorded. Each individual block required for the LAWS implementation was simulated. And because all modules in the design have parameterizable input sizes and constant throughput, it is possible to determine the latency of the LAWS implementation for all constituent modules of the logistic regression inference benchmark.

[0086] A summary table comparing the performance of the RNS and LAWS implementations against the latency of each ciphertext function and the logistic regression inference execution time for a minimum DPRIVE of 1,024 points is included in Table 1. The results show that the overall logistic regression latency is dominated by ciphertext rotations, with the RNS implementation being only about 4% faster than the LAWS implementation. Both implementations achieve latencies that are over 1.1 times faster than the maximum execution time of 0.1 ms per inference specified by DPRIVE at an operating frequency of 600 MHz.

[0087] Since an FPGA manufactured using a 20 nm process can calculate a 1,028-bit addition in 4 cycles at a frequency of 554 MHz, an ASIC manufactured using a 7 nm or 5 nm CMOS technology process can perform a 1,024-bit addition in 4 cycles at a frequency of 600 MHz. Note that since the multiplication module is built only with a MUX and an addition module, the number of cycles for the multiplication can also be justified when justifying the number of cycles for the addition at the selected operating frequency.

[0088] The number of cycles for addition, multiplication, and rotation of the ciphertext in Table 1 indicates the number of cycles required to generate the first output coefficient. The total pipeline delay refers to the total number of cycles to generate the first output coefficient of the logistic regression inference model, and the total latency to process the ciphertext refers to the number of cycles until all coefficients are output. The operating frequencies were determined such that both the RNS and LAWS implementations met the DPRIVE target execution time considering the total execution cycles. The inferences per ciphertext are based on the batch size, i.e., the number of test set examples packed into each ciphertext, N=16,384, and the latency per inference refers to the amortized inference time at the listed operating frequencies. [Table 1]

[0089] The largest amount of eSRAM storage space for constants in both the RNS and LAWS implementations of the design is taken up by the roots of one and inverse roots of one in the NTT and iNTT modules. Each NTT and iNTT uses N different roots of one, which are accessed in a predefined pattern determined by the corresponding state machine address generator. However, unlike the modulus, which remains constant throughout the execution of the module, a single butterfly may need to access a different root of one in each cycle, so these roots of one cannot be stored in the register bank of each NTT and iNTT module. Therefore, the roots must be stored in a dedicated eSRAM block in each NTT and iNTT. However, because NTT and iNTT run in parallel and synchronously on multiple polynomials, the same roots and inverse roots are used in the same order in all parallel transformations. For example, in Figure 4A, all four transformations use the same roots of one delivered to the parallel butterflies during the same cycle, so a single eSRAM can be used to perform all four transformations.

number

number

number

number

[0090] Storing a single set of roots of 1 for synchronous transformations reduces the storage required for NTT and iNTT somewhat, but the size of N means that thousands of values ​​still need to be stored in internal memory. However, it is also possible to use "on-the-fly" root-of-1 generation. In this method, a subset of roots of 1 and inverse roots of 1 are stored on-chip, and all other roots are generated as modular products of the stored roots. Since the length of each multiplication is known in advance, it is relatively easy to ensure that all roots are generated in the required cycles, but the actual cost of on-the-fly root-of-1 generation is the number of extra modular multiplications, and therefore the number of extra transistors, required to generate the roots that are not stored. If N / n roots of 1 are stored in eSRAM, then computing the missing roots of 1 for each logN stage in the NTT or iNTT circuit requires n-1 successive modular multiplications, where n ≥ 1. We find that the optimal number of roots to store in eSRAM that minimizes the total core area for both RNS and LAWS design embodiments, including the area of ​​transistors for computing the missing roots, is N / 4. Thus, N / 4 roots and inverse roots are stored in eSRAM for each set of parallel NTTs or iNTTs.

[0091] Note that in the LAWS implementation of ciphertext multiplication, only two sets of roots of 1 and inverse roots of 1 are preserved. That is, only four sets of modular multipliers are needed to generate the missing roots and inverse roots. Furthermore, in the RNS implementation of ciphertext multiplication and rotation, only np and np key The set of roots and inverse roots of are stored, and np and np key A set of modular multipliers of log are used to compute the missing roots. Figure 12 also shows the modular multipliers used to generate the missing roots and inverse roots, on top of the eSRAM that stores the roots in the LAWS implementation. With the selected parameters, it takes log 2 Up to 3 multipliers are needed per N = 14 stage.

[0092] While our design is the simplest of the DPRIVE benchmarks and does not address the most complex module, bootstrap, it is worth remembering that performance is specified at an operating frequency of 600 MHz. The high-bandwidth memory (HBM) that can be used to feed the first input stage of the design, HBM2E, has a maximum operating frequency of 1.6 GHz, while the next generation of this technology, HBM3, will have an operating frequency of 4.2 GHz. If we assume that the external factor limiting the clock rate of the design is the ability to deliver the input ciphertext from HBM to the on-chip eSRAM, it would be possible to double the clock frequency of the design to 1.2 GHz, reducing the number of modules by about half to achieve the same performance in about half the stated area. For example, at 600 MHz, we use 10 ciphertext rotation tiles for the matrix-vector multiplication portion of the logistic regression, but at a clock frequency of 1.2 GHz, we can achieve the same performance with only 5 ciphertext rotation tiles, using each remaining tile twice as fast (assuming the arithmetic blocks do not impose rate limitations). However, doubling the clock rate saves less than half the total area since the area of ​​the ciphertext rotation tiles is halved but the eSRAM required to store the rotated keys is not reduced. The newly available area can be used to bootstrap tiles or additional memory required to implement the remaining two DPRIVE challenge application benchmarks. Additionally, doubling the clock frequency allows the supply voltage to be reduced while maintaining the required performance, thereby reducing the processor's power consumption.

[0093] Similarly, by employing HBM3 external memory, it is possible to increase the operating frequency to 4.2 GHz and obtain 7 times the prescribed performance without increasing the on-chip area (again, assuming that the computation block can support this operating frequency). Thus, by utilizing the available area or increasing the operating frequency and taking advantage of the opportunity of time-multiplexing modules, we demonstrate that not only can the logistic regression inference benchmark target be achieved with the proposed RNS or LAWS design embodiments using 7 nm or 5 nm CMOS technology processes, but also the targets of the convolutional neural network (CNN) inference and training DPRIVE benchmark can be met. Furthermore, since the ciphertext addition, ciphertext multiplication, and ciphertext rotation modules are functionally equivalent for different fully homomorphic encryption (FHE) mathematical foundations, and the ciphertext and key are also the same size for different mathematical foundations, the proposed RNS and LAWS embodiments are similarly valid for hardware accelerators supporting other arithmetic FHE schemes such as BGV and BFV. Furthermore, one skilled in the art will appreciate the direct relevance to accelerating the execution time of applications in areas such as secure search, labeled PSI, etc. We also believe that the proposed embodiments are valid for any future variations of the above schemes, or new schemes consisting of the above modular arithmetic operations, and are not limited to the arrangement of blocks in Figures 4A, 4B, 6A, 6B, 8A, 8B, 10A, and 10B, as long as they are deeply pipelined and have throughput matching the radix or parallelism of the NTT blocks.

[0094] In an efficiency comparison, a cryptographic processor using the RNS architecture to run a 1,024-point logistic regression benchmark that includes ciphertext addition, multiplication, and rotation modules achieves 192.6 times faster latency than an Intel Xeon Platinum 8175 processor with 128 GB of RAM running at 3.1 GHz (clock rate more than 5 times faster). Similarly, a cryptographic processor using the LAWS architecture to run the same 1,024-point logistic regression benchmark that includes ciphertext addition, multiplication, and rotation modules achieves 186.2 times faster latency than an Intel Xeon Platinum 8175 processor with 128 GB of RAM running at 3.1 GHz (clock rate more than 5 times faster) running at 600 MHz.

[0095] Those skilled in the art will appreciate that the above embodiments enable a fully pipelined ciphertext processing module for use in a cryptographic processor to achieve performance parameters for processing encrypted data operations that are comparable to processing parameters associated with unencrypted data processing operations.

[0096] Once received within a computer system via one or more computer readable media, such data and / or instruction based representations of the circuitry described above are processed by a processing entity (e.g., one or more processors) within the computer system in combination with the execution of one or more other computer programs, including, but not limited to, netlist generators, place-and-route programs, etc., to generate a physical representation or image of such circuitry. Such representation or image may then be used in device fabrication, for example, by enabling the generation of one or more masks that are used to form various components of the circuitry in the device fabrication process.

[0097] In the foregoing description and in the accompanying drawings, certain terms and drawing symbols are set forth to provide a thorough understanding of the present invention. In some cases, the terms and symbols may imply specific details that are not necessary for the practice of the invention. For example, any of the specific number of bits, widths of signal paths, signals or operating frequencies, component circuits or devices, etc. may differ from those described above in alternative embodiments. Also, interconnections between circuit elements or circuit blocks shown or described as multi-conductor signal links may instead be single-conductor signal links, and single-conductor signal links may instead be multi-conductor signal links. Signals and signal paths shown or described as single-ended may be differential, and vice versa. Similarly, signals described or depicted as having active high or active low logic levels may have the opposite logic levels in alternative embodiments. Component circuits within an integrated circuit device may be implemented using metal-oxide-semiconductor (MOS) technology, bipolar technology, or other technologies capable of implementing logic and analog circuits. In terms of terminology, a signal is said to be "asserted" when it is driven to a low or high logic state (or charged to a high logic state or discharged to a low logic state) to indicate a particular state. Conversely, a signal is said to be "deasserted" when it indicates that it has been driven (or charged or discharged) to a state other than the asserted state (including a high or low logic state, or a floating state that may occur when the signal driver circuit transitions to a high impedance state such as an open drain or open collector state). A signal driver circuit is said to "output" a signal to a signal receiver circuit when it asserts (or deasserts, if expressly stated or indicated by context) a signal on a signal line coupled between the signal driver circuit and the signal receiver circuit. The signal line is "activated" when a signal is asserted on the signal line and "deactivated" when the signal is deasserted. Additionally, the prefix symbol " / " on a signal name indicates that the signal is an active low signal (i.e., the asserted state is a logic low state). Drawing a line through the signal name

number

[0098] Although the present invention has been described in detail with reference to specific embodiments thereof, it will be apparent to those skilled in the art that various changes and modifications can be made therein without departing from the spirit and scope of the present invention. For example, features or aspects of any embodiment can be applied in combination with or in place of corresponding features or aspects of other embodiments, at least where practicable. The specification and drawings are therefore to be regarded in an illustrative rather than a restrictive sense.

Claims

1. 1. A cryptographic processor comprising: a first cryptographic processing module for performing a first logical operation, a first input circuit for receiving ciphertext input symbols; a first pipeline stage for performing a first operation on the ciphertext input symbols to generate a first stage output; a storage circuit for storing constants used in the first pipeline stage, the storage circuit temporarily storing the first stage output and supplying it to a second pipeline stage in a pipeline manner; the first cryptographic processing module including the second pipeline stage is configured to perform a second operation on the first stage output in a pipelined manner with respect to the first pipeline stage. The cryptographic processor.

2. the first input circuit receives the ciphertext input symbol synchronously with a command clock signal; a new set of input ciphertext symbols is presented to the first input circuit for each cycle of the instruction clock signal; The cryptographic processor of claim 1 .

3. the first cryptographic processing module is configured to perform a ciphertext multiplication operation, a ciphertext rotation operation, or a ciphertext addition operation. The cryptographic processor of claim 1 .

4. the storage circuit includes a bit-wide input interface for receiving at least one entire ciphertext or key coefficient every cycle of a system clock; The cryptographic processor of claim 1 .

5. At least one Chinese Remainder Theorem (CRT) processing stage The cryptographic processor of claim 1 further comprising:

6. the first cryptographic processing module is configured as a Residue Number System (RNS) architecture; The cryptographic processor of claim 5.

7. the first cryptographic processing module includes a plurality of processing slices defining a plurality of processing channels, each channel performing operations on signals up to 64 bits wide simultaneously with the other processing channels; The cryptographic processor of claim 6.

8. the first cryptographic processing module is configured as a large arithmetic word size (LAWS) architecture; The cryptographic processor of claim 1 .

9. the first cryptographic processing module includes a single processing slice defining a single processing channel for performing operations on signals greater than 64 bits wide; The cryptographic processor of claim 8.

10. a second processing module for performing a second logical operation different from the first logical operation; The cryptographic processor of claim 1 further comprising:

11. The memory circuit includes: an on-chip register circuit configured to temporarily store the input of each of said stages; The cryptographic processor of claim 1 .

12. the first cryptographic processing module generates an output with a predetermined latency of execution cycles and a constant throughput; The cryptographic processor of claim 1 .

13. the first pipeline stage includes a number theoretic transform (NTT) circuit stage for performing an NTT operation as the first operation, the NTT circuit stage being configured to exhibit a predetermined parallelism; the second pipeline stage is configured to use a number of inputs and outputs that match the predetermined parallelism of a stage of the NTT circuit; The cryptographic processor of claim 1 .

14. 1. A cryptographic processor comprising: a first cryptographic processing module, a first input circuit for receiving ciphertext input symbols; a number theoretic transform (NTT) stage configured to perform a number theoretic transform (NTT) stage on received ciphertext input symbols to generate NTT stage outputs, the NTT stage configured to exhibit a predetermined parallelism; a second circuit stage receiving the NTT stage output in a pipelined manner; the first cryptographic processing module including the second circuit stage is configured to use a number of inputs and outputs that match the predetermined parallelism of the NTT circuit. The cryptographic processor.

15. the first input circuit receives the ciphertext input symbols synchronously with a command clock signal; a new set of input ciphertext symbols is presented to the first input circuit for each cycle of the instruction clock signal; 15. The cryptographic processor of claim 14.

16. the first cryptographic processing module is configured to perform a ciphertext addition operation, a ciphertext multiplication operation, or a ciphertext rotation operation.

15. The cryptographic processor of claim 14.

17. the first cryptographic processing module is configured as a Residue Number System (RNS) architecture and includes a number of processing slices defining a number of processing channels, each channel performing operations on signals up to 64 bits wide simultaneously with the other processing channels; 15. The cryptographic processor of claim 14.

18. the first cryptographic processing module is configured as a large arithmetic word size (LAWS) architecture and includes a single processing slice defining a single processing channel for performing operations on signals greater than 64 bits wide; 15. The cryptographic processor of claim 14.

19. the first cryptographic processing module generates an output with a predetermined latency of execution cycles and a constant throughput; 15. The cryptographic processor of claim 14.

20. 1. A method of operation in a cryptographic processor, comprising: receiving a ciphertext input symbol at a first input circuit; performing a number theoretic transform (NTT) operation on the received ciphertext input symbols in an NTT stage to generate NTT stage outputs, the NTT stage configured to exhibit a predetermined parallelism; receiving the NTT stage output in a pipelined manner at a second pipeline stage; configuring the second pipeline stage to use a number of inputs and outputs that matches the predetermined parallelism of the NTT circuit; The method comprising:

Images