In-memory computation in homomorphic encryption systems

Abstract

In one approach, the process stores a matrix of multi-bit values ​​for computation in an analog multiply-accumulate unit having at least one crossbar array of binary analog memory cells connected between respective pairs of word lines and bit lines of the array, where: a bit of each multi-bit value is stored in a cell connected along a word line, and a corresponding bit of a value in a column of the matrix is ​​stored in a cell connected along a bit line. In each of one or more computation stages of the cryptographic element, the process provides a set of polynomial coefficients of the element bit-wise to respective word lines of the unit to obtain an analog accumulation signal on the respective bit lines. The process converts the analog signal to digital. The process processes a digital signal derived from successive bits of the polynomial coefficients in each of the stages to obtain a computation result of the cryptographic element.

Description

[Technical Field]

[0001] This invention relates generally to the field of computation in homomorphic encryption systems, and more particularly to techniques for performing computation in homomorphic encryption systems using in-memory computation architectures.

[0002] Homomorphic encryption allows for computations on encrypted data. Currently viable homomorphic encryption schemes use polynomials to represent the basic cryptographic elements, e.g., the encryption key, the ciphertext, the message data to be encrypted, etc. These polynomials are typically of very large order (e.g., 1024), and the polynomial coefficients are each represented by a large number of bits (e.g., 300-800). Computations on these elements must be performed with high precision and are extremely computationally intensive, e.g., O(N 2 The complexity of multiplication between two polynomials of degree N in O(NlogN) is very inefficient. To address this inefficiency, homomorphic encryption algorithms use the Fast Fourier Transform (FFT) to reduce the complexity of polynomial multiplication to O(NlogN). However, this still poses a significant computational constraint.

[0003] In-memory computing refers to a technique that utilizes an array of memory cells to perform specific computational tasks in-place in a computational memory unit. "Computing-in-Memory for Performance and Energy-Efficient Homomorphic Encryption," Reis et al., IEEE Transactions on Very Large Scale Integration (VLSI) Systems, Volume 28, Issue 11, November 2020, and "CryptoPIM: In-Memory Acceleration for Lattice-Based Cryptographic Hardware," Nejatollahi et al., 57th ACM / IEEE Design Automation Conference (DAC), July 2020, propose in-memory computing hardware for cryptographic computation. These proposals implement specific computations for cryptographic computations using an in-memory logic array in which binary logic is embedded in an array of memory cells. While these systems offer some improvement in terms of processing speed, improved techniques for implementing computations in homomorphic encryption systems are highly desirable. Summary of the Invention

[0004] A first aspect of the present invention provides a method of computation in a homomorphic cryptographic system in which cryptographic elements are represented by polynomials having multi-bit coefficients. The method includes storing a matrix of multi-bit values ​​for computation in an analog multiply-accumulate unit having at least one crossbar array of binary analog memory cells connected between respective pairs of word lines and bit lines of the array. Bits of each multi-bit value are stored in cells connected along word lines, and corresponding bits of values ​​in a column of the matrix are stored in cells connected along bit lines. In each of one or more computation stages for a cryptographic element, a set of polynomial coefficients for that element is supplied bit-wise to respective word lines of the unit, resulting in analog accumulation signals on the bit lines. The method further includes converting the analog accumulation signals to digital signals and processing the digital signals resulting from successive bits of the coefficients in each of the computation stages to obtain the computation result required for the cryptographic element.

[0005] By utilizing an analog multiply-accumulate unit for computations in which polynomial coefficients are fed bit-wise to an array of binary analog cells, methods embodying the present invention provide very fast computations for cryptographic elements with the high precision required for homomorphic encryption systems. Unlike the in-memory logic arrays referenced above, the results of bit-wise vector-matrix multiplications are accumulated on the bitlines of the array, significantly reducing the complexity and computation time of cryptographic computations.

[0006] Embodiments of the present invention provide efficient implementations of various computations in a homomorphic encryption system. One embodiment computes the result of a polynomial multiplication c1c2 between a first cryptographic element c1 and a second cryptographic element c2. The method includes storing the polynomial coefficients of element c2 as respective multi-bit values ​​in a matrix column in a multiply-accumulate unit. In successive computation stages, the coefficients of element c1 are gradually shifted relative to a set of word lines connected to cells storing coefficients of c2 until all coefficients of c1 are provided bit-wise to all word lines in that set. In each stage, digital signals obtained from the set of bit lines connected to cells storing coefficients of c2 and from successive bits of the coefficients of c1 are processed to obtain the result of the polynomial multiplication c1c2. Here, this result is typically computed as c1c2 modulo p, where p is a predetermined prime number for the homomorphic encryption system. This provides a particularly efficient technique for multiplying polynomial cryptographic elements. Furthermore, as described in more detail below, multiple polynomial multiplications can be performed in parallel in the multiply-accumulate unit.

[0007] Polynomial multiplication techniques can be particularly advantageously applied to homomorphic decryption, where the second cryptographic element c2 is element s of a homomorphic encryption system's private key (1, s), and the first cryptographic element c1 is an element of ciphertext (c0, c1) encrypted with the corresponding public key, where c0 is another cryptographic element. The method includes, after obtaining the result of the polynomial multiplication c1s, calculating the sum of c1s and element c0 to obtain the decryption of the ciphertext m = c0 + c1s modulo p. The private key s is relatively static, i.e., does not change frequently during system operation, and storing this element in the multiply-accumulate unit allows for rapid decryption of all input ciphertexts. Multiple ciphertexts can also be decrypted in parallel, thereby providing a highly efficient homomorphic decryption engine. Embodiments can also utilize a hybrid system, whereby the polynomial multiplication is performed in a multiply-accumulate unit and the sum c0 + c1s is calculated using an in-memory logic array.

[0008] Polynomial multiplication techniques can also be used to perform homomorphic inference on encrypted data, where the encrypted weights w of a neural network inference model are multiplied by the respective cryptographic elements c w contains each element c w The polynomial coefficients of are stored in the multiply-accumulate unit as respective multi-bit values ​​in the columns of a matrix. The encrypted data value d that is weighted and propagated through the network in the inference operation is weighted by a polynomial multiplication c d c w For each cryptographic element c that requires d Each polynomial multiplication in the inference operation c d c w can be performed as described above, where c d corresponds to the first cryptographic element c1, and c w corresponds to the second cryptographic element c2. All polynomial multiplications c d c w The results of are processed to obtain encrypted inference results from the model as the encrypted data values ​​are propagated through the network.

[0009] A further embodiment, detailed below, utilizes a discrete Fourier transform based technique to multiply cryptographic elements using an analog multiply-accumulate unit.

[0010] A second aspect of the present invention provides a computing device for a homomorphic encryption system in which cryptographic elements are represented by polynomials having multi-bit coefficients. The device comprises an analog multiply-accumulate unit having at least one crossbar array of binary analog memory cells connected between each pair of word lines and bit lines of the array, and control logic adapted to implement the computing method according to the first aspect of the invention. The control logic may comprise (log2q)-bit analog-to-digital converter circuitry for converting the analog accumulation signal into a digital signal, where q is the number of word lines supplied with the polynomial coefficients.

[0011] Embodiments of the invention are described in more detail below, by way of illustrative and non-limiting examples, with reference to the accompanying drawings, in which: [Brief explanation of the drawings]

[0012] [Figure 1] 1 is a schematic diagram of a computing device according to an embodiment of the present invention;

[0013] [Figure 2] 2 illustrates the structure of an array of analog memory cells for storing a matrix of multi-bit values ​​in the device of FIG. 1 according to one embodiment of the present invention.

[0014] [Figure 3] 2 illustrates steps of a calculation performed on a cryptographic element by the apparatus of FIG. 1 according to one embodiment of the present invention.

[0015] [Figure 4] 3 shows an example of an analog memory cell in the array of FIG. 2 according to one embodiment of the present invention.

[0016] [Figure 5] FIG. 2 illustrates the processing of digital signals derived from analog accumulation signals on the bit lines of the array, according to one embodiment of the present invention.

[0017] [Figure 6] FIG. 1 illustrates parallel processing of digital signals from columns of a matrix in an array according to one embodiment of the present invention.

[0018] [Figure 7] FIG. 2 illustrates a calculation performed on two arrays of cryptographic elements, according to one embodiment of the present invention.

[0019] [Figure 8] FIG. 2 illustrates a multi-stage computation of a cryptographic element polynomial multiplication according to one embodiment of the present invention.

[0020] [Figure 9] 9 illustrates exemplary stages of the calculation of FIG. 8 according to one embodiment of the present invention.

[0021] [Figure 10] FIG. 1 illustrates the structure of an in-memory logic array for additional computations, according to one embodiment of the present invention.

[0022] [Figure 11] FIG. 1 is a schematic diagram of network layers in a neural network inference model, according to one embodiment of the present invention.

[0023] [Figure 12] FIG. 1 illustrates a computational implementation of a homomorphic inference operation, according to one embodiment of the present invention.

[0024] [Figure 13] FIG. 2 illustrates polynomial multiplication of cryptographic elements according to one embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0025] Embodiments of the present invention may be utilized in any homomorphic encryption (HEnc) system in which computations are performed on cryptographic elements represented by polynomials. The cryptographic elements may be any polynomial elements of the HEnc scheme on which computations need to be performed, such as elements of encryption keys, ciphertext, message data, etc. For example, in a HEnc scheme based on the Ring Learning with Errors (RLWE) problem, the cryptographic elements are represented by polynomials that are elements of a finite polynomial ring. For example,

number

[0026] FIG. 1 is a schematic block diagram of a computing device 1 embodying an embodiment of the present invention for performing computations in a HEnc system. Device 1 includes an analog multiply-accumulate (MAC) unit 2 having a set of crossbar array 3 of binary analog memory cells. Control logic, here implemented by a MAC controller 4 and a digital processor 5, controls the operation of crossbar array 3 to perform computations for cryptographic elements represented by polynomials with multi-bit coefficients. Digital processor 5 is operatively coupled to analog MAC unit 2, here via a system bus 6. The digital processor includes a central processing unit (CPU) 7 and digital memory 8. Digital memory 8 stores one or more program modules 9 having program instructions executable by CPU 7 to implement functions for controlling cryptographic computations of the HEnc system. Depending on the HEnc system utilizing device 1, such program modules may implement, for example, stages of a cryptographic algorithm for encryption and / or decryption of data via the HEnc scheme and / or computations for cryptographic elements in applications based on the HEnc scheme, using MAC unit 2 for at least some stages of these computations.

[0027] MAC controller 4 provides control circuitry for controlling the application of signals to crossbar array 3 to store data values ​​in the cells of the array, for applying signals for computation within the array, and for processing signals output by the array as will be described in more detail below. Although multiple crossbar arrays 3 are shown in Figure 1, in general MAC unit 2 can have one or more crossbar arrays.

[0028] While FIG. 1 illustrates an exemplary embodiment of device 1, digital processor 5 may include one or more CPUs (including graphics processing units (GPUs)), which may be implemented by one or more microprocessors. Memory 8 may include one or more data storage entities, including main memory, e.g., dynamic random-access memory (DRAM) and / or other storage physically separate from CPU 7, as well as cache and / or other memory local to CPU 7. Generally, digital processor 5 may be implemented by one or more (general-purpose or special-purpose) computer / programmable data processing devices, and the stages of the processing operations performed by the digital processor may be implemented by hardware or software or a combination thereof. MAC controller 4 may include one or more processors configurable by hardwired logic and / or software instructions to perform control operations in MAC unit 2. Digital processor 5 may, in some embodiments, be integrated with MAC unit 2, e.g., in a system-on-chip (SoC) design.

[0029] In some embodiments, the digital processor 5 and / or MAC controller 4 may include electronic circuitry, such as programmable logic circuitry, a field-programmable gate array (FPGA), or a programmable logic array (PLA), that executes program instructions to implement the described functions. The program instructions / program modules may include routines, programs, objects, components, logic, data structures, etc. that perform particular tasks or implement particular abstract data types. The digital processor 5 and / or MAC controller 4 may also include dedicated hardware-based systems, such as application-specific integrated circuits (ASICs), to implement particular functions.

[0030] The system bus 6 represents any one or more of several types of bus structures, including a memory bus or memory controller, a peripheral bus, an accelerated graphics port, and a processor or local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA) local bus, and a Peripheral Component Interconnect (PCI) bus. In some embodiments, the system bus 6 may represent a communications network connecting the digital processor 5 to subunits of the MAC controller 4 that control individual crossbar arrays or subsets of the arrays.

[0031] To perform a calculation in device 1, a matrix M of multi-bit values ​​for the calculation is stored in one or more crossbar arrays 3 of MAC unit 2. FIG. 2 illustrates the logical structure of crossbar array 3. It includes an array of binary analog memory cells 10 connected between respective pairs of word lines and bit lines, as shown. Each memory cell 10 includes an analog memory device that stores a binary state of 0 or 1, corresponding to one bit of the multi-bit value stored in the cells 10. The bit of each multi-bit value in matrix M is stored in a cell connected along a word line. Corresponding bits of the multi-bit values ​​in a column of M are stored in cells connected along bit lines. In the illustrated example, an n×m matrix M of b-bit values ​​is stored in cells 10 connected between n word lines and m×b bit lines of a single array 3. The m b-bit values ​​in a row of M are stored in m sets of b cells connected along word lines. Corresponding bits of the n b-bit values ​​in column M are stored in cells connected along bit lines. Digital signals input to array 3 for computation are converted to analog signals that are applied to the word lines by digital-to-analog converter (DAC) circuitry 11. The resulting analog signals available on the bit lines are converted to digital signals by analog-to-digital converter (ADC) circuitry 12 for further processing.

[0032] 2 shows matrix M having multiple columns, in general, matrix M for computation may have m > 1 columns of multi-bit values. Also, although in this example the matrix is ​​stored in a single array 3, matrix M may be stored in multiple arrays, as described below.

[0033] FIG. 3 illustrates the basic steps of the computation process in device 1. Step 15 represents the storage of matrix M for computation in one or more arrays of MAC units 2 described above. In step 16, a set of polynomial coefficients for a cryptographic element is provided bit-wise (i.e., bit by bit) to each word line of the unit. As each bit of the input coefficient is provided to a word line, an analog accumulation signal is obtained on the bit line at the input to ADC 12. In particular, the input bit value provided to a word line is effectively multiplied (in the analog domain) by the bit value stored in the cell 10 connected to that word line, providing either a current or no current from that cell on the connected bit line, corresponding to a multiplication result of 1 or 0, respectively. Contributions from all cells on a given bit line provide an analog accumulation signal at the output of that bit line. This represents the accumulation of multiplication results from all cells on the bit line, and therefore represents the result of multiplying a vector of input bits on the word line by a vector of bits stored in cells connected to that bit line. This is done in parallel for all bit lines, thereby performing a bit-wise vector-matrix multiplication. As shown in step 17, the analog accumulated signals available on all bit lines for successive bits of the input coefficients are converted to digital accumulated signals by ADC 12. Steps 16 and 17 may be repeated for each of multiple stages of the calculation, as described further below. In step 18, the resulting digital signals obtained from successive bits of the input coefficients in each of the calculation stage(s) are processed to obtain the calculation results required for the cryptographic element. This processing may be performed in one or a combination of MAC controller 4 and digital processor 5. In step 19, the calculation results may then be stored in MAC controller 4 or digital memory 8 for use in further cryptographic calculations and / or output by digital processor 5 as the final calculation results of the cryptographic process.

[0034] The analog memory cells 10 of the MAC unit 2 can be implemented by nonvolatile or persistent memory cells, including any of a variety of resistance- or charge-based memory devices, where analog computation is based on the use of current or charge, respectively. For example, charge-based memory devices include DRAM, SRAM (Random-Access Memory), and flash memory devices, while resistance-based devices include PCM (Phase-Change Memory), RRAM (Resistive Random-Access Memory), and STT-MRAM (Spin-Transfer Torque Magnetic Random-Access Memory). Input signals are applied as voltages on the word lines, and depending on the cell type, vector-matrix multiplication is performed using the physical structure of the array via a combination of Ohm's law or Coulomb's law and Kirchhoff's circuit laws. Results are derived from the net analog current or voltage read through the bit line ADC. The MAC control circuitry that stores values ​​within the cells 10 and drives the cells during array computations can be implemented in known manner according to the particular implementation of the analog cell.

[0035] In some embodiments of device 1, analog cell 10 comprises an analog SRAM cell. An example of an analog SRAM cell is shown in FIG. 4. Analog cell 10 comprises a standard digital SRAM cell 20 connected between a word line WL and a bit line BL via circuitry including capacitor C and switches s1, s2, and s3 as shown. Digital SRAM cell 20 stores one bit of the multi-bit value described above. In a first phase of array operation, switch s1 is closed and an input signal corresponding to an input bit value of 0 or 1 is applied to word line WL. Capacitor C is charged or left uncharged depending on whether the input bit is 1 or 0. Switch s2 is then closed, thereby discharging capacitor C if cell 20 stores a bit value of 0. Finally, switch s3 is closed, shorting out the capacitors of all cells along bit line BL, thereby generating a final voltage on the bit line corresponding to the accumulation result through charge sharing.

[0036] If values ​​in more than one column of matrix M are stored in array 3, the digital accumulation signals are processed column by column. In some embodiments, MAC controller 4 has processing logic that processes the digital signals obtained from each column of the matrix. For each bit of a coefficient supplied bit-wise to a word line, this processing logic accumulates digital signals obtained from a set of bit lines connected to cells that store values ​​in the columns of the matrix, with successive bit shifts corresponding to successive bit positions of these values. The resulting digital signals for successive input bits of a coefficient are also accumulated with successive bit shifts corresponding to successive bit positions of the coefficient. Figure 5 shows the implementation and operation of this processing logic for a simplified example.

[0037] The processing logic of Figure 5 is implemented by hardwired digital logic 25 around array 3. In this simple example, input cryptographic element c1 is represented by a polynomial coefficient vector (0,1,3,2) having four 2-bit coefficients. The illustrated portion of the array stores M column vectors (3,6,2,1) having four 3-bit values. The coefficients of c1 are supplied bit-wise, LSB-first, to respective word lines. ADC 12 is a log2q-bit ADC, where q is the number of word lines to which the coefficients are supplied, where q=4. The resulting digital signal from each bit line represents the result of multiplying the vector of LSBs of the input coefficients by the vector of bits stored in the cells connected to that bit line. These signals are supplied to digital logic 25 and processed at least as shown in the input LSB section of logic block 25. The digital signals input to this section have decimal values ​​(1, 2, 0) in the order of the value's bit position in the array from most significant bit (MSB) to least significant bit (LSB). These signals are scaled by the bit shifts corresponding to these bit positions as shown, resulting in values ​​(1 x 2 2 ,2×2 1 ,0×2 0 )=(4,4,0). The shifted signals are accumulated to obtain a binary signal with a decimal value of 8. The MSB of the input coefficient is then fed into the array, and the result is processed by at least the same logic as shown in the Input MSB section of block 25. An additional bit shift corresponding to the MSB position of the input coefficient is applied to the sum of the signal value (0,2,1)=3 (binary 11), resulting in binary 110=6. The results from both bits of the input coefficient are then added together as needed to obtain the dot product result (0,1,3,2)·(3,6,2,1)=14.

[0038] While the above example is simple, the same principles can be applied to large polynomial coefficient vectors of real cryptographic elements and stored b-bit values ​​having large numbers of bits. As shown in Figure 6, digital logic 25 can be associated with each of multiple columns of values ​​in array 3, allowing bitwise vector-matrix multiplication to be performed in parallel.

[0039] If the matrix M or coefficient vector processed in the MAC unit is larger than the size of a single array, the matrix M or coefficient vector can be mapped to multiple arrays, and the multiplication results from these arrays can be combined to generate the final result. Figure 7 illustrates this technique for an example in which calculations are performed on two arrays A1 and A2. In some embodiments, the rows of M can also be distributed across multiple arrays.

[0040] The above technique allows vector-matrix multiplication for cryptographic computations to be performed in O(1) time complexity. The decision boundary in the ADC 12 can be adjusted to accommodate offsets from non-idealities in the array or analog memory cells. The use of analog SRAM cells 10 simplifies this task by reducing the variability in the 1 and 0 states of the cells. Bit-wise operations therefore allow computations to be performed with the bit-level accuracy required for HEnc systems.

[0041] Some embodiments utilize a technique for computing the result of a polynomial multiplication c1c2 between a first cryptographic element c1 and a second cryptographic element c2. This technique is illustrated in FIG. 8, where the n coefficients of element c2 are stored in MAC unit 2 (in this example, in a single array 3) as respective multi-bit values ​​in the columns of a matrix M. In each successive stage of computation, a set of c1 coefficients is provided to the array, with the number of coefficients in these sets gradually increasing and then decreasing across successive stages. In particular, as shown in the figure, MAC controller 4 routes the coefficients of element c1 to a set of word lines (here WL1 through WL2) connected to the cells storing the coefficients of c2, until all coefficients of c1 have been bit-wise provided to all word lines in that set. n ) in a stepwise manner. In each of the calculation stages, the digital signals obtained from the set of bit lines connected to the cells storing the coefficients of c2 and from successive bits of the coefficients of c1 are then processed as described above to obtain the result of the polynomial multiplication c1c2. The operation of this technique can be understood from the following simple example.

[0042] c1=(ax 2 +bx) and c2=(cx 2 +dx), consider a simple polynomial multiplication c1c2:

number

[0043] FIG. 9 shows three successive computation stages of the technique of FIG. 8 that output the required coefficients of the resulting polynomial c3 = c1c2. This provides a particularly efficient technique for high-precision multiplication of polynomial cryptographic elements. When polynomial multiplication modulo p is required, as is typically required in HEnc systems, modulo arithmetic can be applied in the digital processing to obtain c3 = c1c2 modulo p. The modulo arithmetic can be performed in known manner in the logic of the MAC controller 4 (e.g., by additional modulo circuitry in the digital logic 25) and / or in the digital processor 5, if necessary. The digital processing can also include a re-linearization operation to obtain the polynomial c3 = c1c2 of the same degree as c1 and c2. Re-linearization can be achieved using a variety of standard techniques for homomorphic encryption applications that will be apparent to those skilled in the art.

[0044] One or more further polynomial multiplications c1c are performed on the word lines WL1 to WL n 8 can be performed in parallel by storing the coefficients of the cryptographic element c in a further column of M in cells connected to the same set of M. The digital signals obtained from the corresponding bit lines are then processed as described above.

[0045] The technique described in Figure 8 can be particularly advantageously applied to homomorphic decryption, where the second cryptographic element c2 is element s of the private key (1, s) of a homomorphic encryption system, and the first cryptographic element c1 is an element of the ciphertext (c0, c1) encrypted with the corresponding public key, where c0 is another cryptographic element, as described in more detail below.

[0046] Let (1,s) be the secret key for RLWE-based homomorphic encryption;

[0047]

number

number

number

[0048] Encode the plaintext message into a polynomial m;

[0049] Let (e0, e1) be the randomly generated noise polynomial; and

[0050]

number

[0051] The message m can then be recovered as c0 + c1s mod p through a decryption process. In a decryption system utilizing the technique of Figure 8, the secret key s is stored within MAC unit 2, and the coefficient of element c1 is fed into the unit to obtain the result of polynomial multiplication c1s. The sum of c1s and element c0 can then be calculated to obtain the decryption of the ciphertext m = c0 + c1s modulo p. This provides a highly efficient homomorphic decryption engine that can decrypt one or more input ciphertexts through parallel computation in the MAC unit.

[0052] While the sum c0+c1s can be calculated in digital processor 5, some embodiments may utilize a hybrid in-memory calculation system in MAC unit 2, where polynomial multiplication c1s is performed in MAC unit 2 as described above, and the sum c0+c1s is calculated using an in-memory logic array. The in-memory logic can be implemented using known SRAM arrays, an example of which will be briefly described with reference to FIG. 10. The coefficients from the two polynomials to be added are stored in two word lines WL i and WL j, but share the same bit lines as in Figure 10. By enabling two word lines together, a modified sense amplifier (SA) can compute NOR and AND operations between the bit lines. Performing a NOR on two SAs from a bit line results in an XOR between two bits. The XOR and AND together form a half-adder circuit. The results of the half-adders from multiple bit lines can be combined by a ripple-carry adder to perform the addition of polynomial coefficients.

[0053] The technique of Figure 8 can, of course, be applied to any computation of the HEnc scheme, e.g., polynomial multiplication required in key generation and / or encryption operations. Hybrid embodiments can also use known in-memory logic units for operations other than addition, e.g., subtraction, scaling, and / or component-wise multiplication of cryptographic elements. For example, the logic of Figure 10 can be used for subtraction by using the two's complement of one of the coefficients of the polynomial.

[0054] The technique described in FIG. 8 can also be used to implement a homomorphic inference system for encrypted data. In particular, the weights of a neural network inference model can be encrypted as cryptographic elements of the HEnc scheme and stored in MAC unit 2. Neural network (NN) models utilize a logical structure in which a series of layers of neurons are interconnected such that the output signals of neurons in one layer are weighted and transmitted to neurons in the next layer. By exposing the network to a set of training data, the NN model can be trained in a known manner to perform inference (e.g., classification or regression operations) on the input data, e.g., classifying digital images according to their image content. The resulting trained network, with weights defined via the training operation, can be applied to new (previously unseen) data to perform the inference task for the application in question.

[0055] Figure 11 shows a simple schematic diagram of an exemplary NN model 30 showing the connections in the first network layer. The neurons at the layer input are n i (i=1~K), and the neurons in the layer output are n j (j=1~L) for each neuron n i is the number of neurons n j is connected to the weight w ij is defined for each inter-neuron connection. i The input data value d supplied to i is the corresponding weight of a neuron pair, w ij After weighting by, each neuron n j Each neuron n j is the neuron n i The neurons in the output layer generate activation signals in response to accumulated weighted inputs from the network. The weighted signals can thus be propagated through successive layers of the network, whereby neurons in the output layer provide inferential results from the network.

[0056] In the HEnc inference system, inference is performed on data values ​​encrypted by the HEnc scheme. The parameters of the NN model (weights, activation functions, etc.) are also encrypted via the HEnc scheme. In particular, in the homomorphic inference system using the technique of Figure 8, the encrypted weights w of the NN inference model are encrypted by the respective encryption elements c w and each element c w The coefficients of are stored in MAC unit 2 as respective multi-bit values ​​in the columns of matrix M. The encrypted data value d that is weighted in the inference operation and propagated through the network is multiplied by a polynomial c to weight the data value d by a weight w. d c w Each cryptographic element c that requires d Each polynomial multiplication in the inference operation is d c w can be performed as described with reference to Figure 8, where c d corresponds to the first cryptographic element c1, and cw corresponds to the second cryptographic element c2.

[0057] Figure 12 shows how polynomial multiplications on input data values ​​d1 and d2 in NN model 30 can be mapped to arrays A1 and A2 and computed via the techniques disclosed with reference to Figure 8. Each encrypted data value d = d1 or d2 is assigned multiple weights w for propagation through the network. j = 1~L must be weighted by the corresponding multiple polynomial multiplication

number

number

number

number

[0058] Another embodiment of device 1 utilizes the Discrete Fourier Transform to multiply cryptographic elements using an analog multiply-accumulate unit. Figure 13 shows a schematic of the operation of this embodiment to compute a polynomial multiplication c1c2 of cryptographic elements c1 and c2, each having n polynomial coefficients. In this embodiment, a matrix of multi-bit values ​​is i,j =k i×j An (integer) value e given modulo p i,j , i=0~(n-1), j=0~(n-1), where k N= 1 modulo p, N≧n. Additionally, an inverse discrete Fourier transform matrix M2 corresponding to M1 is stored as a further matrix of multi-bit (integer) values ​​in at least one further crossbar array of the MAC unit. The n coefficients of element c1 are supplied bit-wise to respective word lines connected to cells storing values ​​in M1. Digital signals resulting from successive bits of the coefficients are processed to obtain the discrete Fourier transform T(c1) of the coefficients of element c1. Similarly, the n coefficients of element c2 are supplied bit-wise to respective word lines connected to cells storing values ​​in M1, and the resulting digital signals from successive bits of the coefficients are processed to obtain the discrete Fourier transform T(c2) of the coefficients of element c2. Digital processor 5 then performs component-wise multiplication of corresponding components of T(c1) and T(c2) to obtain the discrete Fourier transform T(c3) of the coefficients of cryptographic element c3. The components of T(c3) are then supplied bit-wise to respective word lines connected to cells storing values ​​in M2. The resulting analog accumulated signal on the bit lines is converted to a digital signal and processed as before to obtain the result of the polynomial multiplication c3 = c1c2. This result may be modulo p obtained as described above. The component-wise multiplication in digital processor 5 may be calculated by in-memory logic in other embodiments.

[0059] It can be seen that the above embodiment provides highly efficient computation for cryptographic elements in a HEnc system. However, various alternatives and modifications can be made to the described embodiment. By way of example, the described processing operations may be allocated differently between the MAC controller 4 and the digital processor 5. An embodiment can be envisioned in which the coefficients are input into the MAC array MSB first. The memory cells 10 can also be implemented using types of cells other than SRAM cells.

[0060] In general, where features are described herein with reference to a method embodying the invention, corresponding features may also be provided in an apparatus / system embodying the invention, and vice versa. Steps in the flow diagrams may be performed in a different order than that shown, and some steps may be performed in parallel where appropriate.

[0061] The present invention may be a system, method and / or computer program product integrated at any possible level of technical detail. The computer program product may include a computer-readable storage medium (or media) having computer-readable program instructions that cause a processor to perform aspects of the present invention.

[0062] A computer-readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. The computer-readable storage medium may be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes portable computer diskettes, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves on which instructions are recorded, and any suitable combination thereof. As used herein, computer-readable storage media should not be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over wires.

[0063] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium into each computing / processing device, or may be downloaded to an external computer or external storage device over a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network may comprise copper transmission cables, optical transmission fiber, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and transfers the computer-readable program instructions for storage in a computer-readable storage medium in the respective computing / processing device.

[0064] The computer-readable program instructions for carrying out the operations of the present invention may be assembler instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, configuration data for an integrated circuit, or source or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk® or C++, and procedural programming languages ​​such as the “C” programming language or similar programming languages. The computer-readable program instructions may run entirely on the user's computer, as a standalone software package, partially on the user's computer, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA) may execute computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry to perform aspects of the present invention.

[0065] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0066] These computer-readable program instructions may be provided to a processor of a computer or other programmable data processing apparatus to produce a machine, whereby the instructions, executed by the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may also be stored on a computer-readable storage medium that can instruct a computer, programmable data processing apparatus and / or other device to function in a particular manner, whereby the computer-readable storage medium having instructions stored therein has an article of manufacture including instructions that implement aspects of the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0067] The computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be executed on the computer, other programmable apparatus, or other device to generate a computer-implemented process, whereby the instructions executing on the computer, other programmable apparatus, or other device implement the functions / acts specified in one or more blocks of the flowcharts and / or block diagrams.

[0068] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, including one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions noted in the blocks may occur out of the order noted in the figures. For example, two blocks shown in succession may actually be realized as a single step, executed concurrently, substantially concurrently, partially, or fully in an overlapping manner, or the blocks may possibly be executed in reverse order depending on the functionality involved. It should also be noted that each block of the block diagrams and / or flowchart diagrams, and combinations of blocks in the block diagrams and / or flowchart diagrams, may be implemented by a dedicated hardware-based system that performs the specified functions or operations, or executes a combination of dedicated hardware and computer instructions.

[0069] The description of various embodiments of the present invention has been presented for purposes of illustration, but is not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope of the present invention. The terms used herein have been selected to best explain the principles of the embodiments, practical applications, or technical improvements over technologies found in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. storing a matrix of multi-bit values ​​for calculation in an analog multiply-accumulate unit having at least one crossbar array of binary analog memory cells connected between respective pairs of word lines and bit lines of the at least one crossbar array, wherein: The bits of each multi-bit value are stored in cells connected along word lines; and Corresponding bits of values ​​in columns of said matrix are stored in cells connected along bit lines; in each of one or more computation stages of a cryptographic element, bit-wise supplying a set of polynomial coefficients of the element to respective word lines of said analog multiply-accumulate unit to obtain analog accumulation signals on respective bit lines; converting the analog accumulated signal to a digital signal; and processing the digital signals derived from successive bits of the polynomial coefficients in each of the one or more calculation stages to obtain a calculation result of the cryptographic element; A computer-implemented method comprising:

2. for each bit of the polynomial coefficient supplied bitwise to the word lines, accumulating the digital signals obtained from a set of bit lines connected to cells storing values ​​in a column of the matrix with successive bit shifts corresponding to successive bit positions of the value; and accumulating said digital signal of said successive bits of said polynomial coefficients with successive bit shifts corresponding to successive bit positions of said polynomial coefficients. The computer-implemented method of claim 1 further comprising:

3. First cryptographic element c １ The calculation result of the polynomial multiplication c １ c ２ The result is ２ is the second cryptographic element, The second cryptographic element c ２ storing the polynomial coefficients of the matrix in the analog multiply-accumulate unit as respective multi-bit values ​​in a first column of the matrix; In successive calculation stages, the element c １ The polynomial coefficients of ２ For a set of word lines connected to cells storing coefficients of １ gradually shifting the coefficients until they are bit-wise supplied to the word lines in the set of word lines; and In each of the calculation stages, c ２ from the set of bit lines connected to cells storing the coefficients of １ processing the digital signal obtained from successive bits of the coefficients of １ c ２ obtaining said result of The computer-implemented method of claim 1 further comprising:

4. The digital signal is processed to obtain the polynomial multiplication c １ c ２ The result of c １ c ２ Obtaining modulo p, where p is a predetermined prime number of the homomorphic encryption system. The computer-implemented method of claim 3 further comprising:

5. For at least one further cryptographic element c: storing the polynomial coefficients of element c as respective multi-bit values ​​in further columns of the matrix in cells connected to the set of word lines; and In each of the calculation stages, from the set of bit lines connected to cells storing the polynomial coefficients of c, １ , processing the digital signal obtained from successive bits of the coefficients of １ obtaining further results of c. The computer-implemented method of claim 3 further comprising:

6. The second cryptographic element c ２ is element s of the secret key (1, s) of the homomorphic encryption system; The first cryptographic element c １ is the ciphertext (c ０ , c １ ) element; c ０ is another cryptographic element; Polynomial multiplication c １ After obtaining the result of s, １ s and c ０ The sum of m and c is calculated to decrypt the ciphertext. ０ +c １ The computer-implemented method of claim 3 , further comprising obtaining s modulo p, where p is a predetermined prime number of the homomorphic encryption system.

7. calculating the sum in an in-memory logic array The computer-implemented method of claim 6 further comprising:

8. The encrypted weights w of the neural network inference model are ｗ and each element c ｗ are stored in the analog multiply-accumulate unit as respective multi-bit values ​​in columns of the matrix; The encrypted data value d that is weighted and propagated through the neural network in the inference operation is multiplied by a polynomial c to weight the data value d by a weight w. ｄ c ｗ Each cryptographic element c that requires ｄ having In the inference operation, each polynomial multiplication c ｄ c ｗ where c ｄ is the first cryptographic element c １ corresponds to c ｗ is the second cryptographic element c ２ Corresponding to; When the encrypted data value is propagated through the neural network, polynomial multiplication c ｄ c ｗ processing the results of step 1 to obtain encrypted inference results from the inference model. The computer-implemented method of claim 3 further comprising:

9. A plurality of weights w for propagation through the neural network ｊ＝１～Ｌ For the encrypted data values ​​d weighted by [Equation 1] Each element requires [Equation 2] The coefficients of the elements [Equation 3] stored in each column of said matrix in cells connected to a common set of word lines for Polynomial Multiplication [Equation 4] The result of the above is the element c ｄ The coefficient of c for that set of word lines ｄ is obtained by gradually shifting the coefficients of 9. The computer-implemented method of claim 8.

10. a first cryptographic element c each having n polynomial coefficients; １ and the second cryptographic element c ２ Polynomial multiplication of c １ c ２ where the matrix of multi-bit values ​​is e ｉ，ｊ = k ｉ×ｊ The value e given by modulo p ｉ，ｊ , i=0 to (n-1), j=0 to (n-1) １ where k Ｎ = 1 modulo p, N ≥ n, where p is a predetermined prime number of the homomorphic encryption system; M １ The inverse discrete Fourier transform matrix M corresponding to ２ storing the multiply-accumulate unit (1) as a further matrix of multi-bit values ​​in a further crossbar array of the analog multiply-accumulate unit; element c １ The n coefficients of M １ and processing the digital signals obtained from successive bits of the coefficients to obtain the element c １ The discrete Fourier transform T(c １ ) obtaining the element c ２ The n coefficients of M １ and processing the digital signals obtained from successive bits of the coefficients to obtain the element c ２ The discrete Fourier transform T(c ２ ) obtaining the T(c １ ) and T(c ２ ) to obtain the cryptographic element c ３ Another discrete Fourier transform T(c ３ ) and T(c ３ ) by using M ２ to obtain analog accumulated signals on the bit lines, converting the analog accumulated signals to digital signals, and processing the digital signals obtained from successive bits of the components to obtain the polynomial multiplication result c ３ = c １ c ２ The stage of obtaining The computer-implemented method of claim 1 , further comprising:

11. The digital signal is processed to obtain the polynomial multiplication c １ c ２ The result of c １ c ２ and obtaining modulo p, where p is a predetermined prime number of the homomorphic encryption system. The computer-implemented method of claim 10.

12. performing operations selected from the group consisting of (i) addition, (ii) subtraction, (iii) scaling, and (iv) component-wise multiplication of the cryptographic elements required for said calculation using an in-memory logic array; The computer-implemented method of claim 1 further comprising:

13. The computer-implemented method of claim 1 , wherein the binary analog memory cells comprise analog static random access memory (SRAM) cells.

14. A computer system comprising:

1. A homomorphic encryption system, comprising: a cryptographic element represented by a polynomial having multi-bit coefficients; an analog multiply-accumulate unit having at least one crossbar array of binary analog memory cells connected between respective pairs of word lines and bit lines of the at least one crossbar array; one or more computer-readable storage media; and program instructions collectively stored on the one or more computer-readable storage media for execution, the program instructions, when executed by the computer system, causing the computer system to: program instructions for causing an analog multiply-accumulate unit having at least one crossbar array of binary analog memory cells connected between respective pairs of word lines and bit lines of said at least one crossbar array to store a matrix of multi-bit values ​​for calculation, wherein: The bits of each multi-bit value are stored in cells connected along word lines; and Corresponding bits of values ​​in a column of said matrix are stored in cells connected along bit lines; program instructions for causing, in each of one or more computation stages of a cryptographic element, a set of polynomial coefficients of the element to be bit-wise supplied to respective word lines of said analog multiply-accumulate unit to obtain analog accumulation signals on respective bit lines; program instructions for converting the analog accumulated signal to a digital signal; and program instructions for processing the digital signals derived from successive bits of the polynomial coefficients in each of the one or more calculation stages to obtain a calculation result of the cryptographic element; 2. A computer system comprising:

15. The program instructions, when executed by the computer system, cause the computer system to: program instructions for, for each bit of the polynomial coefficient provided bit-wise to the word lines, accumulating the digital signals obtained from a set of bit lines connected to cells storing values ​​in a column of the matrix with successive bit shifts corresponding to successive bit positions of the value; and program instructions for accumulating the digital signal of the successive bits of the polynomial coefficients with successive bit shifts corresponding to successive bit positions of the polynomial coefficients; 15. The computer system of claim 14, further comprising:

16. First cryptographic element c １ The calculation result of the polynomial multiplication c １ c ２ The result is ２ is the second cryptographic element, The program instructions, when executed by the computer system, cause the computer system to: The second cryptographic element c ２ in the analog multiply-accumulate unit as respective multi-bit values ​​in a first column of the matrix; In successive calculation stages, the element c １ The polynomial coefficients of c ２ For a set of word lines connected to cells storing coefficients of １ program instructions for gradually shifting the coefficients until they are bit-wise supplied to the word lines in the set of word lines; and In each of the calculation stages, c ２ from the set of bit lines connected to cells storing the coefficients of １ The digital signal obtained from the successive bits of the coefficients of １ c ２ program instructions that cause said result to be obtained 15. The computer system of claim 14, further comprising:

17. The digital signal is processed to obtain the polynomial multiplication c １ c ２ The result of c １ c ２ Program instructions to obtain modulo p, where p is a predetermined prime number of the homomorphic encryption system 17. The computer system of claim 16, further comprising:

18. The program instructions, when executed by the computer system, cause the computer system to: For at least one further cryptographic element c: program instructions that cause the polynomial coefficients of element c to be stored as respective multi-bit values ​​in further columns of the matrix in cells connected to the set of word lines; and In each of the calculation stages, from the set of bit lines connected to cells storing the polynomial coefficients of c, １ The digital signal obtained from successive bits of the coefficients of １ Program instructions that cause further results of c to be obtained 17. The computer system of claim 16, further comprising:

19. The second cryptographic element c ２ is element s of the secret key (1, s) of the homomorphic encryption system; The first cryptographic element c １ is the ciphertext (c ０ , c １ ) element; c ０ is another cryptographic element; The program instructions, when executed by the computer system, cause the computer system to: Polynomial multiplication c １ After obtaining the result of s, １ s and c ０ The sum of the ciphertext m = c ０ +c １ program instructions to obtain s modulo p, where p is a predetermined prime number of said homomorphic encryption system; 19. The computer system of claim 16, further comprising:

20. and program instructions that, when executed by a computer system, cause the computer system to:

1. Program instructions for causing an analog multiply-accumulate unit having at least one crossbar array of binary analog memory cells connected between respective pairs of word lines and bit lines of the at least one crossbar array to store a matrix of multi-bit values ​​for calculation, wherein: The bits of each multi-bit value are stored in cells connected along word lines; and Corresponding bits of values ​​in a column of said matrix are stored in cells connected along bit lines; program instructions for causing, in each of one or more computation stages of a cryptographic element, a set of polynomial coefficients of the element to be bit-wise supplied to respective word lines of said analog multiply-accumulate unit to obtain analog accumulation signals on respective bit lines; program instructions for converting the analog accumulated signal to a digital signal; and program instructions for processing the digital signals derived from successive bits of the polynomial coefficients in each of the one or more calculation stages to obtain a calculation result of the cryptographic element; a computer program comprising:

Images