Methods of operating on data in a fully homomorphic encryption system using in-situ processing-in-memory and related circuits
View Patent ↗A method of operating on encrypted data can be performed by receiving ciphertexts at a server that is configured to operate on the ciphertexts generated using a 3 rd generation RGSW based fully homomorphic encryption system, operating on the ciphertexts received at the server in response to requested operations to generate respective input ciphertexts including ciphertext polynomials and ciphertext integers that are representative of the input ciphertexts, and processing the input ciphertexts in a server processing-in-memory device, that is operatively coupled to the server, to perform operations on the input ciphertext using the server processing-in-memory device, in-situ.
1 . A method for fully homomorphic processing of ciphertexts, the method comprising:
receiving, at a computing platform that comprises a server operatively coupled to a processing-in-memory (PIM) device, one or more ciphertexts produced with a Ring-Gentry-Sahai-Waters (RGSW) based fully homomorphic encryption system that permits evaluation of arbitrary functions on encrypted data;
generating, from the ciphertexts, corresponding input ciphertexts, each input ciphertext including a ciphertext polynomial and a ciphertext integer;
processing the input ciphertexts entirely in-situ within the PIM device, wherein the processing includes performing bootstrapping operations in a pipelined architecture, and dynamically adjusting one or more bootstrapping parameters during the bootstrapping operations based on structural characteristics of the input ciphertexts, wherein the structural characteristics comprise at least one of a polynomial degree, a noise level, or a ciphertext modulus, and wherein the bootstrapping operations include executing stage-wise number-theoretic transform and inverse number-theoretic transform operations using an in-memory coefficient-row mapping architecture in which each stage operates on coefficient pairs resident in a common memory row and transfers intermediate results to a next stage through column-wise data movement internal to the PIM device; and
performing, on the input ciphertexts, at least one homomorphic operation, the at least one homomorphic operation comprising ciphertext addition, ciphertext multiplication, key switching, or modulus switching, wherein each input ciphertext remains in encrypted form within the PIM device during the at least one homomorphic operation.
2 . The method of claim 1 wherein bootstrapping includes:
bootstrapping the input ciphertext with an encrypted private key that is associated with the ciphertexts, to provide an output ciphertext having reduced noise compared to the input ciphertext.
3 . The method of claim 1 wherein bootstrapping further includes:
setting an initial value of an accumulator; and
decomposing polynomials of the input ciphertexts to be compatible with a refreshing key associated with the ciphertexts received at the server.
4 . The method of claim 3 wherein setting the initial value of the accumulator includes:
translating boolean functions into at least one homomorphic computation step to provide respective integer outputs; and
mapping the respective integer outputs to respective bootstrapping compatible polynomials using search based processing-in-memory operations.
5 . The method of claim 3 wherein decomposing the polynomials of the input ciphertexts includes:
decomposing the respective bootstrapping compatible polynomials to coefficients of the respective bootstrapping compatible polynomials.
6 . The method of claim 5 further comprising:
performing Number Theoretic Transform (NTT) transforms on the respective bootstrapping compatible polynomials to provide a frequency domain equivalent of the respective bootstrapping compatible polynomials.
7 . The method of claim 6 further comprising:
performing row-parallel multiplication between the frequency domain equivalent of the respective bootstrapping compatible polynomials and respective refreshing keys to provide respective portions of an N dimensional vector; and
adding the respective portions of an N dimensional vector to provide an accumulator pipeline output.
8 . The method of claim 7 further includes:
performing inverse NTT transforms on the accumulator pipeline output to generate an accumulator output.
9 . The method of claim 1 further comprising:
receiving unencrypted data at a client; and
encrypting the unencrypted data using the RGSW based fully homomorphic encryption system using a client processing-in-memory device, that is operatively coupled to the client, to perform operations on the unencrypted data by the client processing-in-memory device, in-situ.
10 . The method of claim 1 , wherein the fully homomorphic encryption system comprises a third-generation Ring-Gentry-Sahai-Waters (RGSW)-based system configured to support evaluation of arbitrary functions on encrypted data.
11 . The method of claim 1 , further comprising storing, in a plurality of local memory banks physically co-located with respective pipeline stages of the PIM device, digit-decomposed portions of a refreshing key.
12 . The method of claim 1 , wherein the bootstrapping operations further comprises:
performing, in row-parallel fashion, a signed-digit decomposition of the ciphertext polynomials;
executing stage-wise number-theoretic transform and inverse number-theoretic transform operations using an in-memory coefficient-row mapping architecture in which each stage operates on coefficient pairs resident in a common memory row and transfers intermediate results to a next stage through column-wise data movement internal to the PIM device.
13 . The method of claim 1 , wherein the one or more bootstrapping parameters includes at least one of decomposition base, decomposition depth, polynomial degree, modulus set, or pipeline stage width.
14 . The method of claim 1 , wherein the processing further includes selecting, for each bootstrapping operation, an accumulation path of either an algebraic-product (AP) type or a generalized-inverse-number-theoretic-transform (GINX) type, the selection being performed as a function of a statistical distribution of secret-key coefficients associated with the corresponding input ciphertext.
15 . The method of claim 1 , further comprising outputting, from the PIM device, encrypted output ciphertexts that encode respective results of the at least one homomorphic operation.
16 . A method for fully homomorphic processing of ciphertexts, the method comprising:
receiving, at a computing platform that comprises a server operatively coupled to a processing-in-memory (PIM) device, one or more ciphertexts produced with a Ring-Gentry-Sahai-Waters (RGSW) based fully homomorphic encryption system that permits evaluation of arbitrary functions on encrypted data;
generating, from the ciphertexts, corresponding input ciphertexts, each input ciphertext including a ciphertext polynomial and a ciphertext integer;
processing the input ciphertexts entirely in-situ within the PIM device, wherein the processing includes:
performing bootstrapping operations in a pipelined architecture,
selecting, for each bootstrapping operation, an accumulation path of at least one of an algebraic-product type or a generalized-inverse-number-theoretic-transform type, the selection being performed as a function of a statistical distribution of secret-key coefficients associated with a corresponding input ciphertext, and
dynamically adjusting one or more bootstrapping parameters during the bootstrapping operations based on structural characteristics of the input ciphertexts, wherein the structural characteristics comprise at least one of a polynomial degree, a noise level, or a ciphertext modulus; and
performing, on the input ciphertexts, at least one homomorphic operation, the at least one homomorphic operation comprising ciphertext addition, ciphertext multiplication, key switching, or modulus switching, wherein each input ciphertext remains in encrypted form within the PIM device during the at least one homomorphic operation.