arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新,休息一下吧,周末愉快~~
arXiv 2112.06396cs.CRcs.AR
收藏

全同态加密需要计算加速吗?

Does Fully Homomorphic Encryption Need Compute Acceleration?

Leo de Castro, Rashmi Agrawal, Rabia Yazicigil, Anantha Chandrakasan, Vinod Vaikuntanathan, Chiraag Juvekar, Ajay Joshi

摘要:

全同态加密(FHE)允许对加密数据进行任意复杂的计算,而无需对其进行解密,从而使我们能够在第三方系统上维护数据隐私。不幸的是,使用FHE维持深度计算需要称为自举的周期性降噪步骤。自举操作的成本是FHE广泛采用的主要障碍之一。在本文中,我们提出了一个深入的架构分析的引导步骤FHE。首先,我们观察到,安全实现的自举表现出低的算术强度(<1 Op/字节),需要大的缓存(>100 MB),并严重约束的主要内存带宽。因此,我们表明,现有的工作负载观察边际性能增益定制的高吞吐量的算术单元的设计定制FHE。其次,我们提出了几个高速缓存友好的算法优化,提高FHE自举的吞吐量,使高达3.2倍更高的算术强度和4.6倍更低的内存带宽。我们的优化适用于广泛的结构相似的计算,如私人评估和机器学习模型的训练。最后,我们将这些优化到一个架构工具,给定的缓存大小,内存子系统,功能单元的数量和所需的安全级别,选择最佳的密码系统参数,以最大限度地提高自举吞吐量。我们优化的引导实现代表了FHE计算加速的最佳情况。我们表明,尽管这些优化,引导继续被主要内存带宽。我们提出了新的研究方向,以解决潜在的内存瓶颈。总之,我们对这个问题的回答是:是的,但只有在解决内存瓶颈之后!

英文摘要:

Fully Homomorphic Encryption (FHE) allows arbitrarily complex computations on encrypted data without ever needing to decrypt it, thus enabling us to maintain data privacy on third-party systems. Unfortunately, sustaining deep computations with FHE requires a periodic noise reduction step known as bootstrapping. The cost of the bootstrapping operation is one of the primary barriers to the wide-spread adoption of FHE. In this paper, we present an in-depth architectural analysis of the bootstrapping step in FHE. First, we observe that secure implementations of bootstrapping exhibit a low arithmetic intensity (<1 Op/byte), require large caches (>100 MB), and are heavily bound by the main memory bandwidth. Consequently, we demonstrate that existing workloads observe marginal performance gains from the design of bespoke high-throughput arithmetic units tailored to FHE. Second, we propose several cache-friendly algorithmic optimizations that improve the throughput in FHE bootstrapping by enabling up to 3.2x higher arithmetic intensity and 4.6x lower memory bandwidth. Our optimizations apply to a wide range of structurally similar computations such as private evaluation and training of machine learning models. Finally, we incorporate these optimizations into an architectural tool which, given a cache size, memory subsystem, the number of functional units and a desired security level, selects optimal cryptosystem parameters to maximize the bootstrapping throughput. Our optimized bootstrapping implementation represents a best-case scenario for compute acceleration of FHE. We show that despite these optimizations, bootstrapping continues to be bottlenecked by main memory bandwidth. We propose new research directions to address the underlying memory bottleneck. In summary, our answer to the titular question is: yes, but only after addressing the memory bottleneck!

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑