Secure Function Evaluation using an FPGA Overlay Architecture

Transcription

1 Secure Function Evaluation using an FPGA Overlay Architecture Xin Fang Stratis Ioannidis Miriam Leeser Dept. of Electrical and Computer Engineering Northeastern University Boston, MA, USA FPGA 217 1

2 Introduction Data Evaluation User Data Evaluator Output 2

3 Examples: User Data Biologist DNA Sequences 3

4 Examples: User Internet Footprint 4

5 Data is protected using Secure Function Evaluation (SFE) User Data Evaluator SFE SFE SFE Learns function output only; Does not learn user data 5

6 Garbled Circuits (GC) One solution of SFE Introduced by Andrew Yao in 1982 Use cryptographic primitives Suitable for any function represented as a Boolean circuit Three types of parties: Garbler, Evaluator, Users 6

7 Current Problems and Situation Software Platform Limitations : Slow on large problems Energy inefficient Acceleration is needed Main objective: Accelerate Garbled Circuits using FPGA architecture 7

8 Traditional FPGA Workflow for GC Problems Disadvantages: GC problems too large to map Long compilation time Redo the implementation for every new problem Solution: FPGA Coarse Grain Overlays 8

9 FPGA Overlays Two parts: A circuit design implemented on FPGA fabric using standard design flow A user circuit mapped onto that overlay circuit Benefits: User-configured logic in fixed FPGA bitstream Optimized for GC problem (coarse grain) One time synthesis Overlay Cell FPGA 9

10 Our Contributions First FPGA overlay architecture to accelerate generic Garbled Circuit problems Tools and workflow for modeling and mapping GC problems onto FPGAs Show speedup of 2-3 orders of magnitude 1

11 Garbled Circuits - Steps Evaluator and two users with private data Users Evaluator a aa a b Inputs Outputs a b a or b 1 b f a b

12 Garbled Circuits - Steps Garbler: encrypt the outputs, shared to Evaluator Users Evaluator Garbler aa a b Inputs Outputs a b x a b Enc a,b (x ) a b 1 Enc a,b1 (x 1 ) 1 b a 1 b Enc a1,b (x 1 ) a 1 b 1 Enc a1,b1 (x 1 ) a b 12

13 Garbled Circuits - Steps Garbler: encrypt the outputs, shared to Evaluator Users Evaluator Garbler aa a b Inputs Outputs a b x a b Enc a,b (x ) a b 1 Enc a,b1 (x 1 ) 1 b a 1 b Enc a1,b (x 1 ) a 1 b 1 Enc a1,b1 (x 1 ) a b 13

14 Garbled Circuits - Steps Using Oblivious Transfer (OT), evaluator 1) Learns garbled inputs 2) Evaluates function by decrypting only the matching entry Users Evaluator Garbler Enc a,b (x ) Enc a,b1 (x 1 ) Enc a1,b (x 1 ) Enc a1,b1 (x 1 ) Tables OT OT 14

15 General Case Problem Garbled circuits: suitable for any program that terminates in finite time Translate Boolean Netlist 15

16 General Case a b a 1 b 1 c 16

17 General Case a b a 1 b 1 c 17

18 General Case a b a 1 b 1 c 18

19 General Case a b a 1 b 1 c 19

20 General Case a b a 1 b 1 c 2

21 Takeaway Message GC ensures the privacy of input data while being processed Garbled Gate is not simple gate Arbitrary function that terminates in finite time can be represented as Garbled Circuits 21

22 Solution Challenges Challenge1 Garbled Circuits Acceleration Architecture Design on FPGAs Challenge2 Circuits too large to map directly to FPGAs -> How to represent large circuits on FPGAs Challenge3 FPGA and Host CPU Communication -> How to handle data transmission 22

23 Generating Garbled Circuits GC Problem ObliVM 1 Gate Netlist Layer Extractor Layer Info [1] Chang Liu, Xiao Shaun Wang, Karthik Nayak, Yan Huang, and Elaine Shi. ObliVM: A generic, customizable, and reusable secure computation architecture. In IEEE S & P,

24 Garbler and Evaluator on FPGAs Garbler Evaluator PCIE Garble Table FPGA CPU CPU FPGA Input garbled values via O.T. PCIE Layer Info Shared Layer Info 24

25 Garbler Overlay Architecture GC AND GC AND GC AND GC AND GC AND GC AND GC AND GC AND GC AND GC AND GC AND GC XOR Workload Dispatcher & Data Controller FPGA FIFO BRAM PCIe CPU 25

26 Garbled XOR Gate Garbled XOR Gate K K 1 R K K 2 K 1 K K 1 K 1 2 R K i true = K i false xor R Latency: 1 cycle Kolesnikov, Vladimir, and Thomas Schneider. "Improved garbled circuit: Free XOR gates and 26 applications." International Colloquium on Automata, Languages, and Programming. 28.

27 Garbled AND Gate Garbled AND Gate K,K 1 K 1,K 1 SHA-1 SHA-1 K K 1 K 2 R K 2 K,K 1 1 K 2 K 1,K 1 1 Latency: 82 cycles SHA-1 SHA-1 K 2 K

28 Timing on the FPGA A B C D A: BRAM Read; B: GC AND Operation; C: BRAM Write back; D: reset;

29 Size of Problem Problem # AND Gate # XOR gate # layers Max # AND in One Layer Millionaire(2) Addition(6) HD(1) HD(3) HD(5) A*B(8) A*B(32) A*B(64) Sorting(1*4)

30 Run times: FPGA Overlay vs. ObliVM Problem Our Approach (Clock cycle) ObliVM (Clock Cycle) Millionaire(2) 1.9* *1 6 Addition(6) 5.6* *1 6 HD(1) 1.2*1 3 4*1 6 HD(3) 2.2* *1 7 HD(5) 2.8* *1 7 A*B(8) 4.4*1 3 3*1 7 A*B(32) 3.6* *1 8 A*B(64) 1.1* *1 8 Sorting(1*4) 1.1* *1 8 3

31 Speedup: FPGA Overlay vs. ObliVM Problem Speedup Millionaire(2) 422 Addition(6) 222 HD(1) 243 HD(3) 357 HD(5) 434 ObliVM runs at 2.8 GHz FPGA overlay runs at 2 MHz A*B(8) 498 A*B(32) 218 A*B(64) 28 Sorting(1*4)

32 Hardware Platform Gidel ProceV Board featuring Stratix V FPGA 32

33 Resource Utilization 33

34 Conclusions First FPGA overlay architecture to accelerate generic Garbled Circuit problems Tools and workflow for modeling and mapping GC problems onto FPGAs FPGAs are a good platform for Garbled Circuit problem by showing the speedup against state-of-art software platform for arbitrary GC problems 34

35 Future Work Optimization for better GC performance Test on large GC problems Garbled Circuits in the Datacenter 35

36 Thank you! Reconfigurable and GPU Computing Laboratory Xin Fang: Stratis Ioannidis: Miriam Leeser: 36