Ring-Learning-with-Errors (RLWE) has emerged as the foundation of many important techniques for improving security and privacy, including homomorphic encryption and post-quantum cryptography. While promising, these techniques have received limited use due to their extreme overheads of running on general-purpose machines. In this paper, we present a novel vector Instruction Set Architecture (ISA) and microarchitecture for accelerating the ring-based computations of RLWE. The ISA, named B512, is developed to meet the needs of ring processing workloads while balancing high-performance and general-purpose programming support. Having an ISA rather than fixed hardware facilitates continued software improvement post-fabrication and the ability to support the evolving workloads. We then propose the ring processing unit (RPU), a high-performance, modular implementation of B512. The RPU has native large word modular arithmetic support, capabilities for very wide parallel processing, and a large capacity highbandwidth scratchpad to meet the needs of ring processing. We address the challenges of programming the RPU using a newly developed SPIRAL backend. A configurable simulator is built to characterize design tradeoffs and quantify performance. The best performing design was implemented in RTL and used to validate simulator performance. In addition to our characterization, we show that a RPU using 20.5mm2of GF12nm can provide a speedup of 1485× over a CPU running a 64k, 128-bit NTT, a core RLWE workload.

Network slicing is a powerful tool that provides 5G and future networks a robust means for managing cross-application QoS, dynamic traffic migration in response to network events, and in-network data aggregation and computation. Unfortunately, slicing inherits many of the security challenges of cloud and edge computing such as side-channel information leakage, while also encountering new challenges posed by multi-domain authorization and quantum computing. Many extant mechanisms, such as PKI, are insufficient in the face of quantum computers, and existing side-channel mitigations impose heavy overhead costs while only providing defense against known attacks. In this paper, we describe a novel approach to protecting slice control information through the use of Homomorphic Encryption (HE). HE allows quantum-resilient validation and distribution of critical information, while also enabling hierarchical control across multiple domains and providing encrypted computation. Further, threshold HE enables secure decryption and computation of control or measurement information, while protecting the entire slice against potential key-leakage by rendering any one key useless without the required quorum. The benchmark results shown demonstrate that the HE mechanisms used can be deployed in a practical manner, providing stalwart security guarantees against a variety of threats.

We address the practicality challenges of secure program obfuscation by implementing, optimizing, and experimentally assessing an approach to securely obfuscate conjunction programs proposed in [1]. Conjunction programs evaluate functionsf(x1,...,xL) = Λi∈Iyi, whereyiis eitherxior ¬xiandI⊆ [L], and can be used as classifiers. Our obfuscation approach satisfies distributional Virtual Black Box (VBB) security based on reasonable hardness assumptions, namely an entropic variant of the Ring Learning with Errors (Ring-LWE) assumption. Prior implementations of secure program obfuscation techniques support either trivial programs like point functions, or support the obfuscation of more general but less efficient branching programs to satisfy Indistinguishability Obfuscation (IO), a weaker security model. Further, the more general implemented techniques, rather than relying on standard assumptions, base their security on conjectures that have been shown to be theoretically vulnerable. Our work is the first implementation of non-trivial program obfuscation based on polynomial rings. Our contributions include multiple design and implementation advances resulting in reduced program size, obfuscation runtime, and evaluation runtime by many orders of magnitude. We implement our design in software and experimentally assess performance in a commercially available multi-core computing environment. Our implementation achieves runtimes of 6.7 hours to securely obfuscate a 64-bit conjunction program and 2.5 seconds to evaluate this program over an arbitrary input. We are also able to obfuscate a 32-bit conjunction program with 53 bits of security in 7 minutes and evaluate the obfuscated program in 43 milliseconds on a commodity desktop computer, which implies that 32-bit conjunction obfuscation is already practical. Our graph-induced (directed) encoding implementation runs up to 25 levels, which is higher than previously reported in the literature for this encoding. Our design and implementation advances are applicable to obfuscating more general compute-and-compare programs and can also be used for many cryptographic schemes based on lattice trapdoors.

We present an approach to scalable, secure voice over IP (VoIP) teleconferencing on commodity mobile devices and data networks with end-to-end homomorphic encryption. We assume an honest-but-curious threat model where an adversary, despite observing all communications between participants and having access to teleconferencing servers, is unable to obtain unencrypted data and subsequently listen to the conversation. Prior secure VoIP teleconferencing services have relied on: 1) teleconferencing clients to maintain point-to-point encrypted links with other clients or 2) a teleconferencing server which can access and manipulate VoIP streams unencrypted. Our approach mixes VoIP data streams at a single teleconferencing server only while encrypted. Data streams are never decrypted at the teleconferencing server. Innovation comes from an efficient VoIP encoding to reduce circuit depth for homomorphic mixing of encrypted VoIP data, parameterization for low bandwidth usage and integration into an existing open-source VoIP infrastructure. We experimentally evaluate on commodity iPhones, mixing at the VoIP servers on lowest cost Amazon AWS cloud server instances and communicating on commercial data networks and 802.11n access points.

Describes an approach to the problem of optimizing memory resource use in high-performance scalable computing systems. The approach is automatic and applicable to a wide variety of system architectures. It consists of a hybrid genetic algorithm optimizer (the Embedded Genetic Allocator or EGA), coupled with a high-precision software performance monitoring system. EGA requires no programmer knowledge of the underlying non-uniform memory access (NUMA) architecture of the target hardware; the programmer simply specifies the data buffers to be allocated and requires that certain groups of buffers share the same performance quality. EGA minimizes the execution time of time-critical portions of the target system by allocating target program data buffers to various memory banks in the NUMA architecture. These trial allocations are loaded and evaluated directly on the target hardware. Measurements of process execution time are derived from synchronized event logging of multiple processors performed by BBN TraceMaker/sup TM/. The timing data provides the information for an optimizer cost function which the genetic algorithm uses when selecting from amongst competing allocations. Thus, EGA automates the trial-and-error method of hand optimization. We have demonstrated EGA performing memory allocation optimizations on a typical VME-based multiprocessor DSP system and completed a set of optimization experiments. The results demonstrate that EGA can be used to optimize the memory allocation on a DSP with real-world code, and that the resulting optimizations can rival those generated manually by a skilled programmer.