Method for communication based on homomorphic encryption in communication system and device therefor

Abstract

The present specification disclosure provides a method performed by a client in a communication system. More specifically, the present method comprises the steps of: receiving at least one synchronization signal from a server; receiving control information from the server; transmitting a homomorphic encryption secret key obtained by homomorphically encrypting a secret key used for data encryption and data decryption to the server; and transmitting encrypted data obtained by encrypting data on the basis of an encryption process repeated at least once, based on (i) the homomorphic encryption secret key and (ii) ROUND function, to the server. Each of the encryption process repeated at least once is performed on the basis of (i) a nonlinear layer for scrambling a part of the data encrypted in the corresponding encryption process and (ii) a linear layer for expanding a part of the scrambled data with regard to all the data. The nonlinear layer is randomly generated with regard to each of the encryption process repeated at least once.

Description

Communication method based on homomorphic encryption in a communication system and device therefor

[0001] The present disclosure relates to a communication system, and more particularly, to a method for performing homomorphic encryption-based communication in a communication system and a device therefor.

[0002]

[0003] Wireless communication systems are widely deployed to provide various types of communication services, such as voice and data. Typically, wireless communication systems are multiple access systems that support communication with multiple users by sharing available system resources (e.g., bandwidth, transmission power). Examples of multiple access systems include Code Division Multiple Access (CDMA), Frequency Division Multiple Access (FDMA), Time Division Multiple Access (TDMA), Space Division Multiple Access (SDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Single Carrier Frequency Division Multiple Access (SC-FDMA), and Interleave Division Multiple Access (IDMA).

[0004]

[0005] The purpose of the present disclosure is to provide a method for performing homomorphic encryption-based communication in a communication system and a device therefor.

[0006] In addition, the present disclosure aims to provide a method and a device for performing two blind rotations in a table reference homomorphic operation in a homomorphic encryption-friendly symmetric key encryption method.

[0007] The technical problems to be achieved in the present disclosure are not limited to the technical problems mentioned above, and other technical problems not mentioned will be clearly understood by a person having ordinary skill in the technical field to which the present invention pertains from the description below.

[0008]

[0009] According to various embodiments of the present disclosure, a method performed by a server in a communication system comprises the steps of: transmitting at least one synchronization signal to a client; transmitting control information to the client; receiving encrypted data from the client based on at least one round performed on data, wherein in each of the at least one round, (i) common input data commonly used in the at least one round and (ii) a round key individually used in each of the at least one round are input to and output from a round function of each of the at least one round; And a step of performing a homomorphic operation on the output value of the round function of each of the at least one round included in the encrypted data, wherein the homomorphic operation on the output value of the round function of each of the at least one round is performed based on a preset mapping relationship between an input value for the homomorphic operation and a result value of the homomorphic operation on the input value, and for the homomorphic operation based on the preset mapping relationship, a first ciphertext for a round key individually used in each of the at least one round is pre-computed before performing the homomorphic operation, and a second ciphertext for the common input data is computed when performing the homomorphic operation, and a result value of the homomorphic operation on the output value of the round function of each of the at least one round is calculated based on (i) a first blind rotation based on the first ciphertext and a second blind rotation based on the second ciphertext, which are performed on the preset mapping relationship.

[0010] According to various embodiments of the present disclosure, a method performed by a client in a communication system comprises the steps of: receiving at least one synchronization signal from a server; receiving control information from the server; transmitting encrypted data to the server based on at least one round performed on data, wherein in each of the at least one round, (i) common input data commonly used in the at least one round and (ii) a round key individually used in each of the at least one round are input to and output from a round function of each of the at least one round; And a step of receiving, from the server, a homomorphic ciphertext of the data obtained based on a homomorphic operation on an output value of a round function of each of the at least one round included in the encrypted data, wherein the homomorphic operation on the output value of the round function of each of the at least one round is performed based on a preset mapping relationship between an input value for the homomorphic operation and a result value of the homomorphic operation on the input value, and for the homomorphic operation based on the preset mapping relationship, a first ciphertext for a round key individually used in each of the at least one round is pre-computed before performing the homomorphic operation, and a second ciphertext for the common input data is computed when performing the homomorphic operation, and a result value of the homomorphic operation on the output value of the round function of each of the at least one round is calculated based on (i) a first blind rotation based on the first ciphertext and a second blind rotation based on the second ciphertext, which are performed on the preset mapping relationship.

[0011] According to various embodiments of the present disclosure, a server for performing communication in a communication system comprises: a transmitter for transmitting a wireless signal; a receiver for receiving a wireless signal; at least one processor; and at least one computer memory operably connectable to the at least one processor and storing instructions that, when executed by the at least one processor, perform operations, the operations comprising: transmitting at least one synchronization signal to a client; transmitting control information to the client; receiving, from the client, encrypted data encrypted based on at least one round performed on data, wherein in each of the at least one round, (i) common input data commonly used in the at least one round and (ii) a round key individually used in each of the at least one round are input to and output from a round function of each of the at least one round;And a step of performing a homomorphic operation on the output value of the round function of each of the at least one round included in the encrypted data, wherein the homomorphic operation on the output value of the round function of each of the at least one round is performed based on a preset mapping relationship between an input value for the homomorphic operation and a result value of the homomorphic operation on the input value, and for the homomorphic operation based on the preset mapping relationship, a first ciphertext for a round key individually used in each of the at least one round is pre-computed before performing the homomorphic operation, and a second ciphertext for the common input data is computed when performing the homomorphic operation, and a server is provided in which a result value of the homomorphic operation on the output value of the round function of each of the at least one round is calculated based on (i) a first blind rotation based on the first ciphertext and a second blind rotation based on the second ciphertext, which are performed on the preset mapping relationship.;

[0012] According to various embodiments of the present disclosure, a client performing communication in a communication system comprises: a transmitter for transmitting a wireless signal; a receiver for receiving a wireless signal; at least one processor; and at least one computer memory operably connectable to the at least one processor and storing instructions that, when executed by the at least one processor, perform operations, the operations comprising: receiving at least one synchronization signal from a server; receiving control information from the server; transmitting encrypted data to the server based on at least one round performed on data, wherein in each of the at least one round, (i) common input data commonly used in the at least one round and (ii) a round key individually used in each of the at least one round are input to and output from a round function of each of the at least one round;And a step of receiving, from the server, a homomorphic ciphertext of the data obtained based on a homomorphic operation on an output value of a round function of each of the at least one round included in the encrypted data, wherein the homomorphic operation on the output value of the round function of each of the at least one round is performed based on a preset mapping relationship between an input value for the homomorphic operation and a result value of the homomorphic operation on the input value, and for the homomorphic operation based on the preset mapping relationship, a first ciphertext for a round key individually used in each of the at least one round is pre-computed before performing the homomorphic operation, and a second ciphertext for the common input data is computed when performing the homomorphic operation, and a result value of the homomorphic operation on the output value of the round function of each of the at least one round is computed based on (i) a first blind rotation based on the first ciphertext and a second blind rotation based on the second ciphertext, which are performed on the preset mapping relationship.

[0013] According to various embodiments of the present disclosure, a non-transitory computer-readable medium (CRM) storing one or more commands, wherein one or more commands executable by one or more processors include operations performed by a transmitting end, wherein the operations include all steps of a method performed by a server.

[0014] According to various embodiments of the present disclosure, a non-transitory computer-readable medium (CRM) storing one or more instructions, wherein one or more instructions executable by one or more processors include operations performed by a transmitting end, wherein the operations include all steps of a method performed by a client.

[0015] According to various embodiments of the present disclosure, a device is provided comprising one or more memories and one or more processors functionally connected to the one or more memories, wherein the one or more processors execute operations performed by the device, wherein the operations include all steps of a method performed by a server.

[0016] According to various embodiments of the present disclosure, a device is provided comprising one or more memories and one or more processors functionally connected to the one or more memories, wherein the one or more processors execute operations performed by the device, wherein the operations include all steps of a method performed by a client.

[0017]

[0018] The present disclosure has the effect of enabling homomorphic encryption-based communication in a communication system.

[0019] In addition, the present disclosure has the effect of performing two blind rotations in a homomorphic encryption-friendly symmetric key encryption method when performing a table reference homomorphic operation.

[0020] In addition, the present disclosure has the effect of reducing the time required for homomorphic operations.

[0021] The effects that can be obtained from the present disclosure are not limited to the effects mentioned above, and other effects not mentioned will be clearly understood by those skilled in the art to which the present invention pertains from the description below.

[0022]

[0023] The accompanying drawings are intended to aid in understanding the present disclosure and, together with detailed descriptions, may provide embodiments of the present disclosure. However, the technical features of the present disclosure are not limited to specific drawings, and the features disclosed in each drawing may be combined with each other to form new embodiments. Reference numerals in each drawing may indicate structural elements.

[0024] FIG. 1 is a diagram illustrating an example of a communication system applicable to the present disclosure.

[0025] FIG. 2 is a drawing showing an example of a wireless device applicable to the present disclosure.

[0026] FIG. 3 is a diagram illustrating a method for processing a transmission signal applicable to the present disclosure.

[0027] FIG. 4 is a diagram showing another example of a wireless device applicable to the present disclosure.

[0028] FIG. 5 is a drawing showing an example of a mobile device applicable to the present disclosure.

[0029] FIG. 6 is a diagram showing physical channels applicable to the present disclosure and a signal transmission method using the same.

[0030] FIG. 7 is a diagram showing the structure of a wireless frame applicable to the present disclosure.

[0031] Fig. 8 is a drawing showing a slot structure applicable to the present disclosure.

[0032] FIG. 9 is a diagram showing an example of a communication structure that can be provided in a 6G system applicable to the present disclosure.

[0033] Figure 10 is a diagram showing an example of multilateral communication.

[0034] Figure 11 is a diagram showing an example of a homomorphic encryption-symmetric key encryption hybrid framework.

[0035] Figure 12 is a diagram showing an example of a round function of an SPN structure symmetric key encryption.

[0036] Figure 13 is a diagram showing another example of a round function of an SPN structure symmetric key encryption.

[0037] Figure 14 is a diagram showing an example of a Feistel structure symmetric key encryption.

[0038] Figure 15 is a diagram showing another example of a Feistel structure symmetric key encryption.

[0039] Figure 16 is a diagram showing an example of the method proposed in the present disclosure being performed on a client.

[0040] Figure 17 is a diagram showing an example in which the method proposed in the present disclosure is performed on a server.

[0041]

[0042] The following embodiments combine components and features of the present disclosure in a predetermined form. Each component or feature may be considered optional unless explicitly stated otherwise. Each component or feature may be implemented without being combined with other components or features. Furthermore, some components and / or features may be combined to form embodiments of the present disclosure. The order of operations described in the embodiments of the present disclosure may be changed. Some components or features of one embodiment may be included in another embodiment or may be replaced with corresponding components or features of another embodiment.

[0043] In the description of the drawings, procedures or steps that may obscure the gist of the present disclosure are not described, and procedures or steps that can be understood by a person skilled in the art are also not described.

[0044] Throughout the specification, when a part is said to "comprising" (or including) a certain component, this does not mean that other components are excluded, but rather that other components can be included, unless specifically stated otherwise. In addition, terms such as "...part," "...unit," and "module" described in the specification mean a unit that processes at least one function or operation, which may be implemented by hardware, software, or a combination of hardware and software. In addition, the words "a" or "an," "one," "the," and similar related words may be used in the context of describing the present disclosure (especially in the context of the claims below) to include both the singular and the plural, unless otherwise indicated in the present disclosure or clearly contradicted by the context.

[0045] The embodiments of the present disclosure have been described with a focus on the data transmission and reception relationship between a base station and a mobile station. Here, the base station is understood as a terminal node of a network that directly communicates with the mobile station. Certain operations described as being performed by the base station in the present disclosure may, in some cases, be performed by an upper node of the base station.

[0046] That is, in a network consisting of multiple network nodes including a base station, various operations performed for communication with a mobile station may be performed by the base station or other network nodes other than the base station. In this case, the term 'base station' may be replaced by terms such as fixed station, Node B, eNB (eNode B), gNB (gNode B), ng-eNB, advanced base station (ABS), or access point.

[0047] Additionally, in embodiments of the present disclosure, the term terminal may be replaced with terms such as user equipment (UE), mobile station (MS), subscriber station (SS), mobile subscriber station (MSS), mobile terminal, or advanced mobile station (AMS).

[0048] Additionally, a transmitter refers to a fixed and / or mobile node that provides data or voice services, and a receiver refers to a fixed and / or mobile node that receives data or voice services. Therefore, for uplink, a mobile station can be the transmitter, and a base station can be the receiver. Similarly, for downlink, a mobile station can be the receiver, and a base station can be the transmitter.

[0049] Embodiments of the present disclosure may be supported by standard documents disclosed in at least one of wireless access systems, such as IEEE 802.xx system, 3rd Generation Partnership Project (3GPP) system, 3GPP Long Term Evolution (LTE) system, 3GPP 5G (5th generation) NR (New Radio) system and 3GPP2 system, and in particular, embodiments of the present disclosure may be supported by 3GPP TS (technical specification) 38.211, 3GPP TS 38.212, 3GPP TS 38.213, 3GPP TS 38.321 and 3GPP TS 38.331 documents.

[0050] Furthermore, the embodiments of the present disclosure may be applied to other wireless access systems and are not limited to the aforementioned systems. For example, they may be applicable to systems implemented after the 3GPP 5G NR system, and are not limited to a specific system.

[0051] That is, obvious steps or parts not described in the embodiments of the present disclosure can be explained by referring to the above documents. In addition, all terms disclosed in the present disclosure can be explained by the above standard documents.

[0052] Hereinafter, preferred embodiments according to the present disclosure will be described in detail with reference to the accompanying drawings. The detailed description set forth below, together with the accompanying drawings, is intended to illustrate exemplary embodiments of the present disclosure and is not intended to represent the only embodiments in which the technical configurations of the present disclosure may be implemented.

[0053] Additionally, specific terms used in the embodiments of the present disclosure are provided to aid in understanding the present disclosure, and the use of such specific terms may be changed to other forms without departing from the technical spirit of the present disclosure.

[0054] The following technology can be applied to various wireless access systems such as CDMA (code division multiple access), FDMA (frequency division multiple access), TDMA (time division multiple access), OFDMA (orthogonal frequency division multiple access), and SC-FDMA (single carrier frequency division multiple access).

[0055] In order to make the following description clear, the following description is based on a 3GPP communication system (e.g., LTE, NR, etc.), but the technical idea of ​​the present invention is not limited thereto. LTE may refer to technology after 3GPP TS 36.xxx Release 8. Specifically, LTE technology after 3GPP TS 36.xxx Release 10 may be referred to as LTE-A, and LTE technology after 3GPP TS 36.xxx Release 13 may be referred to as LTE-A pro. 3GPP NR may refer to technology after TS 38.xxx Release 15. 3GPP 6G may refer to technology after TS Release 17 and / or Release 18. "xxx" refers to a standard document detail number. LTE / NR / 6G may be collectively referred to as a 3GPP system.

[0056] For background information, terms, abbreviations, etc. used in this disclosure, reference may be made to standard documents published prior to the invention of the present invention. For example, reference may be made to the 36.xxx and 38.xxx standard documents.

[0057]

[0058] Communication system applicable to the present disclosure

[0059] Although not limited thereto, the various descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed in this disclosure may be applied to various fields requiring wireless communication / connectivity (e.g., 5G) between devices.

[0060] Hereinafter, more specific examples will be provided with reference to the drawings. In the drawings / descriptions below, the same drawing reference numerals may represent identical or corresponding hardware blocks, software blocks, or functional blocks, unless otherwise described.

[0061] FIG. 1 is a diagram illustrating an example of a communication system applicable to the present disclosure. Referring to FIG. 1, a communication system (100) applicable to the present disclosure includes a wireless device, a base station, and a network. Here, the wireless device refers to a device that performs communication using a wireless access technology (e.g., 5G NR, LTE) and may be referred to as a communication / wireless / 5G device. Although not limited thereto, the wireless device may include a robot (100a), a vehicle (100b-1, 100b-2), an XR (extended reality) device (100c), a hand-held device (100d), a home appliance (100e), an IoT (Internet of Things) device (100f), and an AI (artificial intelligence) device / server (100g). For example, the vehicle may include a vehicle equipped with a wireless communication function, an autonomous vehicle, a vehicle capable of performing vehicle-to-vehicle communication, etc. Here, the vehicles (100b-1, 100b-2) may include unmanned aerial vehicles (UAVs) (e.g., drones). The XR devices (100c) include augmented reality (AR) / virtual reality (VR) / mixed reality (MR) devices, and may be implemented in the form of head-mounted devices (HMDs), head-up displays (HUDs) installed in vehicles, televisions, smartphones, computers, wearable devices, home appliances, digital signage, vehicles, robots, etc. The portable devices (100d) may include smartphones, smart pads, wearable devices (e.g., smartwatches, smart glasses), computers (e.g., laptops, etc.), etc. The home appliances (100e) may include TVs, refrigerators, washing machines, etc. The IoT devices (100f) may include sensors, smart meters, etc.For example, the base station (120) and the network (130) may also be implemented as wireless devices, and a specific wireless device (120a) may act as a base station / network node to other wireless devices.

[0062] Wireless devices (100a to 100f) can be connected to a network (130) via a base station (120). AI technology can be applied to the wireless devices (100a to 100f), and the wireless devices (100a to 100f) can be connected to an AI server (100g) via a network (130). The network (130) can be configured using a 3G network, a 4G (e.g., LTE) network, a 5G (e.g., NR) network, etc. The wireless devices (100a to 100f) can communicate with each other via the base station (120) / network (130), but can also communicate directly (e.g., sidelink communication) without going through the base station (120) / network (130). For example, vehicles (100b-1, 100b-2) can communicate directly (e.g., V2V (vehicle to vehicle) / V2X (vehicle to everything) communication). In addition, IoT devices (100f) (e.g., sensors) can communicate directly with other IoT devices (e.g., sensors) or other wireless devices (100a to 100f).

[0063] Wireless communication / connection (150a, 150b, 150c) can be established between wireless devices (100a to 100f) / base stations (120), and base stations (120) / base stations (120). Here, the wireless communication / connection can be established through various wireless access technologies (e.g., 5G NR) such as uplink / downlink communication (150a), sidelink communication (150b) (or D2D communication), and base station-to-base station communication (150c) (e.g., relay, IAB (integrated access backhaul)). Through the wireless communication / connection (150a, 150b, 150c), the wireless device and base station / wireless device, and base stations and base stations can transmit / receive wireless signals to / from each other. For example, the wireless communication / connection (150a, 150b, 150c) can transmit / receive signals through various physical channels. To this end, based on various proposals of the present disclosure, at least some of various configuration information setting processes for transmitting / receiving wireless signals, various signal processing processes (e.g., channel encoding / decoding, modulation / demodulation, resource mapping / demapping, etc.), resource allocation processes, etc. may be performed.

[0064]

[0065] Wireless devices applicable to the present disclosure

[0066] FIG. 2 is a diagram illustrating an example of a wireless device applicable to the present disclosure.

[0067] Referring to FIG. 2, the first wireless device (200a) and the second wireless device (200b) can transmit and receive wireless signals via various wireless access technologies (e.g., LTE, NR). Here, {the first wireless device (200a), the second wireless device (200b)} can correspond to {the wireless device (100x), the base station (120)} and / or {the wireless device (100x), the wireless device (100x)} of FIG. 1.

[0068] A first wireless device (200a) includes one or more processors (202a) and one or more memories (204a), and may further include one or more transceivers (206a) and / or one or more antennas (208a). The processor (202a) controls the memories (204a) and / or the transceivers (206a), and may be configured to implement the descriptions, functions, procedures, proposals, methods, and / or operational flowcharts disclosed in the present disclosure. For example, the processor (202a) may process information in the memories (204a) to generate first information / signals, and then transmit a wireless signal including the first information / signals via the transceivers (206a). In addition, the processor (202a) may receive a wireless signal including second information / signals via the transceivers (206a), and then store information obtained from signal processing of the second information / signals in the memory (204a). The memory (204a) may be connected to the processor (202a) and may store various information related to the operation of the processor (202a). For example, the memory (204a) may perform some or all of the processes controlled by the processor (202a), or may store software code including instructions for performing the descriptions, functions, procedures, proposals, methods, and / or operational flowcharts disclosed in the present disclosure. Here, the processor (202a) and the memory (204a) may be part of a communication modem / circuit / chip designed to implement wireless communication technology (e.g., LTE, NR). The transceiver (206a) may be connected to the processor (202a) and may transmit and / or receive wireless signals via one or more antennas (208a). The transceiver (206a) may include a transmitter and / or a receiver. The transceiver (206a) may be used interchangeably with an RF (radio frequency) unit. In the present disclosure, a wireless device may also mean a communication modem / circuit / chip.

[0069] The second wireless device (200b) includes one or more processors (202b), one or more memories (204b), and may further include one or more transceivers (206b) and / or one or more antennas (208b). The processor (202b) controls the memories (204b) and / or the transceivers (206b), and may be configured to implement the descriptions, functions, procedures, proposals, methods, and / or operational flowcharts disclosed in the present disclosure. For example, the processor (202b) may process information in the memory (204b) to generate third information / signals, and then transmit a wireless signal including the third information / signals via the transceivers (206b). In addition, the processor (202b) may receive a wireless signal including fourth information / signals via the transceivers (206b), and then store information obtained from signal processing of the fourth information / signals in the memory (204b). The memory (204b) may be connected to the processor (202b) and may store various information related to the operation of the processor (202b). For example, the memory (204b) may perform some or all of the processes controlled by the processor (202b), or may store software code including commands for performing the descriptions, functions, procedures, proposals, methods, and / or operational flowcharts disclosed in the present disclosure. Here, the processor (202b) and the memory (204b) may be part of a communication modem / circuit / chip designed to implement wireless communication technology (e.g., LTE, NR). The transceiver (206b) may be connected to the processor (202b) and may transmit and / or receive wireless signals via one or more antennas (208b). The transceiver (206b) may include a transmitter and / or a receiver. The transceiver (206b) may be used interchangeably with an RF unit. In the present disclosure, a wireless device may also mean a communication modem / circuit / chip.

[0070] Hereinafter, hardware elements of the wireless device (200a, 200b) will be described in more detail. Although not limited thereto, one or more protocol layers may be implemented by one or more processors (202a, 202b). For example, one or more processors (202a, 202b) may implement one or more layers (e.g., functional layers such as physical (PHY), media access control (MAC), radio link control (RLC), packet data convergence protocol (PDCP), radio resource control (RRC), and service data adaptation protocol (SDAP)). One or more processors (202a, 202b) may generate one or more Protocol Data Units (PDUs) and / or one or more Service Data Units (SDUs) according to the descriptions, functions, procedures, proposals, methods, and / or operational flowcharts disclosed in the present disclosure. One or more processors (202a, 202b) may generate messages, control information, data or information according to the descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed in this disclosure. One or more processors (202a, 202b) may generate signals (e.g., baseband signals) including PDUs, SDUs, messages, control information, data or information according to the functions, procedures, proposals and / or methods disclosed in this disclosure, and provide the signals to one or more transceivers (206a, 206b). One or more processors (202a, 202b) may receive signals (e.g., baseband signals) from one or more transceivers (206a, 206b) and obtain PDUs, SDUs, messages, control information, data or information according to the descriptions, functions, procedures, proposals, methods and / or operational flowcharts disclosed in this disclosure.

[0071] One or more processors (202a, 202b) may be referred to as a controller, a microcontroller, a microprocessor, or a microcomputer. One or more processors (202a, 202b) may be implemented by hardware, firmware, software, or a combination thereof. For example, one or more application specific integrated circuits (ASICs), one or more digital signal processors (DSPs), one or more digital signal processing devices (DSPDs), one or more programmable logic devices (PLDs), or one or more field programmable gate arrays (FPGAs) may be included in one or more processors (202a, 202b). The descriptions, functions, procedures, proposals, methods, and / or operational flowcharts disclosed in this disclosure may be implemented using firmware or software, and the firmware or software may be implemented to include modules, procedures, functions, etc. The descriptions, functions, procedures, proposals, methods and / or operation flowcharts disclosed in this disclosure may be implemented using firmware or software configured to perform one or more processors (202a, 202b) or stored in one or more memories (204a, 204b) and driven by one or more processors (202a, 202b). The descriptions, functions, procedures, proposals, methods and / or operation flowcharts disclosed in this disclosure may be implemented using firmware or software in the form of codes, instructions and / or sets of instructions.

[0072] One or more memories (204a, 204b) may be coupled to one or more processors (202a, 202b) and may store various forms of data, signals, messages, information, programs, codes, instructions, and / or commands. The one or more memories (204a, 204b) may be configured as read only memory (ROM), random access memory (RAM), erasable programmable read only memory (EPROM), flash memory, hard drives, registers, cache memory, computer readable storage media, and / or combinations thereof. The one or more memories (204a, 204b) may be located internally and / or externally to the one or more processors (202a, 202b). Additionally, the one or more memories (204a, 204b) may be coupled to the one or more processors (202a, 202b) via various technologies, such as wired or wireless connections.

[0073] One or more transceivers (206a, 206b) can transmit user data, control information, wireless signals / channels, etc., as mentioned in the methods and / or flowcharts of the present disclosure, to one or more other devices. One or more transceivers (206a, 206b) can receive user data, control information, wireless signals / channels, etc., as mentioned in the descriptions, functions, procedures, proposals, methods and / or flowcharts of the present disclosure, from one or more other devices. For example, one or more transceivers (206a, 206b) can be coupled to one or more processors (202a, 202b) and can transmit and receive wireless signals. For example, one or more processors (202a, 202b) can control one or more transceivers (206a, 206b) to transmit user data, control information, or wireless signals to one or more other devices. Additionally, one or more processors (202a, 202b) may control one or more transceivers (206a, 206b) to receive user data, control information, or wireless signals from one or more other devices. Additionally, one or more transceivers (206a, 206b) may be coupled to one or more antennas (208a, 208b), and one or more transceivers (206a, 206b) may be configured to transmit and receive user data, control information, wireless signals / channels, or the like, as referred to in the descriptions, functions, procedures, proposals, methods, and / or operational flowcharts disclosed in this disclosure, via one or more antennas (208a, 208b). In the present disclosure, one or more antennas may be multiple physical antennas or multiple logical antennas (e.g., antenna ports). One or more transceivers (206a, 206b) can convert received user data, control information, wireless signals / channels, etc. from RF band signals to baseband signals in order to process the received user data, control information, wireless signals / channels, etc. using one or more processors (202a, 202b).One or more transceivers (206a, 206b) may convert user data, control information, wireless signals / channels, etc. processed by one or more processors (202a, 202b) from baseband signals to RF band signals. For this purpose, one or more transceivers (206a, 206b) may include an (analog) oscillator and / or filter.

[0074] FIG. 3 is a diagram illustrating a method for processing a transmission signal applied to the present disclosure. For example, the transmission signal may be processed by a signal processing circuit. At this time, the signal processing circuit (300) may include a scrambler (310), a modulator (320), a layer mapper (330), a precoder (340), a resource mapper (350), and a signal generator (360). At this time, as an example, the operations / functions of FIG. 3 may be performed in the processors (202a, 202b) and / or the transceivers (206a, 206b) of FIG. 2. Furthermore, as an example, the hardware elements of FIG. 3 may be implemented in the processors (202a, 202b) and / or the transceivers (206a, 206b) of FIG. 2. For example, blocks 310 to 350 may be implemented in the processor (202a, 202b) of FIG. 2, and block 360 may be implemented in the transceiver (206a, 206b) of FIG. 2, and are not limited to the above-described embodiments.

[0075] The codeword can be converted into a wireless signal through the signal processing circuit (300) of FIG. 3. Here, the codeword is an encoded bit sequence of an information block. The information block may include a transport block (e.g., a UL-SCH transport block, a DL-SCH transport block). The wireless signal may be transmitted through various physical channels (e.g., a PUSCH, a PDSCH) of FIG. 6. Specifically, the codeword can be converted into a bit sequence scrambled by a scrambler (310). The scramble sequence used for scrambling is generated based on an initialization value, and the initialization value may include ID information of the wireless device, etc. The scrambled bit sequence can be modulated into a modulation symbol sequence by a modulator (320). The modulation scheme may include pi / 2-binary phase shift keying (pi / 2-BPSK), m-phase shift keying (m-PSK), m-quadrature amplitude modulation (m-QAM), etc.

[0076] A complex modulation symbol sequence can be mapped to one or more transmission layers by a layer mapper (330). The modulation symbols of each transmission layer can be mapped to the corresponding antenna port(s) by a precoder (340) (precoding). The output z of the precoder (340) can be obtained by multiplying the output y of the layer mapper (330) by an N*M precoding matrix W. Here, N is the number of antenna ports, and M is the number of transmission layers. Here, the precoder (340) can perform precoding after performing transform precoding (e.g., discrete Fourier transform (DFT) transform) on the complex modulation symbols. In addition, the precoder (340) can perform precoding without performing transform precoding.

[0077] The resource mapper (350) can map modulation symbols of each antenna port to time-frequency resources. The time-frequency resources can include multiple symbols (e.g., CP-OFDMA symbols, DFT-s-OFDMA symbols) in the time domain and multiple subcarriers in the frequency domain. The signal generator (360) generates a wireless signal from the mapped modulation symbols, and the generated wireless signal can be transmitted to another device through each antenna. To this end, the signal generator (360) can include an inverse fast Fourier transform (IFFT) module, a cyclic prefix (CP) inserter, a digital-to-analog converter (DAC), a frequency uplink converter, and the like.

[0078] The signal processing process for receiving signals in a wireless device can be configured in reverse order of the signal processing process (310-360) of FIG. 3. For example, a wireless device (e.g., 200a, 200b of FIG. 2) can receive wireless signals from the outside through an antenna port / transceiver. The received wireless signals can be converted into baseband signals through a signal restorer. For this purpose, the signal restorer can include a frequency downlink converter, an analog-to-digital converter (ADC), a CP remover, and a fast Fourier transform (FFT) module. Thereafter, the baseband signal can be restored to a codeword through a resource demapper process, a postcoding process, a demodulation process, and a descrambling process. The codewords can be restored to the original information blocks through decoding. Accordingly, a signal processing circuit (not shown) for a received signal may include a signal restorer, a resource de-mapper, a postcoder, a demodulator, a de-scrambler, and a decoder.

[0079] Wireless device structure applicable to the present disclosure

[0080] FIG. 4 is a diagram illustrating another example of a wireless device applicable to the present disclosure.

[0081] Referring to FIG. 4, the wireless device (400) corresponds to the wireless devices (200a, 200b) of FIG. 2 and may be composed of various elements, components, units, and / or modules. For example, the wireless device (400) may include a communication unit (410), a control unit (420), a memory unit (430), and additional elements (440). The communication unit may include a communication circuit (412) and a transceiver(s) (414). For example, the communication circuit (412) may include one or more processors (202a, 202b) and / or one or more memories (204a, 204b) of FIG. 2. For example, the transceiver(s) (414) may include one or more transceivers (206a, 206b) and / or one or more antennas (208a, 208b) of FIG. 2. The control unit (420) is electrically connected to the communication unit (410), the memory unit (430), and the additional elements (440) and controls the overall operation of the wireless device. For example, the control unit (420) may control the electrical / mechanical operation of the wireless device based on the program / code / command / information stored in the memory unit (430). In addition, the control unit (420) may transmit information stored in the memory unit (430) to an external device (e.g., another communication device) via a wireless / wired interface through the communication unit (410), or store information received from an external device (e.g., another communication device) via a wireless / wired interface in the memory unit (430).

[0082] The additional element (440) may be configured in various ways depending on the type of the wireless device. For example, the additional element (440) may include at least one of a power unit / battery, an input / output unit, a driving unit, and a computing unit. Although not limited thereto, the wireless device (400) may be implemented in the form of a robot (Fig. 1, 100a), a vehicle (Fig. 1, 100b-1, 100b-2), an XR device (Fig. 1, 100c), a portable device (Fig. 1, 100d), a home appliance (Fig. 1, 100e), an IoT device (Fig. 1, 100f), a digital broadcasting terminal, a hologram device, a public safety device, an MTC device, a medical device, a fintech device (or a financial device), a security device, a climate / environmental device, an AI server / device (Fig. 1, 140), a base station (Fig. 1, 120), a network node, etc. Wireless devices may be mobile or stationary depending on the use / service.

[0083] In FIG. 4, various elements, components, units / parts, and / or modules within the wireless device (400) may be entirely interconnected via a wired interface, or at least some may be wirelessly connected via a communication unit (410). For example, within the wireless device (400), the control unit (420) and the communication unit (410) may be wired, and the control unit (420) and a first unit (e.g., 430, 440) may be wirelessly connected via the communication unit (410). In addition, each element, component, unit / part, and / or module within the wireless device (400) may further include one or more elements. For example, the control unit (420) may be composed of a set of one or more processors. For example, the control unit (420) may be composed of a set of a communication control processor, an application processor, an electronic control unit (ECU), a graphics processing processor, a memory control processor, etc. As another example, the memory unit (430) may be composed of RAM, DRAM (dynamic RAM), ROM, flash memory, volatile memory, non-volatile memory, and / or a combination thereof.

[0084] Mobile devices to which the present disclosure applies

[0085] FIG. 5 is a drawing illustrating an example of a mobile device applied to the present disclosure.

[0086] Figure 5 illustrates an example of a mobile device applicable to the present disclosure. The mobile device may include a smartphone, a smart pad, a wearable device (e.g., a smart watch, smart glasses), or a portable computer (e.g., a laptop, etc.). The mobile device may be referred to as a mobile station (MS), a user terminal (UT), a mobile subscriber station (MSS), a subscriber station (SS), an advanced mobile station (AMS), or a wireless terminal (WT).

[0087] Referring to FIG. 5, the portable device (500) may include an antenna unit (508), a communication unit (510), a control unit (520), a memory unit (530), a power supply unit (540a), an interface unit (540b), and an input / output unit (540c). The antenna unit (508) may be configured as a part of the communication unit (510). Blocks 510 to 530 / 540a to 540c correspond to blocks 410 to 430 / 440 of FIG. 4, respectively.

[0088] The communication unit (510) can transmit and receive signals (e.g., data, control signals, etc.) with other wireless devices and base stations. The control unit (520) can control components of the portable device (500) to perform various operations. The control unit (520) can include an AP (application processor). The memory unit (530) can store data / parameters / programs / codes / commands required for operating the portable device (500). In addition, the memory unit (530) can store input / output data / information, etc. The power supply unit (540a) supplies power to the portable device (500) and can include a wired / wireless charging circuit, a battery, etc. The interface unit (540b) can support connection between the portable device (500) and other external devices. The interface unit (540b) can include various ports (e.g., audio input / output ports, video input / output ports) for connection with external devices. The input / output unit (540c) can input or output video information / signals, audio information / signals, data, and / or information input from a user. The input / output unit (540c) may include a camera, a microphone, a user input unit, a display unit (540d), a speaker, and / or a haptic module.

[0089] For example, in the case of data communication, the input / output unit (540c) obtains information / signals (e.g., touch, text, voice, image, video) input by the user, and the obtained information / signals can be stored in the memory unit (530). The communication unit (510) can convert the information / signals stored in the memory into wireless signals, and transmit the converted wireless signals directly to other wireless devices or to a base station. In addition, the communication unit (510) can receive wireless signals from other wireless devices or base stations, and then restore the received wireless signals to the original information / signals. The restored information / signals can be stored in the memory unit (530) and then output in various forms (e.g., text, voice, image, video, haptic) through the input / output unit (540c).

[0090] Physical channels and general signal transmission

[0091] In a wireless access system, a terminal can receive information from a base station via the downlink (DL) and transmit it to the base station via the uplink (UL). The information transmitted and received between the base station and the terminal includes general data and various control information, and various physical channels exist depending on the type and purpose of the information being transmitted and received.

[0092] FIG. 6 is a diagram illustrating physical channels applicable to the present disclosure and a signal transmission method using the same.

[0093] When a terminal is powered on again from a powered-off state or newly enters a cell, it performs an initial cell search operation, such as synchronizing with the base station, in step S611. To this end, the terminal receives a primary synchronization channel (P-SCH) and a secondary synchronization channel (S-SCH) from the base station to synchronize with the base station and obtain information such as the cell ID.

[0094] After that, the terminal can obtain broadcast information within the cell by receiving a physical broadcast channel (PBCH) signal from the base station. Meanwhile, the terminal can check the downlink channel status by receiving a downlink reference signal (DL RS) in the initial cell search phase. After completing the initial cell search, the terminal can obtain more specific system information by receiving a physical downlink control channel (PDCCH) and a physical downlink shared channel (PDSCH) based on the physical downlink control channel information in step S612.

[0095] Thereafter, the terminal may perform a random access procedure such as steps S613 to S616 to complete connection to the base station. To this end, the terminal may transmit a preamble through a physical random access channel (PRACH) (S613) and receive a random access response (RAR) for the preamble through a physical downlink control channel and a physical downlink shared channel corresponding thereto (S614). The terminal may transmit a physical uplink shared channel (PUSCH) using scheduling information in the RAR (S615) and perform a contention resolution procedure such as receiving a physical downlink control channel signal and a physical downlink shared channel signal corresponding thereto (S616).

[0096] A terminal that has performed the procedure described above can then perform reception of a physical downlink control channel signal and / or a physical downlink shared channel signal (S617) and transmission of a physical uplink shared channel (PUSCH) signal and / or a physical uplink control channel (PUCCH) signal (S618) as a general uplink / downlink signal transmission procedure.

[0097] Control information transmitted from a terminal to a base station is collectively referred to as uplink control information (UCI). UCI includes hybrid automatic repeat and request acknowledgment / negative ACK (HARQ-ACK / NACK), scheduling request (SR), channel quality indication (CQI), precoding matrix indication (PMI), rank indication (RI), and beam indication (BI) information. UCI is generally transmitted periodically through PUCCH, but depending on the embodiment (e.g., when control information and traffic data must be transmitted simultaneously), it may be transmitted through PUSCH. In addition, the terminal may transmit UCI aperiodically through PUSCH upon request / instruction from the network.

[0098] FIG. 7 is a diagram illustrating the structure of a wireless frame applicable to the present disclosure.

[0099] Uplink and downlink transmissions based on the NR system can be based on frames such as those in FIG. 7. At this time, one radio frame has a length of 10 ms and can be defined as two 5 ms half-frames (HF). One half-frame can be defined as five 1 ms subframes (SF). One subframe is divided into one or more slots, and the number of slots within a subframe can depend on the subcarrier spacing (SCS). At this time, each slot can contain 12 or 14 OFDM (A) symbols depending on the cyclic prefix (CP). When a normal CP is used, each slot can contain 14 symbols. When an extended CP is used, each slot can contain 12 symbols. Here, the symbol may include an OFDM symbol (or CP-OFDM symbol), an SC-FDMA symbol (or DFT-s-OFDM symbol).

[0100] Table 1 shows the number of symbols per slot, the number of slots per frame, and the number of slots per subframe according to SCS when a general CP is used, and Table 2 shows the number of symbols per slot, the number of slots per frame, and the number of slots per subframe according to SCS when an extended CSP is used.

[0101] μN slot symb N frame,μ slot N subframe,μ slot 0141011142022144043148084141601651432021

[0102] μN slot symb N frame,μ slot N subframe,μ slot 212404

[0103] In the above Tables 1 and 2, Nslotsymb may represent the number of symbols in a slot, Nframe,μslot may represent the number of slots in a frame, and Nsubframe,μslot may represent the number of slots in a subframe.

[0104] Additionally, in a system to which the present disclosure is applicable, OFDM(A) numerologies (e.g., SCS, CP length, etc.) may be set differently between multiple cells merged into a single terminal. Accordingly, the (absolute time) interval of a time resource (e.g., SF, slot, or TTI) (conveniently referred to as a TU (time unit)) consisting of the same number of symbols may be set differently between the merged cells.

[0105] NR can support multiple numerologies (or subcarrier spacing (SCS)) to support various 5G services. For example, a 15 kHz SCS supports wide areas in traditional cellular bands; a 30 kHz / 60 kHz SCS supports dense urban areas, lower latency, and wider carrier bandwidth; and a 60 kHz or higher SCS can support bandwidths greater than 24.25 GHz to overcome phase noise.

[0106] The NR frequency band is defined by two types of frequency ranges (FR1 and FR2). FR1 and FR2 can be configured as shown in the table below. FR2 can also refer to millimeter wave (mmW).

[0107] Frequency Range designationCorresponding frequency rangeSubcarrier Spacing (SCS)FR1410MHz - 7125MHz15, 30, 60kHzFR224250MHz - 52600MHz60, 120, 240kHz

[0108] Additionally, for example, the numerology described above may be set differently in a communication system to which the present disclosure is applicable. For example, a terahertz wave (THz) band may be used as a frequency band higher than the FR2 described above. In the THz band, the SCS may be set to be larger than in the NR system, and the number of slots may also be set differently, and the present invention is not limited to the above-described embodiment.

[0109] FIG. 8 is a drawing illustrating a slot structure applicable to the present disclosure.

[0110] A single slot contains multiple symbols in the time domain. For example, a slot contains seven symbols in a regular CP, but a slot may contain six symbols in an extended CP. A carrier contains multiple subcarriers in the frequency domain. A Resource Block (RB) can be defined as multiple (e.g., 12) consecutive subcarriers in the frequency domain.

[0111] Additionally, a Bandwidth Part (BWP) is defined as multiple consecutive (P)RBs in the frequency domain, and can correspond to one numerology (e.g., SCS, CP length, etc.).

[0112] A carrier can contain up to N (e.g., 5) BWPs. Data communication is performed through an activated BWP, and only one BWP can be activated per terminal. Each element in the resource grid is referred to as a Resource Element (RE), to which a single complex symbol can be mapped.

[0113] 6G communication system

[0114] The 6G (wireless communication) system aims to achieve (i) very high data rates per device, (ii) a very large number of connected devices, (iii) global connectivity, (iv) very low latency, (v) low energy consumption for battery-free IoT devices, (vi) ultra-reliable connectivity, and (vii) connected intelligence with machine learning capabilities. The vision of the 6G system can be divided into four aspects: "intelligent connectivity," "deep connectivity," "holographic connectivity," and "ubiquitous connectivity," and the 6G system can satisfy the requirements as shown in Table 4 below. In other words, Table 4 is a table showing the requirements of the 6G system.

[0115] Per device peak data rate1TbpsE2E latency1msMaximum spectral efficiency100bps / HzMobility supportUp to 1000km / hrSatellite integrationFullyAIFullyAutonomous vehicleFullyXRFullyHaptic CommunicationFully

[0116] At this time, the 6G system may have key factors such as enhanced mobile broadband (eMBB), ultra-reliable low latency communications (URLLC), massive machine type communications (mMTC), AI integrated communication, tactile internet, high throughput, high network capacity, high energy efficiency, low backhaul and access network congestion, and enhanced data security.

[0117] FIG. 9 is a diagram illustrating an example of a communication structure that can be provided in a 6G system applicable to the present disclosure.

[0118] Referring to Figure 9, 6G systems are expected to have 50 times higher simultaneous wireless communication connectivity than 5G wireless communication systems. URLLC, a key feature of 5G, is expected to become a more prominent technology in 6G communications by providing end-to-end latency of less than 1 ms. Furthermore, 6G systems will have significantly better volumetric spectral efficiency, unlike the commonly used area spectral efficiency. 6G systems can offer extremely long battery life and advanced battery technologies for energy harvesting, eliminating the need for separate charging for mobile devices in 6G systems. Furthermore, new network characteristics in 6G may include:

[0119] - Satellite integrated network: 6G is expected to integrate with satellites to provide a global mobile network. The integration of terrestrial, satellite, and airborne networks into a single wireless communications system could be crucial for 6G.

[0120] Connected Intelligence: Unlike previous generations of wireless communication systems, 6G is revolutionary, upgrading the wireless evolution from "connected objects" to "connected intelligence." AI can be applied at every stage of the communication process (or at every signal processing step, as described below).

[0121] - Seamless integration of wireless information and energy transfer: 6G wireless networks will transfer power to charge the batteries of devices such as smartphones and sensors. Therefore, wireless information and energy transfer (WIET) will be integrated.

[0122] - Ubiquitous super 3-dimension connectivity: Access to networks and core network functions from drones and very low Earth orbit satellites will create super 3-dimension connectivity in 6G ubiquitous.

[0123] Some general requirements for the new network characteristics of 6G, such as the above, may be as follows:

[0124] - Small cell networks: The concept of small cell networks was introduced to improve received signal quality in cellular systems by increasing throughput, energy efficiency, and spectral efficiency. Consequently, small cell networks are essential for 5G and beyond-5G (5GB) communication systems. Accordingly, 6G communication systems also adopt the characteristics of small cell networks.

[0125] Ultra-dense heterogeneous networks: Ultra-dense heterogeneous networks will be another key feature of 6G communication systems. Multi-tier networks comprised of heterogeneous networks improve overall QoS and reduce costs.

[0126] High-capacity backhaul: Backhaul connections are characterized by high-capacity backhaul networks to support high-volume traffic. High-speed fiber optics and free-space optics (FSO) systems may be potential solutions to this problem.

[0127] - Radar technology integrated with mobile technology: High-precision localization (or location-based services) through communications is a key feature of 6G wireless communication systems. Therefore, radar systems will be integrated with 6G networks.

[0128] - Softwarization and virtualization: Softwarization and virtualization are two critical features that form the foundation of the design process for 5GB networks to ensure flexibility, reconfigurability, and programmability. Furthermore, billions of devices can be shared on a shared physical infrastructure.

[0129] Quantum communication

[0130] Quantum communication is a next-generation communication technology that applies quantum mechanical properties to the field of information and communication, overcoming limitations of existing information and communication technologies, such as security and ultra-high-speed computation. Quantum communication provides a means to generate, transmit, process, and store information that cannot be expressed in the binary bits of 0 and 1 used in existing communication technologies, or that are difficult to express. Unlike existing communication technologies, which use wavelength or amplitude to transmit information between a transmitter and receiver, quantum communication utilizes photons, the smallest unit of light, to transmit information between the transmitter and receiver. In particular, quantum communication utilizes quantum uncertainty, quantum irreversibility, and non-cloning properties to account for the polarization and phase difference of photons (light), enabling perfectly secure communication. Furthermore, under certain conditions, quantum communication may also enable ultra-high-speed communication by exploiting quantum entanglement.

[0131] homomorphic encryption

[0132] Homomorphic encryption refers to an encryption method that allows calculations on encrypted data without decrypting it. In this case, the result of the calculation in the encrypted state is also in an encrypted format, and the plaintext obtained by decrypting it is the same as the result of the calculation between the data before the ciphertext used in the calculation was encrypted. For example, if the ciphertext encrypted with a secret key k using a homomorphic encryption E for the multiplication operation (*) on the plaintext m1 and m2, which are the data to be encrypted, is Ek(m1) and Ek(m2), the homomorphic encryption satisfies Ek(m1*m2) = Ek(m1)*Ek(m2). In other words, homomorphism implies that the result of the calculation in the encrypted state is the same as the result encrypted after the calculation. Homomorphic encryption can be broadly classified into four types: Partially Homomorphic Encryption (PHE), Somewhat Homomorphic Encryption (SHE), Leveled Fully Homomorphic Encryption, and Fully Homomorphic Encryption (FHE). PHE refers to an encryption that allows only addition or multiplication, while SHE is an encryption that allows both addition and multiplication. Leveled FHE allows addition and multiplication, but the number of operations is limited. Finally, FHE allows addition and multiplication, and there is no limit to the number of operations. Most of them are based on mathematically difficult problems defined on a lattice.

[0133] Typically, in cloud computing, data encryption using symmetric key algorithms allows for fast encryption and efficient data storage. However, when performing computations on encrypted data in cloud computing, the encrypted data must be decrypted, then computed, and then re-encrypted. This decryption process requires the cloud server to know the individual's private key. If the cloud server does not know the individual's private key, the individual must download and decrypt their data, which can be problematic. Homomorphic encryption, on the other hand, has the disadvantage of being slow, but it allows for computations while safely protecting information. It is primarily used in cloud services that require personal information security, and can be utilized in areas such as big data analysis and cryptocurrencies.

[0134] A representative example of homomorphic encryption applied to communication is a multiparty communication method based on homomorphic encryption. To facilitate understanding of the method proposed in this disclosure, the general concept of multiparty communication and existing encryption methods for multiparty communication are described below with reference to Figure 10.

[0135] Figure 10 illustrates an example of multi-party communication. More specifically, Figure 10 relates to an end-to-end encrypted VoIP teleconferencing technology that addresses high-level design goals. In Figure 10, each client (1010 / 1020 / 1030 / 1040) samples, encodes, and encrypts a user's voice data, and then sends the encrypted VoIP data stream to a VoIP mixer on a server. The mixer then sends a return stream of encrypted VoIP data, which is then decrypted and decoded by the client and played back to the client user. Any encryption system that supports additional homomorphism can be implemented. In Figure 10, the focus is on using a shared secret key, and in addition to not using multiplicative homomorphism, no public key functionality is used. The client's input voice stream is sampled and homomorphically encrypted using the shared secret key. The encrypted voice samples are transmitted to a SIPHER-enabled VoIP server that does not have access to the encryption key. The VoIP server combines and balances the encrypted audio feeds. The combined output is transmitted to the client handset, where it is decrypted and played back to the user. The processed results are sent to the client and decrypted using the client's private key. Since the key is not stored on the remote conferencing server, privacy is protected even if an attacker views all communication links and operations on the server.

[0136] Below, before explaining the communication method based on homomorphic encryption proposed in the present disclosure, symmetric key encryption is explained to help understand the method proposed in the present disclosure.

[0137] <Information related to the present invention>

[0138] Symmetric key encryption

[0139] Symmetric key cryptography refers to cryptography that uses the same secret key for both encryption and decryption. Compared to public key cryptography, where the key required for encryption is public and the key required for decryption is private, symmetric key cryptography has the disadvantage of requiring a key-sharing process between the sender and receiver. However, it is much faster in data calculations than public key cryptography, so symmetric key cryptography is used in actual data encryption processes, and public key cryptography can be utilized in key-sharing processes, etc.

[0140] To be more specific about symmetric key cryptography, symmetric key cryptography is generally composed of a form in which a fixed round function is repeated multiple times, and each of the round functions is composed of a nonlinear layer that complexly mixes (scrambles) some bits of the input data for the encryption process using an S(substitution)-box, and a linear layer that widely spreads (expands) some of the complexly mixed (scrambled) bits throughout the entire input data. Here, the complexity of the nonlinear layer can be an important factor in determining the security of the symmetric key cryptography algorithm. Increasing the number of rounds (the number of rounds) of the round function can strengthen the security of the algorithm, but conversely, the computational time required for data encryption can increase, which can lower the overall efficiency. The S-box is a component that makes up a block cipher, and can be understood as a public nonlinear function in which the relationship between the input and the output is defined as a table or mathematical relationship. More specifically, rather than the S-box itself having the ability to 'encrypt' data, the data can be encrypted when the value generated by relating the plaintext and the secret key during the encryption function calculation process is input to the S-box. The input and output sizes do not have to be the same. More specifically, when the input is n bits and the output is m, n and m do not have to be the same. In addition, the S-box can be understood as a substitution cipher in which the relationship between the input and output values ​​is defined by a table or a mathematical relationship. The S-box may or may not have an inverse function, and the S-box with an inverse function has the same size of the input bits and output bits. The types of operations used in the S-box can include substitution, exclusive-OR, shift, swap, split, and combine, and the above types of operations can be used to encrypt the input data.

[0141] Symmetric key encryption with Feistel structure

[0142] Figure 11 is a diagram showing an example of a Feistel structure symmetric key cipher. The Feistel structure is one of the methods for designing symmetric key ciphers, and is the method used in DES (Data Encryption Standard), the first international standard cipher. As illustrated in Figure 11, the Feistel structure is a structure in which half of the internal state and a round key are input to a round function, and the result is added to the remaining state. In other words, the Feistel structure is based on a round function that is repeated at least once. In each round, a fixed nonlinear function f is applied to the round key ki and half of the entire data state, and the remaining half of the entire data state is added to the output value obtained here. 1110 in Figure 11 represents the first round in the Feistel structure, in which a fixed nonlinear function f is applied to the round key k1 and half of the entire data state (R0), and the remaining half of the entire data state (L0) is added to the output value obtained here. In this process, a structure that divides the internal state into different sizes, rather than dividing it exactly in half, and uses these divided internal states as the input and output sizes of the round function can be called an unbalanced Feistel structure. Furthermore, a structure that divides the internal state into multiple branches can be called a generalized Feistel structure.

[0143] Homomorphic Encryption-Symmetric Key Encryption Hybrid Framework

[0144] As previously explained, homomorphic encryption is a type of encryption designed to allow computations on data without a secret key, even when the data is encrypted. Typically, communication based on homomorphic encryption is used as a form of public key encryption, where a client transmits data to a server and entrusts the server with the computation. More specifically, the client generates a homomorphic ciphertext of the data and transmits the generated homomorphic ciphertext to the server. The server then performs a homomorphic computation on the homomorphic ciphertext received from the client, performs the computation desired (entrusted) by the client, obtains the result of the homomorphic computation, and returns the obtained result of the homomorphic computation to the client. Next, the client can decrypt the homomorphic ciphertext received from the server to obtain the result of the computation on the plaintext data.

[0145] Hereinafter, a client can be understood as a terminal in a communication system, and a server can be understood as a base station / network in a communication system.

[0146] In the case of homomorphic encryption-based communication in the form of public key encryption as above (client-server scenario), if the client directly encrypts data using homomorphic encryption, the size of the homomorphic ciphertext inevitably increases due to the nature of homomorphic encryption, which causes ciphertext expansion to become larger than the original data. Furthermore, depending on the parameters being homomorphically encrypted, the size of the homomorphic ciphertext can increase by tens to hundreds of times compared to the original data, which not only significantly increases the amount of data transmitted from the client to the server, but also takes up a lot of storage space on the server if the server needs to store the homomorphic ciphertext data for a long time. To solve the above problem, the homomorphic encryption-symmetric key encryption hybrid framework of FIG. 11 can be used.

[0147] FIG. 12 is a diagram illustrating an example of a homomorphic encryption-symmetric key encryption hybrid framework. In the homomorphic encryption-symmetric key encryption hybrid framework, a client (1210) encrypts data using a symmetric key encryption and transmits it to a server (1220), and the server (1220) performs an operation to convert the encrypted symmetric key ciphertext into a homomorphic ciphertext using the symmetric key encryption. More specifically, referring to FIG. 12, the client (1210) first encrypts a secret key k for a symmetric key encryption E using homomorphic encryption and transmits EncHE(k) to the server (1220). Thereafter, the client (1210) encrypts data m using the symmetric key encryption E and the secret key k and transmits Ek(m) to the server (1220).

[0148] Thereafter, the server (1220) first calculates the homomorphic ciphertext EncHE(c) to obtain the homomorphic ciphertext EncHE(m) for data m from the symmetric key ciphertext c=Ek(m) received from the client (1210), and then performs the decryption operation E-1 of E as a homomorphic operation using EncHE(k) (EvalHE(E-1) in FIG. 12). In the homomorphic encryption-symmetric key encryption hybrid framework, the client (1210) only needs to transmit EncHE(k) to the server (1220) once until the secret key of the symmetric key encryption is changed. In addition to generating a homomorphic ciphertext for the secret key, the client (1210) transmits actual data in the form of a symmetric key ciphertext in which ciphertext expansion does not occur, so the amount of data transmitted by the client (1210) to the server (1220) may not increase.

[0149] Homomorphic encryption-friendly symmetric key encryption

[0150] For the hybrid framework described above to operate efficiently, homomorphic operations on symmetric-key cryptography must be efficiently performed. In other words, a symmetric-key cryptography E must be used that can efficiently compute EvalHE(E-1), as illustrated in Figure 11. While this may vary depending on the homomorphic encryption algorithm used, homomorphic operations are generally lightweight (requiring less computational resources) for linear operations such as addition and constant multiplication, while nonlinear operations such as multiplication require more computational resources.

[0151] Considering the characteristics of these homomorphic operations, a cipher that can be efficiently calculated through homomorphic operations is called a homomorphic encryption-friendly symmetric key cipher. Research related to homomorphic encryption-friendly symmetric key ciphers is continuously being conducted, and most of the existing research on homomorphic encryption-friendly symmetric key ciphers has been on homomorphic encryption algorithms that support addition and multiplication operations. As explained above, since multiplication operations consume more computational resources than addition operations, homomorphic encryption algorithm-friendly symmetric key ciphers that support addition and multiplication operations can be designed to have simple nonlinear layers and a small number of rounds. Homomorphic encryption algorithm-friendly symmetric key ciphers designed in this way have a problem of reducing the security of symmetric key ciphers. To solve this problem of reducing the security of symmetric key ciphers, a homomorphic encryption algorithm-friendly symmetric key cipher with a structure that randomly generates linear layers at each encryption process has been proposed. By designing the linear layer to be different for each encryption process, it is possible to defend against attack techniques that collect and analyze input / output data for the same function. In this case, the process of randomly generating the linear layer is performed publicly without information about the secret key, so it does not place a large burden on the process of calculating the symmetric key encryption using homomorphic operations.

[0152] Concrete homomorphic encryption algorithm

[0153] The Concrete homomorphic encryption algorithm is an extension of the TFHE algorithm, which supports bitwise operations. Concrete homomorphic encryption supports addition and table lookup operations, with table lookup operations being more computationally intensive than addition. The only Concrete-friendly symmetric-key cipher developed to date is the Elisabeth cipher.

[0154] In the Concrete homomorphic encryption algorithm, table reference operations can be performed through an operation called PBS (programmable bootstrapping), which is a process of removing noise from a ciphertext so that homomorphic operations can be continuously performed. In the case of the Concrete homomorphic encryption algorithm, the bootstrapping process not only removes noise, but also enables additional table reference operations for input values ​​of the ciphertext to be performed through the bootstrapping process. The table reference operation may refer to a homomorphic association performed by presetting a mapping relationship between an input value on which a homomorphic operation is performed and the result value (output value) of the homomorphic operation for the input value. That is, if a mapping relationship is set so that the result value (output value) of the homomorphic operation y1 corresponds to an input value x1, then when a homomorphic operation is performed on an input value x1, the result value of the homomorphic operation y1 can be obtained using the preset mapping relationship. Here, the preset mapping relationship may be a table.

[0155] The core of the PBS operation that enables table reference operations is the blind rotation operation. The blind rotation is an operation that, when a function to be calculated is given in the form of a table and an input value is given as ciphertext, allows the result of rotating the table by the input value to be obtained in the form of ciphertext without restoring the input value. More specifically, the blind rotation can be understood as an operation that, when the input value of a homomorphic operation is an encrypted value, obtains an encrypted result value corresponding to the input value of the homomorphic operation, which is an encrypted value, based on the preset mapping relationship (table) rotated by the input value of the homomorphic operation, which is the encrypted value, without decrypting the input value of the homomorphic operation, which is the encrypted value.

[0156] FIG. 13 is a diagram showing an example of how a PBS operation is performed. Referring to FIG. 13, in order to perform blind rotation, the ciphertext of the input value must be converted into a special form of ciphertext called GSW, and most of the time required for the PBS operation is used in the process of converting the ciphertext of the input value into GSW (Gentry-Sahai-Waters) ciphertext. In FIG. 13, 1310 represents a table for unencrypted input values. Referring to 1310, the output value corresponding to input value 0 is f(0), the output value corresponding to input value 1 is f(1), etc. Referring to FIG. 13, blind rotation (1330) can be performed to obtain f(x), which is an output value for ciphertext x for a specific input value. Blind rotation includes a GSW transform process to enable blind rotation. As a result of blind rotation on the table of 1310, a table of 1320 is obtained, which includes a mapping relationship between an encrypted input value to which blind rotation has been applied and output values ​​corresponding to the encrypted input value. By referring to the table of 1320, an output value f(x) for an input value x can be obtained, and at this time, sample extraction and key switching (1340) can be applied.

[0157] A homomorphic operation method using double blind rotation

[0158] The present disclosure proposes a homomorphic computation method using double-blind rotation. More specifically, the method proposed in the present disclosure can be a double-blind rotation method that can improve PBS computation efficiency when computing a specially structured unbalanced Feistel cipher using the Concrete homomorphic encryption algorithm, with the goal of designing a Concrete homomorphic encryption-friendly symmetric key cipher.

[0159] More specifically, the double blind rotation method proposed in the present disclosure is a method in which, when (x+y) is given as an input to a function f to be calculated, instead of calculating the GSW ciphertext of (x+y), the GSW ciphertext for x and the GSW ciphertext for y are separately calculated, and blind rotation is applied twice to calculate f(x+y). If double blind rotation is used, the number of times the GSW ciphertext transformation is performed increases from once to twice, which may be inefficient in general. However, the process of calculating a symmetric key cipher generally has a structure in which f(x+k) is calculated by taking as input the value of the current state x plus the round key k for the nonlinear function f, and since the round key k continues to use the same value until the key is updated, if the GSW transformation for the round key k is performed only once and stored in advance, the GSW ciphertext for which the GSW transformation for the round key k has been performed in advance can be continuously used in multiple encryption processes. In particular, such a double-blind rotation method can significantly increase computational efficiency in unbalanced Feistel structures where one state value is applied to multiple round functions.

[0160] Fig. 14 is a diagram showing another example of how a PBS operation is performed. More specifically, Fig. 14 relates to a method in which blind rotation is performed twice during a PBS operation. In Fig. 14, 1410 represents a table for unencrypted input values. Referring to 1410, an output value corresponding to input value 0 is f(0), an output value corresponding to input value 1 is f(1), etc. Referring to Fig. 14, a first blind rotation (1420) may be performed to obtain an output value f(x1) for ciphertext x1 for a specific input value. The first blind rotation includes a GSW transform process for the input value x1 to enable blind rotation. At this time, according to the double blind rotation method proposed in the present disclosure, the input value (x1+k j ) is not performed, but the first blind rotation (1420) is performed on x1 first, so that a table (1430) having the form of the table 1410 rotated by x1 is obtained. Next, the round key k j A second blind rotation (1440) is performed based on the input value k to enable the blind rotation. j It includes a GSW transform process for k, and the GSW transform is performed j The GSW ciphertext of can be precomputed and stored. As a result of the second blind rotation (1440), the table of 1430 is k j A table (1450) having a rotated shape is obtained. As a result, the table of 1450 is the table of 1410 (x1+k j ) has a rotated form, and the encrypted input value x1+k is referenced by the table of 1450. j The output value for the back is f(x1+k j ) can be obtained.

[0161] Double blind rotation method in unbalanced Feistel structures

[0162] As explained above, the double blind rotation method proposed in the present disclosure can be effective when applied to an unbalanced Feistel structure. Fig. 15 is a diagram showing an example of an unbalanced Feistel structure. Referring to Fig. 15, the unbalanced Feistel structure has an internal state of multiple branches (x1, x2, x3, …, x l ) and the round function has a common input branch. The unbalanced Feistel structure consists of at least one round, and in each of the at least one round, (i) common input data (x1) commonly used in the at least one round, and (ii) a round key (k) individually used in each of the at least one round. l -1) is input to and output from the round function of each of the at least one round, and in each of the at least one round, an individual input value (xl) used individually in each of the at least one round can be added to the output value of the round function of each of the at least one round and output.

[0163] Referring to Fig. 15, the execution method of the first round is described. In the round, the common input data (x1) (1511) and the round key (k1) (1513) used in the round are input to the round function (f1) (1515) of the round and output, and the individual input values ​​(x2) (1517) used individually in the round are added to the output value of the round function and output (y2). Separately, y1, for which no operation is performed on the common input value (x1), can also be output. Here, y1, y2, …, y lIn the embodiment of Fig. 15, the input values ​​x1, …, x l This corresponds to the result value after going through this one round. The final result value obtained by going through multiple rounds of input values ​​can be called a key stream. According to the single blind rotation in the unbalanced Feistel structure of Fig. 15, f is calculated in one round. i Go x i +k i Since it has +1 as input, a total of l-1 GSW ciphertexts must be calculated, but when the double blind rotation method proposed in this disclosure is applied, each k i The GSW ciphertext for f is pre-calculated, and in the actual encryption process, only the GSW ciphertext for the common input value (x1) is calculated, f i A table representing x1 is used once, and then k i We perform a total of two blind rotations again with f i (x1+k i ) can be calculated.

[0164] Combination with Concrete-friendly symmetric key cryptographic design using randomly generated nonlinear layers.

[0165] The method proposed in this disclosure can be combined with a concrete-friendly symmetric key encryption scheme using randomly generated nonlinear layers.

[0166] More specifically, since the double blind rotation technique proposed in the present disclosure does not depend on the specific function value of the nonlinear function f to be calculated, it can be equally applied even if the nonlinear functions in the above unbalanced Feistel structure have a structure in which they are randomly generated for each encryption.

[0167] Combining the double-blind rotation technique with a homomorphic cryptographic-friendly symmetric key encryption scheme that uses randomly generated nonlinear layers not only reduces the total number of rounds required by randomly generating the nonlinear layers, but also significantly reduces the computation time for each round through the double-blind rotation technique.

[0168] Figure 16 is a diagram illustrating an example of a double blind rotation technique combined with a homomorphic encryption-friendly symmetric key encryption scheme using randomly generated nonlinear layers. Referring to Figure 16, for each encryption round, nonlinear functions f1, f2,..., f l From this XOF (1610), it can be randomly generated in table form, and f2,...,f having the same input branch (1621) l The calculation of the function can be efficiently performed using the double blind rotation technique proposed in the present disclosure. Referring to Fig. 16, the execution method of the first round will be described. In the round, common input data (x1) (1621) and the round key (rk2) (1623) used in the round are input to the round function (f2) (1625) of the round and output. At this time, the round function (1625) may be randomly generated by XOF (1610). The individual input values ​​(x2) (1627) individually used in the round may be added to the output value of the round function and output (y2) (1629).

[0169] Application of the double-blind rotation method to various PBS calculation methods.

[0170] The optimization technique using double-blind rotation proposed in this disclosure can be applied to various PBS techniques other than the PBS techniques of FIGS. 13 and 14. More specifically, the optimization technique using double-blind rotation proposed in this disclosure can also be applied to a method of converting the input ciphertext into a GLWE (Generalized LWE, generalized Learning With Errors) ciphertext format and multiplying it by a polynomial representing the function to be calculated, rather than converting the input ciphertext into a GSW ciphertext format and performing blind rotation.

[0171] GLWE ciphertext is a ciphertext whose message is a polynomial for variable X. The blind rotation method using GLWE ciphertext creates a homomorphic ciphertext for message m as X -m This is done through the process of converting it into a homomorphic ciphertext in the form of GLWE. In the case of GLWE ciphertext, the function f to be calculated is also a polynomial P for X. f It is made in the form of (X), at which time P f The function values ​​of f are stored in each coefficient of . The core idea of ​​PBS operation based on GLWE ciphertext is that given a homomorphic ciphertext for m and a function f, the polynomial X -m P f The constant term of (X) is to make the function value f(m). That is, P f A table for a function f called GLWE ciphertext X -m It is rotated by the value of m.

[0172] In general, X is a homomorphic operation -m P f To obtain the ciphertext for (X), the homomorphic ciphertext for message m and the polynomial P f Repeat the CMux operation from X several times -m P fThe ciphertext for (X) is obtained. In PBS operations based on LWE ciphertexts, a method of using double blind rotation in table reference operations of the form f(a+b) that is common in unbalanced Feistel structure calculations can be applied. -a Wow X -b After calculating the GLWE ciphertext for CMux operation, X is obtained by multiplying the GLWE ciphertexts. -a+b P f The ciphertext for (X) can be computed. If either a or b is a common value used multiple times, the GLWE ciphertext can be computed only once and the double-blind rotation technique can be used in the same way by rotating the table for f twice.

[0173] effect

[0174] In the case of the existing homomorphic encryption calculation method, the GSW ciphertext must be calculated as many times as the number of nonlinear functions to be calculated for each round. On the other hand, according to the method proposed in this disclosure, if only the GSW ciphertext for the round key is calculated in advance, only the GSW ciphertext for the input state value needs to be calculated in the subsequent ciphertext calculation step. Therefore, when calculating the ciphertext of multiple blocks, the GSW ciphertext for the round key can be continuously and repeatedly used, so that the total time required for ciphertext calculation can be significantly reduced. In particular, according to the method proposed in this disclosure, the degree of reduction in the total time required for ciphertext calculation can be proportional to the number of nonlinear functions to be calculated for each round.

[0175] Figure 17 is a diagram showing an example in which the method proposed in the present disclosure is performed on a server.

[0176] First, the server receives encrypted data from the client based on at least one round performed on the data (S1710).

[0177] Next, in each of the at least one round, (i) common input data commonly used in the at least one round and (ii) a round key individually used in each of the at least one round are input to and output from a round function of each of the at least one round.

[0178] Thereafter, the server performs a homomorphic operation on the output value of each round function of at least one round included in the encrypted data.

[0179] At this time, the homomorphic operation for the output value of the round function of each of the at least one round is performed based on a preset mapping relationship between an input value for the homomorphic operation and a result value of the homomorphic operation for the input value, and for the homomorphic operation based on the preset mapping relationship, a first ciphertext for a round key individually used in each of the at least one round is calculated in advance before performing the homomorphic operation, and a second ciphertext for the common input data is calculated when performing the homomorphic operation.

[0180] At this time, based on (i) the first blind rotation based on the first ciphertext and the second blind rotation based on the second ciphertext performed for the preset mapping relationship, the result value of the homomorphic operation for the output value of the round function of each of the at least one round is calculated.

[0181] At this time, although not shown in FIG. 17, the server may transmit at least one synchronization signal and transmit control information before step S1710, between steps S1710 and S1720, or after step S1720.

[0182] In addition, the server includes a transmitter for transmitting a wireless signal; a receiver for receiving a wireless signal; at least one processor; and at least one computer memory operably connected to the at least one processor and storing instructions that, when executed by the at least one processor, perform operations. In this case, the operations include the steps described in FIG. 17.

[0183] Additionally, the operations described in FIG. 17 may be stored on a non-transitory computer-readable medium (CRM) storing one or more commands. The non-transitory computer-readable medium stores one or more commands executable by one or more processors, and the one or more commands cause the server to perform the operations described in FIG. 17.

[0184] Additionally, a device comprising one or more memories and one or more processors functionally connected to the one or more memories, wherein the one or more processors control the device to perform the operations described in FIG. 17.

[0185] Figure 18 is a diagram showing an example of the method proposed in the present disclosure being performed on a client.

[0186] First, the client transmits encrypted data to the server based on at least one round performed on the data (S1810).

[0187] Here, in each of the at least one round, (i) common input data commonly used in the at least one round and (ii) a round key individually used in each of the at least one round are input to and output from a round function of each of the at least one round.

[0188] Thereafter, the client receives, from the server, a homomorphic ciphertext of the data obtained based on a homomorphic operation on the output value of each round function of at least one round included in the encrypted data (S1820).

[0189] At this time, the homomorphic operation for the output value of the round function of each of the at least one round is performed based on a preset mapping relationship between an input value for the homomorphic operation and a result value of the homomorphic operation for the input value, and for the homomorphic operation based on the preset mapping relationship, a first ciphertext for a round key individually used in each of the at least one round is calculated in advance before performing the homomorphic operation, and a second ciphertext for the common input data is calculated when performing the homomorphic operation.

[0190] Here, based on (i) a first blind rotation based on the first ciphertext and a second blind rotation based on the second ciphertext performed for the preset mapping relationship, a result value of the homomorphic operation on the output value of the round function of each of the at least one round is calculated.

[0191] At this time, although not shown in FIG. 18, the terminal may receive at least one synchronization signal and receive control information before step S1810, between steps S1810 and S1820, or after step S1820.

[0192] Additionally, the client includes a transmitter for transmitting a wireless signal; a receiver for receiving a wireless signal; at least one processor; and at least one computer memory operably connected to the at least one processor and storing instructions that, when executed by the at least one processor, perform operations. In this case, the operations include the steps described in FIG. 18.

[0193] Additionally, the operations described in FIG. 18 may be stored in a non-transitory computer-readable medium (CRM) storing one or more commands. The non-transitory computer-readable medium stores one or more commands executable by one or more processors, and the one or more commands cause the terminal to perform the operations described in FIG. 18.

[0194] Additionally, a device comprising one or more memories and one or more processors functionally connected to the one or more memories, wherein the one or more processors control the device to perform the operations described in FIG. 18.

[0195] The embodiments described above are combinations of components and features of the present disclosure in a predetermined form. Each component or feature should be considered optional unless explicitly stated otherwise. Each component or feature may be implemented without being combined with other components or features. Furthermore, it is also possible to combine some components and / or features to form an embodiment of the present disclosure. The order of operations described in the embodiments of the present disclosure may be changed. Some components or features of one embodiment may be included in another embodiment or may be replaced with corresponding components or features of another embodiment. It is self-evident that claims that do not have an explicit citation relationship in the claims may be combined to form an embodiment or may be incorporated as a new claim through a post-application amendment.

[0196] Embodiments according to the present disclosure may be implemented by various means, for example, hardware, firmware, software, or a combination thereof. In the case of hardware implementation, an embodiment of the present disclosure may be implemented by one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, etc.

[0197] When implemented via firmware or software, one embodiment of the present disclosure may be implemented in the form of a module, procedure, function, or the like that performs the functions or operations described above. The software code may be stored in memory and executed by a processor. The memory may be located within or external to the processor and may exchange data with the processor via various known means.

[0198] It will be apparent to those skilled in the art that the present disclosure may be embodied in other specific forms without departing from the essential characteristics thereof. Therefore, the above detailed description should not be construed as limiting in any respect, but rather as illustrative. The scope of the present disclosure should be determined by a reasonable interpretation of the appended claims, and all modifications within the scope of equivalents of the present disclosure are intended to be included within the scope of the present disclosure.

[0199] Additionally or alternatively, the wireless communication technology implemented in the device (100, 200) of the present disclosure may perform communication based on LTE-M technology. For example, LTE-M technology may be an example of LPWAN technology and may be called by various names such as eMTC (enhanced Machine Type Communication). For example, LTE-M technology may be implemented by at least one of various standards such as 1) LTE CAT 0, 2) LTE Cat M1, 3) LTE Cat M2, 4) LTE non-BL (non-Bandwidth Limited), 5) LTE-MTC, 6) LTE Machine Type Communication, and / or 7) LTE M, and is not limited to the above-described names.

[0200] Additionally or alternatively, the wireless communication technology implemented in the device (100, 200) of the present disclosure may include at least one of ZigBee, Bluetooth, and Low Power Wide Area Network (LPWAN) that take low-power communication into account, and is not limited to the above-described names. For example, ZigBee technology can create personal area networks (PANs) related to small / low-power digital communication based on various standards such as IEEE 802.15.4, and may be called by various names.

[0201] Although the present disclosure focuses on examples applied to 3GPP LTE / LTE-A and 5G / 6G systems, it can be applied to various wireless communication systems in addition to 3GPP LTE / LTE-A and 5G / 6G systems.

Claims

1. In a method performed by a server in a communication system, A step of transmitting at least one synchronization signal to a client; A step of transmitting control information to the above client; A step of receiving encrypted data from the client based on at least one round performed on the data, In each of the at least one round, (i) common input data commonly used in the at least one round and (ii) a round key individually used in each of the at least one round are input to and output from a round function of each of the at least one round; and Comprising a step of performing a homomorphic operation on the output value of each round function of at least one round included in the encrypted data, The above homomorphic operation on the output value of each round function of at least one round is performed based on a preset mapping relationship between the input value for the homomorphic operation and the result value of the homomorphic operation on the input value, For the homomorphic operation based on the above preset mapping relationship, a first ciphertext for a round key individually used in each of the at least one rounds is pre-calculated before performing the homomorphic operation, and a second ciphertext for the common input data is calculated when performing the homomorphic operation. A method in which the result value of the homomorphic operation on the output value of the round function of each of the at least one round is calculated based on (i) a first blind rotation based on the first ciphertext and a second blind rotation based on the second ciphertext performed for the above preset mapping relationship.

2. In paragraph 1, A method in which, in each of the at least one round, the output value of the round function of each of the at least one round is added to the individual input values ​​individually used in each of the at least one round and output.

3. In paragraph 1, The above first blind rotation and the second blind rotation are operations that, when the input value of the homomorphic operation is an encrypted value, obtain an encrypted result value corresponding to the input value of the homomorphic operation, which is an encrypted value, based on the preset mapping relationship rotated by the amount of the input value of the homomorphic operation, which is an encrypted value, without decryption of the input value of the homomorphic operation, which is an encrypted value.

4. In paragraph 1, Each round key used individually in each of the above at least one round is the same method in each of the above at least one round until the round key update.

5. In paragraph 1. A method in which the size of the above common input data is not half the size of the above data.

6. In paragraph 1. A step of receiving, from the client, a homomorphic encrypted secret key associated with encryption based on at least one round; A step of obtaining a homomorphic ciphertext of the data based on the result of the homomorphic operation on the homomorphically encrypted secret key and the encrypted data; and A method further comprising the step of transmitting a homomorphic ciphertext of the data to the client.

7. In paragraph 1. A method in which each round function of at least one of the above rounds is randomly generated for each of the above at least one round.

8. In a method performed by a client in a communication system, A step of receiving at least one synchronization signal from a server; A step of receiving control information from the above server; A step of transmitting encrypted data to the above server based on at least one round performed on the data, In each of the at least one round, (i) common input data commonly used in the at least one round and (ii) a round key individually used in each of the at least one round are input to and output from a round function of each of the at least one round; and A step of receiving, from the server, a homomorphic ciphertext of the data obtained based on a homomorphic operation on the output value of each round function of at least one round included in the encrypted data, The above homomorphic operation on the output value of each round function of at least one round is performed based on a preset mapping relationship between the input value for the homomorphic operation and the result value of the homomorphic operation on the input value, For the homomorphic operation based on the above preset mapping relationship, a first ciphertext for a round key individually used in each of the at least one rounds is pre-calculated before performing the homomorphic operation, and a second ciphertext for the common input data is calculated when performing the homomorphic operation. A method in which the result value of the homomorphic operation on the output value of the round function of each of the at least one round is calculated based on (i) a first blind rotation based on the first ciphertext and a second blind rotation based on the second ciphertext performed for the above preset mapping relationship.

9. In paragraph 8, A method in which, in each of the at least one round, the output value of the round function of each of the at least one round is added to the individual input values ​​individually used in each of the at least one round and output.

10. In paragraph 8, The above first blind rotation and the second blind rotation are operations that, when the input value of the homomorphic operation is an encrypted value, obtain an encrypted result value corresponding to the input value of the homomorphic operation, which is an encrypted value, based on the preset mapping relationship rotated by the amount of the input value of the homomorphic operation, which is an encrypted value, without decryption of the input value of the homomorphic operation, which is an encrypted value.

11. In paragraph 8, Each round key used individually in each of the above at least one round is the same method in each of the above at least one round until the round key update.

12. In paragraph 8. A method in which the size of the above common input data is not half the size of the above data.

13. In paragraph 8. A step of transmitting a homomorphic encrypted secret key related to encryption based on at least one round to the above server; and A method further comprising the step of receiving, from the server, the homomorphic encrypted secret key and the homomorphic ciphertext obtained based on the result of the homomorphic operation on the encrypted data.

14. In paragraph 8. A method in which each round function of at least one of the above rounds is randomly generated for each of the above at least one round.

15. In a server that performs communication in a communication system, A transmitter for transmitting wireless signals; A receiver for receiving wireless signals; at least one processor; and At least one computer memory operably connectable to said at least one processor and storing instructions that, when executed by said at least one processor, perform operations; The above actions are, A step of transmitting at least one synchronization signal to a client; A step of transmitting control information to the above client; A step of receiving encrypted data from the client based on at least one round performed on the data, In each of the at least one round, (i) common input data commonly used in the at least one round and (ii) a round key individually used in each of the at least one round are input to and output from a round function of each of the at least one round; and Comprising a step of performing a homomorphic operation on the output value of each round function of at least one round included in the encrypted data, The above homomorphic operation on the output value of each round function of at least one round is performed based on a preset mapping relationship between the input value for the homomorphic operation and the result value of the homomorphic operation on the input value, For the homomorphic operation based on the above preset mapping relationship, a first ciphertext for a round key individually used in each of the at least one rounds is pre-calculated before performing the homomorphic operation, and a second ciphertext for the common input data is calculated when performing the homomorphic operation. A server in which the result value of the homomorphic operation on the output value of the round function of each of the at least one round is calculated based on (i) a first blind rotation based on the first ciphertext and a second blind rotation based on the second ciphertext performed for the above preset mapping relationship.

16. For a client performing communication in a communication system, A transmitter for transmitting wireless signals; A receiver for receiving wireless signals; at least one processor; and At least one computer memory operably connectable to said at least one processor and storing instructions that, when executed by said at least one processor, perform operations; The above actions are, A step of receiving at least one synchronization signal from a server; A step of receiving control information from the above server; A step of transmitting encrypted data to the above server based on at least one round performed on the data, In each of the at least one round, (i) common input data commonly used in the at least one round and (ii) a round key individually used in each of the at least one round are input to and output from a round function of each of the at least one round; and A step of receiving, from the server, a homomorphic ciphertext of the data obtained based on a homomorphic operation on the output value of each round function of at least one round included in the encrypted data, The above homomorphic operation on the output value of each round function of at least one round is performed based on a preset mapping relationship between the input value for the homomorphic operation and the result value of the homomorphic operation on the input value, For the homomorphic operation based on the above preset mapping relationship, a first ciphertext for a round key individually used in each of the at least one rounds is pre-calculated before performing the homomorphic operation, and a second ciphertext for the common input data is calculated when performing the homomorphic operation. A client in which a result value of the homomorphic operation on the output value of the round function of each of the at least one round is calculated based on (i) a first blind rotation based on the first ciphertext and a second blind rotation based on the second ciphertext performed for the above preset mapping relationship.

17. In a non-transitory computer-readable medium (CRM) storing one or more instructions, One or more instructions executable by one or more processors include operations performed by the transmitter, The above actions are, A non-transitory computer-readable medium comprising all steps of a method according to any one of claims 1 to 7.

18. In a non-transitory computer-readable medium (CRM) storing one or more instructions, One or more instructions executable by one or more processors include operations performed by the transmitter, The above actions are, A non-transitory computer-readable medium comprising all steps of a method according to any one of claims 8 to 14.

19. A device comprising one or more memories and one or more processors functionally connected to the one or more memories, The one or more processors execute the operations performed by the device, The above actions are, A device comprising all steps of a method according to any one of claims 1 to 7.

20. In a device comprising one or more memories and one or more processors functionally connected to the one or more memories, The one or more processors execute the operations performed by the device, The above actions are, A tooth comprising all steps of a method according to any one of claims 8 to 14.

Images