Secure execution technology for code that operates encrypted data on public computers

Abstract

A technique for securely processing encrypted data on a public resource comprises: receiving first data, the first data representing a sequence of reversible q-bit gates, including a first segment for decryption, a second segment for operating on the decrypted data, and a third segment for encrypting the resulting decrypted data. A second data representation rule is used to replace a first sequence of two q-bit gates operating on at least one shared bit of an input N-bit word with a second sequence of one or more q-bit gates that produce the same output N-bit word. The second data is used to: propagate a gate from the first segment a distance into or out of the second segment; and propagate a gate from the third segment a distance into or before the second segment. The above process produces an obfuscated sequence of reversible gates. Obfuscated instructions based on the obfuscated sequence of gates are sent to the public resource.

Description

Background Art

[0001] By encrypting the data and using powerful public resources (such as cloud data storage and cloud computing) to store the encrypted data, the data can usually be kept confidential from the public. However, when the amount of data stored is very large, such as in the order of Terabits (Tb, 1Tb = 10 12 bits), some efficiency would be lost if most of the encrypted data had to be returned to a local secure processor for processing. Similarly, if an operation involves huge computing resources, even for relatively small amounts of data, it would be advantageous to run it on a powerful public resource (such as a cloud processor) rather than on a secure computer with relatively limited computing power. However, in order to decrypt the data, the processor on the powerful public resource would expose the encryption method and reveal the underlying data. Summary of the invention

[0002] Techniques are provided for securely processing encrypted data over insecure but potentially powerful public resources.

[0003] In a first set of embodiments, a method executed on a first (e.g., local and secure) processor includes receiving first data representing a sequence of reversible q-bit gates, including a first segment for decrypting permuted encrypted data to produce decrypted data, a second segment for operating on the decrypted data to produce one or more resultant decrypted data, and a third segment for encrypting the resultant decrypted data using permutation encryption to produce permuted encrypted resultant data. The method also includes storing second data on a computer-readable medium, the second data representing a rule for replacing a first sequence of two q-bit gates operating on at least one shared bit of an input N-bit word with a different second sequence of one or more q-bit gates that produce the same output N-bit word. Further, the method also includes using the second data to propagate at least one q-bit gate from the first segment a distance of J gates to within or after a q-bit gate of the second segment, and propagate at least one q-bit gate from the third segment a distance of K gates to within or before a q-bit gate of the second segment, thereby producing an obfuscated sequence of reversible q-bit gates. Further, the method also includes sending an obfuscated instruction based on an obfuscated sequence of inverse q-bit gates to a second processor (e.g., an unsecure or cloud processor, or a processor partition with different access permissions) for execution.

[0004] In some embodiments of the first group, the method further includes storing third data on a computer-readable medium, the third data associating each code instruction executable by a second processor with one or more reversible q-bit gates operating on an N-bit word. In these embodiments, the method further includes using the third data to convert a scrambled sequence of reversible q-bit gates into scrambled code instructions executable by the second processor. Then, sending the scrambled instructions includes sending the scrambled code instructions executable by the second processor.

[0005] In some embodiments of the first group, the method further includes storing third data on a computer-readable medium, the third data associating each code instruction executable by a second processor with one or more reversible q-bit gates operating on an N-bit word. In these embodiments, receiving the first data includes: receiving code instructions executable by the second processor for operating on encrypted data to generate one or more resultant decrypted data; and using the third data to convert the code instructions executable by the second processor for operating on encrypted data to generate one or more resultant decrypted data into a sequence of reversible q-bit gates for operating on encrypted data to generate one or more resultant decrypted data.

[0006] In some embodiments of the first group, the method further includes storing merged data on a computer-readable medium, the rules represented by the merged data for replacing each sequence of one or more reversible q-bit gates operating on an input N-bit word to produce an output N-bit word with one or more reversible k-bit gates producing the same output N-bit word, where 3 < k ≤ N. In these implementations, the method further includes using the merged data to replace a particular sequence of one or more reversible q-bit gates in the scrambled sequence of reversible q-bit gates with k-bit gates that can replace the particular sequence.

[0007] In some of these embodiments, the method further includes storing third data on a computer-readable medium, the third data associating each code instruction executable by the different second processors with one or more reversible q-bit gates operating on an N-bit word. In these embodiments, the method further includes storing merged code data on a computer-readable medium, the merged code data associating each of one or more k-bit gates with one or more code instructions executed on the different second processors. In some embodiments, the method further includes: using the merged code data to convert the k-bit gates into at least a portion of the scrambled code instructions; and using the third data to convert the remaining reversible q-bit gates in the scrambled sequence of reversible q-bit gates into the remaining portion of the scrambled code instructions. In these embodiments, sending the scrambled instructions further includes sending the scrambled code instructions executable by the second processor.

[0008] In some embodiments of the first group, J is greater than N and K is greater than N.

[0009] In some embodiments of the first group, each reversible q-bit gate is a control gate including a single target bit and q-1 control bits, and is used to determine the value of the single target bit based on the values ​​of the q-1 control bits and the values ​​input to the q-1 control bits.

[0010] In some embodiments of the first group, q∈{1,2,3}).

[0011] In some embodiments of the first group, the second processor is different from the first processor. In some embodiments of the first group, access to the second processor is different from access to the first processor.

[0012] In other sets of embodiments, the computer readable medium or system is configured to perform one or more steps of the above-described method.

[0013] Other aspects, features and advantages will be apparent from the following detailed description, merely by illustrating a number of specific embodiments and implementations, including the best mode contemplated for carrying out the invention. Other embodiments are also capable of other and different features and advantages, and their several details may be modified in various obvious respects, all without departing from the spirit and scope of the invention. Accordingly, the drawings and description should be regarded as illustrative in nature, and not restrictive. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Embodiments are illustrated by way of example and not limitation in the accompanying drawings in which like reference numerals refer to similar elements and in which:

[0015] FIG1 illustrates a block diagram of an example system that uses encrypted data stored on a public resource;

[0016] Figure 2A shows a block diagram of an example 3-bit gate operating on an N-bit word according to an embodiment;

[0017] Figure 2B shows a block diagram of an exemplary pair of 3-bit gates operating on an N-bit word according to an embodiment;

[0018] Figure 2C The results according to the embodiment are shown. Figure 2B A block diagram of an exemplary series of 3-bit gates producing the same result as the 3-bit gate in FIG.

[0019] Figure 2D A block diagram of an example system for securely processing encrypted data stored on a public resource on a public resource according to an embodiment is shown;

[0020] Figure 3A flow chart illustrating an example method for securely processing encrypted data stored on a public resource on a public resource according to an embodiment;

[0021] FIG. 4A to FIG. 4C A block diagram of an exemplary program according to an embodiment is shown, wherein the exemplary program is obfuscated as a series of gates operating on 7-bit words to generate a specific output word y given a specific input word x;

[0022] Figure 5 A flowchart showing an example method of propagating a first 3-bit gate through a second 3-bit gate according to an embodiment is shown. The method is applied, for example, in Figure 3 In a step of the method shown;

[0023] Figure 6 shows a block diagram of a pair of example 3-bit gates that collide on all three bits according to an embodiment;

[0024] Figure 7 shows a block diagram of a pair of example 3-bit gates colliding on two bits according to an embodiment;

[0025] Figure 8 shows a block diagram of a pair of example 3-bit gates colliding on two bits according to an embodiment;

[0026] Fig. 9 A block diagram showing a set of example interleaving permutations for generating fragmented gates when 3-bit gates collide on two bits according to an embodiment;

[0027] Fig.10 A block diagram showing an example set of fragmented gates generated when a 3-bit gate collides on two bits according to an embodiment;

[0028] Fig.11 A block diagram showing exemplary construction conditions for a table for generating fragment gates when a 3-bit gate collides on two bits according to an embodiment;

[0029] Fig.12 A block diagram showing an exemplary 4-bit operator being decomposed to determine fragment gates when a 3-bit gate collides on two bits according to an embodiment;

[0030] Fig.13A shows a block diagram of several sets of exemplary fragmentation gates c, d, e and f when a 3-bit gate collides on two bits according to an embodiment;

[0031] Fig. 13B shows a set of exemplary truth tables for fragment gates c, d, e, and f when a 3-bit gate collides on two bits according to an embodiment;

[0032] Fig.14A block diagram showing eight example ways of introducing a swap gate when a 3-bit gate collides on one bit according to an embodiment;

[0033] Fig.15 A block diagram showing a set of example steps for generating a significant fragment gate when a 3-bit gate collides on one bit according to an embodiment;

[0034] Fig.16 and Fig.17 A block diagram showing the introduction of intermediate encryption and decryption steps to further obfuscate the program through collision gates according to an embodiment;

[0035] Fig.18 A block diagram showing three sets of example steps for generating an obfuscated program according to an embodiment;

[0036] Fig.19 A block diagram showing an example of combining 3-bit gates into multiple gates including more bits to further confuse the program according to an embodiment;

[0037] Fig. 20 A block diagram showing a set of example sequences of 3-bit gates for a 2-bit multiplication function f according to an embodiment;

[0038] Fig.21 The intermediate encryption and decryption blocks are shown inserted into Fig. 20 A block diagram of an example of function f is shown;

[0039] Fig. 22 It is shown that according to the embodiment, Fig.21 A block diagram of exemplary steps for obfuscating a 2-bit multiplication function f using multiple intermediate encryptions as shown;

[0040] FIG. 23A to FIG. 23C A block diagram illustrating an exemplary distance that an encryption / decryption gate moves toward a function code according to an embodiment;

[0041] FIG. 24A to FIG. 24C shows a block diagram of an exemplary control gate for replacing a 3-bit gate according to an embodiment;

[0042] Fig.24D shows a block diagram of an exemplary 6-bit control gate resulting from merging or collision according to an embodiment;

[0043] Fig.25 shows a simplified schematic block diagram of an exemplary control gate for replacing a 3-bit gate according to an embodiment;

[0044] Fig.26 A flowchart of an example method for propagating a first control q-bit gate through a second control q-bit gate according to an embodiment is shown, the method being applied, for example, in Figure 3 In the steps of the method shown;

[0045] FIG. 27A to FIG. 27D A block diagram illustrating an exemplary collision of control gates having a shared target or control bit according to an embodiment;

[0046] Fig.28A and Fig.28B A block diagram showing an exemplary collision of control gates having different non-overlapping control bits according to an embodiment;

[0047] FIG. 29A to FIG. 29D A block diagram showing an exemplary collision of control gates according to an embodiment, wherein a leading bit of one gate overlaps a trailing bit of another gate;

[0048] FIG. 30A to FIG. 30D A block diagram showing an exemplary collision of control gates according to an embodiment, wherein the leading bits of two gates overlap one tail bit of other gates;

[0049] Fig.31 A block diagram showing a set of exemplary steps for generating an obfuscated program for a simple function according to an embodiment;

[0050] Fig.32 A block diagram showing an exemplary computer system on which embodiments of the present invention may be executed; and

[0051] Fig.33 A block diagram is shown of an exemplary chip set upon which embodiments of the present invention may be executed. DETAILED DESCRIPTION

[0052] The present invention provides a method and system for securely processing encrypted data on public resources, for example, utilizing superior processing power, efficiency, or elasticity or a combination of the above on public resources such as the cloud. In the following description, for the purpose of explanation, many specific details are set forth to facilitate a thorough understanding of the present invention. However, it is obvious to those skilled in the art that the present invention can be implemented without these specific details. In other cases, well-known structures and devices are shown in block diagram form to avoid obscurity of the present invention.

[0053] Although the numerical ranges and parameters listed in the broad range are approximate values, the numerical values ​​listed in the specific non-limiting examples should be reported as accurately as possible. However, any numerical value inherently contains some errors, which are caused by the standard deviation found in the respective test measurements at the time of writing this article. In addition, unless it is clear from the context, the numerical values ​​given in this article have the implicit precision given by the least significant digit. Therefore, the value 1.1 represents a value between 1.05 and 1.15. The term "about" is used to indicate a wider range centered on a given value, and unless it is clear from the context, the wider range implied near the least significant digit, such as "about 1.1" represents a range from 1.0 to 1.2. If the least significant digit is unclear, the term "about" means twice, for example, "about X" represents a value between 0.5X and 2X; for example, about 100 represents a value between 50 and 200. In addition, it should be understood that the range disclosed herein covers any and all sub-ranges contained therein. For example, a range of “less than 10” includes any and all sub-ranges between a minimum value of 0 and a maximum value of 10, ie, a minimum value equal to or greater than 0 and a maximum value equal to or less than 10, such as 1 to 4.

[0054] Embodiments of the present invention are described below in conjunction with exemplary functions, exemplary 3-bit gates, and exemplary alternatives for replacing a pair of 3-bit gates. However, the present invention is not limited to this context. In other embodiments, other functions, q-bit gates, and alternatives may also be implemented following the methods described herein.

[0055] 1. Overview

[0056] 1 is a block diagram illustrating an example system for using encrypted data stored on a public resource. Encrypted data 140 is stored on one or more unsecured storage devices 188. In the illustrated embodiment, encrypted data 140 is encrypted using permutation encryption. In permutation encryption, an N-bit word of plaintext is converted to an N-bit word of ciphertext by converting the position and value of the bit in the plaintext to the position and value in the ciphertext in a permutation key. The ciphertext is permuted encrypted data 140. Each N-bit plaintext word points to an N-bit ciphertext word. Two different N-bit plaintext words do not convert to the same N-bit ciphertext word. Based on the understanding of the permutation key, the ciphertext can be converted back to plaintext and used for calculations. The number of possible permutations is 2 N ! Therefore, the larger the number of bits N contained in each N-bit ciphertext is, the more secure the encrypted data 140 is.

[0057] One or more unsecured servers 182 may access unsecured storage device 188 directly or through unsecured communications network 180. Without access to the replacement key, these servers 182 and devices in network 180 cannot access the plaintext. Secure computing system 110 may also access unsecured storage device 188 through various methods known in the art, such as a firewall (not shown). Secure computer system 110 is under physical and communications control of authorized users of the plaintext corresponding to the ciphertext in encrypted data 140. The user of secure computer system 110 knows the replacement key that includes one or more replacement encryption parameters in data 112.

[0058] Although using encrypted data for processing on one or more unsecured servers 182 may improve computing power or efficiency, doing so may expose the replacement key comprising data 112 to processes running on unsecured servers 182 or network 180. Therefore, users of encrypted data 140 are generally constrained to retrieve some or all of the encrypted data 140 from unsecured storage devices 188 over network 180 for at least temporary local storage on secure system 110. This retrieval process is performed by retrieve / store encrypted data module 115 and is responsible for identifying the encrypted data to be retrieved. If the retrieval criteria depend on information stored in ciphertext form, a large amount of data will be transmitted and stored locally, which is not necessary for the performance of the function.

[0059] Plaintext function program module 113 is used to perform operations on plaintext. Module 114 performs the following processes: decrypting ciphertext (using module 116), operating on plaintext (using module 113), and encrypting the result using module 118. Modules 116 and 118 are both dependent on encryption parameters 112. Module 115 is used to store the result back to the unsecured storage device 188. If the storage location depends on the information stored as ciphertext, a large amount of data that is not changed by the plaintext function processing of module 113 will be transmitted over network 180 and stored on the unsecured device 188. For example, if you want to retrieve the social security number (SSN) of the public that begins with "123", you must first decrypt the SSN before determining whether to operate on the data. Since this cannot be performed on the unsecured device, all of the data must be downloaded to the local device first, at least all of the SSNs must be decrypted, and then the desired data, i.e., a small portion of the downloaded data, must be operated on.

[0060] It can be seen from this that: 1) permutation encryption can be implemented by a sequence of one or more q-bit gates (q∈{1,2,3}); 2) inputs can also be mapped one-to-one to outputs by a sequence of one or more q-bit gates (assuming that the functional program module 113 has such a bijective function); and, 3) because there are more than one set of q-bit gates that produce the same output for the same input, the decryption, plaintext function, and encryption q-bit gates can be replaced by a different sequence of gates that do not directly correspond to the operations of the three, in order to obfuscate these operations. Obfuscated codes that implement different sequences of gates can be generated, but these codes do not reveal the operations performed. Therefore, the obfuscated code can be transmitted to the unsecured server 182 for execution. Such code can take advantage of the computing power, efficiency, or flexibility of the unsecured server 182 and the unsecured device 188 without revealing the permutation key. In the present invention, a series of gates is also called a circuit. Therefore, as in the circuit model of computing, the program that performs the intended function on the data is converted into a description of the gates. Logic gates can be represented by q-bit reversible gates, such as 3-bit Tofolli gates.

[0061] Figure 2A A block diagram of an example 3-bit gate operating on an N-bit word is shown according to an embodiment. Three bit positions from an input N-bit word 202a, represented by X 203x, Y 203y and Z 203z, separated by zero or more bit positions represented by ellipses, before or after them, are passed to a reversible 3-bit gate 201. The result is passed to the same three bit positions in an output N-bit word 202b. However, the contents of these three bit positions may have been permuted. For example, the eight values ​​A, B, C (such as 000, 001, 010, 011, 100, 101, 110, 111) at the three bits X, Y, Z of the N-bit word 202a are changed to a permutation of the eight values ​​A', B', C' (such as 110, 111, 100, 101, 000, 001, 011, 010, respectively) in the N-bit word 202b. In the other 3-bit gates, 8 other permutations of values ​​will be generated. For any three positions (X, Y, Z), there are 2 3 = 40,320 possible 3-bit gates. In the example section, Figure 2A Similarly, 3-bit gates are represented by solid dots on the lines corresponding to the operable bit positions.

[0062] Figure 2BA block diagram of a pair of exemplary 3-bit gates (204a, 204b) operating on an N-bit word is shown according to an embodiment. The figure depicts an input N-bit word 202c, a 3-bit gate 204a, a 3-bit gate 204b, and an output N-bit word 202d. Horizontal segments represent twelve consecutive bit positions, and several ellipses represent that there are no bit positions or there are more bit positions after that. Moving the 3-bit gate 204a past the 3-bit gate 204b, for example, in order to confuse the 3-bit gate associated with the plaintext function into the 3-bit gate associated with the decryption is called a gate movement. If the two gates 204a and 204b share at least one bit, the movement will cause the gates to include a set of one or more different gates, called "fragmented" gates, none of which can be identified as the original gates 204a and 204b. In this case, it is called a "collision" of the gates. The rules for resolving "collisions" are described in more detail in the "Examples" section below in general terms. Typically, the cost of resolving a collision is to increase the total number of 3-bit gates. This general concept is described in detail in the "Examples" section. Figure 2C Shown in.

[0063] Figure 2C A block diagram of a series of 3-bit gates producing a result similar to Figure 2B The two 3-bit gates 204a and 204b in the example above produce the same result. This is not the actual solution result for the specific 3-bit gates 204a and 204b, but is used to indicate that gates 204a and 204b have been consumed in the solution and replaced by four different "fragmented" 3-bit gates 202c, 204d, 204e and 204f.

[0064] Here, gate Ga has moved past gate Gb. For example, in forward movement, when gate Ga on the left is to move past gate Gb on the right, both will collide if gates Ga and Gb share one or two bit lines. In the case of no shared bit lines, the gate movement is achieved by swapping the order of gates Ga and Gb. In the case of sharing all three bit lines, gates Ga and Gb are first merged into a single gate, which then continues the movement of gate Ga. In a collision, the original gates Ga and Gb are replaced by an equivalent sequence of fragmented gates; the number of fragmented gates depends on the number of shared bit lines: up to four fragmented gates when sharing two bit lines; up to seven fragmented gates when sharing one bit line. After moving gate Ga past gate Gb, the gates generated on the far right are called descendants of Ga, including the rightmost fragmented gate generated by the collision. If the original intention was to move gate Ga past other gates to the right of gate Gb, the descendant gates of gate Ga or other fragmented gates after the collision will immediately pass through the gate and move to the right of the original gate Gb, such as Gc. If you want to move the gate further to the right, repeat this process until the gate Ga or at least one of its descendants moves past a predetermined number of gates to its right. When the gate Gb on the right moves back to move past the Ga gate on the left or further, follow the same steps above, but the movement is reversed.

[0065] In various embodiments, the concept of moving gates is used during the merging process to obfuscate the code by moving the gates associated with decryption or encryption past the gates associated with the plaintext functionality.

[0066] Figure 2D A block diagram of an example system for securely processing encrypted data stored on a public resource on a public resource according to an embodiment is shown. As shown in FIG1 , a network 180, an unsecure storage device 188; a replacement encrypted data 140, a replacement encrypted parameter data 112, a plain text function program module 113, a module 114, and a retrieval / recovery encrypted data module 115.

[0067] Secure computer system 210 differs from system 110 because system 210 includes table 230, module 232, module 233, module 234, module 235, module 236, and module 250. Table 230 associates each source code or object code instruction executable by unsecure server 282 with a sequence of one or more q-bit gates that, when inputted are the same one or more N-bit words as the source code or object code instruction, output the same one or more N-bit words.

[0068] FIG. 4A to FIG. 4C A block diagram of an exemplary program according to an embodiment is shown, wherein the exemplary program is obfuscated as a series of gates operating on 7-bit words to generate a specific output word y given a specific input word x. Figure 4A Including decryption module E-1 , functional module f and encryption module E 1 The program P acts on a word consisting of multiple bits (e.g., 7 bits). All encrypted data in the database is encrypted using a permutation scheme based on reversible logic gates, such as 3-bit Toffoli gates. Reversible computation ensures that the result of the entire circuit is a permutation that takes an n-bit input x (n and N are used interchangeably) and returns an n-bit output y = P(x), where P(x) is a permutation that acts on 2 n permutations on the space of possible n-bit inputs x. Use reversible q-bit gates to generate permutations on the 2n-dimensional bit space from simple permutations. Since the program E(x) for encrypting plaintext data x' into ciphertext data x is represented by reversible gates, the program E for decrypting data can be obtained by inverse operation -1 , by using the inverse of each gate in the program, and reading in the opposite direction. This inversion operation generates the inverse of the permutation, x' = E -1 (x) for decrypting data. In addition, the program f that performs the intended function on the plaintext data x' is converted into gates, as in a computational circuit model, or generated by a compiler for a central processing unit (CPU) or a field programmable gate array. The logic gates are then represented by q-bit reversible gates. In some embodiments, the final circuit, such as the merge / obfuscation E -1 ·f·E, programmed into the FPGA. Since the circuit is implemented in hardware, the circuit processes the input data faster. In other embodiments, other encryption schemes, such as the Advanced Encryption Standard (AES), can be used to define E and E -1 , as long as these encryption schemes can be implemented using reversible gates.

[0069] like Figure 4B As shown, a reversible program P is constructed by combining the three stages of the program: module E for decrypting data -1 , module f for performing the intended function, and module E for encrypting data 1 Since each module is represented by a reversible q-bit gate, the combined program P is also composed of reversible q-bit gates. The combined reversible program is a permutation that inputs an n-bit ciphertext x and outputs a ciphertext y = P(x), where P(x) is the number of bits acting on 2 n permutations of the space of possible n-bit inputs x, such as Figure 4B shown.

[0070] In some embodiments, it is preferred to associate each target code instruction with one or more q-bit gates, because the target code often contains a smaller number of commands, so the total number of entries in the table can be less than the total number of entries in the table associated with the high-level composite source code instructions. In addition, the target code is mostly run on the processor chip level registers, so the N bits can match the number of bits in the registers, thereby simplifying the mapping. The source code can be written in any language and then compiled using any known compiler suitable for an unsecured server to generate the target code mapped to the q-bit gate sequence.

[0071] The description of the 3-bit reversible gates for the entire program (or permutation) P is not unique. There are other sequences of 3-bit gates that produce the same final result P(x) for input x, but with different intermediate machine states. Figure 4C A block diagram of exemplary different intermediate states that can be achieved for any program P(x) according to an embodiment is shown. In the illustrated embodiment, the original program P generates a sequence G of m1 q-bit gates. a (1) , each gate acts on up to three specified bits (x iα , x jα , x kα ), where α = 1, ..., m1, the subscripts i, j, and k represent different n bits in each word for the same α, and each subscript x represents the value of the bit referred to. When the program that produces the same output y given the same input x also includes m p q-bit gate G b (p) Program P (P) (x), each gate acts on up to three specified bits (x i’ β, x j’ β, x k’ β), where β = 1, ..., m p , given the same input x, each produces the same output y. Figure 4C Two alternative procedures are shown when p=2 and 3, but are not limited thereto.

[0072] Given any program P (P) , we cannot determine the original program P (1) . Choose the original program P (1) Programs P that share a small number of gate sequences (0) As a confusing program (0) , in which it is impossible to determine the steps related to decryption or the encrypted data. Therefore, the obfuscated program P (0) can be run on a shared public computer without discarding the key used to decrypt the ciphertext stored in the public memory. (0) A new sequence of gates that can combine the three parts E-1 , f and E 1 Merge so that they can no longer be distinguished. Merging consists in moving the gates from one segment to another. But simply moving the gates is not enough; for these gates pass through each other to penetrate deep into the body of the other segment.

[0073] Program P (0) is transmitted to the server for execution. The cloud service provider is able to perform the requested computation, read the data from the encrypted database and output the encrypted data. However, the cloud server provider cannot identify the operations being performed throughout the computation because, although the final output is the same, the intermediate steps produce different results in most or all steps of the computation. For example, a client wants to query the database for all entries that satisfy a Boolean expression. The server runs the obfuscated code, queries the encrypted database and writes the query results to an encrypted output file, and then returns the results to the client. The client decrypts the results returned by the server on a secure computer.

[0074] In some embodiments, as described in detail below, multiple q-bit gates are combined into a k-bit gate (3<k≤N). In these embodiments, table 230 includes entries or instructions that associate each source code or object code instruction with one or more k-bit gates, which input the same one or more N-bit words and output the same one or more N-bit words. In some of these embodiments, table 230 also includes entries that associate each k-bit gate with a sequence of one or more q-bit gates. Therefore, q-bit gates can be replaced with corresponding k-bit gates as needed. For example, table 230 includes rules or instructions for converting a series of q-bit gates into a k-bit gate, which is a simple process for ordinary technicians in this field without excessive experimentation. In some embodiments, q-bit gates are continuously combined until a k-bit gate is generated.

[0075] Module 232 is configured to convert source code or target code into a sequence of q-bit reversible gates. Module 232 uses at least some of the data in table 230 and marks each q-bit gate as belonging to a decryption or plaintext function or encryption. In some embodiments, as described in more detail below, module 232 divides the plaintext function into multiple segments, and adds an encryption process after each segment, and adds a corresponding decryption process before the next segment. This segmentation of the plaintext function can be performed before or after converting the source / target code into a sequence of q-bit gates. In these segmented plaintext function embodiments, each q-bit gate is marked as being associated with a plaintext function or an encryption / decryption process. In some embodiments, the encryption q-bit gate is marked to distinguish it from the decryption q-bit gate. The output of module 232 is module 233, which includes a series of q-bit reversible gates equivalent to module 114. In some embodiments, the decryption process or the encryption process or both are defined by q-bit gates (for example, the permutation encryption parameter 112 includes a series of q-bit gates that perform decryption operations or / and a series of q-bit gates that perform encryption operations). In these embodiments, module 232 need not convert any source or object decryption code or encryption code or both into q-bit gates. In some embodiments, encryption is achieved simply by reversing the order of q-bit gates used to achieve decryption, and parameters 112 include only one sequence for decryption or encryption.

[0076] Module 234 is configured to move a q-bit gate from one or more encryption or decryption processes to a position within or outside the q-bit gate of the plaintext function segment. This is referred to herein as a merging process. In some embodiments, the merging process includes three steps. In the first step, the gate in the decryption segment is propagated forward through the gate in the plaintext function segment, thereby generating a merged segment of the first stage. In the second step, the gate in the encryption segment is propagated backward through the gate generated in the first step, thereby generating a merged sequence of the second step gate. In the third step, multiple q-bit gates of this sequence are merged into a k-bit gate (k>3). Gate propagation includes the movement of the gate through the gate located to its right or left, depending on whether it is forward propagation or backward propagation.

[0077] At the beginning of the step, the rightmost gate in the decryption segment (e.g., Gz) is propagated forward through J gates to reach or outside the plaintext function segment. J is called the propagation distance. As mentioned above, moving through J gates means that the Gz offspring (the "moving" gate Gz or the collision fragment gate farthest from it) also moves through J gates to the right of the original Gz. This process continues, and the second rightmost gate in the decryption segment (e.g., Gy) is propagated through J' gates to reach or outside the plaintext function segment. In this propagation, the second rightmost gate (Gy) also moves through the fragment gates (if any) left behind by the propagation of the first rightmost gate (Gz). Each remaining gate towards the target J' is counted as 1, and the target J' can be less than, equal to, or greater than J. The advantage of J' being equal to or less than J is that obfuscation can be effectively completed with less calculations. The advantage of J' being greater than J is that more thorough obfuscation can be achieved. In some embodiments, the J' value is randomly selected, and it varies around the value of J to increase the difficulty of deobfuscation. The above process is repeated until all gates in the decryption segment are at least partially propagated into or out of the plaintext function segment, thereby completing the merging of the decryption segment and the plaintext function segment.

[0078] In step two, the encrypted segment is merged with the sequence of gates obtained by merging the previous decryption and plaintext function segments. This process is similar to the process in step one, but is performed in reverse. At the beginning, the leftmost gate (e.g., Ga) in the encrypted segment is propagated backward through the K gates in the decryption-plaintext function merge segment. As previously described, moving through K gates means that the Ga offspring (moving gate Ga or its farthest collision fragment gate) also moves through the K gates to the left of the original Ga. This process continues, and the second leftmost gate (e.g., Gb) in the encrypted segment is propagated to the left through K' gates, including the gates left behind by the propagation of the first leftmost gate (Ga). Each remaining gate toward the target K' is counted as 1, and the target K' can be less than, equal to, or greater than K. Similar to J and J' above, the advantage of K' being equal to or less than K is that obfuscation can be effectively completed with less calculations. The advantage of K' being greater than K is that more thorough obfuscation can be achieved. In some embodiments, the K' value is randomly selected, and it varies around the value of K to increase the difficulty of deobfuscation. Step two ends when all gates in the encryption segment have at least partially propagated into the decryption / function gates merged on the left.

[0079] In some embodiments, the method may be modified to move the leftmost gate on the right side to the left side (R→L), or move the rightmost gate on the left side to the right side (L→R). Optional step 3 of merging multiple q-bit gates into one k-bit gate is described in more detail below.

[0080] Combination Figure 5 and Fig.26The output of module 234 is module 235, which includes a confusing sequence of q-bit reversible gates (and zero or more k-bit gates) equivalent to module 114, but in which the original decryption or final encryption process cannot be inferred, and therefore the encryption parameter values ​​in data 112 cannot be determined.

[0081] Module 236 is configured to convert the obfuscated sequence of q-bit reversible gates into obfuscated source code or target code. Module 236 uses at least part of the data in table 230. In some embodiments, as in the example described in more detail below, module 236 first merges at least part of the q-bit gates into a k-bit gate based on direct calculation or based on the association stored in table 230. The k-bit gate is converted into source code or target code using the association between the k-bit gate and the source code or target code instruction stored or encoded in table 230. In some embodiments, for those of ordinary skill in the art, the k-bit gate can be directly converted into one or more source code or target code instructions without multiple experiments based on rules, one or more instructions. The output of module 236 is module 250, which includes obfuscated source code or target code equivalent to module 114. As shown, module 250 can be securely transmitted to an unsecured server 282 with module 115 to operate on encrypted data 140 using the power, efficiency or flexibility of server 282.

[0082] Although in Figures 1 and Figure 2D The processes, devices, and data structures are depicted as an overall diagram of a specific setting, but this is only for convenience of description. Therefore, in other embodiments, one or more processes or data structures or parts thereof may be set in different ways on the same or different hosts, or in one or more databases, or omitted, or include one or more different processes or data structures on the same or different hosts.

[0083] Figure 3 A flow chart of an example method for securely processing encrypted data stored on a public resource on a public resource is shown according to an embodiment. Figure 3 And follow-up Figure 5 and Fig.26 The steps performed in a specific order are depicted in the figure, but this is only for convenience of description. Therefore, in other embodiments, one or more steps or parts thereof are performed in a different order, or overlap in time, are performed serially or in parallel, or are omitted, or one or more other steps are added, or the method is changed in some combination.

[0084] In step 301, table 230 is generated. It can be generated manually or automatically, and when the generation is completed, the result is stored on a computer readable medium as table 230. The entries in table 230 at least associate each source code or target code instruction with one or more q-bit gates. In some embodiments, the source code or target code is an instruction for a field programmable gate array (FPGA). In some embodiments, the association from the source / target code to the sequence of q-bit gates used is different from the association from the sequence of q-bit gates to the source / target code use. For example, in the case of forward association, each target code instruction in a reduced instruction set processor (RISP) is converted to the minimum q-bit gate; while in the case of backward association, each q-bit gate is converted to the most efficient RISP instruction, such as the SHIFT function, to execute a single q-bit gate.

[0085] In some embodiments using merging, the entries included in table 230 are used to convert from each of one or more source code or target code instructions to a k-bit gate (3 < k ≤ N). It is not difficult for a person of ordinary skill in the art to convert a q-bit or k-bit gate to a source / target code instruction without undue experimentation. In the least efficient way, it requires passing (2 3 ) and (2 k In embodiments where merging is not used, entries involving k-bit gates may be omitted from table 230.

[0086] In step 303, instructions are generated for module 115 to retrieve the input ciphertext from encryption data structure 140 and store the resulting ciphertext in data structure 140. This process can be done manually or automatically based on SQL queries.

[0087] In step 305, instructions are generated for module 114 to decrypt the ciphertext, apply the plaintext function and encrypt the resulting plaintext to produce the resulting ciphertext which is then stored. In some embodiments, step 305 includes breaking the function into several functional segments and adding new encryption instructions after each segment and adding corresponding decryption instructions before the next segment. In some embodiments where the target code is converted back and forth to q-bit gates, step 305 includes compiling the source code that executes the function (segment) and optionally compiling the first decryption segment and the subsequent encryption segment to generate the target code which is then converted to q-bit gates in step 307.

[0088] In step 307, table 230 is used to convert the instruction generated in step 305 into a sequence of q-bit gates. In some embodiments, a table is not used, but a gate compiler generated by a skilled programmer is operated to convert the source / object code into q-bit gates. In some embodiments, a combination of a compiler and table 230 is used. In some embodiments, a compiler for an FPGA is used or the gates are implemented on the FPGA, or both. In some embodiments, step 307 is performed by module 232. The output of step 307 is module 233 of q-bit gates.

[0089] In step 309, the q-bit gates corresponding to the plaintext function are decomposed into multiple segments, and encryption and decryption gates are added between the segments. In some embodiments, as described below, step 309 includes determining the number of gates included in each segment, and is related to the propagation depth determined in step 311. The determination of the penetration depth (e.g., J, J', K or K', or a combination) requires comprehensive consideration, because the greater the depth, the more collisions, and the more collisions, the more gates generated. Increasing the depth is beneficial to increase the degree of obfuscation, but generating too many gates will result in excessively long and inefficient code. In order to determine the number of segments, it is beneficial to obfuscate the function well enough without generating too many gates due to collisions. A single segment will achieve maximum obfuscation, but if all gates in the decryption and encryption segments are moved through the function segment, the number of gates will increase exponentially. Dividing the function into too many segments (e.g., one segment for each gate in the function segment) will result in unclear obfuscation. A good balance is that the number of segments is approximately the number of bits in the N-bit word (symbolized by ). However, the optimal number of segments depends on the type of function. For example, functions usually include many gates, such as For example, the multiplication function. But this is not always the case. Some functions may include fewer gates, such as For example, in this case, it is not necessary to subdivide F(x) into multiple segments to achieve a better merging without causing exponential growth. In fact, this is why it is proposed to divide F(x) into multiple segments, each with The reason is that the number of gates. Then, the merging can be done locally without causing exponential growth in the circuit length. The F(x) function of the gate is used to Segments. An example of determining the number of gates per segment is presented in the Examples section. To further confuse the inversion obfuscation, it is advantageous to add a random element to one or both of the segment length and penetration depth.

[0090] If the segmentation of the plaintext function has been completed at the source / target code level in step 305, step 309 is omitted. For example, steps 307 and 309 are replaced by Figure 2DIn some embodiments, encryption / decryption segments that have been written as sequences of q-bit gates are employed (rather than using encryption / decryption segments at the source / target code level).

[0091] In step 311, the q-bit gates involved in decryption are propagated forward past the q-bit gates involved in the plaintext function or its current segment. The distance moved into the plaintext function can be weighed based on the penetration obtained and the number of gates increased by gate collision. A distance J (e.g., the number of gates J) is defined to move the decryption q-bit gate forward into or out of the plaintext function (segment). An example method for determining this distance is described in the "Example" section. In conjunction with Figure 5 The general reversible 3-bit gate shown, and Fig.26 The control gate shown, utilizes a specific process described below to introduce how to resolve collisions with existing reversible q-bit gates and is explained in detail in the "Example" section.

[0092] In step 313, the q-bit gates involved in the encryption are propagated backward through the q-bit gates involved in the plaintext function or its current segment. The distance moved into the plaintext function can be weighed based on the penetration gained and the number of gates increased by gate collisions. A distance K (e.g., the number of gates K) is defined to move the encryption q-bit gate backward into or out of the plaintext function (segment). An example method for determining this distance is described in the "Example" section, K=J. In conjunction with Figure 5 The universal reversible 3-bit gate shown and Fig.26 The control gate shown, utilizes a specific process described below to introduce how to resolve collisions with existing reversible q-bit gates and is explained in detail in the "Example" section.

[0093] In some embodiments, other groupings are used. For example, the decryption and functional sections are grouped into one group (Group A), and then the gates from the encryption section (Group B) are moved into Group A, resulting in Group C.

[0094] In step 315, determine whether there is another decryption-plaintext function segment-encryption sequence of q-bit gates. If so, the obfuscated q-bit sequence of module 235 has been generated; and return to step 311. If not, go to step 317. For example, the loop described by steps 311, 313 and 315 is Figure 2D Module 234 in is executed.

[0095] In step 317, the sequence of q-bit gates in the obfuscated q-bit gate module 235 is replaced with (combined into) one or more k-bit gates. It is relatively simple to merge multiple q-bit gates into one k-bit gate, where k>3. For example, the program generates the k-bit gates based on the sequence of given q-bit gates. In these embodiments, table 230 associates source / target code instructions with q-bit gates (two ways) and k-bit gates with source / target instructions (one way). In some embodiments, merging is not used; step 317 is omitted.

[0096] In step 321, the q-bit gate and k-bit gate of the obfuscated code are converted into source code or target code using table 230 to generate obfuscated source / target code module 250. For example, steps 317 and 321 are performed by Figure 2D In some embodiments, if the merge occurs before sending the gate sequence in module 235, module 236 can be implemented on an unsecured server. This will take advantage of the computing power available on the cloud.

[0097] In step 323, the obfuscated code 250 and the data retrieval and result storage module 115 are sent to the unsecured server 182. In step 325, the unsecured server is caused to execute the retrieval / storage module 115 and the obfuscated code 250. For example, the command to execute these modules is sent to the unsecured server in the form of a message.

[0098] 2. Exemplary Embodiments

[0099] 2.1 Universal 3-bit Gate

[0100] Figure 5 A flowchart of an example method of propagating a first 3-bit gate through a second 3-bit gate according to an embodiment is shown, for example, in Figure 3 In step 311 or step 313 of the method shown. The notation used in this article is that the gate g acting on the 3 bits b1, b2 and b3 is written as G, which acts on the n-bit string, but is only valid for the 3 bits b1, b2 and b3. The three-gate program P acting on the n-bit word x can be expressed as P(x)=G3(G2(G3(x))) or P=G3·G2·G1. Therefore, more generally, for m 3-bit gates, P=G m ·G m-1 ·G m-2 ...G3·G2·G1. Furthermore, the program P can be viewed as an ordered list l of lines:

[0101]

[0102] Thus, the program P becomes a set of instructions, each with a sequence number given by line number l and ail 、x jl 、x kl and the permutation g1 on the specified 3 bits. Each row has n(n-1)(n-2)x8! possible instructions, some of which lead to the same result (because an instruction can reorder the 3 bits and choose the corresponding permutation g). One way to eliminate this simplicity and get a different number of instructions is to choose x il <x jl <x kl , thus giving Uncomplicated instructions, where the symbol And read the number of combinations of item a each time item b is taken.

[0103] Collision rule. Let's take the simplest case to illustrate the movement of the gate, that is, two consecutive gates act on different sets of three bits, so they are directly exchanged, that is, G l ·G l-1 =G l-1 ·G l In terms of program lines, if two consecutive gates do not share any bits, that is, if {x il ,x jl ,x kl}∩{x i(l+1) ,x j(l+1) ,x k(l+1)}=0,

[0104] Then we can swap row l and row l+1 in the instruction list. The swapping of consecutive gates can continue until two consecutive gates collide, that is, when the consecutive gates share one, two or three bits.

[0105] The probability of a collision can be estimated by the following equation: For randomly distributed gates, the probability that two consecutive gates share 0, 1, 2, or 3 bits is denoted as p0, p1, p2, and p3, respectively, and is given by the following unnumbered etc.

[0106]

[0107]

[0108]

[0109]

[0110] Note that for larger values ​​of n, p1≈9 / n and p2≈18 / n 2 , p3≈6 / n 3 , and p0=1-p1-p2-p3≈1-9 / n. The probability that a door passes directly through 1 door is p0 l=(1-9 / n) l ≈e -9l / n , or equivalently, the average penetration depth without collision is about l0=n / 9.

[0111] To adequately encrypt an n-bit word, n gates or more are required. Therefore, the penetration depth without collisions is part of the encryption segment of the program; it is usually not enough to obfuscate the decryption or encryption segment. To push the gates further into adjacent segments, a collision handling method is used, for example, to mix the information into multiple gates passing through a pair of collision gates before the collision. Figure 5 A method of moving information through a collision gate of a general 3-bit gate is described. Here, the two gates that collide with each other are called the first 3-bit gate and the second 3-bit gate, or gate Ga and gate Gb.

[0112] In step 501, determine the number of bit positions shared by the first 3-bit gate and the second 3-bit gate. If there are no shared bit positions, go to step 503. In step 503, the first 3-bit gate can be moved past the second 3-bit gate without collision, and no additional gates are generated. Then go to step 551.

[0113] In step 551, it is determined whether the first gate has propagated far enough, for example, through the number of gates indicated by the target gate number (such as J or K). Step 551 includes incrementing the propagated distance (for example, incrementing the propagation distance by 1). If the propagation distance is less than the target gate number, then go to step 553; otherwise, the process ends.

[0114] In step 553, the next first gate and the next second gate are determined. For example, after gates Gc to Gf ​​are generated, gate Gb is moved through Ga in a 2-bit collision, and it is asked "Has Ga passed through J (or K) gates?" It should be noted that in a collision that shares two bits, when Ga moves through Gb, Ga is replaced by the descendant gate Gf, and then it moves through the next gate in the circuit. The collision that shares one bit is similar, except that there are 7 fragment gates (such as Gc, Gd, Ge, Gf, Gg, Gh, Gi) in the collision. In this case, the back door Gi replaces Ga to move further. It can be understood that if the penetration direction is opposite (Gb moves through Ga), the descendant gate Gc will replace Gb in both types of collisions (collisions that share two bits and collisions that share one bit). Then, return to step 501 to check the number of bit positions shared by the next first gate and the second gate.

[0115] If it is determined in step 501 that all three bit positions are shared, then go to step 511. In step 511, the two 3-bit gates can be replaced by (combined into) another 3-bit gate that can achieve the same result. Figure 6A block diagram of a pair of example 3-bit gates that collide on all three bits according to an embodiment is shown. The result is a single 3-bit gate. In this case, the number of 3-bit gates is reduced after the collision; but the propagation distance is still increased by 1. It should be noted that there are 8! ways to decompose the resulting 3-bit gate into two 3-bit gates that act on the same bit. Because of the possibility tree generated, it is difficult to undo the merge caused by the collision. Then, go to step 551 and perform the above operations.

[0116] If it is determined in step 501 that the two bit positions are shared, then go to step 521. There are many ways to convert the gates Ga and Gb into unconfused Gc and Gd. One of them is to insert a gauge conversion in the two bits between the two gates. Figure 7 FIG. 1 shows a block diagram of an example pair of 3-bit gates Gg1 and Gg2 that collide on two bits according to an embodiment. This process does not produce any effect because 1) the topology of the circuit is not changed; 2) only the step between the two gates is affected, because Ga, Ga in the previous gate sequence are not changed. -1 The pair will be cancelled (Ga appears to double Ga -1 ). Instead, the process depicted in steps 521 to 541 provides greater confusion.

[0117] In step 521, first replace two 3-bit gates (designated as Ga and Gb, respectively) with four 3-bit gates (designated as Gc, Gd, Ge, Gf, respectively) and two interleaved gates Bk and Bl. The interleaved gates are 5-bit gates. Once determined, they can be converted to two or more easily determined 3-bit gates. The replacement gate settings are shown in Equations 1 and Figure 8 .

[0118] Gb·Ga=Gf·Bl·Ge·Gd·Bk·Gc (1)

[0119] Figure 8 A block diagram of an example pair of 3-bit gates colliding on two bits is shown, according to an embodiment.

[0120] In step 523, from Fig. 9 B1 and Bk are selected from the 6 interleaving permutations shown. Fig. 9 A block diagram of a set of example interleaved permutations for generating fragment gates when a 3-bit gate collides on two bits, according to an embodiment, is shown. B0, B1, and B2 are their own inverses, but B3, B4, and B5 are not. Bk and Bl can be selected arbitrarily from these six and their inverses. For convenience, Figure 8 Select k and l to determine the collision fragments so that Bl = Bk -1(The superscript -1 indicates going through the gates in the opposite direction). In this case, moving the permutation through gates Gd and Ge produces only three possible configurations of gates Gd' and Ge'. Fig.10 According to the embodiment, Bl=Bk is selected. -1 ,Block diagram of an example set of fragmented gates generated when 3-bit gates collide on two bits.

[0121] In step 525, two boundary 3-bit gates Gc and Gf are randomly selected from a specific table in 6 preset tables, where each preset table includes 840 groups of gates. When the interleaved gate Bk is selected, in order to determine the gates Gc, Gd, Ge and Gf, the gates Gc and Gf are first randomly selected from the pre-built table. The advantage of random selection is that the inverse operation of the obtained gates can be prevented. Each of the six tables contains 8! / (2! 4!) = 840 different types of 3-bit reversible gates. These tables are used to limit the possible sets of gates (Gc, Gd, Ge, Gf) to non-equivalent gates and simplify the search for gates Gd and Ge. The conditions that each gate in the 6 preset tables must meet are listed below. Fig.11 A block diagram showing exemplary construction conditions for a table for generating fragment gates when a 3-bit gate collides on two bits, according to an embodiment.

[0122] Tables 1 to 3 include gates {Gci} acting on bits x2, x3, x4, such that Gci≠Gcj·g,i,j=1,…,840. In Table 1, g is the product of a permutation on bit x4 and a 2-bit gate acting on bits x2 and x3. In Table 2, g is the product of a permutation on bit x3 and a 2-bit gate acting on bits x2 and x4. In Table 3, g is the product of a permutation on bit x2 and a 2-bit gate acting on bits x3 and x4. Tables 4 to 6 include gates {Gfi} acting on bits x1, x2, x3, such that Gfi≠g·Gfj,i,j=1,…,840. In Table 4, g is the product of a permutation on bit x1 and a 2-bit gate acting on bits x2 and x3. In Table 5, g is the product of a permutation on bit x2 and a 2-bit gate acting on bits x1 and x3. In Table 6, g is the product of a permutation on x3 and a 2-bit gate acting on bits x1 and x2. These tables can be generated in any manner. For example, in some embodiments, the tables are generated by trial and error, i.e., by going through all 3-bit gates (8! gates) and for each gate removing all gates that are equivalent to the product of a 2-bit gate (4! = 24 possibilities) and a 1-bit gate (2! = 2 possibilities). Thus, in total, each table needs to check 8! x 4! x 2! = 1,935,360 cases. This is well within the capabilities of current processors (e.g., takes less than an hour per table).

[0123] The correspondence between the interleaved gate type selection and the selected table is as follows. For B0 and B1, gate Gc is randomly selected from Table 1 and gate Gf is randomly selected from Table 4. For B2 and B3, gate Gc is randomly selected from Table 2 and gate Gf is randomly selected from Table 5. For B4 and B5, gate Gc is randomly selected from Table 3 and gate Gf is randomly selected from Table 6.

[0124] In step 527, the remaining two 3-bit gates Gd and Ge are used to solve Equation 2.

[0125] Ge·Gd=O=Bk·Gf 1 ·Gb·Ga·Gc -1 ·Bk -1 (2)

[0126] It should be noted that the product Ge·Gd with only two bits of overlap corresponds to a 4-bit operation gate marked as O. Fig.12 A block diagram is shown in which an exemplary 4-bit operator O is decomposed to determine fragment gates Gd and Ge when a 3-bit gate collides on two bits according to an embodiment. In step 527, it is determined whether a solution to equation 2 is found. If not, return to step 525 to randomly select two different boundary gates Gc and Gf, and repeat the attempt in step 527 to solve the remaining gates Gd and Ge. If a solution is found, go to step 541. Many pairs of gates Gd and Ge are usually found. As a rule of thumb, starting from 2500 arbitrary gates Ga and Gb, 1.25% have one solution (Gc, Gd, Ge, Gf), 31.80% have 2 to 10 solutions, 49.16% have 11 to 100 solutions, 11.76% have 101 to 1000 solutions, and 6.04% have more than 1000 solutions. Due to the gauge symmetry Gb·Ga=Gb·g·g -1 • Ga, not all (8!) 2 pairs of Ga and Gb gates need to be tested, where g is a gate containing a two-bit permutation acting on a bit shared by Ga and Gb and a one-bit permutation acting on a bit not shared by Ga or Gb.

[0127] To further explain steps 521 to 527, Fig.13A Take the gates Ga and Gb in as an example. Fig.13A Several sets of exemplary fragment gates Gc, Gd, Ge, and Gf are shown when 3-bit gates Ga and Gb collide on two bits, according to an embodiment. Fig. 13B The truth table corresponding to gates Ga to Gf ​​is shown in , marked with their subscripts. Fig. 13B An exemplary set of truth tables for fragment gates Gc, Gd, Ge, and Gf when 3-bit gates Ga and Gb collide on two bits are shown according to an embodiment.

[0128] In step 541, based on the two shared bit positions, it is determined whether step 521 is entered from step 501. If so, the collision is resolved and the process goes to step 551 to see if further propagation is required. Otherwise, the process goes to step 542, as described below.

[0129] If it is determined in step 501 that only one bit position is shared, go to step 531 and proceed to utilize the above solution for gates with 2 shared bit positions. In step 531, add a swap gate S1 before the first gate (Ga) so that two bits are shared with the second gate (Gb). A swap gate is a 2-bit gate that swaps the position of two bits without changing the value, which can be implemented by a simplified 3-bit gate that does not change the value or position of one bit. Add an inverse swap gate S1 after gate Ga and before gate Gb. -1 It should be noted that S1 -1 =S1. The resulting gate is given by Equation 3a:

[0130] Gb·Ga=Gb·S1 -1 ·S1·Ga=Gb·S1 -1 ·Ga'·S1=Gb·S2·Ga'·S1 (3a)

[0131] Where Ga' is a gate based on Ga, but has a two-bit overlap with Gb due to the action of the swap gate S1. Ga' is formed by moving S1 before the gate Ga. One SWAP gate is inside the circuit, call it S2; the other is moved outside, call it S1. But both are used to swap the same two bits. Ga can be transformed to Ga' by swapping the bits in the gate definition. For the selected gate, there are four ways to insert the SWAP, depending on which bits need to be swapped and how they are swapped. Therefore, there are eight ways to handle collisions in total.

[0132] Fig.14 A block diagram of eight exemplary ways of introducing a swap gate when a 3-bit gate collides on one bit according to an embodiment is shown. In the illustrated embodiment, gate Ga acts on bits x1, x2, and x3, and gate Gb acts on bits x3, x4, and x5, so the two collide on bit x3. (These bits do not need to be adjacent to each other). In the following, only the implementation process of the first way is discussed for swapping the first bit of gate Ga with the second bit of gate Gb; of course, the process is also applicable to the other seven ways. Fig.15 A block diagram showing a set of example steps for generating a significant fragment gate when a 3-bit gate collides on one bit according to an embodiment. For the example of swapping the first and fourth bits using S1=S2, Fig.14 The first exchange shown in produces Fig.15 The result of step 1 is depicted in .

[0133] In step 533, another pair of exchange gates S3 and S4 are added between Ga' and the reverse exchange gate S2 = S3 -1 The two swap gates swap and unswap the two colliding bits. The result is expressed in Equation 3b.

[0134] Gb·Ga=Gb·S2·S4·S3·Ga'·S1 (3b) This step description Fig.15 In step 2 of the illustrated embodiment, the first of the two, S3, is combined with Ga' to form Ga", and the second, S4, is combined with the reverse exchange gate S2 to form Gp.

[0135] Gb·Ga=Gb·Gp·Ga”·S1 (3c)

[0136] Among them, Ga″=S3·Ga′, and Gp=S2·S4.

[0137] The result consists of three gates Ga", Gp and Gb, with every two gates sharing two bit positions. This step is described in Fig.15 In step 3 of the illustrated embodiment.

[0138] Then, go to step 521, for the collision of two bits, replace the artificially generated gate Gp and the original gate Gb with four gates and two interleaved gates, see equations 4a and 4b.

[0139]

[0140] Where A=Bl·Ge·Gd·Bk (4b)

[0141] This step is described in Fig.15 In step 4 of the illustrated embodiment.

[0142] However, if the solution result Gf·A·Gc·Gf is obtained in step 527 and go to step 541, the answer to the test is no, and the original gates Ga and Gb do not share 2 positions; then, go to step 542.

[0143] In step 542, it is determined whether the two-bit collision is the first collision generated by the original one-bit collision, such as Gp and Gb. If yes, go to step 543.

[0144] In step 543, the first gate Gc generated by the first solved two-bit collision is collided with the gate Ga" remaining after exchanging the original gate Ga with the exchange gate S3. As described above, four more gates and two interleaved gates are added for the two-bit collision, see equations 5a and 5b. For convenience, the outer gate is called Ga"' instead of Gf' to reflect the deepest penetration of the information introduced by gate Ga.

[0145]

[0146] Where, B = Bl′·Ge′·Gd′·Bk′ (5b)

[0147] This step is described in Fig.15 In step 5 of the illustrated embodiment.

[0148] In step 542 , if it is determined that the two-bit collision is not the first two-bit collision generated by the original one-bit collision, then go to step 545 to process the result equation 5a in step 543 .

[0149] In step 545, the remaining exchange gate S1 collides with gate A′·Ga″·B′·Gc″ until the collision affects the outer gate Gf generated by the collision shown in equation 6 in step 543. The collision of the two-bit exchange gate S1 with the three-bit gate Gc' can be regarded as a simplified three-bit gate G1 that has a two-bit overlap with Gc', so the two-bit collision method can be used. It turns out that for this collision, the result is clear: the exchange gate S1 "passes through" the 3-bit gate, which actually just exchanges the bit lines. The exchange gate S1 moves through the various gates, modifying each gate until it collides with gate Gf. By construction, gates S1 and Gf share two bit lines. Therefore, S1 can be absorbed by Gf, converting the latter into Gf', which acts on the same bit line as Gf.

[0150] Gb·Ga=Gf'·A'·Ga""·B'·Gc" (6)

[0151] Note that for permutations A and B, and A' and B', their two 3-bit gates have three possible configurations (for the exemplary embodiment shown, Fig.15 The net result of this process is the creation of a sequence of seven 3-bit gates that are equivalent to the original gates Ga and Gb.

[0152] Then, go to step 551, as described above, to see if further propagation is required.

[0153] In some embodiments, the obfuscated code that operates on encrypted data is part of the entire program that does not need to be obfuscated. In some of these embodiments, the obfuscated code is embedded between unobfuscated instructions.

[0154] Multiple encryption. In the above step 309, before the collision gate, decryption and encryption gates are intermittently or periodically added to all gates representing function f. Here, a 3-bit gate is used as an example to introduce this step and the resulting confusion. If n (expressed as gate (usually for gate Ga bit i a 、j a , k a The following method is advantageous. Fig.16 As shown, the function f is decomposed into products, f = f p ·f p-1 …f2·f. Fig.16 and Fig.17 A block diagram showing an embodiment of introducing intermediate encryption and decryption steps to further obfuscate the program through collision gates. For periodic encryption, if f includes n g gates, then each sub-function f r Set to include n g / p gates, r=1,...,p-1, where f p Contains all remaining gates. The periodic encryption is expressed as follows in Equation 7.

[0155] E'·f·E -1 =(E'·f p ·E p-1 -1 )…(E r ·f r ·E r-1 -1 )…(E2·f2·E1 -1 )·(E1·f1·E -1 )(7)

[0156] like Fig.17 As shown, a different encryption / decryption permutation E can be selected for each r=1, ..., p-1 r 、E r -1 .

[0157] It should be noted that each block (E r ·f r ·E r-1 -1) is itself an example of a computation that decrypts-computes-encrypts data. If each is obfuscated, then their product will also be obfuscated. Obfuscating each block means that the encryption / decryption fragment or operation f cannot be inferred from the output of each block. r .

[0158] There are many ways to confuse a block (E r ·f r ·E r-1 -1 ), where E r-1 -1 and E r Each contains an number of gates. Here, a is a constant. (For safety purposes, setting a to 3 or 4 is sufficient), and assuming f r Contains bn~ng / p gates. Fig.18 A block diagram showing three sets of example steps for generating an obfuscated program according to an embodiment is shown. Fig.18 It shows that the expression E r ·f r ·E r-1 -1 Steps to merge into the garbled circuit Cr: (i) Substitute E r-1 -1 and f r Merge into block A r , and the gate from as block B r E r Move through block A r (corresponding to Figure 3 (ii) converting f r and E r Merge into block A r , and the gate from as block B r E r-1 -1 Move through block A r (corresponding to Figure 3 or (iii) removing the gate from block B r E r Move through as A r f r , get the merged block Ar', and then add the gate from block B r E r Move through block A r (corresponding to Figure 3 311 and 313 in FIG.

[0159] Here, refer to Figures 23a to Fig.23C Describe option (i) in detail. FIG. 23A to FIG. 23CA block diagram showing an exemplary distance that an encryption / decryption gate moves toward a function code, according to an embodiment. This explanation can be easily extended to other schemes.

[0160] According to solution (i), the system can be reorganized into E r ·(f r ·E r-1 -1 ), in E r There are an gates in (f r ·E r-1 -1 ) has (a+b)n gates. Confusion is achieved by (f r ·E r-1 -1 ) is completed by merging r Side, called E r is the Br side. Equation 8a gives the number of gates or A r Length:

[0161] l(A r )=(a+b)n. (8a)

[0162] In this example, if Fig.23A As shown, B r Each gate in is labeled Gb r , i = 1, 2, ..., an, is pushed into A as follows r Side middle. Take B r The closest to A r and B r The gate of the interface between (gate Gb1 in the first iteration) pushes it into A r , all the way to A r The starting point of the circuit (A r Relative to the opposite side of the interface, such as until the movement affects A r The result (after all collisions) is circuit A on one side. r (1) and on the other side circuit B r (1) , including gates Gb2, ..., Gb an When gate Gb1 is pushed into A r When the door hits the far side, A r The size of l(A r ) increases to A r (1) The size l(A r (1) ).

[0163] The increased length l(A r(1) )-l(A r ) can be estimated according to the following formula. The collision-free penetration depth obtained above is l0 = n / 9, so collisions. Each collision adds (δ-1) gates to the circuit, where δ=6 represents a one-bit collision and δ=3 represents a two-bit collision. (δ=0 represents a three-bit collision, because the two colliding gates are merged into one gate.) As mentioned above, since p1 is n times larger than p2, and p2 is n times larger than p3, the probability of a one-bit collision is higher.

[0164] Therefore, when n is large enough, A r The added length of the side is shown in Equation 8B.

[0165]

[0166] When the preset value of K is greater than the circuit length l(A r ), the collision gate will move through the entire circuit, increasing the total length of the circuit to l(A r (1) ). Repeat this operation for other gates until the total length of the m-th gate is l(A r (m) ) is equal to or greater than K. Then, the remaining gates that have not been moved are only moved by a fixed length K. In this way, it can be determined that the length of the circuit will not grow exponentially with the size of the register N (=n).

[0167] After propagating Gb1, similar to the operation on Gb1, push Gb2 into A r (1) , but not to A r (1) The endpoint of Fig. 23B As shown, the distance from A r (1) The endpoint distance is In this way, gate Gb2 is pushed into A r (1) The number of gates passed in the first step is the same as the number of gates Gb1 is pushed into A in the first step. r The number of gates passed through is the same. Circuit A r (2) The length of satisfies Equation 8c:

[0168]

[0169] This process goes through all the gates in B. Push gate Gbi into circuit A r (i-1) , and stops at a distance of (i-1)Δl from its end point, thus obtaining circuit A r (i) , the length satisfies equation 8d:

[0170]

[0171] At the end of step 313, if Fig.23C As shown, B r All the an doors inside push into A r On the other hand, the two circuits are combined into circuit C. r The final length of the merging circuit can be obtained by recursion of Equation 8d, as shown in Equation 8e:

[0172] l(A r (an) )=l(A r )+anΔl (8e)

[0173] Because B r The gate list on side A has been emptied to side A, or equivalently, l(B r (an) )=0, so the combined circuit C r The total length of is given by Equation 8e. As defined above, replace A with (a+b)n r The length of the combined circuit C can be obtained based on the Δ1 defined in equation 8b, 8c or 8d. r The length of is used to represent the current segment, as shown in Equation 8f:

[0174] l(C r )=(a+b){1+9a(δ-1)}n (8f)

[0175] It should be noted that, since the final stop positions of the collided Gb' are spaced A1 = K from each other, B r The gates in are evenly arranged along the merging circuit C.

[0176] exist Figure 3 In the loops 311 to 315 shown, the above merging is performed on all segments, r=1, ..., p. and E p =E′, this representation can be extended to the first decryption and the last encryption. Now we can calculate the equivalent of E′·f·E -1 The length of the complete garbled circuit. It can be seen that (E r ·f r ·E r-1 -1 Each block in the ) block generates a garbled circuit C of length given by Equation 8f r . Recall from above that f includes n g gates, and assume that each f r All include bn~ng / p gates. So there are Therefore, the length of the entire obfuscation circuit l(obfuscate) is C given by Equation 8f r Multiply the length by a factor

[0177] Since the length of the encryption and decryption parts in the original circuit is an, and the length of the original function f is n g , so the total length of the original circuit is 2an+n g Equation 9a gives the expansion factor Z by which the circuit length can be expanded.

[0178]

[0179] Assume that n g >>2an, then in the expression (2an+n g ) can ignore 2an, so the remaining term n g Therefore, Equation 9a is simplified to Equation 9b.

[0180]

[0181] For representative values ​​of a-3, b-1, and δ-1-5, the expansion factor is z-544. Therefore, in this exemplary embodiment, E'·f·E -1 Merging into a single indistinguishable set of 3-bit reversible gates incurs an overhead factor of about 500. However, this overhead is much smaller than the overhead of other recently proposed homomorphic methods. For many important applications, an overhead factor of 500 is reasonable and acceptable.

[0182] In step 317, as described above, multiple 3-bit gates are combined into at least one k-bit gate, k>3. After applying the gate collision rule, multiple 3-bit gates can be combined into each of one or more larger k-bit gates to further confuse the circuit. The 2-bit gates are combined by determining the product of multiple 3-bit gates acting on the k-bit line. k However, in reverse, 2 k It is difficult to decompose a permutation of 10 inputs into the product of multiple smaller permutations produced by multiple 3-bit gates acting on a set of k lines. In the present invention, the process of multiplying 3-bit gates to form a k-bit gate whose internal components are difficult to determine is called "gate merging".

[0183] There are different ways to collect sets of 3-bit gates to be merged together. One example is growth, which proceeds as follows. First, select a 3-bit gate somewhere in the circuit and make it the first gate of the cluster; then, search for the first neighbor on its left or right that shares at least one bit with it and add it to the cluster as the second gate. The number of bit lines used by the two gates in the cluster is at most 5, of which 3 are the 3 bit lines of the first gate, and at most 2 are not used by the first gate but are used by the second gate. Continue to grow the cluster by searching for a third gate on the left or right of each gate in the cluster that shares at least one bit with them. When the third gate joins the cluster, it spans at most 7 bit lines. Repeat the above process until the cluster spans k bit lines. Fig.19 An example of the merging process is shown in FIG.

[0184] Fig.19 FIG. 4 is an exemplary block diagram showing merging 3-bit gates into multiple gates including more bits to further obfuscate a program according to an embodiment. Fig.19 The figure shows the merging of fifteen adjacent 3-bit gates into three adjacent gates A, B, and C, where A is a 9-bit gate and B and C are 8-bit gates. The minimum number of 3-bit gates in a k-bit gate cluster is h min =(k-1) / 2. The product of all the basic 3-bit gates in the cluster is 2 acting on k bits. k permutation P on the state space. This product can be calculated and stored as a 2 k A list of numbers P(z) where z = 0, ..., 2 k -1.

[0185] It is a difficult problem to recover or decompose the permutation P into the product of the basic 3-bit permutations. By exhaustively searching all possible combinations of 3-bit gates of the k-bit permutation P generated by multiplication, at least the number of steps S given by Equation 10 is required.

[0186]

[0187] k is an odd number. For example, when k=11 bits, the permutation P can be stored with a list of 211 words, each of which is at most 11 bits, such as in a memory less than 5KB. (Note that the merging of 3-bit gates can pass the preprocessing operations of multiple gates to the server to store the product results of multiple 3-bit gates in memory). However, factoring the permutation P requires a large amount of computation. To fully decompose the permutation into its original 3-bit components, it would take 10 32 When k = 21 bits, the permutation P can be stored in a memory less than 7MB, but exhaustive search to decompose P into basic 3-bit gates would require up to 10 71 Steps.

[0188] It is also important to note that a k-bit gate or 2 k The permutations on the states have different factorizations when factored into products of 3-bit operations. Even if the factorization is found, it does not mean that the obfuscation can be restored. If the permutation found is not exactly the same as the one used in the above scheme, it actually further obfuscates the operation.

[0189] Multiplication example. A function f that multiplies two numbers x and y produces x · y. Implementing this function with reversible gates may require auxiliary bits. Fig. 20 FIG. 1 is a block diagram showing a set of example sequences of 3-bit gates for a 2-bit multiplication function f according to an embodiment. The 2-bit multiplication circuit is based on a controlled ripple adder, using six Toffoli Ts and four Rs. 3-bit reversible gate. The illustration shows R and The gate is decomposed into CNOT gate and Toffoli gate. Fig. 20 Five auxiliary bits are used.

[0190] When x and y are given as input, the auxiliary bit is set to zero and the circuit outputs x, x·y and an auxiliary bit set to 0.

[0191] To encrypt data and operations, the encryption functions E and E' each contain about 30 3-bit reversible gates. Function f is decomposed into three blocks of partial functions f1, f2 and f3, each of which defines a subset of the circuit, and an encryption and decryption block is inserted between each pair of consecutive partial functions, that is, E1 and E1 are inserted between f1 and f2. -1 , and insert E2 and E2 between f2 and f3 -1 . Fig.21 According to an embodiment, the intermediate encryption and decryption blocks are inserted into Fig. 20 The block diagram of the example in function f is shown.

[0192] The blocks are then merged. Fig. 22 The final step consists of merging sets of adjacent 3-bit gates into k-bit gates, where k is large enough to make collisions unfeasible. Fig. 22 According to an embodiment, using Fig.21 Block diagram of exemplary steps for obfuscating a 2-bit multiplication function f using multiple intermediate encryptions. Block A1 = f1·E -1 Combined with B1=E1, we generate circuit C1. Similarly, block A2=f2·E1 -1 Merge with B2=E2, and block A3=f3·E2 -1 Combined with B3=E1, circuits C2 and C3 are generated respectively. Combining circuit C3·C2·C1=P generates a garbled circuit.

[0193] 2.2 Control gate

[0194] In some embodiments, a CNOT control gate with q-1 control bits is used, where q∈{1, 2, 3, ...}. In the present invention, a control gate refers to a function in which the value of a single target bit (also called the first bit, or the head of the gate) is a function of the values ​​of zero or more control bits (also called the tail bits, or the tail of the gate). The tail bits indicate the logic applied to the first bit based on the binary input of the control bits. The binary input of any tail bit is not changed, but simply passed to the next gate. The use of q-bit control gates provides a simpler set of collision rules. Any expression consisting of a set of reversible 3-bit gates can be reconstructed as a set of gates consisting only of control gates. Therefore, in Figure 3 In step 301 of the illustrated method 300, in some embodiments, each source / object code instruction is associated with one or more control gates in a table. Those skilled in the art understand how to program most basic functions in terms of control gates.

[0195] FIG. 24A to FIG. 24C A schematic block diagram of an exemplary control gate used to replace a 3-bit gate according to an embodiment is shown. A single target bit is represented by a circle with a vertical cross inside. A control bit can be either a "true" type logic (solid circle) or a "false" type logic (open circle). False type logic means that the control is activated only when the value of the corresponding bit is 0. The simplest control gate is a "not" gate (see Fig.24A ), only acts on one bit: x1→x1', that is, flipping the state of the target bit. (The apostrophe here means negating the bit value.) It should be noted that there is no control bit in the "NOT" gate. Fig. 24B As shown in Figure 1, a CNOT is a control gate with one control bit and one target bit. For true logic, x1→x1 (the output is the same as the input, for all tail bits) and For pseudo logic, x1→x1 for all tail bits, and symbol Represents an exclusive OR (XOR) operation. When either x1 or x2 is true and both are not true at the same time, the expression is true. The Toffoli gate has two control bits at the end and one target bit at the beginning, and it consists of Fig.24C For example, in one case, when both control bits are true, then x1→x1 and x2→x2 (same for all tail bits), and That is, x3 is XORed with the product of x1 and x2. If any control bit belongs to false type logic, the value of that bit is negated in the XOR and multiplication operations. It is important to note that the reversible control gate uses the XOR function to define the new first bit value. All other logic operations can be obtained by combining the gates in a set of XOR control gates.

[0196] Fig.24D A diagram of an exemplary 6-bit control gate resulting from fusion or collision, according to an embodiment, is shown. In the example, the 6-bit control gate has five tail bits (three "true" and two "false"). The logic performed at the first bit is the XOR of the product of the value input to the first bit and the value of the tail bit, negated as shown by the open circle. In Section 2.2 below, gates of the control target type will be referred to simply as gates unless it is clear from the context. Fig.25 A simplified schematic diagram of an exemplary control gate used to replace a 3-bit gate is shown in accordance with an embodiment. Fig.25 A simplified graphical representation of a control gate is introduced, with all control bits at the end replaced by a box. Sometimes, one or more control bits in the box are pulled out to show the gate in order to distinguish between gate collisions.

[0197] Each control gate g can be labeled by a list containing a header (the controlled bit address) and a tail, including the bit address associated with true or false logic, which for simplicity is called a bead in the following. Each bead b corresponds to a pair (i(b), σ(b)), containing the control bit address i(b) and whether the control is inverted (σ(b) = 1, corresponding to an open circle) or not inverted (σ(b) = 0, corresponding to a solid circle). For example, [3, [(1, 0), (2, 0)]] is a Toffoli gate that acts on bit 3 controlled by bits 1 and 2, and does not invert: x1 → x1, x2 → x2, and For another example, [2,[(1,1)]] is a CNOT gate. If bit 1 is false, it acts on bit 2, thus negating the value of bit 1: x1→x1. The NOT gate on bit 1 is simply labeled [1, []], with an empty tail, i.e., no tail bit. Let h(g) and t(g) denote the head and tail of gate g, and (again)(i(b),σ(b)) denote the bit address and control type of bead b∈t(g), respectively. The logic function of gate g can be written onto the controlled bit, as shown in Equation 11.

[0198]

[0199] collision. Fig.26 A flow chart of an exemplary method for propagating a first control q-bit gate through a second control q-bit gate, for example using Figure 3Unlike the rules used to combine control bits in optimizing quantum circuits, the rules used in method 2600 do not require all control bits to be true logic. In this method, two adjacent gates Ga and Gb are first moved past each other, such as Figure 3 Step 311 and / or step 313 of method 300 are shown.

[0200] FIG. 27A to FIG. 27D The block diagram of FIG. 1 illustrates an exemplary collision of control gates having a shared target bit or control bit, according to an embodiment. Fig.28A and Fig.28B An exemplary collision of control gates with different non-overlapping control bits is shown, according to an embodiment. FIG. 29A to FIG. 29D The block diagram of FIG. 1 shows an exemplary collision of two control gates, where a bit at the head of one gate overlaps a bit at the tail of the other gate, according to an embodiment. These types of collisions are called single-head collisions. FIG. 30A to FIG. 30D The block diagram of shows an exemplary collision of multiple control gates according to an embodiment, where a bit at the head of two gates overlaps with a bit at the tail of the other gate. These types of collisions are called double-headed collisions. The X and Y in the figure represent Boolean functions on the control bits of the two colliding gates Ga and Gb that do not participate in the collision; these control bits do not overlap with any controlled bits of the other gate. As described above, only the values ​​of the controlled bits can change.

[0201] In step 2601, it is determined whether the two gates Ga and Gb are identical, i.e., whether they have tails acting on the same bit and the same target bit. Fig.27A . Note that both tails are marked with an X to indicate that they are identical. This can happen with fragment gates created by other collisions. Logically, this would cause the second gate to undo the effect of the first; and the combined result would be no effect at all. Therefore, as shown in the attached Fig.27A As shown, if it is determined in step 2601 that the two gates are the same, then in step 2603, both gates are removed from the circuit. This type of collision reduces the number of gates, which is called simplification. Then go to step 2651.

[0202] In some embodiments, step 2601 includes determining whether one or more other simplified conditions exist, such as adjacent gates having the same head bit and tail bit except for one tail bit. Fig.27B , Fig.27C and Fig.27D These situations are shown in . Fig.27B and Fig.27D 1 shows a first gate Ga and a second gate Gb, which are identical except that the first gate Ga includes an additional tail bit, wherein the additional tail bit included by the first gate can be a true logic type ( Fig.27B) or false logical type ( Fig.27D ). In either case, the collision (simplification) rule is that the two gates Ga and Gb are replaced by a single simplified gate Gs, which has the same head bit and the same common tail bit (X), but the opposite logic type of the bit that the first gate Ga additionally includes is also included in the tail of gate Gs. Fig.27C Two gates Ga and Gb are shown, which are identical except for one tail bit with different logic types. In this case, the collision (simplification) rule is that the two gates Ga and Gb are replaced by a single simplified gate Gs with the same header bit and the same common tail bit (X), but the simplified gate does not include the other tail bits. That is, the tail bits of the original two gates with conflicting logic types are removed from the tail of the simplified gate Gs.

[0203] In step 2651, it is determined whether the resulting gate has passed through the instruction list far enough, for example, through J or K gates, into the adjacent part of all the gates to be moved, as described in more detail below. If not, the next first gate Ga and second gate Gb are selected, and the process returns to step 2601. If enough gates have been passed through, the process goes to step 2653, which in some embodiments scans the resulting sequence of gates (also known as the instruction list or "circuit") to perform other simplifications. The process then ends and returns to Figure 3 Step 313 or 315 in method 300 is shown.

[0204] If it is determined in step 2601 that the two gates g1 and g2 (e.g., Ga and Gb) are not the same, then go to step 2611. In step 2611, it is determined whether the control bit in the second gate Gb is shared with the target bit of the first gate Ga. This is the case in Fig.29B and Fig.29D As shown in FIG. , it indicates at least one single head collision at the rear, and also Fig. 30A , Fig. 30B , 30C As shown in FIG. 30 , it is represented as a double head collision at the tail. If yes, then in step 2613, it is next determined whether the control bit in the first gate Ga is shared with the target bit of the second gate. If not, Fig.29B and Fig.29D As shown, there is only a single head collision on the tail, and then go to step 2621.

[0205] In step 2621, the single head collision rule between the tail and the head of the first door is used. Fig.29B The collision tail shown is true logic (solid circle), or Fig.29DIn the case where the collision tail is a false type logic, a fragment gate Gc is generated. In either case, the collision rule indicates that the fragment gate Gc has a combined tail, but does not include the collision bit and the head of the second gate Gb, for the logic represented by equation 11. In step 2641, the original two gates Ga and Gb are replaced (substituted) with three gates arranged in the order of Gb, Gc, Ga. Then go to the above step 2651 and the steps thereafter; the result is a three-gate order of Gb, Gc, Ga.

[0206] If it is determined in step 2613 that the control bit in the first gate Ga is shared with the target bit in the second gate Gb, a double-head collision occurs on the tail. This double-head collision includes Fig. 30A , 30B , Fig. 30C and Fig.30D Example shown. Go to step 2615, in which the door collision is performed using the rule of double-head collision. Fig. 30A The two colliding tail bits shown are both true logic (solid circles), or Fig. 30B One of the colliding tail bits shown is true and the other is false, or Fig. 30C One of the colliding tail bits shown is of false logic type and the other is of true logic type, or Fig.30D The two collision tail bits shown are both false type logic (open circles), and two fragment gates Gc and Gd are generated. In either case, the collision rule shows the control gate logic expressed by equation 11, that is: 1) the fragment gate Gc has the head bit and tail bit of the first gate Ga, where the tail bit combines the tail of the first gate Ga with the tail bit of the second gate Gb that does not participate in the collision; 2) the fragment gate Gd has the head bit and tail bit of the second gate Gb, where the tail bit combines the tail of the second gate Gb and the tail bit of the first gate Ga that does not participate in the collision.

[0207] In step 2617, the original two gates Ga and Gb are replaced (substituted) by four gates arranged in the order of Gb, Gc, Gd, and Ga. Then, the process goes to the above step 2651 and subsequent steps.

[0208] If it is determined in step 2611 that no control bit in the second gate Gb is shared with the target bit of the first gate Ga, then go to step 2631. Fig.28A and Fig.28B , indicating that the head does not collide with the tail, and Fig.29A and Fig.29C , indicating that at most a single head collision occurs with the rear. If yes, then go to step 2631.

[0209] In step 2631, it is determined whether the control bit in the first gate Ga shares with the target bit of the second gate Gb. If not, there is no collision between the head and the tail; the gate can pass directly; and go to step 2633. These situations are Fig.28A and 28B In step 2633, because the two doors can pass directly, the first door moves past the second door. Then go to the above-mentioned step 2651 and the steps thereafter.

[0210] If it is determined in step 2631 that the control bit in the first gate Ga is shared with the target bit in the second gate Gb, then go to step 2635. In this case, the second gate Gb has a single-head collision with the tail of the first gate Ga, such as Fig.29A and Fig.29C In step 2635, the gates are collided using the single-head collision rule that occurs at the tail with the head of the second gate Gb. Fig.29A True type logic as shown (solid circle), or Fig.29C In the case of the pseudo-type logic shown, this process produces a fragment gate Gc. In either case, the collision rule states that the fragment gate Gc has a combined tail that does not include the collision bit and the head of the first gate Ga for the logic represented by equation 11.

[0211] In step 2641, the original two gates Ga and Gb are replaced (substituted) by three gates arranged in the order of Gb, Gc, Ga. Then go to the above step 2651 and subsequent steps, and the result is the three-gate order of Gb, Gc, Ga.

[0212] The collision rule described above can be expressed by the following mathematical equation. X and t Y Defined as the tailball set of Boolean functions X and Y that do not participate in the collision of gates Ga and Gb. Express them in equations 12a and 12b.

[0213]

[0214]

[0215] The product of the two can be written as Equation 13.

[0216]

[0217] If the collision is included, the expression can be simplified, that is, if there are beads b1, b2∈t X ∪t Y, so that i(b1)=i(b2) (same bit line), but σ(b1)≠σ(b2) (opposite negation). In this case, the conflict of type x'x is always 0 (False). Therefore, XY can be rewritten according to Equation 14.

[0218]

[0219] By checking for situations where collisions occur, it is possible to remove doors with XY on the tail when constructing collisions, as in these situations the fragmented door will disappear.

[0220] Another simplification is to combine the two gates into one. Consider two gates h(Ga) = h(Gb) (bit lines with the same header) and tails t(Ga) and t(Gb). Let t(Ga, Gb) ≡ t(Ga) ∩ t(Gb) denote the intersection of the two tails; then let t (Ga, Gb)≡(t(Ga)∪t(Gb))\(t(Ga)∩t(Gb)) represents the remaining bits outside the two tail intersections. The following simplifications are possible.

[0221] If | t = 0, then the two gates have the same beads and are therefore identical (all gates controlled by the same control line are either involutive or reflexive). In this case, the two gates can be removed from the circuit. This simplification is Fig.27A As shown in FIG. 1 , and implemented in steps 2601 and 2603 .

[0222] If | t (Ga, Gb)|=1, then the two gates have the same bead. Therefore, there is a bead b * ∈ t (Ga, Gb) appears in one gate but not in the other. The two gates can be combined into one using equations 15 to 17.

[0223]

[0224]

[0225]

[0226] In other words, the tail of the combinatorial gate contains the common beads and the same bit address but for beads b. * The bead b$ with the inverse of σ=(i(b * ),σ(b * )). This simplification is Fig.27B and 27Dand, in some embodiments, implemented in steps 2601 and 2603.

[0227] If | t (Ga, Gb)|=2 and two beads b1, b2∈ t If the (g1, g2) bits are in different gates and i(b1) = i(b2), then the two gates can be combined together. Note that since the difference set contains two beads, if these beads act on the same bit line, they must have σ(b1) ≠ σ(b2) (otherwise they are the same bead and not in the difference set). Using equations 18 to 20, the two gates can be combined into one.

[0228]

[0229]

[0230]

[0231] It should be noted that since i(b1)=i(b2) and σ(b1)≠σ(b2), then and Therefore, by removing the two beads b1 and b2, the two gates can be combined into one gate. The single gate has a shorter tail t(G a , G b ). This simplification is Fig.27C Shown in.

[0232] Some collisions will produce fragment gates with longer tails. It is understood that fragment gates with a size greater than 3 can be reconstructed into several controlled q-bit gates with a size of 3 bits or less. Take the collision of two gates as an example, one with q1 bits and the other with q2 bits. When the two gates are not directly passable, their collision will leave fragments. An upper limit on the number of bits of gates that make up the fragment can be found.

[0233] First consider the case where the head or target bit of one gate (Ga) collides with the control bit of another gate (Gb), but not the other way around. In this case, the fragment will have the head of Ga (1 bit), plus the gates in Boolean function XY, which does not include the control bit in Gb that collided with the head of Ga. The maximum number of bits in XY is q1-1+q2-2. Therefore, the maximum number of bits in a fragment is q max =q1+q2-2. This is a single-head collision that occurs on the tail and FIG. 29A to FIG. 29D Shown in.

[0234] If the collision is the header bit of one gate hitting the control bit of another gate, or vice versa, then the number of bits in the fragment is the sum of the number of bits of the Boolean function XY, i.e. q1-2+q2-2 (the two bits involved in the collision are subtracted from each gate), plus the two common bits. This gives us q again. max =q1+q2-2.

[0235] Note that if the circuit has only 1-bit and 2-bit gates (q1,q2≤2), then there are at most q1+q2-2≤2 1-bit gates. Therefore, collisions will not generate larger gates (although the number of gates can change). However, when the circuit has multiple 3-bit gates, collisions may generate 4-bit gates, and so on.

[0236] Using the collision rules above, we can obfuscate a set of instructions that have been converted into a list of q-bit control gates. Consider a circuit consisting of three parts, the left part or L, the middle part or M, and the right part or R. For certain applications, such as homomorphic encryption, it is natural to divide the circuit into these three parts: L = E -1 , the circuit that decrypts the binary string; M = f, the circuit that implements the intended function; R = E, the circuit that re-encrypts the state (if the same key is used). Another example is if you want to replace one encryption circuit with another (for example, change the key), in which case the natural choice is L = E -1 , (no intermediate circuits, or an empty set of gates), and R = E', a new encryption scheme. Finally, for a given circuit that does not have a priori structure like in the two examples above, one can simply choose to partition the circuit with two cuts and define the three resulting fragments as L, M, and R.

[0237] Based on the above rules for controlling q-bit gate collisions, an example process for confusing a circuit is described below. In the following, L, M, and R can be regarded as lists of gates, and square brackets [] are used as delimiters of lists (as in the Python programming language). 1. Take out the rightmost gate in L (called gL), and define L' as the list L without that gate. Similarly, take out the leftmost gate in R (called gR), and define R' as the list R without that gate. 2. Randomly choose (with a probability of 50% / 50%) to (i) push gL into M+[gR] from left to right, or (ii) push gR into [gL]+M from right to left. Assume that the choice is to push from right to left (the other case is similar). 3. Initialize the lists sideA=[gL]+M and sideB=[gR]. 4. When list sideA is not empty and the size of list sideB plus the size of sideA is less than a preset length K (for example, K doors), do the following: pop the rightmost door in sideA and the leftmost door in sideB; collide them, and unless they are destroyed, place the fragment in list sideB (add the fragment to the left). Repeat this step until one of the two conditions of the while loop is not met. 5. Assemble the new middle part of the circuit M'=sideA+sideB. 6. As long as L and R are not empty, repeat the above steps for the updated triple L'→L, M'→M, R'→R. If so, return to circuit C obf =L+M+R.

[0238] Obfuscated source code or object code 250 is generated using the obfuscated circuit Cobf. This obfuscation process can be achieved by obfuscating the pseudo code of Algorithm 1, as well as the right push of Algorithm 2 and the left push of Algorithm 3.

[0239]

[0240]

[0241]

[0242] Fig.31 The block diagram of shows an exemplary set of steps for generating an obfuscation program for a simple function according to an embodiment. In this example circuit, L and R each consist of three gates, while M consists of only one gate. The word length is 5 bits (n=N=5). This simple example can be understood as the following case: L=E -1 is the decryption circuit, R=E is the encryption circuit, and function f corresponds to a single gate (CNOT in this case) in M. It should be noted that the encryption circuit and the decryption circuit are inverse images of each other.

[0243] In the first step ( Fig.313101), door "c" collides with door "d" ( Fig.29B The single-head collision shown in Figure 2) moves to the left of gate "d" and leaves behind the fragment gate "c'". Gate "c" collides with gate "c-1", canceling each other out, see Fig.27A In the second step (3102), door "b-1" collides with door "c'" ( Fig.29B The single-head collision shown in Figure 2) moves to the right of gate "c'" and leaves debris behind gate "b'". Gate "b-1" passes through gate "d" without leaving debris (see Fig.28A ), moves to the right of door "d". Door "b-1" collides with door "b" and cancels each other out, see 27A. In the third step (3103), door "a" passes through door "b'" without leaving any fragments (see Fig.28A ), and moved to the right of door "b'". Similarly, door "a" passed through door "c'" without leaving any debris (see Fig.28A ), moves to the right of door "c'". Door "a" collides with door "d" ( Fig.29D The single-head collision shown in FIG. 100 ) moves to the left of gate “d” and leaves behind a fragment gate “a’”. In the fourth step (3104), the adjacent gates “c’” and “a’” are simplified to a single gate “e” (see FIG. Fig.27C In the fifth step (3105), the adjacent gates "b'" and "e" are simplified to a single gate "f" (see Fig.27B ).

[0244] In some embodiments, as mentioned for the universal reversible 3-bit gate, the obfuscated code that operates on encrypted data is part of the entire program that does not need to be obfuscated. In some of these embodiments, the obfuscated code is embedded between unobfuscated instructions.

[0245] 3. Overview of computing hardware

[0246] Fig.323200 is a block diagram showing a computer system 3200 on which an embodiment of the present invention can be executed. The computer system 3200 includes a communication mechanism, such as a bus 3210, for transmitting information between other internal and external components of the computer system 3200. Information is represented as a physical signal of a measurable phenomenon, usually a voltage, but in other embodiments, includes phenomena such as magnetism, electromagnetism, pressure, chemistry, molecular atoms and quantum interactions. For example, a north-south magnetic field or a zero and non-zero voltage represents two states (0, 1) of a binary digit (bit). Other phenomena can represent numbers of higher cardinality. The superposition of multiple simultaneous quantum states before measurement represents a quantum bit (qubit). A sequence of one or more numbers constitutes digital data for representing a digital or character code. In some embodiments, information referred to as analog data is represented by a nearly continuous measurable value within a specific range. The computer system 3200 or a portion thereof constitutes a device for performing one or more steps of one or more methods described herein.

[0247] A sequence of binary digits constitutes digital data, a number or code for representing a character. Bus 3210 contains many parallel information conductors so that information can be quickly transferred between devices coupled to bus 3210. One or more processors 3202 for processing information are coupled to bus 3210. Processor 3202 performs a set of operations on information. The set of operations includes bringing in information from bus 3210 and placing information on bus 3210. The set of operations also typically includes comparing two or more units of information, moving the position of units of information, and combining two or more units of information, such as by addition or multiplication. The series of operations performed by processor 3202 constitutes a computer instruction.

[0248] The computer system 3200 also includes a memory 3204 coupled to the bus 3210. The memory 3204, such as a random access memory (RAM) or other dynamic storage device, stores information including computer instructions. Dynamic memory allows the computer system 3200 to change the information stored therein. RAM allows a unit of information stored at a memory address to be stored and retrieved independently of information at neighboring addresses. The memory 3204 is also used by the processor 3202 to store temporary values ​​during the execution of computer instructions. The computer system 3200 also includes a read-only memory (ROM) 3206 or other static storage device coupled to the bus 3210 for storing static information including information that is not changed by the computer system 3200. A non-volatile (permanent) storage device 3208, such as a magnetic disk or optical disk, is also coupled to the bus 3210 for storing information including instructions that remains even if the computer system 3200 is turned off or powered off.

[0249] Information including instructions is provided to the bus 3210 for use by the processor from an external input device 3212, such as a keyboard or sensor containing alphanumeric keys operated by a human user. The sensor detects conditions in its vicinity and converts the detection results into signals compatible with signals representing information in the computer system 3200. Other external devices coupled to the bus 3210, primarily for human interaction, include a display device 3214 for presenting images, such as a cathode ray tube (CRT) or a liquid crystal display (LCD), and a pointing device 3216, such as a mouse, trackball, or cursor direction keys, for controlling the position of a small cursor image displayed on the display 3214 and issuing commands related to the pixels of the graphics displayed on the display 3214.

[0250] In the illustrated embodiment, special purpose hardware such as an application specific integrated circuit (IC) 3220 is coupled to bus 3210. Special purpose hardware is configured to perform operations quickly enough that are not performed by processor 3202. Examples of special purpose ICs include graphics accelerator cards for generating images 3214 for display; cryptographic boards for encrypting and decrypting messages sent over a network; speech recognition; and interfaces with specialized external devices such as robotic arms and medical scanning equipment that perform certain operations repeatedly. Complex sequences of operations may be more efficiently implemented in hardware.

[0251] The computer system 3200 also includes one or more instances of a communication interface 3270 coupled to the bus 3210. The communication interface 3270 provides a two-way communication coupling to various external devices that operate using their own processors, such as printers, scanners, and external disks. Typically, the coupling is made through a network link 3278 connected to a local area network 3280, to which various external devices with their own processors are connected. For example, the communication interface 3270 may be a parallel port or a serial port or a universal serial bus (USB) port on a personal computer. In some embodiments, the communication interface 3270 is an integrated services digital network (ISDN) card or a digital subscriber line (DSL) card or a telephone modem that provides an information communication connection to a corresponding type of telephone line. In some embodiments, the communication interface 3270 is a cable modem that converts signals on the bus 3210 into signals for communication connection via coaxial cable or into optical signals for communication connection via fiber optic cable. As another example, the communication interface 3270 may be a local area network (LAN) card to provide a data communication connection to a compatible LAN such as Ethernet. Wireless links may also be implemented. Carrier waves such as acoustic waves and electromagnetic waves (including radio waves, optical waves, and infrared waves) propagate through space without wires or cables. Signals include artificial variations in the amplitude, frequency, phase characteristic, polarization, or other physical properties of the carrier wave. For wireless links, the communication interface 3270 sends and receives electrical, acoustic, or electromagnetic signals, including infrared and optical signals, that carry information streams, such as digital data.

[0252] The term computer-readable media is used herein to refer to any medium that participates in providing information to the processor 3202, including instructions for execution. Such media can take many forms, including but not limited to non-volatile media, volatile media, and transmission media. Non-volatile media include, for example, optical or magnetic disks, such as storage device 3208. Volatile media include, for example, dynamic memory 3204. Transmission media include, for example, coaxial cables, copper wire, fiber optic cables, and waves that propagate in space without wires or cables, such as sound waves and electromagnetic waves, including radio waves, light waves, and infrared waves. The term computer-readable storage media is used herein to refer to any medium that participates in providing information to the processor 3202, except transmission media.

[0253] Common forms of computer-readable media include, for example, floppy disks, diskettes, hard disks, magnetic tape or any other magnetic medium, compact disk ROM (CD-ROM), digital video disk (DVD)) or any other optical medium, punch cards, paper tape or any other physical medium with a pattern of holes, RAM, programmable ROM (PROM), erasable PROM (EPROM), FLASH-EPROM, floating array flash memory, SDRAM or any other memory chip or cartridge that can be read from a computer, a carrier wave or any other medium. The term "non-transitory computer-readable storage medium" is used herein to refer to any medium that participates in providing information to the processor 3202, other than carrier waves and other signals.

[0254] Logic encoded in one or more tangible media includes one or both of processor instructions on a computer-readable storage medium and dedicated hardware (eg, ASIC 3220).

[0255] Network link 3278 typically provides information communication through one or more networks to other devices that use or process the information. For example, network link 3278 may provide a connection through local network 3280 to a host computer 3282 or to equipment 3284 operated by an Internet service provider (ISP). ISP equipment 3284, in turn, provides data communication services through the public, global packet-switched communications network now commonly referred to as the Internet 3290. Computers called servers 3292 connected to the Internet provide services in response to information received through the Internet. For example, server 3292 provides information representing video data for presentation on display 3214. In some cases, the resources represented by some combination of host computer 3282, local network 3280, Internet service provider 3284, Internet 3290, and server 3292 are referred to as a "cloud."

[0256] The present invention relates to the use of computer system 3200 for implementing the techniques described herein. According to one embodiment of the present invention, those techniques are performed by computer system 3200 in response to processor 3202 executing one or more sequences of one or more instructions contained in memory 3204. Such instructions (also referred to as software and program code) can be read into memory 3204 from another computer-readable medium (e.g., storage device 3208). Execution of the sequence of instructions contained in memory 3204 causes processor 3202 to perform the method steps described herein. In alternative embodiments, hardware such as application specific integrated circuit 3220 can be used instead of software or in combination with software to implement the present invention. Therefore, embodiments of the present invention are not limited to any specific combination of hardware and software.

[0257] Information is transmitted to and from computer system 3200 by signals transmitted over network link 3278 and other networks through communication interface 3270. Computer system 3200 can send and receive information including program code through networks 3280, 3290 and through network link 3278 and communication interface 3270. In the example using Internet 3290, server 3292 transmits program code for a specific application requested by a message sent from computer 3200 through Internet 3290, ISP equipment 3284, local area network 3280 and communication interface 3270. The received code can be executed by processor 3202 when it is received, or can be stored in storage device 3208 or other non-volatile memory for later execution, or both. In this way, computer system 3200 can obtain application code in the form of signals on a carrier wave.

[0258] Various forms of computer readable media may be involved in carrying one or more sequences of instructions or data, or both, to the processor 3202 for execution. For example, the instructions and data may initially be carried on a disk of a remote computer such as the host 3282. The remote computer loads the instructions and data into its dynamic memory and sends the instructions and data over a telephone line using a modem. The modem local to the computer system 3200 receives the instructions and data over the telephone line and uses an infrared transmitter to convert the instructions and data into an infrared signal and uses it as a carrier for the network link 3278. An infrared detector used as the communication interface 3270 receives the instructions and data carried in the infrared signal and places information representing the instructions and data on the bus 3210. The bus 3210 transfers the information to the memory 3204, from which the processor 3202 retrieves and executes the instructions using some data sent with the instructions. The instructions and data received in the memory 3204 may optionally be stored on the storage device 3208 before or after execution by the processor 3202.

[0259] Fig.33 A chipset 3300 is shown on which an embodiment of the present invention may be implemented. Chipset 3300 is programmed to perform one or more steps of the methods described herein and includes, for example, a processor and memory components described with respect to FIG. 1 . 32 is packaged in one or more physical packages (e.g., chips). For example, a physical package includes an arrangement of one or more materials, components, and / or wires on a structural assembly (e.g., a baseboard) to provide one or more characteristics, such as physical strength, size savings, and / or limitation of electrical interactions. It is contemplated that in certain embodiments, the chipset may be implemented in a single chip. Chipset 3300, or a portion thereof, constitutes a device for performing one or more steps of the methods described herein.

[0260] In one embodiment, the chipset 3300 includes a communication mechanism such as a bus 3301 for transferring information between components of the chipset 3300. The processor 3303 has connectivity to the bus 3301 to execute instructions and process information stored in, for example, the memory 3305. The processor 3303 may include one or more processing cores, each of which is configured to execute independently. A multi-core processor can perform multi-processing within a single physical package. Examples of multi-core processors include two, four, eight or more processing cores. Optionally, the processor 3303 may include one or more microprocessors configured in series via the bus 3301 to enable independent execution of instructions, pipelining and multithreading. The processor 3303 may also be accompanied by one or more dedicated components to perform certain processing functions and tasks, such as one or more digital signal processors (DSPs) 3307 or one or more application-specific integrated circuits (ASICs) 3309. The DSP 3307 is typically configured to process real-world signals (e.g., sound) in real time independently of the processor 3303. Similarly, ASIC 3309 can be configured to perform specialized functions that are not easily performed by a general purpose processor. Other specialized components that aid in performing the inventive functions described herein include one or more field programmable gate arrays (FPGAs) (not shown), one or more controllers (not shown), or one or more other special-purpose computer chips.

[0261] The processor 3303 and accompanying components have connectivity to the memory 3305 via the bus 3301. The memory 3305 includes dynamic memory (e.g., RAM, magnetic disk, writable optical disk, etc.) and static memory (e.g., ROM, CD-ROM, etc.) for storing executable instructions that, when executed, perform one or more steps of the methods described herein. The memory 3305 also stores data associated with or generated by performing one or more steps of the methods described herein.

[0262] 4. Variations, deviations and modifications In the foregoing description, the present invention has been described with reference to specific embodiments of the present invention. However, it is apparent that various modifications and changes may be made to it without departing from the broader spirit and scope of the present invention. Therefore, the description and the drawings should be considered illustrative rather than restrictive. Throughout the specification and claims, unless the context otherwise requires, the words "comprise" and their variations, such as "comprises" and "containing", will be understood to imply the inclusion of the items, elements or steps or the collection of items, elements or steps, but not to exclude any other items, elements or steps or the collection of items, elements or steps. In addition, the indefinite article "a" is intended to represent one or more of the items, elements or steps modified by the article.

[0263] 5. References.

[0264] [1]R.L.Rivest,L.Adleman,and M.L.Dertouzos,On data bank and privacyhomomorphisms(1978).

[0265] [2]E.F.Brickell and Y.Yacobi,On privacy homomorphisms,Workshop onTheory and Applications of Cryptographic Techniques,117-25(1987).

[0266] [3]C.Gentry,Fully homomorphic encryption using ideal lattices.ACMSymposium on Theory of Computation(STOC),169-178(2009).

[0267] [4]K.Lauter,Can homomorphic encryption be practical.Proceedings ofthe 3rd ACM workshop on cloud computing security,113-124(2011).

[0268] [5]C.B.Gentry,Bootstrappable Homomorphic Encryption Method,ComputerProgram and Apparatus.US Patent 8,515,058 B1(August 20,2013).

[0269] [6]C.B.Gentry and S.Halevi,Efficient Implementation of FullyHomomorphic Encryption.US Patent 8,565,435 B2(October 22,2013).

[0270] [7]C.B.Gentry,Fully Homomorphic Encryption Method Based on aBootstrappable Encryption Scheme,Computer and Apparatus.US Patent 8,630,422B2(January 14,2014).

[0271] [8]C.B.Gentry,S.Halevi,N.P.Smart,Homomorphic Evaluation Including KeySwitching,Modulus Switching,and Dynamical Noise Management.US Patent 9,281,941 B2(March 8,2016).

[0272] [9]C.B.Gentry,S.Halevi,N.P.Smart,Homomorphic Evaluation Including KeySwitching,Modulus Switching,and Dynamical Noise Management.US Patent 9,608,817 B2(March 28,2017).

[0273]

[10] C.B.Gentry,S.Halevi,N.P.Smart,Homomorphic Evaluation IncludingKey Switching,Modulus Switching,and Dynamical Noise Management.US Patent 9,621,346 B2(April 11,2017).

[0274]

[11] J.J.Loftus,M.Naehrig,J.W.Bos,K.E.Lauter,Managed SecureComputations on Encrypted Data.US Patent 9,306,738 B2(April 5,2016).

[0275]

[12] M.Tamayo-Rios,Method for Fully Homomorphic Encryption UsingMultivariate Cryptography.US Patent 9,313,028 B2(April 12,2016).

[0276]

[13] A.Kipnis and E.Hibshoosh,Method and System for HomomorphiclyRamdomizing an Input.US Patent 9,350,543 B2(May 24,2016).

[0277]

[14] G.Saldamli,Homomorphic Encryption in Computing Systems andEnvironments.US Patent 9,436,835 B1(September 16,2016).

[0278]

[15] D.Coppersmith and E.Grossman,Generators for certain alternatinggroups with applications to cryptography.SIAM J.Appl.Math.29(4),624-627(1975).

[0279]

[16] A.Parent,M.Roeteller,and M.Mosca,Improved Reversible and Circuitsfor Karatsuba-Based Integer Multiplication.arXiv:1706.03419(2017).

[0280]

[17] S.Cuccaro,T.G.Drapper,S.A.Kutin,and D.P.Moulton,A New QuantumRipple-Carry Addition Circuit.arXiv:quant-ph / 0410184(2004).

[0281]

[18] K.Iwama,Y.Kambayashi,and S.Yamashita,Transformation Rules forDesigning CNOT-based Quantum Circuits,DAC2002,pp 419-424(New Orleans,Louisiana,USA,2002).

Claims

1. A method of operating on a first processor, comprising: receiving first data, the first data representing a sequence of reversible q-bit gates, including a first segment for decrypting permutation-encrypted data to produce decrypted data, a second segment for operating on the decrypted data to produce one or more resultant decrypted data, and a third segment for encrypting the resultant decrypted data using permutation encryption to produce permutation-encrypted resultant data; storing second data on a computer-readable medium, the second data representing rules for replacing a first sequence of two q-bit gates that operate on at least one shared bit of an input N-bit word with a different second sequence of one or more q-bit gates that produce the same output N-bit word; utilizing the second data to propagate at least one q-bit gate from the first segment a distance of J gates within or after the q-bit gates of the second segment, and to propagate at least one q-bit gate from the third segment a distance of K gates within or before the q-bit gates of the second segment, thereby producing a scrambled sequence of reversible q-bit gates; and sending a scrambled instruction based on the scrambled sequence of reversible q-bit gates to a second processor for execution.

2. The method according to claim 1, further comprising: storing third data on a computer-readable medium, the third data associating each code instruction executable by the second processor with one or more reversible q-bit gates operating on an N-bit word; and utilizing the third data to convert the scrambled sequence of reversible q-bit gates into scrambled code instructions executable by the second processor; wherein sending the scrambled instruction further includes sending the scrambled code instructions executable by the second processor.

3. The method according to claim 1, wherein: the method further includes storing third data on a computer-readable medium, the third data associating each code instruction executable by the second processor with one or more reversible q-bit gates operating on an N-bit word; and, the receiving of the first data further includes: receiving the code instructions executable by the second processor for operating on the encrypted data to generate the one or more resultant decrypted data; and utilizing the third data to convert the code instructions executable by the second processor, for operating on the encrypted data to generate the one or more resultant decrypted data, into a sequence of reversible q-bit gates for operating on the encrypted data to generate the one or more resultant decrypted data.

4. The method according to claim 1, further comprising: storing merged data on a computer-readable medium, the merged data representing rules for replacing each sequence of one or more reversible q-bit gates operating on an input N-bit word to produce an output N-bit word with one or more reversible k-bit gates (where 3 < k ≤ N) that produce the same output N-bit word; and utilizing the merged data to replace a particular sequence of one or more reversible q-bit gates in the scrambled sequence of reversible q-bit gates with k-bit gates that can replace the particular sequence.

5. The method according to claim 4, further comprising: include: storing third data on a computer-readable medium, the third data associating each code instruction executable by the second processor with one or more reversible q-bit gates that operate on an N-bit word; storing merged code data on a computer readable medium, the merged code data associating each of the one or more k-bit gates with one or more code instructions executed by the different second processor; Utilizing the merged code data, converting the k-bit gate into at least a portion of an obfuscated code instruction; and Using the third data, converting the remaining reversible q-bit gates in the obfuscated sequence of reversible q-bit gates into the remaining part of the obfuscated code instruction; The sending of the obfuscation instruction further includes sending an obfuscation code instruction executable by the second processor.

6. The method according to claim 1, in, J>N and K>N.

7. The method according to claim 1, in, Each reversible q-bit gate is a control gate including a single target bit and q-1 control bits, and is used to determine the value of the single target bit based on the values ​​of the q-1 control bits and the value input to the q-1 control bits.

8. The method according to claim 1, in, q∈{1,2,3})。 9. The method according to claim 1, in, The second processor is different from the first processor.

10. The method according to claim 1, in, Access to the second processor is different from access to the first processor.

11. A non-transitory computer readable medium carrying one or more sequences of instructions, in, Execution of the one or more sequences of instructions by a first set of one or more processors causes the first set of one or more processors to perform the following steps: receiving first data, the first data representing a sequence of reversible q-bit gates, including a first segment for decrypting permuted encrypted data to produce decrypted data, a second segment for operating on the decrypted data to produce one or more resultant decrypted data, and a third segment for encrypting the resultant decrypted data using permutation encryption to produce permuted encrypted resultant data; storing second data representing a rule for replacing a first sequence of two reversible q-bit gates operating on at least one shared bit of an input N-bit word with a different second sequence of one or more reversible q-bit gates producing the same output N-bit word; Using the second data, propagate at least one q-bit gate from the first segment by a distance of J gates to within or after the q-bit gates of the second segment, and propagate at least one q-bit gate from the third segment by a distance of K gates to within or before the q-bit gates of the second segment, thereby generating a confusing sequence of reversible q-bit gates; and Obfuscated instructions based on the obfuscated sequence of reversible q-bit gates are sent to a second set of one or more processors for execution.

12. The non-transitory computer readable medium of claim 11, further comprising: include: Store third data on a computer-readable medium, the third data associating each code instruction executable by a second processor with one or more reversible q-bit gates operating on an N-bit word; And Utilize the third data to convert a scrambled sequence of the reversible q-bit gates into scrambled code instructions executable by the second processor; Wherein, sending the scrambled instructions further includes sending the scrambled code instructions executable by a second set of the one or more processors.

13. The non-transitory computer-readable medium according to claim 11, Wherein: The step further includes storing third data on a computer-readable medium, the third data associating each code instruction executable by a second set of the one or more processors with one or more reversible q-bit gates operating on an N-bit word; And, The receiving the first data further includes: Receiving code instructions executable by a second set of the one or more processors for operating on the encrypted data to generate the one or more resultant decrypted data; And Utilize the third data to convert the code instructions executable by a second set of the one or more processors, which are for operating on the encrypted data to generate the one or more resultant decrypted data, into a sequence of reversible q-bit gates for operating on the encrypted data to generate the one or more resultant decrypted data.

14. The non-transitory computer-readable medium according to claim 11, further Comprises: Store merged data on a computer-readable medium, the rules represented by the merged data for replacing each sequence in one or more sequences of reversible q-bit gates operating on an input N-bit word to produce an output N-bit word with one or more k-bit gates (where 3 < k ≤ N) that produce the same output N-bit word; and Utilize the merged data to replace a particular sequence of one or more reversible q-bit gates in the scrambled sequence of the reversible q-bit gates with k-bit gates that can replace the particular sequence.

15. The non-transitory computer-readable medium according to claim 14, further Comprises: Store third data on a computer-readable medium, the third data associating each code instruction executable by a second set of the one or more processors with one or more reversible q-bit gates operating on an N-bit word; Store merged code data on a computer-readable medium, the merged code data associating each of one or more k-bit gates with one or more code instructions executed on a second set of the one or more processors; Utilize the merged code data to convert the k-bit gates into at least a part of the scrambled code instructions; and Utilize the third data to convert the remaining reversible q-bit gates in the scrambled sequence of the reversible q-bit gates into the remaining part of the scrambled code instructions; Wherein, sending the scrambled instructions further includes sending the scrambled code instructions executable by a second set of the one or more processors.

16. The non-transitory computer-readable medium according to claim 11, Wherein, J > N and K > N.

17. The non-transitory computer readable medium of claim 11, in, Each reversible q-bit gate is a control gate including a single target bit and q-1 control bits, and is used to determine the value of the single target bit based on the values ​​of the q-1 control bits and the value input to the q-1 control bits.

18. The non-transitory computer readable medium of claim 11, in, q∈{1,2,3})。 19. The non-transitory computer readable medium of claim 11, in, The second set of one or more processors is different than the first set of one or more processors.

20. The non-transitory computer readable medium of claim 11, in, Access to the second set of the one or more processors is different than access to the first set of the one or more processors.

21. A system operating on a first processor, include: a first set of at least one processor; and at least one memory, the memory comprising one or more instruction sequences, The at least one memory and the one or more instruction sequences are configured to, together with the at least one processor, cause the apparatus to at least perform the following operations: receiving first data, the first data representing a sequence of reversible q-bit gates, including a first segment for decrypting permuted encrypted data to produce decrypted data, a second segment for operating on the decrypted data to produce one or more resultant decrypted data, and a third segment for encrypting the resultant decrypted data using permutation encryption to produce permuted encrypted resultant data; storing second data on a computer readable medium, the second data representing a rule for replacing a first sequence of two q-bit gates operating on at least one shared bit of an input N-bit word with a second sequence of one or more q-bit gates producing the same output N-bit word; Using the second data, propagate at least one q-bit gate from the first segment by a distance of J gates to within or after the q-bit gates of the second segment, and propagate at least one q-bit gate from the third segment by a distance of K gates to within or before the q-bit gates of the second segment, thereby generating a confusing sequence of reversible q-bit gates; and Obfuscated instructions based on the obfuscated sequence of reversible q-bit gates are sent to a second set of at least one processor for execution.

22. The system according to claim 21, further comprising: include: storing third data on a computer-readable medium, the third data associating each code instruction executable by the second set of the at least one processor with one or more reversible q-bit gates that operate on an N-bit word; as well as using the third data, converting the obfuscated sequence of reversible q-bit gates into obfuscated code instructions executable by a second set of the at least one processor; The sending of the obfuscated instruction further comprises sending the obfuscated code instruction executable by a second set of the at least one processor.

23. The system according to claim 21, in: The operation further includes storing third data on a computer-readable medium, the third data associating each code instruction executable by a second set of the at least one processor with one or more reversible q-bit gates operating on an N-bit word; And, The receiving of the first data further includes: Receiving code instructions executable by a second set of the at least one processor for operating on the encrypted data to generate the one or more result decryption data; And Using the third data, converting the code instructions executable by a second set of the at least one processor for operating on the encrypted data to generate the one or more result decryption data into a sequence of reversible q-bit gates for operating on the encrypted data to generate one or more of the result decryption data.

24. The system according to claim 21, further including: Storing merged data on a computer-readable medium, the rules represented by the merged data for replacing each sequence in one or more sequences of reversible q-bit gates operating on an input N-bit word to produce an output N-bit word with one or more k-bit gates (where 3 < k ≤ N) that produce the same output N-bit word; and Using the merged data, replacing a specific sequence of one or more q-bit gates in the scrambled sequence of q-bit gates with k-bit gates that can replace the specific sequence.

25. The system according to claim 24, further including: Storing third data on a computer-readable medium, the third data associating each code instruction executable by a second set of the at least one processor with one or more reversible q-bit gates operating on an N-bit word; Storing merged code data on a computer-readable medium, the merged code data associating each of one or more k-bit gates with one or more code instructions executed on a second set of the at least one processor; Using the merged code data, converting the k-bit gates into at least a part of the scrambled code instructions; and Using the third data, converting the remaining reversible q-bit gates in the scrambled sequence of reversible q-bit gates into the remaining part of the scrambled code instructions; wherein, sending the scrambled instructions further includes sending the scrambled code instructions executable by a second set of the at least one processor.

26. The system according to claim 21, wherein, J > N and K > N.

27. The system according to claim 21, characterized in that Each reversible q-bit gate is a control gate including a single target bit and q - 1 control bits, for determining the value of the single target bit based on the values of the q - 1 control bits and the values input to the q - 1 control bits.

28. The system according to claim 21, wherein, q∈{1,2,3})。 29. The system according to claim 21, wherein, The second set of the at least one processor is different from the first set of the at least one processor.

30. The system according to claim 21, wherein, Access to the second set of the at least one processor is different than access to the first set of the at least one processor.

Images