Device and method for performing non-polynomial calculation on ciphertext

Abstract

A ciphertext calculation method is disclosed. The ciphertext calculation method comprises the following steps: receiving a comparison calculation command for a plurality of ciphertexts of the same type; performing calculation by reflecting the plurality of ciphertexts of the same type on a composite function corresponding to the comparison calculation command; and outputting the calculated ciphertexts of the same type.

Description

Technical Field

[0001] The present application relates to an apparatus and method for performing non-polynomial computations, such as comparison computations, on approximately encrypted messages. Background Art

[0002] With the development of communication technology and the active distribution of electronic devices, efforts are continuously made to maintain the security of communications between electronic devices. Therefore, in most communication environments, encryption / decryption technology is used.

[0003] When a message encrypted by encryption technology is delivered to another party, the other party needs to perform decryption to use the message. In this case, the other party may waste resources and time in the process of decrypting the encrypted data. In addition, when a third party performs a hacking attack in a state where the other party has temporarily decrypted the message for calculation, the message may be easily leaked to the third party.

[0004] In order to solve such a problem, homomorphic encryption methods have been studied. According to homomorphic encryption, although calculations are performed on the encrypted message itself without decrypting the encrypted information, the same result as the value obtained by calculating and then encrypting the plain text can be obtained. Therefore, various calculations can be performed without decrypting the encrypted message.

[0005] However, the homomorphic ciphertext of the related art supports only some calculations such as addition, multiplication, etc., and therefore it is necessary to obtain a method for applying non-polynomial calculations such as comparison calculations to the homomorphic ciphertext. Summary of the invention

[0006] The present application is made to solve the above-mentioned problem, and an object thereof is to provide an apparatus and method for performing non-polynomial calculations such as comparison calculations on approximately encrypted messages.

[0007] The present application is to achieve the above-mentioned purpose. According to one aspect of the present application, a ciphertext calculation method is provided, comprising: receiving an input of a comparison calculation command for a plurality of homomorphic ciphertexts; performing calculation by reflecting the plurality of homomorphic ciphertexts as a composite function corresponding to the comparison calculation command, and outputting the calculated homomorphic ciphertext.

[0008] The complex function may have a response with precision 2 -α The complexity is θ(α) or θ(αlogα).

[0009] The comparison calculation may be a maximum value operation or a minimum value operation, and performing the calculation may include performing the calculation of the maximum value operation or the minimum value operation by using a composite function corresponding to the square root calculation.

[0010] The composite function corresponding to the square root calculation may be a function that repeatedly performs calculations of a first function and a second function a predetermined number of times, the first function including a first variable having an input value as an initial value and a second variable having a value obtained by subtracting 1 from the input value as an initial value, and the second function including the second variable.

[0011] The predetermined number of times may be a number corresponding to an error rate of square root calculation.

[0012] The comparison calculation may be a calculation that outputs a predetermined value according to a size comparison, and performing the calculation may include repeatedly performing a calculation of a composite function including a function calculation corresponding to the inverse calculation a predetermined number of times.

[0013] The comparison operation may be a calculation that outputs a predetermined value according to a magnitude comparison, and performing the calculation may include repeatedly performing the calculation by using a composite function corresponding to the sign function a predetermined number of times.

[0014] The composite function corresponding to the sign function may be a composite function that obtains an output value close to 1 for an input value greater than 0 and obtains an output value close to -1 for an input value less than 0.

[0015] Performing the calculation may include performing a comparison operation by using two or more different composite functions that are approximate functions corresponding to the sign function.

[0016] According to another aspect of the present application, a computing device is provided, comprising: a memory storing at least one instruction; and a processor arranged to execute the at least one instruction, wherein the processor is configured to: by executing the at least one instruction, based on an input for a received comparison calculation command for multiple homomorphic ciphertexts, perform calculations by reflecting multiple homomorphic ciphertexts to a composite function corresponding to the comparison calculation command, and output the calculated homomorphic ciphertexts.

[0017] The comparison calculation may be a maximum value operation or a minimum value operation, and the processor may be configured to perform the calculation of the maximum value operation or the minimum value operation by using a composite function corresponding to the square root calculation.

[0018] The comparison calculation may be a calculation that outputs a predetermined value according to a size comparison, and the processor may be configured to repeatedly perform a calculation of a composite function including a function calculation corresponding to the inverse calculation a predetermined number of times.

[0019] The comparison calculation may be a calculation that outputs a predetermined value according to a size comparison, and the processor may be configured to repeatedly perform the calculation by using a composite function corresponding to the sign function a predetermined number of times.

[0020] The composite function corresponding to the sign function may be a composite function that obtains an output value close to 1 for an input value greater than 0 and obtains an output value close to -1 for an input value less than 0.

[0021] The processor may be arranged to perform the comparison calculation by using two or more different composite functions, the composite functions being approximate functions corresponding to the sign functions.

[0022] Effects of the Invention

[0023] According to the various embodiments disclosed above, in the homomorphic ciphertext processing method, a comparison calculation can be performed on the approximate encrypted ciphertext by using a composite function. In addition, the composite function proposed in the present application has low complexity, and therefore even if the accuracy is increased, faster calculations can be performed. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 is a diagram showing a structure of a network system according to an embodiment;

[0025] Figure 2 is a block diagram showing a configuration of a computing device according to an embodiment;

[0026] Figure 3 is a diagram showing a calculation operation of a calculation device of an embodiment;

[0027] Figure 4 is a flow chart showing a ciphertext calculation method according to an embodiment;

[0028] Figure 5 is a diagram showing a method of operating an inverse calculation by using a composite function according to an embodiment;

[0029] Figure 6 is a diagram illustrating a method of operating a square root calculation by using a composite function according to an embodiment;

[0030] Figure 7 is a diagram showing a method for calculating a maximum value and a minimum value according to an embodiment;

[0031] Figure 8 is a diagram showing a size comparison method of the first embodiment;

[0032] Fig. 9 is a diagram showing a size comparison method according to a second embodiment;

[0033] Fig.10 is a diagram showing a method of obtaining a composite function corresponding to the slope of a sign function;

[0034] Fig.11 is a diagram showing a size comparison method according to the third embodiment;

[0035] Fig.12 is a diagram showing the shape of a composite function corresponding to a sign function for each number of repetitions; and

[0036] Fig.13 is a diagram showing the shapes of various composite functions associated with the sign function for each number of repetitions. Summary of the invention

[0038] DETAILED DESCRIPTION OF EXAMPLE EMBODIMENTS

[0039] Hereinafter, the present application will be described in detail with reference to the accompanying drawings. For the information (data) transmission process performed in the present application, encryption / decryption may be applied if necessary. In the present application and the claims, although not separately specified, the expressions describing the information (data) transmission process should be interpreted as including both encryption and decryption. In the present application, expressions such as "sending (transmitting) from A to B" or "receiving from B by A" include the sending (transmitting) or receiving of another medium therebetween, and do not merely mean sending (transmitting) directly from A to B or receiving directly from B by A.

[0040] When describing the present application, it should be understood that the order of each step is not limited unless the previous step needs to be performed before the subsequent step logically and temporally. In other words, except for the above exceptions, even if a step such as a subsequent step is performed before a step such as a previous step, it will not affect the gist of the present application, and the scope of the rights should also be defined, regardless of the order of the steps. In the specification, "A or B" not only selectively indicates any one of A and B, but is defined as including both A and B. In addition, the term "comprising" in the present application also additionally covers other elements in addition to the listed elements.

[0041] In the specification, only the essential elements necessary to describe the present application are described, and elements irrelevant to the gist of the present application are not mentioned. The present application should not be interpreted in an exclusive sense including only the elements, but should be interpreted in a non-exclusive sense to also include other elements.

[0042] A "value" in this application is defined to include not only scalar values ​​but also vectors.

[0043] The mathematical operations and calculations of each step of the present application described below may be implemented as computer calculations through well-known coding methods for corresponding operations or calculations and / or codes designed to be suitable for the present application.

[0044] The specific formulas described below are illustrative examples of several possible alternatives and should not be interpreted as limiting the scope of rights of the present application to the formulas in the present application.

[0045] For the convenience of description, the following symbols will be used in this application.

[0046] a←D: Select element (a) according to distribution (D)

[0047] s1,s2∈R: Each of S1 and S2 is an element belonging to the set R.

[0048] mod(q): performs a modulo calculation using element q

[0049] "-": round off internal values

[0050] Hereinafter, various embodiments of the present application will be described in detail with reference to the accompanying drawings.

[0051] Figure 1 is a diagram showing a configuration of a network system according to an embodiment.

[0052] Reference Figure 1 , the network system includes a plurality of electronic devices 100 - 1 , . . . , and 100 - n , a first server device 200 , and a second server device 300 , and these elements are connectable to each other via a network 10 .

[0053] The network 10 may be implemented as various types of wired and wireless communication networks, broadcast communication networks, optical communication networks, cloud networks, etc., and each device may be connected via methods such as Wi-Fi, Bluetooth, near field communication (NFC), or other methods that do not require a separate medium.

[0054] Reference Figure 1 , it is shown that a plurality of electronic devices (100-1, ... and 100-n) are provided, but it is not necessary to use the plurality of electronic devices, and one device can be used. For example, the electronic devices 100-1, ... and 100-n can be implemented as various types of devices, such as smart phones, tablet computers, game consoles, PCs, laptop PCs, home servers, self-service terminals, etc., and can also be implemented in the form of home appliances to which IoT functions are applied.

[0055] The user may input various pieces of information through the electronic devices 100-1, ... and 100-n used by the user. The input information may be stored in the electronic devices 100-1, ... and 100-n themselves, and may also be sent to and stored in an external device for reasons of storage capacity, security, etc. Figure 1 , the first server device 200 may function to store such information, and the second server device 300 may function to use some or all of the information stored in the first server device 200 .

[0056] Each of the electronic devices 100 - 1 , . . . , and 100 - n may perform homomorphic encryption on input information and transmit a homomorphic ciphertext to the first server device 200 .

[0057] Each of the electronic devices 100-1, ... and 100-n may include encryption noise calculated in the process of performing homomorphic encryption, that is, an error in the ciphertext. Specifically, the homomorphic ciphertext generated from each of the electronic devices 100-1, ... and 100-n may be generated so that when decryption is performed using the private key later, the result value includes the message and the error value is restored.

[0058] For example, when decryption is performed using a private key, homomorphic ciphertext generated from each of the electronic devices 100 - 1 , . . . , and 100 - n may be generated to satisfy the following properties.

[0059] [Formula 1]

[0060] Dec(ct,sk)=<ct,sk> =M+e(mod q)

[0061] Here, <, > represents a common inner product, ct represents a ciphertext, sk represents a private key, M represents a plaintext message, e represents an encryption error value, and mod q represents the modulus of the ciphertext. For q, it is necessary to select a value larger than the result value M obtained by multiplying the message by the scaling factor Δ. If the absolute value of the error value e is sufficiently smaller than M, the decrypted value M+e of the ciphertext can be a value that can be replaced with the original message with the same accuracy in the calculation of the effective digit. In the decrypted data, the error can be arranged on one side of the least significant bit (LSB), and M can be arranged on one side of the second least significant bit.

[0062] If the size of a message is very small or large, its size can be adjusted by using a scaling factor. When the scaling factor is used, not only messages in integer form but also messages in real form can be encrypted, and thus usability can be significantly improved. In addition, by adjusting the size of a message using a scaling factor, the size of a domain in which a message exists, that is, a valid domain of a ciphertext after calculation is performed, can be adjusted.

[0063] According to one embodiment, the ciphertext modulus q can be set and used in various forms. For example, the ciphertext modulus can be q=Δ L It can be set in the form of , which is the power of the proportional factor Δ. When Δ is 2, it can be set such as q = 2 10 The value of .

[0064] The first server device 200 may store the received homomorphic ciphertext in a ciphertext state without performing decryption.

[0065] The second server device 300 may request a specific processing result of the homomorphic ciphertext from the first server device 200. The first server device 200 may perform a specific calculation according to the request of the second server device 300 and send the result to the second server device 300.

[0066] In one example, when the ciphertexts ct1 and ct2 transmitted by the two electronic devices 100-1 and 100-2 are stored in the first server device 200, the second server device 300 may request the first server device 200 for a value obtained by adding a plurality of pieces of information provided from the two electronic devices 100-1 and 100-2. The first server device 200 may perform a calculation of adding the two ciphertexts, and transmit the result value (ct1+ct2) to the second server device 300 according to the request.

[0067] According to the properties of homomorphic ciphertext, the first server device 200 can perform calculation without performing decryption, and its result value is in the form of ciphertext. In the present application, the result value obtained by calculation can be referred to as calculation result ciphertext.

[0068] The first server device 200 may transmit the calculation result ciphertext to the second server device 300. The second server device 300 may decrypt the received calculation result ciphertext and obtain the calculation result value of the data included in each homomorphic ciphertext.

[0069] The first server device 200 may perform calculations multiple times according to user requests. At this time, the first server device 200 may perform not only calculations consisting of addition, subtraction, and multiplication only, but also calculations including inverse calculations and square root calculations. In addition, the first server device 200 may perform comparison operations such as maximum value operations, minimum value operations, and size comparisons. As described above, the first server device 200 may be referred to as a calculation device because it may perform calculation operations.

[0070] When performing the comparison operation, the first server device 200 can perform the calculation by using a composite function corresponding to the non-polynomial calculation. The composite function according to the present application has a complexity of θ(α) or θ(αlogα) in response to the accuracy 2-α, and therefore, when the accuracy is improved, faster calculation can be performed than the related art.

[0071] At the same time, reference Figure 1 , showing that the first electronic device and the second electronic device perform encryption and the second server device performs decryption, but is not limited thereto.

[0072] Figure 2 is a block diagram illustrating an arrangement of a computing device according to an embodiment.

[0073] Specifically, in Figure 1In the system, a device that performs homomorphic encryption, such as a first electronic device and a second electronic device, a device that performs calculation on homomorphic ciphertext, such as a first server device, and a device that decrypts homomorphic ciphertext, such as a second server device, may be referred to as a computing device. Such a computing device may be a variety of devices, such as a personal computer (PC), a laptop, a smart phone, a tablet, a server, etc.

[0074] Reference Figure 2 , the computing device 400 may include a communication device 410 , a memory 420 , a display 430 , a manipulation input device 440 , and a processor 450 .

[0075] The communication device 410 may be formed to connect the computing device 400 to an external device (not shown), and may access the external device through a local area network (LAN) and the Internet, and may also access the external device through a universal serial bus (USB) port or a wireless communication (e.g., Wi-Fi 802.11a / b / g / n, NFC, Bluetooth) port. The communication device 410 may be referred to as a transceiver.

[0076] The communication device 410 may receive a public key from an external device and transmit a public key autonomously generated by the computing device 400 to the external device.

[0077] The communication device 410 may receive a message from an external device and transmit the generated homomorphic ciphertext to the external device.

[0078] In addition, the communication device 410 may receive various parameters required to generate a ciphertext from an external device. Meanwhile, in an embodiment, various parameters may be directly received from a user by manipulating the input device 440 to be described below.

[0079] In addition, the communication device 410 may receive a computation request for a homomorphic ciphertext from an external device, and send the result of the corresponding computation to the external device. The requested computation may be a computation such as addition, subtraction, or multiplication, or may also be a comparison operation as a non-polynomial computation.

[0080] The memory 420 may store at least one instruction related to the computing device 400. Specifically, the memory 420 may store various programs (or software) for operating the computing device 400 according to various embodiments of the present application.

[0081] The memory 420 may be implemented as various types such as RAM, ROM, flash memory, HDD, external memory, and memory card, and is not limited to any one of them.

[0082] The memory 420 can store the message to be encrypted. Here, the message can be various credit information, private information, etc. referenced by the user, and can be information related to the use history, etc., such as location information, Internet use time information, etc., used on the computing device 400.

[0083] The memory 420 may store a private key, and if the computing device 400 is a device that directly generates a public key, the memory 420 may store not only a secret key but also various parameters required to generate the private key and the secret key.

[0084] The memory 420 may store homomorphic ciphertexts generated in the process described below. The memory 420 may store homomorphic ciphertexts sent from an external device. In addition, the memory 420 may also store calculation result ciphertexts, which are the results from the calculation process described below.

[0085] The display 430 may display a user interface window for receiving selections of functions supported by the computing device 400. Specifically, the display 430 may display a user interface window for receiving selections of various functions provided by the computing device 400. The display 430 may be a monitor such as a liquid crystal display (LCD), an organic light emitting diode (OLED), etc., and may also be implemented as a touch screen capable of simultaneously performing a function of manipulating the input device 440, which will be described below.

[0086] The display 430 may display a message for requesting input of parameters necessary for generating a private key and a public key. The display 430 may display a message for selecting an encryption target. Meanwhile, in an embodiment, the encryption target may be directly selected by the user or automatically selected. In other words, although the user does not directly select a message, private information that needs to be encrypted may be automatically set.

[0087] The manipulation input device 440 may receive a selection of a function of the computing device 400 and a control command for the corresponding function from the user. Specifically, the manipulation input device 440 may receive an input of parameters required to generate a private key and a public key from the user. In addition, the manipulation input device 440 may set a message to be encrypted from the user.

[0088] The processor 450 may control the general operation of the computing device 400. Specifically, the processor 450 may generally control the operation of the computing device 400 by executing at least one instruction stored in the memory 420. The processor 450 may be configured with a single device such as a central processing unit (CPU) or an application specific integrated circuit (ASIC), or may be configured with a plurality of devices such as a CPU, a graphics processing unit (GPU), etc.

[0089] When a message to be transmitted is input, the processor 450 may store the message in the memory 420. The processor 450 may perform homomorphic encryption on the message by using various setting values ​​and programs stored in the memory 420. In this case, a public key may be used.

[0090] The processor 450 may automatically generate and use a public key necessary to perform encryption, or may receive a public key from an external device and use the public key. In an example, the second server device 300 that performs decryption may distribute the public key to other devices.

[0091] In the case of automatically generating keys, the processor 450 can generate a public key by using the Ring-LWE technology. Specifically, first, the processor 450 can set various parameters and rings and store them in the memory 420. Examples of parameters may include the bit length of the plaintext message, the size of the public key and the secret key, etc.

[0092] The ring can be represented by the following formula.

[0093] [Formula 2]

[0094]

[0095] Here, R represents a ring, Z q denotes a coefficient, and f(x) denotes an n-degree polynomial.

[0096] A ring is a set of polynomials with predetermined coefficients and refers to a set of sets in which addition and multiplication between elements are defined and closed for addition and multiplication. Such a ring may be called an annulus.

[0097] For example, a ring may refer to a coefficient Z q The set of n-order polynomials. Specifically, when n is Φ(N), the ring may refer to a cyclotomic polynomial of degree n. f(x) represents the ideal value of Zq[x] generated by f(x). The Euler totient function Φ(N) refers to a natural number that is prime to N and less than N. When Φ N When (x) is defined as an n-order cyclotomogram polynomial, the ring can be expressed by Formula 3 as follows.

[0098] [Formula 3]

[0099]

[0100] The secret key (sk) can be expressed as follows.

[0101] Meanwhile, the ring of the above formula 3 has complex numbers in the plaintext space. In order to improve the calculation speed of the homomorphic ciphertext, only the set having real numbers in the plaintext space among the sets of the above rings may be used.

[0102] When such a ring is set up, processor 450 may compute a secret key (sk) from the ring.

[0103] [Formula 4]

[0104] sk←(1,s(x)),s(x)∈R

[0105] Here, s(x) represents a randomly generated polynomial with small coefficients.

[0106] The processor 450 may calculate a first random polynomial a(x) from the ring. The first random polynomial may be expressed as follows.

[0107] [Formula 5]

[0108] a(x)←R

[0109] The processor 450 may calculate the error. Specifically, the processor 450 may extract the error from a discrete Gaussian distribution or a distribution having a statistical distance closer to a discrete Gaussian distribution. Such an error may be represented as follows.

[0110] [Formula 6]

[0111]

[0112] When the error is calculated, the processor 450 may modulate the error to the first random polynomial and the secret key to calculate the second random polynomial. The second random polynomial may be expressed as follows.

[0113] [Formula 7]

[0114] b(x)=-a(x)s(x)+e(x)(mod q)

[0115] Finally, the public key (pk) may be set as follows to include the first random polynomial and the second random polynomial.

[0116] [Formula 8]

[0117] pk=(b(x),a(x))

[0118] The above-mentioned key generation method is only an example and is therefore not limited thereto, and the public key and the private key may also be generated by other methods.

[0119] Meanwhile, when a public key is generated, the processor 450 may control the communication device 410 to transmit the public key to other devices.

[0120] Processor 450 may generate homomorphic ciphertext for the message. Specifically, processor 450 may generate homomorphic ciphertext by applying a public key previously generated for the message. Processor 450 may generate the ciphertext such that the length of the ciphertext corresponds to the size of the scaling factor.

[0121] When generating homomorphic ciphertext, the processor 450 may store the homomorphic ciphertext in the memory 420 or control the communication device 410 to send the homomorphic ciphertext to another device according to a user request or a predetermined default command.

[0122] According to an embodiment of the present application, packing may be performed. When packing is used in homomorphic encryption, multiple messages may be encrypted into one ciphertext. In this case, when calculations between ciphertexts are performed on the computing device 400, calculations for multiple messages may be processed in parallel, thereby significantly reducing the computational load.

[0123] Specifically, when the message is formed by multiple message vectors, the processor 450 may convert the multiple message vectors into polynomials to be encrypted in parallel, multiply the polynomials by a scaling factor, and perform homomorphic encryption by using a public key. Therefore, a ciphertext having multiple wrapped message vectors may be generated.

[0124] When the homomorphic ciphertext needs to be decrypted, the processor 450 can generate a decrypted text in polynomial form by applying the private key to the homomorphic ciphertext, and decode the decrypted text in polynomial form to generate a message. As described above with reference to the above formula 1, the message generated here may include errors.

[0125] The processor 450 may perform calculations on the ciphertext. Specifically, the processor 450 may perform calculations such as addition, subtraction, or multiplication while maintaining the encryption state of the homomorphic ciphertext.

[0126] In addition, the processor 450 may perform calculations on the polynomial using calculations other than addition, subtraction or multiplication of the ciphertext. Specifically, the homomorphic ciphertext is closed for addition, subtraction or multiplication, but not for other calculations.

[0127] Therefore, for calculations other than addition, subtraction or multiplication, it is necessary to use the approximate calculation expression represented by the above three calculations. In this regard, for calculations other than addition, subtraction or multiplication, the processor 450 can perform the calculation by using the approximate function corresponding to the requested calculation.

[0128] For this purpose, an approximation function well known in the related art (eg, Taylor, least squares, or minimum maximum) can be used, but in the related art, the approximation function is for precision 2 -αWith complexity θ(2α / 2). In other words, in the prior art method, the calculation becomes exponentially complex with respect to the precision, and therefore, as the precision increases, a longer calculation time is required.

[0129] To solve this problem, in this application, the response to the precision 2 can be used. -α A composite function with complexity θ(α) or θ(αlogα), ie an approximate function. Specifically, in the present application, instead of a general polynomial, a well-structured polynomial with a more efficient evaluation may be used, ie a composite function may be used.

[0130] In this application, composite functions are proposed for each of inverse calculation, square root, maximum or minimum value, and size comparison, and reference will be made to Figures 5 to 10 Describe the method of applying composite functions to each calculation.

[0131] When the calculation is completed, the computing device 400 may detect the data in the valid domain from the calculation result data. Specifically, the computing device 400 may detect the data in the valid domain by rounding the calculation result data. The rounding process may refer to rounding off the message in the encrypted state, which may also be called rescaling.

[0132] In addition, when the percentage of approximate messages in the calculation result ciphertext exceeds a threshold, the computing device 400 may perform a rebooting operation on the ciphertext.

[0133] Figure 3 is a diagram illustrating a computing operation of a computing device according to an embodiment.

[0134] Reference Figure 3 , homomorphic ciphertexts 10 and 20 include approximate message regions 11 and 21, respectively. Approximate message regions 11 and 21 have messages and errors m1+e1 and m2+e2, respectively.

[0135] The computing device 400 can perform a specific computation by using two homomorphic ciphertexts 10 and 20 as input values. The computation may be a polynomial computation formed by addition, subtraction, or multiplication, and may also be a polynomial computation or a non-polynomial computation in which an approximate function must be used.

[0136] The most representative calculation in the non-polynomial calculation is the comparison operation, and it can be a maximum operation, a minimum operation, or a size comparison. The maximum operation can output a larger value from two values, the minimum operation can output a minimum value from two values, and the size comparison may output 1 if either value is larger, output 0 if the other value is larger, and output 1 / 2 if the two values ​​are the same. Meanwhile, in the size comparison, the output numerical value is only an example, and in an embodiment, other values ​​may be output.

[0137] The maximum value operation may be expressed by the following Formula 9, and the minimum value operation may be expressed by the following Formula 10.

[0138] [Formula 9]

[0139]

[0140] Here, a represents the first homomorphic ciphertext, b represents the second homomorphic ciphertext, and max(a, b) represents a function that outputs the value of the homomorphic ciphertext having the larger value between the first homomorphic ciphertext and the second homomorphic ciphertext.

[0141] [Formula 10]

[0142]

[0143] Here, a represents the first homomorphic ciphertext, b represents the second homomorphic ciphertext, and min(a, b) represents a function that outputs the value of the homomorphic ciphertext having the smaller value between the first homomorphic ciphertext and the second homomorphic ciphertext.

[0144] Referring to the above formulas 9 and 10, calculations such as addition, subtraction, and division by a constant 2 can be performed in the homomorphic ciphertext state, but square root calculation cannot be performed in the homomorphic ciphertext state. Therefore, the square root calculation requires an approximate polynomial, and a composite function that repeatedly performs calculations of a first function and a second function a predetermined number of times can be used, the first function having a first variable with an input value as an initial value and a second variable with a value obtained by subtracting 1 from the input value as an initial value, and the second function having a second variable. The specific operation of the square root calculation will be referred to below. Figure 6 Give a description.

[0145] When a composite function corresponding to a square root calculation is used, a maximum value operation and a minimum value operation can be expressed as follows.

[0146] [Formula 11]

[0147]

[0148] [Formula 12]

[0149]

[0150] Here, a represents the first homomorphic ciphertext, b represents the second homomorphic ciphertext, d represents the number of repetitions, and Sqrt((ab) 2 ; d) represents the composite function corresponding to the square root calculation.

[0151] This can be done by repeatedly executing The size comparison is approximated by the calculation of the formula, and the formula corresponding to the size comparison may include the inverse calculation of the homomorphic ciphertext. The inverse calculation cannot be performed directly in the homomorphic ciphertext state, and therefore, in this application, a composite function corresponding to the inverse calculation may be used. Figure 5 Describe the specific operations of inverse calculation.

[0152] Meanwhile, the size comparison can be approximated by using a sign function, and such a sign function can be a composite function that obtains output values ​​parallel to each other for input values ​​other than 0 (for example, an output value close to 1 is obtained for input values ​​greater than 0, and an output value close to -1 is obtained for input values ​​less than 0) and / or can be a composite function that obtains output values ​​parallel to each other for input values ​​other than 0. Fig. 9 and 10 Describe operations using such composite functions.

[0153] Meanwhile, the ciphertext 30 obtained by the above calculation may include an approximate message field 31 having a calculation result (m3+e3) between approximate messages. If the plaintext space 32 is removed or is less than a limit value, the computing device 400 may perform a restart operation.

[0154] Figure 4 is a flowchart illustrating a ciphertext calculation method according to an embodiment.

[0155] Reference Figure 4 , a comparison calculation command for a plurality of homomorphic ciphertexts may be received (S410). Such a command may be received from an external device or may be directly input from the computing device. The comparison calculation may be one of a minimum value operation, a maximum value operation, and a size comparison.

[0156] The calculation (S420) may be performed by reflecting the plurality of homomorphic ciphertexts to a composite function corresponding to the comparison calculation command. Specifically, the comparison calculation may be performed by using a composite function having a complexity of θ(α) or θ(αlogα).

[0157] The calculated homomorphic ciphertext may be output (S430). Specifically, the calculation result may be output to the device that has requested the calculation.

[0158] In the ciphertext operation method according to the present application, the precision 2 -αThe calculation is performed with complexity θ(α) or θ(αlogα), and therefore, faster calculation can be performed even if it is necessary to obtain high accuracy.

[0159] Figure 5 is a diagram illustrating a method of operating an inverse calculation by using a composite function according to an embodiment.

[0160] refer to Figure 5 , the inverse function Inv(x; d) for a variable x and a positive value d is a composite function in which a value obtained by subtracting the input value x from 2 is set as the initial value a 0 The first variable a n , and having a value obtained by subtracting the input value x from 1 as the initial value b 0 The second variable b n , and has a second variable b n The first function b 2 n and with the first variable a n and the second variable b n The second function a n ·(1+B n+1 ) is repeated a predetermined number of times.

[0161] The inverse function can be obtained by modifying Goldschmidt's division algorithm, such as Equation 13 below.

[0162] [Formula 13]

[0163]

[0164] This composite function for the inverse function may have complexity θ(α).

[0165] Figure 6 is a diagram illustrating a method of operating a square root calculation by using a composite function according to an embodiment.

[0166] refer to Figure 6 , the square root calculation Sqrt(x; d) of the variable x and the positive number d is a composite function, which is assumed to have the input value x as the initial value a in the initial stage 0 The first variable a n The value obtained by subtracting 1 from the input value x is used as the initial value b 0 The second variable b n , and will have the first variable a n and the second variable b n The first function and with a second variable b n The second function Repeat a predetermined number of times.

[0167] This composite function for the square root is relative to the error bound 2 -α It can have complexity θ(α).

[0168] Figure 7 is a diagram illustrating a method for calculating a maximum value and a minimum value according to an embodiment.

[0169] Reference Figure 7 , the maximum value operation and the minimum value operation can be expressed by the above formulas 9 and 10, and in the square root calculation of formulas 9 and 10, the following can be used: Figure 6 Composite function for square root calculation shown.

[0170] For example, when requesting the maximum value of homomorphic ciphertexts A and B, refer to Figure 7 , the computing device 400 may: ① calculate the value of (A+B) / 2 and the value of (A﹣B) / 2, ② calculate the square of (A﹣B) / 2 and repeat the calculation of the square value a predetermined number of times d by using a composite function corresponding to the square root calculation, and ③ add the result of the composite function to the previously calculated value of (A+B) / 2, thereby calculating the maximum value.

[0171] At the same time, when requesting a minimum operation for homomorphic ciphertexts A and B, computing device 400, referring to Figure 7 , it is possible to: ① calculate the value of (A+B) / 2 and the value of (A-B) / 2, ② calculate the square of (A-B) / 2 by using a composite function corresponding to the square root calculation and repeat the calculation of the square value a predetermined number of times d by using the composite function corresponding to the square root calculation, and ③ subtract the result of the composite function from the previously calculated value of (A+B) / 2, thereby calculating the minimum value.

[0172] Meanwhile, in the above, it is shown and described that the maximum value or the minimum value is output by comparing only two values, but in an embodiment, the maximum value operation and the minimum value operation can also be performed on three or more homomorphic ciphertexts. For example, when three homomorphic ciphertexts are provided, the first and second homomorphic ciphertexts can be compared with each other, and then the results thereof can be compared with the remaining homomorphic ciphertexts to calculate the maximum value of the three values ​​or the minimum value of the three values.

[0173] Figure 8 is a diagram showing a size comparison method according to the first embodiment.

[0174] For example, a comparison function that outputs a value of 0 or 1 when two values ​​are different from each other and outputs 0.5 when two values ​​are the same as each other can be approximated as follows.

[0175] [Formula 14]

[0176]

[0177] Here, a represents the first homomorphic ciphertext, b represents the second homomorphic ciphertext, and comp(a, b) represents a function that compares two input homomorphic ciphertexts, and outputs 1 when a is large; outputs 0 when b is large; and outputs 0.5 when a and b are the same.

[0178] Referring to Formula 14, the approximate function for the comparison function may include an inverse calculation. Therefore, when performing a comparison operation on homomorphic ciphertexts A and B by using an approximate function such as Formula 14, the computing device 400 refers to Figure 8 , the initial value a can be calculated 0 and b 0 , and ① after calculating the initial value, by using the corresponding Figure 5 The composite function of the inverse calculation described above performs Inv(a m n +b m n ; d). In addition, the inverse calculation value can be multiplied by a by repeating ② for a predetermined number of times t m n ③ Subtract the previously calculated value a from 1 n+1 Calculation is used to calculate and compare the calculation result value.

[0179] Fig. 9 is a diagram showing a size comparison method according to the second embodiment.

[0180] Meanwhile, the size comparison function can be expressed as a sign function as follows.

[0181] [Formula 15]

[0182] comp(a,b)=(sgn(ab)+1) / 2

[0183] Here, a represents the first homomorphic ciphertext, b represents the second homomorphic ciphertext, and comp(a, b) represents a function that compares two input homomorphic ciphertexts and outputs 1 when a is large, outputs 0 when b is large, and outputs 0.5 when a is the same as b. sgn() represents a sign function.

[0184] Therefore, the approximation of the magnitude comparison function can be expressed as an approximation of the sign function.

[0185] When the sign function satisfies the following Formula 16, the composite function used for the sign function operation can be expressed by the following Formula 17.

[0186] [Formula 16]

[0187] Prop If(-x)=-f(x)

[0188] Prop II. f(1) = 1, f(-1) = -1

[0189] Prop III.f′(x)=c(1-x 2 ) n for some constant c>0

[0190] f(x) represents a polynomial function.

[0191] [Formula 17]

[0192]

[0193] The composite function used for the sign function operation as described above may be a composite function that obtains an output value close to 1 for an input value greater than 0, and obtains an output value close to -1 for an input value less than 0.

[0194] Reference Fig. 9 When a size comparison calculation command for a homomorphic ciphertext is requested, the computing device 400 can perform the comparison calculation by executing the following: ① calculating the difference between two values ​​(ab); ② repeatedly calculating the corresponding calculation value a predetermined number of times d by using formula 17, and ③ performing a constant calculation on the calculation value.

[0195] At the same time, Fig. 9 In the method, a method of obtaining a sign function whose both ends are 1 or -1, i.e., parallel to each other, is used. As another characteristic of an ideal sign function, a slope having a value of 0 has an infinite value, in other words, a slope having a value of 0 has a vertical shape. In this regard, hereinafter, a composite function taking this into consideration will be described.

[0196] Fig.10 : is a diagram showing a method for obtaining a composite function corresponding to the slope of a sign function.

[0197] An approximation of the magnitude comparison function can be expressed as an approximation of the sign function as described above.

[0198] [Formula 18]

[0199] Prop Ig(-x)=-g(x) (Origin Symmetry)

[0200]

[0201]

[0202] Here, g(x) represents another complex function used for the symbolic function operation, and c represents the convergence range of the output value, which can be defined as a value less than 1, such as 1 / 4, 1 / 3, etc.

[0203] When the sign function satisfies Formula 18, the computing device 400 can calculate the value of Fig.10 The method shown is used to calculate the function g(x).

[0204] When passing Fig.10 When the method shown in the figure is used to calculate the composite function, the size comparison method can also be combined with the reference Fig. 9 The following will refer to the composite function described in Fig.11 Describe this.

[0205] Fig.11 is a diagram illustrating a size comparison method according to the third embodiment.

[0206] Reference Fig.11 When a size comparison calculation command for a homomorphic ciphertext is requested, the computing device 400 may perform the comparison calculation by performing the following: ① calculating the difference between the two values ​​(ab), ② repeating the calculation with a number of times d g Repeated counting by Fig.10 The corresponding calculated value of the composite function gn(x) is calculated by the method; ③ By using formula 17(f n (x)) Repeat the calculation of the corresponding calculated value a predetermined number of times df, and ④ perform constant calculation on the calculated value.

[0207] Fig.12 is a diagram showing the shape of the composite function corresponding to the sign function for each number of repetitions, and Fig.13 It is a diagram showing the shapes of various composite functions related to the sign function for each number of repetitions.

[0208] Reference Fig.12 , you can confirm the reference Fig. 9 The composite function f described n (x) With the increase of the number of repetitions, it has a more ideal shape.

[0209] Reference Fig.13 For reference, please refer to the left picture Fig.10 The composite function described has Fig. 9 The composite function has a higher slope, but errors occur at both ends. Therefore, when using Fig.10 A composite function that is used at a later stage Fig. 9 In other words, when using a composite function such as Fig.11 When you use a composite function that combines the methods in Fig. 9 The ideal shape can be obtained by comparing the case of a composite function of , or by comparing with the same number of repetitions.

[0210] Specifically, refer to Fig.13 As shown in the right figure, Fig. 9The composite function is 5 times compared to Fig.10 The composite function is executed twice and applied Fig. 9 When the function is applied three times, the desired shape is obtained.

[0211] Meanwhile, the ciphertext processing method according to each embodiment can be performed in the form of a program code for performing each process, and can be stored in a recording medium and distributed. In this case, a device equipped with a recording medium can perform operations such as the above-mentioned encryption or ciphertext processing.

[0212] The recording medium may be various types of computer-readable media such as ROM, RAM, memory chip, memory card, external hard disk, hard disk, CD, DVD, magnetic disk, or magnetic tape.

[0213] Although the present application is described with reference to the accompanying drawings, the scope of the rights is limited by the appended claims and is not interpreted as being limited to the described embodiments and / or drawings. In addition, it should be clearly understood that it is obvious to those skilled in the art that various improvements, modifications and variations of the embodiments of the claims are included within the scope of the rights of the present application.

Claims

1. A ciphertext calculation method, comprising: receiving an input of a comparison calculation command for a plurality of homomorphic ciphertexts; performing calculation by reflecting the plurality of homomorphic ciphertexts to a composite function corresponding to a comparison calculation command; as well as Output the calculated homomorphic ciphertext, Wherein, the comparison calculation is a maximum value calculation or a minimum value calculation, wherein performing the calculation includes performing the calculation of the maximum value operation or the minimum value operation by using a composite function corresponding to a square root calculation, and The composite function corresponding to the square root calculation is a function that repeatedly performs calculations of a first function and a second function a predetermined number of times, wherein the first function includes a first variable having an input value as an initial value and a second variable having a value obtained by subtracting 1 from the input value as an initial value, and the second function includes a second variable.

2. The ciphertext calculation method according to claim 1, wherein: The composite function responds to precision 2 -α And has complexity θ(α) or θ(αlogα).

3. The ciphertext calculation method according to claim 1, wherein: The predetermined number of times is a number corresponding to the error rate of the square root calculation.

4. The ciphertext calculation method according to claim 1, wherein: The comparison calculation is a calculation that outputs a predetermined value based on a size comparison, and The performing of the calculation includes repeatedly performing the calculation of a composite function a predetermined number of times, wherein the composite function includes a function calculation corresponding to the inverse calculation.

5. A ciphertext calculation method, comprising: receiving an input of a comparison calculation command for a plurality of homomorphic ciphertexts; performing calculation by reflecting the plurality of homomorphic ciphertexts to a composite function corresponding to a comparison calculation command; as well as Output the calculated homomorphic ciphertext, The comparison calculation is a calculation that outputs a predetermined value based on the size comparison, and wherein performing the calculation comprises: repeatedly performing the calculation by using a composite function corresponding to the sign function a predetermined number of times, The composite function corresponding to the sign function is a composite function that obtains an output value close to 1 for an input value greater than 0 and obtains an output value close to -1 for an input value less than 0.

6. The ciphertext calculation method according to claim 5, wherein: Performing the calculation includes performing the comparison calculation by using two or more different composite functions, the composite functions being approximate functions corresponding to the sign function.

7. A computing device comprising: a memory storing at least one instruction; and a processor arranged to execute said at least one instruction, The processor is configured to: Based on an input of a comparison calculation command for a plurality of homomorphic ciphertexts received, performing calculation by reflecting the plurality of homomorphic ciphertexts to a composite function corresponding to the comparison calculation command, and outputting the calculated homomorphic ciphertexts, Wherein, the comparison calculation is a maximum value calculation or a minimum value calculation, wherein the processor is configured to perform the calculation of the maximum value operation or the minimum value operation by using a composite function corresponding to a square root calculation, and The composite function corresponding to the square root calculation is a function that repeatedly performs calculations of a first function and a second function a predetermined number of times, wherein the first function includes a first variable having an input value as an initial value and a second variable having a value obtained by subtracting 1 from the input value as an initial value, and the second function includes a second variable.

8. The computing device according to claim 7, wherein: The comparison calculation is a calculation that outputs a predetermined value based on a size comparison, and The processor is configured to repeatedly perform calculation of a composite function a predetermined number of times, wherein the composite function includes function calculation corresponding to the inverse calculation.

9. A computing device comprising: a memory storing at least one instruction; and a processor arranged to execute said at least one instruction, The processor is configured to: Based on an input of a comparison calculation command for a plurality of homomorphic ciphertexts received, performing calculation by reflecting the plurality of homomorphic ciphertexts to a composite function corresponding to the comparison calculation command, and outputting the calculated homomorphic ciphertexts, The comparison calculation is a calculation that outputs a predetermined value based on the size comparison, and wherein the processor is configured to repeatedly perform the calculation by using the composite function corresponding to the sign function a predetermined number of times, The composite function corresponding to the sign function is a composite function that obtains an output value close to 1 for an input value greater than 0, and obtains an output value close to -1 for an input value less than 0.

10. The computing device according to claim 9, wherein: The processor is configured to perform the comparison calculation by using two or more different composite functions, the composite functions being approximate functions corresponding to the sign function.

Images