Ciphertext Processing Method and Apparatus Based on Homomorphic Encryption

Abstract

A method and apparatus for ciphertext processing based on homomorphic encryption. The method includes: determining an approximate polynomial corresponding to a modular reduction based on samples extracted from a modular reduction used for bootstrapping ciphertext; and bootstrapping ciphertext based on the approximate polynomial.

Description

[0001] Cross-reference to related applications

[0002] This application claims priority to U.S. Provisional Application No. 63 / 010,812, filed April 16, 2020, and Korean Patent Application No. 10-2020-0137640, filed October 22, 2020, with the Korean Intellectual Property Office, the entire disclosures of which are incorporated herein by reference for all purposes. Technical Field

[0003] The following description relates to a method and apparatus for processing ciphertext based on homomorphic encryption. Background Technology

[0004] Fully homomorphic encryption is an encryption scheme that allows arbitrary logical or mathematical operations to be performed on encrypted data. Fully homomorphic encryption maintains the security of data processing. It enables customers to obtain many services while protecting their privacy. Summary of the Invention

[0005] This summary is provided to describe in simplified form the selection of concepts further described below in the detailed description. This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to help define the scope of the claimed subject matter.

[0006] In one general aspect, a ciphertext processing method based on homomorphic encryption includes: determining an approximate polynomial corresponding to a modular reduction based on samples extracted from a modular reduction used for bootstrapping ciphertext; and bootstrapping ciphertext based on the approximate polynomial.

[0007] The determination may include: determining the coefficients of the approximate polynomial such that the current difference between the sample extracted from the modulo reduction and the value of the approximate polynomial is less than a predetermined threshold.

[0008] The determination may include: verifying whether the current difference between the sample extracted from the modulo reduction and the value of the approximate polynomial is less than a predetermined threshold; and in response to the current difference being greater than or equal to the predetermined threshold, increasing the number of samples or the degree of the approximate polynomial based on a comparison between the current difference and the difference determined in a previous step.

[0009] The determination may include: increasing the number of samples in response to the similarity between the current difference and the difference determined in a previous step being less than a predetermined threshold similarity; and increasing the degree of the approximate polynomial in response to the similarity being greater than or equal to the predetermined threshold similarity.

[0010] The difference between the values ​​of the sample and the approximate polynomial can be determined based on the L2 norm between the sample and the approximate polynomial.

[0011] This determination may include: determining an approximate polynomial that includes terms of odd order.

[0012] This determination may include: determining an approximate polynomial based on Chebyshev polynomials.

[0013] The sample can be extracted from a piecewise continuous interval that has a symmetrical shape about the reference point in the function corresponding to the modulus reduction.

[0014] Samples can be extracted from segments separated by reference points within a continuous interval.

[0015] The bootstrapping can include: bootstrapping ciphertext by evaluating modular reduction using approximate polynomial homomorphism.

[0016] In another general aspect, a ciphertext processing apparatus based on homomorphic encryption includes one or more processors, wherein the one or more processors are configured to: determine an approximate polynomial corresponding to the modular reduction based on samples extracted from a modular reduction used for bootstrapping ciphertext; and bootstrap ciphertext based on the approximate polynomial.

[0017] In another general aspect, a method includes: determining an initial approximate polynomial corresponding to the modular reduction based on an initial number of samples extracted from the modular reduction used for the bootstrap ciphertext; calculating the error between the initial approximate polynomial and the modular reduction function; increasing one of the initial number of samples and the initial approximate polynomial by a certain number based on the error; determining an updated approximate polynomial based on the increased number of samples or the increased number of the initial approximate polynomial; and homomorphically evaluating the modular reduction using the updated approximate polynomial.

[0018] The computational error may include: determining that the difference between the initial number of samples extracted from the modulo reduction and the value of the initial approximate polynomial is greater than or equal to a threshold.

[0019] Other features and aspects will become clear from the following detailed description, drawings and claims. Attached Figure Description

[0020] Figure 1 An example of operation for a user terminal and server for processing ciphertext encrypted based on homomorphic encryption is shown.

[0021] Figure 2 An example of a scaling modulo reduction function is shown.

[0022] Figure 3 An example of determining an approximate polynomial is shown.

[0023] Figure 4 A bootstrapping example using the determined approximate polynomial is shown.

[0024] Figure 5An example of a ciphertext processing method is shown.

[0025] Figure 6 An example of a ciphertext processing device is shown.

[0026] Throughout the accompanying drawings and detailed description, unless otherwise described or provided, the same reference numerals will be understood to refer to the same elements, features, and structures. The drawings may be drawn not to scale, and for clarity, illustration, and convenience, the relative dimensions, scale, and depiction of elements in the drawings may be enlarged. Detailed Implementation

[0027] The detailed structural or functional descriptions below are provided as examples only, and various changes and modifications can be made to the examples. Therefore, the examples are not to be construed as limiting to this disclosure and should be understood to include all changes, equivalents, and substitutions within the technical scope of this disclosure.

[0028] Components may be described in this document using terms such as first, second, etc. Each of these terms is not used to define the nature, order, or sequence of the corresponding component, but only to distinguish the corresponding component from other components. For example, the first component may be referred to as the second component, and similarly, the second component may be referred to as the first component.

[0029] It should be noted that if a component is described as “connected,” “coupled,” or “joined” to another component, a third component can be “connected,” “coupled,” and “joined” between the first and second components, although the first component can be directly connected, coupled, or joined to the second component.

[0030] The singular forms “a,” “an,” and “the” are intended to also include the plural forms unless the context explicitly indicates otherwise. It will also be understood that the terms “comprising,” “having,” and / or “including” as used herein mean the presence of the stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or combinations thereof.

[0031] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains. Terms (such as those defined in common dictionaries) shall be interpreted as having the meaning consistent with their meaning in the context of the relevant art, and shall not be interpreted as having an ideal or overly formal meaning, unless expressly defined herein.

[0032] In the following description, examples will be illustrated in detail with reference to the accompanying drawings. The specific structural or functional descriptions below are exemplary and merely illustrative, and the scope of the examples is not limited to the descriptions provided in this specification. Various changes and modifications can be made thereto by those skilled in the art. Similar reference numerals in the drawings denote similar elements, and known functions or configurations will be omitted herein.

[0033] Figure 1 An example of operation for a user terminal and server for processing ciphertext encrypted based on homomorphic encryption is shown.

[0034] Reference Figure 1 The diagram illustrates a user terminal 110 and a server 120. The user terminal 110 is a user-controlled device and may include, for example, various computing devices (such as smartphones, tablets, laptops, and personal computers), various wearable devices (such as smartwatches and smart glasses), various home appliances (such as smart speakers, smart TVs, and smart refrigerators), smart vehicles, smart kiosks, Internet of Things (IoT) devices, drones, robots, etc. The user terminal 110 can encrypt stored data using homomorphic encryption and send the encrypted data to the server 120. The user terminal 110 can send data to the server 120 to use various services provided by the server 120. In this example, the data to be sent can be encrypted to protect the information contained therein. To facilitate the server 120's processing of the encrypted data, the user terminal 110 can encrypt the data using homomorphic encryption.

[0035] Homomorphic encryption is an encryption scheme that allows computation to be performed on encrypted data without decryption. Because it can process encrypted data without decryption, homomorphic encryption is suitable for data-massive applications requiring privacy protection. For example, a homomorphic encryption scheme could be the Cheon-Kim-Kim-Song (CKKS) scheme, which will be described in detail later. Here, the unencrypted data can be referred to as plaintext, and the encrypted data as ciphertext.

[0036] Homomorphic encryption contains noise, and the noise level can increase as operations are performed on the ciphertext. To prevent noise from overwhelming the data, noise processing, i.e., bootstrapping, can be performed to refresh the noise. Bootstrapping fixes the parameter size and computational overhead, making it independent of circuit depth.

[0037] Without bootstrapping, ciphertext encrypted using homomorphic encryption has the maximum possible number of operations, which can be represented by level l (0 < l ≤ L). Bootstrapping can be the process of generating level L ciphertext with the same message by refreshing level 0 ciphertext, which cannot be further operated on.

[0038] Server 120 can perform various operations on ciphertext through bootstrapping. In this case, decryption of the ciphertext is not required, thus avoiding privacy violations. In the example, the ciphertext manipulated by server 120 can be sent back to user terminal 110, and user terminal 110 can provide the user with the data obtained by decrypting the ciphertext, or use that data for subsequent operations.

[0039] Homomorphic evaluation of modular reduction is important in bootstrapping. Only arithmetic operations can be evaluated as homomorphic. Since modular reduction is not an arithmetic operation, a polynomial approximation is required for it. Here, homomorphic evaluation can also be expressed as obtaining homomorphic values ​​or performing the operation homomorphically.

[0040] Here, finding an approximate polynomial for modular reduction can be replaced by directly computing the L2 norm minimization problem for the optimal solution. Therefore, the limitations caused by polynomial approximations using trigonometric functions (e.g., sine functions, etc.) can be easily overcome. Discrete optimization methods can be applied to obtain the approximate polynomial for modular reduction. By solving the modified discretization problem, the degree of the approximate polynomial used for modular reduction can be reduced, while achieving a low error range. Furthermore, the bootstrap level loss can be reduced, and the solution to the transformation problem can be determined efficiently without iteration.

[0041] Figure 2 An example of a scaling modulo reduction function is shown.

[0042] Here, vectors are represented in bold (e.g., x), and each vector can be a column vector. Matrices are represented by bold uppercase letters (e.g., A). The inner product of two vectors is represented by <·, ·>, or simply by ·. Matrix multiplication is represented by ·, or can be omitted if not required. The Lp norm of a vector is represented by ||x||. p =(∑ i x[i] p ) -p Let x[i] represent the i-th element of vector x. Similarly, A[i;j] are the elements of matrix A in the i-th row and j-th column. x←D denotes a sample of x according to distribution D. When a set is used instead of a distribution, it means that x is randomly and uniformly sampled from the elements of the set.

[0043] Chebyshev interpolation is a polynomial interpolation method that uses Chebyshev polynomials as the basis for interpolation polynomials. The first kind of Chebyshev polynomial, in short, is defined by the following recursive relation.

[0044] [Equation 1]

[0045] T0(x)=1

[0046] T1(x)=x

[0047] T n+1 (x)=2xT n (x)-T n-1 (x)

[0048] An nth-degree Chebyshev polynomial has n distinct roots in the interval [-1, 1], and all its extrema are also in [-1, 1]. Furthermore, It can be the smallest absolute value among nth degree monomial polynomials, and its absolute value is... The polynomial.

[0049] In Chebyshev interpolation, the nth-degree polynomial p n (x) can be expressed as the sum of Chebyshev polynomials, in the following form.

[0050] [Equation 2]

[0051]

[0052] Where, p n (x) is obtained by interpolating n+1 points {x0, x1, ..., x...} n The approximate polynomial of f(x) obtained is}.

[0053] [Equation 3]

[0054]

[0055] Choose points {x0, x1, ..., x} n} is the key to achieving a good approximation.

[0056] For a positive integer M, Φ M (X) can be the Mth Nth cyclotomic polynomial. Here, M is a power of 2, M = 2N, and Φ M (X)=X N +1. It can be a number field The integer ring, and is written as

[0057] The CKKS scheme and its residue system (RNS) variants can provide homomorphic operations on real numbers with errors. This can be performed via regular embeddings and their inverses. Regular embeddings in σ It can be in Φ M The vector of evaluation values ​​a at the roots of (X). π can represent the vector from... arrive The natural projection. Here. It can be an integer modulo M multiplicative group. The encoding will be described below. And decoding.

[0058] Ecd(z;Δ). Encoding the (N / 2)-dimensional vector z can return the following.

[0059] [Equation 4]

[0060]

[0061] Here, Δ is the scaling factor, and Indicates: will Discretize into π -1 (z) elements.

[0062] Dcd(m; Δ). For input polynomials... We can output a vector j∈T such that, for π(z), the entry at index j can be given as Here, ζM is an M-th power root of unity, and T is a root satisfying... of Multiplicative subgroups.

[0063] For σ(a) The L-infinite norm of a can be called the regular embedding norm of a, by express.

[0064] Three distributions can be defined as follows. For real numbers γ > 0, Represents vector in The distribution in the data, whose entries can be independent of the variance γ 2 The discrete Gaussian distribution is sampled. The symbol is {0, ±1} N A set of signed binary vectors, where the Hamming weight is h, and Let {0, ±1} be a vector distribution starting from ±1 (where the probability is ρ / 2 for each 1-ρ) and have a probability of zero. N We can assume the existence of an l-level ciphertext (0 < l ≤ L). Here, l-level represents the maximum possible number of multiplications before bootstrapping. For ease of description, the base p > 0 and the modulus q can be fixed, and q can be set... l =pl ·q. The base integer p can be the base Δ used for scaling.

[0065] The CKKS scheme can be defined using the following key generation, encryption, decryption, and corresponding homomorphic operations.

[0066] KeyGen(1 λ Given a security parameter λ, a power of 2 M, an integer h, an integer P, a real value γ, and a maximum ciphertext modulus Q, such that Q ≥ q can be determined. L And sampling can be performed as follows.

[0067] [Equation 5]

[0068]

[0069] The private and public keys can be defined as sk := (1, s),

[0070] Where b = -as + e (mod q) L ).

[0071] KSGen sk (s′). This can be done on... and Sampling can be performed, and the switching key can be output as... Where b′=-a′s+e′+Ps′(mod Pq) L The evaluation key can be set to evk:=KSGen. sk (s 2 ).

[0072] Enc pk (m). This can be used for... and Sampling is performed, and the output can be c = v·pk + (m + e0, e1) (mod q) L ).

[0073] Dec sk (c). Can output

[0074] Add(c1, c2). For It can output c add =c1+c2(mod q) l ).

[0075] Mult evk (c1, c2). For c1 = (b1, a1), Assume (d0, d1, d2) := (b1b2, a1b2+a2b1, a1a2)(mod q)l Then it can output ),

[0076] RS l→l′ (c). For It can output

[0077] KS swk (c). For It can output

[0078] In addition to the operations mentioned above, key switching technology can also be used to provide various operations, such as complex conjugation and rotation.

[0079] The basic operations supported in this paper can be similarly applied to the fully RNS variant of CKKS. Therefore, the methods described in this paper can be applied to the CKKS scheme and all its variants.

[0080] The bootstrapping of the CKKS scheme can include the following four steps: ModRaise, CoeffToSlot, EvalMod, and SlotToCoeff.

[0081] ModRaise can be the process of changing the modulus of the ciphertext to a larger value. We can assume that ct satisfies m(X) = [<ct,sk> ] q The ciphertext. t(X) =<ct,sk> (mod X N +1) is for conditions with boundaries ||I(X)|| ∞ <K is of the form t(X) = qI(X) + m(X), where K can be derived from... Definition. The following procedure aims to calculate the remainder of the coefficients t(X), that is, the remainder [t] obtained homomorphically by dividing t by q. q Since modular reduction is not an arithmetic operation, the key is to find a polynomial that approximates the modular reduction. The size of the message can be controlled, so for smaller m < ∈ · q, it can be ensured that ∈ .

[0082] Regarding CoeffToSlot, approximate homomorphic operations can be performed within plaintext time slots. Therefore, to process t(X), it may be necessary to place the polynomial coefficients within the plaintext time slots. In the CoeffToSlot step, Ecd can be performed homomorphically using matrix multiplication, FFT-like operations utilizing the relation of the root of unity, or a hybrid of both. Then, the result can be obtained for... and (or a combination thereof) Two ciphertexts to be encrypted.

[0083] In the EvalMod step, the elements of each time slot can be considered from a Single Instruction Multiple Data (SIMD) perspective. In other words, t = qI + m can represent the elements in the time slot. In the EvalMod step, [t] can be... q Perform an approximate assessment.

[0084] SlotToCoeff can be the inverse operation of CoeffToSlot.

[0085] As mentioned above, the key part of the bootstrapping of the CKKS scheme is the homomorphic evaluation of modulo reduction.

[0086] like Figure 2 As shown, by scaling the modulo reduction function by 1 / q, [t] can be... q Defined as tk, where t∈I k Here, I k = [k-∈, k+∈], and k can be an integer satisfying |k|<K. Additionally, ∈ can represent the ratio of the largest coefficient of the message polynomial to the modulus of the ciphertext, i.e., [t] q The domain can be given as in other words, Where t = q·I + m.

[0087] In the following text, the description will directly find [t]. q Approximate polynomial p o (t) without using intermediate approximations such as sine or cosine functions. This method can use least squares estimation or L2 norm optimization. The goal could be to find the set of coefficients c = (c0, c1, ..., c... n ) to make ||[t] q -p(t)|| ∞ Minimize. Here, the nth-degree polynomial can be obtained from... Definition. This type of polynomial can be called a minimal-maximal polynomial. p(t) can be equivalent to c and T = (1, t) 1 , ..., t n The inner product of ).

[0088] Here, t i ′ can be in each I k The intervals δ << ∈ (i.e., k-∈, k-∈+δ, ..., k+∈-δ, ​​k+∈) are uniformly sampled. k There is There are 10 samples, therefore, the total number of samples can be 10 ... Use t i N tot One sample can determine t iThe vector of powers, i.e., T i = (1, t) i , t 2 i , ..., t n i ), where 1≤i≤N tot .

[0089] In other words, it can be obtained from... Figure 2 The piecewise continuous interval of the modulo reduction function shown Extract I k = [k-∈, k+∈] samples. As will be discussed later, in the modulo reduction function, each segment has a continuous interval I. k =[k-∈, k+∈] can have a symmetrical shape about a reference point (e.g., -2, -1, 0, 1, or 2). Only continuous intervals I from each segment can be used. k The approximate polynomial is determined by samples extracted from the portion of [k-∈, k+∈] separated by the reference point (e.g., the portion where the value of the modulo reduction function is greater than or less than 0).

[0090] The objective function to be minimized is expressed as follows.

[0091] [Equation 6]

[0092]

[0093] Here, T is satisfied N tot A ×(n+1) matrix, and y is a matrix satisfying y[i]=[t i ] q The vector. Instead of the L-infinity norm, the above objective function can be replaced with the loss function using the L2 norm. Then, the optimal solution for minimizing the L2 norm can be efficiently computed. c We can represent the L2 norm with coefficients c. Then, we can find c that minimizes the following terms.

[0094] [Equation 7]

[0095] L c =||yT·c||2

[0096] =(yT·c) T (yT·c)

[0097] Unfortunately, entries for T may have very large values ​​or very small values ​​close to zero because the degree of the polynomial n is high.

[0098] Therefore, Chebyshev polynomials can be used as the basis of polynomials rather than the power basis. In other words, entries can be used. Redefining N tot A ×(n+1) matrix T. Because... This can be satisfied. Therefore, the entries of T can be evenly distributed in [-1, 1], rather than larger values ​​or smaller values ​​near 0.

[0099] Then, the optimal coefficient vector c * It can be given as follows.

[0100] [Equation 8]

[0101] c * =arg min c L c

[0102] Since the loss is a convex function, the optimal solution c * It can be at zero gradient. Loss function L c The gradient can be given as follows.

[0103] [Equation 9]

[0104]

[0105] Setting the gradient to zero yields the following optimal coefficients.

[0106] [Equation 10]

[0107]

[0108] In summary, the modulo reduction function can be approximated as follows.

[0109] [Equation 11]

[0110]

[0111] in,

[0112] The approximation error can be calculated from the maximum error of the sampling points and... The product is used to define it.

[0113] For t∈I k The approximation error can be defined as its absolute value, as shown below.

[0114] [Equation 12]

[0115] E(t)=(tk)-p o (t)

[0116] E(t) can be for the field t∈I k A polynomial. It can be represented as...

[0117] It can optimize for discrete point t i |E(t) i )|.

[0118] For t within a smaller interval |E(t)|, we can consider [t i , t i +δ). Then, it can be determined that |E(t)|≤|E(t) i )|+|E(t)-E(t i )|, and |E(t)-E(t) i | can be defined as follows.

[0119] [Equation 13]

[0120]

[0121] Here, t∈[t i , t i +δ) can be for Δt=tt i And constructed. Because Δt < δ < < t i Linear approximation can be applied. In addition, t i >∈ can be for And constructed. Otherwise, at least They can always be satisfied.

[0122] Therefore, the following equation can be derived.

[0123] [Equation 14]

[0124]

[0125] In summary, through fine sampling, the maximum error of the sampling points can approach the global maximum value of the approximate error. Furthermore, since the domain of the objective function in the CKKS scheme contains real numbers with errors, processing the sampled values ​​may be reasonable.

[0126] The L-infinite norm can be defined by the L2 norm as follows.

[0127] [Equation 15]

[0128]

[0129] Therefore, minimizing the L2 norm can reduce the L-infinity norm. Since this is not strictly bounded, there may be room for optimization using higher norms. However, the solution for the L2 norm is quite clear and easily computed. Although it is difficult to find the minimum-maximum polynomial of the modulo reduction function, an approximate optimal solution for the minimum-maximum polynomial can be found in a very efficient way without iterating through the L2 norm optimization problem.

[0130] Considering IV tot >n, matrix inversion (T) T T) -1 This is likely the main computation. Therefore, when using the Coppersmith-Winograd algorithm, the time complexity can be [missing information - likely a time complexity value]. This is perfectly acceptable because c * The coefficients are pre-computed and stored as the coefficients of the baby-step giant-step algorithm or the Paterson-Stockmever algorithm, which will be described later.

[0131] The approximate polynomial can be optimized based on Chebyshev polynomials. Therefore, the small-step-big-step algorithm and the modified Patterson-Stockman algorithm can be applied to the efficient homomorphic evaluation of the proposed polynomial. Using the small-step-big-step algorithm, it is possible to optimize the approximate polynomial using at most 2... l +2 m-l +ml-3 nonscalar multiplications to homomorphically evaluate p o (t), while consuming depth m. Here, 2 m It can be greater than the number of times n.

[0132] When evaluating Chebyshev polynomials using the small-step-big-step algorithm, the following can be used: and T 2n+1 =2T n T n+1 -T1, and the multiplication of 2 can be replaced by addition. Therefore, one nonscalar multiplication and two additions may be required.

[0133] In the small steps of the small-step-big-step algorithm, 2 can be evaluated. l -1 degree polynomials, and at most 2 m / 2 l A polynomial. However, when 2 m When the number of polynomials exceeds n+1, there may exist polynomials with all zero coefficients. By ignoring these, it is possible that in smaller steps, polynomials may exist. A maximum of 2 l A polynomial of degree -1. In other words, since 2 m Unlike n+1, the small-step-big-step algorithm may have... One corresponding to The polynomials are zero. Therefore, these zero polynomials can be ignored, and according to the recursive structure, exactly zero polynomials can be ignored in large steps. A nonscalar multiplication. Therefore, by using 2 m′ >n≥2 m′-1 We can obtain N(n) = N(n-2) m′-1 )+N(2m′-1 -1)+1, and can produce

[0134] Here, N(k), k≥2 l This represents the number of nonscalar multiplications in a large step, and for k < 2 l N(k) = 0. Therefore, the number of nonscalar multiplications can be given as

[0135] The number of scalar multiplications can be And the number of additions can be n+2 (2 l +ml-2). When m satisfies 2 m When the smallest integers > n and l ≈ m / 2 are available, the depth and number of nonscalar multiplications can be minimized.

[0136] When the degrees of the approximation polynomials are 2n-1 and 2n, the maximum approximation errors can be similar to each other. This is because the target of the approximation is the modulo reduction function [t]. q , is an odd function. The following proposition shows that the minimal maxima polynomial of an odd function is an odd function.

[0137] Proposition: If f(t) is an odd function, then the best approximation between polynomials of degree n is also odd.

[0138] P m Let f denote the subspace of the largest m-degree polynomial function, and f m (t) represents the P closest to f(t) in the highest norm. m The only element.

[0139] We can define p(t)∈P m ,in Then, for all u in the domain of f(t), the following equation can be established.

[0140] [Equation 16]

[0141]

[0142] If p(t)≠f m (t), then with f m The fact that f(t) is closest to f(t) contradicts this. Therefore, It can be an odd function.

[0143] In the polynomial coefficients of the proposed method, the coefficients of even-order terms can have p... oThe very small values ​​of (t) close to 0. This proves that the proposed method finds a polynomial near the minimal maxima polynomial because the modulo reduction function is an odd function. Even terms may be a barrier to finding an approximate polynomial. Therefore, a more accurate approximate polynomial can be generated by approximating only odd-order Chebyshev polynomials.

[0144] One advantage of the proposed method is its ability to leverage the properties of odd functions. By utilizing the fact that odd functions are symmetric about the origin, the L2 norm minimization can be solved using only samples with values ​​greater than 0 (or samples with values ​​less than 0). Therefore, the number of rows and columns of matrix T can be halved. Consequently, the time complexity of matrix inversion can be reduced to approximately 1 / 8. Furthermore, some operations on even-order terms can be neglected during homomorphic evaluation.

[0145] When using the proposed method, more suitable parameters can be selected to reduce the level loss during bootstrapping. As mentioned above, if the proposed method is relatively superior to the previous best method, it can find a more accurate approximate polynomial. The method for selecting parameters based on these characteristics will be described below.

[0146] For noise estimation, the following lemma can be used.

[0147] Lemma 2: For ciphertext Let c′←RS l→l′ (c) then Some of them And satisfy in

[0148] Lemma 3: Let Let swk ← KSGen be the ciphertext relative to the private key sk′=(1,s′) and let swk←KSGen sk (s′), then c′←KS swk (c) satisfies<c′,sk> =<c,sk′> +e ks (mod q), some of which and in

[0149] To maintain the accuracy of the values ​​in the time slot, a sufficiently large scaling factor can be multiplied in the CoeffToSlot step. Δ bs This can be different from the message scaling factor Δ. According to Lemma 3 above, when a sufficiently large P is chosen, the total error of the CoeffToSlot step can be...

[0150] In the EvalMod step, for small errors e j (For example Each component in the corresponding plaintext time slot can contain t j +e j Due to the approximate polynomial p o (t j ) is using the scaling factor Δ bs The approximation error is as follows, since it is evaluated.

[0151] [Equation 17]

[0152]

[0153] In order to pass Defining errors in the EvalMod step may require ensuring the following conditions are met.

[0154] [Equation 18]

[0155]

[0156] When the error in the EvalMod step is caused by When defining the error, the error after the SlotToCoeff step can be determined by... Define.

[0157] In Lemma 2 above, the bootstrap error can be independent of the message scaling factor Δ, and is determined by... Therefore, plaintext precision can be proportional to logΔ, where Δ can be determined by |m|. In the above method, the bootstrap level loss can be approximately equal to... Proportional, not with Proportional. This is one of the advantages of the proposed method, which overcomes the limitations of existing methods and achieves greater results due to the need for more precise calculations.

[0158] Various factors, such as the number of time slots, can affect plaintext accuracy. Therefore, numerical methods can be used to obtain plaintext accuracy and use it to determine parameters. When using the proposed method, a relatively small q can be used, so in some cases, more levels may remain after bootstrapping.

[0159] Based on the above description, an approximate polynomial for the modular reduction function used for bootstrapping can be determined. The problem of finding an approximate polynomial for modular reduction can be transformed into an L2 norm minimization problem, the solution of which can be found directly without the need for intermediate functions such as sine functions.

[0160] Since the approximation error in the proposed method is unaffected by the sine function, it can approximate modular reduction with high accuracy. Using Chebyshev polynomials as a foundation, low approximation error can be achieved even with polynomials of lower degrees. Furthermore, the proposed polynomial can utilize both the small-step-big-step algorithm and the Patterson-Stockman algorithm. It can be seen that by reducing the number of nonscalar multiplications, scalar multiplications, and additions based on the small-step-big-step algorithm, the proposed polynomial reduces the number of operations required for homomorphic approximate modular reduction.

[0161] The proposed method offers bootstrapping with fewer errors, especially when choosing larger scaling factors. Therefore, the choice of parameters can be expanded. Most importantly, the proposed method may be essential for applications requiring precise approximations. Conversely, the proposed method does not have, for example, a lower bound, allowing for the selection of better parameters. Therefore, bootstrapping can be less costly when using the proposed method.

[0162] Figure 3 An example of determining an approximate polynomial is shown.

[0163] In operation 301, the sample size N, the degree n of the approximate polynomial, and the target error e can be determined. target For example, the sample size N can be determined to be 16. However, this is not the only example. The initial sample size can be set in various ways depending on the situation.

[0164] In operation 302, it is possible to obtain from each interval I k Extract N samples t1, ..., t N(2K-1) Here, I k = [k-∈, k+∈].

[0165] In operation 303, the approximate polynomial T based on the Chebyshev polynomial and the function value Y corresponding to the modular reduction can be determined. Here, [t] q = tk, where t∈I k ,and K is a constant. T i (·) can represent a Chebyshev polynomial of the first kind i.

[0166] In operation 304, the optimal coefficient vector c can be determined for each sample. * It makes the modulo reduction function value [t] i ] q The value of the nth degree polynomial p(t) i )=∑ i∈[0，n] c[k]T k (t i Minimize the L2 norm of the difference between ().

[0167] In operation 305, the determined optimal coefficient vector c can be used. * Determine the approximate polynomial p n (t).

[0168] In operation 306, the determined approximate polynomial p can be calculated. n (t) and the modulo reduction function [t] q Error between them.

[0169] In operation 307, it can be determined whether the calculated error is less than the target error e. target If the calculated error is greater than or equal to the target error e target Then operation 308 can be executed.

[0170] In operation 308, it is determined whether the similarity between the calculated error and the error calculated in a previous step is less than a predetermined threshold similarity. If the similarity is less than the predetermined threshold similarity, that is, if the error calculated in the current step decreases below the error calculated in a previous step, and therefore they are not similar to each other, operation 309 can be performed to increase the sample size N. Conversely, if the similarity is greater than or equal to the predetermined threshold similarity, that is, if the error calculated in the current step is similar to the error calculated in a previous step, operation 310 can be performed to increase the degree n of the approximate polynomial. Thus, since the approximate polynomial may not approximate the modulo reduction function well with a small number of samples, it is necessary to increase the sample size N. Even if the error is not significantly reduced by increasing the sample size, it may indicate that the degree of the approximate polynomial is insufficient. Therefore, the degree n can be increased. As mentioned above, since the approximate polynomial may include odd-order terms, the degree n can be increased by 2.

[0171] If in operation 307 it is determined that the calculated error is less than the target error e target Then operation 311 can be performed to finally determine and return the approximate polynomial p. n (t).

[0172] The approximate polynomial represented by the coefficients found using the above method can be used for bootstrapping in fully homomorphic encryption through various methods, including operations to reduce the depth or number of operations, such as the small-step-big-step algorithm or the Patterson-Stockman algorithm.

[0173] In some examples, for ease of manipulation, Chebyshev polynomials of only a fractional degree can be used as approximate polynomials. Furthermore, in addition to Chebyshev polynomials, Legendre polynomials or powers of x can also be used as the basis.

[0174] Figure 4 A bootstrapping example using the determined approximate polynomial is shown.

[0175] In operation 410, the ciphertext requiring modular arithmetic during the bootstrapping process can be identified. In operation 420, the ciphertext can be homomorphically evaluated. Figure 3 The example defines the approximate polynomial p(t) for the modular reduction function. In operation 430, an approximate result of the modular operation can be obtained.

[0176] Figure 5 An example of a ciphertext processing method is shown.

[0177] Reference Figure 5 This illustrates a ciphertext processing method performed by a processor located in a ciphertext processing device.

[0178] In operation 510, the ciphertext processing apparatus determines an approximate polynomial corresponding to the modular reduction used for the bootstrap ciphertext based on samples extracted from the modular reduction. The ciphertext processing apparatus can determine the coefficients of the approximate polynomial such that the difference between the sample and the value of the approximate polynomial is less than a predetermined threshold.

[0179] The encrypted processing apparatus can verify whether the difference between a sample and the value of an approximate polynomial is less than a predetermined threshold, and in response to the difference being greater than or equal to the predetermined threshold, increase the number of samples or the degree of the approximate polynomial based on a comparison between the difference and a difference determined in a previous step. For example, the encrypted processing apparatus can increase the number of samples in response to the similarity between the difference and the difference determined in a previous step being less than a predetermined threshold similarity, and increase the degree of the approximate polynomial in response to the similarity being greater than or equal to the predetermined threshold similarity. The difference between the sample and the value of the approximate polynomial can be determined based on the L2 norm between the sample and the value of the approximate polynomial.

[0180] The ciphertext processing apparatus can determine approximate polynomials that include terms of odd order. The ciphertext processing apparatus can also determine approximate polynomials based on Chebyshev polynomials.

[0181] In operation 520, the ciphertext processing apparatus bootstraps the ciphertext based on an approximate polynomial. The ciphertext processing apparatus can bootstrap the ciphertext by homomorphically evaluating the modulo reduction using the approximate polynomial.

[0182] refer to Figures 1 to 4 The provided description can be applied to Figure 5 The operation shown will be omitted in further detail.

[0183] Figure 6 An example of a ciphertext processing device is shown.

[0184] refer to Figure 6The encrypted processing device 600 includes a memory 610 and a processor 620. The memory 610 and the processor 620 can communicate with each other via a bus 630.

[0185] Memory 610 may include computer-readable instructions. When processor 620 executes instructions stored in memory 610, processor 620 can perform the operations described above. Memory 610 may be volatile memory or non-volatile memory.

[0186] Processor 620 is a device that executes instructions or programs or controls ciphertext processing apparatus 600, and may include, for example, a central processing unit (CPU), a graphics processing unit (GPU), etc. Processor 620 may determine an approximate polynomial corresponding to the modular reduction used for bootstrapping ciphertext based on samples extracted from modular reduction, and bootstrap ciphertext based on the approximate polynomial.

[0187] The ciphertext processing device 600 can be used during the bootstrapping of ciphertext in fully homomorphic encryption, in which plaintext, including real or complex numbers, is encrypted. If the degree of the approximate polynomial determined by the ciphertext processing device 600 is reduced, the number of operations can be decreased. Therefore, the resources required for ciphertext processing operations can be effectively reduced.

[0188] In addition, the ciphertext processing device 600 can be applied to the field of encryption / security technology, such as cloud computing, information protection machine learning, all other homomorphic encryption applications, network security, system (terminal) security, cryptography / authentication, security management, content / information leakage prevention security, authentication services, etc.

[0189] In addition, the encrypted text processing device 600 can handle the above operations.

[0190] The units described herein can be implemented using hardware components, software components, and / or combinations thereof. The processing device can be implemented using one or more general-purpose or special-purpose computers, such as processors, controllers and arithmetic logic units (ALUs), DSPs, microcomputers, FPGAs, programmable logic units (PLUs), microprocessors, or any other device capable of responding to and executing instructions in a defined manner. The processing device can run an operating system (OS) and one or more software applications running on the OS. The processing device can also access, store, manipulate, process, and create data in response to the execution of software. For simplicity, the processing device is described in the singular; however, those skilled in the art will understand that a processing device can include multiple processing elements and various types of processing elements. For example, a processing device can include multiple processors or processors and controllers. Furthermore, different processing configurations are possible, such as parallel processors.

[0191] Software can include computer programs, code segments, instructions, or combinations thereof, to independently or uniformly instruct or configure processing equipment to operate as needed. Software and data can be permanently or temporarily embodied in any type of machine, component, physical or virtual device, computer storage medium, or device, or in propagated signal waves capable of providing instructions or data to or being interpreted by the processing equipment. Software can also be distributed across network-coupled computer systems, enabling distributed storage and execution of the software. Software and data can be stored on one or more non-transitory computer-readable recording media.

[0192] The methods described in the examples above can be recorded in a non-transitory computer-readable medium, including program instructions for implementing the various operations described in the examples. The medium may also include data files, data structures, etc., alone or in combination with the program instructions. The program instructions recorded on the medium may be program instructions specifically designed and constructed for the purposes of the examples, or they may be program instructions known and available to those skilled in the art of computer software. Examples of non-transitory computer-readable media include: magnetic media such as hard disks, floppy disks, and magnetic tapes; optical media such as CD-ROMs, DVDs, and / or Blu-ray discs; magneto-optical media such as optical discs; and hardware devices specifically configured for storing and executing program instructions, such as read-only memory (ROM), random access memory (RAM), flash memory (e.g., USB flash drives, memory cards, memory sticks, etc.). Examples of program instructions include machine code generated by a compiler, and files containing higher-level code that can be executed by a computer using an interpreter. The devices described above can be configured to function as one or more software modules to perform the operations described in the examples above, and vice versa.

[0193] Several examples have been described above. However, it should be understood that various modifications can be made to these examples. For example, suitable results may be achieved if the described techniques are performed in a different order and / or if the components in the described system, architecture, device, or circuit are combined in a different manner and / or replaced or supplemented by other components or their equivalents.

Claims

1. A method for processing ciphertexts, comprising: determining, based on samples extracted from a modulus reduction for bootstrapping ciphertexts, an approximating polynomial corresponding to the modulus reduction; and bootstrapping ciphertexts based on the approximating polynomial, wherein the determining comprises: in response to a similarity between a current difference between the samples extracted from the modulus reduction and a value of the approximating polynomial and a difference determined in a previous step being less than a predetermined threshold similarity, increasing a number of samples; and in response to the similarity being greater than or equal to the predetermined threshold similarity, increasing a degree of the approximating polynomial. the determining comprises determining coefficients of the approximating polynomial such that the current difference between the samples extracted from the modulus reduction and a value of the approximating polynomial is less than a predetermined threshold.

2. The method of claim 1, wherein, the determining comprises:

3. The method of claim 2, wherein, verifying whether the current difference between the samples extracted from the modulus reduction and a value of the approximating polynomial is less than the predetermined threshold; and in response to the current difference being greater than or equal to the predetermined threshold, increasing the number of samples or the degree of the approximating polynomial based on a comparison between the current difference and a difference determined in a previous step. the determining comprises determining a difference between the samples extracted from the modulus reduction and a value of the approximating polynomial based on an L2 norm between the samples extracted from the modulus reduction and the value of the approximating polynomial.

4. The method of claim 2, wherein, the determining comprises determining an approximating polynomial that includes odd degree terms.

5. The method of claim 1, wherein, the determining comprises determining an approximating polynomial that uses Chebyshev polynomials as a basis.

6. The method of claim 1, wherein, the samples are extracted from piecewise continuous intervals having a symmetric shape around a reference point in a function corresponding to the modulus reduction.

7. The method of claim 1, wherein, the samples are extracted from portions of the piecewise continuous intervals separated by the reference point.

8. The method of claim 7, wherein, the bootstrapping comprises homomorphically evaluating the modulus reduction to bootstrap ciphertexts by using the approximating polynomial.

9. The method of claim 1, wherein, 10. A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to perform the method of claim 1.

11. An apparatus for processing ciphertexts, the apparatus comprising: one or more processors; wherein the one or more processors are configured to: determine, based on samples extracted from a modulus reduction for bootstrapping ciphertexts, an approximating polynomial corresponding to the modulus reduction, and bootstrap ciphertexts based on the approximating polynomial, wherein the one or more processors are configured to: in response to a similarity between a current difference between the samples extracted from the modulus reduction and a value of the approximating polynomial and a difference determined in a previous step being less than a predetermined threshold similarity, increase a number of samples; and in response to the similarity being greater than or equal to the predetermined threshold similarity, increase a degree of the approximating polynomial. the one or more processors are configured to determine coefficients of the approximating polynomial such that the current difference between the samples extracted from the modulus reduction and a value of the approximating polynomial is less than a predetermined threshold.

12. The apparatus of claim 11, wherein, the one or more processors are configured to:

13. The apparatus of claim 12, wherein, verify whether the current difference between the samples extracted from the modulus reduction and a value of the approximating polynomial is less than the predetermined threshold; and in response to the current difference being greater than or equal to the predetermined threshold, increase the number of samples or the degree of the approximating polynomial based on a comparison between the current difference and a difference determined in a previous step. in response to the current difference being greater than or equal to the predetermined threshold, increasing the number of samples or a degree of the approximation polynomial based on a comparison between the current difference and a difference determined in a previous step.

14. The apparatus of claim 12, wherein, a difference between a sample extracted from the modulus reduction and a value of the approximation polynomial is determined based on an L2 norm between the sample and the value of the approximation polynomial.

15. The apparatus of claim 11, wherein, the one or more processors are configured to determine the approximation polynomial to include an odd degree term.

16. The apparatus of claim 11, wherein, the one or more processors are configured to determine the approximation polynomial to use Chebyshev polynomials as a basis.

17. The apparatus of claim 11, wherein, the samples are extracted from a piecewise continuous interval having a symmetric shape about a reference point in a function corresponding to the modulus reduction.

18. The apparatus of claim 17, wherein, the samples are extracted from portions of the piecewise continuous interval separated by the reference point.

19. A method for processing ciphertext, comprising: determining an initial approximation polynomial corresponding to a modulus reduction for bootstrapping ciphertext based on an initial number of samples extracted from the modulus reduction; computing an error between the initial approximation polynomial and a function of the modulus reduction; in response to a similarity between the error and an error computed in a previous step being less than a predetermined threshold similarity, increasing the initial number of samples; in response to the similarity between the error and the error computed in the previous step being greater than or equal to the predetermined threshold similarity, increasing a degree of the initial approximation polynomial; determining an updated approximation polynomial based on the increased initial number of samples or the increased degree of the initial approximation polynomial; and homomorphically evaluating the modulus reduction using the updated approximation polynomial.

20. The method of claim 19, wherein, computing the error includes determining that a difference between the initial number of samples extracted from the modulus reduction and a value of the initial approximation polynomial is greater than or equal to a threshold.

Images