Encryption Method and Apparatus Based on Homomorphic Encryption Using Function Composition

Abstract

An encryption method and apparatus based on composite homomorphic encryption using functions. The encryption method includes: generating ciphertext by encrypting data; and bootstrapping the ciphertext by performing modular reduction based on a composite function with respect to the modulus corresponding to the ciphertext.

Description

[0001] Cross-reference to related applications

[0002] This application claims priority to U.S. Provisional Patent Application No. 63 / 013,706, filed April 22, 2020, and U.S. Provisional Patent Application No. 63 / 021,761, filed May 8, 2020, and to Korean Patent Application No. 10-2020-0139489, filed October 26, 2020, with the Korean Intellectual Property Office, the entire disclosure of which is incorporated herein by reference for all purposes. Technical Field

[0003] The following description relates to encryption methods and apparatus based on composite homomorphic encryption using functions. Background Technology

[0004] Fully homomorphic encryption is an encryption scheme that allows arbitrary logical or mathematical operations to be performed on encrypted data. Fully homomorphic encryption methods maintain security during data processing.

[0005] However, conventional encryption methods struggle to process encrypted data and are therefore insufficient to protect customer privacy.

[0006] Fully homomorphic encryption enables customers to receive a variety of services while protecting their privacy. Summary of the Invention

[0007] This summary is provided to introduce, in a simplified form, the selection of concepts further described in the detailed embodiments below. This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to help determine the scope of the claimed subject matter.

[0008] In one general aspect, an encryption method based on composite homomorphic encryption using functions includes: generating ciphertext by encrypting data; and bootstrapping the ciphertext by performing modular reduction based on composite functions of a modulus corresponding to the ciphertext.

[0009] Bootstrapping can include: bootstrapping the ciphertext by approximating the modulo reduction based on the function and the inverse function of the function.

[0010] Bootstrapping the ciphertext by approximating the modular reduction based on the function and its inverse function may include: obtaining the approximating polynomial of the function; obtaining the approximating polynomial of the inverse function; and generating a composite function that approximates the modular reduction based on a composite function of the approximating polynomials of the function and the inverse function.

[0011] The function may include trigonometric functions.

[0012] Obtaining the approximation polynomial of the function may include: in response to the function being a trigonometric function, obtaining the double-angle function of the trigonometric function by applying the double-angle formula to the trigonometric function.

[0013] Obtaining the approximation polynomial of the function may include: determining one or more reference points based on the degree of the approximation polynomial of the function; obtaining an arbitrary polynomial based on the one or more reference points; and generating the approximation polynomial of the function based on one or more extreme points selected according to the arbitrary polynomial.

[0014] Obtaining the arbitrary polynomial may include: obtaining a piecewise continuous function passing through the one or more reference points; and obtaining the arbitrary polynomial by generating a polynomial such that the absolute value of the error between the polynomial and the piecewise continuous function at the one or more reference points is a predetermined value.

[0015] Obtaining the arbitrary polynomial by generating a polynomial may include: obtaining the arbitrary polynomial by generating a polynomial such that: a first error at a first reference point included in the one or more reference points has a different sign than a second error at a second reference point adjacent to the first reference point, and the absolute values ​​of the first error and the second error are the predetermined values.

[0016] Generating an approximation polynomial for the function based on one or more extreme points selected according to the arbitrary polynomial may include: obtaining candidate points whose absolute values ​​are greater than or equal to a predetermined value from among the extreme points of the error between the arbitrary polynomial and a piecewise continuous function passing through the one or more reference points; selecting target points from among the candidate points, wherein the number of target points is based on the degree of the approximation polynomial of the function; and generating an approximation polynomial for the function based on the target points.

[0017] In another general aspect, an encryption device based on composite homomorphic encryption using functions includes: a processor configured to: generate ciphertext by encrypting data, and bootstrap the ciphertext by performing modular reduction based on composite functions of a modulus corresponding to the ciphertext; and a memory configured to store instructions to be executed by the processor.

[0018] The processor can be configured to bootstrap the ciphertext by approximating the modular reduction based on the function and the inverse function of the function.

[0019] The processor can be configured to: obtain an approximation polynomial of the function; obtain an approximation polynomial of the inverse function; and generate a composite function that approximates the modulus reduction based on a composite function of the approximation polynomials of the function and the inverse function.

[0020] The function may include trigonometric functions.

[0021] The processor can be configured to: in response to the function being a trigonometric function, obtain a double-angle function of the trigonometric function by applying a double-angle formula to the trigonometric function.

[0022] The processor can be configured to: determine one or more reference points based on the degree of the approximation polynomial of the function; obtain an arbitrary polynomial based on the one or more reference points; and generate an approximation polynomial of the function based on one or more extreme points selected according to the arbitrary polynomial.

[0023] The processor can be configured to: obtain a piecewise continuous function passing through the one or more reference points; and obtain the arbitrary polynomial by generating a polynomial such that the absolute value of the error between the polynomial and the piecewise continuous function at the one or more reference points is a predetermined value.

[0024] The processor can be configured to obtain the arbitrary polynomial by generating a polynomial, wherein the generated polynomial is such that a first error at a first reference point included in the one or more reference points has a different sign than a second error at a second reference point adjacent to the first reference point, and the absolute values ​​of the first error and the second error are the predetermined values.

[0025] The processor can be configured to: obtain candidate points whose absolute values ​​are greater than or equal to predetermined values ​​from the extreme points of the error between the arbitrary polynomial and a piecewise continuous function passing through the one or more reference points; select target points from the candidate points, wherein the number of target points is based on the degree of the approximation polynomial of the function; and generate an approximation polynomial of the function based on the target points.

[0026] Other features and aspects will become clear from the following detailed description, drawings and claims. Attached Figure Description

[0027] Figure 1 An example of an encryption device is shown.

[0028] Figure 2 It shows the way Figure 1 An example of how an encryption device obtains an approximation function.

[0029] Figure 3 It shows the method for passing through Figure 1 Examples of algorithms for obtaining approximate polynomials of functions and their inverse functions from cryptographic devices.

[0030] Figure 4 It shows the method for passing through Figure 1 Examples of algorithms for obtaining approximate polynomials of functions and their inverse functions from cryptographic devices.

[0031] Figure 5 It shows Figure 1 An example of the operation of an encryption device.

[0032] Throughout the accompanying drawings and detailed embodiments, unless otherwise described or provided, the same reference numerals will be understood to refer to the same elements, features, and structures. The drawings may not be drawn to scale, and for clarity, illustration, and convenience, the relative dimensions, scale, and depiction of elements in the drawings may be enlarged. Detailed Implementation

[0033] The examples will be described in detail below with reference to the accompanying drawings. However, various changes and modifications can be made to the examples. These examples are not intended to limit the scope of this disclosure. The examples should be understood to include all changes, equivalents, and substitutions within the concept and technical scope of this disclosure.

[0034] The terminology used herein is for the purpose of describing specific examples only and is not intended to limit the examples. The singular forms “a,” “an,” and “described” are intended to also include the plural forms unless the context explicitly indicates otherwise. It will also be understood that the terms “comprising” and / or “including” as used herein mean the presence of the stated features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or combinations thereof.

[0035] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which the examples pertain. It should also be understood that terms such as those defined in common dictionaries shall be interpreted as having a meaning consistent with their meaning in the context of the relevant art, and not as having an ideal or overly formal meaning, unless expressly defined herein.

[0036] When describing the examples with reference to the accompanying drawings, the same reference numerals denote the same constituent elements, and redundant descriptions associated with them will be omitted. In the description of the examples, descriptions of well-known related structures or functions will be omitted where such detailed descriptions would likely obscure the interpretation of this disclosure.

[0037] Furthermore, when describing the components of this disclosure, terms such as first, second, A, B, (a), and (b) may be used herein to describe the components. These terms are used only for the purpose of distinguishing one component from another, and the nature, order, or sequence of the components are not limited by the terms. When a component is described as being “connected,” “coupled,” or “attached” to another component, it should be understood that the one component may be directly connected to or attached to the other component, and intermediate components may also be “connected,” “coupled,” or “attached” to these components.

[0038] The same names can be used to describe the components included in the examples above and components that share a common function. Unless otherwise stated, the descriptions of each example are applicable to the following examples, therefore, repeated descriptions will be omitted for brevity.

[0039] Figure 1 An example of an encryption device is shown.

[0040] refer to Figure 1 The encryption device 10 can encrypt data. The encryption device 10 can generate encrypted data by encrypting data. In the following text, the encrypted data may be referred to as ciphertext.

[0041] Encryption device 10 can perform encryption and decryption using homomorphic encryption. Encryption device 10 can provide encryption techniques for operating on data encrypted using homomorphic encryption without decryption. For example, encryption device 10 can decrypt the result obtained by operating on data encrypted using homomorphic encryption, thereby obtaining the same result as operating on plaintext data. Encryption device 10 can provide homomorphic encryption operations for real or complex numbers.

[0042] The encryption device 10 can perform the bootstrapping required for homomorphic encryption. The encryption device 10 can generate an approximation polynomial that approximates the function corresponding to the modulo reduction required for homomorphic encryption.

[0043] The encryption device 10 can find the minimum-maximum approximation error for each degree of the optimal minimum-maximum approximation polynomial.

[0044] The encryption device 10 can find the approximation polynomial that best approximates the modular reduction operation, thereby providing excellent performance in terms of minimax approximation error in homomorphic encryption.

[0045] The encryption device 10 can generate an approximating polynomial for the approximating modulo-reducing function based on approximation region information. The encryption device 10 can perform modulo-reducing based on the composition of functions. The encryption device 10 can perform bootstrapping by performing modulo-reducing based on the composition of functions.

[0046] The encryption device 10 includes a processor 100 and a memory 200.

[0047] Processor 100 can process data stored in memory. Processor 100 can execute computer-readable code (e.g., software) stored in memory 200 and instructions triggered by processor 100.

[0048] The processor 100 can be a data processing device implemented in hardware, which includes circuitry having a physical structure for performing desired operations. For example, the desired operations may include instructions or code included in a program.

[0049] For example, hardware-implemented data processing devices may include microprocessors, central processing units (CPUs), processor cores, multi-core processors, multiprocessors, application-specific integrated circuits (ASICs), and field-programmable gate arrays (FPGAs).

[0050] The processor 100 can generate ciphertext by encrypting data. The data can be information in the form of characters, numbers, sound, or images that can be processed by a computer.

[0051] The processor 100 can bootstrap the ciphertext by performing a composite modulo reduction based on a function that performs a modulo operation corresponding to the generated ciphertext.

[0052] Processor 100 can perform bootstrapping by approximating modular reduction based on functions and their inverses. Processor 100 can obtain the approximating polynomial of the function. Processor 100 can obtain the approximating polynomial of the inverse function.

[0053] Processor 100 can determine one or more reference points based on the degree of the approximation polynomial. Processor 100 can obtain an arbitrary polynomial based on one or more reference points. Processor 100 can obtain a piecewise continuous function passing through one or more reference points. Processor 100 can obtain an arbitrary polynomial by generating a polynomial such that the absolute value of the error between the polynomial and the piecewise continuous function at one or more reference points is a predetermined value.

[0054] The processor 100 can obtain an arbitrary polynomial by generating a polynomial such that the error at a first reference point included in one or more reference points has a different sign than the error at a second reference point adjacent to the first reference point, and the absolute value of these errors is a predetermined value.

[0055] Processor 100 can generate an approximation polynomial based on one or more extreme points selected according to an arbitrary polynomial. Processor 100 can obtain candidate points whose absolute values ​​are greater than or equal to predetermined values ​​from the extreme points of the error between the arbitrary polynomial and a piecewise continuous function passing through one or more reference points.

[0056] The processor 100 can select target points from candidate points, wherein the number of target points is based on the degree of the approximation polynomial. The processor 100 can generate an approximation polynomial based on the target points.

[0057] Processor 100 can obtain an approximating polynomial of at least one of a function and its inverse function, and perform modular reduction by performing composition of the function based on the obtained approximating polynomial. (See reference...) Figure 3 and Figure 4 Describe in detail the process of obtaining the approximate polynomials of the function and its inverse function.

[0058] Processor 100 can generate a composite function with modulo reduction based on a composite function of the approximation polynomials of the function and the inverse function. In this case, the function may include trigonometric functions. For example, trigonometric functions may include at least one of sine and cosine functions.

[0059] Since the function is a trigonometric function, the processor 100 can obtain the double-angle function of the trigonometric function by applying the double-angle formula to the trigonometric function.

[0060] The memory 200 may store instructions (or programs) that can be executed by the processor. For example, the instructions may include instructions for performing operations of the processor and / or operations of each element of the processor.

[0061] The memory 200 can be implemented as a volatile memory device or a non-volatile memory device.

[0062] Volatile memory devices can be implemented as dynamic random access memory (DRAM), static random access memory (SRAM), thyristor RAM (T-RAM), zero-capacitor RAM (Z-RAM), or dual-transistor RAM (TTRAM).

[0063] Non-volatile memory devices can be implemented as electrically erasable programmable read-only memory (EEPROM), flash memory, magnetic RAM (MRAM), spin-transfer torque (STT)-MRAM, conductive bridged RAM (CBRAM), ferroelectric RAM (FeRAM), phase change RAM (PRAM), resistive RAM (RRAM), nanotube RRAM, polymer RAM (PoRAM), nanofloating gate memory (NFGM), holographic memory, molecular electronic memory devices, or insulator resistance-changing memory.

[0064] Figure 2 It shows the way Figure 1 An example of how an encryption device obtains an approximation function.

[0065] refer to Figure 2 Processor 100 can perform bootstrapping by approximating a modular reduction function. In operation 210, processor 100 can detect ciphertext that requires modular arithmetic (e.g., a modular reduction function) during the bootstrapping process. For example, processor 100 can detect ciphertext that cannot be further operated on because its modulus is less than or equal to a threshold point.

[0066] Processor 100 can approximate a modulo-decreasing function to perform bootstrapping. Processor 100 can obtain an approximate polynomial for any function and an approximate polynomial for its inverse function. For example, any function can include trigonometric functions.

[0067] Figure 2 The example illustrates the case where any function is a sine function. However, even if any function is a cosine function, it can be approximated as a modulo-decreasing function in the same way.

[0068] Processor 100 can generate a composite function that approximates a modulo-decreasing function based on a composite function of the approximate polynomials of the function and the inverse function. Processor 100 can approximate a modulo-decreasing function by composing polynomials of relatively low degree.

[0069] For example, in operation 230, processor 100 can obtain an approximate polynomial f(t) for sin(t). In operation 250, processor 100 can obtain an approximate polynomial g(t) for arcsin(t). (Refer to...) Figures 3 to 4 Describe in detail the process of obtaining the approximate polynomial.

[0070] In operation 270, processor 100 can obtain gf(t) by composing the obtained g(t) and f(t). In operation 290, processor 100 can approximate the modular function (e.g., a modular reduction function) based on the composition function.

[0071] The processor 100 can approximate the modular function using a composite function of trigonometric and inverse trigonometric functions, thereby reducing the error compared to using only trigonometric functions to approximate the modular function.

[0072] Processor 100 performs modular reduction functions based on a combination of approximation polynomials of the function and its inverse, thereby reducing the fundamental error caused by approximation using only trigonometric functions. Processor 100 can reduce the number of nonscalar multiplications by applying double-angle formulas for trigonometric functions. Through the composition of functions and their inverses, processor 100 can reduce the number of operations used for approximating the function.

[0073] If function f is a sine function and function g is an arcsine function, then these two functions can be defined according to Formula 1 and Formula 2.

[0074] [Formula 1]

[0075]

[0076] [Formula 2]

[0077] g: [-sin2π∈]→[-2π∈, 2π∈], g(x)=arcsinx

[0078] Here, ∈ can be Within the range.

[0079] The composite function of the functions in Equations 1 and 2 can be represented by Equation 3.

[0080] [Formula 3]

[0081]

[0082] Here, it should be... When making a substitution, this composite function can be represented by Equation 4.

[0083] [Formula 4]

[0084]

[0085] Here, normod(t) denotes the normalized modulo reduction function. Referring to Equations 1 to 4, the processor 100 can approximate functions f and g using approximation polynomials and compose these functions, thereby reducing the error in the modulo reduction function.

[0086] Even for relatively small ∈, processor 100 can approximate g(x) using a linear polynomial. For example, processor 100 can approximate g(x) using x as an identity function.

[0087] Furthermore, the cosine function is a translation of the sine function. Therefore, the processor 100 can also perform the same function composition on the cosine function.

[0088] If any function is an odd function, then its approximating polynomial can also be an odd function. That is, if the inverse function is an arcsine function, then the approximating polynomial of the arcsine function can be an odd function.

[0089] Therefore, since the approximation polynomial of the arcsine function in a polynomial of degree less than or equal to 2 is a linear polynomial, the error function between the approximation polynomial and the arcsine function can have four global extrema that satisfy the Chebyshev transform theorem.

[0090] Processor 100 can obtain the minimum-maximum approximation polynomial c of the arcsine function in the interval [-sin ∈, sin ∈]. min As shown in Formula 5.

[0091] [Formula 5]

[0092]

[0093] Furthermore, the relationship in Formula 6 can be satisfied.

[0094] [Formula 6]

[0095]

[0096] In this example, the domain of all functions can be [-sin∈, sin∈].

[0097] If f(x) = sinx and Then the normalized modulus reduction function in Formula 4 can be evaluated, as shown in Formula 7.

[0098] [Formula 7]

[0099]

[0100] Here, the minimal-maximum linear polynomial of g(x) can be This is exactly the initial approximation formula multiplied by a constant. Therefore, the processor 100 can reduce the basic limit of the approximation error for cosine approximation by 1 / 4.

[0101] By doing so, processor 100 can obtain an additional 2-bit precision simply by adjusting the multiplication factor.

[0102] Formulas 5 to 7 describe the case where the degree of the approximation polynomial of the inverse function is 1, and the processor 100 can approximate the degree of the approximation polynomial of the inverse function to 2 or higher, thereby further reducing the minimax error.

[0103] Processor 100 can perform approximation by increasing the degree of the approximation polynomial to 3, as shown in Equation 8.

[0104] [Formula 8]

[0105] g(x)≈c1x+c3x 3 =g1(x)

[0106] Here, we will refer to Figure 3 The process of obtaining the coefficients c1 and c3 of the polynomial is described. By applying Equation 8 to Equation 4, the normalized modulus reduction function as shown in Equation 9 can be obtained.

[0107] [Formula 9]

[0108]

[0109] To approximate the modulo-decreasing function, processor 100 can use a minimax approximation polynomial to approximate the sine or cosine function, and then approximate g1(x) of formula 8. Processor 100 can apply double-angle formulas for approximating the sine or cosine function.

[0110] After approximating the sine or cosine function, applying the double-angle formula requires two additional nonscalar multiplications and two additional depths. Using the double-angle formula, the minimum-maximum approximation error for the normalized modulo-decreasing function can have a value between δ0 and δ1, where δ0 is the approximation flat error when the degree of the approximation polynomial of the inverse function is 1, and δ1 is the minimum-maximum approximation error when using Equation 8 to approximate the modulo-decreasing function.

[0111] If g n Let g(x) denote the optimal minimal-maximum approximation polynomial of degree 2n+1 for g(x), then g n (x) can have only terms of odd degree. In the following text, δ n It can be g n The minimum maximum approximation error of (x).

[0112] In order to obtain δ n and δ n+1 Given the minimum-maximum approximation error between them, the processor 100 can obtain the normalized modulus reduction function expressed by Equation 10.

[0113] [Formula 10]

[0114]

[0115] Here, δ n It can approach zero as n increases. The processor 100 can reduce the approximation error by composing the approximation functions of trigonometric functions and inverse trigonometric functions.

[0116] In the following text, reference will be made to Figure 3 and Figure 4 Describe in detail the process of obtaining the approximate polynomials of the function and its inverse function.

[0117] Figure 3 It shows the method for passing through Figure 1 Examples of algorithms for obtaining approximate polynomials of functions and their inverse functions from cryptographic devices.

[0118] refer to Figure 3 The processor 100 can obtain the approximate polynomial of a function and / or the approximate polynomial of its inverse function. The processor 100 can obtain the approximate polynomial of the function by using... Figure 3 Algorithm 1 obtains the approximate polynomial of the function and / or the approximate polynomial of the inverse function.

[0119] Processor 100 can obtain approximate polynomials for at least one of a function and its inverse function. The approximate polynomial of a function and the approximate polynomial of its inverse function can be obtained through the same process.

[0120] Processor 100 can be used Figure 3 Algorithm 1 finds a minimax approximation polynomial for any continuous function on the interval [a, b] to generate the approximation polynomial. Processor 100 can use the Chebyshev transform theorem to generate the approximation polynomial that satisfies the oscillation condition.

[0121] Processor 100 can generate basis functions {g1, ..., g...} n The approximation polynomials satisfying the Haar conditions. To generate approximation polynomials of degree d, processor 100 can use the power basis {1, x, ..., x...}. d Choose basis functions {g1, ..., g} n Here, n = d + 1.

[0122] Processor 100 can determine one or more reference points based on the degree d of the approximation polynomial to be obtained. Processor 100 can initialize a set of reference points that converge to the extrema of the minimax approximation polynomial. Processor 100 can obtain the minimax approximation polynomial with respect to the set of reference points. Since the set of reference points is a finite set of many points in [a, b], it can be a closed subset of [a, b]. Therefore, the Chebyshev transformation theorem can be satisfied for the set of reference points.

[0123] Processor 100 can obtain an arbitrary polynomial based on one or more reference points. Processor 100 can obtain a piecewise continuous function passing through one or more reference points. Processor 100 can obtain an arbitrary polynomial by generating a polynomial such that the absolute value of the error between the polynomial and the piecewise continuous function at one or more reference points is a predetermined value.

[0124] The processor 100 can obtain an arbitrary polynomial by generating a polynomial such that the error at a first reference point included in one or more reference points has a different sign than the error at a second reference point adjacent to the first reference point, and the absolute value of these errors is a predetermined value.

[0125] f(x) can be a piecewise continuous function passing through one or more reference points. When f(x) is a continuous function on [a, b], the minimum-maximum approximation polynomial on the set of reference points can be a polynomial with a basis {g1, ..., g2} that satisfies the condition of E in Formula 11 for some E. n The generalized polynomial p(x) of}. The value of E can be the predetermined value mentioned above.

[0126] [Formula 11]

[0127] p(x i )-f(x i )=(-1) i E i = 1, ..., d+2

[0128] Processor 100 can obtain any polynomial p(x) using Equation 11. According to Equation 11, a system of linear equations with n+1 equations, n coefficients of p(x), and n+1 variables of E, and the linear equations being nonsingular according to the Haar condition, can be used by processor 100 to obtain a polynomial p(x) that satisfies the conditions of Equation 11.

[0129] Processor 100 can generate an approximation polynomial based on one or more extreme points selected according to an arbitrary polynomial. Specifically, processor 100 can obtain candidate points whose absolute values ​​are greater than or equal to predetermined values ​​from the extreme points of the error between the arbitrary polynomial and a piecewise continuous function passing through one or more reference points. Processor 100 can select target points from the candidate points, wherein the number of target points is based on the degree of the approximation polynomial. Processor 100 can generate an approximation polynomial based on the selected target points.

[0130] Processor 100 can obtain in x i With x i+1 The n zeros z of p(x)-f(x) between i The condition is that z0 = a, z n+1 =b and i = 1, 2, ..., n, and can be obtained in each [z i-1 , z i The n+1 extreme points y1, ..., y of p(x)-f(x) in the equation. n+1 .

[0131] If p(x) i )-f(x i If ) < 0, processor 100 can be selected in [z i-1 , z i The minimum point of p(x)-f(x) in ]; and if p(x i )-f(x i If ) > 0, you can choose to [z] i-1 , z i [The maximum point of p(x)-f(x) in the graph].

[0132] Through this operation, the processor 100 can select new extreme points y1, ..., y2. n+1 The set of points is used as candidate points. If these candidate points satisfy the iso-oscillatory condition, the processor 100 can return the minimax approximation polynomial, the approximation polynomial of the generating function or its inverse function by applying the Chebyshev transform theorem.

[0133] Furthermore, the processor 100 can utilize the new extreme points y1, ..., y1 obtained through the above process. n+1 The set of reference points is replaced by the set of reference points, and the above polynomial generation process is performed iteratively.

[0134] Figure 3 Algorithm 1 shown can be extended to multiple subintervals of an interval. When applying Algorithm 1 extended to multiple subintervals, the following can be modified: Figure 3 Steps 3 and 4.

[0135] For each iteration, the processor 100 can obtain all local extrema of the error function pf, and its absolute error value can be greater than the absolute error value at the current reference point.

[0136] Then, processor 100 can select n+1 new extreme points from all the obtained local extreme points that satisfy the following two criteria:

[0137] 1. The sign of the error value changes alternately; and

[0138] 2. The new set of extreme points includes global extreme points.

[0139] The two criteria mentioned above can guarantee convergence to a minimal maxima generalized polynomial.

[0140] Figure 4 It shows the method for passing through Figure 1 Examples of algorithms for obtaining approximate polynomials of functions and their inverse functions from cryptographic devices.

[0141] refer to Figure 4 The processor 100 can obtain the approximate polynomial of the function and / or the approximate polynomial of the inverse function by using Algorithm 2.

[0142] The function to be obtained by processor 100 through approximation can be a normalized modulo reduction function defined only in a nearly finite number of integers, as shown in Equation 12.

[0143] [Formula 12]

[0144]

[0145] Formula 12 can represent the modulo reduction function that scales both the domain and the range of the modulo reduction.

[0146] Processor 100 can use the cosine function to approximate normod(x) to use the double-angle formula for efficient homomorphic assignment.

[0147] If the double-angle formula is used l times, then the cosine function in Formula 13 needs to be approximated.

[0148] [Formula 13]

[0149]

[0150] In order to approximate piecewise continuous functions, including those in Equations 12 and 13, processor 100 may assume a general piecewise continuous function defined on the union of a finite number of closed intervals, which is given as Equation 14.

[0151] [Formula 14]

[0152]

[0153] Here, a i <b i <a i+1 <b i+1 This holds true for all i = 1, ..., t-1.

[0154] In order to approximate a given piecewise continuous function on D in Equation 14 using a polynomial of degree less than or equal to d, the processor 100 may set a criterion for selecting new d+2 reference points from a plurality of extrema.

[0155] Processor 100 can use {g1, ..., g} which satisfy the Haar condition on [a, b]. n The reference points are used as a basis to generate approximate polynomials. The processor 100 can obtain a minimax approximate polynomial for each iteration with respect to the set of reference points, and select a new set of reference points for the next iteration.

[0156] There can be many cases in which the processor 100 selects n+1 points from the extrema of the error function obtained using an arbitrary polynomial derived from the set of reference points. The processor 100 can consider many intervals during the encryption process, so there may be many candidate extrema.

[0157] Processor 100 can select n+1 target points from a large number of candidate points for each iteration to minimize the number of iterations. In doing so, processor 100 can generate a minimax approximation polynomial by converging the approximation polynomial generated for each iteration. In this example, the final generated minimax approximation polynomial can be the approximation polynomial of the function described above and / or the approximation polynomial of the inverse function of that function.

[0158] To set the criteria for selecting n+1 target points, processor 100 can define a function according to formula 15.

[0159] [Formula 15]

[0160]

[0161] Here, p(x) denotes any polynomial obtained in each iteration, and J(x) denotes the piecewise continuous function to be approximated. For convenience, μ p，f It may be referred to as μ in the following text.

[0162] Processor 100 can form a set B of all the extreme points of p(x)-f(x). B can be a finite set and is represented as B = {x1, x2, ..., x}. m Processor 100 can select a point within an interval of B.

[0163] Assume B is sorted in ascending order, x1 < x2 < ... < x m If μ = 1, then the value of μ can be 1 or -1. The number of extreme points can satisfy m ≥ n + 1.

[0164] Processor 100 can define a set of functions. As shown in Formula 16.

[0165] [Formula 16]

[0166]

[0167] In this example, if n+1 = m, then the set It may include only the identity function.

[0168] The processor 100 can be configured with three criteria for selecting n+1 extreme points.

[0169] Processor 100 can set the local extremum condition as the first condition. If E is the absolute error at the set of reference points, then the condition of Equation 17 can be set.

[0170] [Formula 17]

[0171]

[0172] In order to satisfy the local extremum condition, if the local maximum value of p(x)-f(x) is negative or the local minimum value of p(x)-f(x) is positive, then the processor 100 can remove the extremum points.

[0173] Secondly, the processor 100 can set alternating conditions. In other words, the conditions of Formula 18 can be set. Specifically, if one of two adjacent extreme points has a local maximum, then the other extreme point may have a local minimum.

[0174] [Formula 18]

[0175] μ(x σ(i) )·μ(x σ(i+1) -1 for i = 1, ..., n

[0176] Third, the processor 100 can set a maximum absolute sum condition. The processor 100 can select the σ that maximizes the value of formula 19 from among the σ that satisfy the local extremum condition and the alternation condition.

[0177] [Formula 19]

[0178]

[0179] At the current reference point x1, ..., xn+1 The absolute error value at the point can be smaller than the minimum-maximum approximation error, and as the number of iterations increases, it converges to the minimum-maximum approximation error.

[0180] Furthermore, the absolute error value at the current reference point can be the approximation polynomial in the previous iteration at x1, ..., x n+1 The weighted average of the absolute error values ​​at each point.

[0181] Processor 100 can use the maximum absolute sum condition to help the absolute error value at the current reference point converge quickly to the minimum maximum approximation error.

[0182] Local extremum conditions and alternation conditions can be applied to Figure 3 The algorithm and Figure 4 Both algorithms (Algorithm 1 and Algorithm 2) can be used, and the condition for maximum absolute sum can be applied. Figure 4 Algorithm 2. Processor 100 can apply the maximum absolute sum condition, thereby promoting convergence to the minimax approximation polynomial.

[0183] gather It always contains at least one element σ0 that satisfies the local extremum condition and the alternation condition, and can have an element σ0 that satisfies the following condition for some i0: σ0(i0).

[0184] Processor 100 can execute more efficiently. Figure 4 Steps 2, 3, and 4 of Algorithm 2 are described below. Processor 100 can find the coefficients of the approximating polynomial at the current reference point for a continuous function f(x) using a power basis.

[0185] That is, processor 100 can obtain the coefficient c in formula 20. j The value of is used to generate an approximate polynomial.

[0186] [Formula 20]

[0187]

[0188] Here, E may be unknown in the linear equation. As the degree of the basis of the approximating polynomial increases, the coefficients decrease. Processor 100 may need to set higher precision for the coefficients of higher-degree bases.

[0189] Therefore, processor 100 can effectively solve the accuracy problem by using the basis of Chebyshev polynomials as the basis of approximating polynomials. Since the coefficients of polynomials using Chebyshev bases usually have almost the same order of magnitude, processor 110 can use Chebyshev bases instead of power bases to generate approximating polynomials.

[0190] The Chebyshev polynomial satisfies the Haar condition described above, and the processor 100 can compute c by solving the system of d+2 linear equations of Equation 21 using d+2 reference points. j And E, to obtain the approximate polynomial.

[0191] [Formula 21]

[0192]

[0193] Figure 5 It shows Figure 1 An example of the operation of an encryption device.

[0194] refer to Figure 5 In operation 510, processor 100 can generate ciphertext by encrypting data. In operation 530, processor 100 can bootstrap the ciphertext by performing a composite modulo reduction based on a function relating the modulus to the ciphertext. In this case, the function may include a trigonometric function.

[0195] Processor 100 can perform bootstrapping by approximating modular reduction based on a function and its inverse function. Processor 100 can obtain the approximating polynomial of the function and the approximating polynomial of the inverse function.

[0196] The processor 100 can determine one or more reference points based on the degree of the approximating polynomial, and obtain any polynomial based on one or more reference points.

[0197] Processor 100 can obtain a piecewise continuous function passing through one or more reference points; and obtain an arbitrary polynomial by generating a polynomial such that the absolute value of the error between the polynomial and the piecewise continuous function at one or more reference points is a predetermined value.

[0198] The processor 100 can obtain an arbitrary polynomial by generating a polynomial such that the error at a first reference point included in one or more reference points has a different sign than the error at a second reference point adjacent to the first reference point, and the absolute value of these errors is a predetermined value.

[0199] Processor 100 can generate an approximation polynomial based on one or more extreme points selected according to an arbitrary polynomial. Processor 100 can perform the following operations: obtaining candidate points whose absolute values ​​are greater than or equal to predetermined values ​​from the extreme points of the error between the arbitrary polynomial and a piecewise continuous function passing through one or more reference points; and selecting target points from the candidate points, wherein the number of target points is based on the degree of the approximation polynomial.

[0200] The processor 100 can generate an approximation polynomial of a function or its inverse function based on a selected target point.

[0201] Processor 100 can generate a composite function with approximate modulo reduction based on a composite function of the approximate polynomials of the function and the inverse function. In this example, since the function is a trigonometric function, processor 100 can obtain a double-angle function of the trigonometric function by applying the double-angle formula to the trigonometric function.

[0202] The methods described in the examples above can be recorded in a non-transitory computer-readable medium comprising program instructions for implementing the various operations described in the examples. The medium may also include data files, data structures, etc., alone or in combination with the program instructions. The program instructions recorded on the medium may be program instructions specifically designed and constructed for the purposes of the examples, or program instructions may be of a type well-known and available to those skilled in the art of computer software. Examples of non-transitory computer-readable media include: magnetic media, such as hard disks, floppy disks, and magnetic tapes; optical media, such as CD-ROMs, DVDs, and / or Blu-ray discs; magneto-optical media, such as optical floppy disks; and hardware devices specifically configured to store and execute program instructions, such as read-only memory (ROM), random access memory (RAM), flash memory (e.g., USB flash drives, memory cards, memory sticks, etc.). Examples of program instructions include both machine code (e.g., machine code generated by a compiler) and files containing higher-level code that can be executed by a computer using an interpreter. The aforementioned devices may be configured as one or more software modules to perform the operations described in the examples above, and vice versa.

[0203] Software can include computer programs, code segments, instructions, or some combination thereof, to independently or consistently instruct or configure a processing device to operate as needed. Software and data can be permanently or temporarily embodied in any type of machine, component, physical or virtual device, computer storage medium, or device; or in signal waves capable of providing propagation of instructions or data to or interpreted by the processing device. Software can also be distributed across network-coupled computer systems, thereby storing and executing software in a distributed manner. Software and data can be stored on one or more non-transitory computer-readable recording media.

[0204] Several examples have been described above. However, it should be understood that various modifications can be made to these examples. For example, suitable results may be achieved if the described techniques are performed in a different order and / or if the components in the described system, architecture, device, or circuit are combined in a different manner and / or replaced or supplemented by other components or their equivalents.

[0205] Therefore, other embodiments are within the scope of the appended claims.

Claims

1. A homomorphic encryption-based encryption method, the encryption method comprising: generating ciphertext by encrypting data; and bootstrapping the ciphertext by performing a modular reduction, wherein bootstrapping is performed by approximating the modular reduction based on a trigonometric function and an inverse function of the trigonometric function for a modulus corresponding to the ciphertext.

2. The encryption method of claim 1, wherein bootstrapping the ciphertext by approximating the modular reduction based on the trigonometric function and the inverse function of the trigonometric function comprises: obtaining an approximating polynomial of the trigonometric function; obtaining an approximating polynomial of the inverse function of the trigonometric function; and generating a composite function approximating the modular reduction based on a composite function of the approximating polynomial of the trigonometric function and the approximating polynomial of the inverse function of the trigonometric function.

3. The encryption method of claim 2, wherein obtaining an approximating polynomial of the trigonometric function comprises: obtaining a double-angle function of the trigonometric function by applying a double-angle formula to the trigonometric function.

4. The encryption method of claim 2, wherein obtaining an approximating polynomial of the trigonometric function comprises: determining one or more reference points based on a degree of the approximating polynomial of the trigonometric function; obtaining an arbitrary polynomial based on the one or more reference points; and generating the approximating polynomial of the trigonometric function based on one or more extreme points selected from the arbitrary polynomial.

5. The encryption method of claim 4, wherein obtaining the arbitrary polynomial comprises: obtaining a piecewise continuous function passing through the one or more reference points; and obtaining the arbitrary polynomial by generating a polynomial such that an absolute value of an error between the polynomial and the piecewise continuous function at the one or more reference points is a predetermined value.

6. The encryption method of claim 5, wherein obtaining the arbitrary polynomial by generating a polynomial comprises: obtaining the arbitrary polynomial by generating a polynomial such that a first error at a first reference point included in the one or more reference points and a second error at a second reference point adjacent to the first reference point have different signs and an absolute value of the first error and an absolute value of the second error are the predetermined value.

7. The encryption method of claim 4, wherein generating the approximating polynomial of the trigonometric function based on one or more extreme points selected from the arbitrary polynomial comprises: obtaining candidate points having an absolute value greater than or equal to a predetermined value from among extreme points of an error between the arbitrary polynomial and a piecewise continuous function passing through the one or more reference points; selecting target points from among the candidate points, wherein a number of the target points is based on a degree of the approximating polynomial of the trigonometric function; and generating the approximating polynomial of the trigonometric function based on the target points.

8. A non-transitory computer-readable storage medium storing instructions which, when executed by a processor, cause the processor to perform the encryption method according to any one of claims 1 to 7. ​ ​ ​ ​ 9. An encryption device based on homomorphic encryption, the encryption device comprising: a processor configured to: generate ciphertext by encrypting data; and bootstrap the ciphertext by performing a modular reduction, wherein the processor is further configured to bootstrap by approximating the modular reduction based on a trigonometric function and an inverse of the trigonometric function for a modulus corresponding to the ciphertext; and a memory configured to store instructions to be executed by the processor.

10. The encryption apparatus of claim 9, wherein, the processor is configured to: obtain an approximating polynomial of the trigonometric function; obtain an approximating polynomial of the inverse of the trigonometric function; and generate a composite function approximating the modular reduction based on a composite function of the approximating polynomial of the trigonometric function and the approximating polynomial of the inverse of the trigonometric function.

11. The encryption device of claim 10, wherein the processor is configured to obtain a double-angle function of the trigonometric function by applying a double-angle formula to the trigonometric function.

12. The encryption apparatus of claim 10, wherein, the processor is configured to: determine one or more reference points based on a degree of the approximating polynomial of the trigonometric function; obtain an arbitrary polynomial based on the one or more reference points; and generate the approximating polynomial of the trigonometric function based on one or more extreme points selected from the arbitrary polynomial. the processor is configured to:

13. The cryptographic device of claim 12, wherein, obtain a piecewise continuous function passing through the one or more reference points; and obtain the arbitrary polynomial by generating a polynomial such that an absolute value of an error between the polynomial and the piecewise continuous function at the one or more reference points is a predetermined value.

14. The encryption device of claim 13, wherein the processor is configured to: obtain the arbitrary polynomial by generating a polynomial such that a first error at a first reference point included in the one or more reference points and a second error at a second reference point adjacent to the first reference point have different signs and an absolute value of the first error and an absolute value of the second error are the predetermined value. the processor is configured to:

15. The cryptographic device of claim 12, wherein, obtain candidate points having an absolute value greater than or equal to a predetermined value from among extreme points of an error between the arbitrary polynomial and a piecewise continuous function passing through the one or more reference points; select target points from among the candidate points, wherein a number of the target points is based on a degree of the approximating polynomial of the trigonometric function; and generate the approximating polynomial of the trigonometric function based on the target points. ​

Images