Homomorphic encryption apparatus and ciphertext arithmetic method thereof

Abstract

A homomorphic encryption apparatus and a ciphertext arithmetic method thereof are disclosed. The homomorphic encryption apparatus includes a re-encryption parameter generation circuit, a re-encryption circuit, and an arithmetic circuit. The re-encryption parameter generation circuit is configured to generate re-encryption parameters including a plurality of re-encryption levels for a plurality of ciphertexts, respectively, based on an arithmetic scenario including information on an arithmetic schedule between the plurality of ciphertexts. The re-encryption circuit is configured to generate a plurality of re-encrypted ciphertexts by re-encrypting each of the plurality of ciphertexts to a corresponding re-encryption level based on the re-encryption parameters. The arithmetic circuit is configured to output an arithmetic result by performing an operation using the plurality of re-encrypted ciphertexts according to the arithmetic scenario.

Description

[0001] This application claims the benefit of priority to Korean Patent Application No. 10-2020-0065187, filed on May 29, 2020, with the Korean Intellectual Property Office, the entire disclosure of which is incorporated herein by reference. Technical Field

[0002] One or more inventive concepts described herein relate to homomorphic encryption devices and ciphertext arithmetic methods performed by homomorphic encryption devices. More specifically, one or more inventive concepts described herein relate to homomorphic encryption devices for re-encrypting ciphertext and performing operations using the re-encrypted ciphertext, and ciphertext arithmetic methods performed by homomorphic encryption devices. Background Technology

[0003] With the development of communication technology and the widespread use of electronic devices, continuous efforts have been made to maintain the security of communication between electronic devices. Therefore, encryption / decryption technology is used in most modern electronic communication environments.

[0004] When a message encrypted with cryptographic technology is transmitted to the counterpart, the counterpart decrypts the message to use it. In this scenario, while the counterpart has already temporarily decrypted the message for computational purposes, a third-party hacking attack is possible. Therefore, the decrypted message could easily be leaked to a third party.

[0005] To address this problem, homomorphic encryption methods have been researched. Ciphertext is the result of encrypting plaintext using an encryption algorithm. According to the homomorphic encryption methods currently under investigation, various arithmetic operations can be performed on the ciphertext without decryption. Summary of the Invention

[0006] One or more inventive concepts described herein provide a homomorphic encryption device and a ciphertext arithmetic method performed by the homomorphic encryption device. The homomorphic encryption device and the ciphertext arithmetic method allow for a reduction in the computational load during re-encryption and an increase in the operating speed of the homomorphic encryption device.

[0007] According to one aspect of this disclosure, a homomorphic encryption apparatus includes a re-encryption parameter generation circuit, a re-encryption circuit, and an arithmetic circuit. The re-encryption parameter generation circuit is configured to generate re-encryption parameters, including multiple re-encryption levels for the multiple ciphertexts respectively, based on an arithmetic scenario including information about an arithmetic schedule among multiple ciphertexts. The re-encryption circuit is configured to generate multiple re-encrypted ciphertexts by re-encrypting each of the multiple ciphertexts to a corresponding re-encryption level, based on the re-encryption parameters. The arithmetic circuit is configured to output an arithmetic result by performing an operation using the multiple re-encrypted ciphertexts, according to the arithmetic scenario.

[0008] According to another aspect of this disclosure, the ciphertext arithmetic method is performed by a homomorphic encryption device. The ciphertext arithmetic method includes: determining a plurality of re-encryption levels for the plurality of ciphertexts based on an arithmetic scenario including information about an arithmetic schedule for the plurality of ciphertexts. The ciphertext arithmetic method further includes: re-encrypting each of the plurality of ciphertexts to a corresponding re-encryption level among the plurality of re-encryption levels; and outputting an arithmetic result by performing an operation including at least one multiplication operation using the plurality of re-encrypted ciphertexts. At least two of the plurality of re-encryption levels are different from each other.

[0009] According to another aspect of this disclosure, a homomorphic encryption apparatus includes a memory, a re-encryption parameter generation circuit, a re-encryption circuit, and an arithmetic circuit. The memory stores a parameter mapping table including a plurality of re-encryption parameters corresponding to a plurality of operation combinations. The re-encryption parameter generation circuit is configured to generate re-encryption parameters comprising a plurality of re-encryption levels of the plurality of ciphertexts based on comparing the parameter mapping table provided from the memory with the operation combinations of the plurality of ciphertexts. The operation combinations are included in an arithmetic scenario. The re-encryption circuit is configured to generate a plurality of re-encrypted ciphertexts by re-encrypting each of the plurality of ciphertexts to a corresponding re-encryption level among the plurality of re-encryption levels, based on the re-encryption parameters. The arithmetic circuit is configured to output an arithmetic result by calculating the plurality of re-encrypted ciphertexts according to the operation combinations of the plurality of ciphertexts. Each of the plurality of re-encryption parameters included in the parameter mapping table includes information about a level, which is optimized such that the level of the arithmetic result is minimized according to the corresponding operation combination among the plurality of operation combinations.

[0010] According to another aspect of this disclosure, the ciphertext arithmetic method is performed by a homomorphic encryption device. The ciphertext arithmetic method includes: receiving the plurality of ciphertexts from outside the homomorphic encryption device based on the type and order of operations required between the plurality of ciphertexts. The ciphertext arithmetic method further includes: re-encrypting the plurality of ciphertexts to re-encryption levels respectively corresponding to the plurality of ciphertexts, such that the arithmetic result does not include the initial text; and outputting the arithmetic result excluding the initial text by performing an operation including at least one multiplication operation using the plurality of re-encrypted ciphertexts.

[0011] According to another aspect of this disclosure, the ciphertext arithmetic method is performed by a homomorphic encryption device. The ciphertext arithmetic method includes: receiving the plurality of ciphertexts based on an arithmetic scenario including information about at least one operation between the plurality of ciphertexts. The ciphertext arithmetic method further includes: determining a level consumption for each of the at least one operation. For each of the plurality of ciphertexts, the ciphertext arithmetic method includes determining the sum of the level consumptions of the at least one operation performed on the corresponding ciphertext as a re-encryption level corresponding to the corresponding ciphertext. For each of the plurality of ciphertexts, the ciphertext arithmetic method includes generating a plurality of re-encrypted ciphertexts by re-encrypting the corresponding ciphertext to the determined re-encryption level corresponding to the corresponding ciphertext. The ciphertext arithmetic method further includes outputting an arithmetic result by performing an operation using the plurality of re-encrypted ciphertexts. Attached Figure Description

[0012] Embodiments of this disclosure will become clearer from the following detailed description taken in conjunction with the accompanying drawings, in which:

[0013] Figure 1 An apparatus according to an example embodiment of the present disclosure is shown;

[0014] Figure 2 An encryption device according to an example embodiment of the present disclosure is shown;

[0015] Figure 3 This is a diagram illustrating homomorphic encryption according to an example embodiment of the present disclosure;

[0016] Figure 4 A flowchart illustrating a ciphertext arithmetic method performed by an encryption device according to an exemplary embodiment of the present disclosure is shown.

[0017] Figure 5 A flowchart illustrating a ciphertext arithmetic method performed by an encryption device according to an exemplary embodiment of the present disclosure is shown.

[0018] Figure 6 An arithmetic scenario is shown according to an example embodiment of this disclosure;

[0019] Figure 7This is a conceptual diagram illustrating re-encryption and arithmetic processing according to an example embodiment of this disclosure;

[0020] Figure 8 A parameter mapping table is shown according to an example embodiment of this disclosure;

[0021] Figure 9 A flowchart illustrating a ciphertext arithmetic method performed by an encryption device according to an exemplary embodiment of the present disclosure is shown.

[0022] Figure 10 An arithmetic scenario is shown according to an example embodiment of this disclosure;

[0023] Figure 11A and Figure 11B Each illustrates re-encryption and arithmetic processing according to an example embodiment of this disclosure;

[0024] Figure 12 A flowchart illustrating a ciphertext arithmetic method performed by an encryption device according to an example embodiment of the present disclosure; and

[0025] Figure 13 A solid-state drive (SSD) system according to an example embodiment of the present disclosure is shown. Detailed Implementation

[0026] In the following, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

[0027] Figure 1 An apparatus 1 according to an exemplary embodiment of the present disclosure is shown. Apparatus 1 may include an encryption device 10, a processor 20, an interface 30, and a memory 40. Apparatus 1 may transmit data DT to and receive data DT from outside the apparatus. For example, apparatus 1 may transmit data DT to and receive data DT from a smart card, memory card, or other device.

[0028] Device 1 can be implemented by various electronic devices, or can be included in various electronic devices. For example, electronic devices may include drones, robotic devices (such as advanced driver assistance systems (ADAS)), smart TVs (TVs), smartphones, medical devices, mobile devices, image display devices, measuring devices, Internet of Things (IoT) devices, etc. Additionally, device 1 may also be... Figure 13 The storage device shown in the figure is implemented.

[0029] Encryption device 10 can encrypt and / or decrypt data DT received from outside device 1. Encryption device 10 can maintain the security of data DT by performing encryption operations based on an encryption algorithm. The encryption algorithm can be, for example, an algorithm that generates encrypted data using an encryption key. In many embodiments described herein, the encryption algorithm can be a homomorphic encryption algorithm.

[0030] Memory 40 can store instructions and data DT. Processor 20 can execute instructions to process data DT according to the instructions. When executed by processor 20, the instructions can cause device 1 to perform or otherwise implement aspects of the methods described herein.

[0031] Processor 20 can send data DT to and receive data DT from outside device 1 via interface 30. Processor 20 can execute instructions to perform tasks and can store the results of the tasks in memory 40. As an example, processor 20 may include multiple cores.

[0032] The memory 40 can store various data required for the operation of the processor 20. The memory 40 can be implemented by, for example, dynamic random access memory (DRAM), mobile DRAM, static RAM (SRAM), phase change RAM (PRAM), ferroelectric RAM (FRAM), resistive RAM (RRAM) and / or magnetic RAM (MRAM).

[0033] In one embodiment, encryption device 10 can process ciphertext encrypted using homomorphic encryption. For ease of description, the term "ciphertext encrypted using homomorphic encryption" as used herein may be referred to as homomorphic ciphertext. For example, encryption device 10 can perform operations using multiple ciphertexts. When encrypted using homomorphic encryption, the multiple ciphertexts become corresponding homomorphic ciphertexts.

[0034] Homomorphic ciphertext can include preliminary text, a message, and errors (or noise) introduced by the nature of homomorphic encryption. When multiplication is performed on homomorphic ciphertext, the length of the preliminary text can be reduced, and the size of the error in the ciphertext corresponding to the arithmetic result can be greater than the error in the operand ciphertext. In response to the execution of at least one multiplication operation, it may be necessary to remove errors from the ciphertext corresponding to the arithmetic result. Therefore, each time a multiplication is performed on homomorphic ciphertext, the length of the preliminary text can be gradually reduced, and the remaining potential number of multiplication operations to be performed on the homomorphic ciphertext can be reduced. Therefore, when the remaining number of possible arithmetic operations on the homomorphic ciphertext is less than the required number of arithmetic operations, it may be necessary to recrypt the homomorphic ciphertext to increase the length of the preliminary text.

[0035] For ease of description, a reference to the level of a homomorphic ciphertext may correspond to the remaining number of possible arithmetic operations on the homomorphic ciphertext. The level of a homomorphic ciphertext may represent a discrete value representing the length of the initial text of the homomorphic ciphertext. As a non-limiting example, when the maximum level of the homomorphic ciphertext corresponding to the maximum length of the initial text of the homomorphic ciphertext is 10, the level of the homomorphic ciphertext may have an integer value ranging from 0 to 10. For example, when the level of the homomorphic ciphertext is 7, seven additional multiplication operations can be performed on the homomorphic ciphertext. In this example, the level consumed by one operation is assumed to be 1, such that each of the seven additional multiplication operations will consume 1 of the remaining 7 levels. However, one or more inventive concepts described herein are not limited to the specific details of the level of the homomorphic ciphertext in the examples described herein, and the level consumed by one operation may be 2 or more, depending on the type of operation or the nature of the other ciphertext being jointly computed.

[0036] In order to perform multiplication on homomorphic ciphertexts, the operand homomorphic ciphertexts may need to have the same order of precedence. The teachings here can be used to obtain operand homomorphic ciphertexts with the same order of precedence.

[0037] According to an example embodiment of this disclosure, an encryption device 10 included in apparatus 1 can determine a re-encryption level for each of a plurality of ciphertexts. The re-encryption level for each ciphertext can be determined based on an arithmetic scenario including information about an arithmetic schedule of the plurality of ciphertexts. In other words, the encryption device 10 can determine multiple re-encryption levels for the plurality of ciphertexts. At least two of the multiple re-encryption levels may be different from each other. In one embodiment, the arithmetic schedule of the plurality of ciphertexts may include the type and order of operations pre-scheduled to be performed on the plurality of ciphertexts. Additionally, in one embodiment, the arithmetic schedule may include information about the level consumed by each scheduled operation, including when different scheduled operations consume different levels. Operations of the encryption device 10, such as re-encryption level determination, re-encryption, and arithmetic operations, will be described in more detail with reference to the following drawings.

[0038] According to an example embodiment of this disclosure, only the re-encryption required for the arithmetic operations needed by the encryption device 10 in device 1 can be performed. Therefore, one or more unnecessary re-encryptions can be avoided and will not be performed unnecessarily. Thus, the computational load in re-encryption can be reduced. Furthermore, as the computational load in re-encryption is reduced, the operating speed of the encryption device 10 and each of device 1 can be increased.

[0039] Figure 2 An encryption device 10 according to an example embodiment of the present disclosure is shown. The encryption device 10 may correspond to... Figure 1 Encryption device 10.

[0040] The encryption device 10 may include a re-encryption circuit 100, an arithmetic circuit 200, a re-encryption parameter generation circuit 300, and a memory 400.

[0041] Before proceeding, it should be clear that this includes... Figure 2The diagram illustrates and refers to circuit systems labeled with terms such as "circuit". As is conventional in the field of one or more inventive concepts described herein, examples can be described and illustrated based on circuits and blocks that perform one or more of the described functions. These circuits and blocks (which may be referred to herein as re-encryption circuits, arithmetic circuits, re-encryption parameter generation circuits, etc.) are physically implemented by analog and / or digital circuits (such as logic gates, integrated circuits, microprocessors, microcontrollers, memory circuits, passive electronic components, active electronic components, optical components, hardwired circuits, etc.) and may optionally be driven by firmware and / or software. For example, the circuits may be implemented in one or more semiconductor chips or on a substrate support (such as a printed circuit board, etc.). The circuits constituting the circuits or blocks may be implemented by dedicated hardware, or by a processor (e.g., one or more programmed microprocessors and associated circuit systems), or by a combination of dedicated hardware performing some functions of the circuits or blocks and a processor performing other functions of the circuits or blocks. Without departing from the scope of this disclosure, each of the example circuits or blocks may be physically divided into two or more interactive and discrete circuits or blocks. Similarly, without departing from the scope of this disclosure, the example circuits and blocks can be physically combined into more complex circuits and blocks.

[0042] The re-encryption circuit 100 can receive multiple ciphertext CTs from outside the encryption device 10. In other words, the data received by the re-encryption circuit 100 can be ciphertext CTs that have already been encrypted and are already homomorphic ciphertexts. In one embodiment, the multiple ciphertext CTs can be homomorphic ciphertexts encrypted according to a homomorphic encryption technique. The re-encryption circuit 100 can re-encrypt the multiple ciphertext CTs based on re-encryption parameters P_R provided by the re-encryption parameter generation circuit 300. The re-encryption parameters P_R can include multiple re-encryption levels, each of which corresponds to a re-encryption level among the multiple ciphertext CTs. The re-encryption circuit 100 can re-encrypt each of the multiple ciphertext CTs to a corresponding re-encryption level among the multiple re-encryption levels included in the re-encryption parameters P_R. For reference, re-encrypting ciphertext to a re-encryption level can mean increasing the length of the initial text of the ciphertext so that the re-encrypted ciphertext has a re-encryption level. The re-encryption circuit 100 can generate multiple re-encrypted ciphertexts CT_R by re-encrypting multiple ciphertexts CT based on the re-encryption parameter P_R, and can provide the multiple re-encrypted ciphertexts CT_R to the arithmetic circuit 200.

[0043] Arithmetic circuit 200 can perform operations using multiple re-encrypted ciphertexts CT_R provided by re-encryption circuit 100. For example, arithmetic circuit 200 can perform at least one operation included in an arithmetic scenario SNR_A, which includes the type and / or order of operations. The arithmetic scenario SNR_A can be determined internally by encryption device 10, and according to embodiments, the arithmetic scenario SNR_A can be information given or requested from outside encryption device 10. Arithmetic circuit 200 can generate an arithmetic result RST by performing operations using multiple re-encrypted ciphertexts CT_R, and can output the arithmetic result RST. Arithmetic circuit 200 can provide the arithmetic scenario SNR_A to re-encryption parameter generation circuit 300.

[0044] The re-encryption parameter generation circuit 300 can generate re-encryption parameters P_R, including multiple re-encryption levels corresponding to multiple ciphertexts, based on the arithmetic scenario SNR_A provided by the arithmetic circuit 200. To this end, the re-encryption parameter generation circuit 300 can determine multiple re-encryption levels based on the arithmetic scenario SNR_A. The re-encryption parameter generation circuit 300 can provide the re-encryption parameters P_R to the re-encryption circuit 100. In one embodiment, at least two of the multiple re-encryption levels may be different from each other.

[0045] Level consumption represents the number (e.g., a number or quantity) of one or more levels consumed in an operation performed on the ciphertext. In one embodiment, re-encryption parameter generation circuitry 300 may determine the level consumption for at least one operation included in an arithmetic scenario SNR_A. Re-encryption parameter generation circuitry 300 may determine multiple re-encryption levels based on the determined level consumption for at least one computation. For example, for each of a plurality of ciphertexts, re-encryption parameter generation circuitry 300 may sum the level consumption of at least one operation performed on the corresponding ciphertext, and the sum may thus be determined as the re-encryption level corresponding to the corresponding ciphertext. (See reference...) Figure 5 , Figure 6 , Figure 7 and Figure 8 This embodiment will be described in more detail.

[0046] In one embodiment, for a specific ciphertext from multiple ciphertexts, the sum of the level consumption of at least one operation performed on the corresponding ciphertext may be greater than the maximum re-encryption level. The initial text included in the ciphertext may be limited by the maximum length that the initial text may have. The maximum re-encryption level may represent the level corresponding to the maximum length that the initial text included in the ciphertext may have. In this case, a single re-encryption cannot meet the specification required by the arithmetic scenario SNR_A for the corresponding ciphertext. Therefore, the re-encryption parameter generation circuit 300 may divide the sum of the level consumption of at least one operation performed on the corresponding ciphertext into multiple levels and may schedule multiple re-encryption operations corresponding to multiple levels. Here, multiple re-encryption operations may be performed between at least one operation. In one embodiment, the re-encryption parameter generation circuit 300 may additionally provide scheduling information for multiple re-encryption operations to the re-encryption circuit 100. Here, the re-encryption circuit 100 may receive an intermediate result RST_M obtained by performing some of the operations in the at least one operation from the arithmetic circuit 200 and may perform re-encryption on the intermediate result RST_M according to the scheduling information. Refer to Figure 9 , Figure 10 , Figure 11A and Figure 11B This embodiment will be described in more detail.

[0047] According to an example embodiment of this disclosure, encryption device 10 can determine the re-encryption level of each of a plurality of ciphertext CTs based on an arithmetic scenario SNR_A including information about an arithmetic schedule, and can re-encrypt each of the plurality of ciphertext CTs to the determined re-encryption level, the arithmetic schedule including the type and / or order of operations of the plurality of ciphertext CTs. Only the re-encryption required for the arithmetic operations needed by encryption device 10 can be performed. Therefore, one or more re-encryptions can be avoided and will not be performed unnecessarily. Thus, the computational load in re-encryption can be reduced. Furthermore, as the computational load in re-encryption is reduced, the operating speed of each of encryption device 10 and device 1 can be improved.

[0048] Figure 3 This is a diagram illustrating a multiplication operation for ciphertext based on homomorphic encryption according to an exemplary embodiment of the present disclosure. Regarding... Figure 3 , will refer to Figure 3 and Figure 2 Let's describe them together.

[0049] Encryption device 10 can perform multiplication using a first ciphertext CT1 and a second ciphertext CT2. Here, the first ciphertext CT1 may include a first initial text PT1, a first message M1, and a first error E1. The length of the first initial text PT1 may correspond to a length L_p, and the length of the first ciphertext CT1 may correspond to a modulus q. As used herein, the term "modulus" may refer to a fixed, predefined value. Similarly, the second ciphertext CT2 may include a second initial text PT2, a second message M2, and a second error E2. The length of the second initial text PT2 may correspond to a length L_p, and the length of the second ciphertext CT2 may correspond to a modulus q. Because multiplication is required between the first ciphertext CT1 and the second ciphertext CT2, the length of the first ciphertext CT1 may be equal to the length of the second ciphertext CT2. In other words, the level of the first ciphertext CT1 may be equal to the level of the second ciphertext CT2.

[0050] Encryption device 10 generates third ciphertext CT3 by performing a multiplication operation using first ciphertext CT1 and second ciphertext CT2. Third ciphertext CT3 may include third preliminary text PT3, third message M3, and third error E3. The length of third preliminary text PT3 may correspond to a modified length L_p', where the modified length L_p' is less than the length L_p. Third message M3 may correspond to the product of first message M1 and second message M2. The size of third error E3 may be greater than the size of first error E1 and second error E2. When the ciphertext error is too large, due to concerns about degradation of the ciphertext's reliability, encryption device 10 may obtain a modified third error E3* by removing some least significant bits (LSBs) of the third error E3 included in third ciphertext CT3. Encryption device 10 can obtain a modified third ciphertext CT3* including third preliminary text PT3, third message M3, and modified third error E3*. The length of the modified third ciphertext CT3* may correspond to the modulus q' and may be less than the modulus q of third ciphertext CT3. Since the result of multiplication using a first ciphertext CT1 and a second ciphertext CT2 of known and predetermined lengths with a modulus q is known, the length of the modulus q' can be fixed and predetermined.

[0051] In the following description, for ease of description, the operation of performing multiplication on ciphertext and then removing some LSBs with errors will be referred to as multiplication and recryption (MAR) operation.

[0052] As described above, when operations including multiplication are performed on the first ciphertext CT1 and the second ciphertext CT2, as in the modified third ciphertext CT3* which is the final ciphertext, the length of the initial text can be reduced. Therefore, as mentioned above, in order to perform the required operations, some or all of the multiple ciphertexts CT need to be re-encrypted. Also as mentioned above, re-encryption can increase the length of the initial text in the ciphertext CT.

[0053] Figure 4 A flowchart illustrating a ciphertext arithmetic method performed by an encryption device according to an exemplary embodiment of this disclosure is shown. About Figure 4 , will refer to Figure 4 and Figure 2 Let's describe them together.

[0054] Encryption device 10 can determine the second ciphertext to be computed in conjunction with the first ciphertext based on an arithmetic scenario (S120). Encryption device 10 can re-encrypt each of the multiple ciphertexts CT to a re-encryption level determined for the corresponding ciphertext based on an arithmetic scenario SNR_A. For example, Figure 2 The re-encryption parameter generation circuit 300 can determine multiple re-encryption levels corresponding to multiple ciphertexts CT based on the arithmetic scenario SNR_A, and can provide the re-encryption parameter P_R, which includes multiple re-encryption levels, to... Figure 2 The re-encryption circuit 100 is included in the configuration. The re-encryption circuit 100 can re-encrypt multiple ciphertext CTs based on multiple re-encryption levels included in the re-encryption parameter P_R. For example, the re-encryption circuit 100 can re-encrypt each of the multiple ciphertext CTs to the re-encryption level corresponding to the respective ciphertext CT.

[0055] Based on an arithmetic scenario, when the second ciphertext and the first ciphertext are jointly calculated, the encryption device 10 can predict the level of the second ciphertext (S140). The encryption device 10 can output the arithmetic result RST by performing an operation using multiple re-encrypted ciphertexts CT_R. For example, the re-encryption circuit 100 can provide multiple re-encrypted ciphertexts CT_R to... Figure 2 The arithmetic circuit 200 in the middle can output the arithmetic result RST by performing operations using multiple re-encrypted ciphertexts CT_R.

[0056] Figure 5 A flowchart illustrating a ciphertext arithmetic method performed by an encryption device according to an exemplary embodiment of the present disclosure is shown. Specifically, Figure 5 It can be shown according to Figure 4 A flowchart of an embodiment of operation S120. Regarding... Figure 5 , will refer to Figure 5 and Figure 2 Let's describe them together.

[0057] The encryption device 10 can determine the level consumption of each of at least one operation included in the arithmetic scenario SNR_A (S220). For example, Figure 2 The re-encryption parameter generation circuit 300 can identify at least one operation of multiple ciphertext CTs and determine the level consumption of each of the at least one operation, which is included in the arithmetic scene SNR_A. Here, the level consumption can represent the level amount corresponding to the length of the LSB removed in response to the execution of the corresponding operation.

[0058] Encryption device 10 can determine the re-encryption level of each of a plurality of ciphertexts based on an arithmetic scenario (S240). The determination of the re-encryption level in S240 can be performed by summing the level consumption of at least one operation performed on the corresponding ciphertext. That is, in S240, for each of the plurality of ciphertexts CT, encryption device 10 can sum the level consumption of at least one operation performed on the corresponding ciphertext based on the arithmetic scenario SNR_A. Encryption device 10 can determine the sum as the re-encryption level corresponding to the corresponding ciphertext. At least one operation performed on the corresponding ciphertext represents at least one operation performed on the corresponding ciphertext from its initial state to the arithmetic result RST.

[0059] For each of the multiple ciphertexts CT, the encryption device 10 can re-encrypt the corresponding ciphertext to a re-encryption level determined for that ciphertext (S260). For example, Figure 2 The re-encryption circuit 100 in the middle can generate multiple re-encrypted ciphertexts CT_R by re-encrypting multiple ciphertexts CT to re-encryption levels corresponding to the multiple ciphertexts CT respectively.

[0060] Figure 6 An arithmetic scenario SNR_A is shown according to an example embodiment of this disclosure. Figure 6 The specific description of the arithmetic scenario SNR_A shown is merely for the purpose of illustrating an example embodiment, and one or more inventive concepts described herein are not limited thereto. Regarding Figure 6 , will refer to Figure 6 and Figure 2 Let's describe them together.

[0061] In one embodiment, the arithmetic scenario SNR_A may include information about the operations performed on multiple ciphertext CTs, which ciphertext CTs are used for each operation, and the amount of rank consumed by each operation.

[0062] For example, according to Figure 6In an arithmetic scenario SNR_A, multiple ciphertexts CT may include a first ciphertext CT1, a second ciphertext CT2, and a third ciphertext CT3. After performing a first operation OP1 on the first ciphertext CT1 and the second ciphertext CT2, a second operation OP2 may be performed on the intermediate result RST_M, which is the result of the first operation OP1, and the third ciphertext CT3. In other words, the first ciphertext CT1 undergoes both the first operation OP1 and the second operation OP2, the second ciphertext CT2 also undergoes both the first operation OP1 and the second operation OP2, and the third ciphertext CT3 only undergoes the second operation OP2. The level consumption Cons_L of the first operation OP1 can be "3", and the level consumption Cons_L of the second operation OP2 can be "5". Here, each of the first operation OP1 and the second operation OP2 may include at least one multiplication operation, and the level of the ciphertext undergoing each of the first operation OP1 and the second operation OP2 may be consumed due to the at least one multiplication operation included.

[0063] The following will refer to Figure 7 This describes an embodiment of determining the re-encryption level of multiple ciphertext CTs based on such an arithmetic scenario SNR_A.

[0064] Figure 7 This is a conceptual diagram illustrating re-encryption and arithmetic processing according to an example embodiment of this disclosure. Specifically, Figure 7 It can be shown according to Figure 5 and Figure 6 A conceptual diagram of an embodiment for determining the re-encryption level. Regarding... Figure 7 , will refer to Figure 7 as well as Figure 2 , Figure 5 and Figure 6 Let's describe them together.

[0065] exist Figure 5 In operation S220, the encryption device 10 can be based on Figure 6 The arithmetic scenario SNR_A shown in the figure determines that the level amounts consumed by the first operation OP1 and the second operation OP2 are "3" and "5" respectively.

[0066] In operation S240, the encryption device 10 can determine "8" as the re-encryption level corresponding to the first ciphertext CT1, where "8" is the sum of the level amounts consumed by the first operation OP1 and the second operation OP2 performed on the first ciphertext CT1. The encryption device 10 can also determine "8" as the re-encryption level corresponding to the second ciphertext CT2, where "8" is the sum of the level amounts consumed by the first operation OP1 and the second operation OP2 performed on the second ciphertext CT2. The encryption device 10 can further determine "5" as the re-encryption level corresponding to the third ciphertext CT3, where "5" is the sum of the level amounts consumed by the second operation OP2 performed on the third ciphertext CT3.

[0067] exist Figure 5 In operation S260, the encryption device 10 can generate a re-encrypted first ciphertext CT1_R with a level of "8" by re-encrypting the first ciphertext CT1 with a level of "6", and can generate a re-encrypted second ciphertext CT2_R with a level of "8" by re-encrypting the second ciphertext CT2 with a level of "0". Since the third ciphertext CT3 has a level of "5", re-encryption of the third ciphertext CT3 is not required. Of course, one or more inventive concepts described herein are not limited to the details of re-encryption used in any of the examples herein, and according to embodiments, re-encryption of the third ciphertext CT3 can also be performed when the level of the third ciphertext CT3 is less than 5.

[0068] The encryption device 10 can obtain an intermediate result RST_M by performing a MAR1 operation, including a first operation and an LSB removal operation, using a re-encrypted first ciphertext CT1_R and a re-encrypted second ciphertext CT2_R. The encryption device 10 can obtain an arithmetic result RST by performing a MAR2 operation, including a second operation and an LSB removal operation, using the intermediate result RST_M and a third ciphertext CT3. The level of the arithmetic result RST can be "0".

[0069] According to the comparative example, an encryption device whose arithmetic result has a value much greater than "0" may perform many unnecessary re-encryption operations. On the other hand, the encryption device 10 according to the exemplary embodiment of this disclosure can perform re-encryption operations with a minimum value within the required range. Therefore, in the encryption device 10 according to the exemplary embodiment of this disclosure, the computational load in the re-encryption operation can be reduced, and the operating speed of the encryption device 10 can be increased.

[0070] Figure 8 A parameter mapping table PMT is shown according to an example embodiment of the present disclosure. The parameter mapping table PMT may correspond to Figure 2 The parameter mapping table PMT. About Figure 8 , will refer to Figure 8 and Figure 2 Let's describe them together.

[0071] The Parameter Mapping Table (PMT) may include multiple re-encryption parameters corresponding to multiple operation combinations. Each operation combination may be a specific combination of operations in a specific order. For example, the PMT may include a first re-encryption parameter P_R_1 corresponding to a first operation combination CO_1, a second re-encryption parameter P_R_2 corresponding to a second operation combination CO_2, and an Nth re-encryption parameter P_R_N corresponding to the Nth operation combination CO_N (where N is a natural number equal to or greater than 2).

[0072] Each of the multiple re-encryption parameters may include multiple re-encryption levels for multiple ciphertexts CT. For example, the first re-encryption parameter P_R_1 may include a level value L11 as the re-encryption level RL_1 for the first ciphertext, a level value L21 as the re-encryption level RL_2 for the second ciphertext, and a level value L31 as the re-encryption level RL_3 for the third ciphertext. Similarly, for example, the second re-encryption parameter P_R_2 may include a level value L12 as the re-encryption level RL_1 for the first ciphertext, a level value L22 as the re-encryption level RL_2 for the second ciphertext, and a level value L32 as the re-encryption level RL_3 for the third ciphertext.

[0073] The parameter mapping table PMT may include the k-th re-encryption parameter P_R_k corresponding to the k-th operation combination CO_k (where k is a natural number). See reference. Figure 6 and Figure 7 When the k-th operation combination CO_k represents the first operation OP1 and the second operation OP2 performed in the order described, the k-th re-encryption parameter P_R_k may include the value "8" of the re-encryption level RL_1 as the first ciphertext, the value "8" of the re-encryption level RL_2 as the second ciphertext, and the value "5" of the re-encryption level RL_3 as the third ciphertext.

[0074] In one embodiment, the encryption device 10 can compare the parameter mapping table PMT with the combination of operations included in the arithmetic scenario SNR_A. For example, Figure 2 The re-encryption parameter generation circuit 300 can select an operation combination included in the arithmetic scenario SNR_A from a plurality of operation combinations included in the parameter mapping table PMT, and can select a re-encryption parameter corresponding to the operation combination selected from the plurality of re-encryption parameters included in the parameter mapping table PMT. The re-encryption parameter generation circuit 300 can provide the selected re-encryption parameter to... Figure 2 The re-encryption circuit 100 in the middle.

[0075] In one embodiment, the parameter mapping table PMT may be data stored in memory 400 after the data is pre-defined, such that according to a reference... Figure 5 , Figure 6 and Figure 7 The described embodiments determine multiple re-encryption levels for multiple ciphertexts.

[0076] Figure 9 A flowchart illustrating a ciphertext arithmetic method performed by an encryption device according to an exemplary embodiment of the present disclosure is shown. Specifically, Figure 9 It can be shown when Figure 5 An embodiment of the ciphertext arithmetic method when the sum in operation S240 is greater than the maximum re-encryption level. Regarding... Figure 9, will refer to Figure 9 as well as Figure 2 and Figure 5 Let's describe them together.

[0077] In operation S240 concerning a specific ciphertext from multiple ciphertexts CT, in response to a situation where the sum of the level consumption of at least one operation performed on the corresponding ciphertext is greater than the maximum re-encryption level, the encryption device 10 may divide the sum of the corresponding ciphertext into multiple levels (S320). For example, the encryption device 10 may divide the sum into multiple levels such that each of the multiple levels is less than or equal to the maximum re-encryption level. Here, the encryption device 10 may divide the sum into multiple levels such that the number of levels is the value obtained by adding "1" to the quotient when the sum is divided by the maximum re-encryption level. For example, when the sum is "12" and the maximum re-encryption level is "10", the encryption device 10 may divide "12" into two levels (such as (10,2), (9,3), (8,4), (7,5), (6,6), (5,7), (4,8), (3,9) or (2,10)). Additionally, for example, when the sum is “23” and the maximum re-encryption level is “10”, the encryption device 10 can divide “23” into three levels (such as (10, 10, 3) etc.).

[0078] In one embodiment, during operation S320, the encryption device 10 may divide the value obtained by adding small natural numbers (such as 1 to 3) to a sum into multiple levels. This is to prepare for the possibility that the expected level consumption of the operation may vary depending on the environment of the encryption device 10, the type of data to be operated, the type of operation to be performed, etc., and the possibility that the arithmetic scenario SNR_A may change during the processing.

[0079] The encryption device 10 can schedule multiple re-encryptions corresponding to multiple levels of division between at least one operation performed on the corresponding ciphertext (S340). For example, Figure 2 The re-encryption parameter generation circuit 300 can schedule multiple re-encryptions corresponding to multiple division levels between at least one operation performed on the corresponding ciphertext.

[0080] The encryption device 10 can perform multiple re-encryption operations and at least one operation according to the re-encryption schedule in operation S340 (S360).

[0081] The following will refer to Figure 10 , Figure 11A and Figure 11B A more detailed description Figure 9 The flowchart.

[0082] Figure 10 An arithmetic scenario SNR_A is shown according to an example embodiment of this disclosure. Figure 10 The specific description of the arithmetic scenario SNR_A shown herein is for ease of description only, and one or more inventive concepts described herein are not limited to the details of any of the example embodiments described herein. Regarding Figure 10 , will refer to Figure 10 and Figure 2 Let's describe them together.

[0083] In one embodiment, the arithmetic scenario SNR_A may include information about the operations performed on multiple ciphertext CTs, which ciphertext CTs are used for each operation, and the amount of rank consumed in each operation.

[0084] For example, according to Figure 10 In the arithmetic scenario SNR_A, multiple ciphertexts CT can include a first ciphertext CT1, a second ciphertext CT2, and a third ciphertext CT3. After performing a first operation OP1 on the first ciphertext CT1 and the second ciphertext CT2, a second operation OP2 can be performed on the intermediate result RST_M, which is the result of the first operation OP1, and the third ciphertext CT3. In other words, the first ciphertext CT1 undergoes both the first operation OP1 and the second operation OP2, the second ciphertext CT2 also undergoes both the first operation OP1 and the second operation OP2, and the third ciphertext CT3 only undergoes the second operation OP2. The level cost Cons_1 of the first operation OP1 can be "7", and the level cost Cons_1 of the second operation OP2 can be "5".

[0085] Additionally, assuming the maximum re-encryption level is "10", the following will refer to... Figure 11A and Figure 11B This document describes an implementation of determining the re-encryption level of multiple ciphertext CTs based on the arithmetic scenario SNR_A.

[0086] Figure 11A and Figure 11B Each illustrates re-encryption and arithmetic processing according to exemplary embodiments of this disclosure. Specifically, Figure 11A and Figure 11B It can be shown separately according to Figure 9 and Figure 10 A conceptual diagram of an embodiment for determining the re-encryption level. Regarding... Figure 11A and Figure 11B , will refer to Figure 11A and Figure 11B as well as Figure 2 , Figure 9 and Figure 10 Let's describe them together.

[0087] First refer to Figure 11A ,exist Figure 9In operation S320, in response to the case that the level consumed by the first operation OP1 and the second operation OP2 performed on the first ciphertext CT1 is "12" and therefore greater than the maximum re-encryption level "10", the encryption device 10 may divide "12" into two levels. For example, the encryption device 10 may divide "12" into "10" and "2".

[0088] In operation S340, the encryption device 10 can schedule re-encryption operations and arithmetic operations such that, in the order described above, the first ciphertext CT1 is sequentially re-encrypted corresponding to "10", the first operation OP1, the re-encryption corresponding to "2", and the second operation OP2 are performed sequentially. For reference, the re-encryption corresponding to "10" in the first re-encryption operation can represent performing re-encryption to change the level to "10", and the re-encryption corresponding to "2" in the next re-encryption operation can represent a re-encryption operation that increases the level by up to "2". Similarly, the encryption device 10 can schedule re-encryption operations and arithmetic operations such that, also in the order described above, the second ciphertext CT2 is sequentially re-encrypted corresponding to "10", the first operation OP1, the re-encryption corresponding to "2", and the second operation OP2.

[0089] In operation S360, the encryption device 10 can perform re-encryption operations and arithmetic operations according to a schedule. For example, Figure 2 The arithmetic circuit 200 can obtain an intermediate result RST_M with level "3" by performing a MAR1 operation using a re-encrypted first ciphertext CT1_R and a re-encrypted second ciphertext CT2_R. The arithmetic circuit 200 can then provide the intermediate result RST_M to... Figure 2 The re-encryption circuit 100 can obtain a re-encrypted intermediate result RST_M_R by performing a re-encryption that increases the level of the intermediate result RST_M with level "3" by up to "2". Therefore, the level of the re-encrypted intermediate result RST_M_R can be "5".

[0090] Next, the encryption device 10 can obtain the arithmetic result RST with level "0" by performing the MAR2 operation using the re-encrypted intermediate result RST_M_R and the third ciphertext CT3.

[0091] Next, refer to Figure 11B ,exist Figure 9 In operation S320, in response to the case that the level consumed by the first operation OP1 and the second operation OP2 performed on the first ciphertext CT1 is "12" and therefore greater than the maximum re-encryption level "10", the encryption device 10 may divide "12" into two levels. For example, the encryption device 10 may divide "12" into "7" and "5".

[0092] Can be used as a reference Figure 11A The subsequent operations S340 and S360 are performed in essentially the same manner as described above.

[0093] In other words, in reference Figure 11A In the described embodiments, when the sum of the level consumption of at least one operation performed on the corresponding ciphertext is divided into multiple levels, the encryption device 10 may first divide the sum into levels including the maximum re-encryption level (i.e., 10 in this example), and then the final remaining value may be included in the remaining levels.

[0094] In reference Figure 11B In the described embodiments, with Figure 11A In contrast, when the total level consumption of at least one operation performed on the corresponding ciphertext is divided into multiple levels, the encryption device 10 may first allocate as many levels as the number of levels consumed by the first operation OP1 (i.e., 7 in this example), and the remaining value may be included in the remaining levels.

[0095] Figure 12 A flowchart illustrating a ciphertext arithmetic method performed by an encryption device according to an exemplary embodiment of this disclosure is shown. About Figure 12 , will refer to Figure 12 and Figure 2 Let's describe them together.

[0096] In S420, the encryption device 10 can determine the operations to be performed on multiple ciphertext CTs and the level consumption of each operation based on the arithmetic scenario SNR_A.

[0097] In S440, the encryption device 10 can determine multiple re-encryption levels of multiple ciphertexts CT based on the level consumption determined in operation S420, such that the level of the arithmetic result RST is minimized. For example, Figure 2 The re-encryption parameter generation circuit 300 can optimize multiple re-encryption levels to minimize the level of the arithmetic result RST. In one embodiment, the re-encryption parameter generation circuit 300 can generate multiple re-encryption levels such that the level of the arithmetic result RST is "0".

[0098] In S460, for each of the multiple ciphertexts CT, the encryption device 10 can re-encrypt the corresponding ciphertext to a re-encryption level determined for that ciphertext. For example, Figure 2 The re-encryption circuit 100 in the middle can generate multiple re-encrypted ciphertexts CT_R by re-encrypting multiple ciphertexts CT to re-encryption levels corresponding to the multiple ciphertexts CT respectively.

[0099] Figure 13An SSD system 1000 (Solid State Drive (SSD) system) according to an example embodiment of the present disclosure is shown.

[0100] SSD system 1000 may include host 1100 and SSD 1200. SSD 1200 may send signals to and receive signals from host 1100 via a signal connector (SIG), and may receive power via a power connector (PWR). SSD 1200 may include SSD controller 1210, auxiliary power supply 1220, and multiple flash memory devices 1230, 1240, and 1250.

[0101] Here, the SSD controller 1210 may include an encryption device 1212, which can be used to... Figures 1 to 12 The embodiments shown are implemented as described.

[0102] Although one or more inventive concepts described herein have been specifically shown and described with reference to embodiments thereof, it will be understood that various changes in form and detail may be made therein without departing from the spirit and scope of the claims.

Claims

1. A homomorphic encryption apparatus comprising: a re-encryption parameter generation circuit configured to generate re-encryption parameters including a plurality of re-encryption levels respectively for a plurality of ciphertexts based on an arithmetic scenario including information on an arithmetic schedule among the plurality of ciphertexts, and schedule a plurality of re-encryptions corresponding to a plurality of levels of division between at least one operation performed on a corresponding ciphertext; a re-encryption circuit configured to generate a plurality of re-encrypted ciphertexts by re-encrypting each of the plurality of ciphertexts to a corresponding re-encryption level based on the re-encryption parameters; and an arithmetic circuit configured to output an arithmetic result by performing an operation using the plurality of re-encrypted ciphertexts according to the arithmetic scenario, wherein the arithmetic schedule includes a type and / or an order of the operation.

2. The homomorphic encryption device of claim 1, wherein, At least two of the plurality of re-encryption levels respectively corresponding to the plurality of ciphertexts are different from each other.

3. The homomorphic encryption device of claim 1, wherein, The re-encryption parameter generation circuit is further configured to: determine a level consumption amount of at least one operation included in the arithmetic scenario; and generate the re-encryption parameters based on the determined level consumption amount of the at least one operation.

4. The homomorphic encryption device of any one of claims 1 to 3, wherein, The re-encryption parameter generation circuit is further configured to determine, for each of the plurality of ciphertexts, a sum of the level consumption amount of the at least one operation performed on a corresponding ciphertext as a re-encryption level of the corresponding ciphertext.

5. The homomorphic encryption device of claim 4, wherein, The re-encryption parameter generation circuit is further configured to: in response to a case where the sum of the level consumption amount of the at least one operation performed on a corresponding ciphertext is greater than a maximum re-encryption level, divide the sum into the plurality of levels of division such that each of the plurality of levels is less than or equal to the maximum re-encryption level.

6. The homomorphic encryption device of claim 5, wherein, The number of levels corresponds to a value obtained by adding "1" to a quotient when the sum is divided by the maximum re-encryption level.

7. The homomorphic encryption device of any one of claims 1 to 3, wherein, The re-encryption parameter generation circuit is further configured to generate the re-encryption parameters based on the determined level consumption amount of the at least one operation such that a level of the arithmetic result is minimized.

8. The homomorphic encryption device of claim 7, wherein, The re-encryption parameter generation circuit is further configured to generate the re-encryption parameters such that the level of the arithmetic result is "0". 9.A ciphertext arithmetic method performed by a homomorphic encryption apparatus, the ciphertext arithmetic method comprising: determining a plurality of re-encryption levels of a plurality of ciphertexts based on an arithmetic scenario including information on an arithmetic schedule of the plurality of ciphertexts; re-encrypting each of the plurality of ciphertexts to a corresponding re-encryption level among the plurality of re-encryption levels; and outputting an arithmetic result by performing an operation including at least one multiplication operation using the plurality of re-encrypted ciphertexts, wherein at least two of the plurality of re-encryption levels are different from each other, wherein a remainder amount of an arithmetic operation of the plurality of re-encrypted ciphertexts is greater than a remainder amount of an arithmetic operation of the plurality of ciphertexts, and wherein the arithmetic schedule includes a type and / or an order of the operation.

10. The cryptarithmetic method of claim 9, wherein, The step of determining the plurality of re-encryption levels includes: obtaining a parameter mapping table including a plurality of re-encryption parameters corresponding to a plurality of operation combinations; and determining the plurality of re-encryption levels comprises:

11. The cryptarithmetic method according to claim 9, wherein, determining a level consumption amount of each of the at least one operation included in the arithmetic scenario; and determining, for each of the plurality of ciphertexts, a respective re-encryption level based on the determined level consumption amount of the at least one operation. determining the respective re-encryption level comprises determining a sum of the level consumption amounts of the at least one operation performed on the respective ciphertext among the plurality of ciphertexts as the re-encryption level corresponding to the respective ciphertext.

12. The cryptarithmetic method of claim 11, wherein, determining the respective re-encryption level comprises:

13. The cryptarithmetic method of claim 11, wherein, in response to a case where the sum of the level consumption amounts of the at least one operation performed on the respective ciphertext among the plurality of ciphertexts is less than or equal to a maximum re-encryption level, determining the sum as the re-encryption level of the respective ciphertext; and in response to a case where the sum is greater than the maximum re-encryption level, scheduling a plurality of re-encryptions corresponding to the plurality of levels into which the sum is divided, among the at least one operation performed on the respective ciphertext, by dividing the sum into a plurality of levels. determining the plurality of re-encryption levels comprises determining, based on a level consumption amount of each of the at least one operation included in the arithmetic scenario, a level optimized so that a level of an arithmetic result is minimized as the plurality of re-encryption levels.

14. The cryptarithmetic method of claim 9, wherein, determining the plurality of re-encryption levels comprises determining, by comparing a parameter mapping table with a combination of operations included in the arithmetic scenario, a level included in a re-encryption parameter corresponding to the combination of operations included in the arithmetic scenario as the plurality of re-encryption levels, the parameter mapping table including a plurality of re-encryption parameters corresponding to a plurality of combinations of operations stored in the homomorphic encryption device.

15. The cryptarithmetic method according to claim 9, wherein, 16. A ciphertext arithmetic method performed by a homomorphic encryption device, the ciphertext arithmetic method comprising: receiving a plurality of ciphertexts from an outside of the homomorphic encryption device; receiving a parameter mapping table including a plurality of re-encryption parameters corresponding to a plurality of combinations of operations; outputting a re-encryption parameter according to a re-encryption parameter corresponding to a combination of operations included in an arithmetic scenario by comparing the parameter mapping table with the combination of operations included in the arithmetic scenario; re-encrypting the plurality of ciphertexts to re-encryption levels corresponding to the plurality of re-encrypted ciphertexts, respectively, as a plurality of re-encrypted ciphertexts based on a type and an order of operations required between the plurality of ciphertexts so that an arithmetic result does not include a plaintext; and outputting the arithmetic result not including the plaintext by performing an operation including at least one multiplication operation using the plurality of re-encrypted ciphertexts, wherein the arithmetic scenario includes a type and / or an order of operations. determining the plurality of re-encryption levels comprises:

17. The cryptarithmetic method of claim 16, wherein, determining, for each of the plurality of ciphertexts, a sum of level consumption amounts of the at least one operation performed on the respective ciphertext as a re-encryption level corresponding to the respective ciphertext; and re-encrypting the respective ciphertext to the re-encryption level for each of the plurality of ciphertexts. ​ 18. The cryptarithmetic method of claim 17, wherein, The step of determining the sum of the class consumption amounts of the at least one operation as a re-encryption class corresponding to the respective ciphertext includes, in response to a case where the sum is greater than the maximum re-encryption class, scheduling a plurality of re-encryptions corresponding to the divided plurality of classes among the at least one operation performed on the respective ciphertext by dividing the sum into a plurality of classes.

19. The cryptarithmetic method of claim 18, wherein, The step of determining the sum of the class consumption amounts of the at least one operation as a re-encryption class corresponding to the respective ciphertext includes, in response to a case where the sum is less than or equal to the maximum re-encryption class, determining the sum as the re-encryption class of the respective ciphertext.

Images