Terminal devices performing homomorphic encryption and encryption methods for terminal devices

Abstract

This application discloses a terminal device for homomorphic encryption and an encryption method for the terminal device. The encryption method includes the steps of: setting a ring, the ring being a set including multiple elements in which addition and multiplication are defined, the ring including a plaintext space, the plaintext space being a set of real numbers from multiple sets closed by addition and multiplication; calculating a key from the ring; calculating a public key corresponding to the calculated key; and applying the public key to a message and generating homomorphic ciphertext. Accordingly, homomorphic ciphertext that can be computed in a ciphertext state can be efficiently generated.

Description

[0001] This application is a divisional application of the patent application No. 201880008003.6, entitled "Terminal device performing homomorphic encryption, server device processing ciphertext and method thereof" the parent application date of which is December 17, 2018. TECHNICAL FIELD

[0002] The present disclosure relates to a terminal device performing homomorphic encryption, a server device processing the ciphertext, a method thereof, and a homomorphic encryption method of adjusting a plaintext space of a ring to a real number space and generating a homomorphic ciphertext with improved calculation speed. BACKGROUND

[0003] Advances in electronic and communication technologies have supported various services of transceiving data between various devices and utilizing the transceived data. For example, in the cloud computing service, a user stores his or her personal information in a server and utilizes the information of the server by using his or her actively used terminal device.

[0004] In such an environment, it is essential to prevent data leakage using security technology. Accordingly, the server stores encrypted data. In this case, whenever the server searches for data stored therein or performs a series of operations based on the data, it is necessary to decrypt the encrypted data, thus wasting resources and time.

[0005] In addition, when a hacking of a third party is performed while the server temporarily performs decryption for calculation, there is a problem that personal information can be easily leaked to the third party.

[0006] To solve this problem, a homomorphic encryption method has been studied. According to a homomorphic encryption, even if a calculation is performed with a ciphertext itself without decrypting encrypted information, it is possible to obtain the same result as a value obtained by performing a calculation of a plaintext and then encrypting the calculated plaintext. Accordingly, various calculations can be performed in a state in which the ciphertext is not decrypted.

[0007] However, when an integer calculation is performed according to a related art homomorphic encryption method, there is a problem that the number of bits of the plaintext is exponentially increased and the time required for the calculation is significantly increased.

[0008] Meanwhile, the homomorphic encryption method of the related art has a disadvantage that an imaginary part of a plaintext is increased in a calculation process. For example, since the homomorphic encryption method of the prior art performs homomorphic encryption of a message in a complex number space, even when homomorphic encryption of a message is performed in a real number space, an error is added to the imaginary part. If a calculation of homomorphic encryption is repeated, an error of the imaginary space is gradually increased, and when an error of the imaginary space is significantly increased, a message corresponding to a real part of an actual message thereafter can be destroyed in a homomorphic multiplication calculation.

[0009] Therefore, there is a need for a method capable of improving a calculation speed even in a state of a ciphertext and preventing the imaginary part of the plaintext from being destroyed by being increased in the calculation process.

[0010] The above information is presented as background information only to assist with an understanding of the present disclosure. No determination has been made, and no assertion is made, as to whether any of the above might be applicable as prior art with regard to the present disclosure. SUMMARY

[0011] TECHNICAL PROBLEM

[0012] Aspects of the present disclosure are to address at least the above-mentioned problems and / or disadvantages and to provide at least the advantages described below. Accordingly, an aspect of the present disclosure is to provide an end device that generates a homomorphic ciphertext by reflecting a scaling factor in a message and then encrypts the message, a server device that calculates the ciphertext, and a method thereof. In addition, an aspect of the present disclosure is to provide a method of performing homomorphic encryption of a real number plaintext by adjusting a plaintext space of a ring to a real number space and generating a homomorphic encryption with an improved calculation speed.

[0013] TECHNICAL SOLUTION

[0014] According to an aspect of the present disclosure, an encryption method of an end device is provided. The encryption method includes the steps of setting a scaling factor and reflecting the scaling factor in a message to be encrypted, and encrypting using a public key to generate a homomorphic ciphertext. The homomorphic encryption is based on a decryption being performed and in a form in which a result value is recovered, the result value being obtained by adding an error value to a value obtained by reflecting the scaling factor in the message.

[0015] A modulus of the homomorphic ciphertext can be set to a power of a scaling factor.

[0016] A modulus of the homomorphic ciphertext can be set to a value obtained by multiplying a plurality of different scaling factors with each other. The plurality of different scaling factors can be set to a plurality of values which do not intersect with each other in a similar range.

[0017] The generating the homomorphic ciphertext can include calculating an error from a discrete Gaussian distribution or a distribution within a short statistical distance with respect to the discrete Gaussian distribution, and multiplying the message by the scaling factor and adding the error to the multiplied message, and encrypting using the public key to generate the homomorphic ciphertext.

[0018] The encryption method can further include a step of converting a plurality of message vectors into a polynomial based on the message of the plurality of message vectors, the polynomial being in a form capable of being encrypted in parallel. The generating the homomorphic ciphertext can include multiplying the polynomial by the scaling factor and homomorphic encryption using the public key.

[0019] According to another aspect of the disclosure, a ciphertext processing method of a server apparatus is provided. The ciphertext processing method includes receiving a plurality of homomorphic ciphertexts which are individually encrypted, performing a predetermined computation on the plurality of homomorphic ciphertexts, and eliminating a noise domain from a result ciphertext calculated by the computation and extracting data of an effective domain. Each of the plurality of homomorphic ciphertexts can be a ciphertext generated by multiplying a message by a scaling factor and performing encryption of the multiplied message. The noise domain can be determined to correspond to a size of the scaling factor.

[0020] The ciphertext processing method can further include a step of performing a computation process of a plurality of message vectors in parallel based on each of the plurality of homomorphic ciphertexts being a ciphertext generated by packing the plurality of message vectors.

[0021] The ciphertext processing method can further include a step of rotating an order of each of a plurality of message vectors included in a plurality of homomorphic ciphertexts.

[0022] The ciphertext processing method can further include a step of performing a conjugate computation for the plurality of homomorphic ciphertexts based on the message being a complex number.

[0023] According to another aspect of the present disclosure, a terminal device is provided. The terminal device includes a memory configured to store a scaling factor and a public key, a processor configured to reflect the scaling factor in a message to be encrypted, then encrypt using the public key, and generate a homomorphic ciphertext, and a communicator configured to transmit the homomorphic ciphertext to an external device. The homomorphic ciphertext is based on a decryption being performed and in a form in which a result value is recovered, the result value being obtained by adding an error value to a value obtained by reflecting the scaling factor in the message.

[0024] The terminal device can further include an input interface configured to receive input of the message and the scaling factor. The processor can be configured to store the message and the scaling factor input through the input interface in the memory.

[0025] The processor can be configured to set a modulus of the homomorphic ciphertext to a power of the scaling factor, and store the set modulus of the homomorphic ciphertext in the memory.

[0026] The processor can be configured to set a modulus of the homomorphic ciphertext to a value obtained by multiplying a plurality of different scaling factors with each other, and store the set modulus of the homomorphic ciphertext in the memory. The plurality of different scaling factors can be set to values that do not intersect with each other within a similar range.

[0027] The processor can be configured to calculate an error from a discrete Gaussian distribution or a distribution within a short statistical distance with respect to the discrete Gaussian distribution, and multiply the message by the scaling factor and add the error to the multiplied message, then encrypt using the public key.

[0028] The processor can be configured to convert a plurality of message vectors to a polynomial in a form that can be homomorphically encrypted based on the message being a plurality of message vectors, and multiply the polynomial by the scaling factor, then homomorphically encrypt using the public key.

[0029] According to another aspect of the present disclosure, an encryption method of a terminal device is provided. The encryption method includes setting a ring, the ring being a set including a plurality of elements in which addition and multiplication are defined, the ring including a plaintext space, the plaintext space being a real number from a set closed to addition and multiplication; calculating a key from the ring; calculating a public key corresponding to the calculated key; and applying the public key to a message and generating a homomorphic ciphertext.

[0030] The ring can satisfy the following equation:

[0031]

[0032] Here, a(X) is a polynomial corresponding to the ring, R is a ring including a real space, and the real space is a complex number.

[0033] The homomorphic ciphertext can have a complexity of o(n log n) with respect to an addition or multiplication calculation.

[0034] The encryption method can further include the steps of calculating a first random polynomial from the ring, extracting an error, and modulating the error in the first random polynomial and the key and calculating a second random polynomial. The step of calculating the public key can include calculating the public key using the first and second random polynomials.

[0035] The step of generating the homomorphic ciphertext can include calculating the message as a polynomial corresponding to the ring, and applying the public key to the calculated polynomial and generating a homomorphic ciphertext.

[0036] The encryption method can further include the step of performing at least one calculation with respect to an addition or multiplication of the generated homomorphic ciphertext and a pre-generated homomorphic ciphertext. The step of performing the calculation can include performing a first function processing procedure with respect to each of the generated homomorphic ciphertext and the pre-generated homomorphic ciphertext, performing a calculation between the homomorphic ciphertexts on which the first function processing procedure is performed, and performing a second function processing procedure that is a reverse function of the first function with respect to the homomorphic ciphertext on which the calculation is performed.

[0037] The first function can be a number theoretic transform (NTT) function.

[0038] The homomorphic ciphertext is based on a decryption being performed and is in a form in which a result value is recovered, the result value being obtained by adding an error value to the message.

[0039] According to another aspect of the disclosure, a terminal device is provided. The terminal device includes a memory configured to store a message, and a processor configured to set a ring including a set of elements in which addition and multiplication are defined, the ring including a plaintext space that is a real number from among sets closed to addition and multiplication, calculate a key from the ring, calculate a public key corresponding to the calculated key, and apply the public key to a message and generate a homomorphic ciphertext.

[0040] The ring can satisfy the following equation:

[0041]

[0042] Here, a(X) is a polynomial corresponding to the ring, the R includes a ring of a real space, and the real space is a complex number.

[0043] The homomorphic ciphertext can have a complexity of o(n log n) with respect to addition or multiplication.

[0044] The processor can be configured to calculate a first random polynomial from the ring, extract an error, modulate the error in the first random polynomial and the key, and calculate a second random polynomial, and calculate the public key using the first and second random polynomials.

[0045] The processor can be configured to calculate the message as a polynomial corresponding to the ring, and apply the public key to the calculated polynomial and generate a homomorphic ciphertext.

[0046] The processor is configured to perform a first function processing procedure with respect to each of the generated homomorphic ciphertext and the pre-generated homomorphic ciphertext, perform at least one calculation from addition or multiplication between the homomorphic ciphertexts on which the first function processing procedure is performed; and perform a second function processing procedure, which is an inverse function of the first function with respect to the homomorphic ciphertext on which the calculation is performed.

[0047] The first function can be a number theoretic transform (NTT) function.

[0048] Advantages:

[0049] According to various embodiments of the disclosure as described above, a homomorphic ciphertext including an effective domain can be generated, and thus it is possible to reduce the calculation time and burden while minimizing message loss.

[0050] In addition, since a homomorphic ciphertext is generated by adjusting a plaintext space of a ring to a real number space, it is possible to initially prevent an increase in the imaginary part of the plaintext in the calculation process, and support twice the amount of parallel real number calculation corresponding to having the same stability, calculation speed, memory (ciphertext and key size) as the previous HEAAN.

[0051] Other aspects, advantages, and salient features of the disclosure will become apparent to those skilled in the art from the following detailed description, taken in conduction with the accompanying drawings. BRIEF DESCRIPTION OF DRAWINGS

[0052] Figure 1 FIG. 1 is a diagram illustrating a structure of a network system according to an embodiment of the present disclosure;

[0053] Figure 2 FIG. 2 is a block diagram illustrating a configuration of a terminal device and a server device according to an embodiment of the present disclosure;

[0054] Figure 3 FIG. 3 is a flowchart of an encryption method of a terminal device according to an embodiment of the present disclosure;

[0055] Figure 4 FIG. 4 is a flowchart of a ciphertext processing method of a server device according to an embodiment of the present disclosure;

[0056] Figure 5 FIG. 5 is a diagram illustrating various examples of a ciphertext processing method of a server device.

[0057] Figure 6 FIG. 6 is a diagram illustrating various examples of a ciphertext processing method of a server device.

[0058] Figure 7 FIG. 7 is a diagram illustrating various examples of a ciphertext processing method of a server device.

[0059] Figure 8 FIG. 8 is a diagram illustrating a ciphertext processing method of a network system according to an embodiment of the present disclosure;

[0060] Figure 9 FIG. 9 is a diagram illustrating a structure of a network system according to an embodiment of the present disclosure;

[0061] Figure 10 FIG. 10 is a block diagram illustrating a brief configuration of a terminal device according to an embodiment of the present disclosure;

[0062] Figure 11 FIG. 11 is a block diagram illustrating a detailed configuration of a terminal device according to an embodiment of the present disclosure;

[0063] Figure 12 FIG. 12 is a diagram illustrating a process of generating a public key and a secret key.

[0064] Figure 13 FIG. 13 is a diagram illustrating an action of generating a calculation key.

[0065] Figure 14is a diagram illustrating an action of generating and decrypting an approximate encryption ciphertext.

[0066] Figure 15 is a diagram illustrating an addition calculation of a homomorphic ciphertext.

[0067] Figure 16 is a diagram illustrating a multiplication calculation of a homomorphic ciphertext.

[0068] Figure 17 is a flowchart of an encryption method according to an embodiment of the present disclosure; and

[0069] Figure 18 is a diagram illustrating a ciphertext processing method of a network system according to an embodiment of the present disclosure.

[0070] Throughout the drawings, the same reference numerals are used for the same elements. DETAILED DESCRIPTION

[0071] Hereinafter, embodiments will be described in greater detail with reference to the accompanying drawings. The information (data) transmission processing procedure conducted in the present disclosure can include encryption / decryption as necessary. In the present disclosure and claims, the expression describing the processing procedure of the transmitted information (data) should be interpreted as including encryption / decryption, even if it is not mentioned separately. In the present disclosure, the expression in the form of "transmitting (transferring) from A to B" or "receiving from B by A" includes transmitting (transferring) or receiving another medium therebetween, and does not mean only direct transmission (transfer) from A to B or direct reception by A from B.

[0072] In the description of the present disclosure, the order of each step should be understood as non-limiting, unless the previous step must be conducted logically and temporally before the subsequent step. In other words, except for the above-mentioned exception, the nature of the present invention is not affected even if the processing procedure described in the next step is conducted before the processing procedure described in the previous step, and the scope of the right should be defined regardless of the order of the steps. In addition, "A or B" is defined herein to mean not only selectively pointing to A or B, but also including both A and B. Furthermore, it should be understood that the term "comprise" is intended to further include other elements than the elements listed to be included.

[0073] Only the necessary components necessary for explaining the present invention are described in the present disclosure, and components irrelevant to the essence of the present invention are not mentioned. The present disclosure should not be interpreted in an exclusive sense including only the elements recited, but should be interpreted in a non-exclusive sense including other elements.

[0074] In this specification, the term "value" is defined to include not only a scalar value but also a concept of a vector.

[0075] The mathematical calculations and computations of each step of the present disclosure to be described later can be implemented by a computer operation of a known encoding method for performing the computation or calculation and / or coding designed according to the present disclosure.

[0076] The specific formulas described below are exemplarily described among various possible alternatives, and the scope of the present disclosure should not be interpreted as being limited to the formulas mentioned in the present disclosure.

[0077] For ease of description, the following notations will be used in the present disclosure.

[0078] a←D: select an element (a) according to a distribution (D)

[0079] s1, s2∈R: each of s1 and s2 is an element of a set R.

[0080] Mod(q): perform a modular computation by an element q.

[0081] : round up an internal value.

[0082] Hereinafter, various embodiments of the present disclosure will be described in detail with reference to the accompanying drawings.

[0083] Figure 1 is a diagram illustrating a configuration of a network system according to an embodiment of the present disclosure. Referring to FIG. 1, Figure 1A plurality of terminal devices 100-1 to 100-n, a first server device 200, and a second server device 300 can be connected to each other via a network 10. The network 10 can be implemented as wired / wireless communication, a broadcast communication network, an optical communication network, and various types of a cloud network, and each device can be connected in the same manner as Wi-Fi, Bluetooth, near field communication (NFC), without any additional medium.

[0084] In Figure 1 , a plurality of terminal devices 100-1 to 100-n are illustrated. However, a plurality of terminal devices must be used, but one device can be used. For example, the plurality of terminal devices 100-1 to 100-n can be implemented as a device in various forms such as a mobile phone, a tablet personal computer (PC), a game machine, a desktop PC, a laptop PC, a home server, and a kiosk, and can also be implemented as a home appliance to which an Internet of Things (IoT) technology is applied.

[0085] The user can input various information through the terminal device used by him or her. The input information can be stored in the terminal devices 100-1 to 100-n themselves, but can be transmitted to an external device and stored for reasons of storage capacity, security, etc. Figure 1 , the first server device 200 can play a role of storing the information, and the second server device 300 can play a role of utilizing some or all of the information stored in the first server device 200.

[0086] Each of the terminal devices 100-1 to 100-n can perform homomorphic encryption of the input information, and transmit the homomorphic ciphertext to the first server device 200. The first server device 200 can store the obtained homomorphic ciphertext without decryption.

[0087] The second server apparatus 300 can request a result of a certain processing of the homomorphic ciphertext from the first server apparatus 200. The first server apparatus 200 can perform a certain calculation according to the request and then transmit the result to the second server apparatus 300. For example, in a case where the ciphertexts ct1 and ct2 obtained from the two terminal apparatuses 100-1 and 100-2 are stored in the first server apparatus 200, the second server apparatus 300 can request a value obtained by adding the information provided from the two terminal apparatuses 100-1 and 100-2 to the first server apparatus 200. The first server apparatus 200 can perform a calculation to add the two ciphertexts and then transmit the result value (ct1 + ct2) to the second server apparatus 300.

[0088] The plurality of respective terminal apparatuses can include an encryption noise, that is, an error, which is calculated in a process of homomorphic encryption. For example, a homomorphic ciphertext generated in the plurality of respective terminal apparatuses 100-1 to 100-n can be generated in a manner that, when decrypted using a key, a result value including a message and an error value is recovered.

[0089] For example, a homomorphic ciphertext generated in the plurality of terminal apparatuses 100-1 to 100-n can be generated in a manner that, when decrypted using a key, the following property is satisfied.

[0090] [Mathematical Formula 1]

[0091] Dec(ct, sk) =<ct, sk>= ΔM+e(mod q)

[0092] Here, the <with> denotes a usual inner product, ct denotes a ciphertext, sk denotes a secret key, the M denotes a plaintext message, the e denotes an encryption error value, the Δ denotes a scaling factor, and the q denotes a modulus of a ciphertext. It is necessary that the q must be greater than the ΔM, which is a resulting value obtained by multiplying a message by a scaling factor. If an error value e is sufficiently small compared to the ΔM, ΔM + e, which is a decrypted value of the ciphertext, can be a value that can replace the original message with the same precision in significant numerical calculations. From the decrypted data, the error can be arranged at a least significant bit (LSB) side, and the ΔM can be arranged at a second least significant bit side.

[0093] If a size of the message is too small or too large, the size can be adjusted using a scaling factor. When a scaling factor is used, a message in a real number form and a message in an integer form can be encrypted, thus can significantly increase the availability. In addition, by adjusting a size of the message using the scaling factor, a size of a domain of a message presented in the ciphertext after the calculation, i.e., a size of a valid domain, can be adjusted.

[0094] In one embodiment, a ciphertext modulus q can be set and used in various forms. For example, a modulus of a ciphertext can be set as q = Δ L , which is a power of a scaling factor. If Δ is 2, it can be set as a value such as q = 2 10 .

[0095] As another example, a ciphertext modulus can be set as a value obtained by multiplying a plurality of different scaling factors. The plurality of respective factors can be set as a plurality of values within a similar range, i.e., a plurality of values of a similar size. For example, this can be set such that q = q1q2q3,..., q x , where q1q2q3,..., q xEach of the ciphertexts has a similar size to the scaling factor Δ, and is set to a plurality of values in a disjoint relationship with each other. When a scaling factor is set in this way, the entire calculation can be divided into a plurality of modulus computations according to the Chinese Remainder Theorem (CRT), and thus the calculation burden can be reduced. In addition, when a rounding process is performed in the plurality of steps to be described later using factors of similar sizes, a result almost identical to the result value in the previous example can be obtained.

[0096] As described above, the ciphertexts generated in the plurality of respective terminal devices 100-1 to 100-n can be processed by the first server device 200, and then transmitted to the second server device 300 in a form of a ciphertext. The second server device 300 can decrypt the obtained ciphertext using a key. Since a homomorphic encryption process has been performed, the decrypted data can be a value such as a result obtained by decrypting the message itself and performing a calculation process on the decrypted message. As a result, it is possible to prevent the risk of leakage to a third party in the intermediate process.

[0097] In the embodiment of Figure 1 In the embodiment of

[0098] A Ring-LWE method can be used in the key generation process. When it is assumed that the second server device 300 generates the key, the second server device 300 can set various parameters and rings. For example, various parameters such as a length of a plurality of plaintext message bits, a size of the public key and the key, and the like can be set.

[0099] The ring can be expressed as a mathematical formula as shown below.

[0100] [mathematical formula 2]

[0101]

[0102] The ring refers to a set of polynomials with a predetermined coefficient. For example, the ring means having a coefficient Z. q A set of n-th polynomials. In the mathematical formula 2, f(x) denotes an n-th polynomial. For example, if n is Φ(N), then f(x) denotes an n-th cyclotomic polynomial. (F(x)) denotes Z generated by f(x). q An ideal value for [x]. An Euler totient function, Φ(N), denotes the number of natural numbers less than N that do not intersect N. When Φ N When (x) is defined as an nth-order cyclotomic polynomial, a ring can be expressed as shown in the following mathematical formula.

[0103] [Mathematical Formula 3]

[0104]

[0105] Then, the second server device 300 can calculate a key (sk) from the ring.

[0106] [Mathematical Formula 4]

[0107]

[0108] The s(x) denotes a polynomial randomly generated with a small coefficient.

[0109] The second server device 300 can compute a first random polynomial (a(x)) from the ring. The first random polynomial can be expressed as follows.

[0110] [Mathematical Formula 5]

[0111] a(x)<- R

[0112] Additionally, the second server device 300 can extract an error from a discrete Gaussian distribution or a distribution within a short statistical distance thereof. This error can be expressed as the mathematical formula described below.

[0113] [Mathematical Formula 6]

[0114]

[0115] When an error is calculated, the second server device 300 can modulate the error with the first random polynomial and the key, and calculate a second random polynomial. The second random polynomial can be expressed as follows.

[0116] [mathematical formula 7]

[0117] b(x) = -a(x)s(x) + e(x) (mod q)

[0118] Finally, the public key (pk) can be set as follows, thereby including the first random polynomial and the second random polynomial.

[0119] [mathematical formula 8]

[0120] pk = (b(x), a(x))

[0121] The second server device 300 can transmit the generated public key to the respective terminal devices 100-1 to 100-n. The plurality of respective terminal devices 100-1 to 100-n can store the obtained public key, and then use the stored public key for encryption.

[0122] In the above-described example, it is described that the second server device 300 generates a public key and a key. However, in another example, the plurality of respective terminal devices 100-1 to 100-n or another device can generate at least one of a public key or a key, and then share it with another device. In addition, the key generation method described as above is only an example, and is not limited thereto. A public key and a key can be generated in different ways.

[0123] Figure 2 is a block diagram illustrating a configuration of a terminal device 100 and a server device 200 according to an embodiment of the disclosure.

[0124] Referring to Figure 2 , the terminal device 100 can include a memory 110, a processor 120, and a communicator 130.

[0125] The memory 110 is configured to store an operating system (O / S), various software required to operate the terminal device 100, and data. The memory 110 can be various forms such as RAM, ROM, flash memory, HDD, external memory, memory card, etc., and is not limited to any form.

[0126] The memory 110 can store a public key, a scaling factor, etc.

[0127] The processor 120 is an element for executing a program stored in the memory 110 and performing various computing operations.

[0128] The communicator 130 is a configuration for performing communication with an external device. The communicator 130 can be implemented to support not only wireless communication such as Wi-Fi, Zigbee, Bluetooth, and NFC, but also wired communication through various wired communication interfaces.

[0129] The processor 120 can reflect a scaling factor in a message to be encrypted, and then encrypt the message using a public key and generate a homomorphic ciphertext. The processor 120 can control the communicator 130 so that the generated homomorphic ciphertext is transmitted to an external device.

[0130] The homomorphic ciphertext is generated to satisfy a property in Mathematical Formula 1 as described above. For example, the processor 120 can multiply a message M to be encrypted by a scaling factor Δ, and calculate a ΔM, which is an integer or a polynomial of an integer coefficient.

[0131] Then, a polynomial v can be randomly decided. The processor 120 can calculate the v from a small distribution (for example, a discrete Gaussian distribution or a distribution similar thereto). The processor 120 can obtain errors e0 and e1 from a small error distribution (for example, a discrete Gaussian distribution or a distribution similar thereto).

[0132] The processor 120 can generate a public key pk = (b(x), a(x)), and generate a ciphertext using the mathematical formula as shown below.

[0133] [mathematical formula 9]

[0134]

[0135] A message to be encrypted can be received from an external source or can be input from an input device provided directly in the terminal device 100 or from an input device connected to the terminal device 100. Also, a scaling factor can be input directly by a user or can be provided through another device. For example, in the case where the terminal device 100 includes a touch screen or a keyboard, the processor 120 can store data input by the user through the touch screen or keyboard in the memory 110 and then encrypt the stored data. The generated homomorphic ciphertext can be recovered to a result value when decrypted, which is a value obtained by adding an error to a value in which a scaling factor is reflected in the message. The scaling factor can be directly set using a value input in advance.

[0136] According to various embodiments, the modulus q of the ciphertext as described above can be set differently. For example, the processor 120 can set the ciphertext modulus in the form of an exponentiation of a scaling factor (scaling factor) Δ q = Δ L The processor 120 can set the ciphertext modulus to a value obtained by multiplying different scaling factors. The processor 120 can store the set ciphertext modulus in the memory 110. As described above, the respective factors can be in a mutually disjoint relationship within a similar range.

[0137] The processor 120 can use an error for encryption of a public key. An error can be calculated according to a discrete Gaussian distribution or a distribution within a short statistical distance thereof. For example, an error in the form of mathematical formula 6 as shown above can be calculated. When a message is input, the processor 120 can add an error to a value obtained by multiplying the message by the scaling factor and then encrypt using a public key. In this case, an error value obtained when the ciphertext is decrypted can be obtained differently from an initial error added when encryption is performed.

[0138] Alternatively, encryption can be performed using the public key immediately in a state in which the message is multiplied by the scaling factor. In this case, an error obtained in the encryption process can be added to a result value obtained by multiplying the message by the scaling factor.

[0139] The processor 120 can generate a length of ciphertext to correspond to a size of the scaling factor.

[0140] Meanwhile, according to one embodiment, packing can be performed. When a packing is used in the homomorphic encryption, it is possible to encrypt multiple messages into a single ciphertext. In this case, when computations between the multiple respective ciphertexts are performed in the first server device 200, the computations of the multiple messages can be processed in parallel, thus significantly reducing the computational burden.

[0141] When the message is implemented as multiple message vectors, the processor 120 can convert the multiple message vectors into a polynomial in a form that can be encrypted in parallel, then multiply the polynomial by a scaling factor and perform homomorphic encryption using the public key. Thus, a ciphertext generated by packaging the multiple message vectors can be produced.

[0142] For example, the processor 120 can utilize an n-th cyclotomic polynomial. In a complex number It contains a different number Multiple roots The fact that there are primitive N-th roots of unity. Homomorphic encryption of multiple messages is possible simultaneously by employing the concept of complex numbers, which will be described later.

[0143] Then, a canonical embedding function can be modified, and a packing function (σ) can be computed. The canonical embedding function is a polynomial... Corresponding to (n / 2) roots A pair The value is not from The plurality of roots A function of a complex conjugate relationship. The fact that the function is homomorphic can be easily verified by those skilled in the art.

[0144] The canonical embedding function is represented as a matrix (C) as shown below.

[0145] [Mathematical Formula 10]

[0146]

[0147] When a polynomial M(x) is expressed as a column vector of coefficients, M = (M0,..., M n-1 ), the polynomial M(x) can have a relationship with a packing function of the polynomial , i.e., a relationship as shown below.

[0148] [mathematical formula 11]

[0149]

[0150] As described above, in a state in which a canonical embedding function is calculated, when a plurality of (for example, n / 2) message vectors are input, the processor 120 can convert the message vectors into a polynomial using the above-described canonical embedding function.

[0151] [mathematical formula 12]

[0152]

[0153] The polynomial M(x) converted in the manner of mathematical formula 12 satisfies a relationship as shown below.

[0154] The processor 120 can add a scaling factor to the polynomial converted in the above-described manner, and then homomorphically encrypt using a public key. For example, homomorphic encryption can be performed using a ring learning with errors (LWE), which is one of homomorphic encryption methods.

[0155] A specific ciphertext can be expressed in the form shown below.

[0156] [mathematical formula 13]

[0157]

[0158] As described above, the homomorphic ciphertext generated by the terminal device 100 can be provided to the first server device 200. The first server device 200 can store the homomorphic ciphertext received from the terminal device 100, and use the stored homomorphic ciphertext in a subsequent calculation process. The calculation process that the first server device 200 can perform is not only with respect to a plurality of homomorphic ciphertexts received from a plurality of different terminal devices, but also with respect to a plurality of homomorphic ciphertexts received from one terminal device 100.

[0159] ​​The first server apparatus 200 can be implemented to include a memory 210, a processor 220, and a communicator 230.

[0160] The communicator 230 can receive various homomorphic ciphertexts from the terminal apparatus 100. The respective homomorphic ciphertexts mean data individually encrypted in different terminal apparatuses or one terminal apparatus.

[0161] The processor 220 can store the received homomorphic ciphertexts in the memory 210. Figure 2 The memory 210 is illustrated. However, the first server apparatus 200 can further include an additional storage for storing large capacity data, and can be separately connected to an external storage device and store the respective homomorphic ciphertexts in the external storage device.

[0162] The processor 220 can perform a preset computation with respect to a plurality of homomorphic ciphertexts. One computation to be performed can be directly performed by a manger of the first server apparatus 200, and can be requested from the second server apparatus 300.

[0163] For example, the computation can be set to a canonical computation such as multiplication, division, addition, and subtraction, but is not limited thereto. For example, in a case where an encrypted message is a complex number, a conjugate computation can be performed, or a computation such as statistics and sorting can be performed.

[0164] In a case where each of the plurality of homomorphic ciphertexts is a ciphertext generated by packing a plurality of message vectors, the processor 220 can perform a computation process with respect to a plurality of polynomials included in each of the plurality of ciphertexts in parallel. In this case, a computation order of a plurality of ciphertexts can be rotated, or can be randomly mixed and a computation is performed. The detailed computation operation of the second server apparatus 200 will be described again in detail as follows.

[0165] In Figure 2In the above-described example, each of the terminal device 100 and the first server device 200 includes a communicator, a memory, and a processor. However, the example is not limited thereto. That is, according to the type and use environment of each device, various elements such as an input means, a display, and a bus can be further included. For example, the terminal device 100 can further include an input interface (not shown) configured to receive an input of a message to be transmitted or a scaling factor. The processor 120 can store a message or a scaling factor input via the input interface in the memory 110. In addition, the processor 120 can set a modulus of a ciphertext using the input scaling factor in various ways described above, and then store the set modulus in the memory 110.

[0166] Figure 3 FIG. 4 is a flowchart of an encryption method of a terminal device according to an embodiment of the disclosure.

[0167] Referring to Figure 3 At operation S310, the terminal device 100 can set a scaling factor. The method for setting the scaling factor can be implemented in various ways as described above.

[0168] The terminal device 100 can store the set scaling factor. At operation S320, when a message to be encrypted is generated, the terminal device 100 can reflect the scaling factor in the message and then homomorphically encrypt using a public key. The public key can be directly generated by the terminal device 100 or can be provided from an external device.

[0169] Figure 4 FIG. 5 is a flowchart of a ciphertext processing method of a server device according to an embodiment of the disclosure. As Figure 1 As shown in the above-described example, a ciphertext processing process is performed in the first server device, and thus a method performed by the first server device is described.

[0170] Referring to Figure 4 At operation S410, the first server device 200 can receive a plurality of homomorphic ciphertexts. The respective homomorphic ciphertexts mean data generated by homomorphic encryption using a public key in a state in which a scaling factor is applied.

[0171] At operation S420, when a computation request is input from an external device or a manager, the first server device 200 can perform the requested computation on a plurality of homomorphic ciphertexts at operation S430. When the computation is completed, the first server device 200 can detect data of a valid domain from computation result data. The first server device 200 can perform a rounding process on the computation result data and detect data of a valid domain. The rounding process means rounding-off of a message in an encrypted state, and can be different from the so-called rescaling. For example, the first server device 300 can multiply each component of the ciphertext by a reciprocal of a scaling factor Δ -1 , and round the result, and eliminate a noise domain. The noise domain can be determined in a size corresponding to the scaling factor. As a result, a message of a valid domain excluding the noise domain can be detected. Since the rounding process is performed in an encrypted state, a further error occurs. However, the error is small enough to be ignored.

[0172] Figure 5 is provided to specifically illustrate Figure 4 a ciphertext processing method.

[0173] For example, at operation S510, when a multiplication computation on a first homomorphic ciphertext 51 and a second homomorphic ciphertext 52 is requested, the first server device 200 can perform multiplication in an encrypted state and generate a computation ciphertext 53. The obtained computation ciphertext 53 can include a message part (Δ 2 M1M2) reflecting a scaling factor and error data (e mult ). A size of the error data is increased in the multiplication process, but a size of the message part is reduced as will be described later, so there is no problem. This is also applicable to addition.

[0174] Then, the size of the message part (Δ 2M1M2) can be reduced to a part corresponding to a significant number, that is, a significant field, and a final computation ciphertext 54 can be generated. As described above, the second server apparatus 200 can eliminate a noise field by multiplying the computation ciphertext 53 by an inverse of the scaling factor, and then rounding the result. As a result, a final computation ciphertext 54 including data (ΔM1M2)'+e') corresponding to the significant field can be generated. Through this process, a further error is generated and the error data (e mult ) is changed to e', but a size of the error is small enough to be ignored.

[0175] Figure 6 A method of performing a computation in a case where a plurality of messages are encrypted as a ciphertext by the above-described packing method is illustrated. For convenience of explanation, a ciphertext generated by encrypting a plurality of message vectors is referred to as a packing ciphertext. Referring to Figure 6 , a first packing ciphertext (ct) is a ciphertext generated by encrypting a vector including a plurality of messages 61-1 to 61-k, and a second packing ciphertext (ct') is a ciphertext generated by encrypting a vector including a plurality of messages 62-1 to 62-k.

[0176] When a computation with respect to the first packing ciphertext (ct) and the second packing ciphertext (ct') is requested, the first server apparatus 200 can perform a computation with respect to the two ciphertexts by using the method of the above-described embodiment. Thus, a single instruction multiple data (SIMD) computation in which parallel processing of a plurality of data can be performed by a single ciphertext computation can be performed.

[0177] Referring to Figure 6 , a first message component 61-1 of the first packing ciphertext (ct) can be multiplied by a first message component 62-1 of the second packing ciphertext (ct'). At the same time, multiplication of second message components 61-2 and 62-2 can be performed. As a result, a final packing ciphertext (ct mult ) can be understood as a ciphertext generated by encrypting a plurality of vectors 63-1 to 63-k including values obtained by multiplying message components located at the same position.

[0178] Figure 7This is a diagram used to explain a method for changing and processing certain homomorphic ciphertexts during a SIMD computation. (Reference) Figure 7 A new second packaged ciphertext (ct') can be generated using the first packaged ciphertext (ct). The first packaged ciphertext (ct) can be shifted such that a first component of the second packaged ciphertext matches a second message component of the first packaged ciphertext. Simultaneously, a second component of the second packaged ciphertext can be equal to a third message component of the first packaged ciphertext. As a result, the second packaged ciphertext is a packaged ciphertext for which a new message vector generated by shifting multiple positions of all messages in the first packaged ciphertext is encrypted. In this specification, the operation of shifting a position of the ciphertext as described above will be referred to as a rotation process.

[0179] Figure 8 It is used for a comprehensive explanation Figure 1 A timing diagram of an operation in a network system. Figure 8 The text describes the situation where a ciphertext is sent from two terminal devices 100-1 and 100-2.

[0180] First, in operation S810, when a first message is received from a terminal device 1100-1, in operation S8150, the terminal device 1100-1 can generate a first homomorphic ciphertext as described above, and in operation S820, send the generated first homomorphic ciphertext to the first server device. For example, in the case of a user capturing an image on the terminal device 1100-1, the image and a capture location can be encrypted, and in the case of the user reproducing music content or accessing a specific URL, the reproduction history and the URL access history can be encrypted.

[0181] At operations S825, S830, and S835, a terminal device 2100-2 can generate a ciphertext in a similar manner and send the generated ciphertext to the first server device 200.

[0182] The first server device 200 can store the received ciphertext while it is encrypted. In this state, at operation S840, when the second server device 300 requests a specific calculation, at operation S845, the first server device 200 can perform a calculation while in the encrypted state, and at operation S850, send the ciphertext that has undergone the calculation to the second server device. The second server device 300 can decrypt the received ciphertext and detect the message.

[0183] For example, when the second server device 300 uses a key sk = (1, s) to decrypt a ciphertext generated by encryption as shown in mathematical formula 9, the result can be expressed as the following mathematical formula.

[0184] [Mathematical Formula 14]

[0185] <C txt , sk>= (v·b(x) + △·M + e0) + s(x)(v·a(x) + e1)

[0186] = v(b(x) + a(x)s(x)) + △·△ + e0+ s(x)·e1

[0187] = △·M + (v·e + e0+ s(x)·e1)

[0188] = △·M + e small

[0189] The result is that the decrypted data includes an error of a small size e. small The value is added to a value obtained by multiplying the scaling factor by a value obtained from the message, and the error can be arranged on the LSB side, and the ΔM can be arranged at a position adjacent to the error.

[0190] For example: assuming a first message is 1.23, a second message is 3.45, and a scaling factor is Δ = 103, ΔM1 + e1 ≒ 1230, and ΔM2 + e2 ≒ 3450, where ≒ means approximately. When performing a multiplication calculation in the first server device 200, the data can be Δ 2 M1M2+ e total ≒ 4243500. When the resulting value is multiplied by Δ -1 Then, after a rounding process, 4243 is obtained. The second server device 200 can obtain this result value by decryption.

[0191] The second server device 300 can output a decrypted message at operation S860. For example, when terminal device 1 100-1 and terminal device 2 100-2 are respectively in the state of sending an image to the first server device 200, the second server device 300 can output a photo captured at one time by the plurality of respective devices 100-1 and 100-2.

[0192] In the above embodiments, it is shown and described that a calculation between ciphertexts is performed in the first server device 200, and a noise domain is eliminated from the ciphertexts before the ciphertexts are sent to the second server device 300. However, the example is not limited to this. For example, if the second server device 300 knows information about the scaling factor, it can directly eliminate the noise domain and detect a valid domain before continuing the decryption.

[0193] Furthermore, the encryption method and ciphertext processing method described above can be applied to a real number plaintext.

[0194] Figure 9 This is a diagram illustrating a configuration of a network system according to an embodiment of the present disclosure.

[0195] refer to Figure 9 The network system may include a plurality of terminal devices 100-1 to 100-n, a first server device 200 and a second server device 300, and the plurality of respective components may be connected to each other via a network 10.

[0196] The network 10 can be implemented as a wired / wireless communication network, a broadcast communication network, an optical communication network, and various types of cloud networks, and the plurality of respective devices can be connected in the same way as Wi-Fi, Bluetooth, and Near Field Communication (NFC) without any additional medium.

[0197] exist Figure 9 The diagram illustrates the presence of multiple terminal devices 100-1 to 100-n. However, multiple terminal devices must be used; alternatively, a single device can be used. For example, the terminal devices 100-1 to 100-n can be implemented as various forms of devices, such as a smartphone, a tablet PC, a game console, a desktop PC, a laptop PC, a home server, and an information kiosk, and can also be implemented as a home appliance applying Internet of Things (IoT) technology.

[0198] The user can input various information through the terminal device he or she uses. The input information can be stored within the plurality of terminal devices 100-1 to 100-n themselves, but can also be sent to an external device for storage and other reasons such as storage capacity and security. Figure 1 In this process, the first server device 200 can serve as a storage unit for this information, and the second server device 300 can serve as a utilization unit for some or all of the information stored in the first server device 200.

[0199] The plurality of respective terminal devices 100-1 to 100-n can perform homomorphic encryption on the input information and send the homomorphic ciphertext to the first server device 200. The first server device 200 can store the obtained homomorphic ciphertext without decryption.

[0200] The second server device 300 can request a specific processing result of homomorphic ciphertext from the first server device 200. The first server device 200 can perform a specific calculation based on the request and then send the result to the second server device 300. For example, if ciphertexts ct1 and ct2 obtained from two terminal devices 100-1 and 100-2 are stored in the first server device 200, the second server device 300 can request a value obtained by adding the information provided from the two terminal devices 100-1 and 100-2 to the first server device 200. The first server device 200 can perform the calculation to add the two ciphertexts and then send the resulting value (ct1 + ct2) to the second server device 300.

[0201] The plurality of respective terminal devices 100-1 to 100-n may include an encryption noise, i.e., an error, calculated during the homomorphic encryption process. For example, the homomorphic ciphertext generated in the plurality of respective terminal devices 100-1 to 100-n can be generated in such a way that, when decrypted using a key, a result value including a message and an error value is recovered.

[0202] For example, homomorphic ciphertext generated in terminal devices 100-1 to 100-n can be generated such that the following properties are satisfied when decrypted using a single key.

[0203] [Mathematical Formula 1]

[0204] Dec(ct,sk) =<ct,sk> = ΔM+e(mod q)

[0205] Here, < and > denote a typical inner product, ct denotes a ciphertext, sk denotes a key, M denotes a plaintext message, e denotes an encryption error value, Δ represents a scaling factor, and q represents the modulus of the ciphertext. q must be greater than ΔM, which is a result obtained by multiplying a message by a scaling factor. If an error value e is sufficiently small compared to ΔM, then ΔM+e, as a decrypted value of the ciphertext, can be a value that can replace the original message with the same precision in important numerical calculations. From the decrypted data, the error can be placed on the least significant bit (LSB) side, and ΔM can be placed on the second least significant bit side.

[0206] If the size of the message is too small or too large, a scaling factor can be used to adjust the size. When a scaling factor is used, a message in real number form and a message in integer form can be encrypted, thus significantly increasing usability. Furthermore, by adjusting the size of the message using the scaling factor, the size of a field of the message present in the ciphertext, i.e., the size of a valid field, can be adjusted after the calculation is performed.

[0207] In one embodiment, a ciphertext modulus q can be set and used in various forms. For example, the modulus of a ciphertext can be set as a power of a scaling factor, q = Δ. L If the stated Δ is 2, it can be set to something like q = 2. 10 One value.

[0208] As another example, a ciphertext modulus can be set as a set of disjoint integer values. For example, it can be set as q = q1q2q3, ...,q x , where q1q2q3, ...,q x Each of the values ​​in the matrix has a similar size to the scaling factor Δ and is set to values ​​that are disjoint from each other. When a scaling factor is set in this way, the entire computation can be divided into multiple modular computations according to a Chinese Remainder Theorem (CRT), thus reducing the computational burden. A method using multiple disjoint integer values ​​will be called the RNS HEAAN method, and will refer to... Figure 12 to Figure 16 The method will be described in more detail below.

[0209] As described above, the ciphertext generated in each of the respective terminal devices 100-1 to 100-n can be processed by the first server device 200 and then sent to the second server device 300 as ciphertext. The second server device 300 can use a key to decrypt the obtained ciphertext. Since homomorphic encryption has been performed, the decrypted data can be a value obtained, such as by decrypting the message itself and performing computational processing on the decrypted message. As a result, the risk of leakage to third parties during intermediate processing can be prevented.

[0210] exist Figure 9 In this embodiment, a public key used for encryption can be generated by the respective terminal devices, or it can be generated in the second server device 300 for decryption and then distributed to the respective terminal devices. Hereinafter, for ease of explanation, the generation of various keys on the terminal device 100 side will be described.

[0211] A Ring-LWE method can be used in the key generation process.

[0212] The terminal device 100 can receive input of various parameters for generating a key and setting a ring. For example, various parameters can be set, such as the length of the plaintext message bits, the size of the public key and the private key, etc. In addition, the terminal device 100 can generate a setting parameter based on the received parameters, which is required to generate a private key and a public key.

[0213] The ring can be represented by the mathematical formula shown below.

[0214] [Mathematical Formula 2]

[0215]

[0216] Here, R represents a ring, Zq represents a coefficient, and f(x) represents an nth-order polynomial.

[0217] The ring is a polynomial with a set of predetermined coefficients, wherein addition and multiplication are defined among the plurality of elements, and is a closed set for addition and multiplication. The ring may be referred to as an annulus.

[0218] In the mathematical formula 2 shown above, if n is Φ(N), then f(x) represents an nth-order cyclotomic polynomial. (F(x)) represents an ideal value of Zq[x] generated by f(x). An Euler totient function Φ(N) represents the number of natural numbers that do not intersect N and are less than N, when Φ...N When (x) is defined as an nth-order cyclotomic polynomial, a ring can be represented by the mathematical formula shown below. Additionally, when a reciprocal equation is used in the polynomial shown above, the ring can be represented by mathematical formula 15.

[0219] [Mathematical Formula 3]

[0220]

[0221] [Mathematical Formula 15]

[0222]

[0223] The ring described in mathematical formulas 3 and 15 above has a complex number in a plaintext space. In this disclosure, to improve the computation speed with respect to a homomorphic ciphertext, only a set of rings described above whose plaintext space is a real number can be used. Here, a ring whose plaintext space is a real number will be referred to as R', which can be expressed as the mathematical formula shown below. A method using R' will be referred to as a Real HEAAN method.

[0224] [Mathematical Formula 16]

[0225] X -1 :=-X n-1 X represents -1 Assigned the value -X n-1

[0226] When such a ring is set up, the terminal device 100 can calculate a key (sk) from the ring.

[0227] [Mathematical Formula 17]

[0228]

[0229] Here, the S designation is randomly generated as a value with a small coefficient.

[0230] Additionally, the terminal device 100 can compute a first random polynomial (a) from the ring. The first random polynomial can be expressed as follows.

[0231] [Mathematical Formula 18]

[0232]

[0233] Additionally, the terminal device 100 can calculate an error. For example, the terminal device 100 can extract an error from a discrete Gaussian distribution or a distribution within a short statistical distance of it. This error can be expressed as follows.

[0234] [Mathematical Formula 19]

[0235]

[0236] When an error is calculated, the terminal device 100 can modulate the error using the first random polynomial and the key, and calculate a second random polynomial. The second random polynomial can be expressed as follows.

[0237] [Mathematical Formula 20]

[0238]

[0239] Finally, the public key (pk) can be set as follows, thereby including the first random polynomial and the second random polynomial.

[0240] [Mathematical Formula 21]

[0241]

[0242] The terminal device 100 can send the generated public key to other terminal devices 100-2 to 100-n and / or server device 200.

[0243] In the example described above, the terminal device 100 generates a public key and a private key. However, in another example, the server device 200 or another device may generate at least one of a public key or a private key and then share it with another device. Furthermore, the key generation method described above is merely an example and is not limited thereto. A public key and a private key can be generated in different ways.

[0244] The following will refer to Figure 12 The operation of generating a public key and a private key is described in more detail.

[0245] Figure 10 This is a block diagram illustrating a simplified configuration of a terminal device according to an embodiment of the present disclosure.

[0246] refer to Figure 10 The terminal device 100 may include a memory 110 and a processor 120.

[0247] The memory 110 is configured to store an operating system (O / S) and various software and data required to operate the terminal device 100. The memory 110 can be in various forms, such as RAM, ROM, flash memory, HDD, external memory, memory card, etc., and is not limited to any particular form.

[0248] The memory 110 can store a message to be encrypted. Here, the message may be various credit information, personal information, etc. used by the user, and may also be information related to a usage history used in the terminal device 100, such as location information, Internet usage time information, etc.

[0249] Additionally, the memory 110 can store a public key, and if the terminal device 100 is a device that directly generates the public key, it can store various parameters required to generate a public key and a private key.

[0250] Additionally, the memory 110 may store homomorphic ciphertext generated during the following processing.

[0251] The processor 120 can be configured to control each component in the terminal device 100. The processor 130 can be implemented as a single device, such as a CPU, or as multiple devices, such as a clock generation circuit, a CPU, a graphics processor, etc.

[0252] Additionally, the processor 120 can execute a program stored in the memory 110 and generate a key and a public key for generating homomorphic ciphertext. To this end, the processor 120 can primarily establish a ring, which is a set of polynomials with preset coefficients. In this case, the ring can satisfy mathematical formulas 15 or 16 shown above.

[0253] Additionally, the processor 120 can compute a key from the ring. For example, the processor 120 can compute a key (SK) from the ring based on the following mathematical formula.

[0254] Additionally, the processor 120 can compute a first random polynomial (a) from the ring and extract an error from a discrete Gaussian distribution or a distribution within a short distance therefrom.

[0255] Additionally, the processor 120 can modulate an error into the first random polynomial and the key, calculate a second random polynomial, and finally generate a public key (pk), which includes the first random polynomial and the second random polynomial. When the terminal device 100 supports RNS HEAAN, the processor 120 can generate multiple public keys corresponding to multiple disjoint integers.

[0256] Additionally, the processor 120 can generate a homomorphic ciphertext for a message. For example, the processor 120 can apply the previously generated public key to the message and generate a homomorphic ciphertext.

[0257] When the terminal device 100 supports RNS HEAAN, the processor 120 can generate homomorphic ciphertext expressed as multiple cardinalities by using multiple public keys corresponding to multiple disjoint integers in the message.

[0258] Additionally, the processor 120 can compute a message to be encrypted into a polynomial corresponding to the ring, and apply the public key to the obtained polynomial to generate homomorphic ciphertext. A message to be encrypted can be received from an external source, or input from an input device directly provided in the terminal device 100 or from an input device connected to the terminal device 100. Furthermore, a scaling factor can be directly input by a user, or provided by another device.

[0259] According to an embodiment, the modulus q of the ciphertext described above can be set differently. For example, the processor 120 can use a scaling factor Δ raised to the power of q = Δ L The ciphertext modulus is set in the form of a plurality of disjoint integer values. As another example, the processor 120 may utilize a value that is set as a plurality of disjoint integer values.

[0260] Additionally, the processor 120 can generate a ciphertext length corresponding to the size of the scaling factor.

[0261] Meanwhile, according to one embodiment, packing can be performed. When a packing is used in the homomorphic encryption, it is possible to encrypt multiple messages into a single ciphertext. In this case, when calculations are performed between the respective ciphertexts in the first server device 200, the calculations of multiple messages can be processed in parallel, thus significantly reducing the computational burden.

[0262] When the message is implemented as multiple message vectors, the processor 120 can convert the multiple message vectors into a polynomial of a form capable of parallel encryption, then multiply the polynomial by a scaling factor and perform homomorphic encryption using the public key. Thus, a ciphertext generated by packaging multiple message vectors can be produced.

[0263] The processor 120 can perform calculations with respect to homomorphic ciphertext. For example, the processor 120 can perform calculations such as addition or multiplication while encrypting the homomorphic ciphertext. For example, the processor 120 can perform a first function processing procedure for the respective homomorphic ciphertexts to be used in the calculation, performing calculations such as addition or multiplication between the homomorphic ciphertexts that have already undergone the first function processing procedure, and perform a second function processing procedure, the second function processing procedure being an inverse function of the first function with respect to the homomorphic ciphertexts that have already undergone the calculation. Here, the first function can be a number-theoretical transformation (NTT) function.

[0264] When the homomorphic ciphertext is generated using the RNS method described above, the processor 120 can perform addition and multiplication on each cardinality in the generated homomorphic ciphertext.

[0265] Simultaneously, when the calculation is completed, the terminal device 100 can detect data in a valid field from the calculation result data. For example, the terminal device 100 can perform a rounding process on the calculation result data and detect data in a valid field. The rounding process means rounding off a message in an encrypted state, and can be referred to differently as rescaling. For example, the terminal device 100 can multiply each component of the ciphertext by a scaling factor Δ. -1 The result is taken as a reciprocal and rounded, eliminating a noise domain. The noise domain can be determined to be a size corresponding to the scaling factor. As a result, a message excluding a valid domain from the noise domain can be detected. Since the rounding process is performed in an encrypted state, further errors occur. However, these errors are small and can be ignored.

[0266] If the terminal device 100 supports RNS HEAAN, and if the weight of any one of the plurality of cardinalities exceeds a threshold, the processor 120 can perform a message rounding process with respect to each of the plurality of cardinalities of the generated homomorphic ciphertext and rescale the homomorphic ciphertext.

[0267] Furthermore, if the weight of an approximate message within the ciphertext of the computation result exceeds a threshold, the terminal device 100 may expand the plaintext space of the ciphertext. For example, if q in the mathematical formula 1 shown above is less than M, then M + e (mod q) has a different value than M + e, making decryption impossible. Therefore, the value of q must always be greater than M. However, as computation is performed, the value of q may be gradually reduced. This expansion of the plaintext space means changing a ciphertext (ct) to a ciphertext with a larger modulus. The operation of expanding the plaintext space can be alternatively referred to as rebooting. When rebooting is performed, the ciphertext can be in a state where it can be computed again.

[0268] Furthermore, although only a simplified configuration of the terminal device 100 has been shown and described above, various components may be additionally included in actual implementations. These will be referenced below. Figure 11 Described.

[0269] Figure 11 This is a block diagram illustrating a detailed configuration of a terminal device according to an embodiment of the present disclosure.

[0270] refer to Figure 11 The terminal device 100 may include a memory 110, a processor 120, a communicator 130, a display 140, and a control input device 150.

[0271] Since the memory 110 has been referenced Figure 10 The description is already provided, therefore repeated descriptions will be omitted. Additionally, the processor 120 in... Figure 10 This has already been explained. Therefore, for the sake of brevity, further explanation will not be provided below. Only... Figure 11 The added components will be explained as follows.

[0272] The communicator 130 is configured to connect the terminal device 100 to an external device (not shown), and can be connected not only via a local area network (LAN) or the Internet, but also via a universal serial bus (USB) port or a wireless communication port (e.g., Wi-Fi 802.11a / b / g / n, near field communication (NFC), or Bluetooth). The communicator 130 may be referred to as a 'transceiver'.

[0273] The communicator 130 can receive a public key from an external device and send a public key generated in the terminal device 100 to the external device.

[0274] Additionally, the communicator 130 can receive a message from an external device and send a generated homomorphic ciphertext to the external device.

[0275] Additionally, the communicator 130 can receive various parameters required to generate a ciphertext from an external device. In one implementation, these parameters can be received directly from a user via the manipulation input device 150, which will be described later.

[0276] The display 140 may display a user interface window to select a function supported by the terminal device 100. For example, the display 140 may display a user interface window to select various functions provided by the terminal device 100. The display 140 may be a monitor such as an LCD, CRT, OLED, etc., and may also be implemented as a touch screen, which can simultaneously perform the functions of the operation input device 150, which will be described later.

[0277] The display 140 may display a message requesting input of parameters needed to generate a key and a public key. Additionally, the display 140 may display a message allowing the encryption of a subject to select the message. In one implementation, the encryption subject may be directly selected by the user or automatically selected. That is, even if the user does not directly select the message, the personal information to be encrypted can be automatically selected.

[0278] The input device 150 can receive input from the user of a function selection or a control command regarding a corresponding function from the terminal device 100. For example, the input device 150 can receive input from the user of parameters required to generate a key and a public key. Additionally, the input device 150 can receive settings for a message to be encrypted from the user.

[0279] When the processor 120 receives parameters from the user that are required to generate a key and a public key, it can generate a setting parameter based on the received parameters, and generate a key and a public key based on the generated setting parameter.

[0280] Additionally, when it is necessary to generate ciphertext about the message, the processor 120 can apply the public key to the message and generate homomorphic ciphertext. For example, the processor 120 can convert the message into a polynomial, apply the public key to the converted message in polynomial form, and generate homomorphic ciphertext.

[0281] Furthermore, if it is necessary to decrypt the homomorphic ciphertext, the processor 120 can apply the key to the homomorphic ciphertext and generate a deciphertext in a polynomial form, and decode the deciphertext in the same polynomial form to generate a message. The generated message may include an error as described in mathematical formula 1 above.

[0282] Furthermore, if computation is required on the homomorphic ciphertext, the processor 120 can perform an addition or multiplication computation on multiple homomorphic ciphertexts requested by the user. A specific computation operation reference is provided below. Figure 15 and Figure 16 A more detailed explanation follows.

[0283] As described above, the terminal device 100 according to one embodiment can generate homomorphic ciphertext for the message, thus improving the stability of the message even when computation is required. Furthermore, the generated homomorphic ciphertext includes an error and can maintain stable security for biometric information requiring high security. Additionally, the terminal device 100 according to one embodiment uses a ring where the plaintext space is a real number, thus improving computation speed. That is, a parallel real number computation can be performed twice as often as a correlation technique ring using a complex plaintext space.

[0284] The following text will first describe an algorithm for the Real HEAAN method.

[0285] A calculation between multiple ciphertexts is performed on multiple elements. Therefore, it is necessary to improve the addition and multiplication calculations between them. Computational efficiency in this regard. Multiplication in the most straightforward (naive) way has a complexity of O(n^2).

[0286] To reduce this computational complexity, a numerical theory transformation (NTT) method is used in this disclosure. The NTT... m Mark from arrive It is a field isomorphism, and its inverse function is called INTT. m .

[0287] When the Fast Fourier Transform algorithm is applied, NTT m and INTT m It may have a time complexity of O(m log m).

[0288] In other words, To target In the case of being calculated, when the computation is performed as follows When the complexity is O(m log m), the complexity can be O(m log m).

[0289] A method for applying the above method to a loop will be described as follows.

[0290] When the respective elements belonging to the ring can satisfy and When, an element can be expressed as the mathematical formula shown below 22.

[0291] [Mathematical Formula 22]

[0292]

[0293] First, regarding NTT related to R' m (NTT' n / 2 ), It can be calculated and the function Φ can be expressed as the mathematical formula shown below 23.

[0294] [Mathematical Formula 23]

[0295]

[0296]

[0297] Additionally, regarding INTT related to R' m (INTT' n / 2 ), It can be calculated and can output a value as shown in mathematical formula 24.

[0298] [Mathematical Formula 24]

[0299]

[0300] Here,

[0301] .

[0302] Therefore, the mathematical formulas 23 and 24 shown above can be expressed as follows.

[0303] [Mathematical Formula 25]

[0304]

[0305] In other words, with Both NTT and anti-NTT can have a time complexity of O(n log n). Therefore, when satisfying... In one case, when When to be calculated, if as follows The calculation can then achieve a time complexity of O(n log n).

[0306] In the following text, reference will be made to Figure 12 to Figure 16 An algorithm for generating a key and a public key, a method for generating homomorphic ciphertext, and a computation method in the case of applying REAL HEAAN are described in more detail.

[0307] Figure 12 This is a diagram illustrating the process of generating a public key and a private key.

[0308] refer to Figure 12 A setup module 71 can receive inputs from a user of a scaling factor (Δ), a security parameter (λ), and a level parameter (L). Here, the scaling factor (Δ) is a parameter used to adjust the size of a message and is greater than 1. The security parameter (λ) is an index indicating a skimmed stability and can be referred to as computation complexity. The level parameter is an index indicating depth-supporting computation.

[0309] The setting module 71, which receives the parameters described above as input, can set the modulus, randomly select an integer (n) and a positive number (P), and output a setting parameter such as .

[0310] A key generation module 72 can receive input of a setting parameter previously generated in the setup module 71, and generate a secret key and a public key based on the received setup parameter.

[0311] For example: the key generation module 72 can be based on and Generate a key, and based on Calculate one error.

[0312] In addition, the key generation module 72 can generate keys such as The first random polynomial, and generates as follows A second random polynomial. Furthermore, based on the first and second random polynomials generated above, a public key, as shown in mathematical formula 21, can be generated.

[0313] Figure 13 This is a diagram illustrating the operation of generating a computation key.

[0314] refer to Figure 13 The calculation module 73 can calculate a value that satisfies , And e'<-Xerr, and calculate satisfy Therefore, the computing module 73 can output a computing key such as .

[0315] Figure 14 This is a diagram illustrating the process of generating and decrypting a near-encrypted ciphertext.

[0316] refer to Figure 14 An encoding module 74 can receive a message and a scaling factor as input, and reflect the scaling factor to the message and convert it into a polynomial form.

[0317] For example: when When a scaling factor greater than 1 is input, the encoding module 74 can output the message as a polynomial, as shown in mathematical formula 26.

[0318] [Mathematical Formula 26]

[0319]

[0320] Here, m(x) denotes a message in polynomial form.

[0321] Additionally, an encryption module 75 can receive the message in the polynomial form and reflect a public key to the received message to generate homomorphic ciphertext. For example, homomorphic ciphertext can be generated using the following mathematical formula 27.

[0322] [Mathematical Formula 27]

[0323]

[0324] Here, v denotes an element selected according to Xenc, and e0 and e1 represent an error value selected according to Xerr.

[0325] A decryption module 76 can receive ciphertext and a key as input, decrypt the ciphertext, and output a message including an error. For example, when the input ciphertext is as follows: In this case, the decryption module 76 can output a message such as .

[0326] The message output from the decryption module 76 is a message in polynomial form; therefore, the decoding module 77 can output a final message based on the message output from the decryption module 76 and the scaling factor. For example, in the polynomial message satisfying... In this case, the decryption module 76 can output a message such as .

[0327] Figure 15 This is a diagram illustrating the addition calculation of a isomorphic ciphertext.

[0328] refer to Figure 15 A first terminal device 81-1 can output a first homomorphic ciphertext Ct1 of a first message, and a second terminal device 81-2 can output a second homomorphic ciphertext Ct2 of a second message.

[0329] The computing module 83 of the server device that receives the first homomorphic ciphertext Ct1 and the second homomorphic ciphertext Ct2 can perform an addition calculation on the two homomorphic ciphertexts. For example: when satisfying In one case, the calculation module 83 can be as follows: Perform an addition operation on two homomorphic ciphertexts.

[0330] In other words, a first function processing procedure can be performed on two homomorphic ciphertexts to perform an addition calculation on the homomorphic ciphertexts that have already undergone the function processing procedure, and a second function processing procedure can be performed, which is an inverse function of the first function of the homomorphic ciphertexts that have already undergone the addition calculation, and an addition calculation is performed on the two ciphertexts.

[0331] Subsequently, when an actual value is required, a decryption module 85 can decrypt and decode the addition result and output the sum of the first and second messages.

[0332] Figure 16 This is a diagram illustrating the one-multiplication calculation of a isomorphic ciphertext.

[0333] refer to Figure 16A first terminal device 81-1 can output a first homomorphic ciphertext Ct1 of a first message, and a second terminal device 81-2 can output a second homomorphic ciphertext Ct2 of a second message. The computing module 87 of the server device, which receives the first homomorphic ciphertext Ct1 and the second homomorphic ciphertext Ct2, can perform a multiplication calculation on the two homomorphic ciphertexts. For example: when satisfying... In one case, the calculation module 87 can be as follows: The above describes the addition computation of two homomorphic ciphertexts. Here, let... .

[0334] In other words, a first function processing procedure can be performed on the two homomorphic ciphertexts to perform a multiplication calculation on the homomorphic ciphertexts that have already undergone the function processing procedure, and a second function processing procedure can be performed. The function processing procedure is an inverse function of the first function of the homomorphic ciphertexts that have already undergone the multiplication calculation, and the two ciphertexts are multiplied.

[0335] Furthermore, if the weight of an approximate message within the ciphertext of the obtained calculation result exceeds a threshold, a rescaling module 88 can expand a plaintext space of the ciphertext. For example, the rescaling module 88 can update the ciphertext as shown in the following mathematical formula 28.

[0336] [Mathematical Formula 28]

[0337]

[0338] Here, .

[0339] Subsequently, the decryption module 85 can decrypt and decode the addition result, and output the sum of the first message and the second message.

[0340] The actual HEAAN method is described above, and the RNS HEAAN method will be described below.

[0341] To address the issue that methods such as the Chinese Remainder Theorem are not applicable in previous HEAAN methods, the RNS HEAAN replacement is used. A previous encrypted space Therefore, the size of an error bit can have an approximate calculation result that is about five to ten times larger, but there is a performance improvement of three to ten times in terms of calculation speed.

[0342] The operation method is similar to the REAL HEAAN method described above, and the only difference is described below.

[0343] First, in the RNS HEAAN, a modulus can be defined as a plurality of disjoint integers, as shown in mathematical formula 29 below.

[0344] [Mathematical Formula 29]

[0345]

[0346] Therefore, the generated evaluation key can be expressed as mathematical formula 30 as shown below, and the public key can be expressed as multiple cardinalities corresponding to multiple disjoint numbers, as shown in mathematical formula 31.

[0347] [Mathematical Formula 30]

[0348]

[0349] Here, ,as well as .also, .

[0350] [Mathematical Formula 31]

[0351]

[0352] Here, and .

[0353] Therefore, given that a ciphertext is generated, a homomorphic ciphertext with multiple cardinalities, expressed as in mathematical formula 32 as shown below, can be generated.

[0354] [Mathematical Formula 32]

[0355]

[0356] Here, , and .

[0357] Simultaneously, the homomorphic ciphertext generated in the RNS HEAAN method can be performed as shown in mathematical formula 33 below. and Addition calculations.

[0358] [Mathematical Formula 33]

[0359]

[0360] Here, .

[0361] Simultaneously, the homomorphic ciphertext generated in the RNS HEAAN method can be processed as follows: and ) calculation.

[0362] First, you can mainly perform calculations such as those in mathematical formula 34.

[0363] [Mathematical Formula 34]

[0364]

[0365] Then, a modup operation can be performed as shown in mathematical formula 35.

[0366] [Mathematical Formula 35]

[0367]

[0368] Then, a secondary computation, such as that in mathematical formula 36, ​​can be performed.

[0369] [Mathematical Formula 36]

[0370]

[0371] Here, and .

[0372] Additionally, calculations such as those in mathematical formula 37 can be performed, and finally, a value such as that in mathematical formula 38 can be output.

[0373] [Mathematical Formula 37]

[0374]

[0375] [Mathematical Formula 38]

[0376]

[0377] Here, .

[0378] After calculation, if the ciphertext ( If the weight of at least one cardinality exceeds a threshold, then a rounding process for each cardinality among the multiple cardinality can be performed as shown in mathematical formula 39 below, and the homomorphic ciphertext can be rescaled. It can be output.

[0379] [Mathematical Formula 39]

[0380]

[0381] Figure 17 This is a flowchart for explaining an encryption method according to an embodiment of the present disclosure.

[0382] First, a loop of a set of polynomials with preset coefficients can be set at operation S910. For example, a loop such as the mathematical formula 16 closed with respect to addition and multiplication can be set, wherein addition and multiplication are defined among the plurality of elements, and a plaintext space can be set to a real number.

[0383] Additionally, at operation S920, a key can be computed from the ring. A key (s) can be selected based on Xkey, and a key (SK) can be computed based on the selected key (s).

[0384] Additionally, at operation S930, a public key corresponding to the obtained key can be computed. For example, a first random polynomial can be computed from the ring, an error can be extracted, the error can be modulated in the computed first random polynomial, and the key and a second random polynomial can be computed, and a public key can be computed using the computed first and second random polynomials.

[0385] Additionally, at operation S940, the public key can be applied to the message and a homomorphic ciphertext can be generated. For example, the message encoding can be performed by a polynomial corresponding to the ring, and the public key can be applied to the encoded message, and a homomorphic ciphertext can be generated. When using the RNS HEAAN, homomorphic ciphertext expressed as multiple cardinalities can be generated using a single generated public key.

[0386] As described above, the encryption method according to one embodiment generates homomorphic ciphertext, which includes errors, thus maintaining stable security for biometric information requiring high security. Furthermore, since the encryption method according to one embodiment can use a ring where the plaintext space is a real number, the increase of the imaginary part of the plaintext is initially prevented during the computation process, and it supports twice the parallel real number computation with the same stability, computational speed, and memory (ciphertext and key size) as the previous HEAAN.

[0387] Figure 18 This diagram illustrates a method for ciphertext processing in a network system according to an embodiment of the present disclosure. Figure 18 The case of sending a ciphertext from two terminal devices 100-1 and 100-2 is described.

[0388] First, in operation S1010, when a first message is received from a terminal device 1100-1, in operation S1015, the terminal device 1100-1 can generate a first homomorphic ciphertext as described above, and in operation S1020, send the generated first homomorphic ciphertext to the first server device. For example, in the case of a user capturing an image on the terminal device 1100-1, the image and a capture location can be encrypted, and in the case of the user reproducing music content or accessing a specific URL, the reproduction history and the URL access history can be encrypted.

[0389] At operations S1025, S1030, and S1035, a terminal device 2100-2 can generate a ciphertext in a similar manner and send the generated ciphertext to the first server device 200.

[0390] The first server device 200 can store the received ciphertext while it is being encrypted. In this state, at operation S1040, when the second server device 300 requests a specific computation, at operation S1045, the first server device 200 can perform a predetermined computation requested by the second server device 300 for the homomorphic ciphertext. Then, at operation S1050, the ciphertext is sent, and the predetermined computation has been performed on the second server device. The second server device 300 can decrypt the received ciphertext and detect the message.

[0391] Additionally, during operation S1060, the second server device 300 can output a decrypted message. For example, when terminal device 1 100-1 and terminal device 2 100-2 have each sent an image to the first server device 200, the second server device 300 can output a photo captured at once by each of the respective devices 100-1 and 100-2.

[0392] The encryption and ciphertext processing methods described above can be used not only to collect the execution results of various applications, but also to collect various credit or personal information directly input by a user. In the case where the second server device 300 is a bank server, the bank can collect only the necessary items from the customer's credit information and identify only the collected items.

[0393] Meanwhile, the encryption method and ciphertext processing method according to the various embodiments described above can be implemented in the form of program code for performing each step, stored in a recording medium, and distributed. In this case, a device on which the recording medium is mounted can perform the above-described encryption or ciphertext processing operations.

[0394] The recording medium can be any type of computer-readable medium, such as ROM, RAM, a memory chip, a memory card, an external hard drive, a hard disk, an optical disc (CD), a digital versatile optical disc (DVD), a magnetic disk, or a magnetic tape.

[0395] As described above, the encryption and ciphertext processing procedures according to various embodiments of this disclosure are secure even in the era of quantum computers, can significantly improve encryption / decryption speed, and can reduce the size of the ciphertext. In particular, a message used for encryption can be extended to a real number domain, thus significantly increasing usability.

[0396] Although this disclosure has been described with reference to the accompanying drawings, the scope of the rights is defined by the appended claims and should not be construed as limited to the described embodiments and / or the drawings. Furthermore, it should be understood that this disclosure includes various improvements, modifications, and variations to the embodiments of the claims that are obvious to those skilled in the art, and these are included within the scope of this disclosure.

Claims

1. An encryption method of a terminal device, characterized by: The encryption method includes steps of: setting a ring, the ring being a set including a plurality of elements in which addition and multiplication are defined, the ring including a plaintext space, the plaintext space being a real number from a plurality of sets closed to addition and multiplication; calculating a key from the ring; calculating a public key corresponding to the calculated key; and applying the public key to a message and generating a homomorphic ciphertext; wherein the generating a homomorphic ciphertext includes: extracting an error from a discrete Gaussian distribution or a distribution within a short statistical distance from the Gaussian distribution; setting a scaling factor; adding the error to a value obtained by multiplying the message by the scaling factor and encrypting using the public key to generate the homomorphic ciphertext.

2. The encryption method of claim 1, wherein: The ring satisfies the following equation: a(X) = a(X -1 ) where a(X) e R, X -1 : = -X n-1 wherein X is a variable, n is a natural number, a(X) is a polynomial corresponding to the ring, and R is a ring including a real space of a complex number.

3. The encryption method of claim 1, wherein: The homomorphic ciphertext has a complexity of o(n log n) with respect to addition or multiplication calculation, where n is a natural number.

4. The encryption method of claim 1, wherein: The encryption method further includes steps of calculating a first random polynomial from the ring; extracting an error; and modulating the error in the first random polynomial and the key and calculating a second random polynomial, wherein the step of calculating the public key includes: calculating the public key using the first random polynomial and the second random polynomial.

5. The encryption method of claim 1, wherein: The step of generating the homomorphic ciphertext includes: calculating the message as a polynomial corresponding to the ring, and applying the public key to the calculated polynomial and generating a homomorphic ciphertext.

6. The encryption method of claim 1, wherein: The encryption method further includes steps of: performing at least one calculation with respect to addition or multiplication of a generated homomorphic ciphertext and a pre-generated homomorphic ciphertext, wherein the step of performing the calculation includes: performing a first function processing procedure with respect to each of the generated homomorphic ciphertext and the pre-generated homomorphic ciphertext; performing a calculation between the homomorphic ciphertexts on which the first function processing procedure is performed; and performing a second function processing procedure, the second function processing procedure being an inverse function of the first function with respect to a homomorphic ciphertext on which the calculation is performed.

7. The encryption method of claim 6, wherein: The first function is a number theoretic transform function.

8. The encryption method of claim 1, wherein: The homomorphic ciphertext is based on a decryption being performed and is in a form in which a result value is recovered, the result value being obtained by adding an error value to the message.

9. A terminal device, characterized by: The terminal device includes: a memory configured to store a message; and a processor configured to set a ring, the ring being a set including a plurality of elements in which addition and multiplication are defined, the ring including a plaintext space, the plaintext space being a real number from a plurality of sets closed to addition and multiplication; calculating a key from the ring; calculating a public key corresponding to the calculated key; and applying the public key to a message and generating a homomorphic ciphertext; wherein the generating a homomorphic ciphertext includes: extracting an error from a discrete Gaussian distribution or a distribution within a short statistical distance from the Gaussian distribution; setting a scaling factor; The error is added to a value obtained by multiplying the message by the scaling factor and encrypted using the public key to generate the homomorphic ciphertext.

10. The terminal device of claim 9, wherein: The ring satisfies the following equation: a(X) = a(X -1 ) where a(X) e R, X -1 : = -X n-1 where X is a variable, n is a natural number, a(X) is a polynomial corresponding to a ring, and R is a ring including a real space of a complex number.

11. The terminal device of claim 9, wherein: The homomorphic ciphertext has a complexity of o(n log n) with respect to addition or multiplication computation, where n is a natural number.

12. The terminal device of claim 9, wherein: The processor is configured to: compute a first random polynomial from the ring; extract an error; modulate the error and the key in the first random polynomial and compute a second random polynomial, and compute the public key using the first random polynomial and the second random polynomial.

13. The terminal device of claim 9, wherein: The processor is configured to compute the message as a polynomial corresponding to the ring, and apply the public key to the computed polynomial and generate a homomorphic ciphertext.

14. The terminal device of claim 9, wherein: The processor is configured to: perform a first function processing procedure with respect to each of the generated homomorphic ciphertext and the pre-generated homomorphic ciphertext; perform at least one of addition or multiplication computation between the homomorphic ciphertexts on which the first function processing procedure is performed; and perform a second function processing procedure, which is an inverse function of the first function with respect to the homomorphic ciphertext on which the computation is performed.

15. The terminal device of claim 11, wherein: The homomorphic ciphertext is based on a decryption being performed and is in a form in which a result value is recovered, the result value being obtained by adding an error value to the message.

Images