Homomorphic encryption relinearization method and system based on remainder system and BFV scheme

Abstract

A homomorphic encryption relinearization method and system based on a remainder system and a BFV scheme includes reading a third ciphertext polynomial obtained by homomorphic multiplication; decomposing the third ciphertext polynomial according to various bases of the RNS to obtain components of each basis; copying the components of each basis into several groups of channels corresponding to the respective RNS bases to form a decomposed third ciphertext polynomial group; performing an NTT transformation on the decomposed third ciphertext polynomial group and two groups of relinearization keys, and sequentially performing an inner product operation and an INTT transformation on the results to obtain two sets of third ciphertext polynomial output results; and adding the two sets of third ciphertext polynomial output results to the first and second ciphertext polynomials obtained by homomorphic multiplication to obtain two relinearized ciphertexts. By accelerating the relinearization portion of the homomorphic multiplication, which has the largest computational complexity, the efficiency of the homomorphic multiplication is greatly improved.

Description

Technical Field

[0001] The present invention relates to a hardware implementation technology for a homomorphic encryption algorithm, and in particular to a hardware implementation method and system for homomorphic encryption relinearization based on a residue number system and a BFV scheme. Background Art

[0002] Currently, ensuring the security of user data in the context of cloud computing has become a widespread concern. If traditional encryption algorithms are used to upload data, cloud servers must obtain the secret key before performing any calculations. This decrypts the data, rendering encryption meaningless and undoubtedly reducing cloud security. Homomorphic encryption (HE) algorithms allow for direct homomorphic computations to be performed on encrypted ciphertext without first decrypting the data. If homomorphic encryption can be applied to cloud computing and cloud storage, sensitive user data on third-party platforms will be prevented from being leaked, significantly enhancing cloud security.

[0003] Fully homomorphic encryption (FHE) refers to a homomorphic encryption scheme that can perform infinite homomorphic additions and multiplications on ciphertext. Gentry first demonstrated the theoretical feasibility of FHE in 2009. The basic idea is to first construct a somewhat homomorphic encryption scheme (SHE) based on a lattice cipher, and then continuously refresh the ciphertext noise through bootstrapping to achieve a fully homomorphic effect. However, a key problem is that FHE based on lattice ciphers is very complex and computationally inefficient. After several generations of development, the truly "practical" Brakerski-Fan-Vercauteren (BFV) somewhat homomorphic encryption scheme was proposed in 2012.

[0004] The BFV scheme is based on the Ring-Learning with Error (RLWE) problem. Compared to first-generation homomorphic encryption schemes and contemporary schemes like BGV, BFV, which operates on an integer ring, significantly reduces the number of parameters required and omits the complex mathematical procedures of previous generations of homomorphic encryption, making the entire scheme more lightweight and concise. To address the inefficiency of integer operations with very large bit widths during BFV implementation, RNS was applied to optimize BFV, resulting in several RNS variants of BFV.

[0005] The Residue Number System (RNS) is an unweighted modular arithmetic system where each modular operation is inherently independent and parallel, with no carry between them. It consists of a set of RNS bases and corresponding operations. The RNS bases can be expressed as follows:

[0006] q RNS ={q0,q1,...,q k-1}#(7)

[0007] Each basis consists of k prime numbers, and Q = q0*q1*...*q k-1 In the current system, the operation of module Q can be split into various modules q i The calculation is performed independently on each channel. After completion, the results of each channel can be restored to the modulo Q domain using the Chinese remainder theorem (CRT). Using RNS avoids large-bitwidth modulo operations and simplifies the hardware implementation of the relinearization module.

[0008] Relinearization is a critical step in the BFV scheme's homomorphic multiplication, used to relinearize the three ciphertexts after multiplication into two ciphertexts. This allows other secret state operations to continue. Although the BFV scheme is relatively lightweight and has an easy-to-implement RNS variant, the dimensions of the ring polynomials used in the scheme are very large to ensure security. This makes the calculations of each module very complicated and the amount of data transferred between modules is also very large. In addition, the relinearization module accounts for a considerable portion of the computational load in secret state multiplication. Currently, there is no publicly available good hardware implementation solution, which is a major bottleneck for the practical application of existing homomorphic encryption schemes. Summary of the Invention

[0009] Purpose of the invention: To provide a homomorphic encryption relinearization method based on the remainder system and the BFV scheme to solve one of the above-mentioned problems existing in the prior art, and further provide a hardware system for implementing the above-mentioned method.

[0010] Technical solution: A homomorphic encryption relinearization method based on the remainder system and the BFV scheme, including the following steps:

[0011] S1. Read the third ciphertext polynomial obtained by homomorphic multiplication.

[0012] S2. Decomposing the third ciphertext polynomial according to each basis of the RNS to obtain components of each basis;

[0013] S3. Copy the components of each basis into several groups of channels corresponding to each basis of the RNS to form a decomposed third ciphertext polynomial group;

[0014] S4. Performing NTT transformation on the decomposed third ciphertext polynomial group and the two relinearized key groups, and sequentially performing inner product operation and INTT transformation on the results to obtain output results of two third ciphertext polynomial groups;

[0015] S5. Add the output results of the two sets of third ciphertext polynomials to the first ciphertext polynomial and the second ciphertext polynomial obtained by homomorphic multiplication, respectively, to obtain two relinearized ciphertexts.

[0016] According to one aspect of the present application, step S2 specifically includes:

[0017] The third ciphertext polynomial C2 is converted into the bases q0, q1, ..., q k-1 Decompose to obtain the components C of the third ciphertext polynomial in each RNS basis 2，0 , C 2,1 ,…C 2，j ,…,C 2，k-1 , where C 2，j is the third ciphertext polynomial in RNS basis q j The amount under, q j is the jth basis in RNS.

[0018] According to one aspect of the present application, step S3 specifically includes:

[0019] Copy the components of each basis to the other channels corresponding to each basis to form the RNS polynomial C of each channel under each basis (2,0)decomp 、C (2,1)decomp ,…,C (2,j)decomp , C (2，k-1)decomp ;

[0020] The third ciphertext polynomial group C is composed of the RNS polynomials of each channel under each basis 2decomp ,

[0021] c 2decomp =(c (2，j)decomp ), j = 0, 1, ..., k-1;

[0022] C (2，j)decomp The RNS polynomial is formed by splitting the j-th channel of the third ciphertext C2 and copying it to the remaining channels.

[0023] According to one aspect of the present application, the NTT transformation in step S4 specifically includes:

[0024] NTT transformation is performed on the components of each channel of each RNS polynomial above. The principle of NTT transformation is as follows:

[0025]

[0026] Among them, the prime number q is the modulus of the NTT transformation, x n are the coefficients of the polynomial, w are the primitive roots of q, and N is the dimension of the polynomial.

[0027] According to one aspect of the present application, in step S4, the process of performing the inner product operation is:

[0028] The reproducibility key polynomial group rlk is expressed as follows:

[0029] rlk=(rlk0 j , rlk1 j ), j = 0, 1, ..., k-1

[0030] Where k is the number of bases in RNS, and each set of relinearization keys consists of two RNS polynomials;

[0031] The relinearized key polynomial group rlk is converted into a polynomial in RNS representation:

[0032]

[0033] Where k is the number of bases in the remainder system, c 2，j is the third ciphertext polynomial in RNS basis q j The weight under q i is the i-th basis in RNS, and the square brackets indicate the modulo operation;

[0034] Expand the above formula into the following form:

[0035]

[0036]

[0037] in, rlk0 j，i 、c 2，i are the relinearization intermediate result, the first term of the j-th group of relinearization keys, and the components of the third ciphertext polynomial on the i-th channel of the RNS respectively;

[0038] The calculations of formula a and formula b above can be simplified as follows:

[0039]

[0040] Among them, c 2，i decomp (i) = c 2，i ;

[0041] Depend on composition, Depend on composition;

[0042] * represents RNS polynomial multiplication, which performs bitwise multiplication on the polynomials of each channel of the RNS polynomial. + represents RNS polynomial addition, which performs bitwise addition on the polynomials of each channel of the RNS polynomial. The overall process is simplified to the inner product of the ring polynomial.

[0043] According to one aspect of the present application, an inverse NTT transform is performed on each channel of the two results of the polynomial inner product RNS polynomial, and the formula is as follows:

[0044]

[0045] The meaning of each symbol is the same as in NTT.

[0046] Homomorphic encryption relinearization module based on remainder system and BFV scheme, including:

[0047] The first module is configured to decompose the third ciphertext polynomial according to each basis of the RNS to obtain components of each basis; and copy the components of each basis to a plurality of groups of channels corresponding to each basis of the RNS to form a decomposed third ciphertext polynomial group;

[0048] The second module is used to perform NTT transformation on the decomposed third ciphertext polynomial group and the two relinearized key groups.

[0049] The third module is used to perform inner product operations on the calculation results of the second module in sequence;

[0050] The fourth module is used to perform an INTT transformation on the calculation result of the third module to obtain output results of two sets of third ciphertext polynomials;

[0051] The storage module is used to store calculation data and / or intermediate results.

[0052] According to one aspect of the present application, the storage module is used to store data including ciphertext polynomials, and each storage module is composed of a storage bank constructed of k SRAMs. The port width of each storage bank is the uniform bit width b of each basis in the specified remainder system, and the depth of each storage bank is the dimension n of the specified polynomial. Each storage bank can completely store the components of a ring polynomial represented by RNS on a channel.

[0053] Furthermore, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of the above embodiments when executing the computer program.

[0054] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of the method described in any of the above embodiments are implemented.

[0055] Beneficial effects:

[0056] First, it can accelerate the relinearization part of the homomorphic multiplication of the RNS version of the BFV variant scheme, which has the largest computational workload, thereby greatly improving the efficiency of homomorphic multiplication.

[0057] Second, the present invention optimizes the algorithm flow of the key steps of relinearization, so that the polynomial multiplication and polynomial addition modules implemented in hardware can be more fully utilized.

[0058] Third, the encrypted RNS ring polynomial storage module used in the present invention can support the parallel reading and writing of data of the same dimension of components on each basis of a group of RNS ring polynomials, which can simplify the control logic and improve the operation efficiency.

[0059] In summary, the present invention can effectively accelerate the relinearization module of homomorphic encryption, has good performance, and has good practical application value. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a flow chart of the relinearization hardware system of the present invention.

[0061] Figure 2 This is a structural diagram of the RNS ring polynomial storage module of this system.

[0062] Figure 3 This is the module data flow diagram of this system (taking k=6 as an example).

[0063] Figure 4 This is the third ciphertext decomposition process diagram of this system.

[0064] Figure 5 and Figure 6 This is a schematic diagram of the system splitting and duplicating broadcasts by channel (taking k=6 as an example).

[0065] Figure 7 and Figure 8 This is a schematic diagram of the workflow of the control group (taking k=6 as an example). DETAILED DESCRIPTION

[0066] The relinearization hardware system based on the remainder system and BFV scheme described in the present invention is composed of a ciphertext RNS ring polynomial storage module, a ciphertext ring polynomial decomposition module, a ring polynomial inner product operation module and an RNS ring polynomial basic operation acceleration module. The operation process between the various modules is as follows: Figure 1As shown, the steps mainly include:

[0067] Step 1: Take the three ciphertext polynomials obtained by homomorphic multiplication as input, and decompose the third ciphertext polynomial according to each basis of RNS, and copy the components of each basis after decomposition to the remaining channels of the basis to form the decomposed third ciphertext polynomial group. The components of each basis after decomposition are stored in Figure 4 BANK0 to BANK k-1 In the example, each of the remaining channels corresponding to the base has K memory banks, forming k*k storage units. Figure 3 36 channels are formed in the 6*6 NTT, thus realizing hardware parallel computing. The data stored in each vertical storage library constitutes C (2,0)decomp .

[0068] Step 2: Perform a fast number theoretic transform (NTT) on the decomposed third ciphertext polynomial and the relinearized key group;

[0069] Step 3: Perform a polynomial inner product operation on the two sets of relinearized keys after NTT and the third ciphertext after decomposition and NTT transformation;

[0070] Step 4: Perform inverse NTT transformation on the two sets of inner product results;

[0071] Step 5: Add the two operation results of the previous step to the first and second ciphertexts after homomorphic multiplication, and output the two ciphertexts after relinearization.

[0072] Among them, step 1 requires performing NTT transformation on the components on each channel of each RNS polynomial mentioned above. The principle of NTT transformation is as follows:

[0073]

[0074] Among them, the prime number q is the modulus of the NTT transformation, x n are the coefficients of the polynomial, w are the primitive roots of q, and N is the dimension of the polynomial.

[0075] The reproducible key group described in step 2 is represented as follows:

[0076] rlk=(rlk0 j , rlk1 j ), j = 0, 1, ..., k-1#(1)

[0077] There are k sets of relinearization keys, where k is the number of bases in RNS. Each set of relinearization keys is composed of two RNS polynomials, and the third ciphertext polynomial group after decomposition is expressed as follows:

[0078] c 2decomp =(c (2，j)decomp ), j = 0, 1, ..., k-1#(2)

[0079] The third ciphertext polynomial group after decomposition has a total of k RNS polynomials. The third ciphertext polynomial group after decomposition c (2，j)decomp The RNS polynomial is constructed by splitting the j-th channel of the third ciphertext c2 and copying it to the remaining channels.

[0080] The polynomial inner product described in step 3 is expressed as follows:

[0081]

[0082] Where * represents the RNS polynomial bitwise multiplication, which performs bitwise multiplication on the polynomials of each channel of the RNS polynomial, and + represents the RNS polynomial multiplication, which performs bitwise addition on the polynomials of each channel of the RNS.

[0083] Step 4 also requires performing an inverse NTT transform on each channel of the RNS polynomial, the two results of the polynomial inner product. The formula for the inverse NTT transform is as follows:

[0084]

[0085] The meaning of each symbol is the same as in NTT.

[0086] The relinearization hardware system based on the remainder system and the BFV scheme is mainly characterized by including:

[0087] The encrypted RNS ring polynomial storage module is used to implement the storage and scheduling of RNS ring polynomial data in the relinearization process;

[0088] The ciphertext ring polynomial decomposition module is used to decompose the ciphertext of the third result of the secret state multiplication into each channel of the RNS;

[0089] The ring polynomial inner product operation module is used to calculate the inner product of the relinearization key and the result of the third ciphertext decomposition of the secret state multiplication, realizing the key process of relinearization;

[0090] The RNS ring polynomial basic operation acceleration module is used to implement and accelerate RNS ring polynomial multiplication and addition.

[0091] Each ciphertext RNS ring polynomial storage module consists of k SRAM blocks, one for each component of the ring polynomial represented by the k bases of the remainder system. The k SRAM blocks can be accessed in parallel. The interface width of each SRAM block is equal to the bit width of each base in the remainder system, and the depth is equal to the dimension of the ring polynomial.

[0092] The relinearization hardware system based on the remainder system and the BFV scheme is further designed in that the basic ring polynomial operation module includes polynomial modular addition and polynomial modular multiplication. The polynomial modular addition module is composed of a basic modular adder, while the polynomial modular multiplication module includes an NTT operation accelerator based on the RNS basis and a polynomial bitwise modular multiplier. The use of NTT acceleration can significantly reduce the time complexity of RNS polynomial multiplication.

[0093] The specific structure of the ciphertext RNS ring polynomial storage module is as follows Figure 2 As shown, a storage module is responsible for storing a complete ciphertext polynomial. Each module consists of k banks of SRAMs. The port width of each bank is the uniform bit width b of each basis in the specified remainder system, and the depth of each bank is the dimension n of the specified polynomial. Each bank can completely store the components of a ring polynomial in RNS representation on a single channel. These SRAMs can be read and written in parallel, allowing access to the uniform-dimensional coefficients of each component of the ring polynomial, greatly simplifying the control logic.

[0094] The data flow diagram of the relinearization hardware system based on the remainder system and the BFV scheme of the present invention is as follows: Figure 3 As shown, specifically including:

[0095] The ciphertext ring polynomial decomposition module is a module that optimizes the original relinearization process and is used to decompose the ciphertext of the third result of the secret state multiplication into various channels of the RNS.

[0096] The ring polynomial inner product operation module is used to calculate the inner product of the relinearization key and the result of the third ciphertext decomposition of the secret state multiplication, realizing the key process of relinearization;

[0097] The RNS ring polynomial basic operation acceleration module includes a modular adder, a modular multiplier, and an NTT acceleration module, which is used to implement and accelerate RNS ring polynomial multiplication and addition.

[0098] For the step of calculating the inner product of the relinearization and the third ciphertext decomposition result in the operation flow, the original formula is expressed as follows:

[0099]

[0100] Where k is the number of bases in the remainder system. (rlk0 j , rlk1 j ), j = 0, 1, ..., k-1 is the relinearization key polynomial group. c 2，j is the third ciphertext polynomial in RNS basis q j The amount of the following. iis the i-th basis in RNS. The square brackets indicate the modulo operation. In this hardware system, in order to fully utilize the polynomial multiplication resources to calculate this formula, the above process is optimized as follows:

[0101] First, the provided relinearization key polynomial group (rlk0 k , rlk1 j ) are all converted into polynomials under RNS representation.

[0102] Then, formula (8) can be expanded into the following form:

[0103]

[0104]

[0105] in, rlk0 j，i 、c 2，i are the relinearized intermediate result, the first term of the jth group of relinearized keys, and the third ciphertext polynomial component on the i-th channel of RNS. Note that the corresponding partial products in each formula are It just constitutes a set of RNS polynomial multiplications.

[0106] Therefore, The calculation can be simplified to:

[0107]

[0108] Where * represents RNS polynomial multiplication, which performs bitwise multiplication on the polynomials of each channel of the RNS polynomial, and + represents RNS polynomial addition, which performs bitwise addition on the polynomials of each channel of the RNS polynomial. 2，i decomp Indicates that c 2，i Decompose into new RNS polynomials constructed on each RNS basis. In this way, the overall process is simplified to the inner product of the ring polynomial. Similarly, Equation 2 can be simplified as follows:

[0109]

[0110] Among them, the decomposition operation of the third ciphertext described in step 2 is as follows Figure 4 As shown, according to the following formula:

[0111] c 2，i decomp (i) = c 2，i #(11)

[0112] As can be seen, the data in each bank of the RNS ring polynomial storage module storing the third ciphertext can be directly copied to the corresponding bank of each ciphertext group after decomposition. Because subsequent operations include modulo operations, direct copying can be performed during decomposition without performing modulo operations on each channel.

[0113] The inner product of the polynomial described in step 3 is then Figure 3 Because NTT is used to accelerate polynomial multiplication, all polynomial operations in the multiplication-accumulation unit are performed in the NTT domain. The addition symbol represents bitwise modular addition of the polynomial, and the multiplication symbol represents bitwise modular multiplication of the polynomial. The main steps for using NTT to accelerate polynomial multiplication are as follows:

[0114] 1. Perform NTT transformation on two input polynomials

[0115] 2. Modular multiplication of the coefficients of the two polynomials after NTT transformation

[0116] 3. Perform NTT inverse transform on the resulting polynomial

[0117] The formulas for the forward and inverse NTT transformations are as follows:

[0118]

[0119] Using NTT to accelerate polynomial multiplication can reduce the time complexity of polynomial multiplication from O(n 2 ) is reduced to O(nlog2n).

[0120] In addition, given the following characteristics of NTT:

[0121] NTT(a(n)+b(n))=NTT(a(n))+NTT(b(n))

[0122] INTT(A(k)+B(k))=INTT(A(k))+INTT(B(k))#(12)

[0123] Polynomial addition can be performed directly in the NTT domain, thus eliminating the need for an additional inverse NTT transformation.

[0124] like Figure 5 and Figure 6 As shown in FIG, taking k=6 as an example, the implementation process of this solution is described.

[0125] The original formula for relinearization is:

[0126] After optimization:

[0127] With this solution, when implementing in hardware, the splitting of ct2 does not take up any time overhead, and it is sufficient to broadcast the components of each channel of ct2 to each computing unit. Figure 5 As shown, in the first step, the data is split according to the channel, and in the second step, the broadcast is replicated and NTT is performed.

[0128] By adopting the above scheme, omitting the modulo step can save N*C*C modulos, where N is the polynomial dimension and C is the number of channels.

[0129] In this solution, the straight-through operations shown in the split are not split, and the RKL does not need to be split, nor does the multiplication and accumulation need to be separated. Therefore, the main purpose is to optimize the process, simplify the logic, and simplify the control.

[0130] If this solution is not adopted, the control process will be very complicated to achieve the same resource overhead.

[0131] like Figure 7 and Figure 8 As shown, using the calculation method of the control group, Figure 7 The splitting is more complicated, and in this splitting mode, rkl also needs to be split accordingly and sent to different operators, such as Figure 8 In addition, the multiplication and accumulation operations after NTT are completed must be separated, which will make the routing and data flow programming very complicated, and the address control complex.

[0132] It should be noted that relinearization is only a detailed module of homomorphic encryption hardware. Many of its computing components are expandable or reusable. To ensure data flow between modules, the design should adopt a consistent approach to data access. To make it easier to mobilize these fixed-interface operators, the process described in the above embodiment is the most user-friendly. It is simple, with direct interfaces and no need to change interfaces. The cost of splitting the value of ct2 itself is zero, so overall performance is greatly improved.

[0133] In short, the solution of this application can reuse existing resources more efficiently. Including CT2 decomposition, the entire process is basically data-through, and the address only needs to jump sequentially, without a very complex address jump mechanism. The control is simple and efficient, and the hardware implementation is easier.

[0134] If the control group's solution is adopted, it will lead to complex routing, complex storage mapping, complex address control, and too scattered form of data circulation in the hardware, which is not conducive to the communication between the front and rear modules.

[0135] In summary, the proposed hardware implementation and system for homomorphic encryption relinearization based on the remainder system and the BFV scheme optimizes the algorithm flow and accelerates the relinearization module through multi-path parallelism. Due to its high degree of parallelism, access to the polynomial storage modules can be performed sequentially, resulting in low control complexity and high hardware utilization, providing a promising approach for the practical application of homomorphic encryption.

[0136] The preferred embodiments of the present invention are described in detail above. However, the present invention is not limited to the specific details in the above embodiments. Within the technical concept of the present invention, various equivalent transformations can be made to the technical solutions of the present invention, and these equivalent transformations all fall within the scope of protection of the present invention.

Claims

1. A homomorphic encryption relinearization method based on the remainder system and the BFV scheme, characterized in that: The steps include: S1. Read the third ciphertext polynomial obtained by homomorphic multiplication. S2. Decomposing the third ciphertext polynomial according to each basis of the RNS to obtain components of each basis; S3. Copy the components of each basis into several groups of channels corresponding to each basis of the RNS to form a decomposed third ciphertext polynomial group; S4. Performing NTT transformation on the decomposed third ciphertext polynomial group and the two relinearized key groups, and sequentially performing inner product operation and INTT transformation on the results to obtain output results of two third ciphertext polynomial groups; S5. Add the output results of the two sets of third ciphertext polynomials to the first ciphertext polynomial and the second ciphertext polynomial calculated by homomorphic multiplication, respectively, to obtain two relinearized ciphertexts. The NTT transformation in step S4 specifically includes: NTT transformation is performed on the components of each channel of each RNS polynomial above. The principle of NTT transformation is as follows: Among them, the prime number q is the modulus of the NTT transformation, x n are the coefficients of the polynomial, w are the primitive roots of q, and N is the dimension of the polynomial; In step S4, the process of performing inner product calculation is as follows: The reproducibility key polynomial group rlk is expressed as follows: rlk=(rlk0 j ,rlk1 j ),j=0,1,...,k-1 Where k is the number of bases in RNS, and each set of relinearization keys consists of two RNS polynomials; The relinearized key polynomial group rlk is converted into a polynomial in RNS representation: Where k is the number of bases in the remainder system, c 2，j is the third ciphertext polynomial in RNS basis q j The weight under q i is the i-th basis in RNS, and the square brackets indicate the modulo operation; Expand the above formula into the following form: in, rlk0 j，i 、c 2，i are the relinearization intermediate result, the first term of the j-th group of relinearization keys, and the components of the third ciphertext polynomial on the i-th channel of the RNS respectively; The above formula a and formula b are simplified to: Among them, c 2，i decomp (i) = c 2，i ; Depend on composition, Depend on composition; * represents RNS polynomial multiplication, which performs bitwise multiplication on the polynomials of each channel of the RNS polynomial. + represents RNS polynomial addition, which performs bitwise addition on the polynomials of each channel of the RNS polynomial. The overall process is simplified to the inner product of the ring polynomial.

2. The homomorphic encryption relinearization method based on the remainder system and the BFV scheme according to claim 1 is characterized in that: Step S2 specifically includes: The third ciphertext polynomial C2 is converted into the bases q0, q1, ..., q k-1 Decompose to obtain the components C of the third ciphertext polynomial in each RNS basis 2，0 , C 2,1 ,…C 2，j ,…,C 2，k-1 , where C 2，j is the third ciphertext polynomial in RNS basis q j The amount under, q j is the jth basis in RNS.

3. The homomorphic encryption relinearization method based on the remainder system and the BFV scheme according to claim 2 is characterized in that: Step S3 specifically includes: Copy the components of each basis to the other channels corresponding to each basis to form the RNS polynomial C of each channel under each basis (2,0)decomp 、C (2,1)decomp ,…,C (2,j)decomp , C (2，k-1)decomp ; The third ciphertext polynomial group C is composed of the RNS polynomials of each channel under each basis 2decomp , c 2 decomp =(c (2，j)decomp ),j=0,1,...,k-1; C (2，j)decomp The RNS polynomial is formed by splitting the j-th channel of the third ciphertext C2 and copying it to the remaining channels.

4. The homomorphic encryption relinearization method based on the remainder system and the BFV scheme according to claim 1 is characterized in that: Perform inverse NTT transform on each channel of the RNS polynomial, the two results of the polynomial inner product, as shown below: The meaning of each symbol is the same as in NTT.

5. A homomorphic encryption relinearization system based on the remainder system and the BFV scheme, characterized by: include: The first module is used to decompose the third ciphertext polynomial according to each basis of the RNS to obtain components of each basis; and copying the components of each basis into a plurality of channels corresponding to each basis of the RNS to form a decomposed third ciphertext polynomial group; The second module is used to perform NTT transformation on the decomposed third ciphertext polynomial group and the two relinearized key groups. The third module is used to perform inner product operations on the calculation results of the second module in sequence; The fourth module is used to perform an INTT transformation on the calculation result of the third module to obtain output results of two sets of third ciphertext polynomials; A storage module, used to store calculation data and / or intermediate results; The NTT transformation specifically includes: NTT transformation is performed on the components of each channel of each RNS polynomial above. The principle of NTT transformation is as follows: Among them, the prime number q is the modulus of the NTT transformation, x n are the coefficients of the polynomial, w are the primitive roots of q, and N is the dimension of the polynomial; Among them, the process of inner product operation is: The reproducibility key polynomial group rlk is expressed as follows: rlk=(rlk0 j ,rlk1 j ),j=0,1,…,k-1 Where k is the number of bases in RNS, and each set of relinearization keys consists of two RNS polynomials; The relinearized key polynomial group rlk is converted into a polynomial in RNS representation: Where k is the number of bases in the remainder system, c 2，j is the third ciphertext polynomial in RNS basis q j The weight under q i is the i-th basis in RNS, and the square brackets indicate the modulo operation; Expand the above formula into the following form: in, rlk0 j，i 、c 2，i are the relinearization intermediate result, the first term of the j-th group of relinearization keys, and the components of the third ciphertext polynomial on the i-th channel of the RNS respectively; The above formula a and formula b are simplified to: Among them, c 2，idecomp (i) = c 2，i ; Depend on composition, Depend on composition; * represents RNS polynomial multiplication, which performs bitwise multiplication on the polynomials of each channel of the RNS polynomial. + represents RNS polynomial addition, which performs bitwise addition on the polynomials of each channel of the RNS polynomial. The overall process is simplified to the inner product of the ring polynomial.

6. The homomorphic encryption relinearization system based on the remainder system and the BFV scheme according to claim 5, characterized in that: The storage module is used to store data including ciphertext polynomials. Each storage module is composed of a bank of k SRAMs. The port width of each bank is the uniform bit width b of each basis in the specified remainder system. The depth of each bank is the dimension n of the specified polynomial. Each bank can completely store the components of a ring polynomial represented by RNS on a channel.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 4 are implemented.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images