Device and method for processing non-polynomial operations on homomorphically encrypted messages

Abstract

Disclosed is a method for processing homomorphic ciphertext. The method includes: receiving a non-polynomial operation command related to the homomorphic ciphertext; calculating an approximate polynomial function corresponding to the non-polynomial operation; performing the operation on the homomorphic ciphertext using the calculated polynomial function and outputting the operated homomorphic ciphertext, wherein the approximate polynomial function is a second approximate polynomial function obtained by extending a first approximate polynomial function to have a second range wider than the first range, and the first approximate polynomial function has a preset precision using the non-polynomial operation within the first range.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is based on and claims the benefit of priority under 35 U.S.C. §119 to Korean Patent Application No. 10-2021-0045002 filed in the Korean Intellectual Property Office on April 7, 2021, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The present application relates to a processing device and method capable of computing and executing an approximate polynomial having a wide domain when performing non-polynomial operations on homomorphically encrypted messages. Background Art

[0004] As communication technologies have been developed and electronic devices have become widely distributed, efforts to maintain security in communications between electronic devices are ongoing. Accordingly, encryption / decryption technology is used in most communication environments.

[0005] When a message encrypted using encryption technology is transmitted to another party, the other party must decrypt the message in order to use it. In this case, the other party may waste resources and time decrypting the encrypted data. If a third party eavesdrops while the other party temporarily decrypts the message for calculation, the message may be easily leaked to the third party.

[0006] Homomorphic encryption has been studied to address this issue. Homomorphic encryption is one of the most promising cryptographic systems. It allows addition and multiplication to be performed on encrypted data without any decryption process. By leveraging homomorphic encryption, a client can delegate computation to an untrusted cloud server, sending encrypted input data to the server, and completing all computations without any additional queries. In this way, homomorphic encryption provides a simple and secure way to delegate computations on private data.

[0007] Machine learning methods that utilize personal data continue to raise concerns about personal information, and recent research has focused on the use of homomorphic encryption in machine learning (ML). While the related art of protecting personal information in machine learning faces limitations in terms of the potential for information loss and vulnerability, machine learning solutions based on homomorphic encryption can address these limitations.

[0008] To compute non-polynomial operations in machine learning algorithms, most homomorphic encryption-based schemes use non-polynomials instead of approximated polynomials. However, existing approximations only work within a limited range and not for all real numbers.

[0009] However, there are problems such as the approximation in related technical fields does not fit other public datasets and hyperparameters, and when the input value range of the new dataset exceeds the existing domain range, the corresponding model may fail. Summary of the Invention

[0010] Therefore, the present application is designed to solve the above-mentioned problems, and more specifically, to provide a processing device and method that can calculate and execute approximate polynomials with a wide domain when performing non-polynomial operations related to homomorphic encryption.

[0011] A method for processing homomorphic ciphertext includes: receiving a non-polynomial operation command related to the homomorphic ciphertext; calculating an approximate polynomial function corresponding to the non-polynomial operation; performing the operation of the homomorphic ciphertext using the calculated polynomial function; and outputting the operated homomorphic ciphertext, wherein the approximate polynomial function is a second approximate polynomial function obtained by extending a first approximate polynomial function to have a second range wider than the first range, and the first approximate polynomial function has a preset accuracy using the non-polynomial operation within the first range.

[0012] Calculating the approximating polynomial function may include determining a first approximating polynomial and calculating a second approximating polynomial, the second approximating polynomial having a value within a first range corresponding to a calculated value of the first approximating polynomial in the first range and having a value within a second range outside the first range corresponding to a calculated value of the first approximating polynomial at an end of the first range.

[0013] Calculating the second approximating polynomial may include determining a number of iterations and basis functions based on the first range and the second range, and iteratively constructing basis functions and scaling basis functions corresponding to the basis functions at the determined number of iterations to calculate the second approximating polynomial.

[0014] Non-polynomial operations include logic functions, and the second range for the logic function is calculated by the following formula:

[0015]

[0016] C α,d,t refers to the upper end value of the second range, α refers to the learning rate, d refers to the number of attributes of the data, and t refers to the number of learnings of the logistic regression analysis.

[0017] The non-polynomial operation uses at least one function of a logistic function, a hyperbolic tangent function, an erf function, an arctangent function, a Gaussian function, or a ReLU-n function.

[0018] According to one embodiment, a processing device includes a memory configured to store at least one instruction and a processor configured to execute at least one instruction, wherein the processor, based on receiving a non-polynomial operation command related to a homomorphic ciphertext, calculates an approximate polynomial function corresponding to the non-polynomial operation by executing the at least one instruction, and performs the operation of the homomorphic ciphertext using the calculated polynomial function.

[0019] The approximate polynomial function is a second approximate polynomial function obtained by extending a first approximate polynomial function to have a second range wider than the first range, the first approximate polynomial function having a preset accuracy using a non-polynomial operation within the first range.

[0020] The processor may determine a first approximating polynomial and calculate a second approximating polynomial having a value within a first range corresponding to a calculated value of the first approximating polynomial in the first range and having a value within a second range outside the first range corresponding to a calculated value of the first approximating polynomial at an end of the first range.

[0021] The processor may determine the number of iterations and the basis functions based on the first range and the second range, and iteratively construct the basis functions and scaled basis functions corresponding to the basis functions at the determined number of iterations to calculate the second approximation polynomial.

[0022] Non-polynomial operations include logic functions, and the second range for the logic function is calculated by the following formula:

[0023]

[0024] C α,d,t refers to the upper end value of the second range, α refers to the learning rate, d refers to the number of attributes of the data, and t refers to the number of learnings of the logistic regression analysis.

[0025] The non-polynomial operation uses at least one function of a logistic function, a hyperbolic tangent function, an erf function, an arctangent function, a Gaussian function, or a ReLU-n function.

[0026] According to various embodiments of the present application, previous machine learning algorithms based on homomorphic encryption have replaced non-polynomial functions with polynomial approximations that are only valid within the domain of empirical estimation. Accordingly, there is a disadvantage of not being able to perform operations when the data set or parameters are increased to an extremely high level. In contrast, the method according to the present application can calculate the range of possible input values ​​for each non-polynomial function in the machine learning model and calculate an approximate polynomial that can reliably operate within each range, so it can operate normally under any given data set and parameters.

[0027] In addition, according to one embodiment of the present application, the method for generating an approximate polynomial consists of repeating simple functions, and is efficient and friendly to homomorphic encryption even if the domain of the approximation is very large. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 Showing the structure of a network system according to an embodiment of the present application;

[0029] Figure 2 is a block diagram showing a configuration of a processing device according to an embodiment of the present application;

[0030] Figure 3 is a diagram for describing the operation of the processing device of the present application;

[0031] Figure 4 is a flowchart illustrating a method for ciphertext processing according to an embodiment of the present application;

[0032] Figure 5 An example of a polynomial with an extended range according to the first embodiment of the present application is shown;

[0033] Figure 6 An example of a polynomial with an extended range according to a second embodiment of the present application is shown;

[0034] Figure 7 is a diagram illustrating a polynomial expansion algorithm according to a first embodiment of the present application;

[0035] Figure 8 is a diagram illustrating a polynomial expansion algorithm according to a second embodiment of the present application;

[0036] Figure 9 is a diagram illustrating a polynomial expansion algorithm according to a third embodiment of the present application; and

[0037] Figure 10 is a diagram illustrating a polynomial expansion algorithm according to a fourth embodiment of the present application. DETAILED DESCRIPTION

[0038] Hereinafter, the present application will be described in detail with reference to the accompanying drawings. Encryption / decryption can be applied to the information (data) transmission process performed in the present application, and although not mentioned separately, the expressions used to describe the information (data) transmission process in the present application and claims should be understood to include the case of encryption / decryption. Expressions in the form of "transmitted (transmitted) from A to B" or "received from B by A" include transmission (transmission) or reception through an intermediate medium and are not necessarily limited to only direct transmission (transmission) from A to B or reception from A to B.

[0039] In the description of this application, the order of each step should be understood in a non-restrictive manner unless the preceding step must be performed before the subsequent step logically and temporally. That is, except for the exceptions above, although the process described as a subsequent step is performed before the process described as a preceding step, it does not affect the essence of this application and the scope of this application should be defined without considering the order of the steps. In addition, the description of "A or B" is defined to mean including both A and B, as well as selectively indicating any one of A and B. In addition, the term "comprising" in this specification has a comprehensive meaning to further include other elements in addition to the elements included in the enumeration.

[0040] In this specification, only the main elements required for the description of this application are described and elements irrelevant to the essence of this application are not mentioned. In addition, only the components mentioned should not be understood to be included in an exclusive sense but should be understood in a non-exclusive sense to include any other elements.

[0041] In this specification, the term "value" is defined as a concept including not only scalar values ​​but also vectors.

[0042] The mathematical operations and calculations of each step in the present application described below can be implemented by computer operations, using known coding methods for corresponding operations or calculations and / or codes appropriately designed for the present application.

[0043] The specific formulas described below are exemplarily described among various possible alternatives, and the scope of the present application should not be construed as being limited to the formulas mentioned herein.

[0044] For ease of description, assume the following.

[0045] a←D: Select element (a) according to distribution (D)

[0046] s1, s2∈R: S1 and S2 are each an element of the set R.

[0047] mod(q): Modular operation using q elements

[0048] Internal value rounding (round off)

[0049] Hereinafter, various embodiments of the present application will be described in detail with reference to the accompanying drawings.

[0050] Figure 1 is a diagram showing a configuration of a network system according to an embodiment of the present application.

[0051] See also Figure 1 , the network system may include a plurality of electronic devices 100 - 1 to 100 - n , a first server device 200 and a second server device 300 , and each component may be connected to each other via a network 10 .

[0052] The network 10 may be implemented as various types of wired / wireless communication networks, broadcast communication networks, optical communication networks, cloud networks, etc., and each device may also be connected through methods such as Wi-Fi, Bluetooth, near field communication (NFC), etc. without using a separate medium.

[0053] See also Figure 1 , multiple electronic devices 100-1 to 100-n are shown, but multiple electronic devices are not necessarily used, and a single device can be used. For example, the electronic devices 100-1 to 100-n can be implemented as various types of devices, such as smartphones, tablets, game consoles, PCs, laptops, home servers, self-service terminals, etc., and can also be implemented in the form of home appliances using IoT functions.

[0054] The user can input various information through the electronic device 100-1 to 100-n that the user is using. The input information can be stored in the electronic device 100-1 to 100-n, but may be transmitted to an external device due to storage capacity, security, etc. Figure 1 , the first server device 200 may operate to store information, and the second server device 300 may operate to use some or all of the information stored in the first server device 200 .

[0055] Each of electronic devices 100 - 1 to 100 - n may homomorphically encrypt input information and transmit the homomorphic ciphertext to first server apparatus 200 .

[0056] Each of the electronic devices 100-1 to 100-n may include cryptographic noise calculated during homomorphic encryption, such as an error in the ciphertext. Specifically, the homomorphic ciphertext generated by each electronic device 100-1 to 100-n may be generated in such a manner that, when decrypted using a secret key, a result value including the message and the error value is stored.

[0057] For example, the homomorphic ciphertext generated by each electronic device 100 - 1 to 100 - n may be generated in a form that satisfies the following properties when decrypted using a secret key thereafter.

[0058] [Formula 1]

[0059] Dec(ct,sk)=<ct,sk> =M+e(mod q)

[0060] Here, <,> is the usual inner product, ct is the ciphertext, sk is the secret key, M is the plaintext message, e is the encryption error value, and modq is the modulus of the ciphertext. Here, q should be selected to be larger than the result value M obtained by multiplying the message by the scaling factor Δ. If the absolute value of the error value e is sufficiently smaller than M, the decrypted value M+e of the ciphertext can be replaced with the same precision in digit arithmetic. In the decrypted data, the error value can be set to the least significant bit (LSB) side, and M can be set to the second LSB side.

[0061] If the message size is too small or too large, a scaling factor can be used to adjust the message size. Using a scaling factor allows encryption of both real and integer messages, significantly increasing utilization. Furthermore, by using a scaling factor to adjust the message size, the size of the message region in the ciphertext after the operation—the valid region—can also be adjusted.

[0062] According to one embodiment, the ciphertext modulus q can be set and used in various forms. For example, the modulus of the ciphertext can be set in the form of a power exponent of the scale factor Δ, that is, q = Δ L If Δ is 2, q can be set to, for example, q=2 10 The value of .

[0063] The first server device 200 may store the received homomorphic ciphertext in encrypted form without decrypting the received homomorphic ciphertext.

[0064] Second server device 300 may request a specific processing result for the homomorphic ciphertext from first server device 200. First server device 200 may perform a specific operation according to the request from second server device 300 and then transmit the result to second server device 300.

[0065] For example, when ciphertexts ct1 and ct2 transmitted from two electronic devices 100-1 and 100-2 are stored in first server device 200, second server device 300 may request a summed value of information provided from electronic devices 100-1 and 100-2 to first server device 200. First server device 200 may perform a summation operation on the two ciphertexts according to the request and then transmit the result value (ct1+ct2) to second server device 300.

[0066] According to the properties of homomorphic ciphertext, the first server device 200 can perform the operation in a non-decrypted state, and the result is in ciphertext form. In this application, the result value obtained by the operation is referred to as the operation result ciphertext.

[0067] The first server device 200 may transmit the operation result ciphertext to the second server device 300. The second server device 300 may decrypt the received operation result ciphertext to obtain the operation result value of the data included in each homomorphic ciphertext.

[0068] The first server device 200 can perform operations according to user requests. The first server device 200 can perform non-polynomial operations for machine learning such as logical functions and operations consisting only of addition, subtraction, and multiplication. In this case, the first server device 200 can calculate an approximate polynomial function corresponding to the non-polynomial operation and perform the non-polynomial operation using the calculated approximate polynomial function. The approximate polynomial function calculated here is a polynomial consisting of operations that can be calculated in homomorphic encryption. Specific non-polynomial approximate operations are shown in Figure 4 middle.

[0069] The first server device 200 may be referred to as a computing device because the first server device may perform computing.

[0070] At the same time, although Figure 1 A case is shown where the first electronic device and the second electronic device perform encryption and the second server device performs decryption, but the present application is not limited thereto.

[0071] Figure 2 is a block diagram illustrating a configuration of a processing device according to an embodiment of the present application.

[0072] Specifically, in Figure 1 In a system, devices that perform homomorphic encryption, such as the first electronic device and the second electronic device, devices that compute homomorphic ciphertext, such as the first server device, and devices that decrypt homomorphic ciphertext, such as the second server device, can be referred to as computing devices. Computing devices can include various devices, such as personal computers, laptops, smartphones, tablets, and servers.

[0073] See also Figure 2 The computing device 400 may include a communication device 410 , a memory 420 , a display 430 , a computing input device 440 , and a processor 450 .

[0074] The communication device 410 is provided to connect the computing device 400 to an external device (not shown). Here, the communication device 410 can be connected to the external device via a local area network (LAN) and the Internet, or can be connected to the external device through a universal serial bus (USB) port or a wireless communication port (e.g., Wi-Fi 802.11a / b / g / n, NFC, Bluetooth). The communication device 410 can also be called a transceiver.

[0075] The communication device 410 may receive a public key from an external device and transmit a public key generated by the computing device 400 itself to the external device.

[0076] The communication device 410 may receive a message from an external device and transmit the generated homomorphic ciphertext to the external device.

[0077] In addition, the communication device 410 can receive various parameters required for generating ciphertext from an external device. Meanwhile, in this embodiment, the user directly inputs various parameters through the operation input device 440 to be described later.

[0078] In addition, the communication device 410 may receive a request from an external device to perform an operation on the homomorphic ciphertext and transmit the calculated result to the external device. The requested operation may be, for example, an operation such as addition, subtraction, multiplication, and may be a comparison operation as a non-polynomial operation.

[0079] At least one instruction regarding the computing device 400 may be stored in the memory 420. Specifically, according to various embodiments of the present application, various programs (or software) for the computing device 400 to perform operations may be stored in the memory 420.

[0080] The memory 420 may be implemented in various forms such as a random access memory (RAM), a read only memory (ROM), a flash memory, a hard disk drive (HDD), an external memory, a memory card, but is not limited thereto.

[0081] The memory 420 can store messages to be encrypted. Here, the messages can be various credit information, personal information, etc. cited by the user, or can be information related to usage history such as positioning information and Internet usage time information used in the computing device 400.

[0082] The memory 420 can store the public key. If the computing device 400 is a device that directly generates a public key, the memory 420 can store not only various parameters required for generating the public key and the secret key but also the secret key.

[0083] In addition, the memory 420 can store homomorphic ciphertext generated in the process described later. The memory 420 can store homomorphic ciphertext transmitted from an external device. In addition, the memory 420 can store calculation result ciphertext, which is the result of the operation described later.

[0084] The memory 420 may store a learning model required for machine learning and a non-polynomial operation function used in the corresponding learning model and an approximate polynomial (a polynomial function with an expanded range or a polynomial function before expansion).

[0085] The display 430 displays a user interface window for selecting functions supported by the computing device 400. Specifically, the display 430 may display a user interface window for selecting various functions provided by the computing device 400. The display 430 may be a monitor such as a liquid crystal display (LCD), an organic light emitting diode (OLED), or the like, or may be implemented as a touch screen capable of simultaneously performing the functions of the computing input device 440 described later.

[0086] Display 430 may display a message requesting input of parameters required to generate a secret key and a public key. Display 430 may also display a message in which the encryption target is selected. Furthermore, when implemented, the encryption target can be selected directly by the user or automatically. In other words, even if the user does not directly select the message, the personal information requested for encryption can be automatically set.

[0087] The computing input device 440 can receive function selections of the computing device 400 and control commands for corresponding functions from the user. Specifically, the computing input device 440 can receive parameters required to generate a secret key and a public key from the user. In addition, the computing input device 440 can receive a message to be encrypted from the user.

[0088] The processor 450 controls the overall operation of the computing device 400. Specifically, the processor 450 can control the overall operation of the computing device 400 by executing at least one instruction stored in the memory 420. The processor 450 can be configured as a single device such as a central processing unit (CPU) or an application-specific integrated circuit (ASIC) or can include multiple devices such as a CPU and a graphics processing unit (GPU).

[0089] When a message to be transmitted is input, the processor 450 may store the message in the memory 420. The processor 450 may homomorphically encrypt the message using various setting values ​​and programs stored in the memory 420. In this case, a public key may be used.

[0090] The processor 450 may generate a public key required for performing encryption itself and use the public key, or may receive a public key from an external device and use the public key. For example, the second server device 300 that performs decryption may distribute the public key to other devices.

[0091] When generating a key itself, the processor 450 may use Ring-LWE technology to generate a public key. Specifically, the processor 450 may first set various parameters and rings, and store the set parameters and rings in the memory 420. Examples of parameters may include the bit length of the plaintext, the size of the public key and the secret key, etc.

[0092] The ring can be described by the following equation:

[0093] [Formula 2]

[0094]

[0095] Here, R represents a ring, Z q denotes the coefficients, and f(x) is an nth-order polynomial.

[0096] A ring is a set of polynomials with predetermined coefficients, in which addition and multiplication are defined between elements and the set is closed to addition and multiplication. Such a ring is called a ring.

[0097] As an example, a ring refers to a set of N-order polynomials whose coefficients are Zq. Specifically, a ring may refer to a cyclotomic polynomial of order N when n is Φ(N). Here, (f(x)) represents the ideal value of Zq[x] generated by (x). The Euler function Φ(N) refers to a number that is relatively prime to N and a natural number less than N. If Φ N If (x) is defined as an Nth-order cyclotomic polynomial, the polynomial ring can also be expressed as the following equation 3.

[0098] [Formula 3]

[0099]

[0100] At the same time, the ring of Equation 3 described above has complex numbers in the plaintext space. At the same time, in order to improve the operation speed of homomorphic ciphertext, only the set of real numbers in the plaintext space can be used in the set of polynomial rings described above.

[0101] When such a ring is established, the processor 450 can calculate the secret key sk and the public key pk from the ring. The calculation operation can be generated by another computing device and provided to the corresponding computing device 400.

[0102] Processor 450 may generate a homomorphic ciphertext for the message. Specifically, processor 450 may generate the homomorphic ciphertext by applying a previously generated public key to the message. Processor 450 may generate a length of the ciphertext corresponding to the size of the scale factor.

[0103] When a homomorphic ciphertext is generated, the processor 450 may control the communication device 410 to store the generated ciphertext in the memory 420 or transmit the ciphertext to another device according to a user request or a predetermined default command.

[0104] According to one embodiment, packing may be performed. The use of packing in homomorphic ciphertexts allows multiple messages to be encrypted into a single ciphertext. In this case, when operations are performed between ciphertexts in the computing device 400, the computational burden is significantly reduced because the operations are performed on multiple messages in parallel.

[0105] Specifically, when a message includes multiple message vectors, processor 450 may convert the multiple message vectors into polynomials that can be encrypted in parallel, and then processor 450 may multiply the polynomials by a scaling factor and perform homomorphic encryption thereon using a public key. Accordingly, a ciphertext in which the multiple message vectors are packed may be generated.

[0106] When the homomorphic ciphertext needs to be decrypted, the processor 450 can generate a polynomial decryption text by applying a secret key to the homomorphic ciphertext, and generate a message by decoding the polynomial decryption text. Here, the generated message may include the error mentioned in the above-described method 1.

[0107] Processor 450 may perform operations on the ciphertext. For example, processor 450 may perform operations such as addition, subtraction, or multiplication while maintaining an encryption state with respect to the homomorphic ciphertext.

[0108] Processor 450 may perform operations on polynomials that have operations other than addition, subtraction, or multiplication for ciphertexts. Specifically, homomorphic ciphertexts are closed to addition, subtraction, and multiplication but not to other operations.

[0109] Therefore, for the operation other than addition, subtraction and multiplication, the approximate operation expression represented by the above three operations should be used.In this respect, processor 450 can use approximate function to perform operation, and this approximate function is corresponding to the operation that is requested to carry out the operation other than addition, subtraction or multiplication.

[0110] For this purpose, approximate functions in related fields (such as Taylor's formula, least squares method, and minimax method) can be used, but because approximate functions in related fields have a narrow range, it is difficult to apply approximate functions in related fields to machine learning.

[0111] In order to solve this problem, the present application calculates (or selects) a first approximation function with a preset accuracy within a first range, and calculates a second approximation function that extends the corresponding first approximation function to a second range wider than the first range. As described above, by using an approximation function with a wider range, the good properties of the existing first approximation function can be ensured and applied to machine learning at the same time. Figures 5 to 10 Describes methods for computing approximate functions.

[0112] At the same time, when the calculation is completed, the computing device 400 can detect the data of the valid area from the calculation result data. Specifically, the computing device 400 can perform rounding processing on the calculation result data to detect the data of the valid area. Rounding processing refers to rounding the encrypted message and can therefore be called rescaling.

[0113] In addition, when a portion of the approximate message in the ciphertext exceeds a threshold according to the calculation result, the calculation device 400 may perform a restart operation for the ciphertext.

[0114] Figure 3 It is a diagram for describing the processing of the processing device of this application.

[0115] See also Figure 3 , each homomorphic ciphertext 10, 20 can include an approximate message area 11 and 21 respectively. The message and the error (m1+e1, m2+e2) exist together in the approximate message area 11 and 21.

[0116] The operation device 400 can perform a specific operation using two homomorphic ciphertexts 10 and 20 as input values. This operation can be a polynomial operation consisting of addition, subtraction, and multiplication, or a polynomial operation or a non-polynomial operation requiring the use of an approximate function.

[0117] Non-polynomial operations may include comparison operations such as maximum value calculation, minimum value calculation, size comparison, etc., and machine learning may include logical functions, hyperbolic tangent functions, erf functions, etc. The following describes the calculation operation of the approximate function of the logical function, which is most frequently used in machine learning, but the following operation can be applied to other non-polynomial operations as well as the logical function.

[0118] As mentioned above, in order to apply non-polynomial operations to homomorphic ciphertexts, a polynomial approximation of the non-polynomial expression is required. However, if the non-polynomial input is hidden by the homomorphic ciphertext, the domain of the approximation must be large enough to exceed all candidates for the input.

[0119] However, when applied to large domains, polynomial approximation methods in related fields have limitations on computations over homomorphic ciphertexts. For example, in order to compute the minimum approximation of a logic function in the range [-R, R], a homomorphic multiplication of Furthermore, the parameters of homomorphic encryption have large intermediate values ​​during calculation and are therefore not practical.

[0120] Therefore, this application describes an efficient polynomial approximation method with a wide domain. Using this method, the logistic function can be approximated in the region [-R, R] using only O(log R). Furthermore, since the intermediate values ​​of the computation remain small, reasonable homomorphic encryption parameters can be used.

[0121] The ciphertext 30 described above may include an approximate message area 31 including the result (m3+e3) of the operation between each approximate message. If the plaintext space 32 is lost or becomes smaller than the limit value, the operation device 400 may perform a restart operation.

[0122] Figure 4 is a flowchart illustrating a method for ciphertext processing according to an embodiment of the present application.

[0123] See also Figure 4 In operation S410, a non-polynomial operation command for homomorphic ciphertext may be received. Such a command may be input from an external device or directly input into the operation device. The non-polynomial operation may be an operation using a logic function or a logical recursive analysis.

[0124] In operation S420, an approximate polynomial function corresponding to the non-polynomial operation is calculated. Specifically, a first approximate polynomial function having a preset accuracy using the non-polynomial operation within a first range may be determined, a value corresponding to a calculated value of the first approximate polynomial within the first range may be determined within the first range, and a second approximate polynomial function having a value corresponding to the calculated value of the first approximate polynomial at the end of the first range may be calculated within a second range different from the first range.

[0125] In operation S430 , an operation of the homomorphic ciphertext may be performed using the calculated polynomial.

[0126] In operation S440, the calculated homomorphic ciphertext may be output in operation S440. If the calculation is requested in another device, the calculation result may be sent to the other device.

[0127] As described above, the ciphertext calculation method according to the present application can perform operations by using an approximate polynomial with a wide domain, thereby enabling homomorphic ciphertext calculation in machine learning where it is difficult to know all candidates for input values.

[0128] Hereinafter, the operation of the approximate polynomial calculation operation according to the present application will be described in more detail.

[0129] In order to apply homomorphic ciphertext to machine learning, it is necessary to approximate non-polynomials. However, approximations in related fields have a narrow scope (i.e., a narrow domain or a narrow definition), and there is a potential problem that machine learning will not be able to operate when using data in a range different from the dataset used during learning.

[0130] To solve this problem, a polynomial approximation method with a known wide range can be used. However, it is difficult to calculate polynomial approximations with a known wide range in homomorphic encryption. Specifically, as the approximation part becomes wider, the degree of the approximating polynomial also increases. For example, in order to approximate the logic function σ(x) = 1 = (1 + exp(-x)) in the range [-R, R] with a fixed supremum norm error e, a polynomial expression of degree O(R) is required.

[0131] In particular, even using the Paterson-StockMeyer method to minimize the number of doublings during polynomial operations, doublings are required. to produce an approximation.

[0132] If the order of the approximating polynomial is large, large intermediate values ​​are derived during the calculation. For example, the minimax approximating polynomial of the logistic function in the range [-1000; 1000] with a supremum norm error of 0.05 has an order of 593. In order to use the Paterson-Stockmeyer method for polynomials of order d, one should calculate Therefore, 1000 should be calculated during evaluation 25 The homomorphically encrypted plaintext space must be large enough to include all potential large intermediate values, which means that large homomorphically encrypted parameters may occur.

[0133] As mentioned above, related field-wide polynomial approximations require high computational cost and very large homomorphic encryption parameters, making them difficult to apply to machine learning.

[0134] To address these issues, the present application uses a domain extension function (DEF). The domain extension function corrects values ​​from a narrow first range and brings each outline from a secondary region to the nearest point in the first interval. Specifically, in the first range, a value corresponding to the calculated value of the first approximating polynomial that operates well in the corresponding range is output, and in a second range larger than the first range, a second approximating polynomial is calculated, which has a value corresponding to the calculated value of the first approximating polynomial at the end of the first range.

[0135] When combined with related art approximate polynomial methods and domain extension functions, the shape from the secondary domain can be reasonably managed while retaining the good eigenvalues ​​of the primary domain. If the target non-polynomial function tends to be peculiar in the primary interval and tends to be flat in the secondary interval, the domain extension function is particularly advantageous. The logistic function, hyperbolic tangent function, erf function, inverse tangent function, Gaussian function or ReLU-n function have these properties. The following focuses on the logistic function and logistic recursive analysis for ease of description.

[0136] The method according to the present application can use only o(logR) numbers for homomorphic multiplication and the minimax polynomial approximation only requires Homomorphic multiplication. When approximating a logistic function with a range of [-1000, 1000], the median value according to this method is less than 1000 3 It is much larger than the median value of 1000 required by the related field approximation scheme. 25 More reasonable.

[0137] We will use the domain extension function described above to describe a new homomorphic encryption-based approach for logistic recursion analysis that is not biased against specific data or hyperparameters. First, we approximate the polynomial spacing of each logistic function in the logistic recursion analysis model. Although the estimated spacing is quite wide, the domain extension function enables efficient computation using homomorphic encryption.

[0138] In the following, the logical recursion will be described first.

[0139] Logistic regression is a well-known model that can solve the binomial classification problem. The logistic regression model consists of trained weights W and biases b and gives the probability of each reference point x being classified as a specific class "1". In the following, two categories are defined as '1' and '-1'. The reference point x is associated with an additional feature (W T x+b=(W T ,b)(x,1) as W T x) are combined.

[0140] To learn the weights and bias b of the logistic recurrent model, assume the following cost function.

[0141] [Formula 4]

[0142]

[0143] Here, x refers to learning data (or single learning data), W refers to weight, y refers to category, and n is the number of data.

[0144] The learning process is to search for weights and biases by minimizing the cost function given learning data. Regarding weights and biases, auxiliary parameters and learning rate α can be updated as follows.

[0145] [Formula 5]

[0146]

[0147] Here, W refers to weight, α refers to learning rate, y refers to classification, x refers to learning data, and n is the number of data.

[0148] Hereinafter, a polynomial approximation method will be described. Although a sigmoid function is specified below, the approximation method according to the present application can be applied to other non-polynomial functions besides the sigmoid function.

[0149] <Domain extension function>

[0150] According to the domain extension function D of this application r (x) can be defined as follows:

[0151] [Formula 6]

[0152]

[0153] Here, D r (x) refers to the domain extension function, x refers to the input value, and r refers to an integer.

[0154] If there exists an integer r, such as f(x)=D r (x), then the function F(x) is called the r-domain extension function (r-DEF). If not needed, r can be omitted.

[0155] If we assume that P is given: [-r, r] → R, where r>0, then the domain of the function can be extended by forming P using the r-domain extension function.

[0156] [Formula 7]

[0157]

[0158] When the input is from the original domain [-r, r], the same function is executed. Thus, the domain extension function can actually extend the domain of a given function.

[0159] <polynomial DEF>

[0160] Consider using polynomial approximation of domain extension function for homomorphic encryption algorithm. In particular, the following operation aims to find a polynomial that satisfies the core properties of domain extension function. r-domain extension function (D r The following properties of (x)) extend the definition of a function.

[0161] Prop ID r (x) = x, on [ = r, r]

[0162] Prop II.

[0163] Prop III.D r The image of (x) is bounded by [-r,r].

[0164] Given a function P: [-r, r] → R, if PropIII is used, D can be used r (x) appropriately synthesizes P(x). Prop I is configured to keep P(x) in [-r, r] and Pro II can properly manage the shape input to simulate values ​​at the nearest boundary.

[0165] In the case of polynomials, it is difficult to satisfy all of the above core properties. Alternatively, approximate versions of each property can be used as follows. For a given polynomial Pr and interval [-R, R], the following properties can be considered.

[0166] PropI'.Pr(x)≈x, on [-r,r]

[0167] PropII'.

[0168] PropIII'.The image of Pr(x) on [-R,R] is bounded by [-r,r].

[0169] This property, together with the error of Pr(x), extends the definition of the function from [-r, r] to [-R, R].

[0170] Now define the r-polynomial domain extension function (r-polyDEF) on [-R,R], which is a polynomial that satisfies PropI', II', III' modified for some r. r can be omitted if not needed.

[0171] These polynomial domain extension functions can preserve the values within the range [-r, r] and take the range out of [-r, r] from the point closest to [-r, r]. The polynomial domain extension functions have similar properties, that is, they have fewer potential errors. Thus, if the function f(x) on [-r, r] is configured as a polynomial domain extension function on [-R, R], the properties of f(x) on [-r, r] can be preserved and the inputs from [-R, R]\[-r, r] can be reasonably managed.

[0172] <Iterative construction of polyDEF.>

[0173] In the following, it is assumed that the basic function B(x) is a 1-polyDEF on [-L, L] and L > 1, which is the extension ratio.

[0174] Consider the function B n (x), where for each positive integer n > 0 (for example ), B n (x) is scaled to L n .

[0175] For each n, if and F n (x) is then it can be recognized whether PropI', II', III' are satisfied for Fn(x) on [-L n , L n . Therefore, Fn is a 1-polyDEF on [-L n , L n .

[0176] For r > 0, by adjusting the size of the 1-polyDEF generated in [-L n , L n , a r-polyDEF on [-rL n , rL n can be obtained. The following Equation 8 (F n , r) can be accurately calculated.

[0177] [Equation 8]

[0178]

[0179] <Example 1>

[0180] Since is a 1-polyDEF with a range of [-1.5, 1.5], it can be considered as the basic function with an extension ratio of 1.5. By using the above structure, Fn and r(x) can be generated using B(x) and the generated F n,r (x) can be for [-1.5n r,1.5 n r] of r-polyDEF.

[0181] Figure 5 An example of a polynomial with an extended range according to the first embodiment of the present application is shown.

[0182] See also Figure 5 , the basic function (Bx) is used The configuration of 1-polyDEF. B1(x) is the primary scaling function and B2(x) is the secondary scaling function among the basic functions. By synthesizing these basic functions and the first scaling function and then synthesizing the first scaling function and the second scaling function, a polynomial with an extended range can be generated. The resulting F3(x) is in [-1.5 3 ,1.5 3 ] on 1-polyDEF. Figure 8 The specific algorithm used for this approximate polynomial generation operation is described again.

[0183] Hereinafter, the range of extending the sigmoid function will be described.

[0184] The sigmoid function is a function having an S-shape. Although the logistic function σ(x)=1 / (1+exp(-x)) is mainly described to facilitate description of the present disclosure, it can be applied to another sigmoid function such as a tanf function, an erf function, or the like.

[0185] The polynomial domain extension function can extend the effective domain of the polynomial approximation of σ(x). In the following, it is assumed that the polynomial approximation P(x) of σ(x) is given in the interval [-r, r]. Assume that r is large enough so that σ(x) ≈ 1. Then, r-polyDEFF n,r The domain of P(x) has an expansion ratio L and can be expanded to [-L n r,L n r].

[0186]

[0187] In F n,r After efficient evaluation of (x), the approximate polynomial over the narrow domain [−r, r] can be computed as n r,L n The logistic function on r].

[0188] For example, we can assume that the approximate polynomial of the sigmoid function with a range of [-r, r] is P(x). As in Example 1 above, the approximate domain [-r, r] can be extended to [-1.5 nr,1.5 n r]. Algorithm 2 for organizing this operation is Figure 8 Detailed description. Using this algorithm 2, an approximate polynomial that works well in a narrow range of related technical fields is expanded to an approximate polynomial that operates in a wider range. In the following, although a representation that expands the range of an existing polynomial is used, it can be shown that a new polynomial is generated.

[0189] Hereinafter, an example of extending the polynomial approximation domain of the logic function by polyDEF of Example 1 will be described below.

[0190] <Proof 1>

[0191] For an approximation polynomial P(x) with r ≥ 12, an excess error ε, and a range of [-r, r], Algorithm 2 can be used to calculate the approximation polynomial P(x) in the range of [-1.5 n r,1.5 n r] uniformly approximates σ(x) with an error less than ε+0.02.

[0192] If we assume that x∈[0,1.5 n r], then for each m, x m =B M-n °B m-n+1 °…°B n (x).

[0193] [Formula 7]

[0194]

[0195] Therefore, if x ≥ 5, |σ(x)-σ(F n,r (x))|≤|1-σ(F n,12 (5))|≤0.02.

[0196] If 2.5≤x≤5,

[0197] [Formula 8]

[0198]

[0199] If 0≤x≤2.5,

[0200] [Formula 9]

[0201]

[0202] For every x∈[0,1.5 n r],

[0203] [Equation 10]

[0204] |σ(x)-P°σ(Fn,r (x))|≤|σ(x)-σ(F n,r (x))|-|σ°F n,r (x)-P°F n,r (x)|≤ε+0.02

[0205] Similarly, for x∈[-1.5 n r,0], the same results are maintained.

[0206] For some constants c1 and c2, these domain extension functions can be expressed using the continuous function f(x) as and The sigmoid function satisfies these conditions. At the same time, c0 functions, such as the Gaussian function, also have these properties. It uses the domain extension function method to expand the domain of the approximate polynomial used for the c0 function.

[0207] In the following, the stability and efficiency of the algorithm will be described using the above method.

[0208] As mentioned above, the known wide range of polynomial approximations based on homomorphic encryption is impractical. In contrast, the structure of the polynomial approximation according to the present application is a simple basis function and is therefore stable and efficient.

[0209] The polyDEF structure described above provides an approximation of the logic function in an iterative manner. That is, a logic function with a wide range can be calculated by repeatedly calculating a simple function.

[0210] In Example 2 above, the approximate polynomial in the narrow [-r, r] region can be calculated as To calculate the [-1.5 n r,1.5 n The logistic function on r].

[0211] B n (x) is a low-order polynomial with flat coefficients, so errors arising from intermediate values ​​and homomorphic encryption do not overflow. As a result, the polyDEF structure according to the present application provides a stable method for approximating logic functions in a wide range of regions.

[0212] Additionally, domain expansion using a polynomial domain expansion function only allows for a predetermined number of homomorphic encryption multiplications. That is, by using the aforementioned domain expansion function configuration, σ(x) = 1 / (1 + exp(-x)) can be approximated by a wide range of polynomials with a hypernorm error of 0.05.

[0213] Proof 1 above shows that the domain extension function can have O(lnR) homomorphic multiplications and can approximate the logic function uniformly in the range [-R, R]. Even in the Paterson-Stockmeyer algorithm that minimizes the number of homomorphic multiplications, it is better than requiring at least The minimax polynomial approximation to HE multiplication is more asymptotically correct.

[0214] In Example 1, the basic function The polynomial domain function of the configuration describes each component by expanding the domain by a factor of 1.5. Three variants are described below: (a) a high-order basis function, (b) a domain-expansion function that is friendly to the domain expansion function in a narrow interval, and (c) a wave reference function of order 3.

[0215] (a) Higher-order basic functions

[0216] For every positive number m, suppose

[0217] here, Refers to the expansion ratio. If 1-polyDEF is in the range [-L m ,L m ] has a series of 2m+1, then B m,0 (x) can be considered as a basic function and The r-polyDEF can be configured as above. More specifically, considering the scaling function and their configurations When F m,n,r (x) can be r-polyDRF on .

[0218] For calculation purposes, if the expansion ratio is Then F m,n,r (x) Requirement Here, m=9 is indeed more efficient than m=3, and m=3 can ensure that the intermediate values ​​in the calculation process are smaller.

[0219] Note 2

[0220] The polynomial domain expansion function generated in Example 1 is actually Here, the expansion ratio is L3=1.5.

[0221] <Note 3>

[0222] B m,0 The structure of is inspired by the method of approximating symbolic functions by repeated operations. In this application, the goal is to find an approximate basic function that can approximate symbolic functions by repeated operations similar to the above task.

[0223] Minimax approximation using monotone polyDEF

[0224] In Algorithm 1, we assume an approximation P(x) of the logic function σ(x) in the range [-r, r]. It can be assumed that the minimax approximation guarantees the best uniform approximation. However, when using a monotone polynomial domain extension function, it is possible to achieve a better approximation than the minimax approximation on [-r, r].

[0225] Different approximations Q(x) can be used (e.g. ) range, replacing the range [-r,r] Minimax approximation. If the domain of the polynomial expands significantly, it becomes an inverse function.

[0226] In addition, Q°F n (x) can be approximated on [-1.5nr, 1.5nr] while ensuring that the uniformity error is less than the following P°F n (x):

[0227] [Equation 11]

[0228]

[0229] When all are summed, Provided in [-1.5 n r,1.5 n r] on σ(x). When the above F n,m,r When Monotone is configured, this preference assumes the domain extension of monotone polynomials and can be evaluated.

[0230] <Waveform polyDEF>

[0231] In the following, non-monotonic basis functions whose domain can be extended beyond monotonicity will be described.

[0232] To maintain stability, we will focus on the tertiary basic function. We will use the same function as used in Example 1, i.e., a function with a range of [-1.5, 1.5]. However, the basic function is a wide range 1-polyDEF, and a higher expansion ratio of L>1.5 can be obtained.

[0233] The function of B(X) rescaled by 2.45n and its configuration are shown below.

[0234] [Equation 12]

[0235]

[0236] F n (x): = B0°B1°…°B n-1 (x)

[0237]

[0238] To configure a suitable polyDEF for the logistic function σ(x), the parameters (L=2.45, r=14.5) will be used.

[0239] The reason for trusting the above parameters is as follows: Assuming that a polynomial approximation P(x) is given by σ(x) on [-r, r] with an excess standard error ε < 0.05, we can say that P°Fn,r(x) is appropriately in approximates σ(x) above.

[0240] If τ = 0.27, each Bn(x) strictly increases for x∈[-τ,τ], then Fn(x) can also strictly increase. In addition, F n (x)≈x. Therefore, for all x∈[-τr,τr], P°F n,r (x)≈P(x)≈σ(x).

[0241] For x∈[τ,L n+1 ], B n (x) may not be monotonic. However, maintaining B n (L n+1 )=L n B(L)>L n B(τ)>B n (τ), B n (x)∈[B n (τ),L n ].

[0242] Through mathematical derivation, we can deduce that F n,r (τr)≤F n,r (x)≤r for all x∈[τr,L n+1 r] holds. However, F n,r (τ)>3.84,σ(F n,r (τ))>σ(3.84)>0.978 is very close to 1. Therefore, for all x∈[τr,L n+1 +r], P°F n,r (x)≈σ(x)°F n,r (x)≈1≈σ(x).

[0243] For x∈[τr,L n+1 +r], P°F n,r(x)≈σ(x). In summary, the waveform polyDEFF with L=2.45 and r=14.5 n,r (x) The domain of definition can be appropriately expanded.

[0244] Figure 6 : is a diagram showing an example of an expanded polynomial according to the second embodiment of the present application. Specifically, Figure 6 Shows the polyDEF of B(x) consisting of rescaled basis functions and expanded by a factor of 2.45.

[0245] See also Figure 6 , the configuration of 1-polyDEF uses [-2.45,2.45] The configuration diagram of F3(x) is the waveform 1-polyDEF on [-2.453, 2.453]. The approximate polynomial described here can be generated using Algorithm 3 as described below.

[0246] Figure 7 is a diagram illustrating a polynomial expansion algorithm according to the first embodiment of the present application.

[0247] See also Figure 7 , Algorithm 1 shows the n r,1.5 n Specifically, a first polynomial corresponding to the non-polynomial operation required in the first range is first selected.

[0248] A rescaling basis function is generated for the selected first polynomial. Specifically, a rescaling basis function is generated for the first polynomial. The base polynomial and the generated rescaling basis function are combined to generate an approximating polynomial having a range extending beyond the first range. Furthermore, an extended approximating polynomial (i.e., a second approximating polynomial) is generated by repeating the above-described operation a number of times corresponding to the extended range. The second approximating polynomial generated by performing three iterations is a third function and does not increase intermediate values.

[0249] Return to see Figure 7 , it can be seen that the finally generated second approximation polynomial y=F3(x) has a value very close to the first approximation polynomial in the first range and has a second range value wider than the first range.

[0250] Figure 8 is a diagram illustrating a polynomial expansion algorithm according to the second embodiment of the present application.

[0251] See also Figure 8 , first select a base polynomial, i.e., the first polynomial corresponding to the non-polynomial operation required in the first scope.

[0252] A rescaling basis function is generated for the selected first polynomial. Specifically, the rescaling basis functions for the first polynomial may be generated successively at a number corresponding to the extended range to generate an approximation polynomial with the extended range.

[0253] Figure 9 is a diagram illustrating a polynomial expansion algorithm according to the third embodiment of the present application.

[0254] Algorithm 3 describes an algorithm for approximating the logistic function over a wide range. When the minimax approximation 9 is used on [-14.5, 14.5], the excess standard error on [-14.5, 14.5] is 0.441, and Algorithm 3 can appropriately expand the approximation domain to maintain the excess standard error less than 0.045.

[0255] Logistic regression analysis is a machine learning method for solving binomial classification problems. Because logistic regression analysis is frequently used with personal data, there is an increasing demand for logistic regression analysis that preserves personal information.

[0256] There have been many attempts to perform logical recursive analysis based on homomorphic encryption, but in the related art, the approximate region of the logic function is not carefully selected. In the related art, it is manually determined whether the input of each logic function belongs to [-8, 8] in the dataset, in which not every input of the logic function is encrypted. In the related art, each input of the logic function using average pooling will fall into [-5, 5]. However, this related art method may lead to potential leakage or data loss. In addition, because the approximate interval is too narrow, it may not be possible to guarantee successful results for a randomly given dataset, learning rate, and number of iterations.

[0257] To address this issue, this application uses a domain extension function. As described above, domain extension functions can be used to efficiently approximate logic functions. Preferably, the approximation interval of the logic function can be carefully selected in each iteration of the logic recursion analysis. Combining this with DEF yields a homomorphic encryption algorithm for logic recursion that is not biased by a specific dataset, learning rate, or number of iterations.

[0258] In the following, the logistic functions will be described for two approximation intervals of each logistic function in the recursive analysis.

[0259] First, it is assumed that all attributes of the reference points are [0,1], i.e., the highest norm of each reference point is limited to 1 (this is the only assumption).

[0260] Let W be the vector of weights and biases for the logistic regression analysis. If the learning rate is α, the batch size is n, and the number of attributes in the data is d, then show the weights and biases trained separately at Wt. Here, x is the reference point sampled in the dataset.

[0261] When iteration is performed in the iterative relationship of weights as described below, the input of the logic function can be approximately restricted (Equation 12).

[0262] [Equation 13]

[0263] |Wn·x|≤nα(d+1)

[0264] Wn·x is the absolute value of the input to the logic function. The above formula 13 shows that the interval [-nα(d+1), nα(d+1)] includes all intervals of the logic function in the nth rounding.

[0265] We will describe a novel homomorphic encryption-based approach for logical recursion that is able to train on all datasets for multiple iterations over various learning rates and encryption states, while using polyDEF in combination with a novel polynomial approximation.

[0266] However, since the interval given by Equation 13 is too wide, even using the domain extension function requires too many homomorphic operations. Accordingly, a narrower interval can be introduced as follows.

[0267] [Equation 14]

[0268]

[0269] Formula 14 is calculated by the following formula 15.

[0270] [Equation 15]

[0271]

[0272]

[0273] For the polynomial approximation of the logistic function in the tth iteration of the logistic recursive analysis, Equation 14 can use a more reasonable interval [-C α,d,t ,C α,d,t ].here, C α,d,t Refers to the upper end value of the second range, α refers to the learning rate, d refers to the attribute of the data, and t refers to the number of logical recursive analyses. Hereinafter, a case where logical recursive analysis based on homomorphic encryption is applied will be described below.

[0274] This application replaces each logic function with a polynomial approximation over a carefully chosen interval. The estimated domain can be wide enough to guarantee successful results even with extreme data. Using the method described in this application, logic functions with wide domains can be efficiently approximated using homomorphic encryption.

[0275] The following is an effective setting for polynomial approximation of the logistic function over a wide range. and an expansion ratio of L2.45. To approximate the logistic function in a narrow interval, dfl can take the following maximum polynomial of degree 9 in the interval [-14.5, 14.5].

[0276] [Equation 16]

[0277] P(x)=0.5+0.1939x-4.813e-3x 3 +5.992e-5x 5 -3.232e-7x 7 +6.195e-10x 9

[0278] The polynomial approximation generated by P(x), b(x), and L can then approximate the widely spaced logistic function with a hypernorm error of less than 0.045.

[0279] The HE-based method for personal information protection logical recursive analysis can be performed by combining the above with the above formula 16. Such a method is not biased by a specific data set, learning rate or number of iterations. This operation is specifically shown in Figure 10 In Algorithm 4.

[0280] Hereinafter, the performance of the amplification function will be described in detail.

[0281]

Table 1

[0282]

[0283] Table 1 shows the experimental results of logistic regression analysis of the encrypted state of the MNIST dataset. The second column represents the maximum size of the input to the logistic function during the entire process. As the learning rate increases, the learning rate also tends to increase. The third column is the percentage of the weight, which indicates how different the two weights are. This value can be calculated as Here, Wp is the training weight of the unencrypted state and Wc is the training weight of the encrypted state.

[0284]

Table 2

[0285] Learning rate Accuracy of encrypted model (%) Accuracy of unencrypted model (%) 0.1 94.51 94.61 0.2 95.72 95.77 0.4 96.22 96.07 0.6 96.32 96.22 0.8 96.12 96.17 1.0 96.12 96.22 1.2 96.17 96.37 1.4 96.02 96.27 1.6 95.82 96.27 1.8 96.02 96.27 2.0 96.12 96.32

[0286] Table 2 shows the accuracy results for the MNIST dataset at various learning rates. The weighted values ​​trained in the unencrypted state are shown. As shown in Table 2, when the learning rate is 0.6, the encrypted model has an accuracy of 96.32%, which is similar to the accuracy of the unencrypted model.

[0287]

Table 3

[0288]

[0289] Table 3 shows the experimental results on the CiFAR-10 dataset. It can be seen that the model trained in an encrypted state and the MNIST dataset has similar accuracy to the model trained in an unencrypted state.

[0290] Because previous HE-based algorithms for logistic recursion approximate the logistic function within a narrow domain, learning models in the related art may not be able to train on the MNIST dataset when the learning rate is large (e.g., greater than 0.4). If the learning rate is reduced to avoid this, the convergence speed will be reduced and performance will deteriorate. The lower performance of smaller learning rates in the MNIST dataset, namely 0.1, 0.2, and 0.41, supports this. In short, previous HE-based algorithms can use limited learning rates, which may lead to performance degradation. In contrast, the present application can use any learning rate and achieve good performance with fewer iterations.

[0291] This application describes a new framework for privacy assurance in machine learning. Instead of fixing the domain of each polynomial approximation with a fixed domain for each non-polynomial, each non-polynomial is approximated by a polynomial with a carefully chosen domain. As a result, this new framework can be selectively implemented on a given dataset and given parameters.

[0292] The domain extension function according to an embodiment of the present application can be applied to a sigmoid function, such as a logical function, and can efficiently expand the approximate domain of a given approximate polynomial given in a narrow domain. The domain extension function according to the present application also has the advantage of maintaining significantly small intermediate values ​​during calculation.

[0293] Meanwhile, according to various embodiments, the above-mentioned encryption method can be implemented in the form of program code for performing each step and can be stored in a recording medium and distributed. In this case, a device having the recording medium installed therein can perform the above-mentioned operations, such as encryption, ciphertext processing or the above-mentioned similar operations.

[0294] The recording medium may be various types of computer-readable media such as ROM, RAM, memory chip, memory card, external hard disk, hard disk, CD, DVD, magnetic disk, or magnetic tape.

[0295] Although the present disclosure has been described with reference to the accompanying drawings, it should be understood that the scope of the present disclosure is defined by the claims described below and should not be interpreted as being limited to the above-described embodiments and / or drawings. It is clearly understood that improvements, changes, and modifications that are obvious to those skilled in the art are also within the scope of the present disclosure as defined by the claims.

Claims

1. A method for processing homomorphic ciphertext, the method comprising: receiving non-polynomial operation commands related to homomorphic ciphertext; calculating an approximate polynomial function corresponding to the non-polynomial operation; Performing an operation on the homomorphic ciphertext using the calculated polynomial function; and Output the homomorphic ciphertext of the operation, The approximate polynomial function is a second approximate polynomial function obtained by expanding a first approximate polynomial function to obtain a second range wider than the first range, and the first approximate polynomial function has a preset accuracy within the first range using the non-polynomial operation. Wherein said calculating said approximate polynomial function comprises: determining the first approximating polynomial; and A second approximating polynomial is calculated that has a value within the first range corresponding to the calculated value of the first approximating polynomial in the first range, and has a value within the second range outside the first range corresponding to the calculated value of the first approximating polynomial at the end of the first range.

2. The method according to claim 1, wherein Calculating the second approximating polynomial includes determining the number of iterations and a basic function based on the first range and the second range, and iteratively constructing the basic function and a scaled basic function corresponding to the basic function with the determined number of iterations to calculate the second approximating polynomial.

3. The method according to claim 1, wherein The non-polynomial operations include logical functions, The second range for the logic function is calculated by the following formula: Among them, C α,d,t refers to the upper end value of the second range, α refers to the learning rate, d refers to the number of attributes of the data, and t refers to the number of learnings of the logistic recursion analysis.

4. The method according to claim 1, wherein The non-polynomial operation uses at least one of a logistic function, a hyperbolic tangent function, an erf function, an arc tangent function, a Gaussian function, or a ReLU-n function.

5. A processing device comprising: a memory configured to store at least one instruction; and a processor configured to execute the at least one instruction, The processor receives a non-polynomial operation command related to the homomorphic ciphertext, calculates an approximate polynomial function corresponding to the non-polynomial operation by executing the at least one instruction, and uses the calculated polynomial function to perform the operation on the homomorphic ciphertext. wherein the approximate polynomial function is a second approximate polynomial function obtained by extending a first approximate polynomial function to have a second range wider than the first range, the first approximate polynomial function having a preset accuracy using the non-polynomial operation within the first range, The processor determines the first approximating polynomial and calculates a second approximating polynomial, wherein the second approximating polynomial has a value within the first range corresponding to a calculated value of the first approximating polynomial in the first range, and the second approximating polynomial has a value within the second range outside the first range corresponding to a calculated value of the first approximating polynomial at an end of the first range.

6. The processing device according to claim 5, wherein The processor determines a number of iterations and a basis function based on the first range and the second range, and iteratively constructs the basis function and a scaled basis function corresponding to the basis function with the determined number of iterations to calculate a second approximation polynomial.

7. The processing device according to claim 5, wherein The non-polynomial operations include logical functions, The second range for the logic function is calculated by the following formula Among them C α,d,t refers to the upper end value of the second range, α refers to the learning rate, d refers to the number of attributes of the data, and t refers to the number of learnings of the logistic regression analysis.

8. The processing device according to claim 5, wherein The non-polynomial operation uses at least one of a logistic function, a hyperbolic tangent function, an erf function, an arc tangent function, a Gaussian function, or a ReLU-n function.

Images