Homomorphic encryption bootstrap method and apparatus, processor, system on chip, and computing device

Abstract

Embodiments of the present application provide a homomorphic encryption bootstrapping method and device, a processor, a system on chip and a computing device. The homomorphic encryption bootstrapping method comprises: homomorphic encryption of a plaintext belonging to a plaintext space of a first variable type is performed using an RLWE key to obtain a first RLWE ciphertext; a plurality of rotation factors based on a polynomial ring in which the RLWE key is located are determined based on a plurality of RLWE encryption matrices of an LWE private key vector, the polynomial ring corresponding to a plaintext space of a second variable type; and rotation processing is sequentially performed on the first RLWE ciphertext based on the plurality of rotation factors to obtain a second RLWE ciphertext after homomorphic decryption. In the process of homomorphic encryption bootstrapping, the scheme of the embodiments of the present application realizes the transformation of the plaintext corresponding to the RLWE ciphertext from the plaintext space of the first variable type to the plaintext space of the second variable type, and improves the computing efficiency of the ciphertext computation.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of computer technology, and in particular to a homomorphic encryption bootstrapping method and device, a processor, a system on chip and a computing device. BACKGROUND

[0002] As one of typical algorithms of outsourcing computation, homomorphic encryption technology has become one of the more popular fields in privacy computation due to its low communication interaction requirement and good security model.

[0003] Fully homomorphic encryption can perform secret computation such as multiplication and addition on encrypted data, and the security is reliably guaranteed through cryptography theory. With the significant increase in the depth and complexity of secret computation, the noise of secret data becomes larger, which is not conducive to accurate decryption of the ciphertext. The bootstrapping algorithm in the process of fully homomorphic encryption can effectively reduce the noise before the noise of the ciphertext accumulates to a large value, thereby ensuring the smooth progress of the secret computation process.

[0004] The Fast Fully Holomorphic Encryption Over the Torus (TFHE) based on the torus has strong Boolean operation capability, and can support infinite computation depth through the bootstrapping algorithm. However, in the case of large computation depth, the computation amount of the bootstrapping algorithm itself is large, resulting in low efficiency of secret computation. SUMMARY

[0005] Therefore, embodiments of the present application provide a homomorphic encryption bootstrapping method and device, a processor, a system on chip and a computing device to at least partially solve the above problems.

[0006] According to a first aspect of embodiments of the present application, a homomorphic encryption bootstrapping method is provided, comprising: performing homomorphic encryption on a plaintext belonging to a plaintext space of a first variable type using an RLWE key to obtain a first RLWE ciphertext; determining a plurality of rotation factors based on a plurality of RLWE encryption matrices of an LWE private key vector, the plurality of rotation factors being based on a polynomial ring in which the RLWE key is located, the polynomial ring corresponding to a plaintext space of a second variable type; and performing rotation processing on the first RLWE ciphertext in sequence based on the plurality of rotation factors to obtain a second RLWE ciphertext after homomorphic decryption.

[0007] In another implementation manner of the present application, the method further comprises: respectively encrypting each element of the LWE private key vector to obtain the plurality of RLWE encryption matrices.

[0008] In another implementation manner of the present application, the method further comprises: obtaining an LWE public key vector corresponding to the LWE private key vector, the LWE public key vector corresponding to the plaintext space of the first variable type; and determining a plurality of rotation factors based on a polynomial ring in which the RLWE key is located, based on the plurality of RLWE encryption matrices of the LWE private key vector and the LWE public key vector.

[0009] In another implementation manner of the present application, the sequentially performing rotation processing on the first RLWE ciphertext based on the plurality of rotation factors to obtain the second RLWE ciphertext after homomorphic decryption comprises: performing rotation processing on the first RLWE ciphertext based on a current rotation factor in the plurality of rotation factors to obtain the second RLWE ciphertext; and outputting the second RLWE ciphertext after homomorphic decryption if there is no next rotation factor in the plurality of rotation factors.

[0010] In another implementation manner of the present application, the sequentially performing rotation processing on the first RLWE ciphertext based on the plurality of rotation factors to obtain the second RLWE ciphertext after homomorphic decryption further comprises: updating the current rotation factor based on a next rotation factor in the plurality of rotation factors if the next rotation factor exists.

[0011] In another implementation manner of the present application, the method further comprises: performing polynomial decomposition on the first RLWE ciphertext based on a second modulus of the plaintext space of the second variable type to obtain a plurality of decomposition polynomials; and determining the second RLWE ciphertext based on a product of the current rotation factor in the plurality of rotation factors and the plurality of decomposition polynomials.

[0012] In another implementation manner of the present application, the method further comprises: determining a residue system representation of the first RLWE ciphertext based on a plurality of preset moduli; and converting the residue system representation into a base representation of the first RLWE ciphertext based on the second modulus; and performing polynomial decomposition on the first RLWE ciphertext to obtain a plurality of decomposition polynomials comprises: performing polynomial decomposition on the base representation of the first RLWE ciphertext to obtain a plurality of decomposition polynomials of the base representation.

[0013] In another implementation manner of the present application, the determining the second RLWE ciphertext based on the product of the current rotation factor in the plurality of rotation factors and the plurality of decomposition polynomials comprises: converting the plurality of decomposition polynomials in the base representation into a residue system representation based on the plurality of preset moduli; and determining the second RLWE ciphertext based on the product of the residue system representation based on the plurality of preset moduli and the plurality of decomposition polynomials.

[0014] In another implementation manner of the present application, the first variable type and the second variable type are different variable types in a Boolean variable, a short integer variable and a long integer variable.

[0015] According to a second aspect of the embodiments of the present application, a homomorphic encryption bootstrap device is provided, comprising: a first encryption unit, which homomorphically encrypts a plaintext belonging to a plaintext space of a first variable type by using an RLWE key to obtain a first RLWE ciphertext; a second encryption unit, which respectively determines a plurality of rotation factors based on a plurality of RLWE encryption matrices of an LWE private key vector, the plurality of rotation factors being based on a polynomial ring in which the RLWE key is located, the polynomial ring corresponding to a plaintext space of a second variable type; and a decryption unit, which respectively rotates the first RLWE ciphertext based on the plurality of rotation factors in sequence to obtain a second RLWE ciphertext after homomorphic decryption.

[0016] According to a third aspect of the embodiments of the present application, a processor is provided, comprising the homomorphic encryption bootstrap device according to the first aspect.

[0017] According to a fourth aspect of the embodiments of the present application, a system on chip is provided, comprising the processor according to the third aspect.

[0018] According to a fifth aspect of the embodiments of the present application, a computing device is provided, comprising the system on chip according to the fourth aspect.

[0019] In the scheme of the embodiments of the present application, the rotation of the first RLWE ciphertext based on the plurality of rotation factors of the polynomial ring in which the RLWE key is located realizes the homomorphic encryption bootstrap, in addition, the first RLWE ciphertext is obtained by homomorphically encrypting a plaintext belonging to a plaintext space of a first variable type, the polynomial ring corresponds to a plaintext space of a second variable type, and in the process of the homomorphic encryption bootstrap, the transformation of the plaintext corresponding to the RLWE ciphertext from the plaintext space of the first variable type to the plaintext space of the second variable type is realized, without performing the transformation of the plaintext space again before or after the homomorphic encryption bootstrap, thereby improving the computing efficiency of the ciphertext computation. BRIEF DESCRIPTION OF DRAWINGS

[0020] In order to make the technical solutions in the embodiments of the present application or the prior art clearer, the accompanying drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description are only some embodiments of the present application, and all other drawings obtained by those of ordinary skill in the art based on the accompanying drawings should belong to the protective scope of the present application.

[0021] Figure 1 Schematic diagram of a homomorphic encryption process according to an example.

[0022] Figure 2 Schematic block diagram of a computing device employing a homomorphic encryption component according to an embodiment of the present application.

[0023] Figure 3 Flowchart of steps of a homomorphic encryption bootstrapping method according to an embodiment of the present application.

[0024] Figure 4 Schematic block diagram of a homomorphic encryption bootstrapping apparatus according to another embodiment of the present application.

[0025] Figure 5 Schematic block diagram of a processor according to another embodiment of the present application.

[0026] Figure 6 Schematic block diagram of a system-on-a-chip according to another embodiment of the present application. DETAILED DESCRIPTION

[0027] In order to make the technical solutions in the embodiments of the present application or the prior art clearer, the accompanying drawings needed in the embodiments or prior art description will be briefly introduced. Obviously, the accompanying drawings in the following description are only some embodiments of the present application, and all other drawings obtained by those of ordinary skill in the art based on the accompanying drawings should belong to the protective scope of the present application.

[0028] The specific implementation of the embodiments of the present application will be further described below with reference to the accompanying drawings of the embodiments of the present application.

[0029] Homomorphic encryption (HE) refers to an encryption form that allows computation on ciphertext, generating an encrypted result that, when decrypted, matches the result of operating on the plaintext, as if the operation were done on the plaintext.

[0030] As Figure 1As shown, in process 1, the plaintext m is homomorphically encrypted using the first key (corresponding to the key represented by the box) to obtain the initial ciphertext. In process 2, the encrypted calculation F is performed based on the initial ciphertext to obtain the first ciphertext of F(m). As the noise generated during the calculation process accumulates, the reliability of the decryption process deteriorates. In process 3, the first ciphertext is converted into the second ciphertext using the second key, while removing the noise generated in the above encrypted calculation. The second ciphertext of F(m) (corresponding to the key represented by the circle) is then used to further perform the encrypted calculation.

[0031] In one example, in process 31, the first ciphertext of F(m) can be encrypted using the second key. Then, in process 32, the first key is homomorphically decrypted while the second key is in the encrypted state to obtain the second ciphertext of F(m).

[0032] Furthermore, in modern HE schemes, ciphertext can be organized as an algebraic ring with high dimension and large coefficients. Compared to traditional Learning with Errors (LWE), Ring Learning with Errors (RLWE) is a typical choice for algebraic rings, where the multiplication of two ciphertexts utilizes multiplication over high-order polynomials (e.g., 8192), where the coefficients modulo ("modulus" or "modulus number") are large integers (e.g., 220 bits).

[0033] Examples of HE application areas include healthcare, finance, and generally, fields that benefit from the combined analysis of data from multiple sources. Examples of HE application workloads include, but are not limited to, logistic regression training, Bayesian inference, or neural networks.

[0034] The Fast Fully Homomorphic Encryption Over the Torus (TFHE) algorithm (see paper: TFHE: Fast Fully Homomorphic Encryption over the Torus) has strong Boolean operation capabilities and can support infinite computation depth through a bootstrapping algorithm. However, with large computation depths, the bootstrapping algorithm itself incurs significant computational costs, resulting in low efficiency in encrypted computation. This invention proposes a series of schemes to improve the efficiency of encrypted computation.

[0035] The following is combined Figure 2 Examples of the software and hardware environments to which the solutions of embodiments of the present invention are applicable are described below. Figure 2In particular embodiments, computing device 100 represents a communication and data processing apparatus that includes or represents, without limitation, a smart voice command device, a smart personal assistant, a home / office automation system, a home appliance (e.g., a washing machine, a television, etc.), a mobile device (e.g., a smartphone, a tablet, etc.), a gaming device, a handheld device, a wearable device (e.g., a smartwatch, a smartband, etc.), a virtual reality (VR) device, a head-mounted display (HMD), an Internet of Things (IoT) device, a laptop computer, a desktop computer, a server computer, a set-top box (e.g., an Internet-based cable television set-top box, etc.), a Global Positioning System (GPS)-based device, an automotive infotainment device, etc.

[0036] In some embodiments, computing device 100 includes or works with any number and type of other smart devices or is embedded in or facilitates such smart devices, such as (but not limited to) autonomous machines or artificial intelligence agents, such as mechanical agents or machines, electronic agents or machines, virtual agents or machines, electromechanical agents or machines, etc. Examples of autonomous machines or artificial intelligence agents can include (but are not limited to) robots, autonomous vehicles (e.g., self-driving cars, self-driving airplanes, self-driving boats, etc.), autonomous device-operated construction vehicles, automatically operated medical devices, etc., etc. Moreover, an “autonomous vehicle” is not limited to a car, but rather they can include any number and type of autonomous machines, such as robots, autonomous devices, home autonomous devices, etc., and any one or more tasks or operations related to such autonomous machines can be interchangeably referred to with autonomous driving.

[0037] Moreover, for example, computing device 100 can include a computer platform that hosts an integrated circuit (“IC”), such as a system on a chip (“SOC” or “SoC”), in which various hardware and / or software components of computing device 100 are integrated on a single chip.

[0038] As shown, in one embodiment, computing device 100 can include any number and type of hardware and / or software components, such as (but not limited to) a graphics processing unit (“GPU” or simply “graphics processor”) 114, a graphics driver (also referred to as a “GPU driver,” “graphics driver logic,” “driver logic,” a user-mode driver (UMD), a user-mode driver framework (UMDF), or simply “driver”) 115, a central processing unit (“CPU” or simply “application processor”) 112, a memory 108, a network device, a driver, etc., and an input / output (I / O) source 104, such as a touchscreen, a touchpad, a touch mat, a virtual or regular keyboard, a virtual or regular mouse, a port, a connector, etc. Computing device 100 can include an operating system (OS) 106 that serves as an interface between the hardware and / or physical resources of computing device 100 and a user.

[0039] It should be appreciated that for some embodiments, fewer or more components than the above examples can be utilized. Thus, the configuration of the computing device 100 can vary from embodiment to embodiment depending on factors such as price constraints, performance requirements, technological improvements, or other circumstances.

[0040] Embodiments can be implemented as any or a combination of one or more microchips or integrated circuits, hardwired logic, software stored by a memory device and executed by a microprocessor, firmware, an application specific integrated circuit (ASIC), and / or a field programmable gate array (FPGA). The terms "logic," "module," "component," "engine," "circuitry," "element," and "mechanism" can include, among other things, software, hardware, and / or a combination thereof, such as firmware.

[0041] In one embodiment, as shown, the HE component 110 can be hosted by a memory 108 in communication with the I / O source(s) 104 of the computing device 100, such as a microphone, speaker, etc. In another embodiment, the HE component 110 can be part of or hosted by the operating system 106. In yet another embodiment, the HE component 110 can be hosted by or part of a graphics driver 115. In yet another embodiment, the HE component 110 can be hosted by or part of a hardware accelerator 114; for example, the HE component 110 can be embedded in or implemented as part of the processing hardware of the hardware accelerator 114, such as in the form of HE component 140. In yet another embodiment, the HE component 110 can be hosted by or part of a graphics processing unit ("GPU" or simply "graphics processor") 116 or firmware of the graphics processor 116; for example, the HE component can be embedded in or implemented as part of the processing hardware of the graphics processor 116, such as in the form of HE component 130. Similarly, in yet another embodiment, the HE component 110 can be hosted by or part of a central processing unit ("CPU" or simply "application processor") 112; for example, the HE component 120 can be embedded in or implemented as part of the processing hardware of the application processor 112, such as in the form of HE component 120. In some embodiments, the HE component 110 can be provided by one or more processors including one or more of a graphics processor, an application processor, and another processor, where the one or more processors are co-located on a common semiconductor package.

[0042] Embodiments are contemplated that are not limited to certain specific implementations or hosting of the HE component 110, and one or more portions or components of the HE component 110 can be implemented or hosted as hardware, software, or any combination thereof, such as firmware. In one embodiment, for example, the HE component can be hosted by a machine learning processing unit that is different from a GPU. In another embodiment, the HE component can be distributed between a machine learning processing unit and a CPU. In another embodiment, the HE component can be distributed between a machine learning processing unit, a CPU, and a GPU. In another embodiment, the HE component can be distributed between a machine learning processing unit, a CPU, a GPU, and a hardware accelerator.

[0043] The computing device 100 can host network interface(s) to provide access to a network, such as a LAN, a wide area network (WAN), a metropolitan area network (MAN), a personal area network (PAN), Bluetooth, a cloud network, a mobile network (e.g., third generation (3G), fourth generation (4G), etc.), an intranet, the Internet, and the like. The network interface(s) can include, for example, a wireless network interface with an antenna, which can represent one or more antennas. The network interface(s) can also include, for example, a wired network interface to communicate with a remote device via a network cable, which can be, for example, an Ethernet cable, a coaxial cable, an optical cable, a serial cable, or a parallel cable.

[0044] Figure 3 A flowchart of steps of a homomorphic encryption bootstrap method according to an embodiment of the present application. The homomorphic encryption bootstrap method of the present embodiment can be applicable to a homomorphic encryption component 110-140 of Figure 2 , including:

[0045] S210: Homomorphically encrypt a plaintext belonging to a plaintext space of a first variable type using an RLWE key to obtain a first RLWE ciphertext.

[0046] It should be understood that the first variable type and the second variable type are different variable types among a Boolean variable, a short integer variable, and a long integer variable. For example, the first variable type is a Boolean variable, and the second variable type is an integer variable, which includes a short integer variable or a long integer variable. For another example, the first variable type is a short integer variable, and the second variable type is a long integer variable. The second modulus of the plaintext space of the second variable type can correspond to the number of bits of a processor performing the homomorphic encryption bootstrap method, for example, a 64-bit processor or a 32-bit processor.

[0047] S220: Determine a plurality of rotation factors based on a plurality of RLWE encryption matrices of the LWE private key vector, respectively, based on a polynomial ring of the RLWE key, the polynomial ring corresponding to a plaintext space of the second variable type.

[0048] It should be understood that the polynomial ring is RQ = Z Q [x] / (x N +1).

[0049] It should also be understood that each element of the LWE private key vector can be encrypted separately to obtain a plurality of RLWE encryption matrices. The LWE ciphertext can be composed of an n-dimensional vector → a and a number b, for an LWE plaintext μ (between 0 and q / δ0-1), an n-dimensional LWE private key vector → s and a noise e with a smaller absolute value. Wherein, the encryption process of the LWE ciphertext is: Correspondingly, the decryption process is: For example, the LWE private key vector s[i] = 0 or 1, i is an integer, 0≤i<N≤1.

[0050] If s[i] = 0, then v(x)*x a[i]s[i] = v(x)*x0= v(x), and v(x)+v(x)*(x a[i] -1)*s[i] = v(x); if s[i] = 1, then v(x)*x a[i]s[i] = v(x)*x a[i] , and v(x)+v(x)*(x a[i] -1)*s[i] = v(x)+v(x)*(x a[i] -1) = v(x)*x a[i] . The rotation factor can be x a[i]s[i] , and the N-time rotation process realizes the point multiplication process of a[i]*s[i].

[0051] S230: based on a plurality of rotation factors respectively, sequentially rotating the first RLWE ciphertext to obtain a second RLWE ciphertext after homomorphic decryption.

[0052] It should be understood that the rotation process can be an N-time iteration process, wherein, for the current rotation factor, if there is no next rotation factor in the plurality of rotation factors, the second RLWE ciphertext after homomorphic decryption is output, and if there is a next rotation factor in the plurality of rotation factors, the current rotation factor is updated based on the next rotation factor.

[0053] In the scheme, the first RLWE ciphertext is rotated based on multiple rotation factors of a polynomial ring where an RLWE key is located, homomorphic encryption bootstrap is achieved, in addition, the first RLWE ciphertext is obtained by homomorphic encryption of a plaintext belonging to a plaintext space of a first variable type, the polynomial ring corresponds to a plaintext space of a second variable type, in the process of homomorphic encryption bootstrap, the transformation of the plaintext corresponding to the RLWE ciphertext from the plaintext space of the first variable type to the plaintext space of the second variable type is achieved, and the transformation of the plaintext space before or after the homomorphic encryption bootstrap is not required, thereby improving the calculation efficiency of the ciphertext calculation.

[0054] In some examples, the homomorphic encryption bootstrap method further includes: respectively encrypting each element of the LWE private key vector to obtain multiple RLWE encryption matrices. The multiple RLWE encryption matrices are beneficial to polynomial decomposition, thereby improving the calculation efficiency.

[0055] In some examples, the homomorphic encryption bootstrap method further includes: obtaining an LWE public key vector corresponding to the LWE private key vector, the LWE public key vector corresponding to the plaintext space of the first variable type. Further, based on the multiple RLWE encryption matrices of the LWE private key vector, multiple rotation factors based on the polynomial ring where the RLWE key is located are respectively determined, including: based on the multiple RLWE encryption matrices of the LWE private key vector and the LWE public key vector, the multiple rotation factors based on the polynomial ring where the RLWE key is located are determined, the multiple RLWE encryption matrices are more secure than the LWE private key vector, and in the process of homomorphic encryption bootstrap, the security of data calculation is ensured.

[0056] In some examples, the first RLWE ciphertext is sequentially rotated based on the multiple rotation factors to obtain the second RLWE ciphertext after homomorphic decryption, including: the first RLWE ciphertext is rotated based on a current rotation factor in the multiple rotation factors to obtain the second RLWE ciphertext; if there is no next rotation factor in the multiple rotation factors, the second RLWE ciphertext after homomorphic decryption is output. Alternatively, if there is a next rotation factor in the multiple rotation factors, the current rotation factor is updated based on the next rotation factor. Through such an iterative manner, convenient rotation processing is achieved, and the homomorphic decryption process is simplified.

[0057] More specifically, the process of multiplying the ciphertext of RLWE by x to the power of several times is called rotation of it, so this process is rotation. The LWE private key vector s[i] = 0 or 1, i is an integer, 0≤i<N≤1.

[0058] However, in fact, s[i] as a key cannot be transmitted in plaintext, that is, it cannot be directly rotated using the following formula in the calculation process:

[0059] If s[i] = 0, then v(x) * x a[i]s[i] = v(x) * x0= v(x), while v(x) + v(x) * (x a[i] -1) * s[i] = v(x); if s[i] = 1, then v(x) * x a[i]s[i] = v(x) * x a[i] , while v(x) + v(x) * (x a[i] -1) * s[i] = v(x) + v(x) * (x a[i] -1) = v(x) * x a[i] . The rotation factor can be x a[i]s[i] .

[0060] In some examples, the homomorphic encryption bootstrapping method further includes: performing polynomial decomposition on the first RLWE ciphertext based on a second modulus of a plaintext space of a second variable type, to obtain a plurality of decomposition polynomials. Further, performing rotation processing on the first RLWE ciphertext based on a current rotation factor in the plurality of rotation factors, to obtain the second RLWE ciphertext, includes: determining the second RLWE ciphertext based on a product of the current rotation factor in the plurality of rotation factors and the plurality of decomposition polynomials. Through polynomial decomposition, the computational efficiency of the product of the plurality of RLWE encryption matrices (for example, N) is improved.

[0061] In some examples, the homomorphic encryption bootstrapping method further includes: determining that the first RLWE ciphertext is represented in a residue system based on a plurality of preset moduli; and converting the residue system representation into a base representation of the first RLWE ciphertext based on a second modulus. Further, performing polynomial decomposition on the first RLWE ciphertext to obtain a plurality of decomposition polynomials includes: performing polynomial decomposition on the base representation of the first RLWE ciphertext to obtain a plurality of decomposition polynomials of the base representation. In this example, through the base representation of the first RLWE ciphertext, the computational efficiency of the processor is improved.

[0062] In some examples, determining the second RLWE ciphertext based on a product of the current rotation factor in the plurality of rotation factors and the plurality of decomposition polynomials includes: converting the plurality of decomposition polynomials of the base representation into a residue system representation based on a plurality of preset moduli; and determining the second RLWE ciphertext based on a product of the residue system representation based on the plurality of preset moduli and the plurality of decomposition polynomials. In this example, through the residue system representation, the computational efficiency of the product of the plurality of decomposition polynomials is improved.

[0063] More specifically, continuing the specific example described above, given that s[0] = 0 and s[1] = 1, the matrices are Ms[0] and Ms[1], respectively. When calculating the matrix-vector multiplication, the two polynomials in the RLWE ciphertext are decomposed respectively, and are respectively divided into l polynomials.

[0064] For a polynomial v(x), the decomposition method is as follows:

[0065]

[0066] where v(x)-Decompose(v(x))*(M / B,M / B2,···,M / Bl) has absolute values of coefficients all less than or equal to M / Bl, and M needs to be greater than or equal to Q; Decompose(.) represents the decomposition process.

[0067] For example, according to the TFHE scheme, as an example:

[0068]

[0069] v(x) = 100x + 31, M = 125, B = 5, l = 2, then the following operations are performed:

[0070]

[0071] It can be seen that 100x + 31-Decompose(100x + 31)*(25, 5) = 100x + 31-(100x + 25 + 5) = 1, and the absolute values of the coefficients of each term are all less than or equal to M / Bl = 5.

[0072] Without loss of generality, in the case of v(x) being represented in a residue system, it is necessary to first convert from the residue system representation back to a single modulus Q representation (an example of a base representation of the second modulus) using the Chinese Remainder Theorem (CRT) before proceeding to the decomposition process (i.e., polynomial decomposition) such as Decompose(.).

[0073] For example, Ms[i] (an example of an RLWE encryption matrix) can be used to represent the rotation process:

[0074] Initial RLWE ciphertext (an example of a first RLWE ciphertext): ct = (v0(x), v1(x)). For example, ct = (0, 10x).

[0075] Implementing one rotation For example, where the first RLWE ciphertext has a first variable type of plaintext space parameter q / δ,

[0076] Implementing N rotations, each of which is implemented as ct i +1 = ct i +Decompose(ct i *(x (a[t]*2N) / q -1))*Ms[i], obtaining a second RLWE ciphertext CT = ct n, the second RLWE ciphertext has a second variable type of plaintext space Q / Δ.

[0077] In one specific example, in the case of N = 2, ct1 = (0, 95) + Decompose((0, 95) * (x3-1)) Ms[0] = (0, 95) + Decompose((0, 10x+10)) Ms[0], where Decompose((0, 10x)) = (0, 0, 0, 2x+2), the result is:

[0078] ct1 = (0, 95) + ((52x+93)(2x+2), (93x+55)(2x+2)) = (80x+82, 86x+19).

[0079] ct2 = (80x+82, 86x+19) + Decompose((80x+82, 86x+19) * (x2-1)) Ms[1] = (80x+82, 86x+19) + Decompose((50x+46, 38x+67)) Ms[1], where Decompose((50x+46, 38x+67)) = (2x+1, 4, x+2, 2x+3), the result is:

[0080] ct2 = (80x+82, 86x+19) + ((30x+80)(2x+1) + (99x+57)4 + (85x+62)(x+2) + (18x+93)(2x+3), (55x+77)(2x+1) + (52x+4)4 + (62x+45)(x+2) + (93x+90)(2x+3)) = (88x+87, 81x+9). Accordingly, the output result is the ciphertext CT = ct2 = (88x+87, 81x+9) (an example of the second ciphertext).

[0081] The plaintext decrypted from this ciphertext is verified as: μ = "(81x+9-(88x+87)x) / 10" = "(-6x+-8) / 10" = -x-1. It can be seen that the constant term of the plaintext polynomial in Q / Δ is obtained as → a, b) represents the RLWE ciphertext of the opposite number (-1) of the plaintext (1), and the conversion from the parameter q / δ to Q / Δ is completed.

[0082] That is, based on the multiple RLWE encryption matrices of the LWE private key vector (for example, Ms[0] and Ms[1] described above) and the LWE public key vector, multiple rotation factors of the polynomial ring based on the RLWE key are determined (for example, in the processing manner in the TFHE technology), and in the polynomial decomposition process, the conversion from the remainder system representation to the single modulus Q representation is implemented, thereby realizing the conversion of the first variable type plaintext space to the second variable type plaintext space. Since the polynomial decomposition process is in the rotation operation, the ciphertext noise reduction processing is realized while the conversion of the plaintext space is realized.

[0083] Figure 4 A schematic block diagram of a homomorphic encryption bootstrap device according to another embodiment of the application.

[0084] The homomorphic encryption bootstrap device of the embodiment corresponds to Figure 3 the homomorphic encryption bootstrap method of the application, comprising:

[0085] The first encryption unit 410 performs homomorphic encryption on the plaintext belonging to the first variable type plaintext space by using the RLWE key to obtain the first RLWE ciphertext.

[0086] The second encryption unit 420 determines multiple rotation factors of the polynomial ring based on the RLWE key based on the multiple RLWE encryption matrices of the LWE private key vector, respectively, and the polynomial ring corresponds to the second variable type plaintext space.

[0087] The decryption unit 430 performs rotation processing on the first RLWE ciphertext in sequence based on the multiple rotation factors, respectively, to obtain the second RLWE ciphertext after homomorphic decryption.

[0088] In the scheme of the embodiment of the application, the rotation processing is performed on the first RLWE ciphertext based on the multiple rotation factors of the polynomial ring based on the RLWE key, thereby realizing the homomorphic encryption bootstrap. In addition, the first RLWE ciphertext is obtained by performing homomorphic encryption on the plaintext belonging to the first variable type plaintext space, and the polynomial ring corresponds to the second variable type plaintext space. In the process of homomorphic encryption bootstrap, the conversion of the plaintext corresponding to the RLWE ciphertext from the first variable type plaintext space to the second variable type plaintext space is realized, and the conversion of the plaintext space does not need to be performed again before or after the homomorphic encryption bootstrap, thereby improving the calculation efficiency of the ciphertext calculation.

[0089] In some other examples, the second encryption unit is further configured to encrypt each element of the LWE private key vector to obtain the multiple RLWE encryption matrices.

[0090] In some examples, the apparatus further includes an obtaining unit configured to obtain an LWE public key vector corresponding to the LWE private key vector, the LWE public key vector corresponding to a plaintext space of the first variable type. The second encrypting unit is specifically configured to determine a plurality of rotation factors of a polynomial ring based on a plurality of RLWE encryption matrices of the LWE private key vector and the LWE public key vector.

[0091] In some examples, the decrypting unit is specifically configured to perform rotation processing on the first RLWE ciphertext based on a current rotation factor in the plurality of rotation factors to obtain a second RLWE ciphertext, and output the homomorphic decrypted second RLWE ciphertext if there is no next rotation factor in the plurality of rotation factors.

[0092] In some examples, the decrypting unit is further configured to update the current rotation factor based on a next rotation factor in the plurality of rotation factors if the next rotation factor exists.

[0093] In some examples, the apparatus further includes a decomposing unit configured to perform polynomial decomposition on the first RLWE ciphertext based on a second modulus of the plaintext space of the second variable type to obtain a plurality of decomposition polynomials. The decrypting unit is specifically configured to determine the second RLWE ciphertext based on a product of the current rotation factor in the plurality of rotation factors and the plurality of decomposition polynomials.

[0094] In some examples, the apparatus further includes a representing unit configured to determine a residue system representation of the first RLWE ciphertext based on a plurality of preset moduli, and convert the residue system representation into a base representation of the first RLWE ciphertext based on the second modulus. The decomposing unit is specifically configured to perform polynomial decomposition on the base representation of the first RLWE ciphertext to obtain a plurality of decomposition polynomials of the base representation.

[0095] In some examples, the decomposing unit is specifically configured to convert the plurality of decomposition polynomials of the base representation into a residue system representation based on the plurality of preset moduli, and determine the second RLWE ciphertext based on a product of the plurality of preset moduli and the plurality of decomposition polynomials.

[0096] In some examples, the first variable type and the second variable type are different variable types in a Boolean variable, a short integer variable, and a long integer variable.

[0097] The apparatus of the present embodiment is used to implement the corresponding method in the foregoing method embodiments, and has the beneficial effects of the corresponding method embodiments, which will not be described here again. In addition, the function implementation of each module in the apparatus of the present embodiment can be referred to the description of the corresponding part in the foregoing method embodiments, which will not be described here again.

[0098] Figure 5 schematic block diagram of a processor according to another embodiment of the application. Figure 5 The processor of Figure 4 The homomorphic encryption bootstrap device 400 of Figure 2 The homomorphic encryption components 110-140 of

[0099] Figure 6 schematic block diagram of a system-on-a-chip according to another embodiment of the application. Figure 6 The system-on-a-chip of Figure 5 The processor 500 of Figure 2 The CPU 112 and / or GPU 116 of

[0100] Further, the specific implementation of each step in the program can refer to the corresponding description of the corresponding steps and units in the above-mentioned method embodiments, and will not be described here. Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working process of the devices and modules described above can refer to the corresponding process description in the foregoing method embodiments, and will not be described here.

[0101] It should be noted that, according to the needs of implementation, each component / step described in the embodiments of the application can be split into more components / steps, or two or more components / steps or part of the operations of the components / steps can be combined into a new component / step, to achieve the purpose of the embodiments of the application.

[0102] The above-mentioned method according to the embodiments of the application can be implemented in hardware, firmware, or as software or computer code that can be stored in a recording medium such as a CD ROM, a RAM, a floppy disk, a hard disk or a magneto-optical disk, or downloaded through a network and originally stored in a remote recording medium or a non-transitory machine-readable medium and then stored in a local recording medium, so that the method described herein can be processed by such software on a recording medium using a general-purpose computer, a special-purpose processor or programmable or special-purpose hardware such as an ASIC or an FPGA. It can be understood that the computer, the processor, the microprocessor controller or the programmable hardware includes a storage component (for example, RAM, ROM, flash memory, etc.) that can store or receive software or computer code, when the software or computer code is accessed and executed by the computer, the processor or the hardware, the method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the method shown herein, the execution of the code will convert the general-purpose computer into a special-purpose computer for executing the method shown herein.

[0103] Those skilled in the art can understand that the units and method steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software manner depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered as beyond the scope of the embodiments of the present application.

[0104] The above embodiments are only used to illustrate but not to limit the embodiments of the present application. Those skilled in the art can make various changes and modifications without departing from the spirit and scope of the embodiments of the present application. Therefore, all equivalent technical solutions belong to the scope of the embodiments of the present application, and the patent protection scope of the embodiments of the present application should be defined by the claims.

Claims

1. A homomorphic encryption bootstrapping method, comprising: Using the RLWE key, the plaintext in the plaintext space belonging to the first variable type is homomorphically encrypted to obtain the first RLWE ciphertext; Based on multiple RLWE encryption matrices of the LWE private key vector, multiple rotation factors are determined based on the polynomial ring in which the RLWE key is located, and the polynomial ring corresponds to the plaintext space of the second variable type; Based on the multiple rotation factors, the first RLWE ciphertext is rotated sequentially to obtain the second RLWE ciphertext after homomorphic decryption.

2. The method according to claim 1, wherein, The method further includes: Based on the RLWE key, the N elements of the LWE private key vector are encrypted respectively to obtain the plurality of RLWE encryption matrices, which are N RLWE encryption matrices.

3. The method according to claim 1, wherein, The method further includes: Obtain the LWE public key vector corresponding to the LWE private key vector, wherein the LWE public key vector corresponds to the plaintext space of the first variable type; The multiple RLWE encryption matrices based on the LWE private key vector respectively determine multiple rotation factors based on the polynomial ring containing the RLWE key, including: Based on the LWE private key vector, multiple RLWE encryption matrices and the LWE public key vector are used to determine multiple twitch factors based on the polynomial ring containing the RLWE key.

4. The method according to claim 3, wherein, The step of sequentially rotating the first RLWE ciphertext based on the plurality of rotation factors to obtain the homomorphically decrypted second RLWE ciphertext includes: Based on the current rotation factor among the plurality of rotation factors, the first RLWE ciphertext is rotated to obtain the second RLWE ciphertext. If there is no next rotation factor among the plurality of rotation factors, then output the second RLWE ciphertext after homomorphic decryption.

5. The method according to claim 4, wherein, The step of sequentially rotating the first RLWE ciphertext based on the plurality of rotation factors to obtain the homomorphically decrypted second RLWE ciphertext further includes: If a next rotation factor exists among the plurality of rotation factors, the current rotation factor is updated based on the next rotation factor.

6. The method according to claim 4, wherein, The method further includes: Based on the second modulus of the plaintext space of the second variable type, the first RLWE ciphertext is decomposed into multiple decomposed polynomials. The step of rotating the first RLWE ciphertext based on the current rotation factor among the plurality of rotation factors to obtain the second RLWE ciphertext includes: The second RLWE ciphertext is determined based on the product of the current twitch factor among the plurality of twitch factors and the plurality of decomposition polynomials.

7. The method according to claim 6, wherein, The method further includes: The first RLWE ciphertext is determined to be represented by a remainder system based on multiple preset moduli; The remainder system representation is converted into a base representation of the first RLWE ciphertext based on the second modulus; The first RLWE ciphertext is subjected to polynomial decomposition to obtain multiple decomposition polynomials, including: The base representation of the first RLWE ciphertext is decomposed into multiple decomposed polynomials in the base representation.

8. The method according to claim 7, wherein, The step of determining the second RLWE ciphertext based on the product of the current twitch factor among the plurality of twitch factors and the plurality of decomposed polynomials includes: The multiple decomposition polynomials represented in the given base are converted into a remainder system representation based on the multiple preset moduli; The second RLWE ciphertext is determined based on the product of the remainder system representation of the plurality of preset moduli and the plurality of decomposed polynomials.

9. The method according to claim 1, wherein, The first variable type and the second variable type are different variable types among Boolean variable, short integer variable, and long integer variable.

10. A homomorphic encryption bootstrap device, comprising: The first encryption unit uses the RLWE key to homomorphically encrypt the plaintext in the plaintext space belonging to the first variable type, thereby obtaining the first RLWE ciphertext; The second encryption unit, based on multiple RLWE encryption matrices of the LWE private key vector, determines multiple rotation factors based on the polynomial ring in which the RLWE key is located, wherein the polynomial ring corresponds to the plaintext space of the second variable type; The decryption unit performs rotation processing on the first RLWE ciphertext sequentially based on the multiple rotation factors to obtain the second RLWE ciphertext after homomorphic decryption.

11. A processor, comprising: The homomorphic encryption bootstrap device according to claim 10.

12. A system-on-a-chip, comprising: The processor according to claim 11.

13. A computing device, comprising: The system-on-a-chip according to claim 12.

Images