Homomorphic encryption bootstrapping method based on inter-small-area interpolation fitting approximation calculation

Abstract

This invention proposes a homomorphic encryption bootstrapping method based on small-interval interpolation fitting approximation. By performing Lagrange interpolation on the sine function within multiple small intervals, the polynomial computation degree is reduced. Furthermore, a comparison function is used to determine the interval containing the ciphertext. The final bootstrap result is obtained by multiplying the interpolation result with the ciphertext interval calculated by the comparison function. Different computational tasks, such as calculating the interpolation points and the comparison function, can be parallelized, significantly improving the scheme's efficiency. By approximating the comparison function using a small-interval fitting polynomial, a single comparison function operation requires only 0.47ms with 8-bit computational precision. With K = O(λ) intervals, the overall bootstrapping computation time after parallelization is significantly shorter than the original scheme's bootstrapping process.

Description

Technical Field

[0001] This invention relates to a bootstrap implementation method based on small-interval interpolation fitting, which achieves an approximate calculation of homomorphic encryption through Lagrange interpolation fitting within small intervals. Background Technology

[0002] With the development of technologies such as big data and the Internet of Things, user-generated data often needs to be stored on servers and processed by them. Sensitive and private user data may be leaked during information transmission and processing. In application areas involving sensitive user data, such as financial data computation, medical data processing, and smart grids, privacy-preserving computing technologies are needed to ensure user data security. Homomorphic encryption is a good encryption technology for handling privacy-preserving data computation. Users encrypt their sensitive and private data using homomorphic encryption before uploading it to the server. The server processes the encrypted data using homomorphic computation and returns the ciphertext result to the user. The user then decrypts the homomorphic computation result to obtain the plaintext result.

[0003] In 2017, Cheon et al. proposed a hierarchical homomorphic encryption scheme based on approximate computation in the paper CKKS17, “Cheon, JH, Kim, A., Kim, M., Song, Y. (2017). Homomorphic Encryption for Arithmetic of Approximate Numbers. In: Takagi, T., Peyrin, T. (eds) Advances in Cryptology–ASIACRYPT 2017. ASIACRYPT 2017. Lecture Notes in Computer Science(), vol 10624. Springer, Cham.”. This scheme encrypts at the word level, which facilitates arithmetic operations on the ciphertext and has great practical application value. Subsequently, Cheon et al. proposed a bootstrapping method for CKKS17 level homomorphic encryption in their 2018 paper CHK+18, “Cheon, JH, Han, K., Kim, A., Kim, M., Song, Y. (2018). Bootstrapping for Approximate Homomorphic Encryption. In: Nielsen, J., Rijmen, V. (eds) Advances in Cryptology–EUROCRYPT 2018. EUROCRYPT 2018. Lecture Notes in Computer Science(), vol 10820. Springer, Cham.”, converting the CKKS17 scheme into a fully homomorphic encryption scheme. Approximate computational homomorphic encryption schemes are word-level encryptions. During the encryption mapping process, the isomorphic transformation of the computational domain prevents direct implementation of homomorphic modular operations on the ciphertext, thus hindering direct bootstrapping operations.

[0004] Define q as the integer modulus, r as a positive integer, and CHK+18 as the sine function. To approximate the modular arithmetic, the specific implementation first uses Taylor expansion for calculation. and Recalculate After r-fold squaring, we get Finally, Euler's formula e ix =cosx + isinx from the exponential function Extracting the sine function from An approximate calculation of the modulus function is obtained. However, this calculation process is computationally intensive. Actual code testing shows that this step accounts for approximately 70% of the total bootstrapping time. Even with 8-bit precision, one bootstrapping operation takes 24.6 seconds, and in a 128-slot parallel computing configuration, the time-sharing computation still requires 1.2 seconds. Therefore, bootstrapping efficiency has become a critical issue that urgently needs to be addressed in homomorphic encryption schemes. Summary of the Invention

[0005] In practical engineering applications, such as medical data processing, the sheer volume of data computation makes it impossible to complete all data processing tasks using hierarchical homomorphic encryption alone. In such cases, bootstrapping techniques are needed to achieve a fully homomorphic encryption scheme. To overcome the problems of slow module function calculation and limited accuracy during the bootstrapping process of approximate homomorphic encryption schemes, this invention proposes a bootstrapping method for approximate homomorphic encryption schemes based on curve small-interval interpolation fitting. By interpolating and fitting within multiple small intervals, a more accurate and faster fitting polynomial is obtained over a larger interval, thereby improving bootstrapping efficiency and increasing the overall running speed of practical engineering applications.

[0006] The technical solution of this invention is as follows:

[0007] A homomorphic encryption bootstrapping method based on small-interval interpolation fitting approximation calculation includes the following steps:

[0008] Step 1: Initialization:

[0009] The settings parameters include: the security parameter λ of the homomorphic encryption scheme, the computational precision prec of the homomorphic encryption scheme, the number of slots N of the homomorphic encryption scheme, and the number of sub-intervals K after partitioning;

[0010] Step 2: Select the fitting function:

[0011] Approximate the sine curve using a Lagrange interpolation polynomial:

[0012] Step 2.1: Extract K = O(λ) interpolation intervals from the range [a, b] of the privacy data x to be bootstrapped;

[0013] Step 2.2: Select the one that satisfies The value of n is taken as the degree polyn of the Lagrange interpolation polynomial; for each small interpolation interval [x i,0 ,x i,polyn ], 1≤i≤K, the degree of the fitting polynomial in the small interpolation interval is polyn, the number of interpolation points to be selected is polyn+1, and it is stipulated that the two endpoints of the interpolation interval are selected, then the selected polyn+1 interpolation points are x. i,0 ,x i,1 ,…,x i,polyn-1 ,xi,polyn ;

[0014] Step 2.3: For the sine function y = f(x), calculate the two endpoints x. i,0 and x i,polyn The function values ​​at the points are respectively and Interpolation points x are selected at equal intervals according to the y-value. i,j j = 0, 1, ..., polyn, y-value intervals but Through the inverse function x = f(x) of y = f -1 (y) Calculate the polyn-1 interpolation points: j = 1, 2, ..., polyn;

[0015] Step 2.4: The above polyn+1 interpolation points Substitute into the Lagrange interpolation calculation formula Curve fitting yields the polynomial function L(x) = a0 + a1x + a2x 2 +…+a polyn x polyn ;

[0016] Step 2.5: Perform the above operation on all small interpolation intervals in the interval [a,b] to obtain K interpolation polynomials L. i (x), i = 1, 2, ..., K, these K interpolation polynomials constitute an approximate fit for the sine function within a selected small interval;

[0017] Step 3: Thread allocation

[0018] Request a thread pool with a maximum number of threads Tn; if Tn≥3K, then allocate 2K threads in step 4 and K threads in step 5; otherwise, allocate threads in step 4. One thread, allocated in step 5. One thread;

[0019] Step 4: Using the ciphertext to be bootstrapping, ct, calculate the vector cmans; the elements of cmans are cmans. i This indicates whether ct belongs to the subinterval [x] corresponding to the element. i,0 ,x i,polyn ]; pk is the public key, using Enc pk (μ) represents the result of encrypting plaintext μ using the public key pk:

[0020] Step 4.1: Calculate the starting point vector of the interpolation interval

[0021] begin=(Enc pk (x 1,0 -2 -prec),Enc pk (x 2,0 -2 -prec ),…,Enc pk (x K,0 -2 -prec ))

[0022] and the vector of the endpoint of the interpolation interval

[0023] end = (Enc pk (x 1,polyn +2 -prec ),Enc pk (x 2,polyn +2 -prec ),…,Enc pk (x K,polyn +2 -prec ));

[0024] Step 4.2: The calculation of the number of combinations is performed using a polynomial with a degree of 2n+1. Among them, take Through g(-x)=-g(x) and When x∈(0,δ], x<g(x)≤1, and when x∈[δ,1], g(x)≤1. Determine the function g n (x); denote the composite function f[g(x)] as via d g Next g n (x) and d f f n (x) Combination, calculate the sign function obtained from the fit:

[0025]

[0026] in σ≤|ab|;

[0027] Step 4.3: Calculation Where the normalized vector We obtain two vectors, lower and upper, with equal dimensions; for the inner product of these two vectors, cmpans = lower·upper, the result only tends to Enc on the interval corresponding to ct. pk (1) The results for all other intervals tend to be Enc pk (0); Returns the result cmpans;

[0028] Step 5: Substitute ct into the K interpolation polynomials L generated in Step 2 respectively. i(x), i=1,2,…,K, to obtain the interpolation result vector Lres=(L1(ct),L2(ct),…,L K (ct)); returns the result Lres;

[0029] Step 6: Calculate the fresh ciphertext:

[0030] For a relatively small modulus q, replace it with the new modulus Q.

[0031] Satisfying Q>>q and [<ct, sk>] Q = <ct,sk>(modx) N +1); For vectors Lres = CalPoly(ct) and cmpans = Cmp(ct), calculate the fresh ciphertext after bootstrapping. Return the result ct′.

[0032] Beneficial effects

[0033] The beneficial effects of this invention are:

[0034] In the bootstrapping process of traditional homomorphic encryption schemes based on approximate computation, the modular operation is first implemented through Taylor expansion. and Recalculate

[0035]

[0036] After r-fold squaring, we get Finally, Euler's formula e ix =cosx + isinx from the exponential function Extracting the sine function from This allows for an approximate calculation of the modular function. However, this calculation process is computationally intensive. Even with 8-bit precision, a single bootstrap operation takes 24.6 seconds, and in a 128-slot parallel computing configuration, the time-sharing calculation still requires 1.2 seconds.

[0037] This invention reduces the polynomial computation degree by performing Lagrange interpolation on the sine function within multiple small intervals. Furthermore, it uses a comparison function to determine the interval containing the ciphertext. The final bootstrap result is obtained by multiplying the interpolation result with the ciphertext interval calculated by the comparison function. Different computational tasks, such as calculating the interpolation points and the comparison function, can be parallelized, significantly improving the efficiency of the scheme. By approximating the comparison function using a small-interval fitting polynomial, a single comparison function operation requires only 0.47ms with 8-bit computational precision. With K = O(λ) intervals, the overall bootstrap computation time after parallel computation is far less than the original scheme's bootstrap process time.

[0038] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Detailed Implementation

[0039] This invention proposes a bootstrapping method for approximate computation of homomorphic encryption schemes based on curve small-interval interpolation fitting. By interpolating and fitting in multiple small intervals, a more accurate and faster fitting polynomial is finally obtained in a large interval, thereby improving bootstrapping efficiency and increasing the overall running speed of practical engineering applications.

[0040] This invention employs small-interval interpolation fitting to achieve high-precision and rapid calculation of trigonometric functions:

[0041] During the ciphertext computation, the value range of the private data x is [a, b], where a and b are both real numbers. This is achieved by using a sine function. When approximating the modulo function over this interval, it can be observed that only the interval where y′>0 and y approaches 0 is used. Therefore, n smaller intervals [x,b] can be extracted from the interval [a,b]. 1,0 ,x 1,m ]、[x 2,0 ,x 2,m ]、…、[x n,0 ,x n,m ], where a≤x 1,0 <x 1,m <...<x n,0 <x n,m ≤b. High-precision, fast interpolation fitting of curves can be achieved using polynomials with small degrees within small intervals, thus reducing the computational load of the bootstrap process.

[0042] However, using inter-interval interpolation introduces the problem of not being able to determine which inter-interval the ciphertext belongs to. Unlike plaintext computation, homomorphic operations cannot select intervals through branching statements. To solve this problem, a comparison function Cmp(ct) is introduced. This function takes the ciphertext ct as input and returns a result vector cmpans of length n. This vector consists of a ciphertext value approximately 1 and n-1 ciphertext values ​​approximately 0. A ciphertext value approximately 1 indicates that ct belongs to the corresponding inter-interval, while a ciphertext value approximately 0 indicates that ct does not belong to the corresponding inter-interval. Substituting the ciphertext ct into the fitting function corresponding to the n defined inter-intervals yields n approximate function values ​​y. i ,calculate y′ is the new ciphertext after bootstrapping.

[0043] The specific steps are as follows:

[0044] Step 1: Initialization:

[0045] Let the positive integer λ be the security parameter of the homomorphic encryption scheme. To ensure the security of the scheme, we take λ = 128 here. That is, when the security parameter is at least 128, the data security in the engineering application process can be guaranteed.

[0046] The positive integer K = O(λ) represents the number of subintervals after the partitioning.

[0047] The positive integer prec represents the set calculation precision for the scheme, meaning the calculation error of the scheme must be less than 2. -prec .

[0048] polyn represents the degree of the fitting polynomial for the scheme.

[0049] N is the number of slots in the scheme, and logN can generally be 15 or 16.

[0050] Choose an integer power of 2 M based on the integer N and Euler's totient function N = φ(M).

[0051] Choose an integer h and a real number σ > 0, and use... The variance is represented by σ. 2 The discrete Gaussian distribution is defined as a uniform distribution. Generate a vector {±1} with Hamming weight h and length N. N .

[0052] Define the distribution for a given probability ρ. by The probability of is +1 or -1, and the probability of 1-ρ is 0, where 0≤ρ≤1.

[0053] Let q be the modulus, sk be the private key, and let ε be the smallest possible value to satisfy the decryption process |[<ct,sk>]. q |≤ε·q, set the normalized vector

[0054] Step 2: Select the fitting function:

[0055] Approximate the sine curve using a Lagrange interpolation polynomial:

[0056] Step 2.1: Extract K = O(λ) interpolation intervals from the range [a, b] of the privacy data x to be bootstrapped;

[0057] Step 2.2: Select the one that satisfies The value of n is taken as the degree polyn of the Lagrange interpolation polynomial; for each small interpolation interval [x i,0 ,x i,polyn], 1≤i≤K, the degree of the fitting polynomial in the small interpolation interval is polyn, the number of interpolation points to be selected is polyn+1, and it is stipulated that the two endpoints of the interpolation interval are selected, then the selected polyn+1 interpolation points are x. i,0 ,x i,1 ,…,x i,polyn-1 ,x i,polyn ;

[0058] Step 2.3: For the sine function y = f(x), calculate the two endpoints x. i,0 and x i,polyn The function values ​​at the points are respectively and Interpolation points x are selected at equal intervals according to the y-value. i,j j = 0, 1, ..., polyn, y-value intervals but Through the inverse function x = f(x) of y = f -1 (y) Calculate the polyn-1 interpolation points: j = 1, 2, ..., polyn;

[0059] Step 2.4: The above polyn+1 interpolation points Substitute into the Lagrange interpolation calculation formula Curve fitting yields the polynomial function L(x) = a0 + a1x + a2x 2 +…+a polyn x polyn ;

[0060] Step 2.5: Perform the above operation on all small interpolation intervals in the interval [a,b] to obtain K interpolation polynomials L. i (x), i = 1, 2, ..., K, these K interpolation polynomials constitute the original sine function. Select an approximate fit within a small interval.

[0061] Step 3: Thread allocation

[0062] Request a thread pool with a maximum number of threads, Tn. If Tn ≥ 3K, then allocate 2K threads in step 4 and K threads in step 5; otherwise, allocate threads in step 4. One thread, allocated in step 5. One thread.

[0063] Step 4: Compare the function to calculate Cmp(ct):

[0064] The input value ct is the ciphertext to be bootstrapping, and the return vector cmpans contains the elements cmpans. i This indicates whether ct belongs to the subinterval [x] corresponding to the element. i,0,x i,polyn ]. pk is the public key, using Enc pk (μ) represents the result of encrypting plaintext μ using public key pk.

[0065] Step 4.1: Calculate the starting point vector of the interpolation interval

[0066] begin=(Enc pk (x 1,0 -2 -prec ),Enc pk (x 2,0 -2 -prec ),…,Enc pk (x K,0 -2 -prec ))

[0067] and the vector of the endpoint of the interpolation interval

[0068] end = (Enc pk (x 1,polyn +2 -prec ),Enc pk (x 2,polyn +2 -prec ),…,Enc pk (x K,polyn +2 -prec ));

[0069] Step 4.2: The calculation of the number of combinations is performed using a polynomial with a degree of 2n+1. Among them, take Through g(-x)=-g(x) and When x∈(0,δ], x<g(x)≤1, and when x∈[δ,1], g(x)≤1. Determine the function g n (x). Let the composite function f[g(x)] be denoted as via d g Next g n (x) and d f f n (x) Composition can approximate the sign function obtained by fitting, that is:

[0070]

[0071] in σ≤|ab|;

[0072] Step 4.3: Calculation Where the normalized vector We obtain two vectors, lower and upper, with equal dimensions. The inner product of these two vectors, cmpans = lower·upper, only tends towards Enc on the interval corresponding to ct. pk (1) The results for all other intervals tend to be Enc pk (0). The returned result is cmpans.

[0073] Step 5: Calculate the interpolation result CalPoly(ct):

[0074] Substitute ct into the K interpolation polynomials L generated in step 2 respectively. i (x), i=1,2,…,K, to obtain the interpolation result vector Lres=(L1(ct),L2(ct),…,L K (ct)). Returns the result Lres.

[0075] Step 6: Calculate the fresh ciphertext:

[0076] For the smaller modulus q, replace it with the new modulus Q.

[0077] Satisfying Q >> q and [<ct, sk>] Q =<ct,sk>(mod x) N +1). For vectors Lres = CalPoly(ct) and cmpans = Cmp(ct), compute the fresh ciphertext after bootstrapping. Return the result ct′.

[0078] As can be seen, for the 3K operations of calculating Cmp(ct) and the lower and upper operations in calculating CalPoly(ct), the data do not affect each other, and the calculation operations can be parallelized to significantly reduce the time consumption of the bootstrapping process.

[0079] The embodiments of the present invention are described in detail below. These embodiments are exemplary and intended to explain the present invention, and should not be construed as limiting the present invention.

[0080] Step 1: Initialization

[0081] Set the parameters λ = 128, logN = 15, prec = 16, K = 100, Tn = 300.

[0082] Step 2: Select the fitting function

[0083] Let ε = 0.01 satisfy |[<ct,sk>] q If |≤ε·q, then the selected K=100 interpolation intervals are [-0.01+kq, 0.01+kq], k=-49,-48,…,50, and the length of each interpolation interval is 2ε=0.02. Substituting the above data into… Calculations show that the interpolation polynomial degree polyn must satisfy polyn≥3. Taking the lower bound polyn=3, we need to take 4 interpolation points.

[0084] Taking k=0 as an example to demonstrate the Lagrange interpolation process, for ease of demonstration, we take q=1000 for calculation: From ε=0.01, k=0, Given that the interpolation interval is [-0.01, 0.01], the function values ​​at the two endpoints x0 = -0.01 and x3 = 0.01 can be calculated.

[0085] y0=f(x0)=-0.009999999993420265, y3=f(x3)=0.009999999993420265.

[0086] The remaining two interpolation points are selected at equal intervals according to the y-values, and the change in y-value Δy is...

[0087] Δy=y3-y0=0.019999999986840530

[0088] Then the function values ​​corresponding to the remaining two interpolation points can be calculated.

[0089]

[0090] function The inverse function is Using y1 and y2 and x = f -1 (y) can be used to calculate the independent variable values ​​corresponding to the remaining two interpolation points, namely x1 = f -1 (y1) = -0.003333333331383783 and x2 = f -1 (y2) = 0.003333333331383783, from which four interpolation points were obtained, namely:

[0091] (x0,y0)=(-0.01,-0.009999999993420265)

[0092] (x1,y1)=(-0.003333333331383783,-0.0033333333311400884)

[0093] (x2,y2)=(0.003333333331383783,0.0033333333311400884)

[0094] (x3,y3)=(0.01,0.009999999993420265)

[0095] Calculate the Lagrange interpolation basis function We can obtain:

[0096] l0(x) = -562499.9999177533x 3 +5624.999999177532x 2

[0097] +6.249999991775334x-0.062499999917753325

[0098] l1(x) = 1687500.0007402198x 3 -5624.999999177532x 2

[0099] -168.750000074022x+0.5624999999177533

[0100] l2(x) = -1687500.0007402198x 3 -5624.999999177532x 2

[0101] +168.75000007402195x+0.5624999999177533

[0102] l3(x) = 562499.9999177533x 3 +5624.999999177532x 2

[0103] -6.249999991775333x-0.062499999917753325

[0104] Then the polyn-th degree Lagrange interpolation polynomial can be expressed as: After sorting, we can obtain:

[0105] L(x) = -6.579733963008039 × 10 -6 x 3 +0.999999999999998x

[0106] -1.0842021724855044×10 -19 Taking x as values ​​of 0, 0.5, and 1 as examples, the corresponding y values ​​can be calculated using y = L(x) as -1.0842021724855044 × 10⁻⁶. -19The errors between 0.4999991775332545 and 0.9999934202660368 and the true values ​​of the modulo function (0, 0.5, 1) are respectively...

[0107] -1.0842021724855044×10 -19 0.0000008224667455 and 0.0000065797339632 both meet the accuracy requirement of the prec range.

[0108] Step 3: Thread allocation

[0109] Given K=100, the subsequent comparison function and interpolation result calculation function contain a total of 3K=300 independent computational subtasks. For current computers, 300 threads can be directly requested to perform parallel computation on the subsequent tasks. K=100 is used to facilitate the explanation of the instantiation process of this invention. In actual use, if 3K is greater than the maximum number of threads that can be requested, thread pool technology can be used to dynamically manage and allocate threads.

[0110] Step 4: Comparison function calculation

[0111] Select a polynomial function with a maximum degree of 9.

[0112]

[0113] Fit the comparison function and take d f =3,d g =6, the comparison function can be expressed as:

[0114]

[0115] In this example, 100 interpolation intervals are selected [-0.01+kq, 0.01+kq], k = -49, -48, ..., 50. Taking q = 1000 as an example, the x-axis coordinate vector of the starting point of the interpolation interval is...

[0116] (-49000.01,-48000.01,…,-1000.01,-0.01,999.99,…,48999.99,49999.99)

[0117] The x-axis coordinate vector of the endpoint of the interpolation interval is

[0118] (-48999.99,-47999.99,…,-999.99,0.01,1000.01,…,49000.01,50000.01).

[0119] Subtract υ = 2 from each element in the starting coordinate vector -prec≈0.000016, thus obtaining

[0120] (-49000.010016,-48000.010016,…,-1000.010016,-0.010016,999.989984,…,48999.989984,49999.989984),

[0121] Add υ to each element of the endpoint coordinate vector to obtain

[0122] (-48999.989984,-47999.989984,…,-999.989984,0.010016,1000.010016,…,49000.010016

[0123] ,50000.010016).

[0124] Encrypting each element in the two vectors above yields:

[0125] begin=(Enc pk (-49000.010016),Enc pk (-48000.010016),…,

[0126] Enc pk (-1000.010016),Enc pk (-0.010016),Enc pk (999.989984)

[0127] …,Enc pk (48999.989984), Enc pk (49999.989984))

[0128] end = (Enc pk (-48999.989984), Enc pk -47999.989984),…,

[0129] Enc pk (-999.989984), Enc pk (0.010016), Enc pk (1000.010016),

[0130] …,Enc pk (49000.010016),Enc pk (50000.010016))

[0131] Set the normalization vector Norm = (49q, 48q, ..., 2q, q, 1, q, 2q, 49q, 50q). Assume the input bootstrap ciphertext is Enc. pk (1.5), then the corresponding function can be calculated. The trigonometric function input value is Perform the following operations on each item in the begin and end vectors respectively:

[0132]

[0133] Taking k=0 and the interpolation interval [-0.01, 0.01] as an example, calculate:

[0134]

[0135] For i∈[0,48], 0<l i <1, -1 <r i <0, then:

[0136]

[0137] For i∈[50,99], -1<l i <0, 0<r i <1, there is:

[0138]

[0139] The above calculations yield two vectors, lower and upper, with equal dimensions, where:

[0140] When i = 49, lower i =Enc pk (1), upper i =Enc pk (1);

[0141] When 0 ≤ i ≤ 48, lower i =Enc pk (1) When 50≤i≤99, lower i =Enc pk (0);

[0142] When 0 ≤ i ≤ 48, upper i =Enc pk (0), when 50≤i≤99, upper i =Enc pk (1);

[0143] It can be observed that, except when i=49, the comparison results for both lower and upper are Enc. pk(1) The results obtained for all other bits of lower and upper are different, resulting in an Enc pk (1) and an Enc pk (0).

[0144] Calculate the inner product cmpans = lower·upper. Observe that the ciphertext result of cmpans at i = 49 is Enc. pk (1), the ciphertext result for all other bits is Enc pk (0). The returned result is cmpans.

[0145] Step 5: Calculate the interpolation results

[0146] For the 100 interpolation polynomials calculated in the second step, the ciphertext Enc to be bootstrapping will be used respectively. pk (1.5) Substitute it into the equation. For example, for the interval [-0.01, 0.01], the interpolation polynomial obtained by Lagrange interpolation for this interval is known to be L. 49 (x) = -6.579733963008039 × 10 -6 x 3 +0.9999999999999998x-1.0842021724855044×10 -19 Then L can be calculated. 49 (Enc pk (1.5))=Enc pk (1.4999777933978744).

[0147] The interpolation result vector Lres = {L i (x)}, i=0,1,…,99, return the result Lres.

[0148] Step 6: Calculate the fresh ciphertext

[0149] For a smaller modulus q, replace it with a new modulus Q, satisfying Q >> q and

[0150] [<ct,sk>] Q = <ct,sk>(modx) N +1).

[0151] Calculate the fresh ciphertext after bootstrapping Return the result ct′.

[0152] The above process describes the parameters λ = 128, logN = 15, prec = 16, K = 100, Tn = 300, ct = Enc pk(1.5) is used as an example to illustrate the bootstrapping process calculated using Lagrange interpolation polynomials. This invention divides a large interpolation interval into multiple smaller interpolation intervals and uses Lagrange interpolation and other polynomial interpolation methods to interpolate the trigonometric functions in each smaller interval. As can be seen from the demonstration, when the security parameter λ = 128 and the calculation precision prec = 16, the highest degree of the Lagrange interpolation polynomial only requires 3, significantly reducing computational complexity. Since homomorphic computation cannot implement logical jumps and cannot determine which smaller interval the bootstrap data belongs to, this invention uses a comparison function to compare the bootstrap data with the left and right endpoints of each interpolation interval. The results of the comparisons are multiplied, and finally, only the interval to which the bootstrap data belongs is the ciphertext Enc. pk (1) The remaining intervals are all ciphertext Enc pk (0), thus achieving the purpose of determining the interval to which the bootstrap data belongs.

[0153] Although embodiments of the present invention have been shown and described above, it is understood that the above embodiments are exemplary and should not be construed as limiting the present invention. Those skilled in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present invention without departing from the principles and spirit of the present invention.

Claims

1. A homomorphic encryption bootstrap method based on cell-wise interpolation fitting approximation calculation, characterized in that: The method comprises the following steps: Step 1: initialization: Setting parameters include: security parameter λ of homomorphic encryption scheme, calculation precision prec of homomorphic encryption scheme, slot number N of homomorphic encryption scheme, and small interpolation interval number K after segmentation; Step 2: selecting fitting function: Approximately fitting the sinusoidal curve by using Lagrange interpolation polynomial: Step 2.1: intercepting K = O(λ) small interpolation intervals in the value range [a, b] of the privacy data x to be bootstrapped; Step 2.2: Choose n values satisfying as the degree of the Lagrange interpolation polynomial polyn; for each small interpolation interval [x i,0 ,x i,polyn ], 1≤i≤K, the fitting polynomial degree of the small interpolation interval is polyn, the number of interpolation points to be selected is polyn+1, and the two endpoints of the small interpolation interval are selected. Then the polyn+1 interpolation points selected are x i,0 ,x i,1 ,…,x i,polyn-1 ,x i,polyn ; Step 2.3: For the sinus function y = f(x), calculate the function values at the two end points x i,0 and x i,polyn , respectively, and According to the equidistant selection of y values, select the interpolation points x i,j , j = 0, 1,..., polyn, y value interval Then Calculate polyn-1 interpolation points not containing the two end points through the inverse function x = f -1 (y) of y = f(x): Step 2.4: Compute polyn+1interpolation points Substitute into Lagrange interpolation formula Perform curve fitting to obtain polynomial function L(x) = a0+ a1x + a2x 2 +…+a polyn x polyn ; Step 2.5: For all small interpolation intervals on the interval [a, b], do the above operation to get K interpolation polynomials L i (x), i = 1, 2, …, K, which K interpolation polynomials constitute the approximate fitting of the sine function in the selected small interpolation interval; Step 3: thread allocation A thread pool with maximum thread number Tn is applied; if Tn≥3K, 2K threads are allocated in step 4, and K threads are allocated in step 5, otherwise 1 thread is allocated in step 4, and 2 threads are allocated in step 5. ​​ Step 4: Compute vector cmpans using the to-be-bootstrapped ciphertext ct; the element cmpans i of cmpans i,0 represents whether ct belongs to the small interpolation interval [x i,polyn , x+1] corresponding to the element; pk is the public key, and Enc pk (μ) represents the result of encrypting plaintext μ using public key pk: Step 4.1: calculating small interpolation interval start point vector begin = (Enc pk (x 1,0 - 1 ), Enc -prec (x pk - 2 ), …, Enc 2,0 (x -prec - n )) begin = (Enc pk (x K,0 - 2 -prec )) And small interpolation interval end point vector end = (Enc pk (x 1,polyn + 2 -prec ), Enc pk (x 2,polyn + 2 -prec ), …, Enc pk (x K,polyn + 2 -prec )) ; Step 4.2: The calculation of the number of combinations, select the degree of 2n+1 polynomial Wherein By g(-x)=-g(x) and Make x∈(0,δ] when x < g(x) ≤1, x∈[δ,1] when g(x)∈[0.75,1], determine the function g n (x); the composite function f[g(x)] is recorded as By d g g n (x) and d f f n (x) composite, calculate the fitted sign function: wherein σ < |a - b|; Step 4.3: Compute where the normalized vector result in two vectors of equal dimension, lower and upper; the inner product of these two vectors, cmpans i = lower · upper, only on the interval corresponding to ct, the result tends to Enc pk (1), and on other intervals, the result tends to Enc pk (0); return the result cmpans; Step 5: Substitute ct into the K interpolation polynomials L generated in Step 2 respectively i (x), i = 1, 2, …, K, to get the interpolation result vector Lres = (L1(ct), L2(ct), …, L K (ct)); return the result Lres; Step 6: calculating fresh ciphertext: Fresh ciphertext after computation bootstrap Return result ct'.

2. The homomorphic encryption bootstrap method based on the approximate calculation of the interpolation fitting between cells according to claim 1, characterized in that: The security parameter λ of the homomorphic encryption scheme is 128, and logN is 15 or 16.

3. The homomorphic encryption bootstrap method based on the approximate calculation of the interpolation fitting between cells according to claim 1, characterized in that: The sinusoidal function y = f(x) is

Images