Methods, systems, and services for evaluating an encrypted data one or multi-variate real-valued function

Abstract

This invention relates to a homomorphic encryption method and variations thereof, which enables the evaluation of real-valued functions on encrypted data, thereby allowing for more extensive and efficient homomorphic processing on encrypted data.

Description

Technical Field

[0001] This invention relates to improving the homomorphic evaluation of one or more functions applied to pre-encrypted data. Based on recent work in cryptography, this technical field may include many applications in all areas of activity where confidentiality restrictions exist (such as, but not limited to, applications for privacy protection, applications for trade secrets, or applications for medical data).

[0002] More specifically, the present invention relates to a method for performing computations required to automatically complete homomorphic evaluations of one or more functions by one or more specially programmed computer systems. Therefore, it is necessary to consider limited storage and computation time capabilities, or, in the case of remote processing such as cloud computing, transmission capabilities known to the information processing system that should perform this type of evaluation.

[0003] As will be described below, the development of homomorphic encryption methods has been greatly hampered to date by the technical limitations inherent in most schemes proposed in the literature, which are related to computer processing power, particularly in terms of the machine resources required to perform different computational stages and the computation time required to support them. Background Technology

[0004] Fully homomorphic encryption schemes ( Fully Homomorphic encryption (abbreviated as FHE) enables any participant to send a set of ciphertext (corresponding to plaintext) Publicly converts to a given function corresponding to plaintext. The encrypted text is transmitted to the participant, who does not have permission to access the plaintext. It is well known that this scheme can be used to construct structures that conform to private life (…). privacy preserving The protocol allows users to store encrypted data on a server and authorize third parties to perform operations on the encrypted data without having to expose the data itself to the server.

[0005] The first generation of fully homomorphic encryption schemes was proposed only in 2009 by Gentry (who obtained US Patent No. 8630422B2 in 2014 based on his initial application in 2009); see also [Craig Gentry, “Fully homomorphic encryption using ideal lattices”, in 41st Annual ACM Symposium on Theory of Computing, pages 169-178, ACM Press, 2009]. Gentry's construction is no longer used nowadays, but one of the features it introduced, "bootstrapping", and in particular one of its implementations, is widely used in subsequent proposed schemes. Bootstrapping is a technique to reduce the noise of the ciphertext: indeed, in all known FHE schemes, the ciphertext includes a small amount of random noise, which is necessary for security. When operations are performed on the noisy ciphertext, the noise increases. After a given number of operations have been evaluated, this noise becomes too high, potentially compromising the result of the computation. Bootstrapping is thus a cornerstone of the construction of homomorphic encryption schemes, but this technique is very costly, both in terms of memory used and computation time.

[0006] Work following Gentry's publication aimed at providing new schemes and improving bootstrapping in order to make homomorphic encryption feasible in practice. The most famous constructions are DGHV [Marten van Dijk, Craig Gentry, Shai Halevi and Vinod Vaikuntanathan, "Fully homomorphic encryption over the integers", in Advances in Cryptology - EUROCRYPT 2010 , volume 6110 de Lecture Notes in Computer Science , pp. 24-43, Springer, 2010], BGV [Zvika Brakerski, Craig Gentry and Vinod Vaikuntanathan, "(Leveled) fully homomorphic encryption without bootstrapping", in ITCS 2012; 3rd Innovations in Theoretical Computer Science , pages 309-325, ACM Press, 2012], GSW [Craig Gentry, Eds, Amit Sahai and Brent Waters, "Homomorphic encryption from learning with errors: Conceptually simpler, asymptotically faster, Attribute-based", in Advances in Cryptology- CRYPTO 2013 , Part I , volume 8042 de Lecture Notes in Computer Science, pp.75-92, Springer, 2013] and variants thereof. While performing bootstrapping in the first generation of Gentry’s scheme is not feasible in practice (a lifetime is not enough to complete the computation), successive constructions have made this operation feasible, though not very practical (each bootstrapping lasts several minutes). A faster bootstrapping performed on GSW-type schemes has been proposed by Ducas and Micciancio in 2015 [Léo Ducas and Daniele Micciancio, “FHEW: Bootstrapping homomorphic encryption in less than a second”, in Advances in Cryptology - EUROCRYPT 2015 , Part I , Volume 9056 de Lecture Notes in Computer Science , pages 617-640, Springer, 2015]: the bootstrapping operation is performed in slightly more than half a second. In 2016, Chillotti, Gama, Georgeva and Izabachene proposed a new variant of FHE scheme, called TFHE [IIaria Chillotti, Nicolas Gama, Mariya Georgieva and Malika Izabachène, “Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds”, in Advances in Cryptology – ASIACRYPT 2016 , Part I , volume 10031 de Lecture Notes in Computer Science , pages 3-33, Springer, 2016]. Their bootstrapping technique has been the basis for subsequent works. Mention can be made of these works: Bourse et al. [Florian Bourse, Micheles Minelli, Matthias Minihold and Pascal Paillier, “Fast homomorphic evaluation of deep discretised neural networks”, in Advances in Cryptology - CRYPTO 2018 , Part III , volume 10993 de Lecture Notes in Computer Science, pages 483-512, Springer, 2018], Carpov et al. [Sergiu Carpov, Malika Izabachène and Victor Mollimard, “New techniques for multi-value input homomorphic evaluation and applications”, in Topics in Cryptology - CT-RSA 2019 , volume 11405 de Lecture Notes in Computer Science , pages 106-126, Springer, 2019], Boura et al. [Christina Boura, Nicolas Gama, Mariya Georgieva and Dimitar Jetchev, “Simulating homomorphic evaluation of deep learning predictions”, in Cyber Security Cryptography and Machine Learning (CSCML 2019) , volume 11527 de Lecture Notes in Computer Science , pages 212-230, Springer, 2019] and Chillotti et al. [Ilaria Chillotti, Nicolas Gama, Mariya Georgieva and Malika Izabachène, “TFHE: Fast fully homomorphic encryption over the torus”, Journal of Cryptology , 31(1), pp.34-91, 2020]. The TFHE performance is significant. They contributed to the research progress in this field and made homomorphic encryption more practical. The new techniques proposed make it possible to compute a bootstrap in a few milliseconds.

[0007] Technical problem

[0008] Despite the progress, the known computing procedures allow to publicly convert a set of ciphertexts (corresponding to plaintexts ) into a ciphertext corresponding to a given function of the plaintexts, but remain limited to certain cases or remain impractical. Indeed, the main general means currently consists in representing this function in the form of a Boolean circuit composed of logic gates of AND, NOT, OR or XOR type, then in including the use of a bootstrapping to evaluate the function ciphertext as input, homomorphically evaluates this circuit. A measure of the complexity of a Boolean circuit is its multiplication depth, defined as the maximum number of consecutive AND gates that should be computed in order to obtain the result of the computation. In order to keep control over the noise during this computation, it is necessary to perform bootstrapping operations regularly during its course. As indicated above, even using the latest techniques, these bootstrapping operations involve complex computations and, due to the large multiplication depth, make the entire computation even slower. This approach is only feasible for functions operating on binary inputs and having a simple Boolean circuit.

[0009] In general, the function to be evaluated takes one or more real-valued variables as input. There can even be several functions to be evaluated on a set of real-valued variables. Therefore, there is a major technical and economic interest in finding a method that allows to quickly perform the above operation, i.e. to publicly convert a set of ciphertexts (corresponding to plaintext ) into a set of ciphertexts corresponding to a plurality of real-valued functions of the plaintext without resorting to overly bulky computing means. In fact, the theoretical progress made by Gentry in 2009 has not yet been known to be practically materialized, due to the lack of an efficient solution to this technical problem. The present invention provides an answer to this problem. SUMMARY

[0010] The present application describes a set of methods intended to be executed in digital form by at least one specially programmed information processing system, in order to efficiently and publicly convert a set of ciphertexts (corresponding to plaintext ) into a set of ciphertexts corresponding to a plurality of functions of the plaintext . This new method converts the multivariate function into a combination of sums of univariate functions and compositions of univariate functions. Preferably, the intermediate values resulting from the conversion of the function are reused in the evaluation. Finally, each univariate function is preferably represented in the form of a table, instead of the usual form of a Boolean circuit.

[0011] It is worth noting that any multivariate function defined on real numbers and having real values is supported. The inputs are pre-encoded in order to ensure compatibility with the original space of messages of the underlying encryption algorithm. After decryption, decoding can also be applied at the output on the image of the considered function.

[0012] The technical effects of the invention are significant, as the techniques it implements, whether considered independently or in combination, will allow to apply a plurality of functions to perform evaluations while greatly reducing complexity and reducing the necessary computation time. As described below, this reduction is due in particular to the facts that (i) the multivariate functions to be evaluated are converted to univariate functions, rather than directly handling functions of several variables; (ii) these functions can be decomposed so that the results of intermediate computations are shared, rather than being evaluated separately; and (iii) the resulting univariate functions are represented by tables, rather than by Boolean circuits.

[0013] When a function has several variables , the method according to the invention is to convert the function into a combination of sums of univariate functions and compositions of univariate functions. It should be noted that both operations of sum of univariate functions and composition of univariate functions allow to express affine transformations or other linear combinations. By analogy with neural networks, the expression "network of univariate functions" is used to designate a representation that, when the conversion from multivariate to univariate is done, combines sums of univariate functions and compositions of univariate functions, this network will perform homomorphic evaluations on several encrypted values. The conversion can be exact or approximate; however, it should be noted that an exact conversion is an error-free approximate conversion. In practice, the network thus obtained has the characteristic of having a low depth compared to a Boolean circuit implementing the same functionality. This new representation of the function is then used to evaluate an encrypted input , where designates an encryption algorithm and encode designates an encoding function, which will allow to start from an input of the type to end with computations of the type of some univariate functions , where are intermediate results. These computations take advantage of the homomorphic properties of the encryption algorithm.

[0014] When the same network of univariate functions is reused several times, it makes sense not to redo all the stages of computation. Thus, according to the invention, a first step consists in precomputing the network of univariate functions; then in subsequent steps, homomorphic evaluations are performed on encrypted data.

[0015] The fact that any continuous multivariate function can be written as a sum of univariate functions and compositions of univariate functions has been proven by Kolmogorov in 1957, [Arey N. Kolmogorov, “On the representation of continuous functions of several variables by superposition of continuous functions of one variable and addition”,Dokl. Akad. Nauk SSSR , 114, pp. 953-956, 1957.

[0016] This result remained theoretical for a long time, but an algorithmic version was discovered, particularly by Sprecher, who proposed an algorithm in which he explicitly described the method for constructing univariate functions [David A. Sprecher, “On the structure of continuous functions of several variables”, Transactions of the American Mathematical Society , 115, pp.340-355, 1965]. It can be found in the article [Pierre-Emmanuel Leni, Yohan Fougerolle and Frédéric Truchetet, “Théorème de superposition de Kolmogorov et son application à la decomposition defenses multivariées”, in MajecSTIC ’08 A detailed description of this can be found in [29–31 Octobre 2008, Marseille, France, 2008]. Furthermore, it should be noted that the assumption of continuity of the function to be decomposed can be relaxed by considering approximations of the latter.

[0017] Another possible approach involves approximating a multivariable function by using the sum of a special multivariable function known in English as a ridge function [BF Logan and LA Shepp, “Optimal reconstruction of a function from its projections”, Duke Mathematical Journal , 42(4), pp. 645-659, 1975]. Real-valued variable vectors The ridge function is applied to the vector of variables and the vector of real parameters. The function of the scalar product, i.e. Functions of type, where It is a univariate function. As noted above, a scalar product or equivalent linear combination is a special case of the combination of the sum of univariate functions and the composition of univariate functions; decomposing a multivariate function into a sum of ridge functions forms one embodiment of the transformation from multiple variables to a single variable according to the present invention. It is known that if the number of ridge functions can be increased, any multivariate function can be approximated by ridge functions with the desired high precision [Allan Pinkus, “Approximating by ridge functions”, in A. LeMéhauté, C. Rabut and LL Schumaker (Éds.), Surface Fitting and Multiresolution Methods [Pages 279-292, Vanderbilt University Press, 1997]. These mathematical results yield a known method of projective tracery (…). projection pursuit A statistical optimization method named after Jerome H. Friedman and Werner Stuetzle, “Projection pursuit regression”, Journal of the American Statistical Association , 76(376), pp. 817-823, 1981].

[0018] Using the so-called Replacing the ridge function with a radial function of the same type is also a possibility [DS Broomhead and David Lowe, “Multivariable functional interpolation and adaptive networks”, Complex Systems [2, pp. 321-355, 1988], and other basic families of functions can also be used with similar approximate quality (convergence rate).

[0019] In some cases, formal decomposition is possible without resorting to Kolmogorov's theorem or one of its algorithmic versions (such as the Sprecher algorithmic version) or through ridge functions, radial functions, or their variants. For example, functions (Especially as the so-called "max pooling" layer used by neural networks) it can therefore be decomposed as follows: ,in Corresponding to a univariate function .

[0020] Given function of these functions are represented by univariate function networks that are later intended to be evaluated homomorphically on encrypted data, this evaluation can be performed in an optimized way when all or part of one or more of these univariate functions are reused. Thus, for each redundancy observed in the set of univariate function networks, certain procedures for the homomorphic evaluation of univariate functions on encrypted values will only have to be performed once. Knowing that this homomorphic evaluation of functions is typically done on the fly and greatly increases the processing speed, sharing intermediate values yields very significant performance gains.

[0021] Three possible types of optimization are considered:

[0022] Same function, same parameter

[0023] This optimization consists, with the same number of univariate functions, in preferring univariate function networks in which the same univariate function is applied the maximum number of times to the same parameter. Indeed, each time a univariate function is the same with the input on which it is evaluated, homomorphic evaluation of this univariate function on this input does not need to be recomputed.

[0024] Different functions, same parameter

[0025] This optimization is applicable when homomorphic evaluation of two or more univariate functions on the same input can essentially be done at the cost of a single homomorphic evaluation, one embodiment allowing to share most of the computations. A similar situation is considered in the above-mentioned article of CT-RSA 2019 under the name of multi-output version. An example of such an embodiment is presented in the “DETAILED DESCRIPTION” section. In the multivariate case, this situation occurs for example in the decomposition of several multivariate functions in the form of a sum of ridge functions or radial functions when the decomposition coefficients are fixed.

[0026] Same function, parameter differing by a non-zero additive constant

[0027] Another situation that allows to speed up the computations is when the same univariate function is evaluated on parameters that differ by a known difference. This occurs for example when using a decomposition of Kolmogorov type, in particular the version of Sprecher’s approximation algorithm. In this case, the decomposition involves so-called “internal” univariate functions; see in particular the application of internal functions in the “DETAILED DESCRIPTION” section. In the latter case, the additional cost is minimal.

[0028] These optimizations are applicable in the case where several functions should be evaluated, but they are also applicable in the case of a single function to be evaluated . In all cases, it is meaningful to produce a univariate function network which not only reduces the number of univariate functions, but also preferably uses different functions on the same parameters, or the same function on parameters differing by a non-zero additive constant, thereby reducing the evaluation cost. This property is specific to homomorphic evaluation of univariate function networks on encrypted inputs.

[0029] Whether the function to be evaluated according to the application is multivariate and the first step proposed above has been performed, or whether it is intended to process original univariate functions, the application provides a method for performing homomorphic evaluation of these univariate functions, and in an advantageous variant, a representation in table form is used for this purpose.

[0030] Homomorphic evaluation of univariate functions, or more generally of combinations of univariate functions, is based on a homomorphic encryption scheme.

[0031] The LWE (for Learning With Errors Learning With Errors ) problem was proposed by Regev in 2005 [Oded Regev, “On lattices, learning with errors, random linear codes, and cryptography”, in 37th Annual ACM Symposium on Theory of Computing , pages 84-93, ACM Press, 2005] enabling the construction of homomorphic encryption schemes on many algebraic structures. Typically, an encryption scheme comprises an encryption algorithm and a decryption algorithm such that if is an encryption of a plaintext , then returns the plaintext . Encryption algorithms derived from the LWE problem and its variants have the property of introducing noise in the ciphertext. This is referred to as the plaintext native space, to indicate the space of the plaintexts on which the encryption algorithm is defined, and on which the decryption of the ciphertext, taking into account some noise, produces the original plaintext of this plaintext space. It should be remembered that for an encryption algorithm with plaintext native space , the encoding function encode is a function that brings an element of an arbitrary set into the set or a subset thereof; preferably, this function is injective.

[0032] As described in detail in the aforementioned article by Chillotti et al. (ASIACRYPT 2016), applied to the ring of real numbers modulo 1 , such a scheme is defined as follows. For a positive integer , the encryption key is vector Plaintext original space is Elements of the torus The LWE ciphertext is vector Among them, for , yes The random elements, and among them , It is based on Low noise from a random error distribution centered at 0. From the ciphertext Begin with the key Understanding allows you to find As The elements of a torus. It should be remembered that two elements of a torus can be added, but their dot product is undefined. The symbol " "" represents the cross product between an integer and a torus element.

[0033] In the same article, the author also described based on -module The plan, in which and These are polynomial rings and For strictly positive integers and The encryption key is vector , ,in Plaintext original space is . polynomial The RLWE ciphertext is vector Among them, for , yes The random polynomial and where (exist In, i.e., modulo ), It is based on Low noise in the random error distribution on the ciphertext. Begin with the key Understanding allows you to find (exist (China) as The element. The symbol "" is used here. "express The outer product on top. The R in RLWE stands for the word "ring". These variations of the LWE problem have already been discussed in [Damien Stehlé, Ron Steinfeld, Keisuke Tanaka and Keita Xagawa, "Efficient public key encryption based on ideal lattices", in Advances in Cryptology - ASIACRYPT 2009 , volume 5912 of Lecture Notes in Computer Science , pages 617–635, Springer, 2009] and [Vadim Lyubashevsky, Chris Peikert, and Oded Regev, “On ideallattices and learning with errors over rings”, in Advances in Cryptology - EUROCRYPT 2010 , volume 6110 of Lecture Notes in Computer Science It was proposed in [pages 1–23, Springer, 2010].

[0034] Finally, this same article, ASIACRYPT 2016, introduces the outer product between RLWE-type ciphertext and RGSW-type ciphertext (representing Gentry-Sahai-Waters, where "R" stands for ring). Remember that RLWE-type encryption produces RGSW-type encryption. Use the notation from the previous paragraph. For integers... , Indicates in It has lines and A matrix of columns, where each row is an RLWE-type encryption of polynomial 0. Then, polynomial The RGSW ciphertext is composed of a matrix Given, among which It is defined in The so-called "gadget" matrix in the middle (with lines and (list), and by Given, where for a given cardinality , yes The same matrix of the same size. Therefore, the tool association is represented as... The conversion makes for Each vector (row) of the polynomial in the expression. We have and Very small. (Polynomial) RGSW type cryptographic text With (polynomial) RLWE type ciphertext The outer product of is expressed as Defined as The ciphertext obtained from this It is a polynomial The RLWE type ciphertext. A proof is given in the aforementioned paper, ASIACRYPT 2016.

[0035] As shown, the aforementioned scheme is a so-called symmetric or private-key encryption scheme. This is by no means a limitation, as Rothblum in [Ron Rothblum, “Homomorphic encryption: From private-key to public-key”, in...] Theory of Cryptography (TCC 2011) , volume 6597 of Lecture Notes in Computer Science As shown in [pages 219-234, Springer, 2011], any additive homomorphic private-key encryption scheme can be transformed into a public-key encryption scheme.

[0036] As mentioned above, bootstrapping refers to a method that allows for the reduction of any possible noise present in the ciphertext. In Gentry's inaugural paper at STOC 2009, he used what is now commonly known as "re-encryption" (…). re-encryption The technique of "bootstrapping" is used to implement bootstrapping, and is thus introduced. Re-encryption involves homomorphically evaluating the decryption algorithm in the cipher domain. In the plain domain, the encryption algorithm takes the ciphertext... and private key As input, and return the corresponding plaintext. In the secret domain, homomorphic encryption algorithms are used. and encoding function The evaluation of the decryption algorithm takes encrypted ciphertext and encrypted ciphertext As input, and thus according to the algorithm The encryption key is used to give a new encrypted ciphertext of the same plaintext. Therefore, it is assumed that the ciphertext is obtained using a homomorphic encryption algorithm. The output given does not constitute a limitation, because re-encryption technology allows the end in this case.

[0037] The homomorphic properties of LWE-type encryption schemes and their variants allow for manipulation of plaintext through operations on the corresponding ciphertext. A unary function to be evaluated. domain of is discretized into several intervals covering its domain. Each interval is represented by a value and the corresponding value of the function . Thus, the function is displayed as a list of pairs of the form . These pairs are actually used to homomorphically compute, starting from the ciphertext of , the ciphertext or an approximation of for any value of in the domain of the function.

[0038] In the present invention, the core of this homomorphic computation is a new generic technique combining bootstrapping and encoding. Several embodiments are described in the "DETAILED DESCRIPTION" section.

[0039] The homomorphic evaluation techniques described in the aforementioned article from ASIACRYPT 2016 and the homomorphic evaluation techniques introduced in the aforementioned follow-up works are not able to homomorphically evaluate any function on any domain. First, these are strictly limited to univariate type functions. No response is known in the prior art in the multivariate case. Moreover, in the univariate case, the prior art assumes conditions on the input values or on the function to be evaluated. Among these limitations, note for example the input limited to binary values (bits) or the required négacyclique property of the function to be evaluated (for example, verified by the "sign" function on the torus). For functions with real-valued variables, there is no generic treatment of input values and output values allowing to end in these special cases in the prior art.

[0040] On the contrary, embodiments of the present invention are able to homomorphically evaluate functions with real-valued variables on inputs of LWE-type ciphertexts of real numbers, while controlling the noise at the output (bootstrapping), regardless of the form of the functions or their domain. BRIEF DESCRIPTION OF DRAWINGS

[0041] Figure 1 schematically illustrates a pre-computation step including the conversion of the multivariate function into a univariate function network composed of sums of univariate real-valued functions and compositions of univariate real-valued functions; a pre-selection step including the identification of redundancies of types 1, 2 and 3 in said pre-computed univariate function network; and the selection of all or part of the identified redundancies including a standard evaluation.

[0042] Figure 2 schematically illustrates a pre-computation step including the conversion of the multivariate function into a sum of univariate continuous functions and a composition of univariate continuous functions including the univariate functions and . ​

[0043] Figure 3 evaluation of a univariate real-valued function is illustrated schematically, said evaluation taking as input real-valued variables uses two homomorphic encryption algorithms (denoted and ) and a homomorphic encryption algorithm . DETAILED DESCRIPTION

[0044] The invention allows, by means of at least one specially programmed information processing system, to evaluate in digital form on encrypted data one or more functions with one or more variables having real values, each function taking as input a plurality of real-valued variables from the real-valued variables .

[0045] When at least one of said functions takes as input at least two variables, the method according to the invention schematically comprises three steps:

[0046] 1. a so-called pre-computation step, comprising the conversion of each of said multivariate functions into a network of univariate functions consisting of sums of univariate functions and compositions of univariate functions;

[0047] 2. a so-called pre-selection step, comprising the identification in said pre-computed network of univariate functions of different types of redundancies and the selection of all or part of them;

[0048] 3. a so-called homomorphic evaluation step of each of said pre-computed network of univariate functions, in which the redundancies selected in said pre-selection step are evaluated in an optimized manner.

[0049] As regards the second step (pre-selection), the selection of all or part of the redundancies is mainly, but not exclusively, guided by the objectives of optimizing the digital processing of the homomorphic evaluation, whether in terms of computational gain or for availability reasons, such as the memory resources for storing intermediate calculation values.

[0050] Figure 1 The first two steps are schematically reproduced when they are implemented by a computer system programmed for this purpose in accordance with the invention.

[0051] Thus, in one of the embodiments of the invention, one or more multivariate functions with real values are evaluated, each function taking as input a plurality of real-valued variables from the variables , and at least one of said functions taking as input at least two variables, taking as input for each of the inputs an encrypted ciphertext , and returning a plurality of encrypted ciphertexts applied to the corresponding inputs of , wherein is a homomorphic encryption algorithm, is an encoding function that associates to each real number an element of the plaintext original space of characterized in that:

[0052] 1. a pre-computation step consisting in transforming each of said multivariate functions into a univariate function network composed of sums of univariate functions and compositions of univariate functions with real values;

[0053] 2. a pre-selection step consisting in identifying in said pre-computed univariate function network redundancies of one of the three following types:

[0054] a. identical univariate functions applied to identical parameters;

[0055] b. different univariate functions applied to identical parameters;

[0056] c. identical univariate functions applied to parameters differing by a non-zero additive constant;

[0057] and selecting all or part of them;

[0058] 3. a step of homomorphic evaluation of each of said pre-computed univariate function network, wherein the redundancies selected in said pre-selection step are evaluated in an optimized manner.

[0059] Concerning the pre-computation step, the explicit version of the Kolmogorov superposition theorem allows to confirm that any continuous function (defined on the same hypercube of dimension ) can be written as a sum of univariate continuous functions and compositions of univariate continuous functions:

[0060]

[0061] and

[0062]

[0063] where, in the case of a given number of variables, and are constants and is a continuous function. In other words

[0064]

[0065] As an example, Figure 2 illustrates the case .

[0066] The functions and​ are so-called "internal" and are independent of the given arity, they are independent of the function associates to each component of the real vector a value in . The function allows to associate to each vector a number in the interval , which will then serve as a parameter of the function to reconstruct the function by summation. It should be noted that the restriction of the domain of to the hypercube in Kolmogorov's theorem is usually made in the scientific literature to simplify its explanation. However, it is obvious that the theorem naturally extends to any parallelepiped with the same dimensionality

[0067] Sprecher proposes in [David A. Sprecher, "A numerical implementation of Kolmogorov's superpositions", Neural Networks , 9(5), pp. 765-772, 1996] and [David A. Sprecher, "A numerical implementation of Kolmogorov's superpositions II", Neural Networks , 10(3), pp. 447-457, 1997] respectively, algorithms for determining internal and external functions.

[0068] Instead of the function originally defined by Sprecher to construct (which is discontinuous for some input values), the function Constructive Approximation defined in [Jürgen Braun and Michael Griebel, "On a constructive proof of Kolmogorov's superposition theorem", , 30(3), pp. 653-675, 2007] can be used

[0069] Once the internal functions and ​​Once that's fixed, all that's left is to determine the outer function. (depends on the function) Therefore, Sprecher proposed for each ( )structure functions The sum of this function converges to the outer function. In the first When the step ends, The approximate result is given in the following form:

[0070]

[0071] in It makes The parameters are then determined. Therefore, the algorithm provides an approximate result regarding the Kolmogorov decomposition theorem. In fact, by... Obtain a fairly large and assumed The function can be obtained. The next approximate representation:

[0072]

[0073] Or

[0074]

[0075] Therefore, in one embodiment of the invention, the pre-calculation stage is characterized in that, for data from... at least one function in The transformation of the pre-computation step is ( and An approximate transformation of the form ), where It is a univariate function defined on the real number and having a real value, where It is a real constant. It is a unary function defined on real numbers and having real values. Determined to be for a given parameter of The function.

[0076] Another decomposition of multivariate functions The technique involves approximating it using the so-called ridge function and the following transformation:

[0077]

[0078] Where the coefficient It is a real number, and among them It is a unary function defined on real numbers and having real values. and the coefficients Determined to be for a given parameter of The function.

[0079] Then, this decomposition is approximate in general, with the aim of determining the optimal approximation, or an approximation with sufficient quality. This approximation serves as a projection pursuit ( projection pursuit This appears in literature focusing on statistical optimization. As mentioned earlier, a noteworthy result is that any function... It can be approximated in this way with arbitrarily high precision. However, in practice, Allowing exact decomposition is common, meaning that it can be analytically expressed as a sum of ridge functions for all or part of its input.

[0080] When function Pick of ( When a subset of ) variables is used as input, if these variables are represented as ( ), then the previous ridge decomposition is written as

[0081]

[0082] in and For functions Sum of coefficients ,function Sum of coefficients Determined to be for a given parameter of The function.

[0083] Therefore, in one embodiment of the present invention, the pre-calculation stage may be characterized by, for the data from... at least one function in The transformation of the pre-computation step is ( and An approximate transformation of the form ), where the coefficients are... It is a real number and its components It is a unary function defined on real numbers and having real values. and the coefficients Determined to be for a given parameter of The function.

[0084] A similar decomposition technique using the same statistical optimization tools is applied by taking a radial function instead of a ridge function, based on...

[0085]

[0086] where , and where the coefficients of the vector are real numbers, and where is a unary function defined on real numbers and having real values, said function and said coefficients being determined as a function of for a given parameter and a given norm . Typically, the Euclidean norm is used.

[0087] When the function takes as input a subset of variables of ( ), if one denotes these variables by ( ), the previous decomposition is written

[0088]

[0089] where and , for a function and coefficients , the function and coefficients are determined as a function of for a given parameter .

[0090] Thus, in one embodiment of the invention, the precomputation phase can be characterized, for at least one function from , by a transformation of the precomputation step of the form where , ( and ), and where the coefficients of the vector are real numbers, and where is a unary function defined on real numbers and having real values, said function and said coefficients being determined as a function of for a given parameter and a given norm .

[0091] As pointed out in the aforementioned article by Pinkus, another important class of function decompositions is when the coefficients are fixed, and the function is variable. This class applies both to decompositions in the form of ridge functions, and to decompositions in the form of radial functions. Several methods for solving this problem are known, under the names: von Neumann's algorithm, the cyclic coordinate algorithm, the Schur domain decomposition method, the Diliberto- Strauss algorithm, and variants found in the literature dedicated to tomography; see this article by Pinkus as well, and the references therein.

[0092] Thus, in a particular embodiment of the invention, this pre-computation phase is further characterized in that the coefficients are fixed.

[0093] In some cases, the transformation of the pre-computation step can be performed entirely through the use of equivalent forms of multivariate functions.

[0094] Consider to be a multivariate function. If this function computes the maximum of and , then it can use the formal equivalent where corresponds to the univariate function . The use of this formal equivalent allows to easily obtain other formal equivalents for the function . For example, since can be expressed in an equivalent way as , one obtains the formal equivalent where is the univariate function "absolute value", and where is the univariate function "divide by 2".

[0095] In general, for three variables or more , given , for any ( ), one iteratively obtains from the combination of the functions (absolute value) or .

[0096] Thus, in an embodiment of the invention, the pre-computation phase can be characterized in that the transformation of this pre-computation step uses the formal equivalent to express the function as a combination of sums of univariate functions and compositions of univariate functions.

[0097] In a particular embodiment of the application, this pre-computation phase can be further characterized in that, when the function comprises three variables or more, the formal equivalence is obtained from an iteration of the formal equivalence for two variables.

[0098] Likewise, for "min" functions, the formal equivalence can be used, where , or , because , by iteration, it generally allows to decompose an m-variables function formally into a combination of sums of unary functions and compositions of unary functions.

[0099] Thus, in an embodiment of the application, the pre-computation phase can be characterized in that the transformation of this pre-computation step uses the formal equivalence to represent the function as a combination of sums of unary functions and compositions of unary functions.

[0100] In a particular embodiment of the application, this pre-computation phase can be further characterized in that, when the function comprises three variables or more, the formal equivalence is obtained from an iteration of the formal equivalence for two variables.

[0101] Another very useful multi-variables function, which can be simply decomposed formally into a combination of sums of unary functions and compositions of unary functions, is the multiplication. A first embodiment is to use the formal equivalence , which involves the unary function . Of course, the use of the formal equivalence can give other formal equivalences. Thus, as an example, by using , it is deduced that ; i.e. the formal equivalence , which involves the unary function .

[0102] Thus, in an embodiment of the application, the pre-computation phase can be characterized in that the transformation of this pre-computation step uses the formal equivalence to represent the function as a combination of sums of unary functions and compositions of unary functions.

[0103] By observing that ( ), these embodiments can be generalized to ( ) variables functions. ​

[0104] In a particular embodiment of the invention, this pre-computation phase is further characterized in that, when the function comprises three variables or more, the formal equivalences are obtained from an iteration of the formal equivalences for two variables.

[0105] The second embodiment is to decompose into , involving the unary function and ; or, for any base , as because where , involving the unary function and . Again, in this case, when it is observed that ( ), these embodiments can be generalized to variable functions ( ).

[0106] Thus, in an embodiment of the invention, the pre-computation phase can be characterized in that the transformation of this pre-computation step uses the formal equivalence to express the function as a combination of a sum of unary functions and a composition of unary functions.

[0107] In a particular embodiment of the invention, this pre-computation phase is further characterized in that, when the function comprises three variables or more, the formal equivalences are obtained from an iteration of the formal equivalences for two variables.

[0108] As mentioned previously, the multivariate function given as input is transformed into a network of multivariate functions. This network is not necessarily unique, even in the case where the transformation is exact.

[0109] For example, we see here at least two decompositions of the multivariate function , namely and . In particular, each of these transformations can be detailed as follows:

[0110] 1.

[0111] • Assume , and define

[0112] • Write

[0113] 2.

[0114] • Assume and

[0115] • Define and

[0116] • Write where

[0117] In general, two types of operations are observed in unary function networks: summation of unary functions and evaluation. When the evaluation of the network is homomorphically conducted on encrypted values, the most costly operation is the evaluation of the unary functions, as this often results in a bootstrapping step. It is therefore meaningful to produce a network of unary functions that minimizes the evaluation operations of these unary functions.

[0118] Thus, in the preceding embodiment, we can see that the first transformation of the "maximum" function seems more advantageous, as it only requires one evaluation of a unary function, namely the evaluation of the function In practice, the difference is not significant, as the second unary function in the second transformation does not really need to be evaluated: all it needs to do is return or integrate this factor into the decoding function at the output. In general, unary functions that include multiplication by a constant can be ignored by either (i) computing multiples of the initial function, or (ii) by "absorbing" the constant when these functions are at the input of another unary function. For example, the multivariate function can be written as

[0119] 1.

[0120] • Assume and define

[0121] • Define

[0122] 2. Write where

[0123] •

[0124] • Assume and

[0125] • Define and

[0126] 3. Write where

[0127] (In the second case, multiplication by the function is "absorbed").

[0128] In addition to unary functions of the type (constant addition) or multiplication by a constant , other cases produce faster evaluation of unary functions.

[0129] denote the set of unary functions with their corresponding parameters (x ) resulting from the transformation by in the pre-computation step, some unary functions can be identical.

[0130] Three types of optimization are considered:

[0131] 1) Identical functions, identical parameters:

[0132] and (type 1). This optimization is trivial. It consists in reusing previously computed results. Thus, if there exists such that has already been evaluated, and for , must not be recomputed.

[0133] 2) Different functions, identical parameters

[0134] and (type 2). In some cases, the cost of evaluating homomorphically two or more unary functions on the same parameters can be less than the sum of the costs of considering these functions separately. Typically, a single bootstrap step is required. In this case, among two unary function networks comprising the same number of type unary functions, it is advantageous to prefer the one sharing the most parameters within the multiplication tolerance. One embodiment illustrates well this case. Consider the homomorphic evaluation of the multivariate function Two possible implementations of the network are

[0135] a.

[0136] • Assume , and define

[0137] • Define and ​

[0138] • writing where

[0139] b.

[0140] • assuming and defining

[0141] • assuming and defining and

[0142] • writing where .

[0143] The two above embodiments include four monadic function evaluations. However, the second embodiment includes two monadic functions on the same parameter, namely and and is therefore preferred.

[0144] The sharing of monadic functions on the same parameter is not limited to transformations performed by equiforms. It also applies to numerical transformations. It should be remembered that a function defined on a parallelepiped can be transformed into a network of monadic functions. In particular, for a function with variables , Sprecher's algorithm allows to obtain an approximation of the function of the form:

[0145]

[0146] where

[0147] In this structure, for a given domain of definition, the so-called "internal" functions and do not depend on . Therefore, if several multivariate functions defined on the same domain are evaluated homomorphically, the homomorphic evaluation of the functions and does not need to be recomputed when they are applied on the same input. This situation also occurs in the decomposition of several multivariate functions using for example ridge functions or radial functions, when the coefficients of the decomposition are fixed.

[0148] 3) Same function, parameter differing by a non-zero additive constant

[0149] and Given constants (Type 3). Another situation where computation can be accelerated is when the same univariate function is applied to parameters that differ by a non-zero additive constant. For example, still in the Sprecher structure, the above... Homomorphic evaluation involves the same univariate function The variables with phase difference additive constant values ​​(i.e., , ( and Several homomorphic evaluations are known on (). In this case, ( The encrypted value can be obtained from This is obtained efficiently through encryption; an implementation scheme will be detailed below.

[0150] From a formal perspective, in the case of All unary functions with corresponding parameters generated by the transformation in the pre-computation step In, an element that satisfies one of the following three conditions This is called "redundancy" for the index. ,

[0151] 1. and

[0152] 2. and

[0153] 3. and Given constants .

[0154] like Figure 3 The example shown is a unary function for any real-valued variable. In the domain Arbitrary precision and in the image When the value in the middle has a real value,

[0155] ,

[0156] The method according to the present invention uses two homomorphic encryption algorithms, denoted as follows: and Their plaintext original spaces are respectively represented as: and The parameter of this method is an integer. It quantifies the so-called evaluation function. The actual precision of the input. In fact, although the function domain The inputs can have an arbitrary precision, but these inputs can be internally represented at most by selected values. The immediate consequence of this is that the function will be represented by the maximum value among possible values. This method is also parameterized by the encoding function and , where takes as input an element of and associates it with an element of , takes as input an element of and associates it with an element of . This method is parameterized by the so-called discretization function , which takes as input an element of and associates it with an integer. The encoding function and the discretization function are such that the image of the domain is obtained by encoding and then discretizing , or taking a set of at most exponents from . Finally, this method is parameterized by a homomorphic encryption scheme with encryption algorithm , the plaintext original space having at least cardinality, and the encoding function , which takes as input an integer and returns an element of . In this case, the method comprises the following steps:

[0157] • a precomputation step in which the function is discretized and a table corresponding to this discretized function is constructed.

[0158] o In particular, the domain of the function is decomposed into sub-intervals , the union of these sub-intervals being equal to . For each exponent , a representative of is chosen and is computed. A table is returned, comprising components , where , .

[0159] • The step of performing a so-called homomorphic evaluation on the table, in which, for real values Given encrypted ciphertext , where the function Will Encoded as The elements will ciphertext Convert to integer ciphertext ,if integer index In the set In As an expected value. From the ciphertext and tables Initially, for elements Obtain the ciphertext ,element Will (in and (This is) used as the expected value. Return the ciphertext. As Encrypted ciphertext of approximate values.

[0160] Therefore, in one embodiment of the invention, the invention covers the digital processing of real-valued variables by a specially programmed information processing system. Univariate function Perform an approximate homomorphic evaluation on the univariate function in its domain. It has arbitrary precision, in the image It has a real value, take encrypted ciphertext As input, and return Encryption ciphertext of approximate value ,in ,in and It is a homomorphic encryption algorithm, and its corresponding plaintext original space is and Its evaluation parameters are:

[0161] Integer Used to quantify the function to be evaluated The actual precision represented by the input variables;

[0162] • Encoding function , taking the domain The element is taken as input, and the element is compared with... The elements are related;

[0163] • an encoding function , taking as input an element of the image and associating this element with an element of ;

[0164] • a discretization function , taking as input an element of and associating it with an index represented by an integer;

[0165] • a homomorphic encryption scheme with an encryption algorithm whose plaintext original space has at least cardinality;

[0166] • an encoding function , taking as input an integer and returning an element of .

[0167] In this way, the image of the domain is obtained by encoding and discretizing is a set of at most N indices chosen from .

[0168] With these parameters, the approximate homomorphic evaluation of the unary function requires the implementation by a specially programmed information processing computer system of the following two successive steps:

[0169] 1. a step of pre-computing a table corresponding to the unary function , comprising:

[0170] a. a decomposition of the domain into N selected sub-intervals , the union of these sub-intervals being ;

[0171] b. for each index in , determining in the sub-interval a representative of and computing the value ;

[0172] c. returning a table comprising components , where , ;

[0173] 2. a step of homomorphic evaluation of the table, comprising:

[0174] a. If , ciphertext Convert to integer ciphertext integer set The index in As an expected value;

[0175] b. From the ciphertext and tables Begin by obtaining elements ciphertext ,element With expected value ;

[0176] c. Return ciphertext .

[0177] When the function to be evaluated domain It is a real number interval At that time, coverage N sub-intervals ( ) can be selected as a half-open interval:

[0178]

[0179] Divide in a regular way Interval Representative There are several options. For example, one could consider the midpoint of each interval, and then... ( (Given). Another option is... China Choose a value that makes near In the interval The average over, or for each , making Approaching In the interval The weighted average or close to the median of a given prior distribution.

[0180] Therefore, in one embodiment of the present invention, a univariate function The approximate homomorphic evaluation is further characterized by

[0181] • Function to be evaluated The domain is defined by the interval of real numbers Give;

[0182] Coverage area N intervals It is a half-open sub-interval Divide in a regular way .

[0183] Encoding function Algorithm The choice is to Convert to It plays a leading role. It should be remembered that, for We have ,in An important situation is when The elements are considered as elements of a soous-ensemble (not necessarily a soous-groupe) when they are part of an additive group. For integers... This additive group is represented as (Provide template) Integers of addition (a set).

[0184] Therefore, in one embodiment of the present invention, a univariate function The approximate homomorphic evaluation is further characterized by the fact that, for integers... ,gather It is an addition group A subset of.

[0185] There are several representation groups Therefore, Ducas and Micipanio, in their aforementioned EUROCRYPT 2015 article, [details omitted]. The elements are represented as the exponents of the variable X; The element i is associated with the element , And for any , We can say that X is the Mth primitive root of the unit. This representation allows for conversion from addition notation to multiplication notation: for all elements... ,element Associated to element .

[0186] Modular multiplication In addition group The set of M-th roots of the unit The relationship induces an outgroup isomorphism. When M is even, the relation... mean Then for We have And the set of the unit M-th root is .

[0187] Therefore, in one embodiment of the present invention, a univariate function The approximate homomorphic evaluation is further characterized by the group The power of the original M-th root of the unit (denoted as X) is expressed multiplicatively, thus... The element i is associated with the element ;unit All M-th roots are formed with isomorphism group, used for modulo multiplication .

[0188] The homomorphic encryption algorithm E is applied to rings. Given the LWE-type encryption algorithm, we have If it is for those with The encoding function `encode` is used to encode the value in the data. express Then we have in ( )and , yes Small random noise on it.

[0189] Therefore, in one embodiment of the present invention, a univariate function The approximate homomorphic evaluation is further characterized by homomorphic encryption algorithms. It is applied to the ring The LWE-type encryption algorithm is given, and it has the original space of plaintext. .

[0190] For integers The discretization function `discretise` is parameterized as a function that associates the element `t` of the ring with the product. modulo The integer part, where exist Calculation in Chinese; written in mathematical form as

[0191] .

[0192] This discretization function naturally extends to vectors in a ring. Applied to... vector We got vector ,Depend on Given, among which ( ), In a more detailed way, if we define as well as Then we have

[0193]

[0194] Signed integers The rounding error was captured and is called "drift". The expected value of the drift is zero. Furthermore, if... ,So We assume

[0195]

[0196] in The expected value is an integer. The encoding function is parameterized so that its image is contained within a sub-range of the ring. Inside. In this way, if ,but and In fact, it can be verified that if ,but and

[0197]

[0198] Therefore, due to Therefore, for these functions `discretise` and `encode`, we actually have... ,in other words It is a set of indexes A subset of.

[0199] Therefore, in one embodiment of the present invention, a univariate function The approximate homomorphic evaluation is further characterized by:

[0200] • The image encoded by the encoding function is contained within a sub-interval of the ring. Inside; and

[0201] The discretization function `discretise` applies the elements `t` of the ring to the product. modulo The integer part, where exist Calculation in Chinese; in mathematical form, .

[0202] It is noted that when the function to be evaluated has a domain of real numbers interval and the plaintext original space is a ring , a possible choice for the encoding function encode is . Then for , we have ; we note that .

[0203] Thus, in one embodiment of the invention, the approximate homomorphic evaluation of a unary function is further characterized in that when the function has a domain of real numbers interval , the encoding function encode is

[0204] .

[0205] The construction yields a first embodiment of the transformation of into . It assumes that the elements of the set are directly seen as integers of . As encoding function , we consider the identity function . With the previous notations, if we denote and its LWE ciphertext on the ring , then is defined as:

[0206]

[0207] where ( ), . It is noted that In this case, we observe that is a LWE-type encryption algorithm on the ring ; the encryption key is .

[0208] Thus, in one embodiment of the invention, the approximate homomorphic evaluation of a unary function is further characterized in that the homomorphic encryption algorithm is a LWE-type encryption algorithm and the encoding function is the identity function.

[0209] Converts to the second embodiment is obtained by considering the M-th root of the unit; this allows to work in a multiplicative way. More specifically, assuming that M is even, any polynomial is fixed. The encoding function is the function . The encryption algorithm

[0210]

[0211] while the encryption algorithm is an RLWE-type encryption algorithm on - modulo . This choice and of conversion uses a re-encryption technique. According to the key , we denote by the RGSW-type ciphertext of (under the encryption key ). The conversion of into is given by the following procedure:

[0212] • obtain the conversion public key ;

[0213] • compute (under the encryption key ) and ;

[0214] • initialize ;

[0215] • for j from 1 to n, evaluate (in ) and

[0216] • return as result .

[0217] In this case, one can see that is an RLWE-type encryption algorithm on modulo ; the encryption key is . Indeed, if we set is the RGSW-type encryption of under the key (under the encryption key ), mathematically , we have

[0218] .

[0219] Thus, if we base the key on the RLWE-type encryption, we have

[0220]

[0221] and by induction:

[0222] .

[0223] Thus, in one embodiment of the invention, the approximate homomorphic evaluation of the unary function parametrized by an even integer M is further characterized in that the homomorphic encryption algorithm is an RLWE-type encryption algorithm, for which any polynomial , the encoding function is the function .

[0224] According to either of the two preceding embodiments, it is now possible to homomorphically evaluate the table from . In both cases, we assume that is an LWE-type algorithm over a ring, and is an even integer, which is equal to .

[0225] 1. The first case assumes that the encoding function is , and that the algorithm is an LWE-type encryption algorithm over . In this first case, we have . The first sub-step consists in:

[0226] • forming the polynomial given by , where ( );

[0227] • obtaining the conversion public key ;

[0228] • initializing ;

[0229] • for j from 1 to n, evaluating in ;

[0230] • assuming​ ;

[0231] • Return .

[0232] 2. The second case is for an arbitrary polynomial , assuming that the encoding function , and the algorithm is an RLWE-type encoding algorithm over . In this second case, for an arbitrary polynomial , we have . The first sub-step consists in:

[0233] • Selecting a polynomial such that where is given by with ( );

[0234] • Evaluating ;

[0235] • Returning , where .

[0236] In particular, it should be noted that, for an integer , if , then we select

[0237]

[0238] (where multiplication by is computed in ) means that . Indeed, we can observe that, for this choice of polynomial , we have

[0239]

[0240] It is also noted that, for , and . It should be noted that ; this equality, whose expected value is equal to zero, is verified within a given drift.

[0241] In both cases, as a response to the first sub-step of homomorphically evaluating the table , we get the expected polynomial according to the key RLWE type ciphertext This key is used to generate RGSW type ciphertext. The key, for the private key bits Encryption is performed. According to... polynomial The constant term is We use Indicates ciphertext Components of.

[0242] sheet The second sub-step of the homomorphic evaluation (in both cases) extracts from the RLWE ciphertext. LWE type ciphertext.

[0243] ● For each , polynomial Written ,in ( )

[0244] ● Polynomial Written ,in ( );

[0245] ● Define the element vector on the ring ,in

[0246]

[0247] ● Return the vector of elements on the ring ,in It is a polynomial The constant term.

[0248] If for each polynomial Written as ,in ( We can see the returned vector. It is based on the key , The LWE-type ciphertext on the ring. This defines the encryption algorithm. Therefore we have In this case, the corresponding plaintext primitive space is Therefore, due to and We actually obtained Approximate LWE-type encryption ciphertext.

[0249] Upon completion of this calculation, the ciphertext may be decrypted and decoded, resulting in an approximation of .

[0250] Thus, in one embodiment of the invention, the approximate homomorphic evaluation of the unary function parametrized by an even integer M equal to 2N is further characterized in that the LWE-type ciphertext on the ring is extracted from an RLWE ciphertext approximating the polynomial , where in , and where ( ).

[0251] When the image of the function to be evaluated is the real interval and the plaintext original space of the LWE-type encryption is the ring , a possible choice for the encoding function is . In this case, the corresponding decoding function is given by .

[0252] Thus, in one embodiment of the invention, the approximate homomorphic evaluation of the unary function is further characterized in that, when the image of the function f is the real interval ,

[0253] • the homomorphic encryption algorithm is given by the LWE-type encryption algorithm applied to the ring , and the plaintext original space is ;

[0254] • the encoding function is .

[0255] Encoding should be taken into account during the addition of ciphertexts. If we denote the encoding function of the homomorphic encoding algorithm E by encode, then we have where and . If the encoding function is homomorphic, then we actually have . Or, if the encoding function does not comply with addition, a correction should be applied to the encoding: such that ​In particular, the correction is zero when the encoding by is additive. For , it is zero. It should be remembered that, for an encryption scheme of LWE type, the uplet is a valid ciphertext of .

[0256] Of course, the previous considerations are still valid on images. For a homomorphic encryption algorithm E' with encoding function encode', for the correction we have . In particular, the correction is zero when the encoding is additive. For the encoding , the correction is equivalent to .

[0257] Another important special case is when the same unary function should be evaluated homomorphically on inputs and (given a constant A). A typical application example is the internal function in the Sprecher application described herein. For a homomorphic encryption algorithm E with encoding function encode, given the fact that , it can be deduced that and then that and , as explained previously. However, it is necessary to repeat all the steps. In the special case where E is an LWE-type algorithm on a ring and , at input , we have seen that, in the result of the first sub-step of the homomorphic evaluation of the table T, we obtain the RLWE-type ciphertext of the expected polynomial , where the polynomial lists the function , and where the expected value of is if belongs to the sub-interval . For example, for the discretization function , where , we obtain

[0258]

[0259] Therefore, . In this case, the RLWE-type ciphertext of the expected polynomial can be obtained as is obtained more quickly. Thus, the value of is derived from the second sub-step of the homomorphic evaluation of the table T.

[0260] The application also comprises an information processing system which is specifically programmed to implement the homomorphic encryption evaluation method according to any one of the alternative methods described herein.

[0261] In addition, it also comprises a computer program product which is specifically designed to implement any one of the alternative methods described herein and which is loaded and implemented by an information processing system programmed for this purpose.

[0262] Application examples of the application

[0263] The application described above can be used very advantageously to protect the confidentiality of certain data, such as, but not limited to, personal, health, classified information data, or more generally all data which the holder wishes to keep secret but for which he wishes third parties to be able to perform digital processing. It is meaningful to distribute the processing to one or more third-party service providers for several reasons: it allows certain operations to be performed which require expensive or unavailable resources; it also allows operations to be performed which are not public. Conversely, the third parties actually responsible for performing the digital processing operations can not wish to communicate the actual content of the processing and the digital functions implemented thereby.

[0264] In such a use, the application encompasses the implementation of remote digital services, such as in particular cloud computing, in which the third-party service provider responsible for applying digital processing on encrypted data, for its part, performs the first pre-computation step described above, which consists in pre-computing a network of univariate functions , each multivariate function of the network being pre-computed in such a way that each univariate function , of the network is evaluated in the second step in an optimized manner. ) in such a way that each univariate function of the network is evaluated in the second step in an optimized manner. , their corresponding parameters satisfy one of the following three criteria: (i) and ; (ii) and ; or (iii) and , the constant being known; these univariate functions will be evaluated in an optimized manner when appropriate.

[0265] Conversely, the secret data the holder of the secret data encrypts it by means of a homomorphic encryption algorithm E, in order to transmit the type data to a third party wherein is the encoding value by means of the encoding function. Typically, the choice of the algorithm E is imposed by the third party provider of the service. Alternatively, the data holder can use an encryption algorithm of his choice, not necessarily homomorphic, in which case the third party (or another service provider) will perform a preliminary re-encryption step to obtain the encrypted data in the required format.

[0266] Thus, in one embodiment of the invention, the homomorphic evaluation encryption method described previously is characterized in that the encrypted data input comes from a preliminary re-encryption step, arranged in the form of encrypted ciphertexts by means of the homomorphic encryption algorithm E.

[0267] Once the third party has obtained the encrypted type data , in a homomorphic evaluation step of a network of unary functions, it performs a homomorphic evaluation of each network of unary functions based on these ciphertexts in a succession of steps, in order to obtain, according to the encryption algorithm the encrypted ciphertexts of the application of the input to each of the functions .

[0268] Once it has been obtained, for the different functions considered the encrypted results of the encryption on the input values of the functions, the relevant third party sends back to the holder of the secret data all these results.

[0269] The holder of the secret data can then obtain, based on the corresponding decryption key held by him, the result values of one or more functions starting from the homomorphically encrypted input data without the third party needing to know the explicit content of the data, and conversely, the data holder not being able to know the details of the functions implemented, without the third party needing to perform digital processing on said data, this digital processing comprising the implementation of one or more functions.

[0270] This sharing of tasks between the data holder and the third party as a digital processing service provider can advantageously be carried out remotely, in particular by means of a cloud computing type service, without affecting the security of the data and the associated processing. Furthermore, the different steps of the digital processing can be the responsibility of different service providers.

[0271] Thus, in one embodiment of the invention, a remote service system of the cloud computing type implements one or more of the homomorphic evaluation encryption methods described previously, with a sharing of tasks between the data holder and the third party (or third parties) as a digital processing service provider.

[0272] In one particular embodiment of the application, this remote service system involves a holder of data that he wishes to keep secret and one or more third parties responsible for applying digital processing to said data, characterized in that

[0273] 1. According to the application, the relevant third party (or parties) performs the first step and the second pre-selection step of pre-computing the network of unary functions;

[0274] 2. The data holder encrypts by means of a homomorphic encryption algorithm E and transmits the encrypted data to the third party, where is the encoded value of by means of an encoding function.

[0275] 3. Once the relevant third party has obtained the encrypted data , he homomorphically evaluates each of the unary functions of the network on the basis of these ciphertexts in a succession of steps, thus obtaining the encrypted ciphertext applied to its input according to the encryption algorithm .

[0276] 4. Once he has obtained the encrypted results of the different functions considered on their input values, the relevant third party sends all these results back to the data holder; 5. The data holder, on the basis of the corresponding decryption key that he holds, obtains the result values of one or more functions

[0277] after decoding. A variant of this embodiment is characterized in that, in the second step (2.) mentioned above:

[0278] • The data holder encrypts

[0279] by means of an encryption algorithm different from E and transmits said encrypted data; • The relevant third party re-encrypts on the encrypted data received to obtain the ciphertext

[0280] according to the homomorphic encryption algorithm E, where is the encoded value of by means of an encoding function.

[0281] ​​Moreover, different applications of the remote digital service according to the invention can be mentioned. Thus, as mentioned in the aforementioned article of Majec STIC'08, it is known to apply a decomposition of Kolmogorov type (which can be seen as a bivariate function where gives the gray intensity of the pixel of coordinates allows to reconstruct an approximated image of the initial image. Thus, the knowledge of the coordinates and defines a bounding box allowing to perform a cropping operation in a simple way. Similar processing methods apply to color images, taking into account the binary functions and give respectively the red, green and blue levels. While this type of processing is known on unencrypted data, the present invention now allows to perform the processing using homomorphic encryption. Thus, according to the invention, if a user sends in encrypted way the GPS coordinates he recorded at regular intervals (e.g. every 10 seconds) during a sport activity, as well as the extreme coordinates of his journey (defining a bounding box), a service provider having a plan image of the map will be able to obtain, by cropping, the ciphertext of the part of the plan related to the activity; moreover, he will be able to represent the journey, using for example color codes, to indicate the local speed homomorphically computed based on the received encrypted image of GPS coordinates. Advantageously, the (third party) service provider does not know the exact location of the activity (except that it is in his plan) or the performance of the user. Moreover, the third party does not disclose the whole content of the map.

[0282] The present invention can also be advantageously used to allow performing artificial intelligence processing, in particular of input data of machine learning type, which are still encrypted, and on which a service provider implementing in particular a neural network applies one or more activation functions to values from said encrypted data. As an example of use of the present invention in the context of neural network implementation, one can refer to the decomposition of the function which is in particular used as a max pooling in the neural network mentioned above, into where corresponds to the unary function . One can also refer to the very popular activation functions and .

[0283] Thus, in one embodiment of the invention, the remote service system implementing one or more of the previously described encrypted homomorphic evaluation methods is intended to implement a digital processing of a neural network.

[0284] The disclosure of the invention is characterized in that

[0285] The present invention enables the evaluation of one or more functions on encrypted data by implementing the data computation and processing capabilities of one or more digital information processing systems. Depending on the case, this or these functions can be univariate or multivariate. Thus, in the different variants of the method according to the invention, it allows the evaluation of both types of functions.

[0286] When the function to be evaluated is of the multivariate type, the present invention first provides for carrying out two preliminary steps: a first pre-computation step, followed by a second pre-selection step, after which, having obtained a network of univariate functions, a third step is applied, which is a homomorphic evaluation of said network of univariate functions according to any known method for the homomorphic evaluation of univariate functions. This is the object of claim 1.

[0287] Depending on whether the initial pre-computation step can implement the different mathematical techniques mentioned above, several variants of the method are disclosed in claims 2 to 5: one of the algorithmic variants of the Kolmogorov-type decomposition (as proposed by Sprecher (in claim 5)) takes the sum of special multivariate functions called ridge functions (in claims 2 and 4), or by using so-called radial functions (in claims 3 and 4). In some particular cases, the present invention also provides an advantageous possibility of not using the three variants mentioned above, but simply carrying out a formal decomposition in a different form equivalent (as claimed in each of claims 6 to 10).

[0288] In the case where the function to be evaluated is of the univariate type, the present invention provides, in one of its embodiments, the implementation of two homomorphic encryption algorithms at the input and at the output, respectively, and the pre-computation of a table for each considered function, followed by a step of homomorphic evaluation of the table thus obtained, as claimed in claim 11. Advantageously, according to claim 1, this form of homomorphic evaluation of one or more univariate functions can also be implemented so as to carry out the third homomorphic evaluation step provided after the pre-computation and pre-selection steps applied beforehand to one or more multivariate functions.

[0289] Claim 11 covers two variants of this combination, including when the initial pre-computation phase uses an approximation transformation (as characterized in claims 2 to 5) or a transformation based on formal equivalence (as characterized in claims 6 to 10).

Claims

1. An encryption method performed in digital form by at least one information processing system specially programmed to evaluate one or more multivariate functions having real values, each function taking as input a plurality of real-valued variables from a set of variables and at least one of the functions taking at least two variables as input.​ Take each input of encrypted ciphertext as input, where and return a plurality of encrypted ciphertexts applied to corresponding inputs of , where is a homomorphic encryption algorithm, is an encoding function that associates elements in the plaintext original space of to each real number ; characterized in that: - a. a pre-computation step consisting in converting each of said multivariate functions into a univariate function network, comprising a composition and a sum of univariate functions with real values; - b. a pre-selection step consisting in identifying in said pre-computed univariate function network redundancies of one of the three following types: o identical univariate functions applied to identical parameters; o different univariate functions applied to identical parameters; o identical univariate functions applied to parameters differing by a non-zero additive constant; and, selecting all or part of the above; - c. a step of homomorphic evaluation of each of the pre-computed univariate function network, wherein the redundancies selected in the pre-selection step are evaluated in a shared way when all or part of one or more of these univariate functions are reused.

2. The encryption method of claim 1, wherein, For at least one function from the transformation of the pre-computation step is an approximation transformation of the form where and and where the coefficients are real numbers and where is a unary function defined on real numbers and having real values, the function and the coefficients are determined as a function of for a given parameter .

3. The encryption method of claim 1, wherein, For those from at least one function in The transformation of the pre-computation step is Approximate transformation of form, where , ,in and And where the vector coefficient Let be a real number, and where It is a unary function defined on real numbers and having real values. and the coefficients Determined to be for a given parameter and given norm of The function.

4. The encryption method according to any one of claims 2 or 3, characterized in that, The coefficients are fixed.

5. The encryption method of claim 1, wherein, For at least one function from , the transformation of the precomputation step is an approximation transformation of the form where and , and where is a unary function defined on real numbers and having real values, where is a real constant, and where is a unary function defined on real numbers and having real values, said function is determined as a function of for a given parameter .

6. The encryption method of claim 1, wherein, The transformation of the pre-computation step uses formal equivalence to express the function as a combination of a sum of unary functions and a composition of unary functions.

7. The encryption method of claim 1, wherein, The transformation of the pre-computation step uses formal equivalence to express the function as a combination of a sum of unary functions and a composition of unary functions.

8. The encryption method of claim 1, wherein, The transformation of the pre-computation step uses formal equivalence to express the function as a combination of a sum of unary functions and a composition of unary functions.

9. The encryption method of claim 1, wherein, The transformation of the pre-computation step uses formal equivalence to express the function as a combination of a sum of unary functions and a composition of unary functions.

10. The encryption method according to any one of claims 6 to 9, characterized in that, When said functions comprise three variables or more, said formal equivalences are obtained from an iteration of formal equivalences of two variables.

11. The encryption method of claim 1, further comprising, in the step of performing homomorphic evaluation on at least one of the pre-computed unary function networks, for real-valued variables at least one of the unary functions The sub-process for performing approximate homomorphic evaluation is taken encrypted ciphertext As input and return Encryption ciphertext of approximate value ,in The unary function is defined in the domain Arbitrary precision and in the image The denominator has real values, where and It is a homomorphic encryption algorithm. and The corresponding plaintext original space is and The parameters of the sub-process are: - an integer , for quantifying the actual precision of the variable representation of the input end of the function to be evaluated ; - Encoding function , take the domain The elements are taken as input and the domain is... elements and The elements are related; - an encoding function , taking as input elements of an image and associating elements of the image with elements of ; - discretization function , take an element of the set as input and associate the element of the set with an index represented by an integer; - With encryption algorithm The homomorphic encryption scheme, the encryption algorithm plaintext original space Having at least The cardinality; - the encoding function takes an integer as input and returns an element of the set such that the image of the domain is encoded and discretized is a set of at most N exponents selected from the set of exponents and, characterized in that: - a. pre-computing with said unary function corresponding table, comprising: o the domain is decomposed into selected sub-intervals the union of these sub-intervals forms ; ○ For Each index in In the sub-interval China determines representatives And calculated value ; o return including a table of components wherein for each , ;​ - b. a step of homomorphic evaluation of the table, comprising: o if the ciphertext is converted to an integer the ciphertext , the integer the exponent in the set is taken as the expected value; o based on the ciphertext and the table obtain the ciphertext of the element , which element will be the expected value; o Return ciphertext .

12. The encryption method according to claim 11, characterized in that, - the function to be evaluated The domain of definition of the function is given by the real interval - coverage domain of N intervals ( ) is a half-open subinterval are divided in a regular fashion .

13. The encryption method of claim 11, wherein, For an integer , the set is a subset of the additive group .

14. The encryption method of claim 13, wherein, group is represented in multiplicative form as a power of the original Mth root of unity, where the unity is represented as X, such that the elements are associated to the elements ; all Mth roots of unity form an isomorphic group to for the multiplicative modulo .

15. The encryption method according to any one of claims 11 to 14, characterized in that, Homomorphic encryption algorithm is given by an LWE-type encryption algorithm applied to a ring and takes as the plaintext raw space.

16. The encryption method of claim 15, the parameter being an integer characterized in that - the image containing the encoding function encode is included in the sub-interval of the ring ; and - the discretise function discretise applies the rounding of the elements of the ring to the product where in is computed in ; the mathematical form is: .

17. The encryption method of claim 16, wherein, When the domain of the function is the real interval , the encoding function encode is 。 18. The encryption method of claim 15, wherein, Homomorphic encryption algorithm is a LWE-type encryption algorithm, the encoding function is an identity function.

19. The encryption method according to claim 15, parameterized by an even integer M, characterized in that, Homomorphic encryption algorithm is an RLWE-type encryption algorithm for any polynomial , the encoding function is the function .

20. The encryption method of claim 18, parameterized by an even integer M equal to 2N, wherein, LWE-type ciphertexts on rings are extracted from RLWE ciphertexts that approximate polynomials , where in , and where , .​ 21. The encryption method according to any one of claims 11 to 14, characterized by, when the at least one function of the image is a real interval of real numbers, - homomorphic encryption algorithm is given by the LWE-type encryption algorithm applied to the ring and takes as the plaintext original space; - encoding function is , .

22. The encryption method of claim 1, wherein, the input encrypted data come from a prior re-encryption step, set in the form of an encrypted ciphertext of said homomorphic encryption algorithm E.

23. An information processing system, characterized by comprising: said information processing system is programmed to implement the encryption method according to any one of claims 1 to 22.

24. A computer program product, said computer program being intended to be loaded and implemented by an information processing system according to claim 23.

25. A remote service system of the cloud computing type, for implementing the encryption method according to any one of claims 1 to 22, wherein the tasks are shared between the data holder and one or more third parties as digital processing service providers.

26. The remote service system of claim 25, comprising a data holder desiring to keep data confidential and one or more third parties responsible for applying digital processing to the data, characterized in that, - a. the first step of pre-computing the univariate function network and the second pre-selection step are performed by the relevant one or more third parties according to claim 1; - b. From data held by the data holder Begin, compute type data wherein is a homomorphic encryption algorithm, is an encoded value of by an encoding function; - c. Once the encrypted type data is obtained by the relevant third party , the third party homomorphically evaluates each of the unary function networks based on the ciphertexts in a series of successive steps to obtain, according to the encryption algorithm, the encrypted ciphertext of the input (for ) applied to ; - d. Once the third party has obtained the different functions considered The encrypted results of the encryption on their input values, the relevant third party sends all these results back to the data holder; - e. The data holder obtains, after decoding, one or more function results values based on the respective decryption key it holds. The functions can be any functions, such as, for example, a hash function, a symmetric encryption function, a public key encryption function, a digital signature function, a function for generating a random number, a function for generating a random bit string, a 27. The remote service system of claim 26, wherein, In the second step, as indicated in claim (b), the data holder uses a homomorphic encryption algorithm. right Encrypt the data and type it. Transmitted to a third party, among which Through the encoding function The encoded value.

28. The remote service system of claim 26, wherein, in the second step denoted (b) in said claim, - the data holder encrypts the data by means of an encryption algorithm different from and transmits the data thus encrypted;​ - the related third party re-encrypts on said received encrypted data to obtain, according to said homomorphic encryption algorithm obtaining a ciphertext wherein is an encoding value of by an encoding function.

29. The remote service system according to any one of claims 25 to 28, intended for implementing the digital processing of a neural network.

Images