Cryptographic methods, systems, and services for evaluating real-valued functions on encrypted data

Abstract

The invention relates to an encryption method based on homomorphic encryption and variants thereof, enabling the evaluation of univariate or multivariate real-valued functions on encrypted data, thus allowing more extensive and efficient homomorphic processing on encrypted data.

Description

Technical Field

[0001] This invention relates to improving the homomorphic evaluation of one or more functions applied to pre-encrypted data. Based on recent work in cryptography, this technical field may include many applications in all areas of activity where confidentiality restrictions exist (such as, but not limited to, applications for privacy protection, applications for trade secrets, or applications for medical data).

[0002] More specifically, the present invention relates to a method for performing computations required to automatically complete homomorphic evaluations of one or more functions by one or more specially programmed computer systems. Therefore, it is necessary to consider limited storage and computation time capabilities, or, in the case of remote processing such as cloud computing, transmission capabilities known to the information processing system that should perform this type of evaluation.

[0003] As will be described below, the development of homomorphic encryption methods has been greatly hampered to date by the technical limitations inherent in most schemes proposed in the literature, which are related to computer processing power, particularly in terms of the machine resources required to perform different computational stages and the computation time required to support them. Background Technology

[0004] Fully homomorphic encryption (FHE) allows any participant to transmit a set of ciphertexts (corresponding to plaintexts x1, ..., x2) to plaintexts. p Transform the public text into a given function f(x1,…,x) corresponding to the plaintext. p The encrypted data is stored on a server, and the participant does not have permission to access the plaintext. This scheme is well-known for building privacy-preserving protocols: users can store encrypted data on a server and authorize third parties to perform operations on the encrypted data without exposing the data itself to the server.

[0005] The first generation of fully homomorphic encryption schemes was proposed only by Gentry in 2009 (he obtained US Patent No. 8630422B2 in 2014 based on his initial application in 2009); see also [Craig Gentry, “Fully homomorphic encryption using ideal lattices”, in 41st Annual ACM Symposium on Theory of Computing, pages 169-178, ACM Press, 2009]. Gentry's construct is no longer used, but one of the features he introduced, “bootstrapping,” and particularly one of its implementations, has been widely used in subsequent schemes. Bootstrapping is a technique for reducing ciphertext noise: in fact, in all known FHE schemes, the ciphertext includes a small amount of random noise that is necessary for security. When operations are performed on noisy ciphertext, the noise increases. After evaluating a given number of operations, this noise can become too high and may jeopardize the computation results. Therefore, bootstrapping is the foundation for constructing homomorphic encryption schemes, but this technique is very expensive in terms of both memory usage and computation time.

[0006] Gentry's subsequent work aimed to provide new schemes and improve bootstrapping so that homomorphic encryption would be feasible in practice. The most famous constructs are DGHV [Marten van Dijk, Craig Gentry, Shai Halevi and Vinod Vaikuntanathan, "Fully homomorphic encryption over the integers", in Advances in Cryptology-EUROCRYPT 2010, volume 6110de Lecture Notes in Computer Science, pp.24-43, Springer, 2010], BGV [Zvika Brakerski, Craig Gentry and Vinod Vaikuntanathan, "(Leveled) fully homomorphic encryption without bootstrapping", in ITCS2012; 3rd Innovations in Theoretical Computer Science, pages 309-325, ACMPress, 2012], GSW [Craig Gentry, Eds, Amit Sahai and Brent Waters, "Homomorphic encryption from learning with errors: Conceptually simpler,asymptoticallyfaster,Attribute-based”,in Advances in Cryptology-CRYPTO [2013, Part I, volume 8042 de Lecture Notes in Computer Science, pp. 75-92, Springer, 2013] and its variants. Although performing bootstrapping in the first-generation Gentry scheme was not feasible in practice (one lifetime was insufficient to complete the computation), subsequent constructs made this operation feasible, although not very practical (each bootstrapping lasted several minutes).A faster bootstrapping mechanism for GSW-type schemes was proposed by Ducas and Micciancio in 2015 [Léo Ducas and Daniele Micciancio, “FHEW: Bootstrapping homomorphic encryption in less than a second”, in Advances in Cryptology-EUROCRYPT 2015, Part I, Volume 9056 de Lecture Notes in Computer Science, pages 617-640, Springer, 2015]: the bootstrapping operation is performed in slightly more than half a second. In 2016, Chillotti, Gama, Georgeva, and Izabachene proposed a new variant of the FHE scheme, called TFHE [IIaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene, “Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds”, in Advances in Cryptology–ASIACRYPT 2016, Part I, volume 10031 deLecture Notes in Computer Science, pages 3-33, Springer, 2016]. Their bootstrapping technique has become the foundation for subsequent work.These works can be mentioned: Bourse et al. [Florian Bourse, Micheles Minelli, Matthias Minihold, and Pascal Paillier, “Fast homomorphic evaluation of deep discretised neural networks”, in Advances in Cryptology-CRYPTO 2018, Part III, volume 10993 of Lecture Notes in Computer Science, pages 483-512, Springer, 2018], Carpov et al. [Sergiu Carpov, Malika Izabachène, and Victor Mollimard, “New techniques for multi-value input homomorphic evaluation and applications”, in Topics in Cryptology-CT-RSA 2019, volume 11405 of Lecture Notes in Computer Science, pages 106-126, Springer, 2019], Boura et al. [Christina Boura, Nicolas Gama, Mariya Georgieva, and Dimitar] Jetchev, “Simulating homomorphic evaluation of deep learning predictions”, in Cyber ​​Security Cryptography and Machine Learning (CSCML 2019), volume 11527de Lecture Notes in Computer Science, pages 212-230, Springer, 2019] and Chillotti et al. [Ilaria Chillotti, Nicolas Gama, Mariya Georgieva and Malika Izabachène, "TFHE: Fast fully homomorphic encryption over the torus", Journal of Cryptology, 31(1), pp.34-91, 2020]. TFHE performance is remarkable.They have contributed to the advancements in this field and made homomorphic encryption more practical. Their proposed new technique makes it possible to compute a bootstrap within milliseconds.

[0007] Technical issues

[0008] Despite the progress made, known computational procedures allow for the processing of a set of ciphertext (corresponding to plaintext x1,…,x) p Transform the public text into a given function f(x1,…,x) corresponding to the plaintext. p While this approach can be used to represent the function f in binary inputs, it remains limited to certain situations or is still impractical. In fact, the current common approach involves representing the function as a Boolean circuit, composed of logic gates of the AND, NOT, OR, or XOR type, and then homomorphically evaluating the circuit using the ciphertext (bits representing the plaintext) of the function f as input. The complexity of a Boolean circuit is measured by its multiplication depth, defined as the maximum number of consecutive AND gates that must be computed to obtain the result. To maintain noise control during this computation, it is necessary to periodically perform bootstrapping operations. As indicated above, even with the latest techniques, these bootstrapping operations involve complex computations and, due to the large multiplication depth, make the entire computation even slower. This approach is only feasible for functions that operate on binary inputs and have simple Boolean circuits.

[0009] Generally, the function to be evaluated takes one or more real variables x1,…,x p As input. There might even be several functions f1,…,f q The evaluation is performed on a set of real variables. Therefore, finding a method has significant technical and economic benefits, allowing the above operations to be performed quickly without using excessively large computational resources, i.e., a set of ciphertext (corresponding to plaintext x1,…,x) is evaluated. p The public text is transformed into multiple real-valued functions f1,…,f corresponding to the plaintext. q A set of encrypted text. In fact, to date, the theoretical progress Gentry made in 2009 has not been materialized in practice due to the lack of an effective solution to this technical problem. This invention provides a response to this problem. Summary of the Invention

[0010] This application describes a set of methods designed to be executed digitally by at least one specially programmed information processing system to convert a set of ciphertext (corresponding to plaintext x1,…,x) into plaintext. p Effectively and publicly convert it into multiple functions f1,…,f corresponding to plaintext. q A set of encrypted text. This new method will convert multivariate functions f1,…,f qThis is transformed into a combination of the sum of univariate functions and the composition of univariate functions. Preferably, it is derived from functions f1, ..., f q The intermediate values ​​obtained from the transformation are reused in the evaluation. Finally, each unary function is preferably represented in tabular form rather than the usual Boolean circuit form.

[0011] It is worth noting that any multivariate function defined on real numbers and having real values ​​is supported. The input is pre-encoded to ensure compatibility with the original space of the message in the underlying encryption algorithm. After decryption, decoding can also be applied at the output to the graph of the function under consideration.

[0012] The technical effects of this invention are significant because, whether considered individually or in combination, the technology it implements will allow for the application of multiple functions f1,…,f to encrypted data. q The results of the evaluation are performed, which greatly reduces complexity and the necessary computation time. As described below, this relief is particularly due to the fact that (i) the multivariate functions to be evaluated are transformed into univariate functions instead of functions that directly deal with several variables; (ii) these functions can be decomposed to share the results of intermediate computations instead of being evaluated separately; and (iii) the resulting univariate functions are represented by tables instead of Boolean circuits.

[0013] When the function f has several variables x1,…,x p In this invention, the method transforms the function f into a combination of the sum and composition of unary functions. It should be noted that both the sum and composition of unary functions allow for the expression of affine transformations or other linear combinations. By analogy with neural networks, the expression "unary function network" is used to refer to a representation that combines the sum and composition of unary functions when performing a transformation from multivariate to univariate, which performs homomorphic evaluation on multiple encrypted values. The transformation can be exact or approximate; however, it should be noted that an exact transformation is an error-free approximate transformation. In practice, the resulting network is characterized by low depth compared to Boolean circuits that achieve the same functionality. This new representation of the function f is then used to encode the inputs E(encode(x1)),...,E(encode(x2)). p The evaluation will be performed using E(encode(z)), where E refers to the encryption algorithm and encode refers to the encoding function. This will allow the evaluation to be performed from E(encode(z)). k The input begins with a )) type, to some unary function g j E(encode(g) j (z k The calculation of type ))) ends, where z k These are intermediate results. These calculations utilize the homomorphic property of the encryption algorithm.

[0014] When the same unary function network is reused multiple times, it makes sense not to repeat all the computational stages. Therefore, according to the present invention, the first step includes pre-computing the unary function network; then, in subsequent steps, homomorphic evaluation is performed on the encrypted data.

[0015] The fact that any continuous multivariable function can be written as a sum of univariate functions and a composition of univariate functions was proven by Kolmogorov in 1957 [Arey N. Kolmogorov, “On the representation of continuous functions of several variables by superposition of continuous functions of one variable and addition”, Dokl. Akad. Nauk SSSR, 114, pp. 953-956, 1957].

[0016] This result had long remained theoretical, but an algorithmic version was discovered, in particular by Sprecher, who proposed an algorithm in which the method for constructing univariate functions is explicitly described [David A. Sprecher, “On the structure of continuous functions of several variables”, Transactions of the American Mathematical Society, 115, pp. 340-355, 1965]. A detailed description can be found in the article [Pierre-Emmanuel Leni, Yohan Fougerolle and Frédéric Truchetet, “Théorème desuperposition de Kolmogorov et son applicationàla décomposition de fonctionsmultivariées”, in MajecSTIC'08, 29-31 Octobre 2008, Marseille, France, 2008]. Furthermore, it should be noted that the assumption of continuity of the function to be decomposed can be relaxed by considering approximations of the latter.

[0017] Another possible approach involves approximating a multivariable function by summing a special multivariable function known in English as a ridge function [BF Logan and L.A. Shepp, “Optimal reconstruction of a function from its projections”, Duke Mathematical Journal, 42(4), pp. 645-659, 1975]. The real-valued variable vector x = (x1, ..., x... p The ridge function is applied to the vector of variables and the real parameter vector a = (a1, ..., a2). p The function of the scalar product of g, i.e. a A function of the type (x) = g(a·x), where g is a univariate function. As noted above, a scalar product or equivalent linear combination is a special case of a combination of the sum of univariate functions and the composition of univariate functions; decomposing a multivariate function into a sum of ridge functions forms one embodiment of the transformation from multivariable to univariate according to the invention. It is known that if the number of ridge functions can be increased, any multivariate function can be approximated by ridge functions with the desired high precision [Allan Pinkus, “Approximating by ridge functions”, in A. Le Méhauté, C. Rabut and L. Schumaker]. Surface Fitting and Multiresolution Methods, pages 279-292, Vanderbilt University Press, 1997. These mathematical results led to a statistical optimization method known as projection pursuit [Jerome H. Friedman and Werner Stuetzle, “Projection pursuit regression”, Journal of the American Statistical Association, 76(376), pp. 817-823, 1981].

[0018] Using the so-called g aIt is also possible to replace the ridge function with a radial function of the type (x) = g(‖xa‖) [DSBroomhead and David Lowe, "Multivariable functional interpolation and adaptive networks", Complex Systems, 2, pp. 321-355, 1988], and other families of basic functions can also be used with similar approximate quality (convergence speed).

[0019] In some cases, formal decomposition is possible without resorting to Kolmogorov's theorem or one of its algorithmic versions (such as the Sprecher algorithm) or through ridge functions, radial functions, or their variants. For example, the function g(z1,z2) = max(z1,z2) (especially as a so-called "max pooling" layer used by neural networks) can therefore be decomposed as: max(z1,z2) = z2 + (z1 - z2) + ,in Corresponding to a univariate function

[0020] Given functions f1,…,f q The data, when each of these functions is represented by a network of unary functions (which is subsequently designed to perform homomorphic evaluation on the encrypted data), allows this evaluation to be performed in an optimized manner when all or part of one or more of these unary functions are reused. Therefore, for each redundancy observed in this set of unary function networks, certain procedures for performing unary function homomorphic evaluation on the encrypted value will only need to be performed once. Knowing that this function homomorphic evaluation is typically done online and greatly increases processing speed, sharing intermediate values ​​yields a very significant performance improvement.

[0021] Three possible optimization types were considered:

[0022] Same function, same parameters

[0023] When the number of unary functions is the same, this optimization involves preferably using a network of unary functions that is repeatedly applied to the same unary function with the same parameters a maximum of times. In fact, whenever a unary function is evaluated using the same input as the unary function itself, homomorphic evaluation of that unary function on that input does not require recalculation.

[0024] Different functions, same parameters

[0025] This optimization is applicable when homomorphically evaluating two or more univariate functions on the same input can be done essentially at the cost of a single homomorphic evaluation, and one implementation allows for sharing most of the computation. A similar situation is considered in the aforementioned CT-RSA2019 paper under the name of a multi-output version. An example of such an implementation is presented in the "Detailed Implementation" section. In the multivariate case, this situation arises, for example, when the decomposition coefficients (a ik When fixed, the decomposition of several multivariable functions is performed in the form of a sum of ridge or radial functions.

[0026] The same function, differing by a non-zero additive constant parameter.

[0027] Another situation that allows for accelerated computation is when evaluating the same univariate function over parameters with known differences. This occurs, for example, when using decompositions of the Kolmogorov type, particularly the approximate version of Sprecher's algorithm. In this case, the decomposition involves so-called "internal" univariate functions; see specifically the application of the internal function Ψ in the "Detailed Implementation" section. In the latter case, the additional cost is minimal.

[0028] These optimizations are applicable when several functions f1,…,f should be evaluated. q However, these conditions also apply to the case of a single function to be evaluated (q=1). In all cases, it is meaningful to generate a network of unary functions, which not only reduces the number of unary functions but also preferably uses different functions on the same parameters or the same functions on parameters that differ by a non-zero additive constant, thereby reducing evaluation costs. This property is unique to unary function networks when performing homomorphic evaluation on encrypted inputs.

[0029] Whether the function being evaluated according to the invention is multivariate and has already taken the first step described above, or is intended to deal with a primitive univariate function, the invention provides a method for performing homomorphic evaluation on such univariate functions, and in an advantageous variant, uses a tabular representation for this purpose.

[0030] Homomorphic evaluation of unary functions, or more generally homomorphic evaluation of combinations of unary functions, is based on homomorphic encryption schemes.

[0031] The LWE (Learning With Errors) problem was proposed by Regev in 2005 [OdedRegev, “On lattices, learning with errors, random linear codes, and cryptography”, in 37th Annual ACM Symposium on Theory of Computing, pages 84-93, ACM Press, 2005], enabling the construction of homomorphic encryption schemes over many algebraic structures. Typically, an encryption scheme includes an encryption algorithm ε and a decryption algorithm. If c = ε(μ) is the encryption of the plaintext μ, then Returns the plaintext μ. Encryption algorithms derived from the LWE problem and its variants have the property of introducing noise into the ciphertext. This is called the plaintext natif, indicating the space of the plaintext on which the encryption algorithm is defined, and on which the ciphertext is decrypted, taking some noise into account, to produce the initial plaintext of that plaintext natif. It should be remembered that for... As an encryption algorithm for the plaintext original space, the encoding function `encode` takes elements from any set and adds them to the set. A function of or a subset thereof; preferably, the function is injective.

[0032] As detailed in the aforementioned paper by Chillotti et al. (ASIACRYPT 2016), this applies to toruses of real numbers modulo 1. The scheme is defined as follows. For a positive integer n, the encryption key is {0,1}. n The vector (s1,…,s) n ); the original plaintext space is The LWE ciphertext of the element μ of the torus is The vector c = (a1, ..., a2) n b), where for 1≤j≤n, a j yes The random elements, and among them e is based on Low noise from a random error distribution centered at 0. From the ciphertext c=(a1,…,a…) n Starting with b), for the key (s1,…,s) n Understanding allows you to find (mod 1) as The elements of the torus. It should be remembered that two elements of the torus can be added, but their inner product is undefined. The symbol "·" represents the outer product between an integer and a torus element.

[0033] In the same article, the author also described based on The plan, in which and These are polynomial rings and For strictly positive integers N and k, the encryption key is The vector (s1,…,s) k ), in Plain text original space is The RLWE ciphertext of the polynomial μ is The vector c = (a1, ..., a2) k b), where for 1≤j≤k, a j yes The random polynomial and where (exist In, that is, modulo(X) N +1,1)), e is based on Low noise in the random error distribution. From the ciphertext c=(a1,…,a k Starting with b), for the key (s1,…,s) k Understanding allows you to find (exist (China) as The element. Here, the symbol "·" indicates... The outer product over the ring. The R in RLWE stands for the word "ring". These variations of the LWE problem have been proposed in [Damien Stehlé, Ron Steinfeld, Keisuke Tanaka and Keita Xagawa, "Efficient public key encryption based on ideal lattices", in Advances in Cryptology–ASIACRYPT 2009, volume 5912 of Lecture Notes in Computer Science, pages 617-635, Springer, 2009] and [Vadim Lyubashevsky, Chris Peikert and Oded Regev, "On ideal lattices and learning with errors over rings", in Advances in Cryptology–EUROCRYPT 2010, volume 6110 of Lecture Notes in Computer Science, pages 1-23, Springer, 2010].

[0034] Finally, this same article, ASIACRYPT 2016, introduces the outer product between RLWE-type ciphertext and RGSW-type ciphertext (representing Gentry-Sahai-Waters, where "R" stands for ring). Remember that RLWE-type encryption produces RGSW-type encryption. Use the notation from the previous paragraph. For integers... Z indicates that in It has A matrix with k rows and k+1 columns, where each row is an RLWE-type encryption of polynomial 0. Then, The RGSW ciphertext of the polynomial σ is given by the matrix C = Z + σ·G, where G is defined in The so-called "gadget" matrix in the middle (with (rows and k+1 columns), and by Given, where for a given cardinality B ≥ 2, I k+1 It is the same matrix of size k+1. Therefore, the tool is associated with the following representation: The conversion makes for For each vector (row) v of the polynomial in G, we have G -1 (v)·G≈v and G -1(v) is very small. (polynomial) )RGSW type ciphertext C and (polynomial) The outer product of the RLWE type ciphertext c is represented as Defined as The ciphertext obtained from this It is a polynomial The RLWE type ciphertext. A proof is given in the aforementioned paper, ASIACRYPT 2016.

[0035] As shown, the aforementioned scheme is a so-called symmetric or private-key encryption scheme. This is by no means a limitation, because as Rothblum shows in [Ron Rothblum, “Homomorphic encryption: From private-key to public-key”, in Theory of Cryptography (TCC 2011), volume 6597 of Lecture Notes in Computer Science, pages 219-234, Springer, 2011], any additive homomorphic private-key encryption scheme can be transformed into a public-key encryption scheme.

[0036] As mentioned above, bootstrapping refers to a method that allows for the reduction of any possible noise present in the ciphertext. Gentry introduced this concept in his inaugural STOC 2009 paper, implementing bootstrapping through a technique now commonly known as "re-encryption." Re-encryption involves homomorphically evaluating a decryption algorithm in the ciphertext domain. In the plaintext domain, the encryption algorithm takes ciphertext C and a private key K as input and returns the corresponding plaintext x. In the ciphertext domain, the decryption algorithm is evaluated using a homomorphic encryption algorithm E and an encoding function encode, taking the ciphertext E(encode(C)) of C and the ciphertext E(encode(K)) of K as input, thus providing a new ciphertext E(encode(x)) of the same plaintext based on the encryption key of algorithm E. Therefore, assuming the ciphertext is given as the output of the homomorphic encryption algorithm E is not a limitation, as the re-encryption technique allows for termination in this case.

[0037] The homomorphic properties of LWE-type encryption schemes and their variants allow for manipulation of plaintext through operations on the corresponding ciphertext. The domain of the unary function f to be evaluated is discretized into several intervals covering its domain. Each interval is defined by the value x. i With function f(x) i The corresponding values ​​of ) are used to represent the function f. Therefore, the function f is represented by a series of values ​​of the form (x). i ,f(x iThe pairs are listed here. These pairs are actually used to homomorphically compute the ciphertext or approximation of f(x) for any value of x in the domain of the function, starting from the ciphertext of x.

[0038] In this invention, the core of this homomorphic computation is a novel general technique that combines bootstrapping and encoding. Several implementation schemes are described in the "Detailed Description" section.

[0039] The homomorphic evaluation techniques described in the aforementioned ASIACRYPT 2016 paper, and those introduced in subsequent works, cannot homomorphically evaluate arbitrary functions over arbitrary domains. First, they are strictly limited to univariate functions. The response in the multivariate case is unknown. Furthermore, in the univariate case, the prior art makes assumptions about the input values ​​or the function to be evaluated. Among these limitations, note, for example, the input is restricted to binary values ​​(bits) or the function to be evaluated requires a negative cyclic property (e.g., verified by a “signed” function on a torus). For functions with arbitrary real values, the prior art does not describe a general treatment of the input and output values ​​that allows termination in these special cases.

[0040] Conversely, embodiments of the present invention are able to homomorphically evaluate functions with real-valued variables on the input of real-valued LWE-type ciphertexts while controlling noise (bootstrapping) at the output, regardless of the form of the functions or their domain. Attached Figure Description

[0041] Figure 1 The first two steps are schematically replicated when the computer system performs the first two steps according to the present invention.

[0042] Figure 2 Examples of continuous functions are given. In the case of p=2, where the continuous function (defined in the same hypercube I of dimension p) p =[0,1] p The above can be written as the sum of a continuous function and the composition of a continuous function.

[0043] Figure 3 This example illustrates a unary function f with any real-valued variable in its domain. Arbitrary precision and in the image When the value in the middle has a real value, Detailed Implementation

[0044] This invention allows one or more functions f1, ..., f to be applied digitally to encrypted data using one or more real-valued variables via at least one specially programmed information processing system. q The evaluation is performed on each function from real number variables x1,…,x p Multiple real-valued variables are taken as input.

[0045] When at least one of the functions takes at least two variables as input, the method according to the invention schematically includes three steps:

[0046] 1. The so-called pre-computation step includes converting each of the multivariate functions into a network of univariate functions, which consists of the sum of univariate functions and the composition of univariate real-valued functions;

[0047] 2. The so-called pre-selection step includes identifying different types of redundancy in the pre-computed unary function network and selecting all or part of them;

[0048] 3. The so-called homomorphic evaluation step of each of the pre-computed unary function network, wherein the redundancy selected in the pre-selection step is evaluated in an optimized manner.

[0049] Regarding the second step (pre-selection), the selection of all or part of the redundancy is primarily, but not entirely, guided by the goal of optimizing the digital processing of homomorphic evaluation, whether for computational gains or for availability reasons, such as memory resources for storing intermediate computational values.

[0050] Figure 1 The first two steps are schematically replicated when a computer system programmed for this purpose performs the first two steps according to the present invention.

[0051] Therefore, in one embodiment of the present invention, one or more multivariate real-valued functions f1,…,f are evaluated. q Each function is derived from variables x1, ..., x. p The function takes multiple real-valued variables as inputs, and at least one of the functions takes at least two variables as inputs, with each input x... i The encrypted ciphertext E(encode(x) i Take f(1 ≤ i ≤ p) as input and return the result applied to f1,…,f q The input consists of multiple encrypted ciphertexts, where E is a homomorphic encryption algorithm and encode is an encoding function that associates elements in the original plaintext space of E with each real number x. i Its features are:

[0052] 1. A pre-computation step, comprising converting each of the multivariate functions into a network of univariate functions, which consists of the sum of univariate real-valued functions and the composition of univariate real-valued functions;

[0053] 2. A pre-selection step, including identifying redundancy of one of the following three types in the pre-computed unary function network:

[0054] a. The same unary function with the same parameters;

[0055] b. Different unary functions with the same parameters;

[0056] c. The same univariate function applied to parameters that differ by a non-zero additive constant;

[0057] And select all or part of it;

[0058] 3. The step of homomorphically evaluating each of the pre-computed unary function network, wherein the redundancy selected in the pre-selection step is evaluated in an optimized manner.

[0059] Regarding the pre-computation step, an explicit version of Kolmogorov's superposition theorem allows confirmation of any continuous function. (defined in the same hypercube I of dimension p) p =[0,1] p The above can be written as a composition of the sum of continuous functions in one variable and a continuous function in another variable:

[0060]

[0061] and

[0062]

[0063] Where, given a number of p variables, λ i And a is a constant, and Ψ is a continuous function. In other words...

[0064]

[0065] As an example, Figure 2 The case where p = 2 is illustrated.

[0066] Functions Ψ and ξ are so-called "interiors," and for a given arithmetic, they are independent of f. Function Ψ will... p The real vector (x1,…,x) p Any component x i Associated with values ​​in the range [0,1]. The function ξ allows numbers in the interval [0,1] to be associated with values ​​in the range [0,1]. Associated with each vector (x1,…,x p )∈I p Then this number will be used as the function g. kThe parameters are used to reconstruct the function f by summation. Note that in Kolmogorov's theorem, the field of f is restricted to the hypercube I. p The limitations imposed in this theorem are typically found in scientific literature to simplify its interpretation. However, it is readily apparent that the theorem naturally extends to any parallelepiped with an isotopic dimension p.

[0067] Sprecher proposed algorithms for determining inner and outer functions in [David A. Sprecher, “A numerical implementation of Kolmogorov’s superpositions”, Neural Networks, 9(5), pp.765-772, 1996] and [David A. Sprecher, “A numerical implementation of Kolmogorov’s superpositions II”, Neural Networks, 10(3), pp.447-457, 1997].

[0068] Instead of constructing ξ using the function Ψ originally defined by Sprecher (for some input values ​​that are discontinuous), the function Ψ defined in [Jürgen Braun and Michael Griebel, “On a constructive proof of Kolmogorov's superposition theorem”, Constructive Approximation, 30(3), pp. 653-675, 2007] can be used.

[0069] Once the inner functions Ψ and ξ are fixed, the remaining task is to determine the outer function g. k (Depending on the function f). Therefore, Sprecher proposed constructing r functions for each k (0 ≤ k ≤ 2p). The sum of this function converges to the outer function g. k At the end of the r-th step, the approximate result of f is given in the following form:

[0070]

[0071] Where K is a parameter that makes K≥2p. Therefore, this algorithm provides an approximate result regarding the Kolmogorov decomposition theorem. In fact, by taking r to be quite large and assuming... We can obtain the next approximate representation of the function f:

[0072]

[0073] Or

[0074]

[0075] Therefore, in one embodiment of the invention, the pre-calculation stage is characterized in that, for the data from f1,…,f… q At least one function f in j The transformation of the pre-computation step is (t≤p and j1,…,j) t An approximate transformation of the form ∈{1,…,p}) is given, where Ψ is a univariate function defined on the real number system and having a real value. It is a real constant, g k It is a unary function defined on real numbers and having real values, the function g k f is determined to be for a given parameter K j The function.

[0076] Another decomposition of the multivariate function f(x1,…,x) p The technique involves approximating it using the so-called ridge function and the following transformation:

[0077]

[0078] Where the coefficient a i,k It is a real number, and where g is a real number. k It is a unary function defined on real numbers and having real values, the function g k and the coefficient a i,k f is determined to be for a given parameter K j The function.

[0079] Then, this decomposition is generally approximate, with the aim of determining the best approximation, or an approximation of sufficient quality. This approximation appears as projection pursuit in the literature focused on statistical optimization. As mentioned earlier, a notable result is that any function f can be approximated in this way with arbitrarily high precision. However, in practice, it is common for f to allow exact decomposition, i.e., it can be analytically expressed as a sum of ridge functions for all or part of its inputs.

[0080] When the function f j Take {x1,…,x} p When a subset of t (t≤p) variables of} is used as input, if these variables are represented as The previous ridge decomposition is then written as

[0081]

[0082] in and a k =(a 1,k ,…,a t,k ), for function g k sum coefficient a i,k function g k And coefficient a i,k f is determined to be for a given parameter K j The function.

[0083] Therefore, in one embodiment of the present invention, the pre-calculation stage may be characterized by, for the data from f1,…,f q At least one function f in j The transformation of the pre-computation step is (t≤p and j1,…,j) t An approximate transformation of the form ∈{1,…,p}) is given, where the coefficient a i,k It is a real number and g is one of them. k It is a unary function defined on real numbers and having real values, the function g k and the coefficient a i,k f is determined to be for a given parameter K j The function.

[0084] A similar decomposition technique using the same statistical optimization tools is applied by taking a radial function instead of a ridge function, based on...

[0085] in a k =(a 1,k ,…,a t,k ), and where vector a k coefficient a i,k Let g be a real number, and g be a real number. k It is a unary function defined on real numbers and having real values, the function g k and the coefficient a i,k f is determined to be for a given parameter K and a given norm ‖·‖ j The function is called. Typically, the Euclidean norm is used.

[0086] When the function f j Take {x1,…,x} p When a subset of t (t≤p) variables is used as input, if people use Representing these variables, the previous decomposition is written as

[0087]

[0088] in and a k=(a 1,k ,…,a t,k ), for function g k And coefficient a i,k function g k And coefficient a i,k f is determined to be for a given parameter K j The function.

[0089] Therefore, in one embodiment of the present invention, the pre-calculation stage may be characterized by, for the data from f1,…,f q At least one function f in j The transformation of the pre-computation step is Transformation of form, where a k =(a 1,k ,…,a t,k (t≤p and j1,…,j) t ∈{1,…,p}), and where vector a k coefficient a i,k Let g be a real number, and g be a real number. k It is a unary function defined on real numbers and having real values, the function g k and the coefficient a i,k f is determined to be for a given parameter K and a given norm ‖·‖ j The function.

[0090] As pointed out in the aforementioned Pinkus article, another important class of function decompositions is when the coefficients a i,k It is fixed, the function g k It is variable in time. This class is applicable to both ridge function decomposition and radial function decomposition. Several methods for solving this problem are known, including the von Neumann algorithm, the cyclic coordinate algorithm, the Schwarz domain decomposition method, the Dirichlet-Strauss algorithm, and variants found in literature specifically for tomography; see this article, also by Pinkus, and its references.

[0091] Therefore, in a particular embodiment of the invention, this pre-calculation stage is further characterized by the coefficient a. i,k It is fixed.

[0092] In some cases, the transformation of the pre-computation step can be performed entirely through the equivalent form of a multivariate function.

[0093] Consider g as a multivariate function. If this function g calculates the maximum value of z1 and z2, g(z1,z2) = max(z1,z2), then it can be used in the form of max(z1,z2) = z2 + (z1 - z2). + ,in Corresponding to a univariate function This use of formal equivalence allows for the easy acquisition of other formal equivalences for the function max(z1,z2). For example, due to (z1-z2)... + It can be expressed in an equivalent way as We obtain the formally equivalent max(z1,z2)=(z1+z2+|z1-z2|) / 2, where It is the absolute value of a univariate function, and in which It is a univariate function "divided by 2".

[0094] Generally speaking, for three or more variables z1,…,z m Given max(z1,…,z) i ,z i+1 ,…,z m ) = max(max(z1,…,z i ),max(z i+1 ,…,z m For any i (1≤i≤m-1), the sum is obtained by the function |·| (absolute value) or the sum is obtained by the function (·). + The combination of these elements is used to iteratively obtain max(z1,…,z). m ).

[0095] Therefore, in one embodiment of the present invention, the pre-calculation stage is characterized in that the transformation of this pre-calculation step is equivalent to max(z1,z2)=z2+(z1-z2). + , in order to make the function It can be represented as a combination of the sum of univariate functions and the composition of univariate functions.

[0096] In a particular embodiment of the invention, this pre-computation stage is further characterized in that, when the function comprises three or more variables, formal equivalence is obtained from iterations of formal equivalence of two variables.

[0097] Similarly, for the "minimum" function, g(z1,z2)=min(z1,z2), we can use the equivalent form min(z1,z2)=z2+(z1-z2). - ,in Or min(z1,z2)=(z1+z2-|z1-z2|) / 2, because Through iteration, it typically allows observation of min(z1,…,z) i ,z i+1 ,…,z m )=min(min(z1,…,z i ),min(zi+1 ,…,z m To use the function min(z1,…,z) to define the m-variables, we can define min(z1,…,z). m It can be decomposed into a combination of the sum of univariate functions and the composition of univariate functions.

[0098] Therefore, in one embodiment of the present invention, the pre-calculation stage is characterized in that the transformation of this pre-calculation step is equivalent to min(z1,z2)=z2+(z1-z2). - , in order to make the function It can be represented as a combination of the sum of univariate functions and the composition of univariate functions.

[0099] In a particular embodiment of the invention, this pre-computation stage is further characterized in that, when the function comprises three or more variables, formal equivalence is obtained from iterations of formal equivalence of two variables.

[0100] Another very useful multivariable function (which can be simply formally decomposed into a combination of sums and compositions of univariate functions) is multiplication. The first implementation is equivalent to the form g(z1,z2)=z1×z2 using z1×z2=(z1+z2). 2 / 4-(z1-z2) 2 / 4, involving univariate functions Of course, the use of formal equivalence can give other forms of formal equivalence. Therefore, as an example, by using z1×z2=(z1+z2) 2 / 4-(z1-z2) 2 / 4, from which we can deduce that z1×z2=(z1+z2) 2 / 4-(z1-z2) 2 / 4+(z1+z2) 2 / 4-(z1+z2) 2 / 4=(z1+z2) 2 / 2-(z1-z2) 2 / 4-(z1+z2) 2 / 4=(z1+z2) 2 / 2-z1 2 / 2-z2 2 / 2; that is, formally equivalent to z1×z2=(z1+z2) 2 / 2-z1 2 / 2-z2 2 / 2, involving univariate functions

[0101] Therefore, in one embodiment of the present invention, the pre-calculation stage is characterized in that the transformation of this pre-calculation step is equivalent to z1×z2=(z1+z2).2 / 4-(z1-z2) 2 / 4, to make the function It can be represented as a combination of the sum of univariate functions and the composition of univariate functions.

[0102] By observing z1×…×z i ×z i+1 ×…×z m =(z1×…×z) i )×(z i+1 ×…×z m These implementation schemes can be generalized to functions of m (m≥3) variables (1≤i≤m-1).

[0103] In a particular embodiment of the invention, this pre-computation stage is further characterized in that, when the function comprises three or more variables, formal equivalence is obtained from iterations of formal equivalence of two variables.

[0104] The second implementation scheme decomposes g(z1,z2)=|z1×z2|=|z1|×|z2| into |z1×z2|=exp(ln|z1|+ln|z2|), which involves a univariate function. and Or, for any base B, such as because Where e = exp(1), it involves a univariate function. and Here again, when we observe |z1×…×z i ×z i+1 ×…×z m |=|z1×…×z i |×|z i+1 ×…×z m When | (1 ≤ i ≤ m - 1), these implementation schemes can be generalized to m-variable functions (m ≥ 3).

[0105] Therefore, in one embodiment of the present invention, the pre-computation stage is characterized in that the transformation of this pre-computation step is equivalent to |z1×z2|=exp(ln|z1|+ln|z2|), so as to transform the function It can be represented as a combination of the sum of univariate functions and the composition of univariate functions.

[0106] In a particular embodiment of the invention, this pre-computation stage is further characterized in that, when the function comprises three or more variables, formal equivalence is obtained from iterations of formal equivalence of two variables.

[0107] As mentioned earlier, the multivariate function given as input is transformed into a multivariate function network. This network is not necessarily unique, even if the transformation is exact.

[0108] For example, we see here at least two decompositions of the multivariate function max(x1,x2), namely max(x1,x2) = x2 + (x1 - x2). + And max(x1,x2) = (x1 + x2 + |x1 - x2|) / 2. Specifically, each of these transformations can be performed in detail as follows:

[0109] 1. max(x1,x2)=x2+(x1-x2) +

[0110] ●Assume z1 = x1 - x2, and define g1(z) = z +

[0111] ●Write max(x1,x2)=x2+g1(z1)

[0112] 2.max(x1,x2)=(x1+x2+|x1-x2|) / 2

[0113] ●Assume z1 = x1 - x2 and z2 = x1 + x2

[0114] ● Define g1(z) = |z| and g2(z) = z / 2

[0115] ●Write max(x1,x2)=g2(z3), where z3=z2+g1(z1)

[0116] Generally, two types of operations are observed in unary function networks: summation of unary functions and evaluation. When the network's evaluation is homomorphically performed on cryptographic values, the most expensive operation is the evaluation of unary functions, as this typically generates bootstrapping steps. Therefore, it makes sense to generate unary function networks that minimize these evaluation operations.

[0117] Therefore, in the previous examples, we can see the "maximum value" function [max(x1,x2)=x2+(x1-x2)] + The first transformation seems more advantageous because it only requires the evaluation of a single function, namely the function g1(z) = z. +The evaluation of the second univariate function in the second transformation is not significant in practice because it doesn't really need to be evaluated: it only needs to return 2max(x1,x2) = x1 + x2 + |x1 - x2| or incorporate this factor into the decoding function at the output. Generally, univariate functions involving multiplication by a constant can be ignored by (i) calculating multiples of the initial function, or (ii) by composing the constant when these functions are at the input of another univariate function. For example, the multivariate function sin(max(x1,x2)) can be written as...

[0118] 1.sin(max(x1,x2))=sin(x2+(x1-x2) + )

[0119] ●Assume z1 = x1 - x2, and define g1(z) = z +

[0120] ● Define g2(z) = sin(z)

[0121] 2. Write sin(max(x1,x2))=g2(z2), where z2=x2+g1(z1).

[0122] ●sin(max(x1,x2))=sin((x1+x2+|x1-x2|) / 2)

[0123] ●Assume z1 = x1 - x2 and z2 = x1 + x2

[0124] ● Define g1(z) = |z| and g2(z) = sin(z / 2)

[0125] 3. Write sin(max(x1,x2))=g2(z3), where z3=z2+g1(z1).

[0126] (in the second case, The multiplication is "absorbed" by the function g2(z) = sin(z / 2).

[0127] Except for univariate functions of the type g(z) = z + a (addition of constant a) or g(z) = az (multiplication of constant a), other cases will produce faster evaluation of univariate functions.

[0128] This indicates that in the pre-computation step, the values ​​of f1, ..., f are calculated. q The conversion produces the corresponding parameters. A set of unary functions, some of which may be identical.

[0129] Three types of optimization were considered:

[0130] 1) Identical functions, identical arguments:

[0131] g k = g k′ and (Type 1). This optimization is obvious. It involves reusing previously computed results. Thus, if there exists a k′ < k such that has already been evaluated, and for will surely not be recomputed.

[0132] 2) Different functions, identical arguments

[0133] g k ≠ g k′ and (Type 2). In some cases, the cost of homomorphically evaluating two or more unary functions on the same arguments may be less than the sum of the costs of considering these functions separately. Typically, a single bootstrapping step is required. In this case, in two unary function networks that include the same number of type unary functions, within the multiplicative tolerance, it is advantageous to preferably share the unary function network with the most parameters. One embodiment illustrates this well. Consider the homomorphic evaluation of the multivariate function f(x1,x2) = max(x1,x2) + |x1 × x2|. Two possible implementations of the network are

[0134] a. max(x1,x2) + |x1 × x2| = x2 + (x1 - x2) + + exp(ln|z1| + ln|z2|)

[0135] ● Assume z1 = x1 - x2, and define g1(z) = z +

[0136] ● Define g2(z) = ln|z| and g3(z) = exp(z)

[0137] ● Write max(x1,x2) + |x1 × x2| = x2 + g1(z1) + g3(z2), where z2 = g2(x1) + g2(x2)

[0138] b. max(x1,x2) + |x1 × x2| = x2 + (x1 - x2) + + |(x1 + x2) 2 / 4 - (x1 - x2) 2 / 4|

[0139] ● Assume z1 = x1 - x2, and define g1(z) = z +

[0140] ●Assume z2 = x1 + x2, and define g2(z) = z 2 / 4 and g3(z) = |z|

[0141] ●Write max(x1,x2)+|x1×x2|=x2+g1(z1)+g3(z3), where z3=g2(z2)-g2(z1).

[0142] The two implementations described above involve four unary function evaluations. However, the second implementation, which includes two unary functions with the same parameters, namely g1(z1) and g2(z1), is therefore preferred.

[0143] The sharing of unary functions on the same parameters is not limited to transformations performed through equivalent representations. This also applies to numerical transformations. It should be remembered that functions defined in... Functions on a parallelepiped can be converted into a network of univariate functions. Specifically, for a function with p variables x1,…,x… p For a function f, Sprecher's algorithm allows obtaining approximate values ​​of functions f with the following form:

[0144]

[0145] in

[0146] In this structure, for a given domain, the so-called "inner" functions Ψ and ξ do not depend on f. Therefore, if several multivariable functions f1,…,f are defined on the same domain… q If they are homomorphically evaluated, then when applied to the same input, the homomorphic evaluations of functions Ψ and ξ do not need to be recalculated. This situation also occurs, for example, when using ridge functions or radial functions to decompose several multivariate functions, where the coefficients of the decomposition (a) ik () is fixed.

[0147] 3) The same function, differing by a non-zero additive constant in its parameters.

[0148] g k =g k′ and Given constant a k ≠0 (Type 3). Another situation where computation can be accelerated is when the same univariate function is applied to parameters that differ by a non-zero additive constant. For example, still in the Sprecher structure, the above homomorphic evaluation of f involves the same univariate function Ψ with variables (i.e., x) differing by an additive constant value. i Several homomorphic evaluations on +ka, (1≤i≤p and ka is known)). In this case, Ψ(x iThe encrypted value of +ka)(1≤k≤K) can be obtained from Ψ(x i This can be effectively obtained through encryption; an implementation scheme will be detailed below.

[0149] From a formal perspective, in the case of f1,…,f q All unary functions with corresponding parameters generated by the transformation in the pre-computation step In, an element that satisfies one of the following three conditions This is called "redundancy" for exponents k′≤k.

[0150] 1.g k =g k′ and

[0151] 2.g k ≠g k′ and

[0152] 3.g k =g k′ and Given constant a k ≠0.

[0153] like Figure 3 As illustrated in the example, a unary function f with any real-valued variable in its domain... Arbitrary precision and in the image When the value in the middle has a real value,

[0154]

[0155] The method according to the present invention uses two homomorphic encryption algorithms, denoted as E and E′. Their original plaintext spaces are respectively denoted as... and The method takes integers N ≥ 1 as its parameters, quantifying the actual precision of the input used to evaluate the function f. In fact, although the domain of function f... The inputs can have arbitrary precision, but internally they can be represented by at most N selected values. The direct consequence of this is that the function f will be represented by the maximum value among the N possible values. This method is also parameterized by the encoding functions `encode` and `encode'`, where `encode` takes the value... The elements are taken as input and compared with The elements are associated, and encode' takes The elements are taken as input and compared with The elements are associated. This method is parameterized by a so-called discretization function, which takes... The elements are taken as input and associated with integers. The encoding function and the discretization function are used to make the domain... The image is discretized after being encoded. Or from Take a set of at most N exponents. Finally, this method is based on an encryption algorithm ε. H Parameterization of homomorphic encryption schemes, plaintext original space It has a base of at least N, and an encoding function `encode`. H It takes an integer as input and returns an integer. The element. In this case, the method includes the following steps:

[0156] ● Pre-calculation step: In the pre-calculation step, the function f is discretized, and a table T corresponding to this discretized function f is constructed.

[0157] Specifically, the domain of a function It is decomposed into N subintervals R0,...,R N-1 The union of these sub-intervals and Equal. For each index i∈{0,...,N-1}, choose a representative x(i)∈R i And calculate y(i)=f(x(i)). Return a table T containing N components T[0], ..., T[N-1], where T[i]=y(i), 0≤i≤N-1.

[0158] ● The step of performing so-called homomorphic evaluation on the table, in which, for real values Given a ciphertext E(encode(x)) of x, where the function encode encodes x into... The element that converts the ciphertext E(encode(x)) into an integer. ciphertext If x∈R i integer Let the index i be in the set {0,...,N-1} As an expected value. From the ciphertext Starting with table T, for element Obtain the ciphertext element Will (in and As expected. Return ciphertext. The encrypted ciphertext is an approximation of f(x).

[0159] Therefore, in one embodiment of the present invention, the present invention covers a digital approximate homomorphic evaluation of a univariate function f of a real-valued variable x by a specially programmed information processing system. This univariate function has arbitrary precision in its domain D and a real value in an image I. It takes the encrypted ciphertext E(encode(x)) of x as input and returns an encrypted ciphertext E′(encode′(y)) that approximates f(x), where y≈f(x). Here, E and E′ are homomorphic encryption algorithms, and their corresponding plaintext original spaces are M and M′. Their evaluation parameters are:

[0160] ● An integer N ≥ 1 is used to quantify the actual precision represented by the input variables of the function f to be evaluated;

[0161] ● The encoding function `encode` takes the domain. The element is taken as input, and the element is compared with... The elements are related;

[0162] ● The encoding function `encode` is used to extract the image. The element is taken as input, and the element is compared with... The elements are related;

[0163] ● The discretization function is `discretise`, which takes... The elements are taken as input and associated with an exponent represented by an integer;

[0164] ● Features encryption algorithm ε H The homomorphic encryption scheme, its plaintext original space It has a base of at least N;

[0165] ●Encoding function encode H Take an integer as input and return an integer. The elements. Thus, through encoding and discretization, the domain... Image From The set of at most N selected indices.

[0166] With these parameters, the approximate homomorphic evaluation of the univariate function f requires the following two consecutive steps to be performed by a specially programmed information processing computer system:

[0167] 1. The step of pre-calculating the table corresponding to the univariate function f includes:

[0168] a. Domain Decompose into N selected subintervals R0, ..., R N-1 The union of these subintervals is

[0169] b. For Each index i in the subinterval R i Let x(i) be the representative of x(i) and its calculated value be y(i) = f(x(i)).

[0170] c. Return a table T consisting of N components T[0], ..., T[N-1], where T[i] = y(i), 0 ≤ i ≤ N-1;

[0171] 2. The steps for performing a homologous evaluation on the table include:

[0172] a. If x∈R i Convert the ciphertext E(encode(x)) into an integer. ciphertext Integer set The index in As an expected value;

[0173] b. From the ciphertext Starting with table T, obtain elements

[0174] ciphertext element With expected value

[0175] c. Return ciphertext When the domain of the function f to be evaluated It is the real number interval [x min ,x max When covering N sub-intervals R i (0≤i≤N-1) can be chosen as a half-open interval:

[0176]

[0177] Divide in a regular way Interval R i The representation x := x(i) can have several choices. For example, we can consider the midpoint of each interval, by... Given. Another option is in R. i Let x(i) be a value that makes f(x(i)) close to f(x) in the interval R. i The average value over R, or for each 0 ≤ i ≤ N-1, such that f(x(i)) approximates the value of x over the interval R. i The weighted average or close to the median of a given prior distribution.

[0178] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a univariate function f is further characterized by:

[0179] ● The domain of the function f to be evaluated is the real number interval Give;

[0180] ●Coverage area N intervals R i (0≤i≤N-1) is a half-open subinterval Divide in a regular way

[0181] Encode function H Algorithm ε H The choice in converting E(encode(x)) to It plays a leading role. It should be remembered that, for We have in An important situation is when The elements of this group are considered as elements of a soous-ensemble (not necessarily a soous-groupe) of the additive group. For integers M ≥ N, this additive group is represented as... (Provide a set of integers {0, ..., M-1} that can be added modulo M).

[0182] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a univariate function f is further characterized in that, for integers M ≥ N, the set It is an addition group A subset of.

[0183] There are several representation groups Therefore, Ducas and Micipanio, in their aforementioned EUROCRYPT 2015 article, [details omitted]. The elements are represented as the exponents of the variable X; Element i is associated with element X i X M =X 0 =1 and for any 0 <j<M,X j ≠ 1. We can say that X is the Mth primitive root of the unit. This representation allows for conversion from addition to multiplication: for all elements... Element i+j (mod M) is associated with element X i+j =X i ·X j (mod(X M -1)).

[0184] Modular multiplication (X)M -1) In addition group The set of M-th roots of the unit {1, X, ..., X} M-1 The relationship between} induces an exodus isomorphism. When M is even, the relation X} M =1 means X M / 2 =-1. Then for We have X i+j =X i ·X j (mod(X M / 2 +1)), and the set of the unit M-th root is {±1,±X,...,±X} (M / 2)-1}

[0185] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a univariate function f is further characterized by the group The original M-th root of the unit (denoted as X) is multiplicatively represented as a power of the original M-th root, thus... Element i is associated with element X i Unit {1, X, ..., X} M-1 All M-th roots of} form with isomorphism group, used for modulo multiplication (X) M -1).

[0186] The homomorphic encryption algorithm E is applied to rings. Given the LWE-type encryption algorithm, we have If for having The encoding function `encode` is used to encode the value in the data. Let μ = encode(x), then we have E(encode(x)) = (a1, ..., a n b) of which and e is Small random noise on it.

[0187] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of the unary function f is further characterized in that the homomorphic encryption algorithm E is derived from the algorithm applied to the ring. The LWE-type encryption algorithm is given, and it has the original space of plaintext.

[0188] For integers M ≥ N, the discretization function `discretise` is parameterized as a function that associates the element `t` of the ring with the product `M × t modulo M`, where `M × t` is in the integer part of the ring. Calculation in Chinese; written in mathematical form as

[0189]

[0190] This discretization function naturally extends to vectors in a ring. Applied to... The vector c = (a1, ..., a2) n b), we get vector Depend on Given, among which In a more detailed way, if we define as well as Then we have

[0191]

[0192] The signed integer Δ captures the rounding error, known as "drift". The expected value of the drift is zero. Furthermore, if |e| < 1 / (2M), then... We assume

[0193] in in The expected value is an integer. The encoding function `encode` is parameterized so that its image is contained within a sub-range of the ring. Inside. In this way, if but and In fact, it can be verified that if but and

[0194]

[0195] Therefore, due to Therefore, for these functions discretise and encode, we actually have in other words It is a set of indexes A subset of.

[0196] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a univariate function f is further characterized by:

[0197] ● The image encoded by the encoding function is contained within a sub-range of the ring. Inside; and

[0198] ● The discretization function `discretise` applies the element `t` of the ring to the product `M×t modulo M`, where `M×t` is in the range of the ring. Calculation in Chinese; in mathematical form,

[0199] It should be noted that when the domain of the function f to be evaluated is the real number interval... The original space of plain text It is a ring When this happens, the possible choices for the encoding function are: Then for We have We noticed

[0200] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a univariate function f is further characterized by the fact that when the domain of function f is the real number interval... When, the encoding function encodes is

[0201]

[0202] structure This produces the conversion of E(encode(x)) to... The first implementation scheme. It assumes a set The elements are directly regarded as An integer. Used as the encoding function `encode`. H We consider the identity function. Using the previous notation, if we represent And use This indicates that it is in the ring c = (a1, ..., a n The LWE ciphertext on b) is then Defined as:

[0203]

[0204] in It should be noted that In this case, we observe ε H It is a ring The LWE-type encryption algorithm is used; the encryption key is (s1, ..., s). n )∈{0,1} n .

[0205] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of the unary function f is further characterized by the homomorphic encryption algorithm ε H It is an LWE-type encryption algorithm, with the encoding function encode. H It is an identity function.

[0206] Convert E(encode(x)) to The second implementation scheme is obtained by considering the Mth root of the unit; this allows it to work in a multiplicative manner. More specifically, assume M is even. The arbitrary polynomial p := p(X) is fixed. The encoding function encodes... H It is a function

[0207]

[0208] And encryption algorithm ε H Is Mold taking The RLWE type encryption algorithm is used. This choice of encoding... H and ε H The conversion used re-encryption technology. Based on the key... We use s j The RGSW type ciphertext (1≤j≤n). Convert to The process is given as follows:

[0209] ● Obtain the conversion public keys bk[1], ..., bk[n];

[0210] ●Calculation and

[0211] ●Initialization

[0212] ● For j ranging from 1 to n, evaluate (exist middle)

[0213] ●Return to c′ n As a result

[0214] In this case, ε can be seen H In taking the mold The RLWE type encryption algorithm is used; the encryption key is In fact, if we set C j yes Based on the key (s′1,...,s′) k The RGSW type encryption (1≤j≤n) is mathematically expressed as follows: We have

[0215]

[0216] Therefore, if we use the key (s′1,...,s′) k Let RLWE(m) represent RLWE type encryption, we have

[0217]

[0218] And through induction:

[0219]

[0220] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of the univariate function f with an even integer M as a parameter is further characterized by the homomorphic encryption algorithm ε H It is an RLWE type encryption algorithm, for For any polynomial p, the encoding function is encode. H It is a function

[0221] According to either of the two implementation schemes above, it is now possible to... Perform a homomorphic evaluation on table t. In both cases, we assume that E is an LWE-type algorithm on the ring, and that M is even, equal to 2N.

[0222] 1. The first case assumes the encoding function is encode. H for And algorithm ε H yes The LWE-type encryption algorithm. In this first case, we have The first sub-step includes:

[0223] ● Forming a polynomial This polynomial is derived from Given, where T′[j]=encode′(T[j])(0≤j≤N-1);

[0224] ● Obtain the conversion public key bk[1],...,bk[n];

[0225] ●Initialization

[0226] ● For j ranging from 1 to n, evaluate (exist middle);

[0227] ●Assume d′=c″ n ;

[0228] ●Return

[0229] 2. The second case is for any polynomial. Assuming encoding function And algorithm ε H yes The RLWE type encoding algorithm. In this second case, for any polynomial We have The first sub-step includes:

[0230] ●Selection polynomial Make P·p≈q where Depend on Given, where T′[j]=encode′(T[j])(0≤j≤N-1);

[0231] ●Evaluation

[0232] ●Return Where P(X)·p(X)≈q(X).

[0233] In particular, it should be noted that for integers L>1, if Then choose

[0234] in For 1≤j≤N-1 (where multiplied by L in...), The calculation in the middle means that P(X)·p(X)≈T′[0]+T′[1]X+…+T′[N-1]X N-1 In fact, we can observe that for the choice of this polynomial p, we have

[0235]

[0236] It should also be noted that for 0≤r≤N-1, as well as It should be noted that P·p≈q; this equation was verified within a given drift, and its expected value is zero.

[0237] In both cases, as a response to the first sub-step of homomorphic evaluation of table T, based on the key... Obtain the expected polynomial The RLWE type ciphertext d′, the key is used to generate the RGSW type ciphertext bk[j] (1≤j≤n), and the private key (s1,...,s) is used to generate the RGSW type ciphertext bk[j] (1≤j≤n). n )∈{0,1} n bits j Encryption is performed. Based on the form q(X), the polynomial... The constant term is We use This represents a component of the ciphertext d′.

[0238] The second sub-step of the homomorphic evaluation of table T (in both cases) extracts from the RLWE ciphertext. LWE type ciphertext.

[0239] ●For each 1≤j≤k, the polynomial Written in

[0240] ● Polynomial Written in

[0241] ● Define the element vector on the ring. in

[0242]

[0243] ● Returns the vector of elements on the ring Where b″=(b′)0 is the constant term of the polynomial b′.

[0244] If for every 1≤j≤k, the polynomial Written as in We can see that the returned vector is (a″1, ..., a″). kN b″) is based on the key ((s′1)0,(s′1)1,...,(s′1) N-1 ,...,(s′ k )0,(s′ k )1,...,(s′ k ) N-1 )∈{0,1} kN , LWE-type ciphertext on the ring. This defines the encryption algorithm E′; therefore we have In this case, the corresponding plaintext primitive space is Therefore, due to and We actually obtained LWE-type encrypted ciphertext with an approximation of f(x).

[0245] After completing the calculation, the ciphertext It can be decrypted and decoded to obtain an approximate value of f(x).

[0246] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a univariate function f with an even integer M equal to 2N as a parameter is further characterized by the LWE-type ciphertext on the ring. From approximation polynomial Extracted from the RLWE ciphertext, in which middle And where T′[j]=encode′(T[j])(0≤j≤N-1).

[0247] When the graph of the function f to be evaluated For the real number interval [y min ,y max Furthermore, the plaintext original space encrypted with LWE type It is a ring When this happens, the possible choices for the encoding function encode' are: In this case, the corresponding decoding function is provided by Provided.

[0248] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a univariate function f is further characterized by the fact that when the graph of function f is a real number interval... hour,

[0249] ● Homomorphic encryption algorithm E′ is applied to ring The LWE-type encryption algorithm is given, and the original plaintext space is

[0250] ●The encoding function encode′ is

[0251] Encoding should be considered during ciphertext addition. If we denote the encoding function of the homomorphic coding algorithm E as encode, then we have E(μ1+μ2)=E(μ1)+E(μ2), where μ1=encode(x1) and μ2=encode(x2). If the encoding function is homomorphic, then we actually have E(encode(x1+x2))=E(encode(x1))+E(encode(x2)). Alternatively, if the encoding function does not conform to addition, a correction ε should be applied to the encoding: ε=encode(x1+x2)-encode(x1)-encode(x2) such that E(encode(x1+x2))=E(encode(x1))+E(encode(x2))+E(ε). In particular, when the encoding is... When defined, the modification is equivalent to For x min =0, then it is zero. It should be remembered that for LWE type encryption schemes, an uplet of the form (0,...,0,ε) is valid ciphertext for ε.

[0252] Of course, the preceding considerations still hold true for images. For a homomorphic encryption algorithm E' with an encoding function encode', for the correction ε′=encode′(f(x1)+f(x2))-encode′(f(x1))-encode′(f(x2)), we have E′(encode′(f(x1)+f(x2)))=E′(encode′(f(x1)))+E′(encode′(f(x2)))+E′(ε′). In particular, the correction ε′ is zero when the encoding encode' conforms to addition. For the encoding Correcting ε′ is equivalent to

[0253] Another important special case is when the same unary function f should be homomorphically evaluated on inputs x1 and x2 = x1 + A (given constant A). A typical application example is the internal function Ψ in the Sprecher application described in this paper. For a homomorphic encryption algorithm E with an encoding function encode, given E(encode(x1)), it is possible to derive E(encode(x2)) = E(encode(x1 + A)), and then obtain E′(encode′(f(x1))) and E′(encode′(f(x2))), as explained above. However, it is necessary to repeat all the steps. In the special case where E is an LWE-type algorithm on a ring and M = 2N, at the input E(encode(x1)), we have already seen that, in the result of the first sub-step of the homomorphic evaluation of table T, we obtain the expected polynomial. The RLWE type ciphertext d′, where the polynomial q lists the function f, and where x1 belongs to the subinterval but The expected value is i1 = discretise(encode(x1)). For example, for the discretization function... Where M = 2N, we get

[0254]

[0255] therefore, In this case, the expected polynomial RLWE type ciphertext can be like That way, we can get it much faster. Therefore, E′(encode′(f(x2)) ～ The value of ) is derived from the second sub-step of the homomorphic evaluation of table T.

[0256] The present invention also includes an information processing system specifically programmed to implement a homomorphic encryption evaluation method according to any of the alternative methods described herein.

[0257] Additionally, it includes computer program products specifically designed to implement any of the alternative methods described herein, and loaded and implemented by an information processing system programmed for this purpose.

[0258] Application Examples of the Invention

[0259] The invention described above can be very advantageously used to protect the confidentiality of certain data, such as, but not limited to, personal, health, and classified information data, or more generally, all data on which the data holder wishes to keep confidential but desires a third party to be able to digitally process it. Distributing processing to one or more third-party service providers makes sense for several reasons: it allows for operations that require expensive or unavailable resources; it also allows for non-public operations. Conversely, the third party actually responsible for performing the digital processing operations may not wish to communicate the actual content of the processing and the digital functions implemented thereby.

[0260] In such an application, the invention covers the implementation of remote digital services, particularly cloud computing, wherein a third-party service provider responsible for applying digital processing to encrypted data performs, for itself, the first pre-computation step described above, which includes processing functions f1, ..., f1 used to process the encrypted data. q Each multivariate function f j Pre-compute the univariate function network. In all the obtained univariate functions (for a given...) In cases where k≥1), the third party pre-selects a univariate function g in the second step. k and their corresponding parameters Make k′<k satisfy one of the following three criteria: (i)g k =g k′ and (ii)g k ≠g k′ and Or (iii)g k =g k′ and Given constant a k ≠0; these unary functions will be evaluated in an optimized manner when appropriate.

[0261] Conversely, confidential data (x1, ..., x) p The holder of ) encrypts it using a homomorphic encryption algorithm E in order to transmit type data E(μ1), ..., E(μ) to a third party. p ), where μ i It is x iThe encoded value is obtained through the encoding function. Typically, the choice of algorithm E is imposed by the third-party provider of the service. Alternatively, the data holder can use an encryption algorithm of his choice, which is not necessarily homomorphic. In this case, a third party (or another service provider) will perform a prior re-encryption step to obtain encrypted data in the desired format.

[0262] Therefore, in one embodiment of the present invention, the previously described homomorphic evaluation encryption method is characterized in that the input encrypted data comes from a prior re-encryption step and is set in the form of encrypted ciphertext of the homomorphic encryption algorithm E.

[0263] Once a third party obtains the encrypted data E(μ) i In the homomorphic evaluation step of a univariate function network, it performs a homomorphic evaluation on each univariate function network based on these ciphertexts in a series of successive steps to obtain f applied to its input according to the encryption algorithm E′. j The encrypted ciphertext (1≤j≤q).

[0264] Once it is obtained, for the different functions f under consideration j The encrypted result of the encryption on its input value is then sent back to the holder of the confidential data by the relevant third party.

[0265] Then, the holder of the confidential data can obtain one or more functions (f1, ..., f) after decoding, based on the corresponding decryption key they possess. q The result value is derived from the homomorphically encrypted input data (x1, ..., x). p To begin, no third party is required to perform digital processing on the data, which includes the implementation of one or more functions. No third party needs to know the explicit content of the data, and conversely, the data holder cannot know the details of the implemented functions.

[0266] This sharing of tasks between data holders and third parties acting as digital processing service providers can advantageously be conducted remotely, particularly through cloud computing-type services, without compromising the security of the data and related processing. Furthermore, different steps in digital processing can be handled by different service providers.

[0267] Therefore, in one embodiment of the invention, a cloud computing-type remote service implements one or more previously described homomorphic evaluation encryption methods, wherein tasks are shared between a data holder and a third party (or multiple third parties) acting as a digital processing service provider.

[0268] In one specific embodiment of the invention, this remote service involves data x1, ..., x that are desired to be kept confidential. pThe holder of the data and one or more third parties responsible for applying digital processing to the data, further characterized in that

[0269] 1. According to the present invention, a relevant third party (or multiple third parties) performs a first step and a second pre-selection step for pre-computing a univariate function network;

[0270] 2. The data holder uses homomorphic encryption algorithm E to store x1, ..., x p Encryption is performed, and the data of type E(μ1), ..., E(μ) are... p ) is transmitted to a third party, where μ i x is obtained through the encoding function i The encoded value;

[0271] 3. Once the relevant third party obtains the encrypted type data E(μ) i He would then perform homomorphic evaluations on each of the unary function networks based on these ciphertexts in a series of consecutive steps, thereby obtaining f applied to its inputs (1≤j≤q) according to the encryption algorithm E′. j Encrypted ciphertext;

[0272] 4. Once he has obtained the different functions f under consideration j The encrypted result, which is encrypted on its input value, is sent back to the data holder by the relevant third party.

[0273] 5. Based on the corresponding decryption key held by the data holder, one or more functions (f1, ..., f) are obtained after decoding. q The result value.

[0274] A variant of this implementation is characterized in that, in the second step (2.) above:

[0275] ● The data holder uses an encryption algorithm different from E to access x1, ..., x p Encryption is performed, and the encrypted data is transmitted.

[0276] ● The relevant third party re-encrypts the received encrypted data to obtain ciphertext E(μ1), ..., E(μ) according to the homomorphic encryption algorithm E. p ), where μ i x is obtained through the encoding function i The encoded value.

[0277] Furthermore, various applications of the remote digital services according to the present invention can be mentioned. Thus, as mentioned in the aforementioned MajecSTIC'08 article, it is known that a Kolmogorov-type decomposition applied to grayscale images (which can be viewed as a bivariate function f(x,y) = I(x,y), where I(x,y) gives the grayscale intensity of the pixel at coordinates (x,y)) allows for the reconstruction of an approximate image of the initial image. Therefore, the knowledge of coordinates (x1,y1) and (x2,y2) defines the bounding box, allowing for a simple cropping operation. A similar processing method applies to color images, taking into account the bivariate functions f1(x,y) = R(x,y), f2(x,y) = G(x,y), and f3(x,y) = B(x,y) giving the red, green, and blue levels, respectively. While this type of processing is known for unencrypted data, the present invention now allows for processing using homomorphic encryption. Therefore, according to the invention, if a user sends in an encrypted manner GPS coordinates recorded at regular intervals (e.g., every 10 seconds) during a sporting activity, along with the extreme coordinates of his journey (defining a bounding box), the service provider possessing the map plan image will be able to obtain the ciphertext of the activity-related portion of the plan by cropping it; furthermore, he will be able to represent the journey within the encrypted area using, for example, color codes to indicate the local speed homomorphically calculated based on the encrypted image of the received GPS coordinates. Advantageously, the (third-party) service provider is unaware of the exact location of the activity (other than its location in his plan) or the user's performance. Furthermore, the third party does not disclose the full content of the map.

[0278] This invention can also be advantageously used to allow the performance of artificial intelligence processing, particularly machine learning-type input data, which remains encrypted, on which a service provider implementing, particularly a neural network, applies one or more activation functions to values ​​from said encrypted data. As an example of the invention's use in neural network implementation, reference can be made to decomposing the function g(z1, z2) = max(z1, z2) (which specifically serves as the max pooling used in the aforementioned neural network) into z2 + (z1 - z2). + ,in Corresponding to a univariate function You can also refer to very popular activation functions and

[0279] Therefore, in one embodiment of the invention, a remote service implementing one or more previously described cryptographic homomorphic evaluation methods is intended to implement digital processing of a neural network.

[0280] The features of the disclosure of this invention are as follows:

[0281] This invention, by implementing the data computation and processing capabilities of one or more digital information processing systems, enables the evaluation of one or more functions on encrypted data. Depending on the circumstances, this or these functions can be univariate or multivariate. Therefore, in different variations of the method according to the invention, it allows for the evaluation of both types of functions.

[0282] When the function to be evaluated is of unary type, the present invention provides, in one embodiment, the steps of implementing two homomorphic encryption algorithms at the input and output ends respectively, and pre-compiling a table for each considered function, and then performing homomorphic evaluation on the resulting table.

[0283] When the function to be evaluated is of a multivariate type, the present invention further provides two preliminary steps: a first pre-computation step followed by a second pre-selection step. After completing these two preliminary steps, a third step is applied to the resulting univariate function network, which is to perform homomorphic evaluation of the univariate function network according to any known method for homomorphic evaluation of univariate functions.

Claims

1. An encryption method executed digitally by at least one information processing system, said information processing system being specifically programmed to perform an approximately homomorphic evaluation of a univariate function f of a real variable x, the univariate function having arbitrary precision in its domain D and being applicable to graphs. Given a real-valued f(x), take the encoded ciphertext E(encode(x)) as input and return an approximate value of f(x) E′(encode′(y)), where y≈f(x), where E and E′ are homomorphic encryption algorithms, and the original plaintext space corresponding to E and E′ is... and The parameters are: - An integer N ≥ 1, used to quantify the actual precision of the variable representation at the input of the function f to be evaluated; - The encoding function `encode` takes the domain. The elements are taken as input and the domain is... elements and The elements are related; - The encoding function `encode` is used to extract the image. The elements are taken as input and the image is processed. elements and The elements are related; - Discretization function `discretise`, taking... The elements are taken as input and the... The elements are associated with an exponent represented by an integer; - With encryption algorithm ε H The homomorphic encryption scheme, the encryption algorithm ε H plaintext original space It has a base of at least N; - Encoding function encode H Take an integer as input and return an integer. Elements; enabling the domain to be encoded and discretized. Image From The set of at most N indices selected in the dataset; And, characterized in that: -a. The step of pre-calculating the table corresponding to the unary function f includes: ○ Domain Decompose into N selected subintervals R0, ..., R N-1 The union of the sub-intervals forms ○For Each index i in the subinterval R i Let x(i) be the representative of x(i) and its calculated value be y(i) = f(x(i)). ○ Return a table T containing N components T[0], ..., T[N-1], where for 0≤i≤N-1, T[i]=y(i); -b. The steps for performing homomorphic evaluation on the table include: ○If x∈R i Convert the ciphertext E(encode(x)) into an integer. ciphertext The integer set The exponent i = As an expected value; ○Based on ciphertext And table T, obtain elements ciphertext The element Will As an expected value; ○ Return to ciphertext 2. The encryption method according to claim 1, characterized in that, - The domain of the function f to be evaluated is the real number interval Give; -Coverage area N intervals R i (0≤i≤N-1) is a half-open subinterval Divide in a regular way 3. The encryption method according to claim 1, characterized in that, For an integer M ≥ N, the set It is an addition group A subset of.

4. The encryption method according to claim 3, characterized in that, group Express the original M-root of unit as a power of multiplication, where the unit is denoted as X, thus... Element i is associated with element X i Unit {1, X, ..., X} M -1 All M-th roots of} form with isomorphism group, used for modulo multiplication (X) M -1).

5. The encryption method according to any one of claims 1 to 4, characterized in that, Homomorphic encryption algorithm E is developed by applying it to rings. The LWE-type encryption algorithm is given, and will As the original space of plaintext.

6. The encryption method according to claim 5, wherein the parameter is an integer M ≥ N, characterized in that... - The image encoded by the encoding function is contained in a sub-range of the ring. Inside; and - The discretization function `discretise` applies the elements `t` of the ring to the product `M×t` modulo `M`, where `M×t` is in the range of the ring. The calculation is performed in Chinese; the mathematical form is:

7. The encryption method according to claim 6, characterized in that, When the domain of function f is the real number interval When, the encoding function encodes is 8. The encryption method according to claim 5, characterized in that, Homomorphic encryption algorithm ε H It is an LWE-type encryption algorithm, with the encoding function `encode`. H It is an identity function.

9. The encryption method according to claim 5, wherein the even integer M is used as the parameter, characterized in that, Homomorphic encryption algorithm ε H It is an RLWE type encryption algorithm, for For any polynomial p, the encoding function is encode. H It is a function 10. The encryption method according to claim 8, wherein the even integer M equal to 2N is used as the parameter, characterized in that, LWE type ciphertext on the ring From approximation polynomial Extracted from the RLWE ciphertext, in which middle And where T′[j]=encode′(T[j]), 0≤j≤N-1.

11. The encryption method according to any one of claims 1 to 4, characterized in that, When the graph of the function f is in the real number interval hour, - Homomorphic encryption algorithm E′ is applied to ring The LWE-type encryption algorithm is given, and will As the original space of plaintext; -The encoding function encode' is 12. The encryption method according to any one of claims 1 to 4, characterized in that, At least one univariate function undergoing the approximate homomorphic evaluation is obtained from a prior processing of at least one multivariate function, which is performed by implementing the following prior steps: -a. A pre-computation step, comprising converting each of the multivariate functions into a network of univariate functions, including the composition of univariate real-valued functions and sums; -b. A pre-selection step, including identifying one of the following three types of redundancy in the pre-computed unary function network: - The same unary function applied to the same parameters; - Different unary functions applied to the same parameters; - The same univariate function applied to parameters with a phase difference of nonzero additive constant; and selecting all or part of the identified redundancy; -c. The step of homomorphically evaluating each of the pre-computed unary function network, wherein when all or part of one or more of the unary functions are reused, the redundancy selected in the pre-selection step is evaluated in a shared manner.

13. The encryption method according to any one of claims 1 to 4, characterized in that, The input encrypted data comes from a prior re-encryption step, thus being set in the form of encrypted ciphertext using the homomorphic encryption algorithm E.

14. An information processing system, characterized in that, The information processing system is programmed to implement the encryption method according to any one of claims 1 to 13.

15. A computer program product, said computer program being loaded and implemented by the information processing system of claim 14.

16. A cloud computing-type remote service system for implementing the encryption method according to any one of claims 1 to 13, wherein tasks are shared between a data holder and one or more third parties acting as a digital processing service provider.

Images