Inter-cell interpolation fitting bootstrap method based on a residue system

Abstract

The application provides a small interval interpolation fitting bootstrap method based on a residue system, which splits operation data into multiple numbers with less digits by using the residue system, respectively performs Lagrange interpolation calculation in multiple small intervals, and finally combines the calculation results to obtain fresh ciphertext after bootstrap, so as to improve the overall efficiency of the bootstrap process. Compared with the prior art, the application can effectively improve the operation efficiency of the modular multiplication operation and the modular inverse operation, and reduce the time consumption of the scheme under high security parameters. When there are parallel executable tasks in the scheme, the efficiency of the scheme can be greatly improved through parallel processing. Compared with the original bootstrap method, the scheme realizes the operation of the module function in the approximate calculation full homomorphic encryption scheme bootstrap process, and greatly improves the operation efficiency of the scheme bootstrap process.

Description

TECHNICAL FIELD

[0001] The present application relates to a method for implementing bootstrapping of an approximate homomorphic encryption scheme, which performs Lagrange interpolation fitting within a cell and accelerates the calculation through a residue system to realize the bootstrapping process of the approximate homomorphic encryption scheme. BACKGROUND

[0002] The approximate homomorphic encryption scheme based on approximate calculation supports floating-point number operation and can perform efficient arithmetic operation, and is suitable for real application scenarios such as machine learning. Combined with the bootstrapping technology, the hierarchical homomorphic encryption scheme can be converted into a full homomorphic encryption scheme, so that the scheme has the ability to calculate arbitrary homomorphic addition and homomorphic multiplication. Although the bootstrapping method of the approximate homomorphic encryption scheme based on approximate calculation has been realized, the bootstrapping process is complex and the amount of calculation is large, which makes the bootstrapping operation time too long and affects the overall efficiency of the scheme. Further improving the bootstrapping efficiency of the full homomorphic encryption scheme based on approximate calculation is the key research direction at present.

[0003] Cheon et al. combined the residue system with the approximate homomorphic encryption scheme in the document CHK+18b“Cheon J.H., Han K., Kim A., Kim M., Song Y. (2019) A Full RNS Variant of Approximate Homomorphic Encryption. In: Cid C., Jacobson Jr. M. (eds) Selected Areas in Cryptography–SAC 2018. Lecture Notes in Computer Science, vol 11349. Springer, Cham.” and optimized the operation efficiency of the approximate homomorphic encryption scheme through the residue system fast modular multiplication and modular inverse calculation method. The applicant's prior patent application“Approximate Homomorphic Encryption Bootstrapping Method Based on Small Interval Interpolation Fitting” also proposed an optimization method for bootstrapping, which divides the original bootstrapping interval into several small intervals and calculates the modulus function in each small interval to realize the acceleration of the bootstrapping process.

[0004] But the above scheme still has efficiency problems. The applicant's previous research scheme improves the efficiency of the bootstrap process through small interval division method, but the time-consuming of modular multiplication operation and modular inverse operation is still very huge, and the experiment test shows that when the operation precision is 8 bits, the time-consuming of one modular operation in the bootstrap process is 3217 milliseconds, and the parallel computing time is 0.098 milliseconds. Although the CHK+18b scheme combines the residue system with the approximate computing homomorphic encryption scheme, it only realizes the hierarchical homomorphic encryption scheme and cannot realize the full homomorphic encryption, and how to apply the residue system to the full homomorphic encryption scheme is also one of the problems to be solved in the field of approximate computing homomorphic encryption scheme. SUMMARY

[0005] In order to reduce the calculation time-consuming of the bootstrap process of the homomorphic encryption scheme based on approximate calculation, the present application provides a small interval interpolation fitting bootstrap method based on residue system, which divides the operation data into a plurality of numbers with less bits by using the residue system, and performs Lagrange interpolation calculation in a plurality of small intervals respectively, and finally combines the calculation results to obtain the fresh ciphertext after bootstrap, so as to improve the overall efficiency of the bootstrap process.

[0006] The technical scheme of the present application is:

[0007] A small interval interpolation fitting bootstrap method based on residue system, comprising the following steps:

[0008] Step 1: initialization:

[0009] The parameters are set, including the security parameter λ of the homomorphic encryption scheme, the integer base q, and the operation precision bit number prec, λ, q and prec are all positive integers;

[0010] Select k prime numbers p according to the integer base q i , and calculate Where 0≤i<k, k is a positive integer;

[0011] Select the slot number N of the approximate computing homomorphic encryption scheme according to the security parameter λ, which satisfies that N is an integer power of 2;

[0012] Step 2: residue system representation:

[0013] For the residue system with As the modulus base, the plaintext m is represented as Encrypt the k elements respectively to obtain the ciphertext

[0014] For plaintexts m1 and m2, the ciphertext representations under the public key pk and modulus base are and

[0015] Enc pk (m1) and the multiplication operation result of Enc pk (m2) is

[0016]

[0017] Enc pk (m1) and the multiplication operation result of Enc pk (m2) is

[0018]

[0019] The addition and multiplication operations in the residue system are all addition and multiplication operations in the corresponding modulus; the homomorphic addition and homomorphic multiplication between two ciphertexts in the residue system are simply denoted as Enc pk (m1) and Enc pk (m2) and Enc pk (m1) and Enc pk (m2);

[0020] Step 3: select a fitting function:

[0021] The present application uses a Lagrange interpolation polynomial to perform approximate fitting of a sinusoidal curve:

[0022] Step 3.1: for the value range of the module function, i.e. the value range [a, b] of the privacy data to be lifted, divide it into K=O(λ) small intervals; wherein O(λ) is a big O notation, which means less than or equal to the function λ in the asymptotic sense;

[0023] Step 3.2: select the largest m' value satisfying as the degree polyn of the Lagrange interpolation polynomial; for the interval range [x i,0 ,x i,polyn ], 1≤i≤K, the number of interpolation points to be selected in each small interval is polyn+1, and the interpolation point x value is represented as x i,0 ,x i,1 ,…,x i,polyn-1 ,x i,polyn ; select the left and right endpoints of the small interval as the interpolation points, and calculate the function values corresponding to the left and right endpoints and wherein the sine function y=f(x) is

[0024] Step 3.3: the remaining polyn-1 interpolation points are selected according to the y value at equal intervals; the interval between the adjacent two y values is Then the remaining polyn-1 y values are respectively Through the inverse function x=f-1 (y) calculate the x value corresponding to the y value

[0025] Step 3.4: Substitute the selected polyn+1 interpolation points into the Lagrange interpolation formula to obtain the approximate fitting result of the sine function

[0026] L(x) = c0 + c1x + c2x 2 +…+c m′ x m′ ;

[0027] Step 3.5: For each of the K small intervals divided on the fitting interval, perform the above interpolation operation to obtain K Lagrange interpolation polynomials L i (x), i = 1, 2, …, K, and the combination of these K interpolation polynomials constitutes an approximate fitting of the sine function ;

[0028] Step 4: Thread allocation

[0029] The maximum number of threads applied in the thread pool is Tn; if Tn≥3K, then allocate 2K threads to step 5 and K threads to step 6, otherwise allocate threads to step 5 and threads to step 6;

[0030] Step 5: Use the to-be-booted ciphertext ct to calculate the vector cmpans; each element in cmpans represents whether the to-be-booted ciphertext ct belongs to the small interval corresponding to the element; Enc pk (μ) represents the ciphertext obtained by encrypting the plaintext μ with the public key pk in the residue system:

[0031] Step 5.1: Calculate the interpolation interval start point vector

[0032] begin = (Enc pk (x 1,0 ), Enc pk (x 2,0 ), …, Enc pk (x K,0 ))

[0033] and the interpolation interval end point vector

[0034] end = (Enc pk (x 1,polyn ), Enc pk (x 2,polyn ), …, Enc pk (x K,polyn ))

[0035] Step 5.2: The calculation of the combination number, select 2n'+1 polynomial odd function

[0036]

[0037] Where

[0038] Select g(-x) = -g(x) and x∈(0, δ] satisfy x < g(x) ≤ 1 and The polynomial g n′ (x) as a fast approximation calculation polynomial;

[0039] Select d satisfy f As the composite degree of function f n′ (x);

[0040] Select d satisfy g As the composite degree of function g n′ (x);

[0041] The composite function f[g(x)] is denoted as Approximate fitting sign function by d g times g n′ (x) and d f times f n′ (x) composite operation:

[0042]

[0043] The upper limit of the calculation error of the comparison function compare(x) is 2 -prec ;

[0044] Step 5.3: Calculate υ = 2 -prec , e = {υ} K ; Calculate begin = begin-e and end = end-e; Calculate The inner product operation is performed on the two vectors: cmpans = lower·upper; The resulting vector cmpans has each element in the interval corresponding to ct tends to Enc pk (1), and in other intervals tends to Enc pk (0); Get the result cmpans;

[0045] Step 6: Substitute ct into K interpolation polynomials L i (x), i = 1, 2, …, K, to get the interpolation result

[0046] L = (L1(ct), L2(ct),..., L K (ct));

[0047] Step 7: Calculate fresh ciphertext:

[0048] For smaller q, select a new modulus Q that satisfies Q >> q, and replace the modulus q with the modulus Q and satisfy

[0049] [<ct, sk>] Q = <ct, sk> (modx N +1);

[0050] Get the vector L = CalPoly(ct) and cmpans = Cmp(ct); Calculate the fresh ciphertext after bootstrap Return the result ct'.

[0051] The three K operations of calculating Cmp(ct), calculating lower in CalPoly(ct) and calculating upper in CalPoly(ct) do not affect each other during calculation, and parallel computing operations can be used to greatly reduce the time consumption of the bootstrap process of the present scheme.

[0052] Advantages

[0053] The present application accelerates the bootstrap process of the approximate calculation of the homomorphic encryption scheme by performing Lagrange interpolation fitting on the modulus function in multiple cells and optimizing the calculation through the remainder system.

[0054] In the prior scheme of the research group, although the efficiency of the bootstrap process is improved by the small interval division method, the time consumption of the modulus multiplication operation and the modulus inverse operation during bootstrap calculation is huge. According to experimental tests, when the operation precision is 8 bits, the time consumption of one modulus operation in the bootstrap process is 3217 milliseconds, and the time consumption of the parallel calculation is 0.098 milliseconds. Moreover, when a higher security parameter is selected, the number of ciphertext bits will increase, and the calculation efficiency of the modulus multiplication operation and the modulus inverse operation on the ciphertext will also decrease. For example, when the security parameter is selected as 16 bits, the time consumption of the modulus operation in the bootstrap process is 0.152 milliseconds, and when the security parameter is selected as 24 bits, the time consumption is 0.173 milliseconds.

[0055] The present application divides a large interval into multiple small intervals, and respectively performs Lagrange interpolation on the modular function in each small interval, so that the polynomial degree is reduced. When using the polynomial composition calculation method to perform efficient approximate calculation on the comparison function, the single comparison function operation time is only 0.47 ms under 8-bit operation precision. Meanwhile, in the calculation process, the remainder system is combined, and the property of fast calculation of modular multiplication and modular inverse in the remainder system is used to realize calculation acceleration. Compared with the approximate calculation homomorphic encryption bootstrap method based on small interval interpolation fitting, the operation efficiency of modular multiplication and modular inverse operation can be effectively improved, and the time consumption of the scheme under high security parameters can be reduced. There are parallel executable tasks in the scheme, and the efficiency of the scheme can be greatly improved through parallel processing. Compared with the original bootstrap method, the scheme realizes the operation of the modular function in the approximate calculation full homomorphic encryption scheme bootstrap process through the small interval interpolation fitting bootstrap method in the remainder system, which greatly improves the operation efficiency of the scheme bootstrap process.

[0056] Additional aspects and advantages of the application will be set forth in part in the description which follows, and in part will become apparent to those skilled in the art upon examination of the following and the description or be learned by practice of the application. DETAILED DESCRIPTION

[0057] The present application uses a small interval interpolation fitting algorithm to realize approximate calculation of modular operation under a homomorphic encryption scheme, and accelerates modular multiplication and modular inverse operation using a remainder system:

[0058] The remainder system is a non-power system. A set of remainder bases needs to be selected, where L is the number of remainders. The number of all different value conditions in the remainder system is called the dynamic range of the remainder system, denoted as For an integer A, calculate a i = A mod p i , where 1≤i≤L, and is expressed as in the remainder system of the remainder base It can be known from the above description that any integer in [0, P-1] can be represented by a unique set of remainder bases {p L-1 , p L}.

[0059] In the ciphertext operation process, the value range of the privacy data x is [a, b], a and b are real numbers. n and m' are positive integers, representing the number of small intervals n after division and the number of selected interpolation points m'+1 in each small interval. n small intervals [x 1,0 , x 1,m′ ], [x 2,0 , x 2,m′ ], …, [x n,0 , x n,m′ ] can be cut from the interval [a, b], where a≤x1,0 < x 1,m′ < … < x n,0 < x n,m′ ≤ b. Only the polynomials with lower degree are used in the small cell to interpolate and fit the curve with high precision, thus reducing the amount of calculation in the bootstrap process.

[0060] However, using small cell interpolation will introduce the problem of being unable to determine which cell the ciphertext belongs to. Unlike plaintext calculation, interval selection cannot be performed through branch judgment statements in the homomorphic operation process. To solve this problem, a comparison function Cmp(ct) is introduced, the input ct of which is ciphertext, and the return length n of the result vector cmpans is composed of one ciphertext value of about 1 and n-1 ciphertext values of about 0, the ciphertext value of about 1 represents that ct belongs to the corresponding index cell, and the ciphertext value of about 0 represents that ct does not belong to the corresponding index cell. The ciphertext ct is brought into the fitting function corresponding to the n small cells to obtain n function approximation values y i i = 1, 2, …, n, and calculate y' is the new ciphertext after bootstrap.

[0061] The specific method steps are as follows:

[0062] Step 1: initialization

[0063] Generally, the parameters that need to be set include the security parameter λ of the homomorphic encryption scheme, the integer base q, the operation layer number L of the hierarchical encryption scheme, and the operation precision bit number prec, q, λ and prec are all positive integers.

[0064] According to the integer base q, k prime numbers p i are selected, and where 0≤i<k, k is a positive integer p i does not need to be close to q, but needs to satisfy that P is large enough to reduce the noise in the key exchange process.

[0065] According to the integer base q, L moduli q j are selected, and satisfy q j / q∈(1-2 -η ,1+2 -η ), where 1≤j≤L.

[0066] Select q0 greater than the encryption ciphertext modulus q to ensure correct decryption.

[0067] According to the security parameter λ, select the slot number N of the approximate calculation homomorphic encryption scheme, which satisfies that N is an integer power of 2.

[0068] According to N and the Euler function N = φ(M), select an integer power of 2 M.

[0069] select a random distribution χ on R key generate a private key, select a random distribution χ enc generate an encryption key, select a random distribution χ err generate a noise.

[0070] Let pk, sk and evk denote the public key, the private key and the homomorphic key respectively, and let Enc pk (m) denote the corresponding ciphertext form.

[0071] O(λ) is the big O notation, which represents a function less than or equal to λ in the asymptotic sense. K = O(λ) interpolation intervals are selected.

[0072] The real number prec is the operation precision of the approximate computation homomorphic encryption scheme, that is, the operation error of the scheme needs to be less than 2 -prec .

[0073] polyn is the fitting polynomial degree of the modulus function in the scheme.

[0074] Select an integer h and a real number σ > 0, uniformly distributed Generate a vector {±1} of length N with a Hamming weight of h N .

[0075] Select a discrete Gaussian distribution with variance σ 2 .

[0076] It is stipulated that for a given probability ρ, the distribution takes +1 or -1 with a probability of and 0 with a probability of 1-ρ, where 0≤ρ≤1.

[0077] ζ is a real number in the interval (0,1), and q is the modulus, and the smallest ζ that satisfies |[<ct,sk>] q |≤ζ·q.

[0078] Set the normalization vector in the bootstrap process

[0079] In this embodiment, the initialization includes:

[0080] The security parameter of the approximate computation homomorphic encryption scheme is represented by a positive integer λ, and λ = 128 is taken to ensure that the encryption scheme can effectively protect the security of encrypted data in engineering applications.

[0081] The positive integer N is the slot number of the encryption scheme, that is, the scheme can perform N data operations at a time, and logN = 16 is taken.

[0082] The real number prec is the precision of the encryption scheme, that is, the calculation error of the scheme needs to be less than 2-prec , take prec = 16.

[0083] Positive integer K is the number of intervals after partition, take K = 100.

[0084] Positive integer Tn is the number of computer available threads, take Tn = 300.

[0085] Positive integer q represents the integer base of ciphertext, take logq = 55.

[0086] Positive integer Q represents the dynamic range of the residue system, take logQ = 886.

[0087] Positive real number 2ε is the length of the interval after partition, take ε = 0.1 to represent the length of the interval after partition is 0.2.

[0088] Step 2: Residue system representation

[0089] Using the public key pk, for plaintext m, Enc pk (m) represents the ciphertext form of plaintext m when encrypted using the public key pk. In the residue system modulo Two ciphertexts Enc pk (157) and Enc pk (35) are taken as examples. 157 can be represented as The corresponding encrypted ciphertext is Similarly, 35 can be represented as The corresponding encrypted ciphertext is

[0090] For homomorphic addition operation Enc pk (157) + Enc pk (35) mod 17 × 23 = Enc pk (192), the operation under the residue system can be represented as

[0091] For homomorphic multiplication operation Enc pk (157) × Enc pk (35) mod 17 × 23 = Enc pk (21), the operation under the residue system can be represented as

[0092] The operation result recovered by Chinese remainder theorem can obtain the correct operation result under decimal system. To simplify the expression, Enc pk (m) is used to represent

[0093] ​​

[0094] Step 3: Selection of fitting function

[0095] Divide the interpolation interval into K interpolation subintervals, respectively [-0.01+kq, 0.01+kq], k = -49, -48, …, 50, the length of each interpolation subinterval is 2ε = 0.02. By

[0096]

[0097] It can be seen that the interpolation polynomial degree polyn needs to satisfy polyn≥3, take the lower bound polyn=3, then polyn+1=4 interpolation points need to be taken.

[0098] Take k = 0, q = 1000 as an example to demonstrate the Lagrange interpolation process: by It can be seen that the interpolation interval is [-0.01, 0.01]. Select two endpoints x0= -0.01 and x3= 0.01 as interpolation points, the function values at the endpoints y0= f(x0)= -0.009999999993420265 and y3= f(x3)= 0.009999999993420265 can be calculated. The remaining polyn-1=2 interpolation points are selected according to the equal interval of y value. The y value change Δy = y3- y0= 0.019999999986840530, then the y values corresponding to the remaining two interpolation points can be calculated as And The remaining two independent variable values can be calculated by the inverse function of the function x1= f -1 (y1)= -0.003333333331383783 and x2= f -1 (y2)= 0.003333333331383783, thus the four interpolation points are determined as:

[0099] (x0,y0) = (-0.01,-0.009999999993420265)

[0100] (x1,y1) = (-0.003333333331383783,-0.0033333333311400884)

[0101] (x2,y2) = (0.003333333331383783,0.0033333333311400884)

[0102] (x3,y3) = (0.01,0.009999999993420265) ​

[0103] Substitute the above four interpolation points into the Lagrange interpolation basis functions We get:

[0104] l0(x) = -562499.9999177533x 3 + 5624.999999177532x 2

[0105] + 6.249999991775334x - 0.062499999917753325

[0106] l1(x) = 1687500.0007402198x 3 - 5624.999999177532x 2

[0107] - 168.750000074022x + 0.5624999999177533

[0108] l2(x) = -1687500.0007402198x 3 - 5624.999999177532x 2

[0109] + 168.75000007402195x + 0.5624999999177533

[0110] l3(x) = 562499.9999177533x 3 + 5624.999999177532x 2

[0111] - 6.249999991775333x - 0.062499999917753325

[0112] The Lagrange interpolation polynomial of degree polyn can be expressed as That is:

[0113] L(x) = -6.579733963008039 x 10 -6 x 3 + 0.9999999999999998x

[0114] - 1.0842021724855044 x 10 -19

[0115] Taking x as values ​​of 0, 0.5, and 1 as examples, the corresponding interpolation results can be calculated using y = L(x) as -1.0842021724855044 × 10⁻⁶. -19 The values ​​0.4999991775332545 and 0.9999934202660368, compared to the true values ​​of 0, 0.5, and 1 of the modular function calculation, have errors of -1.0842021724855044 × 10⁻⁶ respectively. -19 The errors of 0.0000008224667455 and 0.0000065797339632 all meet the accuracy requirements.

[0116] Step 4: Thread allocation

[0117] The comparison function and the interpolation result calculation function together contain 3K = 300 independent computational subtasks, which can be parallelized using 300 threads. K = 100 is used to illustrate the instantiation process of this invention. In actual use, if 3K is greater than the maximum number of threads that can be requested, thread pool technology can be used to dynamically manage and allocate threads.

[0118] Step 5: Comparison function calculation

[0119] Choosing a polynomial function of degree 2n′+1, taking n′=4 as an example, at this time...

[0120]

[0121] The fitting orders of the two functions are d respectively. f =3,d g If = 6, then the comparison function can be expressed as

[0122]

[0123] Let e ​​= 2 z , where z is a positive integer. Generally, we choose... Taking n′=7 as an example, Table 1 below shows the accelerated computation flow of the homomorphic encryption scheme based on the remainder system for polynomial computation when 2n′+1=15: EvalPoly(x,2n′+1,a1,…,a 2n+1 ).

[0124]

[0125] As can be seen, in steps 4, 7, and 10, each calculation is independent, thus allowing for parallel processing of each step. Similarly, steps 5 and 6, and steps 8 and 9, are independent and can also be parallelized.

[0126] In this example, 100 interpolation intervals are selected, and the starting point coordinate vector of the interpolation interval is

[0127] (-49000.01,-48000.01,…,-1000.01,-0.01,999.99,…,48999.99,49999.99), and the ending point coordinate vector of the interpolation interval is

[0128] (-48999.99,-47999.99,…,-999.99,0.01,1000.01,…,49000.01,50000.01).

[0129] Subtract υ=2 -prec ≈0.000016 from each element in the starting point coordinate vector to obtain (-49000.010016,-48000.010016,…,-1000.010016,-0.010016,999.989984,…,48999.989984,49999.989984),

[0130] Add υ to each element in the ending point coordinate vector to obtain (-48999.989984,-47999.989984,…,-999.989984,0.010016,1000.010016,…,49000.010016,50000.010016).

[0131] Encrypt each element in the above two vectors to obtain:

[0132] begin=(Enc pk (-49000.010016),Enc pk (-48000.010016),…,

[0133] Enc pk (-1000.010016),Enc pk (-0.010016),Enc pk (999.989984),

[0134] …,Enc pk (48999.989984),Enc pk (49999.989984)

[0135] end=(Enc pk (-48999.989984),Enc pk -47999.989984),…,

[0136] Encpk (-999.989984), Enc pk (0.010016), Enc pk (1000.010016),

[0137] …, Enc pk (49000.010016), Enc pk (50000.010016))

[0138] The normalized vector is Norm = (49q, 48q,..., 2q, q, 1, q, 2q,..., 49q, 50q). Take the ciphertext Enc pk (1.5) as an example, the corresponding trigonometric functions can be calculated as The input value is For each element in the begin and end vectors, the following operations are performed:

[0139]

[0140] Take the interpolation interval [-0.01, 0.01] corresponding to k = 0 as an example, the following calculations are performed:

[0141] For i ∈ [0, 48], 0 < l i < 1, -1 < r i < 0, we have:

[0142] For i ∈ [50, 99], -1 < l i < 0, 0 < r i < 1, we have:

[0143]

[0144] After the above calculations, we can obtain two vectors lower and upper with equal dimensions, where:

[0145] When i = 49, lower i = Enc pk (1), upper i = Enc pk (1);

[0146] When 0 ≤ i ≤ 48, lower i = Enc pk (1), and when 50 ≤ i ≤ 99, lower i = Enc pk(0) ;

[0147] When 0≤i≤48, upper i = Enc pk (0), when 50≤i≤99, upper i = Enc pk (1) ;

[0148] It can be observed that, except for i = 49, lower and upper comparison results are all Enc pk (1), lower and upper all other subscript same elements are different, which are respectively Enc pk (1) and Enc pk (0).

[0149] The inner product cmpans = lower · upper is calculated. It is observed that the ciphertext result of cmpans at i = 49 is Enc pk (1), and the ciphertext result corresponding to each subscript is Enc pk (0). The result cmpans is returned.

[0150] Step 6: Calculate the interpolation result

[0151] The ciphertext to be bootstrapped Enc pk (1.5) is substituted into the 100 Lagrange interpolation polynomials selected in step 3, such as for the small interval [-0.01, 0.01], the Lagrange interpolation polynomial on the interval is L 49 (x) = -6.579733963008039 × 10 -6 x 3 + 0.9999999999999998x - 1.0842021724855044 × 10 -19 , then L 49 (Enc pk (1.5)) = Enc pk (1.4999777933978744) can be calculated. The interpolation result vector L = {L i (x)}, i = 0, 1, …, 99 is obtained. The result L is returned.

[0152] Step 7: Calculate fresh ciphertext

[0153] For smaller modulus q, select a new modulus Q that satisfies Q >> q and [<ct, sk>] Q = <ct, sk> (mod x N + 1), and replace modulus q with modulus Q.

[0154] The fresh ciphertext after bootstrapping is calculated Return result ct'.

[0155] The above process demonstrates that in the remainder system with parameters of lambda = 128, logN = 16, prec = 16, K = 100, Tn = 300, and ct = Enc pk The bootstrap process of the modulo function calculation on the small interval using the Lagrange interpolation method in the remainder system with parameters of (1.5) is demonstrated. The present application divides the large interpolation interval into multiple small interpolation intervals, and uses the Lagrange interpolation method to interpolate the modulo function on each small interval, and combines the remainder system to accelerate the modulo multiplication and the modular inverse operation in the calculation process. As can be seen from the embodiments, when the security parameter lambda = 128 and the calculation precision prec = 16, the highest degree of the Lagrange interpolation polynomial is only 3, and the calculation complexity is obviously reduced. In view of the problem that the homomorphic calculation cannot realize the logical jump and cannot judge the small interval to which the data to be bootstrapped belongs, the present application uses the comparison function to compare the data to be bootstrapped with the endpoints of each small interval, and calculates the weight data corresponding to each small interval, and finally realizes the function of judging the interval to which the data to be bootstrapped belongs.

[0156] Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and cannot be understood as limiting the present application, and those skilled in the art can make changes, modifications, replacements and variations to the above embodiments without departing from the principles and purposes of the present application within the scope of the present application.

Claims

1. An inter-cell interpolation fitting bootstrap method based on a residue system, characterized in that: The method comprises the following steps: Step 1: initialization: Setting parameters include: security parameter λ of homomorphic encryption scheme, integer base q, operation precision bit number prec, λ, q and prec are all positive integers; Selecting k prime numbers p according to integer base q i and calculating where 0≤i<k, k is a positive integer; According to the security parameter λ, the number of slots N of the approximate calculation homomorphic encryption scheme is selected, which satisfies that N is an integer power of 2; Step 2: According to the k prime numbers p initialized in step 1 i , a residue system with modulus base is established, and the plaintext and ciphertext are represented based on the residue system, and the specific process is as follows: For a residue system with modulus the plaintext m is represented as The k elements are respectively encrypted to obtain ciphertexts in a residue system For plaintexts m1and m2, the ciphertext representations under the public key pk and modulus base are and Enc pk (m1) and the addition operation result of Enc pk (m2) Enc pk (m1)+Enc pk (m2) = (Enc pk (m1+m2 mod p0), Enc pk (m1) and the multiplication result of Enc pk (m2) Enc pk (m1)×Enc pk (m2)=(Enc pk (m1×m2 mod p0), The addition and multiplication operations in the remainder system are the addition and multiplication operations on the corresponding modulus. The homomorphic addition and homomorphic multiplication between two ciphertexts in the remainder system are simply denoted as Enc pk (m1) + Enc pk (m2) and Enc pk (m1) x Enc pk (m2). Step 3: equal-length range of the value of the privacy data to be self-booted into K small intervals; for each small interval, use Lagrange interpolation polynomial to approximate fitting, get K Lagrange interpolation polynomials L i (x), i = 1, 2, …, K, and the K interpolation polynomials are combined to constitute the approximate fitting of the sine function ​ The specific process of using the Lagrange interpolation polynomial to approximately fit each cell interval is as follows: The largest m' value satisfying is selected as the degree polyn of the Lagrange interpolation polynomial; for the interval range [x i,0 ,x i,polyn ], 1≤i≤K, the number of interpolation points to be selected in each small interval is polyn+1, and the interpolation point x value is represented as x i,0 ,x i,1 ,…,x i,polyn-1 ,x i,polyn ; the left and right endpoints of the small interval are selected as the interpolation points, and the function values corresponding to the left and right endpoints are calculated and where the sine function y=f(x) is The remaining polyn-1 interpolation points are selected according to equal intervals of y values; the interval between two adjacent y values is Then the remaining polyn-1 y values are respectively The x value corresponding to the y value is calculated by the inverse function x = f -1 (y) of y = f(x) i,j -1 (y xi,j ), j = 1, 2, …, polyn-1;​ The above selected polyn+1 interpolation points Substitute the Lagrange interpolation formula The approximation fitting result to the sine function is calculated L(x) = c0+ c1x + c2x2 2 +…+c m′ x m′ Step 4: The maximum number of threads for the application is Tn; if Tn≥ 3K, then assign 2K threads to Step 5 and K threads to Step 6, otherwise assign threads to Step 5 and threads to Step 6; Step 5: Compute vector cmpans using the to-be-booted ciphertext ct; each element in cmpans represents whether the to-be-booted ciphertext ct belongs to the cell interval corresponding to the element; Enc pk (μ) represents the ciphertext obtained by encrypting plaintext μ using public key pk in a remainder system: Step 5.1: calculating an interpolation interval start point vector begin = (Enc pk (x 1,0 ), Enc pk (x 2,0 ), …, Enc pk (x K,0 )) And an interpolation interval end point vector end = (Enc pk (x 1,polyn ), Enc pk (x 2,polyn ), …, Enc pk (x K,polyn )) ; Step 5.2: Representation of the calculation of the number of combinations, selection of 2n'+1 polynomial odd functions wherein a polynomial g satisfying g(-x) = -g(x) and a polynomial g satisfying x < g(x) < 1 for x ∈ (0, δ] and g([δ, 1]) ∈ [1 - τ, 1] n′ (x) as a fast approximation computation polynomial; selecting a d that satisfies f the composite order of the function f n′ (x). selecting a d that satisfies g the composite order of the function g n′ (x). The composite function f[g(x)] is denoted as By d g Subg n′ (x) and d f Subf n′ (x) composite operation approximate fitting sign function: The upper bound of the calculation error of the comparison function compare(x) is 2 -prec ; Step 5.3: Compute u = 2 -prec , e = {u} K ; Compute begin = begin - e and end = end - e; Compute where positive real number 2e is the length of the interval between the two partitions; cmpans = lower · upper; The resulting vector cmpans has each element approaching Enc pk (1) on the interval corresponding to ct, and approaching Enc pk (0) on other intervals; Obtain the result cmpans; Step 6: Substitute ct into K interpolation polynomials L i (x), i = 1, 2, …, K, to get the interpolation result L = (L1(ct), L2(ct),..., L K (ct)); Step 7: calculating fresh ciphertexts: For a relatively small module q, a new module Q satisfying Q >> q is selected, and the module q is replaced with the module Q, and Q satisfies [<ct,sk>] Q = <ct,sk> (mod x N +1); wherein sk denotes a private key, and the fresh ciphertext after bootstrapping is calculated 2. The method of claim 1, wherein the method is based on a residue system. In step 3, K = O(λ).

Images