Homomorphic ciphertext processing method and device, electronic equipment and storage medium

Abstract

The present disclosure relates to a homomorphic ciphertext processing method and device, electronic equipment and a storage medium. The method comprises: obtaining homomorphic ciphertext to be processed sent by a terminal and a processing instruction for the homomorphic ciphertext; determining a composite polynomial function approximated by a step function indicated by the processing instruction; performing homomorphic calculation on the homomorphic ciphertext by using the composite polynomial function to obtain a ciphertext processing result, and sending the ciphertext processing result to the terminal. According to the present disclosure, the calculation efficiency and calculation accuracy of performing homomorphic calculation on encrypted user data can be effectively improved.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a homomorphic ciphertext processing method, apparatus, electronic device, and storage medium. Background Technology

[0002] In cryptography, homomorphic encryption is a special type of encryption that allows computation on ciphertext data without decryption. The result is equivalent to the result of computation on the plaintext data followed by homomorphic encryption. Based on homomorphic encryption, terminals can encrypt user privacy data before sending it to a cloud server for ciphertext processing without revealing the user's private information. Due to this characteristic, homomorphic encryption has numerous applications in privacy-preserving computing fields such as financial services and big data healthcare.

[0003] The step function, also known as a piecewise constant function, is a fundamental function in cryptography. Performing homomorphic computations on ciphertext data using step functions is a key technical challenge in various application scenarios. For homomorphic encryption that supports approximate computation, the homomorphic computation problem of step functions can be solved through polynomial approximation. However, current techniques using polynomial approximation of step functions for homomorphic computation suffer from low computational efficiency and accuracy. Summary of the Invention

[0004] In view of this, this disclosure proposes a homomorphic ciphertext processing method, apparatus, electronic device and storage medium, which can improve the computational efficiency and accuracy of performing homomorphic computation on encrypted user data.

[0005] According to one aspect of this disclosure, a homomorphic ciphertext processing method is provided, the method being applied to a server, comprising: acquiring a homomorphic ciphertext to be processed sent by a terminal and a processing instruction for the homomorphic ciphertext, the homomorphic ciphertext including the encryption result of user data by the terminal, the processing instruction indicating a step function required to process the homomorphic ciphertext, the step function having a value range including multiple different initial sub-intervals, the step function having the same function value in the same initial sub-interval; determining a composite polynomial function approximating the step function indicated by the processing instruction, the composite polynomial function including multiple first approximation polynomials and second approximation polynomials, the multiple first approximation polynomials being used to iteratively map each initial sub-interval corresponding to the step function to a target sub-interval near the midpoint of each initial sub-interval, the range of each target sub-interval being smaller than the range of each initial sub-interval, the second approximation polynomials being used to map each target sub-interval to the function value of the step function corresponding to each initial sub-interval; performing homomorphic computation on the homomorphic ciphertext using the composite polynomial function to obtain a ciphertext processing result, and sending the ciphertext processing result to the terminal.

[0006] In one possible implementation, the range of values ​​for the step function includes N initial sub-intervals, and the composite polynomial function includes K first approximation polynomials, where N and K are positive integers. The determination of the composite polynomial function that approximates the step function indicated by the processing instruction includes: for the k-th first approximation polynomial among the K first approximation polynomials, constructing a k-th first initial polynomial with coefficient values ​​to be determined based on the polynomial degree set for the k-th first approximation polynomial, where 1 ≤ k ≤ K; determining N unmapped intervals corresponding to the k-th first initial polynomial based on the N initial sub-intervals corresponding to the step function, and selecting multiple reference points from each of the N unmapped intervals corresponding to the k-th first initial polynomial. The first reference point set is used; based on the first reference point set, the preset first polynomial coefficient threshold, and the standardized step function corresponding to the step function, the coefficient values ​​of the coefficients in the k-th first initial polynomial are determined, wherein the maximum coefficient value of the coefficients in the k-th first initial polynomial is less than or equal to the first polynomial coefficient threshold, the value range of the standardized step function is the same as that of the step function, and the function value of the standardized step function in the 1st sub-interval is the left boundary point of the value range, the function value in the Nth sub-interval is the right boundary point of the value range, and the function value in the i-th sub-interval is the midpoint of the i-th sub-interval, 1 < i < N; the k-th first initial polynomial with determined coefficient values ​​is used as the k-th first approximation polynomial.

[0007] In one possible implementation, determining the N unmapped intervals corresponding to the k-th first initial polynomial based on the N initial sub-intervals corresponding to the step function includes: when k = 1, determining the N unmapped intervals corresponding to the first first initial polynomial according to the N initial sub-intervals and a preset input precision, wherein the input precision characterizes the input precision of the composite polynomial function; when k ≥ k > 1, inputting the N unmapped intervals corresponding to the (k-1)-th first initial polynomial to the (k-1)-th first approximation polynomial to obtain the N mapped intervals output by the (k-1)-th first approximation polynomial, and determining the N unmapped intervals corresponding to the k-th first initial polynomial according to the midpoints of the N initial sub-intervals and the interval radii of the N mapped intervals.

[0008] In one possible implementation, determining the coefficient values ​​of the coefficients in the k-th first initial polynomial based on the first set of reference points, a preset first polynomial coefficient threshold, and the standardized step function corresponding to the step function includes: constructing a first linear programming equation set between the k-th first initial polynomial and the standardized step function, wherein the first linear programming equation set is used to constrain that the absolute value of the deviation between the k-th first initial polynomial and the standardized step function is less than or equal to the product of the first compression ratio parameter and the interval radius of each interval to be mapped, and to constrain that the maximum coefficient in the k-th first initial polynomial is less than or equal to the first polynomial coefficient threshold; with the goal of minimizing the first compression ratio parameter, substituting each reference point in the first set of reference points into the first linear programming equation set, and solving the first linear programming equation set after substituting each reference point to obtain the coefficient values ​​of the coefficients in the k-th first initial polynomial and the first compression ratio parameter value of the first compression ratio parameter.

[0009] In one possible implementation, using the k-th first initial polynomial with determined coefficient values ​​as the k-th first approximation polynomial includes: detecting whether there are extreme points and boundary points in the N intervals to be mapped that satisfy a first specified condition, wherein the first specified condition includes: the absolute value of the deviation between the k-th first initial polynomial with determined coefficient values ​​and the standardized step function is greater than the product of the first compression ratio parameter value and the interval radius of the interval to be mapped; if there are no extreme points and boundary points in the N intervals to be mapped that satisfy the first specified condition, then using the k-th first initial polynomial with determined coefficient values ​​as the k-th first approximation polynomial. The kth first initial polynomial is used as the kth first approximating polynomial; or, if there are extreme points and boundary points that satisfy the first specified condition in the N intervals to be mapped, the extreme points and boundary points that satisfy the first specified condition are added to the first reference point set to obtain the second reference point set; according to the second reference point set, the first polynomial coefficient threshold and the standardized step function, the coefficient values ​​of the coefficients in the kth first initial polynomial are re-determined, and the kth first initial polynomial with re-determined coefficient values ​​is used as the kth first approximating polynomial.

[0010] In one possible implementation, the step of redetermining the coefficient values ​​of the coefficients in the k-th first initial polynomial based on the second reference point set, the first polynomial coefficient threshold, and the standardized step function, and using the k-th first initial polynomial with redetermined coefficient values ​​as the k-th first approximating polynomial, includes: determining the maximum compression ratio among the actual interval compression ratios corresponding to each interval to be mapped based on the second reference point set, the k-th first initial polynomial with determined coefficient values, the standardized step function, and the interval radius of each interval to be mapped corresponding to the k-th first initial polynomial; if the weighted value of the first compression ratio parameter value is greater than the maximum compression ratio, redetermining the coefficient values ​​of the coefficients in the k-th first initial polynomial based on the second reference point set, the first polynomial coefficient threshold, and the standardized step function, and using the k-th first initial polynomial with redetermined coefficient values ​​as the k-th first approximating polynomial; or, if the weighted value of the first compression ratio parameter value is less than or equal to the maximum compression ratio, using the k-th first initial polynomial with determined coefficient values ​​as the k-th first approximating polynomial.

[0011] In one possible implementation, determining the composite polynomial function that approximates the step function indicated by the processing instruction includes: constructing a second initial polynomial with coefficient values ​​to be determined based on the polynomial degree set for the second approximation polynomial; determining N unmapped intervals corresponding to the second initial polynomial based on the midpoints of the N sub-intervals and the interval radii of the N mapped intervals output by the Kth first approximation polynomial among the K first approximation polynomials, and selecting multiple reference points from the N unmapped intervals corresponding to the second initial polynomial to obtain a third reference point set; determining the coefficient values ​​of the coefficients in the second initial polynomial based on the third reference point set, a preset second polynomial coefficient threshold, and the step function, wherein the maximum coefficient value of the coefficients in the second initial polynomial is less than or equal to the second polynomial threshold; and using the second initial polynomial with determined coefficient values ​​as the second approximation polynomial.

[0012] In one possible implementation, determining the coefficient values ​​of the coefficients in the second initial polynomial based on the third reference point set, a preset second polynomial coefficient threshold, and the step function includes: constructing a second linear programming equation set between the second initial polynomial and the step function, wherein the second linear programming equation set is used to constrain that the absolute value of the deviation between the second initial polynomial and the step function is less than or equal to the product of the second compression ratio parameter and the interval radius of each interval to be mapped corresponding to the second initial polynomial, and to constrain that the maximum coefficient in the second initial polynomial is less than or equal to the second polynomial coefficient threshold; with the goal of minimizing the second compression ratio parameter, substituting each reference point in the third reference point set into the second linear programming equation set, and solving the second linear programming equation set after substituting each reference point to obtain the coefficient values ​​of the coefficients in the second initial polynomial and the second compression ratio parameter value of the second compression ratio parameter.

[0013] In one possible implementation, using the second initial polynomial with determined coefficient values ​​as the second approximating polynomial includes: detecting whether there are extreme points and boundary points satisfying a second specified condition in the N unmapped intervals corresponding to the second initial polynomial, wherein the second specified condition includes: the absolute value of the deviation between the second initial polynomial with determined coefficient values ​​and the step function is greater than the product of the second compression ratio parameter value and the interval radius of the unmapped interval corresponding to the second initial polynomial; if there are no extreme points and boundary points satisfying the second specified condition in the N unmapped intervals corresponding to the second initial polynomial, using the second initial polynomial with determined coefficient values ​​as the second approximating polynomial; or, if there are extreme points and boundary points satisfying the second specified condition in the N unmapped intervals corresponding to the second initial polynomial, adding the extreme points and boundary points satisfying the second specified condition to the third reference point set to obtain a fourth reference point set; and redetermining the coefficient values ​​of the coefficients in the second initial polynomial based on the fourth reference point set, the coefficient threshold of the second polynomial, and the step function, and using the second initial polynomial with redetermined coefficient values ​​as the second approximating polynomial.

[0014] In one possible implementation, the method further includes: determining the output accuracy of the composite polynomial function based on the maximum value of the deviation between the function values ​​of the second approximation polynomial and the step function, and a preset error bound, wherein the error bound is used to control the homomorphic computation accuracy of the composite polynomial function.

[0015] According to another aspect of this disclosure, a homomorphic ciphertext processing apparatus is provided, the apparatus being applied to a server, comprising: an acquisition module, configured to acquire a homomorphic ciphertext to be processed sent by a terminal and a processing instruction for the homomorphic ciphertext, the homomorphic ciphertext including the encryption result of user data by the terminal, the processing instruction indicating a step function required to process the homomorphic ciphertext, the step function having a value range including multiple different initial sub-intervals, the step function having the same function value in the same initial sub-interval; and a determination module, configured to determine a composite polynomial function that approximates the step function indicated by the processing instruction, the composite polynomial function... The polynomial function includes multiple first approximation polynomials and second approximation polynomials. The multiple first approximation polynomials are used to iteratively map each initial subinterval corresponding to the step function to a target subinterval near the midpoint of each initial subinterval. The range of each target subinterval is smaller than the range of each initial subinterval. The second approximation polynomial is used to map each target subinterval to the function value of the step function corresponding to each initial subinterval. The execution module is used to perform homomorphic computation on the homomorphic ciphertext using the composite polynomial function to obtain the ciphertext processing result and send the ciphertext processing result to the terminal.

[0016] In one possible implementation, the range of values ​​for the step function includes N initial sub-intervals, and the composite polynomial function includes K first approximation polynomials, where N and K are positive integers. The determination of the composite polynomial function that approximates the step function indicated by the processing instruction includes: for the k-th first approximation polynomial among the K first approximation polynomials, constructing a k-th first initial polynomial with coefficient values ​​to be determined based on the polynomial degree set for the k-th first approximation polynomial, where 1 ≤ k ≤ K; determining N unmapped intervals corresponding to the k-th first initial polynomial based on the N initial sub-intervals corresponding to the step function, and selecting multiple reference points from each of the N unmapped intervals corresponding to the k-th first initial polynomial. The first reference point set is used; based on the first reference point set, the preset first polynomial coefficient threshold, and the standardized step function corresponding to the step function, the coefficient values ​​of the coefficients in the k-th first initial polynomial are determined, wherein the maximum coefficient value of the coefficients in the k-th first initial polynomial is less than or equal to the first polynomial coefficient threshold, the value range of the standardized step function is the same as that of the step function, and the function value of the standardized step function in the 1st sub-interval is the left boundary point of the value range, the function value in the Nth sub-interval is the right boundary point of the value range, and the function value in the i-th sub-interval is the midpoint of the i-th sub-interval, 1 < i < N; the k-th first initial polynomial with determined coefficient values ​​is used as the k-th first approximation polynomial.

[0017] In one possible implementation, determining the N unmapped intervals corresponding to the k-th first initial polynomial based on the N initial sub-intervals corresponding to the step function includes: when k = 1, determining the N unmapped intervals corresponding to the first first initial polynomial according to the N initial sub-intervals and a preset input precision, wherein the input precision characterizes the input precision of the composite polynomial function; when k ≥ k > 1, inputting the N unmapped intervals corresponding to the (k-1)-th first initial polynomial to the (k-1)-th first approximation polynomial to obtain the N mapped intervals output by the (k-1)-th first approximation polynomial, and determining the N unmapped intervals corresponding to the k-th first initial polynomial according to the midpoints of the N initial sub-intervals and the interval radii of the N mapped intervals.

[0018] In one possible implementation, determining the coefficient values ​​of the coefficients in the k-th first initial polynomial based on the first set of reference points, a preset first polynomial coefficient threshold, and the standardized step function corresponding to the step function includes: constructing a first linear programming equation set between the k-th first initial polynomial and the standardized step function, wherein the first linear programming equation set is used to constrain that the absolute value of the deviation between the k-th first initial polynomial and the standardized step function is less than or equal to the product of the first compression ratio parameter and the interval radius of each interval to be mapped, and to constrain that the maximum coefficient in the k-th first initial polynomial is less than or equal to the first polynomial coefficient threshold; with the goal of minimizing the first compression ratio parameter, substituting each reference point in the first set of reference points into the first linear programming equation set, and solving the first linear programming equation set after substituting each reference point to obtain the coefficient values ​​of the coefficients in the k-th first initial polynomial and the first compression ratio parameter value of the first compression ratio parameter.

[0019] In one possible implementation, using the k-th first initial polynomial with determined coefficient values ​​as the k-th first approximation polynomial includes: detecting whether there are extreme points and boundary points in the N intervals to be mapped that satisfy a first specified condition, wherein the first specified condition includes: the absolute value of the deviation between the k-th first initial polynomial with determined coefficient values ​​and the standardized step function is greater than the product of the first compression ratio parameter value and the interval radius of the interval to be mapped; if there are no extreme points and boundary points in the N intervals to be mapped that satisfy the first specified condition, then using the k-th first initial polynomial with determined coefficient values ​​as the k-th first approximation polynomial. The kth first initial polynomial is used as the kth first approximating polynomial; or, if there are extreme points and boundary points that satisfy the first specified condition in the N intervals to be mapped, the extreme points and boundary points that satisfy the first specified condition are added to the first reference point set to obtain the second reference point set; according to the second reference point set, the first polynomial coefficient threshold and the standardized step function, the coefficient values ​​of the coefficients in the kth first initial polynomial are re-determined, and the kth first initial polynomial with re-determined coefficient values ​​is used as the kth first approximating polynomial.

[0020] In one possible implementation, the step of redetermining the coefficient values ​​of the coefficients in the k-th first initial polynomial based on the second reference point set, the first polynomial coefficient threshold, and the standardized step function, and using the k-th first initial polynomial with redetermined coefficient values ​​as the k-th first approximating polynomial, includes: determining the maximum compression ratio among the actual interval compression ratios corresponding to each interval to be mapped based on the second reference point set, the k-th first initial polynomial with determined coefficient values, the standardized step function, and the interval radius of each interval to be mapped corresponding to the k-th first initial polynomial; if the weighted value of the first compression ratio parameter value is greater than the maximum compression ratio, redetermining the coefficient values ​​of the coefficients in the k-th first initial polynomial based on the second reference point set, the first polynomial coefficient threshold, and the standardized step function, and using the k-th first initial polynomial with redetermined coefficient values ​​as the k-th first approximating polynomial; or, if the weighted value of the first compression ratio parameter value is less than or equal to the maximum compression ratio, using the k-th first initial polynomial with determined coefficient values ​​as the k-th first approximating polynomial.

[0021] In one possible implementation, determining the composite polynomial function that approximates the step function indicated by the processing instruction includes: constructing a second initial polynomial with coefficient values ​​to be determined based on the polynomial degree set for the second approximation polynomial; determining N unmapped intervals corresponding to the second initial polynomial based on the midpoints of the N sub-intervals and the interval radii of the N mapped intervals output by the Kth first approximation polynomial among the K first approximation polynomials, and selecting multiple reference points from the N unmapped intervals corresponding to the second initial polynomial to obtain a third reference point set; determining the coefficient values ​​of the coefficients in the second initial polynomial based on the third reference point set, a preset second polynomial coefficient threshold, and the step function, wherein the maximum coefficient value of the coefficients in the second initial polynomial is less than or equal to the second polynomial threshold; and using the second initial polynomial with determined coefficient values ​​as the second approximation polynomial.

[0022] In one possible implementation, determining the coefficient values ​​of the coefficients in the second initial polynomial based on the third reference point set, a preset second polynomial coefficient threshold, and the step function includes: constructing a second linear programming equation set between the second initial polynomial and the step function, wherein the second linear programming equation set is used to constrain that the absolute value of the deviation between the second initial polynomial and the step function is less than or equal to the product of the second compression ratio parameter and the interval radius of each interval to be mapped corresponding to the second initial polynomial, and to constrain that the maximum coefficient in the second initial polynomial is less than or equal to the second polynomial coefficient threshold; with the goal of minimizing the second compression ratio parameter, substituting each reference point in the third reference point set into the second linear programming equation set, and solving the second linear programming equation set after substituting each reference point to obtain the coefficient values ​​of the coefficients in the second initial polynomial and the second compression ratio parameter value of the second compression ratio parameter.

[0023] In one possible implementation, using the second initial polynomial with determined coefficient values ​​as the second approximating polynomial includes: detecting whether there are extreme points and boundary points satisfying a second specified condition in the N unmapped intervals corresponding to the second initial polynomial, wherein the second specified condition includes: the absolute value of the deviation between the second initial polynomial with determined coefficient values ​​and the step function is greater than the product of the second compression ratio parameter value and the interval radius of the unmapped interval corresponding to the second initial polynomial; if there are no extreme points and boundary points satisfying the second specified condition in the N unmapped intervals corresponding to the second initial polynomial, using the second initial polynomial with determined coefficient values ​​as the second approximating polynomial; or, if there are extreme points and boundary points satisfying the second specified condition in the N unmapped intervals corresponding to the second initial polynomial, adding the extreme points and boundary points satisfying the second specified condition to the third reference point set to obtain a fourth reference point set; and redetermining the coefficient values ​​of the coefficients in the second initial polynomial based on the fourth reference point set, the coefficient threshold of the second polynomial, and the step function, and using the second initial polynomial with redetermined coefficient values ​​as the second approximating polynomial.

[0024] In one possible implementation, the device further includes: an output accuracy determination module, configured to determine the output accuracy of the composite polynomial function based on the maximum value of the deviation between the function values ​​of the second approximation polynomial and the step function, and a preset error bound, wherein the error bound is used to control the homomorphic computation accuracy of the composite polynomial function.

[0025] According to another aspect of this disclosure, an electronic device is provided, comprising: a processor; a memory for storing processor-executable instructions; wherein the processor is configured to implement the above-described method when executing instructions stored in the memory.

[0026] According to another aspect of this disclosure, a non-volatile computer-readable storage medium is provided that stores computer program instructions thereon, wherein the computer program instructions, when executed by a processor, implement the above-described method.

[0027] According to another aspect of this disclosure, a computer program product is provided, including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in a processor of an electronic device, the processor in the electronic device performs the above-described method.

[0028] According to embodiments of this disclosure, by using a composite polynomial function that approximates the step function required for processing homomorphic ciphertext, that is, by using a composite polynomial function composed of multiple first approximation polynomials and second approximation polynomials to perform homomorphic computation on homomorphic ciphertext, the efficiency and accuracy of homomorphic computation on homomorphic ciphertext can be improved, thus meeting the homomorphic computation requirements of various application scenarios.

[0029] Other features and aspects of this disclosure will become clear from the following detailed description of exemplary embodiments with reference to the accompanying drawings. Attached Figure Description

[0030] The accompanying drawings, which are included in and form part of this specification, illustrate exemplary embodiments, features, and aspects of this disclosure together with the specification and serve to explain the principles of this disclosure.

[0031] Figure 1 A schematic diagram illustrating an application scenario according to an embodiment of the present disclosure is shown.

[0032] Figure 2 A flowchart illustrating a homomorphic ciphertext processing method according to an embodiment of the present disclosure is shown.

[0033] Figure 3 A flowchart illustrating a polynomial approximation method according to an embodiment of the present disclosure is shown.

[0034] Figure 4 A flowchart illustrating a polynomial approximation method according to an embodiment of the present disclosure is shown.

[0035] Figure 5 A block diagram of a homomorphic ciphertext processing apparatus according to an embodiment of the present disclosure is shown.

[0036] Figure 6 A block diagram of an electronic device 1900 according to an embodiment of the present disclosure is shown. Detailed Implementation

[0037] Various exemplary embodiments, features, and aspects of this disclosure will now be described in detail with reference to the accompanying drawings. The same reference numerals in the drawings denote elements that have the same or similar functions. Although various aspects of the embodiments are shown in the drawings, they are not necessarily drawn to scale unless specifically indicated otherwise.

[0038] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments.

[0039] Furthermore, to better illustrate this disclosure, numerous specific details are set forth in the following detailed description. Those skilled in the art will understand that this disclosure can be practiced without certain specific details. In some instances, methods, means, components, and circuits well known to those skilled in the art have not been described in detail in order to highlight the main points of this disclosure.

[0040] As mentioned above, based on homomorphic encryption, terminals can encrypt user privacy data before sending it to a cloud server for ciphertext processing without leaking the user's private information. Due to this characteristic, homomorphic encryption has numerous applications in privacy computing fields such as financial services and big data healthcare. Utilizing step functions to perform homomorphic computation on ciphertext data is a key technical issue in various application scenarios. Step functions, also known as piecewise constant functions, are a fundamental class of functions in cryptography and are closely related to modular functions and ReLU functions in machine learning. Examples of step functions include sign functions, floor functions, piecewise smoothing functions, and bucketing functions.

[0041] Specifically, suppose κ(x) is a real function defined on the interval [a,b], where the interval [a,b] is divided into segments a = a0. <a1<…<a I =b, if there exists a real number y i (1≤i≤I) such that

[0042] κ(x)=y i ,x∈(a i-1 ,a i ), 1≤i≤I

[0043] Then the function κ(x) can be called the step function.

[0044] Specifically, if when i = 1, y1 = a, and when i = 1, y I =b and 1<i<I, Such a κ(x) is called a standardized step function (also known as a normalized step function). If It is a standardized step function, and It has the same interval partition as κ(x) a=a0 <a1<…<a I =b, then it is called It is the standardized step function of κ(x).

[0045] It is known that for homomorphic encryption supporting approximate computation, the homomorphic computation problem of the step function can be solved by polynomial approximation. This involves first providing a polynomial approximation of the step function, then using this approximation to perform homomorphic computation on the ciphertext data, thus obtaining an approximate result for the homomorphic computation of the step function. By controlling the precision of the polynomial approximation and the computational precision of the homomorphic encryption, high-precision homomorphic computation of the step function can be achieved. Therefore, the key to the homomorphic computation problem of the step function lies in obtaining a polynomial approximation that can meet the computational precision requirements while also possessing high homomorphic computation efficiency. However, the existing methods using polynomial approximation have low homomorphic computation efficiency and precision, failing to meet the homomorphic computation needs of various application scenarios.

[0046] In view of this, the present disclosure provides a homomorphic ciphertext processing method that utilizes a composite polynomial function that approximates the step function required for processing homomorphic ciphertext, that is, a composite polynomial function composed of multiple first approximation polynomials and second approximation polynomials to perform homomorphic computation on homomorphic ciphertext. This method can improve the efficiency and accuracy of homomorphic computation on homomorphic ciphertext and meet the homomorphic computation requirements of various application scenarios.

[0047] Figure 1 The diagram illustrates an application scenario of an embodiment of this disclosure, such as... Figure 1 As shown, when a terminal needs the server's assistance in processing user data (e.g., in a financial scenario, user asset data needs to be statistically sorted; in a medical scenario, user medical case data needs to be screened and analyzed), and also needs to ensure user data security, the terminal can encrypt the user data to obtain homomorphic ciphertext, and send the homomorphic ciphertext and processing instructions for it to the server. The server then performs homomorphic computation on the homomorphic ciphertext based on the processing instructions and returns the result to the terminal. The processing instructions can be instructions sent by the terminal to the server based on its own business logic's computational needs for the homomorphic ciphertext. These instructions can instruct the server on which step function to use to process the homomorphic ciphertext. In this scenario, due to the homomorphic addition... Due to the ciphertext's dense nature, servers cannot directly process homomorphic ciphertext using the step function. Therefore, homomorphic ciphertext can be processed by calculating a polynomial approximation of the step function. However, the polynomial approximation function obtained by existing polynomial approximation methods has low computational efficiency and accuracy when performing homomorphic computation. Therefore, servers can adopt the homomorphic encryption method of this disclosure to improve the computational efficiency and accuracy of homomorphic computation. That is, the technical problem to be solved and the technical effect produced by this disclosure are closely integrated with specific application scenarios. It can solve the problems of low homomorphic computation efficiency and low homomorphic computation accuracy of homomorphic ciphertext in various homomorphic encryption scenarios, and can improve the computational efficiency and accuracy of homomorphic computation of homomorphic ciphertext in homomorphic encryption scenarios.

[0048] The homomorphic ciphertext processing method of this disclosure can be deployed on a server, which can be located in the cloud or locally, and can be a physical device or a virtual device, such as a virtual machine or container, with wireless communication capabilities. These wireless communication capabilities can be configured in the server's chip (system) or other components. The server can be a device with wireless connectivity, meaning it can connect to other servers or terminal devices via wireless connections such as Wi-Fi or Bluetooth. The server involved in this disclosure can also have wired communication capabilities. For example, the server involved in this disclosure can be located in the cloud, communicate with terminal devices, receive homomorphic ciphertext sent by the terminal devices and processing instructions for the homomorphic ciphertext, and use the homomorphic ciphertext processing method deployed on the server to perform homomorphic calculations on the homomorphic ciphertext based on the processing instructions, returning the homomorphic calculation result to the terminal device.

[0049] Of course, the homomorphic ciphertext processing method of this disclosure can also be deployed on various terminal devices through software or hardware modifications. The terminal devices involved in this disclosure can refer to devices with wireless connection capabilities, which means that they can connect to other terminal devices through wireless connection methods such as Wi-Fi and Bluetooth. The terminal devices involved in this disclosure can also have wired connection communication capabilities. The terminal devices involved in this disclosure can be touchscreen, non-touchscreen, or screenless. Touchscreen devices can be controlled by clicking or swiping on the display screen with fingers or styluses. Non-touchscreen devices can be connected to input devices such as mice, keyboards, and touch panels to control the terminal device. Screenless devices can be, for example, screenless Bluetooth speakers. For example, the terminal devices of this application can be smartphones, netbooks, tablets, laptops, wearable electronic devices (such as smart bracelets, smartwatches, etc.), TVs, virtual reality devices, speakers, e-ink devices, etc.

[0050] The following is passed Figures 2 to 4 This paper provides a detailed description of the homomorphic ciphertext processing method provided in the embodiments of this disclosure.

[0051] Figure 2 A flowchart illustrating a homomorphic ciphertext processing method according to an embodiment of this disclosure is shown. This method can be executed by the aforementioned server or other terminal devices. Figure 2 As shown, the homomorphic ciphertext processing method includes:

[0052] Step S21: Obtain the homomorphic ciphertext to be processed sent by the terminal and the processing instructions for the homomorphic ciphertext. The homomorphic ciphertext includes the encryption result of the user data by the terminal. The processing instructions are used to indicate the step function required to process the homomorphic ciphertext. The value range of the step function includes multiple different initial sub-intervals. The function value of the step function is the same in the same initial sub-interval.

[0053] It is understood that user data differs in different application scenarios. For example, in a financial scenario, user data may include user asset data, personal privacy data, etc.; in a medical scenario, user data may include patient medical records, personal privacy data, etc. This disclosure does not limit the specific type of user data.

[0054] As described above, when a terminal needs a server to assist in processing user data using a step function, such as in a financial scenario where user asset data needs to be statistically sorted, or in a medical scenario where user medical case data needs to be screened and analyzed, while ensuring the security of user data, the terminal can encrypt the user data to obtain homomorphic ciphertext and send the homomorphic ciphertext and corresponding processing instructions to the server. The terminal can use data encryption methods known in the art to encrypt the user data, and this disclosure embodiment does not limit this.

[0055] It should be understood that different application scenarios have different business logic requirements, and different business requirements have different processing requirements for user data, that is, different step functions are required to process homomorphic ciphertext. Therefore, the terminal can send the corresponding processing instructions to the server based on its own business logic processing requirements for homomorphic ciphertext. The processing instructions can instruct the server to use which step function to process the homomorphic ciphertext.

[0056] The range of values ​​for the step function can be represented as [a, b], which represents the maximum range of values ​​for the step function. The range includes multiple initial sub-intervals; that is, the range [a, b] can be segmented into a = a0. <a1<…<a I =b, which means it can be divided into multiple initial subintervals [a0,a1], ..., [a i-1 ,a i ]、…、[a I-1 ,a I As mentioned above, the step function can be expressed as κ(x) = y. i ,x∈(a i-1 ,a i ), 1≤i≤I, which means that the step function κ(x) is in the same initial subinterval (a i-1 ,a i The function value y iThe same. It should be understood that the embodiments of this disclosure do not limit the range of the value interval or the number of initial sub-intervals within the value interval.

[0057] Step S22: Determine the composite polynomial function that approximates the step function indicated by the processing instruction. The composite polynomial function includes multiple first approximation polynomials and second approximation polynomials. The multiple first approximation polynomials are used to iteratively map each initial subinterval corresponding to the step function to a target subinterval near the midpoint of each initial subinterval. The range of each target subinterval is smaller than the range of each initial subinterval. The second approximation polynomial is used to map each target subinterval to the function value of the step function corresponding to each initial subinterval.

[0058] Here, we assume that the composite polynomial function is expressed as This composite polynomial constitutes an approximation of the step function κ(x), where f1,…,f K This represents K first approximation polynomials, which can approximate the initial subintervals (a, b, c) of the step function. i-1 ,a i Iteratively map to the midpoint of each initial subinterval The nearby target subinterval, that is, the interval values ​​of the initial subinterval mapped to the standardized step function of κ(x). The approximation is denoted by g, which represents the second approximation polynomial. This second approximation polynomial maps the target subinterval (including the midpoint of the initial subinterval) to the function value of the step function κ(x), i.e., ... The approximation mapped to κ(x).

[0059] It should be understood that those skilled in the art can set the number K of the first approximating polynomials included in the composite polynomial function according to actual needs, and this disclosure does not limit this. Among them, multiple first approximating polynomials f1,…,f K The initial subinterval (a) of the step function i-1 ,a i Iteratively map to the midpoint of the initial subinterval The nearby target sub-interval can be represented as:

[0060]

[0061] Where ε represents the input precision of the composite polynomial function, which can be customized according to actual needs, for example, it can be set to 2. -7 2 -10 2 -20 Wait, z i t represents the midpoint of the initial subinterval. iK t can represent the radius of the target subinterval of the final output of the Kth first approximation polynomial. i1 ti2 …、t i(k-1) It can represent the radius of the interval after mapping the output of the first K-1 approximation polynomial iterations.

[0062] Among them, the second approximation polynomial g will target the subinterval [z] i -t iK ,z i +t iK The function value y mapped to the step function i , can be represented as: Among them, 2 -α The output precision represents the composite polynomial function. This output precision can be the same as or different from the input precision ε. It should be understood that this output precision and the input precision characterize the error between the composite polynomial function and the step function. The smaller the output precision and the input precision, the smaller the error between the composite polynomial function and the step function, meaning a higher degree of approximation between the composite polynomial function and the step function. This results in higher computational precision when performing homomorphic computation using the composite polynomial. Furthermore, the composite polynomial function, composed of multiple first and second approximation polynomials, has higher computational efficiency when performing homomorphic computation on homomorphic ciphertext.

[0063] In practical applications, the server can pre-determine various composite polynomial functions that can be approximated by known step functions, forming a function library. Upon receiving a processing instruction from the terminal, the server can directly call the composite polynomial function corresponding to the step function indicated by the processing instruction from this function library. Alternatively, the processing instruction can also specify the range, structure, coefficients, and other function information of a custom step function. The server can then instantly determine the composite polynomial function corresponding to the custom step function based on this information. This embodiment of the present disclosure does not impose any limitations on this approach.

[0064] Step S23: Perform homomorphic computation on the homomorphic ciphertext using a composite polynomial function to obtain the ciphertext processing result, and send the ciphertext processing result to the terminal.

[0065] Wherein, the composite polynomial function is expressed as follows: Homomorphic ciphertext can be represented as x. Homomorphic computation is performed on the homomorphic ciphertext using a composite polynomial function to obtain the ciphertext processing result. For example, this could involve: inputting the homomorphic ciphertext x into the first approximation polynomial f1 to obtain the output f1(x); then inputting the output f1(x) into the second first approximation polynomial f2 to obtain the output f2(x), and so on, until the (K-1)th first approximation polynomial f1 is input into the first approximation polynomial f2. K-1 The output result f K-1 (x) Input to the Kth first approximation polynomial fK , to obtain f K The output result f K (x), then the f K The output result f K (x) is input into the second approximation polynomial g, and the output result g(x) of g is obtained. The output result g(x) of the second approximation polynomial g is also the processing result of the homomorphic ciphertext.

[0066] It should be understood that the result of homomorphic computation on homomorphic ciphertext using a composite polynomial function is equivalent to the encrypted result obtained by encrypting the plaintext computation result obtained by using a step function on user data.

[0067] According to embodiments of this disclosure, by using a composite polynomial function that approximates the step function required for processing homomorphic ciphertext, that is, by using a composite polynomial function composed of multiple first approximation polynomials and second approximation polynomials to perform homomorphic computation on homomorphic ciphertext, the efficiency and accuracy of homomorphic computation on homomorphic ciphertext can be improved, thus meeting the homomorphic computation requirements of various application scenarios.

[0068] It is known that there are currently two related techniques for polynomial approximation of step functions. One technique is the approximation technique for piecewise smooth functions. This technique can provide polynomials that approximate any piecewise smooth function with singularities to any degree. However, the polynomials obtained by this technique have high degrees, resulting in low efficiency in homomorphic computation. Furthermore, due to the existence of discontinuities in step functions, existing approximation algorithms for piecewise smooth functions are not applicable to the approximation problem of step functions. The other technique is the polynomial approximation technique for sign functions. Sign functions are a special type of step function with only one discontinuity. Many mature solutions exist for polynomial approximation of sign functions. However, since step functions generally have multiple discontinuities, these methods cannot be directly used to solve the polynomial approximation of general step functions. Therefore, existing techniques cannot yet handle the polynomial approximation of general step functions.

[0069] In view of this, embodiments of this disclosure also provide a polynomial approximation method for step functions. This method employs the composite polynomial approach commonly used in approximation problems to construct a sequence of polynomials such that the composite polynomial is precisely the approximation function of the step function. The polynomial approximation method provided by embodiments of this disclosure can determine the specific construction that conforms to polynomial approximation for any step function, that is, it can determine the composite polynomial approximation for any step function. The polynomial approximation method provided by embodiments of this disclosure can guarantee that the construction of the composite polynomial achieves optimal approximation efficiency, that is, optimal computational efficiency when performing homomorphic calculations using the composite polynomial. Furthermore, it can flexibly control the upper bound of the coefficients of the constructed composite polynomial, making it applicable to homomorphic calculation tasks of different precisions.

[0070] Assume the step function takes values ​​over N initial subintervals, and the composite polynomial function contains K first approximation polynomials, where N and K are positive integers. Figure 3 A flowchart illustrating a polynomial approximation method according to an embodiment of the present disclosure is shown. Figure 3 The polynomial approximation method shown can be used to determine multiple first approximating polynomials in the composite polynomial function corresponding to any step function, such as... Figure 3 As shown, step S22 above, which determines the composite polynomial function that approximates the step function indicated by the processing instruction, may include:

[0071] Step S221: For the kth first approximation polynomial among the K first approximation polynomials, construct the kth first initial polynomial with coefficient values ​​to be determined based on the polynomial degree set for the kth first approximation polynomial, where 1≤k≤K.

[0072] In practical applications, users can set the polynomial degree of each first approximation polynomial according to their actual needs. It should be understood that the polynomial degrees of different first approximation polynomials can be the same or different. After knowing the polynomial degree set by the user, at least one base polynomial can be selected from the preset set of base polynomials to construct a first initial polynomial that matches the polynomial degree. Here, the base polynomial can be understood as the fundamental terms that constitute the initial polynomial.

[0073] It should be understood that those skilled in the art can design the number and types of basis polynomials included in the basis polynomial set according to actual needs. For example, the basis polynomial set may include, but is not limited to, "d+ex", "hx", etc. 2 “mx” 3 The basic polynomials are defined as follows: where d, e, h, and m represent coefficients whose values ​​are to be determined. This embodiment of the disclosure does not limit the number or type of basic polynomials in the set of basic polynomials. For example, assuming the polynomial degree for the first approximation polynomial is 2, then "d+ex" and "hx" can be selected from the aforementioned set of basic polynomials. 2 ", construct d+ex+hx 2 As the first initial polynomial.

[0074] Step S222: Based on the N initial sub-intervals corresponding to the step function, determine the N unmapped intervals corresponding to the kth first initial polynomial, and select multiple reference points from the N unmapped intervals corresponding to the kth first initial polynomial to obtain the first reference point set.

[0075] In one possible implementation, based on the N initial sub-intervals corresponding to the step function, the N intervals to be mapped corresponding to the k-th first initial polynomial are determined, including:

[0076] When k=1, based on the N initial sub-intervals and the preset input precision, the N intervals to be mapped corresponding to the first initial polynomial are determined. The input precision characterizes the input precision of the composite polynomial function.

[0077] When K≥k>1, the N unmapped intervals corresponding to the (k-1)th first initial polynomial are input into the (k-1)th first approximation polynomial to obtain the N mapped intervals output by the (k-1)th first approximation polynomial. Based on the midpoints of the N initial sub-intervals and the interval radii of the N mapped intervals, the N unmapped intervals corresponding to the kth first initial polynomial are determined.

[0078] For example, assuming N is 3, that is, the step function has 3 initial sub-intervals, represented as [a0,a1], [a1,a2], and [a2,a3], and the input precision is represented as ε, then the N unmapped intervals corresponding to the first initial polynomial can be represented as [a0+ε,a1-ε], [a1+ε,a2-ε], and [a2+ε,a3-ε]. That is, the input precision can be added to the left endpoint of each initial sub-interval, and the input precision can be subtracted from the right endpoint to obtain the unmapped intervals corresponding to the first initial polynomial.

[0079] It should be understood that after constructing the first initial polynomial, the first approximation polynomial can be obtained through subsequent steps S223 to S224. Then, for the second first initial polynomial, the three unmapped intervals [a0,a1], [a1,a2], and [a2,a3] corresponding to the first initial polynomial can be input into the first approximation polynomial respectively, resulting in three mapped intervals output by the first approximation polynomial. Assume these three mapped intervals are represented as follows: The radius of the three mapped intervals can be calculated based on these three mapped intervals.

[0080] Wherein, the radius of the first mapped interval of the first approximation polynomial output is The radius of the second mapped interval of the first approximation polynomial output is: The radius of the interval after the third mapping of the first approximation polynomial output is: Then, based on the interval radius of the three mapped intervals and the midpoint of each of the three initial sub-intervals, that is, the midpoint of the first initial sub-interval... Midpoint of the second initial subinterval Midpoint of the third initial subinterval Determine the three unmapped intervals corresponding to the second first initial polynomial, that is, determine the three unmapped intervals to be input into the second first initial polynomial;

[0081] Specifically, the midpoints of the three initial subintervals can be added to the radii of the corresponding mapped intervals to obtain the right endpoints of the three unmapped intervals of the second first initial polynomial. Similarly, the midpoints of the three initial subintervals can be subtracted from the radii of the corresponding mapped intervals to obtain the left endpoints of the three unmapped intervals of the second first initial polynomial. For example, the three unmapped intervals corresponding to the second first initial polynomial can be represented as [z1-t]. 12 ,z1+t 12 ]、[z2-t 22 ,z2+t 22 ]、[z2-t 22 ,z2+t 22 It should be understood that after obtaining the three unmapped intervals corresponding to the second initial polynomial, the second first approximation polynomial can be obtained by executing subsequent steps S223 to S224. Then, the three unmapped intervals corresponding to the second first initial polynomial can be input into the second first approximation polynomial to obtain the three mapped intervals output by the second first approximation polynomial. Based on the midpoints of the three initial sub-intervals and the interval radii of the three mapped intervals output by the second first approximation polynomial, the three unmapped intervals corresponding to the third first initial polynomial can be determined. By analogy, the three unmapped intervals corresponding to the kth first initial polynomial in K≥k>1 can be iteratively determined.

[0082] It should be noted that the above example uses three initial sub-intervals to illustrate the method for determining the N unmapped intervals corresponding to the kth initial polynomial. In reality, the number and range of the initial sub-intervals corresponding to the step function can be customized according to actual needs, and this embodiment does not limit this.

[0083] In practical applications, for example, selection methods known in the art, such as random selection, incremental selection, and uniform selection, can be used to select multiple reference points from the N intervals to be mapped corresponding to the k-th first initial polynomial, thereby obtaining a first reference point set. This disclosure does not limit this approach. It should be understood that this disclosure does not limit the selection method or the number of reference points, that is, it does not limit the number of reference points in the first reference point set.

[0084] Step S223: Determine the coefficient values ​​of the coefficients in the k-th first initial polynomial based on the first reference point set, the preset first polynomial coefficient threshold, and the standardized step function corresponding to the step function.

[0085] In this context, the maximum coefficient value of the coefficients in the k-th initial polynomial is less than or equal to the coefficient threshold of the first polynomial. The value interval of the standardized step function is the same as that of the step function, that is, the value interval of the standardized step function is the same as that of the step function, for example, both are [a,b]. Furthermore, the function value y1 of the standardized step function in the first subinterval [a0,a1] is the left boundary point a of the value interval [a,b], and the value y1 in the Nth subinterval [a0,a1] is the left boundary point a of the value interval [a,b]. N-1 ,a N The function value is the right boundary point b of the interval [a, b] and the i-th subinterval [a, b]. i-1 ,a i The function value y i The midpoint of the i-th subinterval 1 < i < N.

[0086] The user sets the specific value of the first polynomial coefficient threshold according to actual needs, and this embodiment of the disclosure does not impose any restrictions on this. By setting the first polynomial coefficient threshold, the upper bound of the coefficients of the generated composite polynomial can be flexibly controlled, making it applicable to homomorphic computation tasks of different precisions.

[0087] In one possible implementation, the coefficient values ​​of the coefficients in the k-th first initial polynomial are determined based on the first reference point set, a preset threshold for the coefficients of the first polynomial, and the standardized step function corresponding to the step function, including:

[0088] Construct a first linear programming equation set between the k-th initial polynomial and the standardized step function. The first linear programming equation set is used to constrain the absolute value of the deviation between the k-th initial polynomial and the standardized step function to be less than or equal to the product between the first compression ratio parameter and the interval radius of each interval to be mapped, and to constrain the maximum coefficient in the k-th initial polynomial to be less than or equal to the first polynomial coefficient threshold.

[0089] With the goal of minimizing the first compression ratio parameter, each reference point in the first reference point set is substituted into the first linear programming equation system, and the first linear programming equation system after substituting each reference point is solved to obtain the coefficient values ​​of the coefficients in the k-th first initial polynomial and the first compression ratio parameter value of the first compression ratio parameter.

[0090] For example, the k-th first initial polynomial f mentioned above k With standardized step function The first system of linear programming equations between them can be expressed as formula (1):

[0091]

[0092] Where χ represents the first set of reference points, x lRepresents any reference point in the first set of reference points. The normalized step function represents the step function, where c represents the first compression ratio parameter, and t... nk C represents the radius of the nth interval among the N intervals to be mapped corresponding to the kth initial polynomial. max (f k ) represents the k-th first initial polynomial f k The largest coefficient among the coefficients, B represents the threshold of the first polynomial coefficients.

[0093] It should be understood that through the above step S222, the N intervals to be mapped corresponding to each first initial polynomial can be determined, and then the interval radius of each interval to be mapped can be calculated; in the above formula (1) The absolute value of the deviation between the k-th initial polynomial and the standardized step function is less than or equal to the product of the first compressibility parameter and the interval radius of each interval to be mapped, as stated in the above C. max (f k )≤B means that the maximum coefficient in the k-th initial polynomial is less than or equal to the coefficient threshold of the first polynomial.

[0094] In practical applications, for example, any known linear programming solver or integer programming solver in the art can be used to solve the first linear programming equation system after substituting each reference point with the goal of minimizing the first compression ratio parameter, so as to obtain the coefficient values ​​of the coefficients in the k-th first initial polynomial and the first compression ratio parameter value of the first compression ratio parameter. That is, the embodiments of this disclosure do not limit the solution method of the above-mentioned first linear programming equation system, as long as the coefficient values ​​of the coefficients in the k-th first initial polynomial and the first compression ratio parameter value of the first compression ratio parameter can be solved.

[0095] Here, the first compression ratio parameter value can be understood as the currently calculated optimal interval compression ratio. This first compression ratio parameter value can characterize the ratio between the input interval to be mapped and the output mapped interval of the first initial polynomial with determined coefficient values. Solving the above first linear programming equation system is equivalent to making the first compression ratio parameter c optimal, i.e., minimum, or in other words, making f as small as possible. k Map the values ​​of the interval to be mapped to a smaller subinterval near the midpoint of the initial subinterval, and ensure that the polynomial coefficients are less than the set upper bound of the coefficients.

[0096] Step S224: The kth first initial polynomial with determined coefficient values ​​is taken as the kth first approximation polynomial.

[0097] In practical applications, after obtaining the coefficient values ​​of each coefficient in the kth first initial polynomial, the kth first initial polynomial with determined coefficient values ​​can be used as the kth first approximation polynomial.

[0098] Considering that step S223 above determines the coefficient values ​​of each coefficient in the k-th first initial polynomial using a first set of reference points selected from N intervals to be mapped, there may be some reference points in the N intervals to be mapped that cannot satisfy the constraints of the first linear programming equation system, making the determined coefficient values ​​potentially not optimal. Therefore, in one possible implementation, using the k-th first initial polynomial with determined coefficient values ​​as the k-th first approximation polynomial may include:

[0099] Detect whether there are extreme points and boundary points in N intervals to be mapped that satisfy a first specified condition. The first specified condition includes: the absolute value of the deviation between the k-th first initial polynomial with determined coefficient values ​​and the standardized step function is greater than the product between the first compression ratio parameter value and the interval radius of the interval to be mapped.

[0100] If no extreme points or boundary points satisfying the first specified condition exist in the N intervals to be mapped, the k-th initial polynomial with determined coefficient values ​​is taken as the k-th first approximation polynomial; or,

[0101] If there are extreme points and boundary points that satisfy the first specified condition in the N intervals to be mapped, add the extreme points and boundary points that satisfy the first specified condition to the first reference point set to obtain the second reference point set; based on the second reference point set, the first polynomial coefficient threshold and the standardized step function, redetermine the coefficient values ​​of the coefficients in the kth first initial polynomial, and take the kth first initial polynomial with the redetermined coefficient values ​​as the kth first approximation polynomial.

[0102] The first specified condition can be expressed as follows: in, This represents the k-th initial polynomial with determined coefficient values. Represents the standardized step function, c l This represents the first compression ratio parameter value. Based on this, we detect whether there are extreme points and boundary points in the N intervals to be mapped that satisfy the first specified condition. This can be understood as detecting whether there are any points in the N intervals to be mapped that satisfy the first specified condition. The extreme points and boundary points x′.

[0103] In this process, the coefficient values ​​of the coefficients in the kth first initial polynomial can be determined by referring to the method of determining the coefficient values ​​in the kth first initial polynomial in step S223 above. This can be achieved by redetermining the coefficient values ​​of the coefficients in the kth first initial polynomial based on the second reference point set, the coefficient threshold of the first polynomial, and the standardized step function, and then using the kth first initial polynomial with the redetermined coefficient values ​​as the kth first approximation polynomial. This will not be elaborated further here.

[0104] In one possible implementation, the coefficient values ​​of the coefficients in the k-th first initial polynomial are re-determined based on the second reference point set, the first polynomial coefficient threshold, and the normalized step function. The k-th first initial polynomial with re-determined coefficient values ​​is then used as the k-th first approximation polynomial. This can include:

[0105] Based on the second set of reference points, the kth initial polynomial with determined coefficient values, the standardized step function, and the interval radius of each interval to be mapped corresponding to the kth initial polynomial, determine the maximum compression ratio among the actual interval compression ratios corresponding to each interval to be mapped.

[0106] If the weighted value of the first compression ratio parameter is greater than the maximum compression ratio, the coefficient values ​​of the coefficients in the k-th first initial polynomial are re-determined based on the second reference point set, the first polynomial coefficient threshold, and the standardized step function, and the k-th first initial polynomial with re-determined coefficient values ​​is taken as the k-th first approximation polynomial; or,

[0107] If the weighted value of the first compression ratio parameter is less than or equal to the maximum compression ratio, the kth initial polynomial with determined coefficient values ​​is used as the kth approximation polynomial.

[0108] Optionally, formula (2) can be used to implement the kth initial polynomial based on the second reference point set χ′ and the determined coefficient values. Standardized step function and the interval radius t of each interval to be mapped corresponding to the kth first initial polynomial. nk Determine the maximum compression ratio c among the actual interval compression ratios corresponding to each interval to be mapped. u :

[0109]

[0110] Among them, the first compression ratio parameter value c l The weighted value can be expressed as (1+γ)c lγ represents the weighting value, also known as the approximation factor, and serves as the termination condition for the polynomial approximation method. Users can customize the specific value of γ according to their implementation requirements. γ controls the output of the coefficients of the k-th initial polynomial when the first compression ratio parameter converges. Based on this, if c u <(1+γ)c l Then output the k-th initial polynomial with determined coefficient values. As the k-th first approximation polynomial, if c u ≥(1+γ)c l Then the coefficient values ​​of the coefficients in the k-th initial polynomial are redefined.

[0111] According to the embodiments of this disclosure, each first approximation polynomial with high accuracy and small error can be effectively calculated, thereby obtaining a composite polynomial function that is closer to the solution function.

[0112] Figure 4 A flowchart illustrating a polynomial approximation method according to an embodiment of the present disclosure is shown. Figure 4 The polynomial approximation method shown can be used to determine the second approximating polynomial in the composite polynomial function corresponding to any step function, such as... Figure 4 As shown, step S22 above, which determines the composite polynomial function that approximates the step function indicated by the processing instruction, may include:

[0113] Step S225: Construct a second initial polynomial with coefficient values ​​to be determined based on the polynomial degree set for the second approximation polynomial.

[0114] In practical applications, users can set the polynomial degree of the second approximation polynomial according to their actual needs. Knowing the polynomial degree set by the user, at least one base polynomial can be selected from the aforementioned set of base polynomials to construct a second initial polynomial matching that degree. The base polynomial can be understood as the fundamental terms constituting the initial polynomial; for example, it includes, but is not limited to, terms such as "d+ex" and "hx". 2 “mx” 3 "and other basis polynomials.

[0115] Step S226: Based on the midpoints of the N sub-intervals and the interval radii of the N mapped intervals output by the Kth first approximation polynomial among the K first approximation polynomials, determine the N unmapped intervals corresponding to the second initial polynomial, and select multiple reference points from the N unmapped intervals corresponding to the second initial polynomial to obtain the third reference point set.

[0116] The interval radius of the N mapped intervals output by the Kth first approximation polynomial among the K first approximation polynomials can be understood as the interval radius of the N mapped intervals output by the last first approximation polynomial among the K first approximation polynomials. In practical applications, the N intervals to be mapped corresponding to the Kth first approximation polynomial determined through step S222 above can be input into the Kth first approximation polynomial to obtain the N mapped intervals output by the Kth first approximation polynomial, and then the interval radius of each of the N mapped intervals output by the Kth first approximation polynomial can be calculated.

[0117] For example, suppose the interval radius of each of the N mapped intervals of the Kth first approximation polynomial output is represented as t. 1K t 2K 、…、t NK The midpoints of the N subintervals are denoted as z1, z2, ..., zn. N Then the N unmapped intervals corresponding to the second initial polynomial can be represented as [z1-t]. 1K ,z1+t 1K ]、[z2-t 2K ,z2+t 2K ]、…、[z N -t NK ,z N +t NK ], or it can be represented as [z n -t nK ,z n +t nK ], n∈[1,N], that is, take the midpoint of each of the N sub-intervals as the midpoint of the N mapped intervals, and based on the midpoint of the N mapped intervals and their corresponding interval radii, obtain the N intervals to be mapped corresponding to the second initial polynomial.

[0118] In one possible implementation, in order to control the computational accuracy of homomorphic computation using composite polynomial functions, an error bound η can be set for each interval to be mapped. k And based on the error bound η k The midpoints of N sub-intervals and the radii of the N mapped intervals are used to determine the N unmapped intervals corresponding to the second initial polynomial. For example, based on the error bound η... k The N intervals to be mapped corresponding to the second initial polynomial mentioned above can be represented as: [z1-t 1K -η k ,z1+t 1K +η k ]、[z2-t 2K -η k ,z2+t 2K +η k]、…、[z N -t NK -η k ,z N +t NK +η k ], or it can be represented as [z n -t nK -η k ,z n +t nK +η k ], n∈[1,N]. Wherein, those skilled in the art can define the error bound η according to actual needs. k The specific value of η k >0, which is not a limitation of the embodiments disclosed herein.

[0119] In practical applications, for example, selection methods known in the art, such as random selection, incremental selection, and uniform selection, can be used to select multiple reference points from the N intervals to be mapped corresponding to the second initial polynomial, thereby obtaining a third set of reference points. This disclosure does not limit this approach. It should be understood that this disclosure does not limit the selection method or the number of reference points, that is, it does not limit the number of reference points in the third set of reference points.

[0120] Step S227: Determine the coefficient values ​​of the coefficients in the second initial polynomial based on the third reference point set, the preset second polynomial coefficient threshold, and the step function. The maximum coefficient value of the coefficients in the second initial polynomial is less than or equal to the second polynomial threshold.

[0121] The user sets the specific value of the second polynomial coefficient threshold according to actual needs, and this embodiment of the disclosure does not impose any restrictions on this. By setting the second polynomial coefficient threshold, the upper bound of the coefficients of the generated composite polynomial function can be flexibly controlled, making it applicable to homomorphic computation tasks of different precisions.

[0122] In one possible implementation, the coefficient values ​​of the coefficients in the second initial polynomial are determined based on the third reference point set, a preset threshold for the coefficients of the second polynomial, and the step function, including:

[0123] Construct a second linear programming equation system between the second initial polynomial and the step function. The second linear programming equation system is used to constrain the absolute value of the deviation between the second initial polynomial and the step function to be less than or equal to the product between the second compression ratio parameter and the interval radius of each interval to be mapped corresponding to the second initial polynomial, and to constrain the maximum coefficient in the second initial polynomial to be less than or equal to the coefficient threshold of the second polynomial.

[0124] With the goal of minimizing the second compression ratio parameter, each reference point in the third reference point set is substituted into the second linear programming equation system, and the second linear programming equation system after substituting each reference point is solved to obtain the coefficient values ​​of the coefficients in the second initial polynomial and the second compression ratio parameter value.

[0125] For example, the second linear programming equation system between the second initial polynomial g and the step function κ can be expressed as formula (3):

[0126]

[0127] Where χ″ represents the set of third reference points, x″ l Let κ represent any reference point in the third set of reference points, κ represent the step function, c′ represent the second compressibility parameter, and t represent the second compressibility parameter. n C represents the radius of the nth interval among the N intervals to be mapped corresponding to the second initial polynomial. max (g) represents the largest coefficient among the coefficients of the second initial polynomial g, and B′ represents the coefficient threshold of the second polynomial.

[0128] It should be understood that in the above formula (3), |g(x″) l )-κ(x″ l )|≤c′t n The absolute value of the deviation between the second initial polynomial and the step function is less than or equal to the product of the second compressibility parameter and the interval radii of each unmapped interval corresponding to the second initial polynomial, as stated in C above. max (g)≤B′ means that the largest coefficient in the second initial polynomial is less than or equal to the coefficient threshold of the second polynomial. Solving the above first linear programming equation system is equivalent to optimizing, or minimizing, the first compression ratio parameter c, or in other words, minimizing f as much as possible. k Map the values ​​of the interval to be mapped to a smaller subinterval near the midpoint of the initial subinterval, and ensure that the polynomial coefficients are less than the set upper bound of the coefficients.

[0129] In practical applications, for example, any known linear programming solver or integer programming solver in the art can be used to solve the second linear programming equation system after substituting each reference point with the goal of minimizing the second compression ratio parameter, thereby obtaining the coefficient values ​​of the coefficients in the second initial polynomial and the second compression ratio parameter value. That is, the embodiments of this disclosure do not limit the solution method of the above-mentioned second linear programming equation system, as long as the coefficient values ​​of the coefficients in the second initial polynomial and the second compression ratio parameter value can be obtained.

[0130] Step S228: Use the second initial polynomial with determined coefficient values ​​as the second approximating polynomial.

[0131] In practical applications, after obtaining the coefficient values ​​of each coefficient in the second initial polynomial, the second initial polynomial with determined coefficient values ​​can be used as the second approximation polynomial.

[0132] Considering that step S226 above determines the coefficient values ​​of each coefficient in the second initial polynomial using a third set of reference points selected from N intervals to be mapped, some reference points in the N intervals to be mapped may not satisfy the constraints of the second linear programming equation system, making the determined coefficient values ​​potentially not optimal. Therefore, in one possible implementation, using the second initial polynomial with determined coefficient values ​​as the second approximation polynomial may include:

[0133] Detect whether there are extreme points and boundary points in the N unmapped intervals corresponding to the second initial polynomial that satisfy the second specified condition. The second specified condition includes: making the absolute value of the deviation between the second initial polynomial with determined coefficient values ​​and the step function greater than the product between the second compression ratio parameter value and the interval radius of the unmapped interval corresponding to the second initial polynomial.

[0134] If no extreme points or boundary points satisfying the second specified condition exist in the N unmapped intervals corresponding to the second initial polynomial, the second initial polynomial with determined coefficient values ​​shall be used as the second approximation polynomial; or,

[0135] If there are extreme points and boundary points that satisfy the second specified condition in the N intervals to be mapped corresponding to the second initial polynomial, the extreme points and boundary points that satisfy the second specified condition are added to the third reference point set to obtain the fourth reference point set. Based on the fourth reference point set, the coefficient threshold of the second polynomial, and the step function, the coefficient values ​​of the coefficients in the second initial polynomial are re-determined, and the second initial polynomial with the re-determined coefficient values ​​is used as the second approximation polynomial.

[0136] The second specified condition mentioned above can be expressed as: in, The second initial polynomial with determined coefficients is represented by κ, which represents the step function, and c′. l This represents the second compression ratio parameter value. Based on this, it checks whether there are extreme points and boundary points in the N intervals to be mapped that satisfy the first specified condition. This can be understood as checking whether there are any points in the N intervals to be mapped that satisfy the condition. Extreme points and boundary points.

[0137] In this process, the method for determining the coefficient values ​​of the coefficients in the second initial polynomial in step S227 above can be used to redetermine the coefficient values ​​of the coefficients in the second initial polynomial based on the fourth reference point set, the coefficient threshold of the second polynomial, and the step function. The second initial polynomial with the redetermined coefficient values ​​can then be used as the second approximating polynomial. This will not be elaborated further here.

[0138] In one possible implementation, the coefficient values ​​of the coefficients in the second initial polynomial are re-determined based on the fourth reference point set, the coefficient threshold of the second polynomial, and the step function, and the second initial polynomial with the re-determined coefficient values ​​is used as the second approximating polynomial. This can include:

[0139] Based on the fourth reference point set, the second initial polynomial with determined coefficient values, the step function, and the interval radius of each interval to be mapped corresponding to the second initial polynomial, determine the maximum compression ratio in the actual interval compression ratio corresponding to each interval to be mapped.

[0140] If the weighted value of the second compression ratio parameter is greater than the maximum compression ratio, the coefficient values ​​of the coefficients in the second initial polynomial are re-determined based on the fourth reference point set, the second polynomial coefficient threshold, and the step function, and the second initial polynomial with the re-determined coefficient values ​​is used as the second approximation polynomial; or,

[0141] If the weighted value of the second compression ratio parameter is less than or equal to the maximum compression ratio, the second initial polynomial with determined coefficient values ​​is used as the second approximation polynomial.

[0142] Alternatively, formula (4) can be used to implement the second initial polynomial based on the fourth reference point set χ″′ and the determined coefficient values. The step function κ and the radius t of each interval to be mapped corresponding to the second initial polynomial. n Determine the maximum compression ratio c′ among the actual interval compression ratios corresponding to each interval to be mapped. u :

[0143]

[0144] Among them, the second compression ratio parameter value c′ l The weighted value can be expressed as (1+γ′)c′ l γ′ represents the weighting value, also known as the approximation factor, and serves as the termination condition for the polynomial approximation method. Users can customize the specific value of γ′ according to their implementation requirements. γ′ controls the output of the coefficients of the second initial polynomial when the second compression ratio parameter converges. Based on this, if c′ u <(1+γ′)c′ l Then output the second initial polynomial with determined coefficient values. As the second approximation polynomial, if c′ u ≥(1+γ′)c′ l Then the coefficient values ​​in the second initial polynomial are redefined.

[0145] In one possible implementation, the method further includes: determining the output precision of the composite polynomial function based on the maximum deviation between the function values ​​of the second approximating polynomial and the step function, and a preset error bound, wherein the error bound is used to control the homomorphic computation precision of the composite polynomial function. This method allows users to easily determine the output precision of the composite polynomial function corresponding to the step function.

[0146] The maximum deviation between the second approximation polynomial and the step function can be expressed as: x∈U′ n ,U′ n =[z n -t nK -η k ,z n +t nK +η k ], n∈[1,N],y n This represents the step function in the interval U′ n Based on the function value at the given location, the maximum deviation between the function values ​​of the second approximation polynomial and the step function can be achieved through formula (5), along with the preset error bound η. g Determine the output precision of the composite polynomial function. -α .

[0147] 2 -α α=-log(t+η) g (3)

[0148] Among them, those skilled in the art can set the error boundary η according to actual needs. g The specific value of η g >0, which is not a limitation of the embodiments disclosed herein.

[0149] According to the embodiments of this disclosure, a second approximation polynomial with high accuracy and small error can be effectively calculated, thereby obtaining a composite polynomial function that is closer to the step function.

[0150] Figure 5 A block diagram of a homomorphic ciphertext processing apparatus according to an embodiment of the present disclosure is shown, as follows: Figure 5 As shown, the device includes:

[0151] The acquisition module 501 is used to acquire the homomorphic ciphertext to be processed sent by the terminal and the processing instructions for the homomorphic ciphertext. The homomorphic ciphertext includes the encryption result of user data by the terminal. The processing instructions are used to indicate the step function required to process the homomorphic ciphertext. The value range of the step function includes multiple different initial sub-intervals. The function value of the step function is the same in the same initial sub-interval.

[0152] The determining module 502 is used to determine a composite polynomial function that approximates the step function indicated by the processing instruction. The composite polynomial function includes a plurality of first approximation polynomials and a second approximation polynomial. The plurality of first approximation polynomials are used to iteratively map each initial subinterval corresponding to the step function to a target subinterval near the midpoint of each initial subinterval. The range of each target subinterval is smaller than the range of each initial subinterval. The second approximation polynomial is used to map each target subinterval to the function value of the step function corresponding to each initial subinterval.

[0153] The execution module 503 is used to perform homomorphic computation on the homomorphic ciphertext using the composite polynomial function, obtain the ciphertext processing result, and send the ciphertext processing result to the terminal.

[0154] In one possible implementation, the range of values ​​for the step function includes N initial sub-intervals, and the composite polynomial function includes K first approximation polynomials, where N and K are positive integers. The determination of the composite polynomial function that approximates the step function indicated by the processing instruction includes: for the k-th first approximation polynomial among the K first approximation polynomials, constructing a k-th first initial polynomial with coefficient values ​​to be determined based on the polynomial degree set for the k-th first approximation polynomial, where 1 ≤ k ≤ K; determining N unmapped intervals corresponding to the k-th first initial polynomial based on the N initial sub-intervals corresponding to the step function, and selecting multiple reference points from each of the N unmapped intervals corresponding to the k-th first initial polynomial. The first reference point set is used; based on the first reference point set, the preset first polynomial coefficient threshold, and the standardized step function corresponding to the step function, the coefficient values ​​of the coefficients in the k-th first initial polynomial are determined, wherein the maximum coefficient value of the coefficients in the k-th first initial polynomial is less than or equal to the first polynomial coefficient threshold, the value range of the standardized step function is the same as that of the step function, and the function value of the standardized step function in the 1st sub-interval is the left boundary point of the value range, the function value in the Nth sub-interval is the right boundary point of the value range, and the function value in the i-th sub-interval is the midpoint of the i-th sub-interval, 1 < i < N; the k-th first initial polynomial with determined coefficient values ​​is used as the k-th first approximation polynomial.

[0155] In one possible implementation, determining the N unmapped intervals corresponding to the k-th first initial polynomial based on the N initial sub-intervals corresponding to the step function includes: when k = 1, determining the N unmapped intervals corresponding to the first first initial polynomial according to the N initial sub-intervals and a preset input precision, wherein the input precision characterizes the input precision of the composite polynomial function; when k ≥ k > 1, inputting the N unmapped intervals corresponding to the (k-1)-th first initial polynomial to the (k-1)-th first approximation polynomial to obtain the N mapped intervals output by the (k-1)-th first approximation polynomial, and determining the N unmapped intervals corresponding to the k-th first initial polynomial according to the midpoints of the N initial sub-intervals and the interval radii of the N mapped intervals.

[0156] In one possible implementation, determining the coefficient values ​​of the coefficients in the k-th first initial polynomial based on the first set of reference points, a preset first polynomial coefficient threshold, and the standardized step function corresponding to the step function includes: constructing a first linear programming equation set between the k-th first initial polynomial and the standardized step function, wherein the first linear programming equation set is used to constrain that the absolute value of the deviation between the k-th first initial polynomial and the standardized step function is less than or equal to the product of the first compression ratio parameter and the interval radius of each interval to be mapped, and to constrain that the maximum coefficient in the k-th first initial polynomial is less than or equal to the first polynomial coefficient threshold; with the goal of minimizing the first compression ratio parameter, substituting each reference point in the first set of reference points into the first linear programming equation set, and solving the first linear programming equation set after substituting each reference point to obtain the coefficient values ​​of the coefficients in the k-th first initial polynomial and the first compression ratio parameter value of the first compression ratio parameter.

[0157] In one possible implementation, using the k-th first initial polynomial with determined coefficient values ​​as the k-th first approximation polynomial includes: detecting whether there are extreme points and boundary points in the N intervals to be mapped that satisfy a first specified condition, wherein the first specified condition includes: the absolute value of the deviation between the k-th first initial polynomial with determined coefficient values ​​and the standardized step function is greater than the product of the first compression ratio parameter value and the interval radius of the interval to be mapped; if there are no extreme points and boundary points in the N intervals to be mapped that satisfy the first specified condition, then using the k-th first initial polynomial with determined coefficient values ​​as the k-th first approximation polynomial. The kth first initial polynomial is used as the kth first approximating polynomial; or, if there are extreme points and boundary points that satisfy the first specified condition in the N intervals to be mapped, the extreme points and boundary points that satisfy the first specified condition are added to the first reference point set to obtain the second reference point set; according to the second reference point set, the first polynomial coefficient threshold and the standardized step function, the coefficient values ​​of the coefficients in the kth first initial polynomial are re-determined, and the kth first initial polynomial with re-determined coefficient values ​​is used as the kth first approximating polynomial.

[0158] In one possible implementation, the step of redetermining the coefficient values ​​of the coefficients in the k-th first initial polynomial based on the second reference point set, the first polynomial coefficient threshold, and the standardized step function, and using the k-th first initial polynomial with redetermined coefficient values ​​as the k-th first approximating polynomial, includes: determining the maximum compression ratio among the actual interval compression ratios corresponding to each interval to be mapped based on the second reference point set, the k-th first initial polynomial with determined coefficient values, the standardized step function, and the interval radius of each interval to be mapped corresponding to the k-th first initial polynomial; if the weighted value of the first compression ratio parameter value is greater than the maximum compression ratio, redetermining the coefficient values ​​of the coefficients in the k-th first initial polynomial based on the second reference point set, the first polynomial coefficient threshold, and the standardized step function, and using the k-th first initial polynomial with redetermined coefficient values ​​as the k-th first approximating polynomial; or, if the weighted value of the first compression ratio parameter value is less than or equal to the maximum compression ratio, using the k-th first initial polynomial with determined coefficient values ​​as the k-th first approximating polynomial.

[0159] In one possible implementation, determining the composite polynomial function that approximates the step function indicated by the processing instruction includes: constructing a second initial polynomial with coefficient values ​​to be determined based on the polynomial degree set for the second approximation polynomial; determining N unmapped intervals corresponding to the second initial polynomial based on the midpoints of the N sub-intervals and the interval radii of the N mapped intervals output by the Kth first approximation polynomial among the K first approximation polynomials, and selecting multiple reference points from the N unmapped intervals corresponding to the second initial polynomial to obtain a third reference point set; determining the coefficient values ​​of the coefficients in the second initial polynomial based on the third reference point set, a preset second polynomial coefficient threshold, and the step function, wherein the maximum coefficient value of the coefficients in the second initial polynomial is less than or equal to the second polynomial threshold; and using the second initial polynomial with determined coefficient values ​​as the second approximation polynomial.

[0160] In one possible implementation, determining the coefficient values ​​of the coefficients in the second initial polynomial based on the third reference point set, a preset second polynomial coefficient threshold, and the step function includes: constructing a second linear programming equation set between the second initial polynomial and the step function, wherein the second linear programming equation set is used to constrain that the absolute value of the deviation between the second initial polynomial and the step function is less than or equal to the product of the second compression ratio parameter and the interval radius of each interval to be mapped corresponding to the second initial polynomial, and to constrain that the maximum coefficient in the second initial polynomial is less than or equal to the second polynomial coefficient threshold; with the goal of minimizing the second compression ratio parameter, substituting each reference point in the third reference point set into the second linear programming equation set, and solving the second linear programming equation set after substituting each reference point to obtain the coefficient values ​​of the coefficients in the second initial polynomial and the second compression ratio parameter value of the second compression ratio parameter.

[0161] In one possible implementation, using the second initial polynomial with determined coefficient values ​​as the second approximating polynomial includes: detecting whether there are extreme points and boundary points satisfying a second specified condition in the N unmapped intervals corresponding to the second initial polynomial, wherein the second specified condition includes: the absolute value of the deviation between the second initial polynomial with determined coefficient values ​​and the step function is greater than the product of the second compression ratio parameter value and the interval radius of the unmapped interval corresponding to the second initial polynomial; if there are no extreme points and boundary points satisfying the second specified condition in the N unmapped intervals corresponding to the second initial polynomial, using the second initial polynomial with determined coefficient values ​​as the second approximating polynomial; or, if there are extreme points and boundary points satisfying the second specified condition in the N unmapped intervals corresponding to the second initial polynomial, adding the extreme points and boundary points satisfying the second specified condition to the third reference point set to obtain a fourth reference point set; and redetermining the coefficient values ​​of the coefficients in the second initial polynomial based on the fourth reference point set, the coefficient threshold of the second polynomial, and the step function, and using the second initial polynomial with redetermined coefficient values ​​as the second approximating polynomial.

[0162] In one possible implementation, the device further includes: an output accuracy determination module, configured to determine the output accuracy of the composite polynomial function based on the maximum value of the deviation between the function values ​​of the second approximation polynomial and the step function, and a preset error bound, wherein the error bound is used to control the homomorphic computation accuracy of the composite polynomial function.

[0163] According to embodiments of this disclosure, by using a composite polynomial function that approximates the step function required for processing homomorphic ciphertext, that is, by using a composite polynomial function composed of multiple first approximation polynomials and second approximation polynomials to perform homomorphic computation on homomorphic ciphertext, the efficiency and accuracy of homomorphic computation on homomorphic ciphertext can be improved, thus meeting the homomorphic computation requirements of various application scenarios.

[0164] In some embodiments, the functions or modules of the apparatus provided in this disclosure can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0165] This disclosure also proposes a computer-readable storage medium storing computer program instructions that, when executed by a processor, implement the above-described method. The computer-readable storage medium can be volatile or non-volatile.

[0166] This disclosure also proposes an electronic device, including: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to implement the above method when executing the instructions stored in the memory.

[0167] This disclosure also provides a computer program product, including computer-readable code, or a non-volatile computer-readable storage medium carrying computer-readable code, wherein when the computer-readable code is run in a processor of an electronic device, the processor in the electronic device performs the above-described method.

[0168] Figure 6 A block diagram of an electronic device 1900 according to an embodiment of the present disclosure is shown. For example, the electronic device 1900 may be provided as a server or a terminal device. (Refer to...) Figure 6 The electronic device 1900 includes a processing component 1922, which further includes one or more processors, and memory resources represented by memory 1932 for storing instructions, such as application programs, that can be executed by the processing component 1922. The application programs stored in memory 1932 may include one or more modules, each corresponding to a set of instructions. Furthermore, the processing component 1922 is configured to execute instructions to perform the methods described above.

[0169] Electronic device 1900 may also include a power supply component 1926 configured to perform power management of electronic device 1900, a wired or wireless network interface 1950 configured to connect electronic device 1900 to a network, and an input / output interface 1958 (I / O interface). Electronic device 1900 can operate on an operating system, such as Windows Server, stored in memory 1932. TM Mac OS X TM Unix TM Linux TM FreeBSD TM Or similar.

[0170] In an exemplary embodiment, a non-volatile computer-readable storage medium is also provided, such as a memory 1932 including computer program instructions that can be executed by a processing component 1922 of an electronic device 1900 to perform the above-described method.

[0171] This disclosure can be a system, method, and / or computer program product. A computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for causing a processor to implement various aspects of this disclosure.

[0172] Computer-readable storage media can be tangible devices capable of holding and storing instructions for use by an instruction execution device. Computer-readable storage media can be, for example—but not limited to—electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable CD-ROM, digital multifunction disc (DVD), memory sticks, floppy disks, mechanical encoding devices, such as punch cards or recessed protrusions storing instructions thereon, and any suitable combination of the foregoing. The computer-readable storage media used herein are not to be construed as transient signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., light pulses through fiber optic cables), or electrical signals transmitted through wires.

[0173] The computer-readable program instructions described herein can be downloaded from computer-readable storage media to various computing / processing devices, or downloaded via a network, such as the Internet, local area network, wide area network, and / or wireless network, to an external computer or external storage device. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards them to the computer-readable storage media in the respective computing / processing device.

[0174] Computer program instructions used to perform the operations of this disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, status setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Smalltalk, C++, etc., and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or may be connected to an external computer (e.g., via the Internet using an Internet service provider). In some embodiments, electronic circuitry, such as programmable logic circuitry, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), is personalized by utilizing the status information of the computer-readable program instructions to implement various aspects of this disclosure.

[0175] Various aspects of this disclosure are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this disclosure. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer-readable program instructions.

[0176] These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that, when executed by the processor of the computer or other programmable data processing apparatus, they create means for implementing the functions / actions specified in one or more blocks of the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium that causes a computer, programmable data processing apparatus, and / or other device to operate in a particular manner; thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing aspects of the functions / actions specified in one or more blocks of the flowchart and / or block diagram.

[0177] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to perform the functions / actions specified in one or more boxes of a flowchart and / or block diagram.

[0178] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of an instruction containing one or more executable instructions for implementing a specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than those shown in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0179] The various embodiments of this disclosure have been described above. These descriptions are exemplary and not exhaustive, nor are they limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen to best explain the principles, practical application, or technical improvements to the embodiments in the market, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for processing homomorphic ciphertext, characterized in that, The method is applied to a server and includes: The terminal sends a homomorphic ciphertext to be processed and a processing instruction for the homomorphic ciphertext. The homomorphic ciphertext includes the encryption result of user data by the terminal. The processing instruction is used to indicate the step function required to process the homomorphic ciphertext. The value range of the step function includes multiple different initial sub-intervals. The function value of the step function is the same in the same initial sub-interval. A composite polynomial function is determined that approximates the step function indicated by the processing instruction. The composite polynomial function includes a plurality of first approximation polynomials and a second approximation polynomial. The plurality of first approximation polynomials are used to iteratively map each initial subinterval corresponding to the step function to a target subinterval near the midpoint of each initial subinterval. The range of each target subinterval is smaller than the range of each initial subinterval. The second approximation polynomial is used to map each target subinterval to the function value of the step function corresponding to each initial subinterval. The homomorphic computation of the homomorphic ciphertext is performed using the composite polynomial function to obtain the ciphertext processing result, and the ciphertext processing result is sent to the terminal.

2. The method according to claim 1, characterized in that, The step function's value interval includes N initial subintervals, and the composite polynomial function includes K first approximation polynomials, where N and K are positive integers. The determination of the composite polynomial function that approximates the step function indicated by the processing instruction includes: For the kth first approximation polynomial among the K first approximation polynomials, construct the kth first initial polynomial with coefficient values ​​to be determined based on the polynomial degree set for the kth first approximation polynomial, where 1≤k≤K; Based on the N initial sub-intervals corresponding to the step function, determine the N unmapped intervals corresponding to the kth first initial polynomial, and select multiple reference points from the N unmapped intervals corresponding to the kth first initial polynomial to obtain the first reference point set. Based on the first set of reference points, the preset first polynomial coefficient threshold, and the standardized step function corresponding to the step function, the coefficient values ​​of the coefficients in the k-th first initial polynomial are determined, wherein the maximum coefficient value of the coefficients in the k-th first initial polynomial is less than or equal to the first polynomial coefficient threshold, the value range of the standardized step function is the same as that of the step function, and the function value of the standardized step function in the 1st sub-interval is the left boundary point of the value range, the function value in the Nth sub-interval is the right boundary point of the value range, and the function value in the i-th sub-interval is the midpoint of the i-th sub-interval, 1 < i < N; The k-th initial polynomial with determined coefficient values ​​is used as the k-th first approximation polynomial.

3. The method according to claim 2, characterized in that, The step of determining the N unmapped intervals corresponding to the k-th first initial polynomial based on the N initial sub-intervals corresponding to the step function includes: When k=1, based on the N initial sub-intervals and the preset input precision, the N intervals to be mapped corresponding to the first initial polynomial are determined, where the input precision characterizes the input precision of the composite polynomial function. When K≥k>1, the N unmapped intervals corresponding to the (k-1)th first initial polynomial are input into the (k-1)th first approximation polynomial to obtain the N mapped intervals output by the (k-1)th first approximation polynomial. Based on the midpoints of the N initial sub-intervals and the interval radii of the N mapped intervals, the N unmapped intervals corresponding to the kth first initial polynomial are determined.

4. The method according to claim 2, characterized in that, The step of determining the coefficient values ​​of the coefficients in the k-th first initial polynomial based on the first reference point set, the preset first polynomial coefficient threshold, and the standardized step function corresponding to the step function includes: Construct a first linear programming equation set between the k-th first initial polynomial and the standardized step function. The first linear programming equation set is used to constrain the absolute value of the deviation between the k-th first initial polynomial and the standardized step function to be less than or equal to the product between the first compression ratio parameter and the interval radius of each interval to be mapped, and to constrain the maximum coefficient in the k-th first initial polynomial to be less than or equal to the first polynomial coefficient threshold. With the goal of minimizing the first compression ratio parameter, each reference point in the first set of reference points is substituted into the first linear programming equation system, and the first linear programming equation system after substituting each reference point is solved to obtain the coefficient values ​​of the coefficients in the k-th first initial polynomial and the first compression ratio parameter value of the first compression ratio parameter.

5. The method according to claim 4, characterized in that, The step of using the kth first initial polynomial with determined coefficient values ​​as the kth first approximation polynomial includes: Detect whether there are extreme points and boundary points in the N intervals to be mapped that satisfy a first specified condition. The first specified condition includes: making the absolute value of the deviation between the k-th first initial polynomial with determined coefficient values ​​and the standardized step function greater than the product between the first compression ratio parameter value and the interval radius of the interval to be mapped. If no extreme points or boundary points satisfying the first specified condition exist in the N intervals to be mapped, the k-th initial polynomial with determined coefficient values ​​is taken as the k-th approximation polynomial; or, If there are extreme points and boundary points that satisfy the first specified condition in the N intervals to be mapped, add the extreme points and boundary points that satisfy the first specified condition to the first reference point set to obtain the second reference point set; based on the second reference point set, the first polynomial coefficient threshold and the standardized step function, redetermine the coefficient values ​​of the coefficients in the kth first initial polynomial, and use the kth first initial polynomial with the redetermined coefficient values ​​as the kth first approximation polynomial.

6. The method according to claim 5, characterized in that, The step of re-determining the coefficient values ​​of the k-th first initial polynomial based on the second reference point set, the first polynomial coefficient threshold, and the standardized step function, and using the k-th first initial polynomial with re-determined coefficient values ​​as the k-th first approximation polynomial, includes: Based on the second set of reference points, the kth initial polynomial with determined coefficient values, the standardized step function, and the interval radius of each interval to be mapped corresponding to the kth initial polynomial, determine the maximum compression ratio among the actual interval compression ratios corresponding to each interval to be mapped. If the weighted value of the first compression ratio parameter is greater than the maximum compression ratio, the coefficient values ​​of the coefficients in the k-th first initial polynomial are re-determined based on the second reference point set, the first polynomial coefficient threshold, and the standardized step function, and the k-th first initial polynomial with re-determined coefficient values ​​is taken as the k-th first approximation polynomial; or, If the weighted value of the first compression ratio parameter is less than or equal to the maximum compression ratio, the kth first initial polynomial with determined coefficient values ​​is used as the kth first approximation polynomial.

7. The method according to any one of claims 2 to 6, characterized in that, The determination of the composite polynomial function that approximates the step function indicated by the processing instruction includes: Based on the polynomial degree set for the second approximation polynomial, construct a second initial polynomial with coefficient values ​​to be determined; Based on the midpoints of the N sub-intervals and the interval radii of the N mapped intervals output by the Kth first approximation polynomial among the K first approximation polynomials, determine the N unmapped intervals corresponding to the second initial polynomial, and select multiple reference points from the N unmapped intervals corresponding to the second initial polynomial to obtain a third reference point set. Based on the third reference point set, the preset second polynomial coefficient threshold, and the step function, the coefficient values ​​of the coefficients in the second initial polynomial are determined, and the maximum coefficient value of the coefficients in the second initial polynomial is less than or equal to the second polynomial coefficient threshold. The second initial polynomial with determined coefficient values ​​is used as the second approximating polynomial.

8. The method according to claim 7, characterized in that, The step of determining the coefficient values ​​of the coefficients in the second initial polynomial based on the third reference point set, the preset second polynomial coefficient threshold, and the step function includes: Construct a second linear programming equation set between the second initial polynomial and the step function. The second linear programming equation set is used to constrain the absolute value of the deviation between the second initial polynomial and the step function to be less than or equal to the product between the second compression ratio parameter and the interval radius of each interval to be mapped corresponding to the second initial polynomial, and to constrain the maximum coefficient in the second initial polynomial to be less than or equal to the coefficient threshold of the second polynomial. With the goal of minimizing the second compression ratio parameter, each reference point in the third reference point set is substituted into the second linear programming equation system, and the second linear programming equation system after substituting each reference point is solved to obtain the coefficient values ​​of the coefficients in the second initial polynomial and the second compression ratio parameter value of the second compression ratio parameter.

9. The method according to claim 8, characterized in that, The step of using the second initial polynomial with determined coefficient values ​​as the second approximating polynomial includes: Detect whether there are extreme points and boundary points in the N unmapped intervals corresponding to the second initial polynomial that satisfy the second specified condition. The second specified condition includes: making the absolute value of the deviation between the second initial polynomial with determined coefficient values ​​and the step function greater than the product between the second compression ratio parameter value and the interval radius of the unmapped interval corresponding to the second initial polynomial. If there are no extreme points or boundary points satisfying the second specified condition in the N unmapped intervals corresponding to the second initial polynomial, the second initial polynomial with determined coefficient values ​​shall be used as the second approximation polynomial; or, If there are extreme points and boundary points that satisfy the second specified condition in the N unmapped intervals corresponding to the second initial polynomial, the extreme points and boundary points that satisfy the second specified condition are added to the third reference point set to obtain the fourth reference point set; based on the fourth reference point set, the coefficient threshold of the second polynomial, and the step function, the coefficient values ​​of the coefficients in the second initial polynomial are re-determined, and the second initial polynomial with the re-determined coefficient values ​​is used as the second approximation polynomial.

10. The method according to claim 7, characterized in that, The method further includes: The output accuracy of the composite polynomial function is determined based on the maximum deviation between the function values ​​of the second approximation polynomial and the step function, and a preset error bound. The error bound is used to control the homomorphic calculation accuracy of the composite polynomial function.

11. A homomorphic ciphertext processing apparatus, characterized in that, The device is used in a server and includes: The acquisition module is used to acquire the homomorphic ciphertext to be processed sent by the terminal and the processing instructions for the homomorphic ciphertext. The homomorphic ciphertext includes the encryption result of user data by the terminal. The processing instructions are used to indicate the step function required to process the homomorphic ciphertext. The value range of the step function includes multiple different initial sub-intervals. The function value of the step function is the same in the same initial sub-interval. A determination module is used to determine a composite polynomial function that approximates the step function indicated by the processing instruction. The composite polynomial function includes multiple first approximation polynomials and second approximation polynomials. The multiple first approximation polynomials are used to iteratively map each initial subinterval corresponding to the step function to a target subinterval near the midpoint of each initial subinterval. The range of each target subinterval is smaller than the range of each initial subinterval. The second approximation polynomial is used to map each target subinterval to the function value of the step function corresponding to each initial subinterval. The execution module is used to perform homomorphic computation on the homomorphic ciphertext using the composite polynomial function, obtain the ciphertext processing result, and send the ciphertext processing result to the terminal.

12. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to implement the method of any one of claims 1 to 10 when executing instructions stored in the memory.

13. A non-volatile computer-readable storage medium storing computer program instructions thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 10.

Images