Key determination method, device and equipment for switching and computer readable storage medium

Abstract

The application discloses a switching key determination method and device, equipment and a computer readable storage medium, and belongs to the technical field of computers. The method comprises the following steps: a computing device acquires a plurality of first elements, one first element being used for representing the size of one first prime number, the first prime number being obtained by modulus decomposition of ciphertext modulus of target ciphertext; a plurality of second prime numbers are generated according to the plurality of first elements; an additional modulus is determined according to the plurality of second prime numbers; then, a switching key is generated according to the additional modulus, and the switching key is used for switching the key of the target ciphertext. The number of the plurality of second prime numbers is greater than or equal to the lower limit of the number of decompositions of the additional modulus of the target ciphertext and is less than the number of the plurality of first elements, so that the number of the second prime numbers of the additional modulus is controlled, the memory storage amount of the determined switching key is low, the calculation complexity of the key switching can be reduced, and the calculation efficiency is improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to methods, apparatus, devices and computer-readable storage media for determining switching keys. Background Technology

[0002] With the development of computer technology, more and more application scenarios involve homomorphic encryption technology. Homomorphic encryption technology allows direct computation on ciphertext, and then decryption of the computation result yields the result of performing the corresponding computation on the plaintext.

[0003] Homomorphic encryption involves a key switching (KS) step to change the key of the target ciphertext. For example, a key switching key (KSKey) can be used to switch the key of the target ciphertext. However, implementing KS using a key switching key increases noise in the target ciphertext. Therefore, a method for determining the key switching key is needed to identify a key that can control noise during the key switching process. Summary of the Invention

[0004] This application provides a method, apparatus, device, and computer-readable storage medium for determining a switching key, which is used for noise control during key switching. The technical solution is as follows:

[0005] Firstly, a method for determining a switching key is provided. This method includes: a computing device acquiring multiple first elements; then generating multiple second prime numbers based on the multiple first elements; after acquiring the multiple second prime numbers, the computing device can determine an additional modulus based on the multiple second prime numbers, and subsequently generate a switching key based on the additional modulus. This switching key is used to switch target ciphertext. Specifically, each first element represents the size of a first prime number, which is obtained by decomposing the ciphertext modulus of the target ciphertext. The number of the multiple second prime numbers is greater than or equal to the lower limit of the number of decompositions of the additional modulus of the target ciphertext, and less than the number of the multiple first elements.

[0006] In determining the switching key, the number of multiple second prime numbers is greater than or equal to the lower limit of the number of factorizations of the additional modulus of the target ciphertext, and less than the number of multiple first elements. Based on this, the number of second prime numbers corresponding to the additional modulus is controlled, and the additional modulus is then determined based on the second prime numbers. The resulting switching key, due to the smaller number of second prime numbers corresponding to the additional modulus, effectively reduces the computational complexity of key switching, improves computational efficiency, and reduces the memory storage requirements of the switching key.

[0007] In one possible implementation, obtaining multiple first elements includes: obtaining multiple second elements, the number of which is the same as the number of first prime numbers obtained from the modulo factorization of the target ciphertext, and one second element can be used to represent the size of a first prime number; subsequently, the computing device calculates the sum of the multiple second elements to obtain the total modulo size of the ciphertext; since the computing device also needs to use the upper limit of the algorithm size corresponding to the target ciphertext when obtaining multiple first elements, and this upper limit of the algorithm size is used to indicate the upper limit of the modulo size supported by the homomorphic algorithm corresponding to the target ciphertext, the computing device also obtains this upper limit of the algorithm size; thus, based on the upper limit of the algorithm size and the total modulo size of the ciphertext, a second element is selected as the first element from the multiple second elements. Obtaining the first element based on the upper limit of the algorithm size ensures that the subsequently determined additional modulo will not exceed the upper limit of the algorithm size corresponding to the target ciphertext, thereby ensuring the security strength during the key switching process based on the additional modulo.

[0008] In one possible implementation, a second element is selected as the first element from a plurality of second elements based on the upper limit of the algorithm size and the total ciphertext modulus size. This includes: if the first difference between the upper limit of the algorithm size and the total ciphertext modulus size is not less than the total ciphertext modulus size, then each of the plurality of second elements is selected as the first element. Since the first difference indicates the maximum value of the size of the additional modulus, when the first difference is not less than the total ciphertext modulus size, the additional modulus can satisfy the requirement that its size is not less than the size of the ciphertext modulus without exceeding the first difference. Therefore, there is no need to divide the ciphertext modulus into blocks; the second element can be directly used as the first element, which is simple and efficient.

[0009] In one possible implementation, a second element is selected as the first element from multiple second elements based on the upper limit of the algorithm size and the total ciphertext module size. This includes: when the first difference between the upper limit of the algorithm size and the total ciphertext module size is less than the total ciphertext module size, the computing device determines the number of blocks for the multiple second elements based on the first difference; subsequently, the computing device can divide the multiple second elements according to the number of blocks, obtaining multiple element blocks, and selecting the second element included in the element block with the largest sum of elements among the multiple element blocks as the first element. When the first difference is less than the total ciphertext module size, if the ciphertext module is not divided into blocks, the size of the extra module cannot meet the requirement of not being smaller than the size of the ciphertext module. By dividing the ciphertext module into blocks, it is ensured that the determined extra module can successfully achieve noise control. Furthermore, different methods exist for obtaining the first element for different relationships between the first difference and the total ciphertext module size, providing high flexibility.

[0010] In one possible implementation, determining the number of blocks for multiple second elements based on the first difference includes: dividing the total modulus size of the ciphertext by the first difference, and determining an initial number based on the quotient; subsequently, the computing device verifies the initial number, and if the initial number passes verification, it is used as the number of blocks. The determined initial number is further verified, resulting in high reliability of the determined number of blocks.

[0011] In one possible implementation, the initial quantity is verified, and the verified initial quantity is used as the block quantity. This includes: determining the reference modulus size corresponding to the initial quantity; if the reference modulus size is not greater than a first difference, the initial quantity is deemed to have passed verification, and this initial quantity is used as the block quantity. By comparing the reference modulus size with the first difference, it is ensured that the size of the ciphertext modulus corresponding to the element blocks obtained after dividing multiple second elements according to the initial quantity is smaller than the size of the additional modulus corresponding to that element block, resulting in high reliability of the scheme.

[0012] In one possible implementation, multiple second elements are divided according to the number of blocks, including: determining the number of elements in each element block within the multiple element blocks based on the number of blocks; and the computing device sequentially dividing the multiple second elements according to the number of elements in each element block. Determining the number of elements in each element block before dividing the multiple second elements refines the division process and increases accuracy.

[0013] In one possible implementation, before generating multiple second prime numbers from multiple first elements, the method further includes: obtaining an upper limit of the device size of the computing device, which indicates the upper limit of the size of the modulus that the computing device can process; then, the computing device divides the sum of the multiple first elements by the upper limit of the device size and determines a lower limit of the number of factorizations based on the quotient. Determining the lower limit of the number of factorizations based on the upper limit of the device size of the computing device ensures that the computing device can support applications with additional moduli.

[0014] In one possible implementation, generating multiple second prime numbers based on multiple first elements includes: a computing device generating multiple third elements corresponding to an additional modulus based on the multiple first elements, wherein the third elements represent the dimensions of the second prime numbers; subsequently, the computing device can generate individual second prime numbers based on the dimensions of each second prime number. Since the dimensions of the ciphertext modulus are referenced previously, the dimensions of the second prime numbers decomposed from the additional modulus are determined first, and then the second prime numbers are generated based on these dimensions. This breaks down the problem of generating the value of the additional modulus based on the dimensions of the ciphertext modulus into two steps: determining the dimensions of the second prime numbers of the additional modulus based on the dimensions of the ciphertext modulus, and then generating the second prime numbers based on these dimensions. The logic between these steps is clear and easy to execute.

[0015] In one possible implementation, the additional modulus is determined based on multiple second prime numbers, including: the computing device multiplies the second prime numbers together, and the product of the multiplications is used as the additional modulus. Obtaining the additional modulus simply by multiplying the second prime numbers together is a simple and easy-to-implement method.

[0016] Secondly, a device for determining a switching key is provided. This device is applied to a computing device and includes: an acquisition module for acquiring a plurality of first elements, each first element representing the size of a first prime number, the first prime number being obtained by ciphertext modulus decomposition of a target ciphertext; a generation module for generating a plurality of second prime numbers based on the plurality of first elements, the number of the plurality of second prime numbers being greater than or equal to a lower limit of the number of decompositions of the additional modulus of the target ciphertext, and less than the number of the plurality of first elements; and a determination module for determining an additional modulus based on the plurality of second prime numbers, and generating a switching key based on the additional modulus, the switching key being used to switch the key of the target ciphertext.

[0017] In one possible implementation, an acquisition module is used to acquire multiple second elements, the number of which is the same as the number of first prime numbers obtained from the ciphertext modulus decomposition of the target ciphertext, with each second element representing the size of a first prime number; calculate the sum of the multiple second elements to obtain the total modulus size of the ciphertext; acquire the upper limit of the algorithm size corresponding to the target ciphertext, the upper limit of the algorithm size indicating the upper limit of the modulus size supported by the homomorphic algorithm corresponding to the target ciphertext; and select a second element from the multiple second elements as the first element based on the upper limit of the algorithm size and the total modulus size of the ciphertext.

[0018] In one possible implementation, the acquisition module is used to take each of the multiple second elements as the first element based on a first difference between the upper limit of the algorithm size and the total modulus size of the ciphertext not being less than the total modulus size of the ciphertext.

[0019] In one possible implementation, the acquisition module is used to determine the number of blocks for multiple second elements based on a first difference between the upper limit of the algorithm size and the total modulus size of the ciphertext, which is less than the total modulus size of the ciphertext; the multiple second elements are divided according to the number of blocks to obtain multiple element blocks; and the second element included in the element block with the largest sum of elements among the multiple element blocks is taken as the first element.

[0020] In one possible implementation, the acquisition module is used to divide the total modulus size of the ciphertext by a first difference, determine the initial quantity based on the quotient, verify the initial quantity, and use the verified initial quantity as the number of blocks.

[0021] In one possible implementation, an acquisition module is used to determine the reference modulus size corresponding to the initial quantity; based on the reference modulus size not being greater than a first difference, the initial quantity verification is passed, and the initial quantity is used as the block quantity.

[0022] In one possible implementation, the acquisition module is used to determine the number of elements in each element block among multiple element blocks based on the number of blocks; and to sequentially divide the multiple second elements according to the number of elements in each element block.

[0023] In one possible implementation, the determining module is further configured to obtain the upper limit of the device size of the computing device, which indicates the upper limit of the size of the modulus that the computing device can process; and to divide the sum of multiple first elements by the upper limit of the device size, and determine the lower limit of the number of decompositions based on the obtained quotient.

[0024] In one possible implementation, a generation module is used to generate multiple third elements corresponding to additional moduli based on multiple first elements, the third elements being used to represent the size of the second prime number; and to generate each second prime number based on the size of each second prime number.

[0025] In one possible implementation, a module is defined for multiplying the second prime number, and the product of the multiplications is used as an additional modulus.

[0026] Thirdly, a computing device is provided, the device including a memory and a processor; the memory stores at least one instruction, the at least one instruction being loaded and executed by the processor to enable the computing device to implement the method for determining the switching key as described in any of the first aspects.

[0027] Fourthly, a computer-readable storage medium is provided, wherein at least one instruction is stored in the computer-readable storage medium, the instruction being loaded and executed by a processor to implement the method for determining the switching key as described in any of the first aspects.

[0028] Fifthly, a computer program product is provided, comprising a computer program / instructions, which are executed by a processor to enable a computer to implement the method for determining the switching key as described in any of the first aspects.

[0029] A sixth aspect provides a communication device comprising: a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other via an internal connection path. The memory stores instructions, and the processor executes the instructions stored in the memory to control the transceiver to receive and transmit signals. When the processor executes the instructions stored in the memory, it causes the processor to perform the method of the first aspect or any possible implementation thereof.

[0030] Optionally, the processor may be one or more, and the memory may be one or more.

[0031] Optionally, the memory may be integrated with the processor, or the memory may be separated from the processor.

[0032] In the specific implementation process, the memory can be a non-transitory memory, such as read-only memory (ROM), which can be integrated with the processor on the same chip or set on different chips. This application does not limit the type of memory or the way the memory and processor are set.

[0033] In a seventh aspect, a chip is provided, including a processor for calling and running program instructions or code stored in a memory, causing a communication device on which the chip is installed to perform the methods in the foregoing aspects.

[0034] Eighthly, another chip is provided, comprising: an input interface, an output interface, a processor, and a memory, wherein the input interface, the output interface, the processor, and the memory are connected via an internal connection path, and the processor is used to execute code in the memory, wherein when the code is executed, the processor is used to perform the methods in the above aspects.

[0035] It should be understood that the beneficial effects of the technical solutions and corresponding possible implementations of the second to eighth aspects of the embodiments of this application can be referred to the above-described technical effects of the first aspect and its corresponding possible implementations, and will not be repeated here. Attached Figure Description

[0036] Figure 1 A schematic diagram of an implementation environment provided for an embodiment of this application;

[0037] Figure 2 A flowchart illustrating a method for determining a switching key as provided in an embodiment of this application;

[0038] Figure 3 This is a schematic diagram illustrating a key switching application provided in an embodiment of this application;

[0039] Figure 4 A schematic diagram illustrating the correspondence between ciphertext modulus and additional modulus provided in this application embodiment;

[0040] Figure 5 A schematic diagram illustrating the correspondence between another ciphertext modulus and an additional modulus provided for an embodiment of this application;

[0041] Figure 6 A schematic diagram illustrating the correspondence between another ciphertext modulus and an additional modulus provided in an embodiment of this application;

[0042] Figure 7 A flowchart of a key switching process provided in this application embodiment;

[0043] Figure 8 A schematic diagram of a device for determining a switching key provided in an embodiment of this application;

[0044] Figure 9 This application provides a schematic diagram of the structure of a network device according to an embodiment of the present application.

[0045] Figure 10 This is a schematic diagram of another network device provided in an embodiment of this application. Detailed Implementation

[0046] The terminology used in the embodiments section of this application is only for explaining specific embodiments of this application and is not intended to limit this application. To make the objectives, technical solutions, and advantages of this application clearer, the embodiments of this application will be further described in detail below with reference to the accompanying drawings.

[0047] With the development of computer technology, more and more application scenarios involve homomorphic encryption technology. After homomorphically encrypting plaintext to obtain ciphertext, calculations can be directly performed on the ciphertext, and the calculation result can be decrypted to obtain the result of the corresponding calculation performed on the plaintext. Homomorphic encryption technology allows for calculations on plaintext without decrypting it to obtain the plaintext, ensuring that the calculation can be completed in an untrusted environment, thus avoiding the risk of plaintext leakage. During ciphertext calculation, a key switching step is used to achieve ciphertext calculation with a smaller ciphertext size. For example, by switching the key, the ciphertext key is changed, thereby converting ciphertexts under different keys to the same key. By unifying the keys of different ciphertexts, the ciphertext size during the ciphertext calculation process can be controlled. However, key switching amplifies the original noise in the ciphertext. Therefore, a switching key with noise control is needed. This application provides a method for determining a switching key, which enables noise control during the key switching process of ciphertext.

[0048] Please refer to Figure 1This illustration shows an implementation environment diagram of the method for determining the switching key provided in this application embodiment. The implementation environment includes a computing device 101 and a ciphertext device 102. The computing device 101 and the ciphertext device 102 establish a communication connection via a wired or wireless network. The ciphertext device 102 is a device that provides the ciphertext to be calculated. The ciphertext device 102 can perform homomorphic encryption on plaintext to obtain the ciphertext, and it can also receive homomorphically encrypted ciphertext sent by other devices. Regardless of how the ciphertext device 102 obtains the ciphertext to be calculated, it can send the ciphertext to the computing device 101 based on the communication connection with the computing device 101. For example, the ciphertext to be calculated is... Figure 1 The shown (c1, c2, ..., c n ).

[0049] After receiving the ciphertext to be calculated, the computing device 101 determines the target ciphertext requiring key switching from the ciphertext to be calculated, and then determines the switching key based on multiple first elements of the target ciphertext using the method provided in this embodiment. The determined switching key can also be used to perform key switching on the target ciphertext, ensuring the smooth execution of the ciphertext calculation. After completing the calculation of the ciphertext, the computing device 101 returns the calculation result to the ciphertext device 102. For example... Figure 1 The computing device 101 shown will calculate the result c result Send to encrypted device 102.

[0050] The computing device 101 can be a server, such as a central server, an edge server, or a local server in a local data center. The server can be a physical server or a cloud server providing cloud computing services. In some embodiments, the computing device 101 can also be a terminal device such as a desktop computer, laptop computer, or smartphone; of course, the computing device 101 can also be other network devices that support data processing. Furthermore, the above examples are intended to illustrate one scenario of the computing device 101, where the computing device 101 can be as follows... Figure 1 The diagram shows a network device performing encrypted computation. The computing device 101 can also be independent of the network device performing encrypted computation; that is, the computing device 101 can establish a communication connection with the network device performing encrypted computation. After determining the switching key, the computing device 101 sends the determined switching key to the network device performing encrypted computation, so that the network device performs encrypted computation based on the received switching key. Optionally, the encrypted device 102, similar to the computing device 101, can also be a server, a terminal, or other network device.

[0051] This application provides a method for determining a switching key, which can be applied to the above-mentioned... Figure 1 The implementation environment shown indicates that this method can be implemented by Figure 1 The method is executed by the computing device 101, and the flowchart of the method is as follows. Figure 2 As shown, it includes S201-S203.

[0052] S201, the computing device acquires a plurality of first elements, one of which represents the size of a first prime number, which is obtained by ciphertext modulus decomposition of the target ciphertext.

[0053] For example, the target ciphertext refers to the ciphertext that needs to be switched via key switching. Whether or not the target ciphertext has undergone ciphertext calculation is not limited in this embodiment. Regardless of whether the target ciphertext has undergone ciphertext calculation, the key switching determination method provided in this embodiment can be used to determine the key switching required during the key switching process, and the process of determining the key switching is similar.

[0054] Figure 3 This is a schematic diagram of a key switching application. See [link / reference] Figure 3 The image above illustrates a case where the target ciphertext is ciphertext for which no ciphertext calculation has been performed. Figure 3 Ciphertext A is encrypted using key s, while ciphertext B is encrypted using key s'. Since the keys for ciphertext A and ciphertext B are different, a key switch is needed for one of the ciphertexts to perform ciphertext computation on ciphertexts using the same key. When the ciphertext undergoing the key switch is... Figure 3 When ciphertext B is shown, the target ciphertext is ciphertext B, and the computing device needs to perform the operations involved in S201-S203 according to the ciphertext modulus of ciphertext B. Of course, the computing device can also choose to switch. Figure 3 The key for ciphertext A in the above diagram is the target ciphertext, which is ciphertext A.

[0055] Optionally, the target ciphertext can also be ciphertext that has already undergone ciphertext computation. See also Figure 3 In the diagram below, ciphertext A and ciphertext C are both encrypted using key s. Multiplying ciphertext A and ciphertext C using ciphertext multiplication results in a change in the key of the resulting ciphertext D. It changes from a single polynomial vector s to two polynomial vectors (s, s...). 2 The ciphertext size of ciphertext D will also expand. Therefore, a key switch is needed to restore ciphertext D to the ciphertext under key s in order to control the ciphertext size. In this case, the target ciphertext is the ciphertext D that has already undergone ciphertext multiplication, that is, the ciphertext D after ciphertext computation.

[0056] In one possible implementation, the process of obtaining multiple first elements includes: obtaining multiple second elements, the number of which is the same as the number of first primes obtained from the ciphertext modulus decomposition of the target ciphertext, with one second element representing the size of a first prime; calculating the sum of the multiple second elements to obtain the total modulus size of the ciphertext; obtaining the upper limit of the algorithm size corresponding to the target ciphertext, the upper limit of the algorithm size indicating the upper limit of the modulus size supported by the homomorphic algorithm corresponding to the target ciphertext; and selecting a second element as the first element from the multiple second elements based on the upper limit of the algorithm size and the total modulus size of the ciphertext.

[0057] Here, the ciphertext modulus refers to the modulus used for ciphertext calculations on the target ciphertext, indicating the counting range during these calculations. However, since the size of the ciphertext modulus is a large integer with multiple precisions, directly using the ciphertext modulus for ciphertext calculations leads to low computational efficiency. Therefore, in actual calculations, the ciphertext modulus is decomposed into multiple smaller first prime numbers based on the Chinese Residue Theorem (CRT). The relationship between the first prime numbers and the ciphertext modulus of the target ciphertext is that multiplying these first prime numbers yields the ciphertext modulus of the target ciphertext, and the sum of the sizes of the multiple first prime numbers is close to the size of the ciphertext modulus of the target ciphertext. Optionally, "close" means that the difference between the sum of the sizes of the first prime numbers and the size of the ciphertext modulus of the target ciphertext is no greater than a reference threshold set based on experience.

[0058] Figure 4 This is a schematic diagram illustrating the correspondence between the ciphertext modulus and the additional modulus, provided in an embodiment of this application. Figure 4 The figure shows a decomposed ciphertext modulus Q, where Q = q0q1…q L Each q i Let L be a single-precision first prime number. L is a positive integer, and i is an identifier used to distinguish the first prime number, with a value ranging from 0 to L. By decomposing the ciphertext modulus of the target ciphertext into multiple first prime numbers from a multi-precision integer, the size of the ciphertext modulus is effectively reduced, the computational efficiency of ciphertext calculation is improved, and high-performance computing is achieved. The multiple second elements that the computing device needs to obtain are used to represent the size of all the first prime numbers decomposed from the ciphertext modulus of the target ciphertext. There is a one-to-one correspondence between the multiple second elements and the first prime numbers, with each second element representing the size of one first prime number.

[0059] Optionally, the computing device can first determine the ciphertext modulus of the target ciphertext, then decompose the ciphertext modulus into multiple first prime numbers, and obtain multiple second elements based on the size of the decomposed first prime numbers. The number of first prime numbers into which the ciphertext modulus is decomposed can be set based on the ciphertext computation object, which refers to the object that provides the target ciphertext and performs calculations on it using the computing device. That is, after providing the target ciphertext, the ciphertext computation object will input the number of first prime numbers into the computing device to specify how many first prime numbers the target ciphertext modulus needs to be decomposed into. The computing device decomposes the ciphertext modulus based on the received number of first prime numbers. Alternatively, the computing device may receive multiple second elements sent by other network devices. After obtaining the multiple second elements, the computing device will add the multiple second elements together, and use the sum as the total ciphertext modulus size of the target ciphertext.

[0060] In addition to acquiring multiple second elements, the computing device also needs to acquire an upper limit for the algorithm size. This upper limit indicates the upper limit of the modulus size supported by the homomorphic algorithm corresponding to the target ciphertext. The homomorphic algorithm corresponding to the target ciphertext refers to the homomorphic encryption performed on the target ciphertext using this algorithm. The upper limit of the supported modulus size means that when the modulus involved in the ciphertext calculation exceeds the upper limit, the security strength of the homomorphic algorithm will decrease, thus failing to achieve the required security strength. Optionally, the upper limit of the algorithm size can be determined based on data such as the security strength of the homomorphic algorithm and the multinomial dimension. The upper limit of the algorithm size is determined according to the correspondence between security strength, multinomial dimension, and the upper limit of the algorithm size.

[0061] For example, a procedure for determining the upper limit of the algorithm size involves inputting the security strength and multinomial dimension values ​​of the homomorphic algorithm into the procedure, and then determining the upper limit of the algorithm size based on the received data. This procedure can be a standalone application, a program running on a website, or a mini-program within an application; this application embodiment does not limit this. Furthermore, both the multinomial dimension and the security strength can be set by the encrypted computation object.

[0062] It should be noted that the above examples are intended to illustrate that when a computing device obtains multiple first elements, it involves obtaining the upper limit of the algorithm size and the total modulus size of the ciphertext, rather than limiting the order in which these two parameters are obtained. The computing device may choose to calculate the total modulus size of the ciphertext first, as shown in the above embodiments, and then obtain the upper limit of the algorithm size. Alternatively, the computing device may choose to obtain the upper limit of the algorithm size first, then calculate the total modulus size of the ciphertext, or simultaneously obtain both parameters.

[0063] Regardless of the acquisition order in which the total modulus size of the ciphertext and the upper limit of the algorithm size are obtained, the computing device can select a second element as the first element from multiple second elements based on the upper limit of the algorithm size and the total modulus size of the ciphertext. Optionally, the computing device can acquire multiple first elements through methods including but not limited to the following two approaches.

[0064] Method 1: Based on the premise that the first difference between the upper limit of the algorithm size and the total modulus size of the ciphertext is not less than the total modulus size of the ciphertext, each of the multiple second elements is taken as the first element.

[0065] For example, since the size of a module is positively correlated with its numerical value, the larger the numerical value of a module, the larger its size will be. That is, if the size of module A is greater than the size of module B, then the numerical value of module A will be greater than that of module B. Therefore, the size of the additional module must meet the requirement of not being less than the size of the ciphertext module to ensure that the numerical value of the additional module is not less than the numerical value of the ciphertext module, thereby achieving noise control. Furthermore, since the first difference reflects the size of the remaining modules in the computing device, that is, the maximum size that the additional module can occupy, when the first difference is not less than the total size of the ciphertext modules, the additional module can meet the requirement that its size is not less than the size of the ciphertext modules without exceeding the first difference. Based on this, the computing device does not need to divide the ciphertext modules into blocks, and therefore does not need to divide multiple second elements into blocks. Each second element can be used as the first element.

[0066] With the target ciphertext level parameter L = 12, and the ciphertext modulus Q = {q0, q1, ... q}, the ciphertext level parameter is 12. L Given multiple second elements {50, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30, 30}, a security strength λ = 128, a polynomial dimension n = 32678, and a maximum device size of 64 bits for the computing device, with a corresponding maximum algorithm size of 881, the determined total modulus size of the ciphertext is 410, and the first difference is 471. In this case, 471 > 410, so each second element can be determined as the first element.

[0067] Method 2: Based on the fact that the first difference between the upper limit of the algorithm size and the total modulus size of the ciphertext is less than the total modulus size of the ciphertext, determine the number of blocks for multiple second elements according to the first difference; divide the multiple second elements according to the number of blocks to obtain multiple element blocks, and take the second element included in the element block with the largest sum of elements among the multiple element blocks as the first element.

[0068] Since the first difference is smaller than the total ciphertext modulus size, if the ciphertext modulus of the target ciphertext is not divided into blocks, the size of the additional modulus corresponding to that ciphertext modulus will be smaller than the size of the ciphertext modulus, and the value of the additional modulus corresponding to that ciphertext modulus will also be smaller than the value of the ciphertext modulus, thus making noise control impossible. Therefore, the computing device needs to divide the multiple first prime numbers of the ciphertext modulus into different prime number blocks, with each prime number block containing at least one first prime number. Let the ciphertext modulus Q = q0q1…q L For example, divide the first prime number q0-q5 into a prime number block, and divide q6 to q... L The elements are then divided into another prime number block. Correspondingly, the multiple second elements used to indicate the size of the first prime number are also divided into multiple element blocks. The elements included in an element block indicate the size of the first prime number corresponding to that element within the prime number block. Furthermore, the size of the ciphertext modulus corresponding to each element block is smaller than the size of the extra modulus corresponding to that element block. The ciphertext modulus corresponding to an element block is the product of the first prime numbers in the prime number blocks corresponding to that element block. Different element blocks have the same extra modulus.

[0069] With the target ciphertext having a ciphertext level parameter L = 55 and a ciphertext modulus Q = {q0, q1, ... q}, the ciphertext level parameter L = 55 is used. L Given multiple second elements {28, 20, 20, 20, ..., 20}, a security strength λ = 128, a polynomial dimension n = 65536, and an upper limit of the algorithm size corresponding to this security strength of 1553, taking a computing device with an upper limit of 28 bits as an example, the determined total modulus size of the ciphertext is 1128, and the first difference is 425. In this case, 425 < 1128, and the first difference is less than the total modulus size of the ciphertext. Therefore, it is necessary to determine the number of blocks to divide the multiple second elements according to the number of blocks. Furthermore, when using this parameter configuration to continue the examples below, it will be referred to as Case Two.

[0070] Optionally, the computing device divides the total ciphertext modulus by a first difference, and determines an initial quantity based on the quotient. The initial quantity is then verified, and the verified initial quantity is used as the number of blocks. Determining the initial quantity means selecting the integer with the smallest difference from the obtained quotient, which is greater than the quotient, as the initial quantity. The initial quantity reflects the minimum number of element blocks that multiple second elements need to be divided into to ensure that the average sum of the elements in each element block is not greater than the first difference. For example, when the total ciphertext modulus is 1128 and the first difference is 425, the ciphertext modulus divided by the first difference is 1128 / 425 = 2.654. ​​This means that at least 3 element blocks are needed to ensure that the average sum of the elements in each element block is not greater than the first difference.

[0071] However, while the initial quantity ensures that the average sum of elements in each element block is not greater than the first difference, when the distribution of multiple second elements is irregular—for example, the numerical difference between second elements exceeds an empirically set difference threshold—some element blocks may have a sum greater than the first difference, while others may have a sum much smaller. Therefore, the average sum of elements across multiple element blocks will not exceed the first difference. Based on this, after determining the initial quantity, the computing device needs to verify the initial quantity to confirm that the sum of elements in the element blocks divided according to the initial quantity is not greater than the first difference.

[0072] For example, the computing device determines a reference modulus size corresponding to the initial quantity and judges the relationship between the reference modulus size and a first difference to verify the initial quantity. During the verification process, based on the principle of uniform division, the initial quantity of elements included in each element block is determined. Then, the first sum of elements in each element block is calculated according to the initial quantity of each element block. The maximum value of the first sum of each element block is used as the reference modulus size, and the relationship between the reference modulus size and the first difference is compared. When the reference modulus size is not greater than the first difference, the initial quantity verification is deemed successful, and the initial quantity is used as the block quantity.

[0073] Continuing with the example of the target ciphertext in scenario two above, the initial quantity verification formula is: min(set1, set2, set3){max{Σ(i∈set1)q i ,Σ(i∈set2)q i ,Σ(i∈set3)q i} = 380 bits < 425 bits, where set1, set2, and set3 refer to three blocks of elements evenly divided according to the initial quantity, Σ(i∈set1)q i This refers to adding all elements belonging to set1 together to obtain the first sum of set1. Since there are 56 second elements, we can determine that there are 18 second elements in set1 and 19 second elements in set2 and set3 according to the principle of uniform distribution. Therefore, the first sum of set1 is 368, and the first sum of set2 and set3 is 380. Taking the maximum value of the first sum, 380, as the reference modulus, and since 380 is less than the first difference, 425, the initial quantity of 3 is verified to be 3. Of course, the computing device can also verify the initial quantity of other numerical values. For example, when the initial quantity is 2, min(set1, set2){max{Σ(i∈set1)q i ,Σ(i∈set2)q i}} = 568 bits > 425 bits. Therefore, based on the initial quantity verification formula above, the number of blocks containing multiple second elements in case two is calculated to be 3.

[0074] For example, after determining the number of blocks, the computing device can divide the multiple second elements according to the number of blocks. The division process includes: determining the number of elements in each element block in the multiple element blocks according to the number of blocks; and dividing the multiple second elements sequentially according to the number of elements in each element block.

[0075] The process of determining the number of elements in each element block includes: calculating the number of elements in each element block based on the number of blocks, the first difference, and the number of multiple second elements. Since the size of the extra modulus must be no less than the size of its corresponding ciphertext modulus, the size of the ciphertext modulus after block division must satisfy the condition that it is no greater than the first difference. That is, after dividing multiple second elements, the sum of the values ​​of the elements included in any element block cannot be greater than the first difference. Taking case two of the above acquisition method two as an example, where the calculated number of blocks is 3, based on this property, the calculation formula is as follows:

[0076]

[0077] Here, k1, k2, and k3 represent the number of elements in each element block that needs to be determined. Besides satisfying the constraints mentioned above, the number of elements in each element block also needs to be determined because each element block is actually a division of multiple second elements. The total number of elements in each element block is equal to the number of the multiple second elements, and the number of elements in each of the three element blocks is greater than or equal to 1, and will not exceed the number of the multiple second elements. In other words, k1, k2, and k3 also satisfy the constraints k1 + k2 + k3 = 55 and 1 ≤ k1, k2, k3 ≤ 55.

[0078] The computing device can calculate the number of elements in each element block according to the above constraints. For example, a solution for k1, k2, and k3 is (k1, k2, k3) = (18, 19, 18). The device then divides the multiple second elements according to the number of elements in each element block, resulting in multiple element blocks. From these element blocks, the computing device selects the element block with the largest sum of elements, and uses its included second elements as the first element. Here, the sum of elements in each element block represents the size of the ciphertext modulus corresponding to each element block. Since the ciphertext modulus is divided into multiple blocks, the ciphertext modulus corresponding to multiple element blocks uses the same additional modulus for noise control; that is, the size of the determined additional modulus must be no less than the size of the ciphertext modulus corresponding to each element block. Therefore, the element block with the largest sum of elements among the element blocks can be selected. Thus, when the size of the additional modulus is not less than the size of the ciphertext modulus corresponding to the selected element block, it means that the size of the additional modulus will not be less than the size of the ciphertext modulus corresponding to other element blocks. This additional modulus can be used for noise control with the ciphertext modulus corresponding to each element block. Continuing with the element block division in the above case two as an example, the determined multiple first elements are 1 x 28 and 18 x 20.

[0079] Based on the above examples, it can be understood that multiple first elements can be all second elements. In this case, the first prime numbers corresponding to the multiple first elements are all the first prime numbers among the multiple first prime numbers obtained from the ciphertext modulus decomposition of the target ciphertext. Multiple first elements can also be some second elements. In this case, the first prime numbers corresponding to the multiple first elements are some of the first prime numbers among the multiple first prime numbers obtained from the ciphertext modulus decomposition of the target ciphertext. Regardless of the type of the multiple first elements, their corresponding additional modulus can be determined based on the method of the embodiments of this application, and the principle for determining the additional modulus is similar.

[0080] Furthermore, the above examples are intended to illustrate a scenario where the number of blocks is determined based on the principle that the size of the additional modulus is not less than the size of the ciphertext modulus corresponding to the multiple first elements, rather than to define the process for determining the number of blocks. In some cases, the computing device can determine the number of blocks based on computational performance requirements or other requirements such as the implementation environment, while ensuring that the size of the additional modulus is not less than the size of the ciphertext modulus corresponding to the multiple first elements. For example, although a block count of 2 is sufficient to satisfy the requirement that the size of the additional modulus is not less than the size of the ciphertext modulus, the ciphertext computation object also has algorithm performance requirements. Based on the algorithm performance requirements, the computing device sets the number of blocks to 3.

[0081] S202, the computing device generates multiple second prime numbers based on multiple first elements, the number of multiple second prime numbers being greater than or equal to the lower limit of the number of factorizations of the additional modulus of the target ciphertext, and less than the number of multiple first elements.

[0082] In this embodiment, similar to the reason for decomposing into multiple first prime numbers shown in S201, since the extra modulus itself is also a large integer, directly using the extra modulus for key switching would affect computational efficiency. Therefore, the extra modulus is also represented in polynomial form based on the CRT, that is, decomposed into multiple single-precision second prime numbers. For example... Figure 4 The additional modulus P shown is decomposed into multiple second prime numbers p. j j is an identifier used to distinguish different second prime numbers, and belongs to the positive integers in the range of 1-α, where α is a positive integer.

[0083] Furthermore, when implementing noise control, the additional modulus must satisfy the condition that its value is not less than the value of the ciphertext modulus. There is no requirement regarding the number of second primes the additional modulus can be factored into, i.e., the number of factorizations of the additional modulus. Since the number of factorizations of the additional modulus affects the storage space size of the determined switching key and the computational complexity of key switching, the computing device, in determining the additional modulus, will first calculate a lower limit for the number of factorizations of that additional modulus to control the storage space size and computational complexity.

[0084] In one possible implementation, the process of determining the lower limit of the number of decompositions by the computing device includes: obtaining the upper limit of the device size of the computing device, which indicates the upper limit of the size of the modulus that the computing device can process; dividing the sum of multiple first elements by the upper limit of the device size, and determining the lower limit of the number of decompositions based on the quotient. The upper limit of the device size of the computing device indicates the maximum size of the modulus that the computing device supports when key switching is running smoothly. The upper limit of the device size can be determined based on the hardware structure of the computing device or based on the software of the computing device; this embodiment does not limit this. Optionally, the lower limit of the number of decompositions is less than the number of multiple first elements.

[0085] Taking the multiple second elements in Case 1 as an example, since each second element is treated as a first element, the sum of the multiple first elements, which is also the total modulus size of the ciphertext calculated in S201, is 410 bits. Since the upper limit of the computing device's size is 64 bits, the lower limit of the calculated number of decompositions is [410 / 64] = 7. The square brackets [] represent rounding. Based on 410 / 64 = 6.40625, which is greater than 6, it can be understood that, without exceeding the upper limit of the computing device's processing size, at least 7 second prime numbers are needed to form an additional modulus greater than the ciphertext modulus. Therefore, the lower limit of the number of decompositions for the additional modulus is equal to 7.

[0086] When multiple first elements are obtained by partitioning multiple second elements, the sum of the partitioned first elements needs to be recalculated. Taking the multiple second elements in case two as an example, the lower limit of the number of decompositions of the extra modulus corresponding to the multiple first elements obtained by partitioning is [(28+20×k1) / 28]=[388 / 28]=14.

[0087] In one possible implementation, after determining the lower limit of the number of factorizations, the computing device can generate multiple third elements corresponding to the additional modulus according to the lower limit of the number of factorizations, whereby the third elements are used to represent the size of the second prime number corresponding to the third element; and generate each second prime number according to the size of each second prime number.

[0088] For example, for each second prime number to be determined, there is a one-to-one corresponding third element, which represents the size of its corresponding second prime number. The above describes the correspondence between the third element and the second prime number. Since there is a correspondence between the size and value of a prime number, and since the aforementioned operations, such as determining whether to divide the ciphertext modulus and dividing the ciphertext modulus, are all based on the size of the modulus, a third element representing the size can be generated first, and then the second prime number can be generated based on the third element according to the correspondence between the size and the value. The additional modulus representing the size of these multiple third elements is an additional modulus used for noise control during key switching based on the ciphertext moduli corresponding to multiple first elements.

[0089] Optionally, since the lower bound on the number of factorizations reflects the minimum number of second primes that the additional modulus can be factored into, that is, the minimum number of multiple second primes. When the number of factorizations of the additional modulus is less than the number of multiple first elements, the number of factorizations of the additional modulus can also be controlled, thereby optimizing the complexity of key switching. Therefore, the computing device can choose any positive integer within the numerical range of the lower bound on the number of factorizations and the number of multiple first elements as the number of factorizations of the additional modulus, that is, the number of multiple second primes.

[0090] For example, the computing device can use a lower limit on the number of factorizations as the number of factorizations for the additional modulus to minimize the number of factorizations for the additional modulus. Regardless of how the computing device determines the number of factorizations for the additional modulus, since there is a one-to-one correspondence between the second prime number and the third element, the number of multiple third elements is the same as the number of factorizations for the additional modulus. Furthermore, none of the third elements can exceed the upper limit of the device size, and the sum of multiple third elements must be greater than or equal to the sum of multiple first elements, and not greater than the first difference. Based on these constraints, the computing device can generate multiple third elements.

[0091] The following explanation uses the lower bound of the number of decompositions as the number of decompositions for the additional modulus as an example to illustrate the process of generating multiple third elements. Continuing with the example of multiple second elements in Case 1, when the lower bound of the number of decompositions is 7, the multiple third elements corresponding to the additional modulus P are set to {60, 60, 60, 60, 60, 60, 60, 50}. Taking the example of multiple second elements in Case 2, when the lower bound of the number of decompositions is 14, the multiple third elements corresponding to the additional modulus P are set to {28, 28, ..., 28, 24}.

[0092] Since there is a correspondence between the size and value of a prime number, the value of the second prime number corresponding to a given size can be determined based on the size of each second prime number. For example, if the integer corresponding to a given size is determined, the prime number closest to that integer can be taken as the second prime number corresponding to that size. Optionally, the values ​​of the second prime numbers can be different.

[0093] S203, the computing device determines an additional modulus based on a plurality of second prime numbers, generates a switching key based on the additional modulus, and the switching key is used to switch the target ciphertext.

[0094] For example, the computing device determines an additional modulus based on a plurality of second prime numbers, including: the computing device multiplies the second prime numbers together and uses the product of the multiplications as the additional modulus. The determined additional modulus is used to control noise during key switching using the ciphertext moduli corresponding to the plurality of first elements. When the plurality of first elements are multiple undivided second elements, the ciphertext modulus corresponding to the plurality of first elements is also the ciphertext modulus of the target ciphertext.

[0095] Optionally, when multiple first elements are obtained by dividing the data into multiple second elements, the ciphertext modulus corresponding to the multiple first elements is the modulus obtained by dividing the target ciphertext modulus into blocks according to the number of blocks. See also Figure 5 It shows a schematic diagram of the correspondence between the ciphertext modulus and the extra modulus when the ciphertext modulus is case two. Figure 5 The product of Q1, Q2, and Q3 in the target ciphertext is equal to the ciphertext modulus Q. Figure 5 The thick lines in the diagram represent the boundaries between different element blocks obtained from multiple second-element divisions. Taking the top-down direction as an example, the ciphertext modulus corresponding to the first element block is Q1, the ciphertext modulus corresponding to the second element block is Q2, and the ciphertext modulus corresponding to the third element block is Q3.

[0096] Since the size of the additional modulus is already limited during the determination of the second prime number—meaning the sum of the multiple third elements is not less than the sum of the multiple first elements—and based on the principle that there is a positive correlation between the size of the modulus and its numerical value, it follows that when the size of the additional modulus is not less than the ciphertext modulus corresponding to the multiple first elements, the numerical value of the additional modulus will also not be less than the numerical value of the ciphertext modulus corresponding to the multiple first elements. Therefore, noise control can be performed during key switching.

[0097] In one possible implementation, after determining the additional modulus, the computing device can determine a key switching key (KSKey) based on the additional modulus to continue key switching.

[0098] Taking case one as an example, the correspondence between the additional modulus P and the ciphertext modulus Q is determined by referring to [reference needed]. Figure 6 The ciphertext modulus consists of 13 first prime numbers, the size of which can be found in [reference needed]. Figure 6 The numbers within the rectangular frame. The additional modulus consists of 7 second prime numbers, where p1 = 60, p1 refers to the second prime number, and 60 is the size of the second prime number, which is also the third element corresponding to the second prime number. Based on this, the switching key is determined as: c0 = -c1×s + e + P×s new modPQ. Where c0 and c1 are the ciphertext components of the target ciphertext, e is noise, and s is the key before the target ciphertext is switched. new Let P be the key after the target ciphertext is switched, where P is the extra modulus and Q is the ciphertext modulus.

[0099] Taking case two as an example, the correspondence between the determined additional modulus and the ciphertext modulus is shown in [reference needed]. Figure 5 It shows the correspondence between the ciphertext modulus divided into 3 prime number blocks and the additional modulus. The ciphertext modulus Q1, Q2 and Q3 corresponding to the three element blocks are used to achieve noise control through an additional modulus P. Figure 5 The correspondence between elements in Figure 6 The correspondence between the elements in the table is similar and will not be elaborated upon here. Based on Figure 5 The switching key determined in the shown case is:

[0100]

[0101] in, and Let be the ciphertext component of the target ciphertext, e be the noise, and s be the key before the target ciphertext is switched. newLet P be the key after the target ciphertext is switched, P be the extra modulus, Q be the ciphertext modulus, and Q1, Q2, and Q3 be the ciphertext modulus corresponding to the three element blocks. Trans is a function that returns a constant (const). Trans(Q1→Q) means that the returned const satisfies const modQ / Q1=0 and const modQ1=1.

[0102] In summary, the method for determining the switching key provided in this application first calculates the lower limit of the number of factorizations of the extra modulus, thereby determining the minimum number of second prime numbers required to ensure that the determined extra modulus is not less than the ciphertext modulus. This allows control over the number of factorizations of the extra modulus during the determination process. By controlling the number of factorizations of the extra modulus, the determined switching key can reduce the computational complexity of key switching, thereby reducing computation time and improving computational efficiency. Furthermore, controlling the number of factorizations of the extra modulus can also reduce the key memory storage size of the switching key, thereby reducing data transfer time during the key switching process and further improving computational efficiency.

[0103] Based on the above-described method for determining the switching key, this application describes the key switching process in its embodiments. Figure 7 The flowchart of a key switching provided in this application embodiment is shown as an example. This key switching can be performed by a computing device.

[0104] S701, from {p i Choose the smallest subset from the set, p i For a single-precision prime number that a computing device can process, such that p in a subset... i The product is greater than or equal to the ciphertext modulus Q.

[0105] The selected minimum subset is also the plurality of second prime numbers involved in the embodiments of this application. Exemplarily, the process of determining the minimum subset is the same as described above. Figure 2 The process of determining multiple second prime numbers in the illustrated embodiments S201-S202 is similar and can be referred to the relevant description, which will not be repeated here.

[0106] S702 generates a switching key based on the selected minimum subset and performs the corresponding key switching calculation.

[0107] For example, the process of generating a switching key based on the selected minimum subset is the same as described above. Figure 2The process of determining the switching key based on multiple second prime numbers in the illustrated embodiment S203 is similar and can be referred to the relevant description, so it will not be repeated here. Performing the corresponding key switching calculation is essentially switching the key of the target ciphertext using the switching key. Taking the switching key KSKey0 = -KSKey1 × s' + e + s as an example, the process of switching the key of the target ciphertext c2 is c2 × KSKey0 = c2(-KSKey1 × s' + e + s). Of course, the key switching calculation process will differ depending on the determined switching key, but the principle is similar, and will not be illustrated in detail here.

[0108] In one possible scenario, when the ciphertext modulus of the target ciphertext is composed of 13 first prime numbers, i.e., the ciphertext modulus shown in Case 1, the performance comparison between the switching key determined by the switching key determination method provided in this application and the switching key determined by the switching key determination method using related technologies is shown in Table 1.

[0109] Table 1

[0110]

[0111] The relevant technique refers to the fact that when the ciphertext modulus is the product of 13 first prime numbers, the number of factorizations of the determined additional modulus is also 13. The additional modulus is then determined based on this 13 factorizations to obtain the switching key. The KS complexity is determined based on the number of number-theoretic transforms (NTT) / inverse number-theoretic transforms (INTT). NTT / INTT are used to implement modulus switching during the key switching process, introducing an additional modulus for noise control on top of the ciphertext modulus. The KS complexity of the relevant technique is 6L = 78, where L is the number of first prime numbers, while the KS complexity of this application is 3L + 3α = 3 × 13 + 3 × 7 = 60, where α is the number of factorizations of the additional modulus. Therefore, the switching key determined in this application effectively reduces the KS complexity by 30%. The memory storage in KS is also related to the number of factorizations of the additional modulus; the memory storage of the relevant technique is 13MB, while the memory storage of this application is 10MB. Therefore, it can be seen that the switching key determined in this application effectively reduces memory storage in KS by 30%.

[0112] In one possible scenario, when the ciphertext modulus of the target ciphertext is composed of 56 first prime numbers, i.e., the ciphertext modulus shown in Case 2, the performance comparison between the switching key determined by the switching key determination method provided in this application and the switching key determined by the switching key determination method using related technologies is shown in Table 2.

[0113] Table 2

[0114]

[0115] In the related technologies, the ciphertext modulus is divided into three blocks. The number of first prime numbers included in each block is determined as the number of decompositions of the additional modulus corresponding to that block, and the additional modulus is determined based on the number of decompositions. The KS complexity and memory storage determination method in Table 2 are similar to those in Table 1, and will not be repeated here. As shown in Table 2, the KS complexity of the related technologies is 373, while the KS complexity of this application is 350. The switching key determined in this application effectively reduces the KS complexity by 6.9%. The memory storage in the KS of the related technologies is 112MB, while the memory storage in the KS of this application is 105MB. The switching key determined in this application effectively reduces the memory storage in the KS by 6.7%.

[0116] In one possible implementation, the key-switching determination method provided in this application embodiment can be applied to the computation scenario of artificial intelligence (AI) model residual network (ResNet) on ciphertext. Using this method for key switching, the computational efficiency of ResNet can be improved by approximately 5%-27%. Furthermore, when performing ciphertext operations, the storage size of the key-switching method can be reduced by 7%-30%, reducing storage and thus reducing data transfer time and improving computational efficiency.

[0117] The above describes the method for determining the switching key according to the embodiments of this application. Corresponding to the above method, the embodiments of this application also provide a device for determining the switching key. Figure 8 This is a schematic diagram of a key-switching determination device provided in an embodiment of this application. Based on Figure 8 The following modules are shown. Figure 8 The device for determining the switching key shown is capable of performing the above. Figure 2 All or part of the operations shown. It should be understood that the device may include more additional modules than those shown, or may omit some of the modules shown; this application embodiment does not impose limitations in this regard. For example... Figure 8 As shown, the device is applied to a computing device, and the device includes:

[0118] The acquisition module 801 is used to acquire multiple first elements. Each first element represents the size of a first prime number, which is obtained by the ciphertext modulus decomposition of the target ciphertext.

[0119] The generation module 802 is used to generate multiple second prime numbers based on multiple first elements. The number of multiple second prime numbers is greater than or equal to the lower limit of the number of factorizations of the additional modulus of the target ciphertext, and less than the number of multiple first elements.

[0120] The determination module 803 is used to determine an additional modulus based on multiple second prime numbers, generate a switching key based on the additional modulus, and use the switching key to switch the target ciphertext.

[0121] In one possible implementation, the acquisition module 801 is used to acquire multiple second elements, the number of which is the same as the number of first primes obtained from the ciphertext modulus decomposition of the target ciphertext, with one second element representing the size of one first prime; calculate the sum of the multiple second elements to obtain the total modulus size of the ciphertext; acquire the upper limit of the algorithm size corresponding to the target ciphertext, the upper limit of the algorithm size indicating the upper limit of the modulus size supported by the homomorphic algorithm corresponding to the target ciphertext; and select a second element from the multiple second elements as the first element based on the upper limit of the algorithm size and the total modulus size of the ciphertext.

[0122] In one possible implementation, the acquisition module 801 is used to take each of the multiple second elements as the first element based on a first difference between the upper limit of the algorithm size and the total modulus size of the ciphertext not being less than the total modulus size of the ciphertext.

[0123] In one possible implementation, the acquisition module 801 is used to determine the number of blocks for multiple second elements based on the first difference between the upper limit of the algorithm size and the total modulus size of the ciphertext being less than the total modulus size of the ciphertext; divide the multiple second elements according to the number of blocks to obtain multiple element blocks; and take the second element included in the element block with the largest sum of elements among the multiple element blocks as the first element.

[0124] In one possible implementation, the acquisition module 801 is used to divide the total modulus size of the ciphertext by the first difference, determine the initial quantity based on the obtained quotient, verify the initial quantity, and use the verified initial quantity as the number of blocks.

[0125] In one possible implementation, module 801 is used to determine the reference modulus size corresponding to the initial quantity; based on the reference modulus size not being greater than the first difference, the initial quantity verification is passed, and the initial quantity is used as the number of blocks.

[0126] In one possible implementation, the acquisition module 801 is used to determine the number of elements in each element block among multiple element blocks based on the number of blocks; and to sequentially divide the multiple second elements according to the number of elements in each element block.

[0127] In one possible implementation, the determining module 803 is further configured to obtain the upper limit of the device size of the computing device, which indicates the upper limit of the size of the modulus that the computing device can process; divide the sum of multiple first elements by the upper limit of the device size, and determine the lower limit of the number of decompositions based on the obtained quotient.

[0128] In one possible implementation, the generation module 802 is used to generate multiple third elements corresponding to the additional modulus according to multiple first elements, the third elements being used to represent the size of the second prime number corresponding to the third element; and to generate each second prime number according to the size of each second prime number.

[0129] In one possible implementation, module 803 is determined to perform a series multiplication on the second prime number and use the product of the series multiplication as an additional modulus.

[0130] In the process of determining the switching key, the above-mentioned device controls the number of second primes of the extra modulus by using the lower limit of the number of factorizations of the extra modulus and the number of multiple first elements. Then, the extra modulus is determined based on the second primes. The resulting switching key has a smaller number of second primes corresponding to the extra modulus, which effectively reduces the computational complexity of key switching, improves computational efficiency, and reduces the memory storage of the switching key.

[0131] It should be understood that the above Figure 8 The provided device, in implementing its functions, is only illustrated by the division of the above-described functional modules. In practical applications, the functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above. Furthermore, the device and method embodiments provided in the above embodiments belong to the same concept, and their specific implementation processes are detailed in the method embodiments, and will not be repeated here.

[0132] See Figure 9 , Figure 9 A schematic diagram of the structure of a network device 900 provided in an exemplary embodiment of this application is shown. Figure 9 The network device 900 shown is used to perform the above. Figure 2 The operation involved in determining the switching key as shown is illustrated. The network device 900 is, for example, a switch, a router, etc., and can be implemented using a general bus architecture.

[0133] like Figure 9 As shown, the network device 900 includes at least one processor 901, a memory 903, and at least one communication interface 904.

[0134] Processor 901 may be, for example, a general-purpose central processing unit (CPU), a digital signal processor (DSP), a network processor (NP), a graphics processing unit (GPU), a neural-network processing unit (NPU), a data processing unit (DPU), a microprocessor, or one or more integrated circuits for implementing the embodiments of this application. For example, processor 901 includes an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or other programmable logic devices, transistor logic devices, hardware components, or any combination thereof. A PLD may be, for example, a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof. It can implement or execute the various logic blocks, modules, and circuits described in connection with the embodiments of this application. A processor may also be a combination that implements computational functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0135] Optionally, network device 900 also includes a bus. The bus is used to transmit information between the components of network device 900. The bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 9 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0136] Memory 903 may be, for example, read-only memory (ROM) or other types of static storage devices capable of storing static information and instructions; random access memory (RAM) or other types of dynamic storage devices capable of storing information and instructions; electrically erasable programmable read-only memory (EEPROM); compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed discs, laser discs, optical discs, digital versatile discs, Blu-ray discs, etc.); magnetic disk storage media or other magnetic storage devices; or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but not limited thereto. Memory 903 may exist independently and be connected to processor 901 via a bus. Memory 903 may also be integrated with processor 901.

[0137] The communication interface 904 uses any transceiver-like device for communicating with other devices or communication networks, such as Ethernet, Radio Access Network (RAN), or Wireless Local Area Network (WLAN). The communication interface 904 can include wired and wireless communication interfaces. Specifically, the communication interface 904 can be an Ethernet interface, a Fast Ethernet (FE) interface, a Gigabit Ethernet (GE) interface, an Asynchronous Transfer Mode (ATM) interface, a WLAN interface, a cellular network communication interface, or a combination thereof. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. In this embodiment, the communication interface 904 can be used by the network device 900 to communicate with other devices.

[0138] In a specific implementation, as one example, the processor 901 may include one or more CPUs, such as... Figure 9 The CPU0 and CPU1 shown are examples of processors. Each of these processors can be a single-core processor or a multi-core processor. A processor here can refer to one or more devices, circuits, and / or processing cores used to process data (e.g., computer program instructions).

[0139] In a specific implementation, as one example, network device 900 may include multiple processors, such as... Figure 9 The processors 901 and 905 are shown in the diagram. Each of these processors can be a single-core processor or a multi-core processor. Here, "processor" can refer to one or more devices, circuits, and / or processing cores used to process data (such as computer program instructions).

[0140] In a specific implementation, as one example, the network device 900 may further include output devices and input devices. The output device communicates with the processor 901 and can display information in various ways. For example, the output device may be a liquid crystal display (LCD), a light-emitting diode (LED) display device, a cathode ray tube (CRT) display device, or a projector, etc. The input device communicates with the processor 901 and can receive user input in various ways. For example, the input device may be a mouse, keyboard, touchscreen device, or sensing device, etc.

[0141] In some embodiments, memory 903 stores program code 910 for executing the solution of this application, and processor 901 can execute the program code 910 stored in memory 903. That is, network device 900 can implement the method for determining the switching key provided in the method embodiment through processor 901 and program code 910 in memory 903. Program code 910 may include one or more software modules. Optionally, processor 901 itself may also store program code or instructions for executing the solution of this application.

[0142] In a specific embodiment, the network device 900 of this application embodiment may correspond to the computing device in the above-described method embodiments.

[0143] in, Figure 2 The steps of the key-switching determination method shown are completed by integrated logic circuits in the hardware or by instructions in the software form of the processor of the network device 900. The steps of the method disclosed in the embodiments of this application can be directly implemented by the hardware processor, or by a combination of hardware and software modules in the processor. The software modules can reside in random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, registers, or other mature storage media in the art. Since the storage medium is located in memory, the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method; to avoid repetition, these will not be described in detail here.

[0144] Figure 10 This is a schematic diagram of another network device provided in an embodiment of this application. This network device is, for example, a server. Servers can vary significantly due to differences in configuration or performance. It may include one or more processors 1001 and one or more memories 1002. The one or more memories 1002 store at least one computer program, which is loaded and executed by the one or more processors 1001 to enable the server to implement the switching key determination method provided in the above-described method embodiments. The processor 1001 is, for example, a central processing unit (CPU). Of course, this network device may also have wired or wireless network interfaces, a keyboard, and input / output interfaces for input / output. The network device may also include other components for implementing device functions, which will not be elaborated here.

[0145] This application also provides a communication device, which includes a transceiver, a memory, and a processor. The transceiver, the memory, and the processor communicate with each other via an internal connection path. The memory stores instructions, and the processor executes the instructions stored in the memory to control the transceiver to receive and transmit signals. Furthermore, when the processor executes the instructions stored in the memory, it causes the processor to perform a method for determining a switching key.

[0146] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. General-purpose processors can be microprocessors or any conventional processor. It is worth noting that the processor can be a processor supporting the Advanced Reduced Instruction Set Computing (RISC) machine (ARM) architecture.

[0147] Furthermore, in an alternative embodiment, the memory described above may include read-only memory and random access memory, and provide instructions and data to the processor. The memory may also include non-volatile random access memory. For example, the memory may also store device type information.

[0148] The memory can be volatile or non-volatile, or may include both. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which serves as an external cache. Many forms of RAM are available by way of example, but not limitation. Examples include static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous linked dynamic random access memory (SLDRAM), and direct rambus RAM (DR RAM).

[0149] This application also provides a computer-readable storage medium storing at least one instruction, which is loaded and executed by a processor to enable a computer to implement the method for determining the switching key as described above.

[0150] This application also provides a computer program (product) that, when executed by a computer, causes the processor or computer to perform the corresponding steps and / or processes in the above method embodiments.

[0151] This application also provides a chip, including a processor, for calling and executing instructions stored in a memory, causing a communication device equipped with the chip to perform the key determination method as described above.

[0152] This application embodiment also provides another chip, including: an input interface, an output interface, a processor, and a memory. The input interface, the output interface, the processor, and the memory are connected through an internal connection path. The processor is used to execute code in the memory. When the code is executed, the processor is used to execute the switching key determination method as described above.

[0153] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive).

[0154] Those skilled in the art will recognize that the method steps and modules described in conjunction with the embodiments disclosed herein can be implemented in software, hardware, firmware, or any combination thereof. To clearly illustrate the interchangeability of hardware and software, the steps and components of each embodiment have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0155] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0156] When implemented using software, it can be implemented wholly or partially as a computer program product. This computer program product includes one or more computer program instructions. As an example, the methods of this application embodiment can be described in the context of machine-executable instructions, such as program modules that execute on a device on a real or virtual processor of the target. Generally, program modules include routines, programs, libraries, objects, classes, components, data structures, etc., which perform specific tasks or implement specific abstract data structures. In various embodiments, the functionality of program modules can be combined or divided among the described program modules. The machine-executable instructions for the program modules can execute within a local or distributed device. In a distributed device, the program modules can reside on both local and remote storage media.

[0157] Computer program code used to implement the methods of the embodiments of this application may be written in one or more programming languages. This computer program code may be provided to the processor of a general-purpose computer, a special-purpose computer, or other programmable switching key determining device, such that when executed by the computer or other programmable switching key determining device, the program code causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The program code may be executed entirely on a computer, partially on a computer, as a standalone software package, partially on a computer and partially on a remote computer, or entirely on a remote computer or server.

[0158] In the context of the embodiments of this application, computer program code or related data may be carried by any suitable carrier to enable a device, apparatus, or processor to perform the various processes and operations described above. Examples of carriers include signals, computer-readable media, etc.

[0159] Examples of signals may include electrical, optical, radio, sound, or other forms of propagation signals, such as carrier waves, infrared signals, etc.

[0160] A machine-readable medium can be any tangible medium that contains or stores programs for or relating to an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. Machine-readable media can include, but are not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. More detailed examples of machine-readable storage media include electrical connections with one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0161] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be found in the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0162] In the embodiments provided in this application, it should be understood that the disclosed systems, devices, and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the couplings or direct couplings or communication connections shown or discussed may be indirect couplings or communication connections through some interfaces, devices, or modules, or they may be electrical, mechanical, or other forms of connection.

[0163] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; that is, they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of the embodiments of this application, depending on actual needs.

[0164] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0165] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computing device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0166] In this application, the terms "first," "second," etc., are used to distinguish identical or similar items that have substantially the same function and purpose. It should be understood that there is no logical or temporal dependency between "first," "second," and "nth," nor does it limit the quantity or order of execution. It should also be understood that although the following description uses the terms "first," "second," etc., to describe various elements, these elements should not be limited by the terms. These terms are merely used to distinguish one element from another. For example, without departing from the various examples described, a first image can be referred to as a second image, and similarly, a second image can be referred to as a first image. Both the first image and the second image can be images, and in some cases, they can be separate and distinct images.

[0167] It should also be understood that, in the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0168] In this application, the term "at least one" means one or more, and the term "multiple" means two or more. For example, multiple second messages refer to two or more second messages. The terms "system" and "network" are often used interchangeably in this document.

[0169] It should be understood that the terminology used in the description of the various examples herein is for the purpose of describing particular examples only and is not intended to be limiting. As used in the description of the various examples and the appended claims, the singular forms “a” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0170] It should also be understood that the term "and / or" as used herein refers to and covers any and all possible combinations of one or more of the associated listed items. The term "and / or" describes an association between related objects, indicating that three relationships can exist; for example, A and / or B can represent: A alone, A and B simultaneously, or B alone. Additionally, the character " / " in this application generally indicates that the preceding and following related objects are in an "or" relationship.

[0171] It should also be understood that the term “comprising” (also referred to as “includes”, “including”, “comprises” and / or “comprising”) as used in this specification specifies the presence of the stated features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0172] It should also be understood that the terms “if” and “if” can be interpreted as meaning “when” or “upon”, or “in response to determination” or “in response to detection”. Similarly, depending on the context, the phrases “if determination…” or “if detection [the stated condition or event]” can be interpreted as meaning “when determination…”, or “in response to determination…”, or “when detection [the stated condition or event]” or “in response to detection [the stated condition or event]”.

[0173] It should be understood that determining B based on A does not mean determining B solely based on A; B can also be determined based on A and / or other information.

[0174] It should also be understood that the phrases "an embodiment," "an embodiment," and "a possible implementation" used throughout the specification mean that a specific feature, structure, or characteristic related to an embodiment or implementation is included in at least one embodiment of this application. Therefore, the phrases "in an embodiment," "an embodiment," or "a possible implementation" appearing throughout the specification do not necessarily refer to the same embodiment. Furthermore, these specific features, structures, or characteristics can be combined in any suitable manner in one or more embodiments.

Claims

1. A method for determining a switching key, characterized in that, The method includes: The computing device acquires multiple first elements, one of which represents the size of a first prime number, which is obtained by ciphertext modulus decomposition of the target ciphertext; The computing device generates a plurality of second prime numbers based on the plurality of first elements. The number of the plurality of second prime numbers is greater than or equal to the lower limit of the number of factorizations of the additional modulus of the target ciphertext, and less than the number of the plurality of first elements. The computing device determines the additional modulus based on the plurality of second prime numbers, and generates a switching key based on the additional modulus. The switching key is used to switch the key of the target ciphertext.

2. The method according to claim 1, characterized in that, The process of obtaining multiple first elements includes: Obtain multiple second elements, the number of which is the same as the number of first prime numbers obtained by the ciphertext modulus decomposition of the target ciphertext, and one second element is used to represent the size of a first prime number; Calculate the sum of the plurality of second elements to obtain the total modulus size of the ciphertext; Obtain the upper limit of the algorithm size corresponding to the target ciphertext, wherein the upper limit of the algorithm size is used to indicate the upper limit of the size of the modulus supported by the homomorphic algorithm corresponding to the target ciphertext; Based on the upper limit of the algorithm size and the total modulus size of the ciphertext, a second element is selected from the plurality of second elements as the first element.

3. The method according to claim 2, characterized in that, The step of selecting a second element as the first element from the plurality of second elements based on the upper limit of the algorithm size and the total modulus size of the ciphertext includes: Based on the premise that the first difference between the upper limit of the algorithm size and the total modulus size of the ciphertext is not less than the total modulus size of the ciphertext, each of the plurality of second elements is taken as the first element.

4. The method according to claim 2, characterized in that, The step of selecting a second element as the first element from the plurality of second elements based on the upper limit of the algorithm size and the total modulus size of the ciphertext includes: Based on the fact that the first difference between the upper limit of the algorithm size and the total modulus size of the ciphertext is less than the total modulus size of the ciphertext, the number of blocks of the plurality of second elements is determined according to the first difference; The plurality of second elements are divided according to the number of blocks to obtain a plurality of element blocks, and the second element included in the element block with the largest sum of elements among the plurality of element blocks is taken as the first element.

5. The method according to claim 4, characterized in that, Determining the number of blocks for the plurality of second elements based on the first difference includes: Divide the total modulus size of the ciphertext by the first difference, and determine the initial quantity based on the quotient. The initial quantity is verified, and the initial quantity that passes the verification is used as the number of blocks.

6. The method according to claim 5, characterized in that, The step of verifying the initial quantity and using the verified initial quantity as the number of blocks includes: Determine the reference module size corresponding to the initial quantity; Based on the fact that the reference modulus size is not greater than the first difference, it is determined that the initial quantity verification is passed, and the initial quantity is used as the number of blocks.

7. The method according to any one of claims 4-6, characterized in that, The step of dividing the plurality of second elements according to the number of blocks includes: The number of elements in each element block within the plurality of element blocks is determined based on the number of blocks. The plurality of second elements are sequentially divided according to the number of elements in each element block.

8. The method according to any one of claims 1-7, characterized in that, Before generating multiple second prime numbers based on the multiple first elements, the method further includes: Obtain the upper limit of the device size of the computing device, wherein the upper limit of the device size is used to indicate the upper limit of the size of the modules that the computing device can process; Divide the sum of the plurality of first elements by the upper limit of the device size, and determine the lower limit of the number of decompositions based on the quotient.

9. The method according to any one of claims 1-8, characterized in that, The step of generating multiple second prime numbers based on the multiple first elements includes: Generate multiple third elements corresponding to the additional modulus according to the multiple first elements, wherein the third elements are used to represent the size of the second prime number; Each of the second prime numbers is generated based on the size of each second prime number.

10. The method according to any one of claims 1-9, characterized in that, Determining the additional modulus based on the plurality of second prime numbers includes: Multiply the second prime number repeatedly, and use the product of the multiple products as the additional modulus.

11. A device for determining a switching key, characterized in that, The device is applied to a computing device, and the device includes: The acquisition module is used to acquire multiple first elements, each first element representing the size of a first prime number, which is obtained by ciphertext modulus decomposition of the target ciphertext; A generation module is used to generate a plurality of second prime numbers based on the plurality of first elements, wherein the number of the plurality of second prime numbers is greater than or equal to the lower limit of the number of factorizations of the additional modulus of the target ciphertext, and less than the number of the plurality of first elements; A determining module is configured to determine the additional modulus based on the plurality of second prime numbers, and generate a switching key based on the additional modulus, the switching key being used to switch the key of the target ciphertext.

12. The apparatus according to claim 11, characterized in that, The acquisition module is used to acquire multiple second elements, the number of which is the same as the number of multiple first prime numbers obtained by the ciphertext modulus decomposition of the target ciphertext, and one second element is used to represent the size of a first prime number; Calculate the sum of the plurality of second elements to obtain the total modulus size of the ciphertext; Obtain the upper limit of the algorithm size corresponding to the target ciphertext, wherein the upper limit of the algorithm size is used to indicate the upper limit of the size of the modulus supported by the homomorphic algorithm corresponding to the target ciphertext; Based on the upper limit of the algorithm size and the total modulus size of the ciphertext, a second element is selected from the plurality of second elements as the first element.

13. The apparatus according to claim 12, characterized in that, The acquisition module is used to select each of the plurality of second elements as the first element based on the first difference between the upper limit of the algorithm size and the total modulus size of the ciphertext not being less than the total modulus size of the ciphertext.

14. The apparatus according to claim 12, characterized in that, The acquisition module is used to determine the number of blocks of the plurality of second elements based on the first difference between the upper limit of the algorithm size and the total modulus size of the ciphertext being less than the total modulus size of the ciphertext. The plurality of second elements are divided according to the number of blocks to obtain a plurality of element blocks, and the second element included in the element block with the largest sum of elements among the plurality of element blocks is taken as the first element.

15. The apparatus according to claim 14, characterized in that, The acquisition module is used to divide the total modulus size of the ciphertext by the first difference, determine the initial quantity based on the quotient, verify the initial quantity, and use the verified initial quantity as the number of blocks.

16. The apparatus according to claim 15, characterized in that, The acquisition module is used to determine the reference modulus size corresponding to the initial quantity; based on the reference modulus size not being greater than the first difference, it is determined that the initial quantity has passed verification, and the initial quantity is used as the number of blocks.

17. The apparatus according to any one of claims 14-16, characterized in that, The acquisition module is used to determine the number of elements in each element block among the plurality of element blocks according to the number of blocks; and to divide the plurality of second elements in order according to the number of elements in each element block.

18. The apparatus according to any one of claims 11-17, characterized in that, The determining module is further configured to obtain the upper limit of the device size of the computing device, wherein the upper limit of the device size is used to indicate the upper limit of the size of the modules that the computing device can process; Divide the sum of the plurality of first elements by the upper limit of the device size, and determine the lower limit of the number of decompositions based on the quotient.

19. The apparatus according to any one of claims 11-18, characterized in that, The generation module is used to generate multiple third elements corresponding to the additional modulus according to the multiple first elements, wherein the third elements are used to represent the size of the second prime number; and to generate each second prime number according to the size of each second prime number.

20. The apparatus according to any one of claims 11-19, characterized in that, The determining module is used to perform a series of multiplications on the second prime number and use the product of the series of multiplications as the additional modulus.

21. A computing device, characterized in that, The device includes a memory and a processor; the memory stores at least one instruction, which is loaded and executed by the processor to enable the computing device to implement the method for determining the switching key as described in any one of claims 1-10.

22. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one instruction, which is loaded and executed by a processor to implement the method for determining the switching key as described in any one of claims 1-10.

Images