Encryption method, device, electronic device and computer storage medium

Abstract

The embodiments of the present application disclose an encryption method, an apparatus, an electronic device, and a computer storage medium, which convert the ciphertext modulus, a key, and a plaintext modulus of a ciphertext to be bootstrapped to obtain a second plaintext modulus of the ciphertext to be bootstrapped, encrypt the second plaintext modulus of the ciphertext to be bootstrapped using a first key and a third ciphertext modulus to obtain the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, perform at least two homomorphic linear sub-transformations on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus in sequence, so as to place N coefficients in the plaintext polynomial of the ciphertext to be bootstrapped of the third ciphertext modulus into slots of K ciphertexts, and determine the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the third ciphertext modulus in each of the K ciphertext slots.

Description

Technical Field

[0001] The present application relates to bootstrapping technology in fully homomorphic encryption, and more particularly to an encryption method, device, electronic device and computer storage medium. Background Art

[0002] Fully Homomorphic Encryption (FHE) is a special type of encryption scheme that allows anyone to perform unlimited calculations on encrypted data without holding the decryption key. FHE is widely used in the field of privacy computing. The most typical application scenario is outsourced computing, in which users upload a large amount of homomorphically encrypted data to a cloud server, use the powerful computing power of the cloud server to perform complex ciphertext calculations, and then return the calculation results to the user in the form of homomorphically encrypted ciphertext. During the whole process, the server can only see the user's ciphertext, so the user's data privacy is protected.

[0003] At present, the mainstream FHE schemes include the Cheon-Kim-Kim-Song (CKKS) scheme for floating-point numbers, the second-generation homomorphic encryption scheme (Brakerski-Gentry-Vaikuntanathan, BGV, Brakerski / Fan-Vercauteren, BFV) and the scheme based on homomorphic encryption over the torus (TFHE). Among them, CKKS is mainly used for decimal operations, TFHE is used for Boolean circuit operations, and BGV and BFV are used for modular integer and finite field operations.

[0004] Bootstrapping is an important algorithm in the FHE scheme. Without bootstrapping, the FHE scheme can only perform a limited number of homomorphic computations. Bootstrapping is usually the most time-consuming part of fully homomorphic computation and is the efficiency bottleneck of the FHE scheme.

[0005] Most of the current FHE schemes are based on Ring Learning with Error (RLWE) construction, so it is necessary to calculate the cyclotomic polynomial ring Polynomial addition and multiplication in , where is an M-order cyclotomic polynomial. In order to use fast polynomial multiplication algorithms such as Number-theoretic Transform (NTT), in actual use, FHE schemes usually take M as a power of 2, corresponding to the polynomial ring Typical examples include TFHE, CKKS, and BFV / BGV schemes implemented in SEAL, lattigo, and OpenFHE; among them, SEAL, Lattigo, and OpenFHE are all open source libraries related to FHE.

[0006] However, although most open source homomorphic libraries choose to use cyclotomic polynomial rings of powers of 2 to obtain optimal polynomial multiplication performance, the homomorphic linear transformations involved in the current BFV / BGV bootstrapping are extremely inefficient or simply cannot be calculated in the above cyclotomic polynomial rings where M is a power of 2, resulting in low encryption efficiency. Summary of the invention

[0007] The embodiments of the present application provide an encryption method, device, electronic device and computer storage medium, which can improve encryption efficiency.

[0008] The technical solution of this application is implemented as follows:

[0009] In a first aspect, an embodiment of the present application provides an encryption method, which is applied to a bootstrapped homomorphic library using a polynomial ring whose ring dimension N is an integer power of 2, including:

[0010] Obtaining a first ciphertext modulus, a first key, and a first plaintext modulus ciphertext to be bootstrapped;

[0011] Convert the ciphertext modulus of the ciphertext to be bootstrapped to obtain the ciphertext to be bootstrapped of the second ciphertext modulus;

[0012] Converting the key of the ciphertext to be bootstrapped of the second ciphertext modulus to obtain the ciphertext to be bootstrapped of the second key;

[0013] Converting the plaintext modulus of the ciphertext to be bootstrapped of the second key to obtain the ciphertext to be bootstrapped of the second plaintext modulus;

[0014] Encrypting the to-be-bootstrapped ciphertext of the second plaintext modulus by using the first key and the third ciphertext modulus to obtain the to-be-bootstrapped ciphertext of the first key and the third ciphertext modulus;

[0015] Perform at least two homomorphic linear sub-transformations on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus in sequence, so as to place N coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into slots of K ciphertexts; wherein K is equal to N divided by L; and L is the total number of slots;

[0016] In each of the K ciphertext slots, coefficients of a plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus are determined to obtain a bootstrapped ciphertext of the ciphertext to be bootstrapped.

[0017] In a second aspect, an embodiment of the present application provides an encryption device, which is applied to a bootstrapped homomorphic library using a polynomial ring whose ring dimension N is an integer power of 2, including:

[0018] An acquisition module, used to acquire the first ciphertext modulus, the first key and the ciphertext to be bootstrapped of the first plaintext modulus;

[0019] A first conversion module, used for converting the ciphertext modulus of the ciphertext to be bootstrapped to obtain the ciphertext to be bootstrapped of the second ciphertext modulus;

[0020] A second conversion module, used to convert the key of the ciphertext to be bootstrapped of the second ciphertext modulus to obtain the ciphertext to be bootstrapped of the second key;

[0021] A third conversion module, used to convert the plaintext modulus of the ciphertext to be bootstrapped of the second key to obtain the ciphertext to be bootstrapped of the second plaintext modulus;

[0022] A fourth conversion module, configured to encrypt the to-be-bootstrapped ciphertext of the second plaintext modulus by using the first key and the third ciphertext modulus to obtain the to-be-bootstrapped ciphertext of the first key and the third ciphertext modulus;

[0023] A sub-transformation module, used for sequentially performing at least two homomorphic linear sub-transformations on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, so as to place N coefficients in the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into slots of K ciphertexts; wherein K is equal to N divided by L; and L is the total number of slots;

[0024] The determination module is used to determine the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus in each slot of the K ciphertext slots to obtain the bootstrapped ciphertext of the ciphertext to be bootstrapped.

[0025] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a processor and a storage medium storing instructions executable by the processor; the storage medium relies on the processor to perform operations through a communication bus, and when the instructions are executed by the processor, the encryption method described in one or more of the above embodiments is executed.

[0026] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing executable instructions. When the executable instructions are executed by one or more processors, the processor executes the encryption method described in one or more of the above embodiments.

[0027] The embodiments of the present application provide an encryption method, an apparatus, an electronic device, and a computer storage medium, which are applied to a bootstrap homomorphic library using a polynomial ring whose ring dimension N is an integer power of 2, including: obtaining a first ciphertext modulus, a first key, and a first plaintext modulus of the ciphertext to be bootstrapped, converting the ciphertext modulus of the ciphertext to be bootstrapped to obtain a second ciphertext modulus of the ciphertext to be bootstrapped, converting the key of the ciphertext to be bootstrapped of the second ciphertext modulus to obtain the ciphertext to be bootstrapped of the second key, converting the plaintext modulus of the ciphertext to be bootstrapped of the second key to obtain the ciphertext to be bootstrapped of the second plaintext modulus, encrypting the second plaintext modulus of the ciphertext to be bootstrapped using the first key and the third ciphertext modulus to obtain the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, ciphertext, and sequentially perform at least two homomorphic linear sub-transformations to place N coefficients in the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into the slots of K ciphertexts, L is the total number of slots, K is equal to N divided by L, and in each slot of the K ciphertext slots, determine the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus to obtain the bootstrapped ciphertext of the ciphertext to be bootstrapped; that is, in an embodiment of the present application, the homomorphic linear transformation is split into at least two homomorphic linear sub-transformations, so that at least two homomorphic linear sub-transformations are used sequentially in the bootstrap process in encryption, and the computational amount of sequentially performing at least two homomorphic linear sub-transformations is lower than the computational amount of the homomorphic linear transformation, so that the computational amount of bootstrapping can be reduced, thereby improving the bootstrap efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] Figure 1 A flowchart of an optional encryption method provided in an embodiment of the present application;

[0029] Figure 2 A flowchart of an example of an optional encryption method provided in an embodiment of the present application;

[0030] Figure 3 A schematic diagram of the structure of an optional encryption device provided in an embodiment of the present application;

[0031] Figure 4 A schematic diagram of the structure of an optional electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0032] The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0033] In the field of encryption, especially FHE, bootstrapping is a crucial concept. The bootstrapping operation is the most complex and computationally intensive part of the FHE scheme, but it is also one of the key technologies to achieve fully homomorphic encryption.

[0034] Bootstrapping, as the name implies, is a process similar to "raising oneself through one's own power". In FHE, the bootstrapping operation allows an unlimited number of homomorphic operations to be performed on encrypted data without decrypting the ciphertext. This is usually done by combining the encrypted key and the ciphertext itself to generate a new, less noisy ciphertext, allowing further homomorphic computations.

[0035] The basic idea of ​​the bootstrap operation is to take the ciphertext and private key as input, and output a new ciphertext through a homomorphic computation process. This new ciphertext should produce the same plaintext as the original ciphertext after decryption, but with a lower noise level. The specific steps are as follows:

[0036] Encryption key: First, the private key (or decryption function) is encrypted to generate an encrypted key (also called a bootstrap key or refresh key).

[0037] Homomorphic decryption: Then, the encrypted key and the original ciphertext are used to perform a homomorphic decryption operation. This operation is performed without decrypting the ciphertext, so no information about the plaintext is leaked.

[0038] Generating New Ciphertext: The result of a homomorphic decryption operation is a new ciphertext that encrypts the same plaintext message as the original ciphertext, but with a lower noise level.

[0039] The computational complexity of the bootstrap operation is very high, which is one of the main obstacles to the practical application of FHE. Different FHE schemes may adopt different bootstrap mechanisms, but most of them follow a similar framework, that is, they perform homomorphic computations on their own decryption processes. However, since the bootstrap operation requires a lot of computing resources, it is often necessary to optimize and accelerate it in practical applications.

[0040] Although the computational complexity of the bootstrapping operation is high, fully homomorphic encryption technology has been initially applied in some fields. For example, in customized advertising systems, homomorphic encryption technology can be used to allow users to get recommendations without knowing the identity of the recommender. In addition, fully homomorphic encryption technology can also be applied to privacy-preserving data analysis, cloud computing security and other fields.

[0041] For the BFV / BGV scheme in bootstrapping, the following parameters are included:

[0042] Plain text modulus ,in, is a prime number, is a positive integer; the ring dimension is an integer power of 2;

[0043] The ring R is represented by:

[0044] (1)

[0045] in, represents the ring of integers, is the ring of all polynomials with integer coefficients and X as the independent variable, Represents the entropy ring operation.

[0046] For some positive integer q, define:

[0047] (2)

[0048] in, It can be a plaintext modulus or a ciphertext modulus. The coefficient is modulus The ring of polynomials of the integers with X as the independent variable.

[0049] Often used ; Safety parameter λ, usually between 80 and 128.

[0050] Among them, the BGV private key is s∈R, and the ciphertext form can be expressed as follows:

[0051] (3)

[0052] in, is random and uniform element, is a polynomial with small coefficients (usually the coefficients are selected by Gaussian sampling), Q represents the ciphertext modulus, and each ciphertext and All are randomly selected again; is the plaintext polynomial, that is, the message to be encrypted; the ciphertext modulus Q corresponding to different ciphertexts may be different, and this modulus may change during the homomorphic operation.

[0053] BGV has a Single Instruction Multiple Data (SIMD) feature: a single plaintext polynomial Actually packed plaintext values, each of which is (i.e., the characteristic is , the number of expansions is The elements of the Galois ring , The specific value depends on and The value of . Homomorphic addition (or multiplication) of the ciphertext is equivalent to Each element in the plaintext value is added (or multiplied) at the same time. Each position in the plaintext vector is usually called a slot. The slots are usually arranged in a hypercube structure similar to a multidimensional array (hereinafter referred to as the plaintext structure). This structure affects the A specific algorithm for performing homomorphic linear transformations on plaintext values.

[0054] In order to solve the technical problem of low bootstrapping efficiency in the encryption process, an embodiment of the present application provides an encryption method, in which a homomorphic library used for bootstrapping adopts a polynomial ring whose ring dimension N is an integer power of 2. Figure 1 A flowchart of an optional encryption method provided in an embodiment of the present application is shown as follows: Figure 1 As shown, the encryption method may include:

[0055] S101: Obtain a first ciphertext modulus, a first key, and a first plaintext modulus ciphertext to be bootstrapped;

[0056] The encryption method in the embodiment of the present application is applicable to BFV or BGV bootstrapping, and is applicable to bootstrapping in which one Galois ring element is stored in each slot.

[0057] In S101, first obtain the ciphertext to be bootstrapped, wherein the ciphertext modulus of the ciphertext to be bootstrapped is the first ciphertext modulus, generally Indicates that the key of the ciphertext to be bootstrapped is the first key, generally used Indicates that the plaintext modulus of the ciphertext to be bootstrapped is the first plaintext modulus, generally used express.

[0058] S102: converting the ciphertext modulus of the ciphertext to be bootstrapped to obtain the ciphertext to be bootstrapped of the second ciphertext modulus;

[0059] After the ciphertext to be bootstrapped is obtained through S101, in S102, the ciphertext modulus of the ciphertext to be bootstrapped is converted. Here, the modulus-to-digital conversion technology is used to convert the ciphertext modulus in the ciphertext to be bootstrapped from the first ciphertext modulus to the second ciphertext modulus. The second ciphertext modulus can be used Represents that the ciphertext to be bootstrapped of the second ciphertext modulus can be obtained.

[0060] S103: converting the key of the ciphertext to be bootstrapped of the second ciphertext modulus to obtain the ciphertext to be bootstrapped of the second key;

[0061] After obtaining the ciphertext to be bootstrapped of the second ciphertext modulus through S102, in S103, the key of the ciphertext to be bootstrapped of the second ciphertext modulus is converted. Here, a key conversion technology is used to convert the key in the ciphertext to be bootstrapped of the second ciphertext modulus from a first key to a second key. The second key can be used Indicates that the ciphertext to be bootstrapped of the second key can be obtained.

[0062] S104: converting the plaintext modulus of the ciphertext to be bootstrapped of the second key to obtain the ciphertext to be bootstrapped of the second plaintext modulus;

[0063] After obtaining the ciphertext to be bootstrapped of the second key in S103, in S104, the plaintext modulus of the ciphertext to be bootstrapped of the second key is converted. Here, the ciphertext modulus may be multiplied by a number, for example, , the key in the second key to be bootstrapped ciphertext is converted from the first plaintext modulus to the second plaintext modulus, and the second plaintext modulus can be used Represents that the ciphertext to be bootstrapped of the second plaintext modulus can be obtained.

[0064] S105: Encrypt the to-be-bootstrapped ciphertext of the second plaintext modulus by using the first key and the third ciphertext modulus to obtain the to-be-bootstrapped ciphertext of the first key and the third ciphertext modulus;

[0065] After obtaining the ciphertext to be bootstrapped of the second plaintext modulus through S104, in S105, the ciphertext to be bootstrapped of the second plaintext modulus is encrypted using the first key and the third ciphertext modulus, the key in the ciphertext to be bootstrapped of the second plaintext modulus is converted from the second key to the first key, the ciphertext modulus is converted from the second ciphertext modulus to the third ciphertext modulus, and the third ciphertext modulus can be used Indicates that the ciphertext to be bootstrapped of the first key and the third ciphertext modulus can be obtained.

[0066] S106: performing at least two homomorphic linear sub-transformations on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus in sequence, so as to place N coefficients in the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into the slots of the K ciphertexts;

[0067] Since S101-S105 cause the plaintext polynomial to change, in order to restore it to the plaintext polynomial of the ciphertext to be bootstrapped, it is necessary to process the ciphertext to be bootstrapped of the first key and the third ciphertext modulus. In S106, at least two homomorphic linear sub-transformations are performed on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus in sequence to put the N coefficients in the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into the slots of K ciphertexts, where K is equal to N divided by L, and L is the total number of slots.

[0068] That is, the first key and the third ciphertext modulus to be bootstrapped are first subjected to the first sub-transformation of at least two homomorphic linear sub-transformations, and the obtained transformation result is input into the second sub-transformation of at least two homomorphic linear sub-transformations, ..., and so on, until the last sub-transformation of at least two homomorphic linear sub-transformations is performed, and the N coefficients of the plaintext polynomial of the first key and the third ciphertext modulus to be bootstrapped are put into A ciphertext slot.

[0069] S107: In each slot of the K ciphertext slots, determine the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus to obtain a bootstrapped ciphertext of the ciphertext to be bootstrapped.

[0070] In S106, N coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the third ciphertext modulus are placed into the slots of the K ciphertexts. In order to obtain the bootstrapped ciphertext of the ciphertext to be bootstrapped, in S107, in each of the slots of the K ciphertexts, a annihilation polynomial and a series of low-order polynomials are constructed to homomorphically calculate the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped from the plaintext polynomial of the ciphertext to be bootstrapped of the third ciphertext modulus in the i-th (where i is an integer between 1 and L) slot, thereby obtaining the bootstrapped ciphertext of the ciphertext to be bootstrapped.

[0071] It should be noted that the device executing the above encryption algorithm does not know the specific values ​​of the first key and the second key.

[0072] In the embodiment of the present application, the bootstrapping may include two bootstrapping modes, namely a first bootstrapping mode and a second bootstrapping mode, wherein the bootstrapping steps are different for different bootstrapping modes.

[0073] For the first bootstrapping method, in an optional embodiment, S107 may include:

[0074] When the ciphertext to be bootstrapped adopts the first bootstrapped mode, in each slot of the K ciphertext slots, the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus are calculated;

[0075] The coefficients are sequentially subjected to inverse transformations of at least two homomorphic linear sub-transformations to move the coefficients to a plaintext polynomial of the to-be-bootstrapped ciphertext of the first key and the third ciphertext modulus.

[0076] It can be understood that the first bootstrapping method is a bootstrapping method commonly used for ciphertext. In the first bootstrapping method, the value of K is greater than or equal to 2. That is to say, in S107, before placing N coefficients into two or more slots of ciphertext, the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus are first calculated in each slot, and then the coefficients are inversely transformed by at least two homomorphic linear sub-transformations in turn, so as to move the coefficients to the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus.

[0077] That is to say, the coefficients are first subjected to the inverse transformation of the first sub-transformation of at least two homomorphic linear sub-transformations, and the obtained transformation result is input into the inverse transformation of the second sub-transformation of at least two homomorphic linear sub-transformations, and so on, until the inverse transformation of the last sub-transformation of at least two homomorphic linear sub-transformations is performed, and then the coefficients are moved to the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, so that the bootstrapped ciphertext can be obtained.

[0078] In this way, bootstrapping under the first bootstrapping mode is realized. Through at least two homomorphic linear sub-transformations and at least two inverse transformations of homomorphic linear sub-transformations, the coefficients can be moved to the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, thereby reducing the computational amount of bootstrapping and improving the bootstrapping efficiency.

[0079] For different bases p of the first plaintext modulus, the corresponding numbers of at least two homomorphic linear sub-transformations are different. In an optional embodiment, when the base p of the first plaintext modulus is 1 when divided by 4, the at least two homomorphic linear sub-transformations include: an inverse transformation of a first preset sub-transformation, a first preset matrix sub-transformation, and a second preset sub-transformation; the inverse transformation of at least two homomorphic linear sub-transformations includes: an inverse transformation of a first preset matrix sub-transformation and a first preset sub-transformation.

[0080] It can be understood that when the base p of the first plaintext modulus is a value that leaves a remainder of 1 when divided by 4, it is necessary to first perform an inverse transform of the first preset sub-transformation on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, then perform a first preset matrix sub-transformation on the result of the transformation, and finally perform a second preset sub-transformation on the result of the transformation, so as to place the N coefficients in the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into the slots of the K ciphertexts.

[0081] Furthermore, when the ciphertext to be bootstrapped adopts the first bootstrapped method, in each slot of the K ciphertext slots, the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus are calculated; the coefficients are first inversely transformed by the first preset matrix sub-transformation, and then the transformed result is subjected to the first preset sub-transformation to move the coefficients to the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus.

[0082] Among them, the first preset sub-transformation is To express, the inverse transform of the first preset sub-transform can be used To express, the above first preset matrix sub-transformation can be expressed as , where j is a positive integer from 1 to log2L. The second preset sub-transformation can be represented by To represent, where the Galois ring stored in each slot The elements in can be regarded as a The polynomial The coefficients can be compared with the standard basis It can also be expressed relative to a normal basis. Define a transformation PtoN that transforms each slot The coefficients in the standard basis are moved to the normal basis.

[0083] The number of diagonals in which all elements of the matrix in the first preset matrix sub-transformation are zero is greater than a preset threshold. If there are more diagonals whose elements are all zero, the amount of calculation when performing the first preset matrix sub-transformation will be reduced.

[0084] In this way, by utilizing at least two homomorphic linear sub-transformations, the computational complexity of the homomorphic linear transformation can be further reduced when the ciphertext to be bootstrapped of the first key and the third ciphertext modulus is subjected to homomorphic linear transformation, thereby reducing the computational complexity in the bootstrapping process and facilitating improving the bootstrapping efficiency.

[0085] In addition, two methods can be used to perform at least two homomorphic linear sub-transformations for a value where the base p of the first plaintext modulus is a remainder 3 when divided by 4. In an optional embodiment, when the base p of the first plaintext modulus is a remainder 3 when divided by 4, the at least two homomorphic linear sub-transformations include: an inverse transformation of the first preset sub-transformation, a second preset matrix sub-transformation, and a second preset sub-transformation; the inverse transformation of the at least two homomorphic linear sub-transformations includes: an inverse transformation of the second preset matrix sub-transformation and the first preset sub-transformation.

[0086] It can be understood that when the base p of the first plaintext modulus is a value that leaves a remainder of 3 when divided by 4, it is necessary to first perform an inverse transform of the first preset sub-transformation on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, then perform a second preset matrix sub-transformation on the result of the transformation, and finally perform a second preset sub-transformation on the result of the transformation, so as to place the N coefficients in the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into the slots of the K ciphertexts.

[0087] Furthermore, when the ciphertext to be bootstrapped adopts the first bootstrapped method, in each slot of the K ciphertext slots, the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus are calculated; the coefficients are first inversely transformed by the second preset matrix sub-transformation, and then the transformed result is subjected to the first preset sub-transformation to move the coefficients to the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus.

[0088] Among them, the above second preset matrix sub-transformation can be used , where j is a positive integer ranging from 1 to log2L. It should be noted that if the base p of the second plaintext modulus has different values, then the definitions of the first preset matrix sub-transformation and the second preset matrix sub-transformation are different.

[0089] The number of diagonals whose elements are all zero in the second preset matrix sub-transformation is greater than the preset threshold. In other words, if the number of diagonals whose elements are all zero in the second preset matrix sub-transformation is large, the amount of calculation when performing the second preset matrix sub-transformation will be reduced.

[0090] In this way, by utilizing at least two homomorphic linear sub-transformations, the computational complexity of the homomorphic linear transformation can be further reduced when the ciphertext to be bootstrapped of the first key and the third ciphertext modulus is subjected to homomorphic linear transformation, thereby reducing the computational complexity in the bootstrapping process and facilitating improving the bootstrapping efficiency.

[0091] For the base p of the first plaintext modulus that is a value with a remainder of 3 when divided by 4, the following method can also be used to perform at least two homomorphic linear sub-transformations. In an optional embodiment, when the base p of the first plaintext modulus is a value with a remainder of 3 when divided by 4, the at least two homomorphic linear sub-transformations include: an inverse transformation of the first preset sub-transformation, a third preset matrix sub-transformation, and a second preset sub-transformation; the inverse transformation of the at least two homomorphic linear sub-transformations includes: an inverse transformation of the third preset matrix sub-transformation and the first preset sub-transformation.

[0092] It can be understood that when the base p of the first plaintext modulus is a value that leaves a remainder of 3 when divided by 4, it is necessary to first perform an inverse transform of the first preset sub-transformation on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, then perform a third preset matrix sub-transformation on the result of the transformation, and finally perform a second preset sub-transformation on the result of the transformation, so as to place the N coefficients in the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into the slots of the K ciphertexts.

[0093] Furthermore, when the ciphertext to be bootstrapped adopts the first bootstrapped method, in each slot of the K ciphertext slots, the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus are calculated; the coefficients are first inversely transformed by the third preset matrix sub-transformation, and then the transformed result is subjected to the first preset sub-transformation to move the coefficients to the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus.

[0094] The third preset matrix sub-transformation can also be used , where j is a positive integer ranging from 1 to log2L. It should be noted that if the base p of the second plaintext modulus has different values, then the definitions of the first preset matrix sub-transformation, the second preset matrix sub-transformation and the third preset matrix sub-transformation are different.

[0095] The number of diagonals whose elements are all zero in the third preset matrix sub-transformation is greater than the preset threshold. In other words, if the number of diagonals whose elements are all zero in the third preset matrix sub-transformation is large, the amount of calculation when performing the third preset matrix sub-transformation will be reduced.

[0096] In this way, by utilizing at least two homomorphic linear sub-transformations, the computational complexity of the homomorphic linear transformation can be further reduced when the ciphertext to be bootstrapped of the first key and the third ciphertext modulus is subjected to homomorphic linear transformation, thereby reducing the computational complexity in the bootstrapping process and facilitating improving the bootstrapping efficiency.

[0097] For the second bootstrapping method, in an optional embodiment, S101 may include:

[0098] When the ciphertext to be bootstrapped adopts the second bootstrapped mode, obtaining the ciphertext to be bootstrapped of the first ciphertext modulus, the first key, and the first plaintext modulus;

[0099] The ciphertext to be bootstrapped is sequentially subjected to inverse transformations of at least two homomorphic linear sub-transformations to move L coefficients in the L slots to the plaintext polynomial of the ciphertext to be bootstrapped.

[0100] It can be understood that the second bootstrap method stores only one In other words, L coefficients are stored in L slots. That is, K is equal to 1. Then, in S107, for the case where the ciphertext to be bootstrapped adopts the second bootstrapped method, first, the ciphertext to be bootstrapped of the first ciphertext modulus, the first key and the first plaintext modulus is obtained, and the ciphertext to be bootstrapped is inversely transformed by at least two homomorphic linear sub-transformations, and the coefficients are moved to the plaintext polynomial of the ciphertext to be bootstrapped of the third ciphertext modulus.

[0101] That is to say, the inverse transformation of the first sub-transformation of the inverse transformation of at least two homomorphic linear sub-transformations is first performed, and the obtained transformation result is input into the inverse transformation of the second sub-transformation of at least two homomorphic linear sub-transformations, ..., and so on, until the inverse transformation of the last sub-transformation of at least two homomorphic linear sub-transformations is performed, thereby moving the L coefficients in the L slots to the plaintext polynomial of the ciphertext to be bootstrapped and executing S102-S107.

[0102] In this way, bootstrapping under the second bootstrapping mode is realized, and the bootstrapped ciphertext of the ciphertext to be bootstrapped is obtained through at least two homomorphic linear sub-transformations and at least two inverse transformations of homomorphic linear sub-transformations, which reduces the computational complexity of the bootstrapping and thus improves the bootstrapping efficiency.

[0103] For the second bootstrap method, the base p of the first plaintext modulus is different, and the corresponding number of at least two homomorphic linear sub-transformations is different. In an optional embodiment, when the base p of the first plaintext modulus is 1 when divided by 4, the at least two homomorphic linear sub-transformations include: a third preset sub-transformation and a first preset matrix sub-transformation; the inverse transformations of the at least two homomorphic linear sub-transformations include: an inverse transformation of the first preset matrix sub-transformation.

[0104] It can be understood that when the base p of the first plaintext modulus is a value that is divided by 4 and has a remainder of 1, it is necessary to first perform a third preset sub-transformation on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, and then perform a first preset matrix sub-transformation on the result of the transformation, so as to put the N coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into the slots of the K ciphertexts. To express.

[0105] Moreover, when the ciphertext to be bootstrapped adopts the second bootstrapped method, after the ciphertext to be bootstrapped is obtained, the obtained ciphertext to be bootstrapped is subjected to an inverse transformation of the first preset matrix sub-transformation to move the L coefficients in the L slots to the plaintext polynomial of the ciphertext to be bootstrapped.

[0106] The number of diagonals in which all elements of the matrix in the first preset matrix sub-transformation are zero is greater than a preset threshold. If there are more diagonals whose elements are all zero, the amount of calculation when performing the first preset matrix sub-transformation will be reduced.

[0107] In this way, by utilizing at least two homomorphic linear sub-transformations, the computational complexity of the homomorphic linear transformation can be further reduced when the ciphertext to be bootstrapped of the first key and the third ciphertext modulus is subjected to homomorphic linear transformation, thereby reducing the computational complexity in the bootstrapping process and facilitating improving the bootstrapping efficiency.

[0108] In addition, two methods can be used to perform at least two homomorphic linear sub-transformations for a value where the base p of the first plaintext modulus is a remainder 3 when divided by 4. In an optional embodiment, when the base p of the first plaintext modulus is a remainder 3 when divided by 4, the at least two homomorphic linear sub-transformations include: a third preset sub-transformation, an inverse transformation of the first preset sub-transformation, and a second preset matrix sub-transformation; the inverse transformation of the at least two homomorphic linear sub-transformations includes: an inverse transformation of the second preset matrix sub-transformation and the first preset sub-transformation.

[0109] It can be understood that when the base p of the first plaintext modulus is a value that is 3 when divided by 4, it is necessary to first perform a third preset sub-transformation on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, and then perform an inverse transformation of the first preset matrix sub-transformation on the result of the transformation, and then perform a second preset matrix sub-transformation on the result of the transformation, so as to place the N coefficients in the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into the slots of the K ciphertexts.

[0110] Moreover, in the case where the ciphertext to be bootstrapped adopts the second bootstrapped method, after the ciphertext to be bootstrapped is obtained, the obtained ciphertext to be bootstrapped is subjected to the inverse transformation of the second preset matrix sub-transformation, and then the result of the transformation is subjected to the first preset sub-transformation to move the L coefficients in the L slots to the plaintext polynomial of the ciphertext to be bootstrapped.

[0111] The number of diagonals whose elements are all zero in the second preset matrix sub-transformation is greater than the preset threshold. In other words, if the number of diagonals whose elements are all zero in the second preset matrix sub-transformation is large, the amount of calculation when performing the second preset matrix sub-transformation will be reduced.

[0112] In this way, by utilizing at least two homomorphic linear sub-transformations, the computational complexity of the homomorphic linear transformation can be further reduced when the ciphertext to be bootstrapped of the first key and the third ciphertext modulus is subjected to homomorphic linear transformation, thereby reducing the computational complexity in the bootstrapping process and facilitating improving the bootstrapping efficiency.

[0113] For the base p of the first plaintext modulus that is a value with a remainder of 3 when divided by 4, the following method can also be used to perform at least two homomorphic linear sub-transformations. In an optional embodiment, when the base p of the first plaintext modulus is a value with a remainder of 3 when divided by 4, the at least two homomorphic linear sub-transformations include: a fourth preset sub-transformation, an inverse transformation of the first preset sub-transformation, a third preset matrix sub-transformation, and a third preset sub-transformation; the inverse transformation of the at least two homomorphic linear sub-transformations includes: an inverse transformation of the third preset matrix sub-transformation and the first preset sub-transformation.

[0114] It can be understood that when the base p of the first plaintext modulus is a value that is divided by 4 and has a remainder of 3, it is necessary to first perform the fourth preset sub-transformation on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, then perform the inverse transformation of the first preset sub-transformation on the result of the transformation, then perform the third preset matrix sub-transformation on the result of the transformation, and finally perform the third preset sub-transformation on the result of the transformation, so as to put the N coefficients in the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into the slots of the K ciphertexts. Among them, the fourth preset sub-transformation can be used To express.

[0115] Moreover, in the case where the ciphertext to be bootstrapped adopts the second bootstrapped method, after the ciphertext to be bootstrapped is obtained, the obtained ciphertext to be bootstrapped is subjected to the inverse transformation of the third preset matrix sub-transformation, and then the result of the transformation is subjected to the first preset sub-transformation to move the L coefficients in the L slots to the plaintext polynomial of the ciphertext to be bootstrapped.

[0116] The number of diagonals whose elements are all zero in the third preset matrix sub-transformation is greater than the preset threshold. In other words, if the number of diagonals whose elements are all zero in the third preset matrix sub-transformation is large, the amount of calculation when performing the third preset matrix sub-transformation will be reduced.

[0117] In this way, by utilizing at least two homomorphic linear sub-transformations, the computational complexity of the homomorphic linear transformation can be further reduced when the ciphertext to be bootstrapped of the first key and the third ciphertext modulus is subjected to homomorphic linear transformation, thereby reducing the computational complexity in the bootstrapping process and facilitating improving the bootstrapping efficiency.

[0118] For the above-mentioned first preset matrix sub-transformation, second preset matrix sub-transformation and third preset matrix sub-transformation, in an optional embodiment, the first preset matrix sub-transformation includes: the jth first preset sub-matrix sub-transformation; the second preset matrix sub-transformation includes: the jth second preset sub-matrix sub-transformation; the third preset matrix sub-transformation includes: the jth third preset sub-matrix sub-transformation.

[0119] It can be understood that, wherein j is a positive integer from 1 to log2L. That is to say, the first preset matrix sub-transformation, the second preset matrix sub-transformation and the third preset matrix sub-transformation all have matrices of positive integers from 1 to log2L. It should be noted that the definitions of the first preset matrix sub-transformation, the second preset matrix sub-transformation and the third preset matrix sub-transformation are different.

[0120] In this way, the above-mentioned first preset matrix sub-transformation, second preset matrix sub-transformation and third preset matrix sub-transformation can be obtained through multiple matrix sub-transformations, which further simplifies the first preset matrix sub-transformation, the second preset matrix sub-transformation and the third preset matrix sub-transformation, which is beneficial to improving the bootstrap efficiency.

[0121] It should be noted that the above-mentioned first preset matrix sub-transformation, second preset matrix sub-transformation and third preset matrix sub-transformation can all be one sub-transformation, or can include sub-matrix sub-transformations. Here, the embodiment of the present application does not make any specific limitation on this.

[0122] The encryption method described in one or more of the above embodiments is described below with examples.

[0123] Although most open source homomorphic libraries currently choose to use cyclotomic polynomial rings of power 2 to obtain optimal polynomial multiplication performance, the homomorphic linear transformations involved in the BFV / BGV bootstrap are extremely inefficient or simply cannot be calculated in the above cyclotomic polynomial rings where M is a power of 2. The only homomorphic library Helib that supports BGV / BFV bootstrap usually uses M that is not a power of 2, which makes the multiplication operations in the corresponding cyclotomic polynomial rings very inefficient. Therefore, there is an urgent need for a fast BFV / BGV bootstrap algorithm suitable for cyclotomic polynomial rings of power 2.

[0124] The main content of this example is to propose an efficient BFV / BGV bootstrap algorithm suitable for cyclotomic polynomial rings of degree 2. The core improvement is to split the linear transformation used in the bootstrap into multiple sub-linear transformations that can be calculated quickly.

[0125] Since BFV and BGV have exactly the same bootstrapping process, this example uses the BGV solution as an example. The bootstrapping method that is applicable to storing one Galois ring element in each slot can be called General Bootstrapping (equivalent to the first bootstrapping method mentioned above). Figure 2 A flowchart of an example of an optional encryption method provided in an embodiment of the present application is shown as follows: Figure 2 As shown, the encryption method may also include:

[0126] S201: BGV / BFV ciphertext to be bootstrapped ;

[0127] Among them, the input is the ciphertext to be bootstrapped as shown in the above formula (3) ,in, .

[0128] S202: Using analog-to-digital conversion technology, The ciphertext modulus is converted to On, get ;

[0129] S203: Use key conversion technology to The key is converted to a sparse bootstrap key ,get ;

[0130] in, as follows:

[0131] (4)

[0132] S204: Using analog-to-digital conversion technology, The plaintext modulus is converted to ;get ;

[0133] Among them, Multiply (At the same time ),get:

[0134] (5)

[0135] The encrypted plaintext becomes ;

[0136] S205: Note In large modulus Download private key And the plaintext modulus Encrypted The ciphertext of ;

[0137] (6)

[0138] The encrypted plaintext is as follows:

[0139] (7)

[0140] (8)

[0141] S206: Calculate the CoeffToSlot transformation that is split into multiple transformations. The N coefficients of the encrypted plaintext polynomial are placed into the K ciphertext slots;

[0142] In this example, a homomorphic linear transformation (called CoeffToSlot) is split into multiple sub-transformations. The N coefficients of are placed into the K ciphertext slots.

[0143] S207: Using the constructed low-order annihilation polynomial to perform homomorphic bit removal on each ciphertext;

[0144] For each ciphertext obtained in S206, a series of low-order polynomials are constructed using the constructed null polynomial to homomorphically convert the ciphertext from work out .

[0145] S208: Calculate the SlotToCoeff transformation that is split into multiple sub-transformations, and put the N coefficients in the K ciphertext slots into the coefficients in a single plaintext polynomial to obtain

[0146] S209: As a bootstrap result.

[0147] Among them, a homomorphic linear transformation (called SlotToCoeff) is homomorphically transformed of coefficients from K ciphertexts The bootstrapping is done by moving from one slot to the coefficients of a single plaintext polynomial.

[0148] In addition, the bootstrapping method applicable to storing only one integer in each slot can be called Thin Bootstrapping (equivalent to the second bootstrapping method mentioned above): the steps of General Bootstrapping can be arranged as S201-S208- S202-S203-S204-S205-S206-S207. The specific process is as follows:

[0149] S301: Input is the ciphertext to be bootstrapped, and each slot stores only one Integer in ;

[0150] S302: Calculate the CoeffToSlot transformation that is split into multiple transformations, and homomorphically move the L integers in the L slots to the coefficients of the plaintext polynomial to obtain the ciphertext ;

[0151] S303: Using analog-to-digital conversion technology, The ciphertext modulus is converted to On, get ;

[0152] S304: Use key conversion technology to The key is converted to a sparse bootstrap key , we get the above formula (4)

[0153] S305: Multiply (At the same time ), we get the above formula (5), and the encrypted plaintext becomes ;

[0154] S306: Note In large modulus Download private key And the plaintext modulus Encrypted The ciphertext is calculated to obtain the above formula (6), and the encrypted plaintext is the above formula (7), where I can be expressed by the above formula (8);

[0155] S307: Calculate the CoeffToSlot transformation that is split into multiple transformations. Put specific L of all N coefficients into a ciphertext slot and get ;

[0156] S308: Using the constructed null polynomial, construct a series of low-degree polynomials to homomorphically In each slot from work out , bootstrapping is complete.

[0157] It should be noted that the main difference between Thin Bootstrapping and General Bootstrapping is that the former only needs to calculate the removal on one ciphertext. part (S208), rather than the original K ciphertexts (S207).

[0158] For the above calculations of the CoeffToSlot transform split into multiple transforms and the calculation of the CoeffToSlot transform split into multiple transforms, the role of the SlotToCoeff transform in the BFV / BGV bootstrap is basically equivalent to a decoding function (Decode):

[0159] (9)

[0160] (10)

[0161] in, is the representative element corresponding to the i-th slot, satisfying the following:

[0162] (11)

[0163] in, yes In The second primitive root of unity, is an integer determined by the plaintext structure. for The minimal polynomial of .

[0164] Decode can be expressed as a composite of two sub-transformations:

[0165] (12)

[0166] in,

[0167] (13)

[0168] (14)

[0169] Among them, and are all considered as a length of of vector to facilitate the definition of subsequent linear transformations.

[0170] The above formula (14) is equivalent to the above first preset sub-transformation.

[0171] Since SlotToCoeff / CoeffToSlot is similar to the number-theoretic transform (NTT), its output value has the bit-reversal property. bit non-negative integer The bit decomposition of is:

[0172] (15)

[0173] The definition is as follows:

[0174] (16)

[0175] (17)

[0176] For a length of , if its The elements are , then define

[0177] (18)

[0178] (19)

[0179] Above and For two Permutation transformation of length.

[0180] The case of General Bootstrapping is discussed below, and the case of Thin Bootstrapping will be discussed later.

[0181] For the case where p≡1mod4:

[0182] Pick

[0183] (20)

[0184] in, ,but

[0185] (twenty one)

[0186] The definition is as follows:

[0187] (twenty two)

[0188] for ,matrix Defined as:

[0189] (twenty three)

[0190] (twenty four)

[0191] (25)

[0192] (26)

[0193] in, .

[0194] matrix Defined as:

[0195] (27)

[0196] (28)

[0197] (29)

[0198] (30)

[0199] in, .

[0200] The above formula (23) to formula (30) are equivalent to the above first preset matrix sub-transformation.

[0201] For the case where p≡3mod4:

[0202] Pick

[0203] (31)

[0204] Here are two decompositions: In the first method:

[0205] (32)

[0206] for ,definition

[0207] (33)

[0208] (34)

[0209] matrix Defined as:

[0210] (35)

[0211] (36)

[0212] (37)

[0213] (38)

[0214] (39)

[0215] (40)

[0216] (41)

[0217] (42)

[0218] (43)

[0219] (44)

[0220] (45)

[0221] (46)

[0222] in, .

[0223] matrix Defined as:

[0224] (47)

[0225] (48)

[0226] (49)

[0227] (50)

[0228] in, .

[0229] The above formula (35) to formula (50) are equivalent to the above second preset matrix sub-transformation.

[0230] In the second method:

[0231] (51)

[0232] for ,matrix Defined as

[0233] (52)

[0234] (53)

[0235] (54)

[0236] (55)

[0237] The above formula (52)-formula (55) is equivalent to the above third preset matrix sub-transformation.

[0238] Define the length of of Transformations on vectors ,satisfy Divisibility hour, ,otherwise , which is used to preserve the L of the plaintext polynomial coefficients (S207).

[0239] Each slot stores The elements in can be regarded as a The polynomial The coefficients can be compared with the standard basis It can also be expressed relative to a normal basis. Define a transformation (equivalent to the second preset sub-transformation mentioned above), which converts The coefficients in the standard basis are moved to the normal basis.

[0240] Based on the many linear transformations defined above, the specific expressions of CoeffToSlot and SlotToCoeff are given below.

[0241] In General Bootstrapping, CoeffToSlot and SlotToCoeff are as follows:

[0242] CoeffToSlot (56)

[0243] SlotToCoeff (57)

[0244] In Thin Bootstrapping, when When CoeffToSlot and SlotToCoeff are as follows:

[0245] SlotToCoeff (58)

[0246] CoeffToSlot= (59)

[0247] when When the first decomposition method is used, CoeffToSlot and SlotToCoeff are as follows:

[0248] SlotToCoeff (60)

[0249] CoeffToSlot= (61)

[0250] When using the second method, SlotToCoeff is the same as the first method, but CoeffToSlot is as follows:

[0251] CoeffToSlot= (62)

[0252] In actual use, multiple adjacent Merge into a single matrix to reduce the number of homomorphic layers consumed by CoeffToSlot / SlotToCoeff.

[0253] An embodiment of the present application provides an encryption method, which is applied to a bootstrap homomorphic library using a polynomial ring whose ring dimension N is an integer power of 2, including: obtaining a first ciphertext modulus, a first key, and a first plaintext modulus of the ciphertext to be bootstrapped, converting the ciphertext modulus of the ciphertext to be bootstrapped to obtain a second ciphertext modulus of the ciphertext to be bootstrapped, converting the key of the ciphertext to be bootstrapped of the second ciphertext modulus to obtain the ciphertext to be bootstrapped of the second key, converting the plaintext modulus of the ciphertext to be bootstrapped of the second key to obtain the ciphertext to be bootstrapped of the second plaintext modulus, encrypting the ciphertext to be bootstrapped of the second plaintext modulus using the first key and the third ciphertext modulus to obtain the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, and performing at least two operations on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus in sequence. A homomorphic linear sub-transformation is performed to put N coefficients in the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into the slots of K ciphertexts, L is the total number of slots, K is equal to N divided by L, and in each slot of the K ciphertext slots, the coefficient of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus is determined to obtain the bootstrapped ciphertext of the ciphertext to be bootstrapped; that is, in an embodiment of the present application, the homomorphic linear transformation is split into at least two homomorphic linear sub-transformations, so that at least two homomorphic linear sub-transformations are used sequentially in the bootstrap process in encryption, and the computational amount of performing at least two homomorphic linear sub-transformations sequentially is lower than the computational amount of the homomorphic linear sub-transformation, so that the computational amount of the homomorphic linear transformation can be reduced, thereby improving the bootstrap efficiency.

[0254] Based on the same inventive concept as the above-mentioned embodiment, the embodiment of the present application provides an encryption device, which is applied to a bootstrapped homomorphic library using a polynomial ring whose ring dimension N is an integer power of 2. Figure 3 A schematic diagram of the structure of an optional encryption device provided in an embodiment of the present application, such as Figure 3 As shown, the encryption device includes: an acquisition module 31, a first conversion module 32, a second conversion module 33, a third conversion module 34, a fourth conversion module 35, a sub-transformation module 36 and a determination module 37; wherein,

[0255] An acquisition module 31 is used to acquire the first ciphertext modulus, the first key and the first plaintext modulus to be bootstrapped;

[0256] A first conversion module 32, configured to convert the ciphertext modulus of the ciphertext to be bootstrapped to obtain the ciphertext to be bootstrapped of the second ciphertext modulus;

[0257] A second conversion module 33, configured to convert the key of the ciphertext to be bootstrapped of the second ciphertext modulus to obtain the ciphertext to be bootstrapped of the second key;

[0258] A third conversion module 34 is used to convert the plaintext modulus of the ciphertext to be bootstrapped of the second key to obtain the ciphertext to be bootstrapped of the second plaintext modulus;

[0259] A fourth conversion module 35 is used to encrypt the to-be-bootstrapped ciphertext of the second plaintext modulus by using the first key and the third ciphertext modulus to obtain the to-be-bootstrapped ciphertext of the first key and the third ciphertext modulus;

[0260] The sub-transformation module 36 is used to sequentially perform at least two homomorphic linear sub-transformations on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, so as to place N coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into slots of K ciphertexts; wherein L is the total number of slots; and K is equal to N divided by L;

[0261] The determination module 37 is used to determine the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus in each slot of the K ciphertext slots to obtain the bootstrapped ciphertext of the ciphertext to be bootstrapped.

[0262] In an optional embodiment, the determination module 37 is specifically configured to:

[0263] When the ciphertext to be bootstrapped adopts the first bootstrapped mode, in each slot of the K ciphertext slots, the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus are calculated;

[0264] The coefficients are sequentially subjected to inverse transformations of at least two homomorphic linear sub-transformations to move the coefficients to a plaintext polynomial of the to-be-bootstrapped ciphertext of the first key and the third ciphertext modulus.

[0265] In an optional embodiment, when the base p of the first plaintext modulus is 1 when divided by 4, at least two homomorphic linear sub-transformations include: an inverse transformation of a first preset sub-transformation, a first preset matrix sub-transformation, and a second preset sub-transformation; the inverse transformations of at least two homomorphic linear sub-transformations include: an inverse transformation of a first preset matrix sub-transformation and a first preset sub-transformation; wherein, in the first preset matrix sub-transformation, the number of diagonals in which the elements of the matrix are all zero is greater than a preset threshold.

[0266] In an optional embodiment, when the base p of the first plaintext modulus is a remainder 3 when divided by 4, at least two homomorphic linear sub-transformations include: an inverse transformation of the first preset sub-transformation, a second preset matrix sub-transformation, and a second preset sub-transformation; the inverse transformations of at least two homomorphic linear sub-transformations include: an inverse transformation of the second preset matrix sub-transformation and the first preset sub-transformation; wherein, in the second preset matrix sub-transformation, the number of diagonals in which the elements of the matrix are all zero is greater than a preset threshold.

[0267] In an optional embodiment, when the base p of the first plaintext modulus is 3 when divided by 4, at least two homomorphic linear sub-transformations include: an inverse transformation of the first preset sub-transformation, a third preset matrix sub-transformation, and a second preset sub-transformation; the inverse transformations of at least two homomorphic linear sub-transformations include: an inverse transformation of the third preset matrix sub-transformation and the first preset sub-transformation; wherein, in the third preset matrix sub-transformation, the number of diagonals in which the elements of the matrix are all zero is greater than a preset threshold.

[0268] In an optional embodiment, the acquisition module 31 is specifically configured to:

[0269] When the ciphertext to be bootstrapped adopts the second bootstrapped mode, obtaining the ciphertext to be bootstrapped of the first ciphertext modulus, the first key, and the first plaintext modulus;

[0270] The ciphertext to be bootstrapped is sequentially subjected to inverse transformations of at least two homomorphic linear sub-transformations to move L coefficients in the L slots to the plaintext polynomial of the ciphertext to be bootstrapped.

[0271] In an optional embodiment, when the base p of the first plaintext modulus is 1 when divided by 4, at least two homomorphic linear sub-transformations include: a third preset sub-transformation and a first preset matrix sub-transformation; the inverse transformations of at least two homomorphic linear sub-transformations include: an inverse transformation of the first preset matrix sub-transformation; wherein, in the first preset matrix sub-transformation, the number of diagonals in which the elements of the matrix are all zero is greater than a preset threshold.

[0272] In an optional embodiment, when the base p of the first plaintext modulus is a remainder 3 when divided by 4, at least two homomorphic linear sub-transformations include: a third preset sub-transformation, an inverse transformation of the first preset sub-transformation, and a second preset matrix sub-transformation; the inverse transformations of at least two homomorphic linear sub-transformations include: an inverse transformation of the second preset matrix sub-transformation and the first preset sub-transformation; wherein, in the second preset matrix sub-transformation, the number of diagonals in which the elements of the matrix are all zero is greater than a preset threshold.

[0273] In an optional embodiment, when the base p of the first plaintext modulus is a remainder 3 when divided by 4, at least two homomorphic linear sub-transformations include: a fourth preset sub-transformation, an inverse transformation of the first preset sub-transformation, a third preset matrix sub-transformation and a third preset sub-transformation; the inverse transformation of at least two homomorphic linear sub-transformations include: an inverse transformation of the third preset matrix sub-transformation and the first preset sub-transformation; wherein, in the third preset matrix sub-transformation, the number of diagonals in which the elements of the matrix are all zero is greater than a preset threshold.

[0274] In an optional embodiment, the first preset matrix sub-transformation includes: the jth first preset sub-matrix sub-transformation; the second preset matrix sub-transformation includes: the jth second preset sub-matrix sub-transformation; the third preset matrix sub-transformation includes: the jth third preset sub-matrix sub-transformation; wherein j is a positive integer from 1 to log2L.

[0275] In actual applications, the above-mentioned acquisition module 31, first conversion module 32, second conversion module 33, third conversion module 34, fourth conversion module 35, sub-transformation module 36 and determination module 37 can be implemented by a processor located on the encryption device, specifically a central processing unit (CPU), a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA).

[0276] Figure 4 A schematic diagram of the structure of an optional electronic device provided in an embodiment of the present application, such as Figure 4 As shown, an embodiment of the present application provides an electronic device 400, including:

[0277] A processor 41 and a storage medium 42 storing instructions executable by the processor; the storage medium 42 relies on the processor 41 to perform operations through a communication bus 43, and when the instructions are executed by the processor, the encryption method executed by the processor side in one or more of the above embodiments is executed.

[0278] It should be noted that in actual application, the various components in the computer device are coupled together through the communication bus 43. It is understandable that the communication bus 43 is used to realize the connection and communication between these components. In addition to the data bus, the communication bus 43 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, Figure 4 Various buses are labeled as communication buses 43.

[0279] An embodiment of the present application provides a computer storage medium storing executable instructions. When the executable instructions are executed by one or more processors, the processors execute the encryption method described in one or more of the above embodiments.

[0280] Among them, the computer readable storage medium can be a ferromagnetic random access memory (FRAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, a magnetic surface storage, an optical disk, or a compact disc read-only memory (CD-ROM) and other memories.

[0281] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may take the form of hardware embodiments, software embodiments, or embodiments combining software and hardware. Moreover, the present application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage and optical storage, etc.) containing computer-usable program codes.

[0282] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0283] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0284] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0285] The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. An encryption method, characterized in that: The homomorphic library used for bootstrapping uses a polynomial ring whose ring dimension N is an integer power of 2, including: Obtaining a first ciphertext modulus, a first key, and a first plaintext modulus ciphertext to be bootstrapped; Converting the ciphertext modulus of the ciphertext to be bootstrapped to obtain the ciphertext to be bootstrapped of the second ciphertext modulus; Converting the key of the ciphertext to be bootstrapped of the second ciphertext modulus to obtain the ciphertext to be bootstrapped of the second key; Converting the plaintext modulus of the ciphertext to be bootstrapped of the second key to obtain the ciphertext to be bootstrapped of the second plaintext modulus; Encrypting the to-be-bootstrapped ciphertext of the second plaintext modulus by using the first key and the third ciphertext modulus to obtain the to-be-bootstrapped ciphertext of the first key and the third ciphertext modulus; Performing at least two homomorphic linear sub-transformations on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus in sequence, so as to place N coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into slots of K ciphertexts; wherein K is equal to N divided by L; and L is the total number of slots; In each slot of the K ciphertext slots, coefficients of a plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus are determined to obtain a bootstrapped ciphertext of the ciphertext to be bootstrapped.

2. The method according to claim 1, characterized in that The step of determining, in each slot of the K ciphertext slots, the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus to obtain the bootstrapped ciphertext of the ciphertext to be bootstrapped comprises: In the case where the ciphertext to be bootstrapped adopts the first bootstrapped mode, in each slot of the K ciphertext slots, coefficients of a plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus are calculated; The coefficients are sequentially subjected to inverse transformations of at least two homomorphic linear sub-transformations to move the coefficients to a plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus.

3. The method according to claim 2, characterized in that include: In the case where the base p of the first plaintext modulus is a remainder of 1 when divided by 4, the at least two homomorphic linear sub-transformations include: an inverse transformation of the first preset sub-transformation, a first preset matrix sub-transformation, and a second preset sub-transformation; the at least two inverse transformations of the homomorphic linear sub-transformations include: an inverse transformation of the first preset matrix sub-transformation and the first preset sub-transformation; Among them, the number of diagonals in which the elements of the matrix in the first preset matrix sub-transformation are all zero is greater than a preset threshold.

4. The method according to claim 2, characterized in that: include: In the case where the base p of the first plaintext modulus is a remainder of 3 when divided by 4, the at least two homomorphic linear sub-transformations include: an inverse transformation of the first preset sub-transformation, a second preset matrix sub-transformation, and a second preset sub-transformation; the at least two inverse transformations of the homomorphic linear sub-transformations include: an inverse transformation of the second preset matrix sub-transformation and the first preset sub-transformation; The number of diagonals in which the elements of the matrix in the second preset matrix sub-transformation are all zero is greater than a preset threshold.

5. The method according to claim 4, characterized in that include: In the case where the base p of the first plaintext modulus is a remainder of 3 when divided by 4, the at least two homomorphic linear sub-transformations include: an inverse transformation of the first preset sub-transformation, a third preset matrix sub-transformation, and a second preset sub-transformation; the at least two inverse transformations of the homomorphic linear sub-transformations include: an inverse transformation of the third preset matrix sub-transformation and the first preset sub-transformation; The second preset matrix sub-transformation is different from the third preset matrix sub-transformation; and the number of diagonals in which the elements of the matrix in the third preset matrix sub-transformation are all zero is greater than a preset threshold.

6. The method according to claim 1, characterized in that The step of obtaining the first ciphertext modulus, the first key, and the first plaintext modulus to be bootstrapped includes: When the ciphertext to be bootstrapped adopts the second bootstrapped mode, obtaining the ciphertext to be bootstrapped of the first ciphertext modulus, the first key and the first plaintext modulus; The ciphertext to be bootstrapped is sequentially subjected to inverse transformation of at least two homomorphic linear sub-transformations to move L coefficients in the L slots to the plaintext polynomial of the ciphertext to be bootstrapped.

7. The method according to claim 6, characterized in that include: In the case where the base p of the first plaintext modulus is a remainder of 1 when divided by 4, the at least two homomorphic linear sub-transformations include: a third preset sub-transformation and a first preset matrix sub-transformation; and the inverse transformations of the at least two homomorphic linear sub-transformations include: an inverse transformation of the first preset matrix sub-transformation; Among them, the number of diagonals in which the elements of the matrix in the first preset matrix sub-transformation are all zero is greater than a preset threshold.

8. The method according to claim 6, characterized in that include: In the case where the base p of the first plaintext modulus is a remainder of 3 when divided by 4, the at least two homomorphic linear sub-transformations include: a third preset sub-transformation, an inverse transformation of the first preset sub-transformation, and a second preset matrix sub-transformation; the at least two inverse transformations of the homomorphic linear sub-transformations include: an inverse transformation of the second preset matrix sub-transformation and the first preset sub-transformation; The number of diagonals in which the elements of the matrix in the second preset matrix sub-transformation are all zero is greater than a preset threshold.

9. The method according to claim 6, characterized in that include: In the case where the base p of the first plaintext modulus is a remainder of 3 when divided by 4, the at least two homomorphic linear sub-transformations include: a fourth preset sub-transformation, an inverse transformation of the first preset sub-transformation, a third preset matrix sub-transformation, and a third preset sub-transformation; the at least two inverse transformations of the homomorphic linear sub-transformations include: an inverse transformation of the third preset matrix sub-transformation and the first preset sub-transformation; The number of diagonals whose matrix elements are all zero in the third preset matrix sub-transformation is greater than a preset threshold.

10. The method according to claim 3 or 7, characterized in that: The first preset matrix sub-transformation includes: a j-th first preset sub-matrix sub-transformation; Among them, j takes values ​​from 1 to A positive integer.

11. The method according to claim 4 or 8, characterized in that: The second preset matrix sub-transformation includes: a j-th second preset sub-matrix sub-transformation; Among them, j takes values ​​from 1 to A positive integer.

12. The method according to claim 5 or 9, characterized in that: The third preset matrix sub-transformation includes: a j-th third preset sub-matrix sub-transformation; Among them, j takes values ​​from 1 to A positive integer.

13. An encryption device, characterized in that: The homomorphic library used for bootstrapping uses a polynomial ring whose ring dimension N is an integer power of 2, including: An acquisition module, used to acquire the first ciphertext modulus, the first key and the ciphertext to be bootstrapped of the first plaintext modulus; A first conversion module, configured to convert the ciphertext modulus of the ciphertext to be bootstrapped to obtain the ciphertext to be bootstrapped of a second ciphertext modulus; A second conversion module, used to convert the key of the ciphertext to be bootstrapped of the second ciphertext modulus to obtain the ciphertext to be bootstrapped of the second key; A third conversion module, used to convert the plaintext modulus of the ciphertext to be bootstrapped of the second key to obtain the ciphertext to be bootstrapped of the second plaintext modulus; a fourth conversion module, configured to encrypt the to-be-bootstrapped ciphertext of the second plaintext modulus by using the first key and the third ciphertext modulus to obtain the to-be-bootstrapped ciphertext of the first key and the third ciphertext modulus; a sub-transformation module, configured to sequentially perform at least two homomorphic linear sub-transformations on the ciphertext to be bootstrapped of the first key and the third ciphertext modulus, so as to place N coefficients in the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus into slots of K ciphertexts; wherein K is equal to N divided by L; and L is the total number of slots; The determination module is used to determine the coefficients of the plaintext polynomial of the ciphertext to be bootstrapped of the first key and the third ciphertext modulus in each slot of the K ciphertext slots to obtain the bootstrapped ciphertext of the ciphertext to be bootstrapped.

14. An electronic device, characterized in that: include: A processor and a storage medium storing instructions executable by the processor; The storage medium relies on the processor to perform operations through a communication bus, and when the instructions are executed by the processor, the encryption method described in any one of claims 1 to 12 is executed.

15. A computer storage medium, characterized in that Executable instructions are stored, and when the executable instructions are executed by one or more processors, the processors execute the encryption method described in any one of claims 1 to 12.

Images