A method, device, equipment and storage medium for BFV fully homomorphic encryption bootstrapping

Abstract

The present application discloses a method, apparatus, device and storage medium for BFV fully homomorphic encryption bootstrapping, the method comprising: performing multiple analog-to-digital conversion processes on the initial BFV ciphertext to be bootstrapped to obtain a first BFV ciphertext; determining a second BFV ciphertext based on a key conversion public key from a first key to an initial key and the first BFV ciphertext; the first key is obtained after converting the initial key; removing the low-digit numbers of the coefficients of the second plaintext polynomial in the second BFV ciphertext to obtain the bootstrapped ciphertext. In this way, since the ciphertext modulus of the second BFV ciphertext is greater than the ciphertext modulus of the first BFV ciphertext, the initial BFV ciphertext can be converted to a larger ciphertext modulus, and further, removing the low-digit numbers of the coefficients of the second plaintext polynomial through the annihilation polynomial corresponding to the second plaintext polynomial can reduce the coefficients of the second plaintext polynomial, thereby reducing the computational complexity of the algorithm, determining the bootstrapped ciphertext more quickly, and improving the efficiency of BFV bootstrapping.

Description

Technical Field

[0001] The present application relates to the field of homomorphic encryption technology, and in particular to a method, apparatus, device and storage medium for BFV fully homomorphic encryption bootstrapping. Background Art

[0002] Fully Homomorphic Encryption (FHE) is a special type of encryption scheme that allows anyone to perform unlimited calculations on encrypted data without holding the decryption key. FHE is widely used in the field of privacy computing, among which the most typical application scenario is outsourced computing: users upload a large amount of homomorphically encrypted data to a cloud server, use the powerful computing power of the cloud server to perform complex calculations on the ciphertext, and finally the cloud server returns the calculation results to the user in the form of homomorphically encrypted ciphertext. In this process, the cloud server can only see the user's ciphertext, so the user's data privacy is protected. The current mainstream FHE schemes include CKKS (Cheon-Kim-Kim-Song), BGV (Brakerski-Gentry-Vaikuntanathan), BFV (Brakerski-Fan-Vercauteren) and TFHE (Troy-Fan-Homomorphic Encryption).

[0003] Bootstrapping is an important algorithm in the FHE scheme. Without bootstrapping, the FHE scheme can only perform a limited number of homomorphic computations. Bootstrapping is usually the most time-consuming part of fully homomorphic computations and is the efficiency bottleneck of the FHE scheme. Currently, the efficiency of CKKS, TFHE, and BGV bootstrapping is relatively high, but the efficiency of BFV bootstrapping is still relatively low, especially when the plaintext modulus of BFV has a large prime factor (hereinafter referred to as the plaintext prime). Summary of the invention

[0004] The embodiments of the present application provide a method, apparatus, device and storage medium for BFV fully homomorphic encryption bootstrapping, which can improve the efficiency of BFV bootstrapping.

[0005] The technical solution of this application is implemented as follows:

[0006] In a first aspect, a BFV fully homomorphic encryption bootstrapping method is provided, comprising:

[0007] Performing multiple analog-to-digital conversion processes on the initial BFV ciphertext to be bootstrapped to obtain a first BFV ciphertext; the initial BFV ciphertext includes an initial key for polynomial encryption of the first plaintext;

[0008] Determine a second BFV ciphertext based on a key conversion public key from a first key to the initial key and the first BFV ciphertext, wherein the first key is obtained by converting the initial key, and a ciphertext modulus of the second BFV ciphertext is greater than a ciphertext modulus of the first BFV ciphertext;

[0009] Based on the annihilation polynomial corresponding to the second plaintext polynomial in the second BFV ciphertext, the low-order digits of the coefficients of the second plaintext polynomial are removed to obtain the bootstrapped ciphertext.

[0010] In a second aspect, a BFV fully homomorphic encryption bootstrapping device is provided, comprising:

[0011] A first processing module is used to perform multiple analog-to-digital conversion processes on the initial BFV ciphertext to be bootstrapped to obtain a first BFV ciphertext; the initial BFV ciphertext includes an initial key for encrypting the first plaintext polynomial;

[0012] A first determining module, configured to determine a second BFV ciphertext based on a key conversion public key from a first key to the initial key and the first BFV ciphertext, wherein the first key is obtained by converting the initial key, and a ciphertext modulus of the second BFV ciphertext is greater than a ciphertext modulus of the first BFV ciphertext;

[0013] The second processing module is used to remove the low-digit digits of the coefficients of the second plaintext polynomial in the second BFV ciphertext based on the annihilation polynomial corresponding to the second plaintext polynomial, so as to obtain the bootstrapped ciphertext; wherein the plaintext polynomial in the bootstrapped ciphertext is the first plaintext polynomial, and the coefficients of the first plaintext polynomial are the coefficients obtained by removing the low-digit digits of the coefficients of the second plaintext polynomial.

[0014] In a third aspect, a BFV fully homomorphic encryption bootstrap device is provided, comprising: a processor and a memory; wherein,

[0015] The memory is used to store a computer program that can be run on the processor;

[0016] The processor is used to execute the BFV fully homomorphic encryption bootstrapping method provided in an embodiment of the present application when running the computer program.

[0017] In a fourth aspect, a computer-readable storage medium is provided, on which a computer program code is stored. When the computer program code is executed by a computer, the BFV fully homomorphic encryption bootstrapping method provided in an embodiment of the present application is executed.

[0018] In an embodiment of the present application, a method for BFV fully homomorphic encryption bootstrapping is provided, including: performing multiple modulus-to-digital conversion processes on the initial BFV ciphertext to be bootstrapped to obtain a first BFV ciphertext; determining a second BFV ciphertext based on a key conversion public key from a first key to an initial key and the first BFV ciphertext; the first key is obtained after converting the initial key, and the ciphertext modulus of the second BFV ciphertext is greater than the ciphertext modulus of the first BFV ciphertext; removing the low-digit numbers of the coefficients of the second plaintext polynomial in the second BFV ciphertext to obtain the bootstrapped ciphertext. In this way, since the ciphertext modulus of the second BFV ciphertext is greater than the ciphertext modulus of the first BFV ciphertext, the initial BFV ciphertext can be converted to a larger ciphertext modulus, and further, removing the low-digit numbers of the coefficients of the second plaintext polynomial through the annihilation polynomial corresponding to the second plaintext polynomial can reduce the coefficients of the second plaintext polynomial, thereby reducing the computational complexity of the algorithm, determining the bootstrapped ciphertext more quickly, and improving the efficiency of BFV bootstrapping. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] Figure 1 A flowchart of a BFV fully homomorphic encryption bootstrapping method provided in an embodiment of the present application;

[0020] Figure 2 A flowchart of another BFV fully homomorphic encryption bootstrapping method provided in an embodiment of the present application;

[0021] Figure 3 A schematic diagram of the composition structure of a BFV fully homomorphic encryption bootstrapping device provided in an embodiment of the present application;

[0022] Figure 4 A schematic diagram of the composition structure of a BFV fully homomorphic encryption bootstrap device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to enable a more detailed understanding of the features and technical contents of the embodiments of the present application, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application.

[0024] In the related technology, a method for implementing BFV bootstrapping based on CKKS is proposed in the article Simpler and Faster BFV Bootstrapping for ArbitraryPlaintext Modulus from CKKS. Each ciphertext multiplication consumes a large ciphertext modulus, so bootstrapping needs to be performed on a larger ciphertext modulus. In order to ensure the security of the scheme while using a large ciphertext modulus, a larger ring dimension needs to be selected, so the flexibility of parameter selection is poor.

[0025] Based on the problems in the related art, this application provides a BFV fully homomorphic encryption bootstrapping method, which can be applied to outsourced computing (such as platform outsourcing computing, software outsourcing computing), privacy computing (such as privacy set intersection) and other scenarios. The method can be executed by a cloud server, a cryptographic machine server, etc. Figure 1 As shown, the method includes:

[0026] S101, performing multiple analog-to-digital conversion processes on the initial BFV ciphertext to be bootstrapped to obtain a first BFV ciphertext.

[0027] In some embodiments, the initial BFV ciphertext is a BFV ciphertext that has not been bootstrapped or needs to be bootstrapped, the plaintext modulus of the first BFV ciphertext is the same as the plaintext modulus of the initial BFV, and the ciphertext modulus of the first BFV ciphertext is smaller than the ciphertext modulus of the initial BFV ciphertext; the plaintext modulus of the plaintext polynomial corresponding to the first BFV ciphertext and the plaintext modulus of the plaintext polynomial corresponding to the initial BFV ciphertext may be the same.

[0028] In some embodiments, the analog-to-digital conversion process may be to transform the ciphertext modulus of the initial BFV ciphertext, for example, to convert the ciphertext modulus of the initial BFV ciphertext to a larger ciphertext modulus. The initial BFV ciphertext may be subjected to at least two analog-to-digital conversions to obtain a first BFV ciphertext, for example, the initial BFV ciphertext may be subjected to an analog-to-digital conversion once to obtain a first reference BFV ciphertext, and then a key conversion technique may be used to convert the key in the first reference BFV ciphertext into a sparse bootstrap key to obtain a second reference BFV ciphertext, and then the second reference BFV ciphertext may be subjected to an analog-to-digital conversion to obtain the first BFV ciphertext.

[0029] In some embodiments, the initial BFV ciphertext may be obtained by encrypting the first plaintext polynomial with an initial key, the initial key may be in polynomial form, and the initial key may belong to a polynomial ring determined by the ciphertext modulus of the initial BFV ciphertext.

[0030] S102: Determine a second BFV ciphertext based on a key conversion public key from the first key to the initial key and the first BFV ciphertext.

[0031] In some embodiments, the first key is obtained by converting the initial key, the first key may be a sparse bootstrap key, the ciphertext modulus of the second BFV ciphertext is greater than the ciphertext modulus of the first BFV ciphertext, and the decryption key of the first BFV ciphertext is different from the decryption key of the second BFV ciphertext.

[0032] In some embodiments, a new key can be determined based on the initial key and the first key, and the first BFV ciphertext can be key-converted based on the new key to determine the second BFV ciphertext. The second BFV ciphertext can also be created based on the new key and components of the first BFV ciphertext.

[0033] S103. Based on the annihilation polynomial corresponding to the second plaintext polynomial in the second BFV ciphertext, remove the low-order digits of the coefficients of the second plaintext polynomial to obtain the bootstrapped ciphertext.

[0034] In some embodiments, the plaintext polynomial in the bootstrapped ciphertext is a first plaintext polynomial, and the coefficients of the first plaintext polynomial are coefficients obtained by removing low-order digits of coefficients of the second plaintext polynomial.

[0035] In some embodiments, the second plaintext polynomial is different from the first plaintext polynomial, the second plaintext polynomial may include the first plaintext polynomial, and the plaintext modulus corresponding to the second plaintext polynomial is greater than the plaintext modulus of the first plaintext polynomial.

[0036] In some embodiments, a annihilation polynomial corresponding to the second plaintext polynomial can be created based on the plaintext modulus corresponding to the second BFV ciphertext and the ring dimension corresponding to the ciphertext modulus. The annihilation polynomial is used to remove the low-order digits of the coefficients of the second plaintext polynomial. The coefficients in the second plaintext polynomial and the redundant parts different from the first plaintext polynomial can be removed to obtain the first plaintext polynomial, that is, the coefficients of the first plaintext polynomial are obtained.

[0037] In some embodiments, after removing the low-order digits of the coefficients of the plaintext polynomial in the second BFV ciphertext, the bootstrapped ciphertext obtained is a new BFV ciphertext, and the ciphertext modulus of the new BFV ciphertext is greater than the ciphertext modulus of the second BFV ciphertext.

[0038] In an embodiment of the present application, the initial BFV ciphertext to be bootstrapped is subjected to multiple analog-to-digital conversion processes to obtain a first BFV ciphertext; based on the key conversion public key from the first key to the initial key and the first BFV ciphertext, the second BFV ciphertext is determined; the first key is obtained after the initial key is converted, and the ciphertext modulus of the second BFV ciphertext is greater than the ciphertext modulus of the first BFV ciphertext; the coefficient of the second plaintext polynomial in the second BFV ciphertext is removed to obtain the bootstrapped ciphertext. In this way, since the ciphertext modulus of the second BFV ciphertext is greater than the ciphertext modulus of the first BFV ciphertext, the initial BFV ciphertext can be converted to a larger ciphertext modulus. Further, by removing the coefficient of the second plaintext polynomial through the annihilation polynomial corresponding to the second plaintext polynomial, the coefficient of the second plaintext polynomial can be reduced, thereby reducing the computational complexity of the algorithm, determining the bootstrapped ciphertext more quickly, and improving the efficiency of BFV bootstrapping.

[0039] In some embodiments of the present application, the initial BFV ciphertext to be bootstrapped is subjected to multiple analog-to-digital conversion processes to obtain a first BFV ciphertext, that is, the above-mentioned step S101 can be implemented by the following steps S1011 to S1014, and each step is described separately below.

[0040] S1011. Perform analog-to-digital conversion on the initial BFV ciphertext to obtain a first reference BFV ciphertext.

[0041] In some embodiments, the ciphertext modulus of the first reference BFV ciphertext may be greater than or less than the ciphertext modulus of the initial BFV ciphertext. By performing modulus-to-digital conversion on the initial BFV ciphertext, the converted ciphertext may belong to the polynomial ring determined by the new ciphertext modulus.

[0042] For example, the initial BFV ciphertext can be expressed by formula (1):

[0043] (1);

[0044] Among them, a, b, respectively represent the two parts of the initial BFV ciphertext, s represents the initial key, q0 represents the ciphertext modulus corresponding to the initial BFV ciphertext, represents a polynomial ring, is a polynomial with smaller coefficients (usually the coefficients are selected by Gaussian sampling), pr is the plaintext modulus, p is the plaintext prime number, r is a positive integer, and m is the first plaintext polynomial. The ciphertext modulus can be converted from q0 to qks through modulus-to-digital conversion to obtain the first reference BFV ciphertext c1.

[0045] S1012: Convert the initial key to obtain a first key.

[0046] In some embodiments, the first reference BFV ciphertext includes an initial key, that is, the encryption key remains unchanged during the process of performing analog-to-digital conversion on the initial BFV ciphertext. By converting the initial key, a sparse first key can be obtained, and the value range of the first key and the initial key can be the same, for example, both can be [-1, 1], and the Hamming weight of the first key is less than the Hamming weight of the initial key.

[0047] It is understandable that by converting the initial key, a sparse first key can be obtained, so that the subsequent encryption or bootstrapping of the ciphertext using the first key has a faster calculation speed.

[0048] S1013. Determine a second reference BFV ciphertext based on the first key and the first reference BFV ciphertext.

[0049] In some embodiments, the second reference BFV ciphertext belongs to the polynomial ring determined by the ciphertext modulus of the first reference BFV ciphertext, that is, the ciphertext modulus corresponding to the second reference BFV ciphertext and the first reference BFV ciphertext is the same, or the value range of the polynomial coefficients corresponding to the second reference BFV ciphertext and the first reference BFV ciphertext is the same, and the value range of the degree of the polynomial is also the same.

[0050] In some embodiments, after converting the initial key to obtain the first key, the initial key in the first reference BFV ciphertext may be converted to the first key, thereby obtaining the second reference BFV ciphertext. Exemplarily, the second reference BFV ciphertext c2 may be represented by formula (2):

[0051] (2);

[0052] Among them, a2, b2, respectively represent the two parts of the initial BFV ciphertext, s' represents the first key, q ks Indicates the ciphertext modulus corresponding to the second reference BFV ciphertext, represents a polynomial ring, is a polynomial with small coefficients (usually the coefficients are chosen by Gaussian sampling).

[0053] S1014. Perform analog-to-digital conversion on the second reference BFV ciphertext to obtain a first BFV ciphertext.

[0054] In some embodiments, the ciphertext modulus of the first BFV ciphertext is different from the ciphertext modulus of the first reference BFV ciphertext, and the ciphertext modulus of the first BFV ciphertext is smaller than the ciphertext modulus of the second reference ciphertext. By performing modulus-to-digital conversion on the second reference BFV ciphertext, a first BFV ciphertext with a larger ciphertext modulus can be obtained, so that subsequent homomorphic encryption calculations can be performed based on the first BFV ciphertext.

[0055] For example, if the ciphertext modulus of the second reference BFV ciphertext c2 is q ks , the ciphertext modulus of the first BFV ciphertext c3 can be p r+t , t is a positive integer, the first BFV ciphertext c3 can be expressed by the following formula (3):

[0056] (3);

[0057] in, , Each coefficient of follows a uniform distribution of (-0.5, 0.5).

[0058] It can be understood that by converting the first key and the first reference BFV ciphertext after the initial key is converted, the second reference BFV ciphertext is determined, and the modulus-to-digital conversion is performed based on the second reference BFV ciphertext, a ciphertext with a smaller ciphertext modulus can be obtained, and the smaller ciphertext modulus is subsequently used to determine the plaintext modulus corresponding to the second plaintext polynomial, which can improve the processing efficiency of removing low-digit digits of the coefficients of the second plaintext polynomial; in addition, using the converted sparse first key to encrypt the ciphertext can improve the computational efficiency of the bootstrap algorithm.

[0059] In some embodiments of the present application, based on the key conversion public key from the first key to the initial key and the first BFV ciphertext, the second BFV ciphertext is determined, that is, the above-mentioned step S102 can be implemented by the following steps S1021 to S1022, and each step is described separately below.

[0060] S1021. Use the initial key to encrypt the first key to obtain a reference key.

[0061] In some embodiments, the first key may be encrypted using the initial key under the ciphertext modulus corresponding to the initial key to obtain the corresponding reference key, wherein the ciphertext modulus corresponding to the first key is greater than the ciphertext modulus corresponding to the first BFV ciphertext. The reference key may be regarded as a key conversion public key for switching from the first key to the initial key.

[0062] S1022. Determine a second BFV ciphertext based on the reference key and the first BFV ciphertext.

[0063] In some embodiments, a second BFV ciphertext may be constructed based on a reference key and components of the first BFV ciphertext. For example, if the second BFV ciphertext It can be expressed by the following formula (4):

[0064] (4);

[0065] in, It is the reference key obtained by encrypting the first key s' with the initial key.

[0066] It can be understood that by using the initial key to encrypt the first key, and based on the initial key and the first BFV ciphertext, a second BFV ciphertext with a larger ciphertext modulus can be determined, so that homomorphic encryption calculations can be continued based on the second BFV ciphertext.

[0067] In some embodiments of the present application, based on the annihilation polynomial corresponding to the second plaintext polynomial in the second BFV ciphertext, the low-order digits of the coefficients of the second plaintext polynomial are removed to obtain the bootstrapped ciphertext, that is, step S103 can be implemented by the following steps S1031 to S1033, and each step is described separately below.

[0068] S1031. Perform a homomorphic linear transformation on the second BFV ciphertext to obtain a third BFV ciphertext.

[0069] In some embodiments, by performing a homomorphic linear transformation on the second BFV ciphertext, the N coefficients of the second plaintext polynomial can be placed in L ciphertext slots, each ciphertext slot stores N / L coefficients, thereby obtaining a third BFV ciphertext, where L is the number of plaintexts corresponding to the first plaintext polynomial, N is the number of coefficients of the first plaintext polynomial, and N / L is a positive integer. The ciphertext modulus of the third BFV ciphertext may be different from the ciphertext modulus of the second BFV ciphertext.

[0070] S1032. Split the third BFV ciphertext into N / L sub-ciphertexts.

[0071] In some embodiments, by splitting the third BFV ciphertext, only one integer value can be stored in each ciphertext slot, and the integer value is the coefficient of the plaintext polynomial in the third BFV ciphertext.

[0072] In some embodiments, the coefficients of the plaintext polynomials corresponding to different sub-ciphertexts may be different, and the form of the plaintext polynomial corresponding to the sub-ciphertext may be different from the form of the second plaintext polynomial.

[0073] In some embodiments, the coefficients of the plaintext polynomials corresponding to the N / L sub-ciphertexts can be placed in their respective corresponding ciphertext slots in sequence, each sub-ciphertext corresponds to L ciphertext slots, and each ciphertext slot can store 1 coefficient of the plaintext polynomial corresponding to the second BFV ciphertext.

[0074] S1033. Perform homomorphic digit removal on the integer value in the ciphertext slot corresponding to the N / Lth sub-ciphertext based on the annihilation polynomial corresponding to the second plaintext polynomial to obtain a bootstrapped ciphertext.

[0075] In some embodiments, a annihilation polynomial corresponding to the second plaintext polynomial may be created first. The annihilation polynomial f(x) may be expressed by formula (5):

[0076] (5);

[0077] Among them, k satisfies The smallest positive integer, the coefficient of I ranges from [low, high], and the values ​​of low and high can be , h is the Hamming weight of s'.

[0078] In some embodiments, in addition to constructing the annihilation polynomial f(x), a minimum bit extraction polynomial g(x) may also be constructed. g(x) may be expressed by formula (6):

[0079] (6);

[0080] This formula indicates that the value range of x is 0, 1, 2, ..., , the value range of g(x) is also 0, 1, 2, ..., In the process of using the annihilation polynomial to homomorphically remove the N coefficients of the plaintext polynomial corresponding to the sub-ciphertext in the i-th ciphertext slot, the polynomial that needs to be homomorphically calculated can be , x is the integer value in the i-th ciphertext slot, replace x with , we can get , and then from Subtract it from the original value and divide the result by , we can get the coefficients of the plaintext polynomial in the i-th ciphertext slot .

[0081] In some embodiments, the plaintext polynomial in the ciphertext after bootstrapping is the first plaintext polynomial. After homomorphic bit number removal is performed in each ciphertext slot, N coefficients can be moved from each ciphertext slot to the coefficients of the first plaintext polynomial. The homomorphic inverse linear transformation can be used to splice the N coefficients corresponding to each of the N / L ciphertext slots. During the homomorphic inverse linear transformation, the coefficients of the same polynomial can be spliced. For example, the coefficients of the first terms of the polynomials corresponding to each of the 1st to N / Lth ciphertext slots are spliced ​​to obtain the coefficients of the first term of the first plaintext polynomial. The method for determining the coefficients of other polynomials is similar to this to obtain the coefficients of the N terms of the first plaintext polynomial.

[0082] In some embodiments, after performing homomorphic digit removal on the integer values ​​in the ciphertext slots corresponding to each sub-ciphertext based on the annihilation polynomial corresponding to the second plaintext polynomial, the coefficients of the first plaintext polynomial and the new ciphertext in the form of the plaintext polynomial of the first plaintext polynomial can be obtained, that is, the bootstrapped ciphertext, and the ciphertext modulus of the bootstrapped ciphertext is greater than the ciphertext modulus of the second BFV ciphertext.

[0083] It can be understood that by using the annihilation polynomial corresponding to the second plaintext polynomial to perform homomorphic digit removal on the integer value in the ciphertext slot corresponding to the sub-ciphertext in each ciphertext slot, the original first plaintext polynomial is restored to obtain the bootstrapped ciphertext based on the first plaintext polynomial, thereby ensuring that subsequent homomorphic encryption calculations are performed on the basis of the original first plaintext polynomial to be decrypted.

[0084] In some embodiments of the present application, the ciphertext after BFV bootstrapping may also be determined through the following steps S201 to S204, and each step is described below.

[0085] S201. Obtain a plaintext modulus corresponding to a first plaintext polynomial.

[0086] In some embodiments, the plaintext modulus corresponding to the first plaintext polynomial may be predetermined, and the plaintext modulus may be , p is a plaintext prime number, and r is a positive integer. For the BFV homomorphic encryption algorithm, the plaintext modulus corresponding to the first plaintext polynomial can remain unchanged during the bootstrapping process.

[0087] S202: Determine a first BGV ciphertext based on the plaintext modulus and the initial BFV ciphertext to be bootstrapped.

[0088] In some embodiments, the first BGV ciphertext is different from the first BFV ciphertext, and the first BGV ciphertext may be a BGV ciphertext obtained by converting the BFV ciphertext and the plaintext modulus of the first plaintext polynomial in the initial BFV ciphertext.

[0089] For example, if the plaintext modulus of the first plaintext polynomial m is , the initial BFV ciphertext to be bootstrapped is as shown in formula (1), then the first BGV ciphertext It can be expressed by formula (7):

[0090] (7);

[0091] S203 , bootstrapping the first BGV ciphertext to obtain a second BGV ciphertext.

[0092] In some embodiments, the ciphertext modulus of the second BGV ciphertext is greater than the ciphertext modulus of the first BGV ciphertext. The second BGV ciphertext can be obtained by performing one or more conversions on the ciphertext modulus corresponding to the first BGV ciphertext, converting the key of the first BGV ciphertext into a sparse bootstrap key, and the like.

[0093] S204 . Based on the ciphertext modulus of the second BGV ciphertext and the plaintext modulus of the first plaintext polynomial, convert the second BGV ciphertext to obtain a bootstrapped BFV ciphertext.

[0094] In some embodiments, after obtaining the second BGV ciphertext after BGV bootstrapping, the second BGV ciphertext can be converted into a bootstrapped BFV ciphertext according to the ciphertext modulus of the second BGV ciphertext and the plaintext modulus of the first plaintext polynomial.

[0095] For example, according to formula (7), It is encrypted The BGV ciphertext, Therefore, we only need to encrypt of Multiply The inverse , you can reversely calculate the BFV ciphertext that encrypts m .

[0096] It can be understood that by performing BGV bootstrapping on the first BGV ciphertext determined by the plaintext modulus of the first plaintext polynomial and the initial BFV ciphertext to obtain the second BGV ciphertext, and converting the second BGV ciphertext according to the ciphertext modulus of the second BGV ciphertext and the plaintext modulus of the first plaintext polynomial, it is possible to directly convert the ciphertext based on the BGV bootstrap to obtain the bootstrapped BFV ciphertext, thereby improving the efficiency of the BFV bootstrap.

[0097] In some embodiments of the present application, the first BGV ciphertext is bootstrapped to obtain the second BGV ciphertext, that is, the above step S203 can be implemented by the following steps S2031A to S2035A, and each step is described below.

[0098] S2031A. Perform analog-to-digital conversion on the first BGV ciphertext to obtain a first reference BGV ciphertext.

[0099] In some embodiments, the ciphertext modulus of the first reference BGV ciphertext is smaller than the ciphertext modulus of the first BGV ciphertext, and a converted ciphertext modulus may be determined first, thereby determining the first reference BGV ciphertext converted to the ciphertext modulus.

[0100] S2032A. Transform the key in the first reference BGV ciphertext to obtain a second reference BGV ciphertext.

[0101] In some embodiments, the ciphertext modulus of the second reference BGV ciphertext is the same as the ciphertext modulus of the first reference BGV ciphertext. Transforming the key in the first reference BGV ciphertext may be converting the ciphertext modulus in the first reference BGV ciphertext into a sparse key, and determining the second reference BGV ciphertext based on the key.

[0102] S2033A. Determine a third reference BGV ciphertext based on the second reference BGV ciphertext and a preset plaintext modulus.

[0103] In some embodiments, the preset plaintext modulus may be a pre-set plaintext modulus, for example, , t can be a positive integer, and the product of the second reference BGV ciphertext and the preset plaintext modulus can be used as the third reference BGV ciphertext.

[0104] S2034A. Perform analog-to-digital conversion on the third reference BGV ciphertext to obtain a fourth reference BGV ciphertext.

[0105] In some embodiments, the ciphertext modulus of the fourth BGV ciphertext is greater than the ciphertext modulus of the third reference BGV ciphertext, and the BGV ciphertext can be converted to a fourth BGV ciphertext with a higher ciphertext modulus by performing modulus-to-digital conversion on the third reference BGV ciphertext.

[0106] S2035A. Based on the annihilation polynomial corresponding to the third plaintext polynomial in the fourth reference BGV ciphertext, remove the low-order digits of the coefficients of the third plaintext polynomial to obtain a second BGV ciphertext.

[0107] In some embodiments, the third plaintext polynomial is different from the first plaintext polynomial in the initial BFV ciphertext. Therefore, by removing the low-bit numbers of the coefficients in the third plaintext polynomial through the annihilation polynomial, a new ciphertext, i.e., the second BGV ciphertext, can be obtained. The coefficients of the plaintext polynomial in the second BGV ciphertext are the coefficients of the first plaintext polynomial, but the ciphertext modulus corresponding to the second BGV ciphertext is different from the ciphertext modulus corresponding to the first BGV ciphertext, the ciphertext modulus corresponding to the second reference BGV ciphertext, the ciphertext modulus corresponding to the third reference BGV ciphertext, and the ciphertext modulus corresponding to the fourth reference ciphertext are all different.

[0108] Exemplarily, in some embodiments, the process of bootstrapping the first BGV ciphertext to obtain the second BGV ciphertext may also be implemented by the following steps:

[0109] S2031B, input the first BGV ciphertext to be bootstrapped ;

[0110] S2032B, using analog-to-digital conversion technology, The ciphertext modulus is converted to On, get ;

[0111] S2033B, using key conversion technology, The key is converted into a sparse bootstrap key, and we get ;

[0112] S2034B, Multiply ,get , the encrypted plaintext becomes [ ] ;

[0113] S2035B, directly The ciphertext modulus is regarded as Q, and we get , the encrypted plaintext is ;

[0114] S2036B, use a homomorphic linear transformation to The N coefficients of are placed into the slots of N / L ciphertexts;

[0115] S2037B, using the constructed annihilation polynomial, construct a series of low-degree polynomials to homomorphically obtain the value of work out .

[0116] S2038B, use a homomorphic linear transformation to homomorphically transform The N coefficients of are moved from the slot to the coefficients of a single plaintext polynomial, and the bootstrapping is completed to obtain the second BGV ciphertext , is the ciphertext modulus corresponding to the second BGV ciphertext, .

[0117] It can be understood that by performing analog-to-digital conversion on the first BGV ciphertext, a first reference BGV ciphertext is obtained; the key in the first reference BGV ciphertext is transformed to obtain a second reference BGV ciphertext; based on the second reference BGV ciphertext and a preset plaintext modulus, a third reference BGV ciphertext is determined; the third reference BGV ciphertext is subjected to analog-to-digital conversion to obtain a fourth reference BGV ciphertext; based on the annihilation polynomial corresponding to the third plaintext polynomial in the fourth reference BGV ciphertext, the low-order digits of the coefficients of the third plaintext polynomial are removed to obtain a second BGV ciphertext, which can realize BGV bootstrapping and obtain a second BGV ciphertext whose ciphertext modulus is greater than that of the first BGV ciphertext, so as to facilitate the subsequent acquisition of the bootstrapped BFV ciphertext based on the second BGV ciphertext.

[0118] The present application embodiment provides another BFV fully homomorphic encryption bootstrapping method, such as Figure 2 As shown, the method can be implemented by the following steps S301 to S309:

[0119] S301, obtain the BFV ciphertext to be bootstrapped .

[0120] S302, using analog-to-digital conversion technology, convert the modulus of c into ,get .

[0121] S303, using key conversion technology, The key is converted to a sparse bootstrap key ,get .

[0122] S304, using analog-to-digital conversion technology, The modulus conversion is ,get .

[0123] S305, note It is encrypted with s under a large modulus Q. The ciphertext of .

[0124] S306, use a homomorphic linear transformation The N coefficients of the encrypted plaintext polynomial are placed into N / L ciphertext slots.

[0125] S307. Construct a low-order annihilation polynomial for performing homomorphic digit removal on each ciphertext.

[0126] S308, using a homomorphic linear transformation, put the N coefficients in the N / L ciphertext slots into the coefficients of a single plaintext polynomial, and obtain .

[0127] S309, Output As a bootstrap result.

[0128] The BFV fully homomorphic encryption bootstrapping method provided in this application performs algorithm transformation based on the BGV bootstrapping algorithm, and combines ciphertext modulus conversion, key conversion, and homomorphic digit removal with annihilation polynomials to optimize the BFV bootstrapping and solve the problem of low efficiency of the existing BFV bootstrapping algorithm. In addition, in the process of bootstrapping BFV, the ciphertext modulus can be transformed multiple times, and the ciphertext modulus, ring dimension, etc. do not have to be maintained at a large level, so the parameter selection is more flexible.

[0129] This application also provides a BFV fully homomorphic encryption bootstrap device, Figure 3 A schematic diagram of the composition structure of a BFV fully homomorphic encryption bootstrap device provided in an embodiment of the present application, such as Figure 3 As shown, the BFV fully homomorphic encryption bootstrapping device 400 includes:

[0130] The first processing module 401 is used to perform multiple analog-to-digital conversion processes on the initial BFV ciphertext to be bootstrapped to obtain a first BFV ciphertext; the initial BFV ciphertext includes an initial key for encrypting the first plaintext polynomial;

[0131] A first determining module 402 is configured to determine a second BFV ciphertext based on a key conversion public key from a first key to the initial key and the first BFV ciphertext, wherein the first key is obtained by converting the initial key, and a ciphertext modulus of the second BFV ciphertext is greater than a ciphertext modulus of the first BFV ciphertext;

[0132] The second processing module 403 is used to remove the low-order digits of the coefficients of the second plaintext polynomial based on the annihilation polynomial corresponding to the second plaintext polynomial in the second BFV ciphertext to obtain the bootstrapped ciphertext.

[0133] In some embodiments, the first processing module 401 includes:

[0134] A first processing submodule is configured to perform analog-to-digital conversion on the initial BFV ciphertext to obtain a first reference BFV ciphertext; the first reference BFV ciphertext includes the initial key;

[0135] A second processing submodule, configured to convert the initial key to obtain the first key;

[0136] A first determination submodule, configured to determine a second reference BFV ciphertext based on the first key and the first reference BFV ciphertext, wherein the second reference BFV ciphertext belongs to a polynomial ring determined by a ciphertext modulus of the first reference BFV ciphertext;

[0137] The third processing submodule is used to perform analog-to-digital conversion on the second reference BFV ciphertext to obtain the first BFV ciphertext; the ciphertext modulus of the first BFV ciphertext is different from the ciphertext modulus of the first reference BFV ciphertext.

[0138] In some embodiments, the first determining module 402 includes:

[0139] A fourth processing submodule, configured to encrypt the first key using the initial key to obtain a reference key;

[0140] The second determination submodule is used to determine the second BFV ciphertext based on the reference key and the first BFV ciphertext.

[0141] In some embodiments, the second processing module 403 includes:

[0142] a fifth processing submodule, configured to perform a homomorphic linear transformation on the second BFV ciphertext to obtain a third BFV ciphertext;

[0143] A first splitting submodule, configured to split the third BFV ciphertext into N / L sub-ciphertexts; wherein L is the number of plaintexts corresponding to the first plaintext polynomial, N is the number of coefficients of the first plaintext polynomial, and N / L is a positive integer;

[0144] The sixth processing submodule is used to perform homomorphic digit removal on the integer values ​​in the ciphertext slots corresponding to the N / L sub-ciphertexts based on the annihilation polynomial corresponding to the second plaintext polynomial to obtain the bootstrapped ciphertext.

[0145] In some embodiments, the ciphertext modulus of the bootstrapped ciphertext is greater than the ciphertext modulus of the second BFV ciphertext.

[0146] In some embodiments, the BFV fully homomorphic encryption bootstrapping device 400 may further include:

[0147] A first acquisition module, used to obtain a plaintext modulus corresponding to the first plaintext polynomial;

[0148] A second determination module is used to determine a first BGV ciphertext based on the plaintext modulus and the initial BFV ciphertext to be bootstrapped; the first BGV ciphertext is different from the first BFV ciphertext;

[0149] A first bootstrap module, configured to bootstrap the first BGV ciphertext to obtain a second BGV ciphertext; the ciphertext modulus of the second BGV ciphertext is greater than the ciphertext modulus of the first BGV ciphertext;

[0150] The third processing module is used to convert the second BGV ciphertext based on the ciphertext modulus of the second BGV ciphertext and the plaintext modulus of the first plaintext polynomial to obtain a bootstrapped BFV ciphertext.

[0151] In some embodiments, the first bootstrap module further comprises:

[0152] an eighth processing submodule, configured to perform analog-to-digital conversion on the first BGV ciphertext to obtain a first reference BGV ciphertext;

[0153] a ninth processing submodule, configured to transform the key in the first reference BGV ciphertext to obtain a second reference BGV ciphertext; the ciphertext modulus of the second reference BGV ciphertext is the same as the ciphertext modulus of the first reference BGV ciphertext;

[0154] A third determination submodule, configured to determine a third reference BGV ciphertext based on the second reference BGV ciphertext and a preset plaintext modulus;

[0155] a tenth processing submodule, configured to perform analog-to-digital conversion processing on the third reference BGV ciphertext to obtain a fourth reference BGV ciphertext; the ciphertext modulus of the fourth reference BGV ciphertext being greater than the ciphertext modulus of the third reference BGV ciphertext;

[0156] An eleventh processing submodule is configured to remove low-order digits of coefficients of the third plaintext polynomial based on the annihilation polynomial corresponding to the third plaintext polynomial in the fourth reference BGV ciphertext to obtain the second BGV ciphertext.

[0157] It should be noted that the description of the BFV fully homomorphic encryption bootstrap device in the embodiment of the present application is similar to the description of the BFV fully homomorphic encryption bootstrap method embodiment described above, and has similar beneficial effects as the method embodiment, so it is not repeated. For technical details not disclosed in the embodiment of the device, please refer to the description of the method embodiment of the present application for understanding.

[0158] Accordingly, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the BFV fully homomorphic encryption bootstrapping method provided in the above embodiment.

[0159] It should be noted that in the embodiments of the present application, if the above-mentioned BFV fully homomorphic encryption bootstrapping method is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can be essentially or partly reflected in the form of a software product that contributes to the relevant solution. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a U disk, a mobile hard disk, a read-only memory (ROM), a disk or an optical disk. In this way, the embodiments of the present application are not limited to any specific combination of hardware and software.

[0160] The present application also provides a BFV fully homomorphic encryption bootstrap device, Figure 4 A schematic diagram of the composition structure of a BFV fully homomorphic encryption bootstrap device provided in an embodiment of the present application, such as Figure 4As shown, the BFV fully homomorphic encryption bootstrap device 500 includes: a memory 501, a processor 502, a communication interface 503 and a communication bus 504. Among them, the memory 501 is used to store instructions that can execute BFV fully homomorphic encryption bootstrap. The processor 502 is used to execute the executable BFV fully homomorphic encryption bootstrap instructions stored in the memory to implement the BFV fully homomorphic encryption bootstrap method provided in the above embodiment.

[0161] It should be noted that, in this article, the term "comprises" or any other variant thereof is intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also includes other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the sentence "comprises at least one ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0162] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as: multiple units or components can be combined, or can be integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the components shown or discussed can be through some interfaces, and the indirect coupling or communication connection of the devices or units can be electrical, mechanical or other forms.

[0163] The units described above as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units; they may be located in one place or distributed on multiple network units; some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0164] In addition, all functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may be a separate unit, or two or more units may be integrated into one unit; the above-mentioned integrated units may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0165] A person of ordinary skill in the art can understand that: all or part of the steps of implementing the above-mentioned method embodiment can be completed by hardware related to program instructions, and the aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it executes the steps of the above-mentioned method embodiment; and the aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROM, disks or optical disks.

[0166] Alternatively, if the above-mentioned integrated unit of the present application is implemented in the form of a software function module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present application can essentially or in other words, the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for a product to execute all or part of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as mobile storage devices, ROMs, magnetic disks or optical disks.

[0167] The above is only an implementation method of the present application, but the protection scope of the present application is not limited thereto. Any technical object familiar with the technical field in this technical field can easily think of changes or replacements within the technical scope disclosed in this application, which should be covered by the protection scope of the present application.

Claims

1. A BFV fully homomorphic encryption bootstrapping method, characterized in that: include: Performing multiple analog-to-digital conversion processes on the initial BFV ciphertext to be bootstrapped to obtain a first BFV ciphertext; the initial BFV ciphertext includes an initial key for polynomial encryption of the first plaintext; Determine a second BFV ciphertext based on a key conversion public key from a first key to the initial key and the first BFV ciphertext, wherein the first key is obtained by converting the initial key, and a ciphertext modulus of the second BFV ciphertext is greater than a ciphertext modulus of the first BFV ciphertext; Based on the annihilation polynomial corresponding to the second plaintext polynomial in the second BFV ciphertext, remove the low digits of the coefficients of the second plaintext polynomial to obtain a bootstrapped ciphertext; The plaintext polynomial in the bootstrapped ciphertext is the first plaintext polynomial, and the coefficients of the first plaintext polynomial are coefficients obtained by removing low-order digits of the coefficients of the second plaintext polynomial.

2. The method according to claim 1, characterized in that The step of performing multiple analog-to-digital conversion processes on the initial BFV ciphertext to be bootstrapped to obtain a first BFV ciphertext includes: Performing analog-to-digital conversion on the initial BFV ciphertext to obtain a first reference BFV ciphertext; the first reference BFV ciphertext includes the initial key; Converting the initial key to obtain the first key; Determine a second reference BFV ciphertext based on the first key and the first reference BFV ciphertext, wherein the second reference BFV ciphertext belongs to a polynomial ring determined by a ciphertext modulus of the first reference BFV ciphertext; Performing analog-to-digital conversion on the second reference BFV ciphertext to obtain the first BFV ciphertext; the ciphertext modulus of the first BFV ciphertext is different from the ciphertext modulus of the first reference BFV ciphertext.

3. The method according to claim 1, characterized in that The determining of the second BFV ciphertext based on the key conversion public key from the first key to the initial key and the first BFV ciphertext comprises: Using the initial key to encrypt the first key to obtain a reference key; Based on the reference key and the first BFV ciphertext, the second BFV ciphertext is determined.

4. The method according to claim 1, characterized in that The step of removing the low-order digits of coefficients of the second plaintext polynomial based on the annihilation polynomial corresponding to the second plaintext polynomial in the second BFV ciphertext to obtain the bootstrapped ciphertext includes: Performing a homomorphic linear transformation on the second BFV ciphertext to obtain a third BFV ciphertext; Splitting the third BFV ciphertext into N / L sub-ciphertexts; wherein L is the number of plaintexts corresponding to the first plaintext polynomial, N is the number of coefficients of the first plaintext polynomial, and N / L is a positive integer; Based on the annihilation polynomial corresponding to the second plaintext polynomial, homomorphic digit removal is performed on the integer values ​​in the ciphertext slots corresponding to the N / L sub-ciphertexts to obtain the bootstrapped ciphertext.

5. The method according to any one of claims 1 to 4, characterized in that: The ciphertext modulus of the bootstrapped ciphertext is greater than the ciphertext modulus of the second BFV ciphertext.

6. The method according to claim 1, characterized in that Also includes: Obtaining a plaintext modulus corresponding to the first plaintext polynomial; Determining a first BGV ciphertext based on the plaintext modulus and the initial BFV ciphertext to be bootstrapped; the first BGV ciphertext is different from the first BFV ciphertext; Bootstrapping the first BGV ciphertext to obtain a second BGV ciphertext; the ciphertext modulus of the second BGV ciphertext is greater than the ciphertext modulus of the first BGV ciphertext; Based on the ciphertext modulus of the second BGV ciphertext and the plaintext modulus of the first plaintext polynomial, the second BGV ciphertext is converted to obtain a bootstrapped BFV ciphertext.

7. The method according to claim 6, characterized in that The step of bootstrapping the first BGV ciphertext to obtain the second BGV ciphertext includes: Performing analog-to-digital conversion on the first BGV ciphertext to obtain a first reference BGV ciphertext; Transforming the key in the first reference BGV ciphertext to obtain a second reference BGV ciphertext; the ciphertext modulus of the second reference BGV ciphertext is the same as the ciphertext modulus of the first reference BGV ciphertext; Determine a third reference BGV ciphertext based on the second reference BGV ciphertext and a preset plaintext modulus; Performing a modulus-to-digital conversion process on the third reference BGV ciphertext to obtain a fourth reference BGV ciphertext; the ciphertext modulus of the fourth reference BGV ciphertext is greater than the ciphertext modulus of the third reference BGV ciphertext; Based on the annihilation polynomial corresponding to the third plaintext polynomial in the fourth reference BGV ciphertext, the third plaintext polynomial is subjected to coefficient low-order digit removal to obtain the second BGV ciphertext.

8. A BFV fully homomorphic encryption bootstrap device, characterized in that: include: A first processing module is used to perform multiple analog-to-digital conversion processes on the initial BFV ciphertext to be bootstrapped to obtain a first BFV ciphertext; the initial BFV ciphertext includes an initial key for encrypting the first plaintext polynomial; A first determination module is configured to determine a second BFV ciphertext based on a key conversion public key from a first key to the initial key and the first BFV ciphertext; the first key is obtained by converting the initial key; and a ciphertext modulus of the second BFV ciphertext is greater than a ciphertext modulus of the first BFV ciphertext; The second processing module is used to remove the low-digit digits of the coefficients of the second plaintext polynomial based on the annihilation polynomial corresponding to the second plaintext polynomial in the second BFV ciphertext to obtain the bootstrapped ciphertext.

9. A BFV fully homomorphic encryption bootstrap device, characterized in that: include: processor and memory; wherein, The memory is used to store a computer program that can be run on the processor; The processor is configured to execute the method according to any one of claims 1 to 7 when running the computer program.

10. A computer-readable storage medium, characterized in that: The storage medium stores computer program code, and when the computer program code is executed by a computer, the method according to any one of claims 1 to 7 is executed.

Images