Method and computing device for performing homomorphic function operation

Abstract

A method and computing device for performing homomorphic function operation, a function corresponding to the homomorphic function operation at least comprises a first variable and a second variable, the method comprises: obtaining a first LWE ciphertext of a first plaintext, the first plaintext being a substitution value of the first variable; generating RLWE ciphertexts of a plurality of first test polynomials corresponding to the first variable, each first test polynomial being generated based on a lookup table of the function, the lookup table comprising first function values corresponding to different variable values of the function; generating a first RGSW ciphertext based on the first LWE ciphertext, the first RGSW ciphertext corresponding to a polynomial including a first item, the power of the first item being a negative number of the first plaintext; calculating an outer product of the RLWE ciphertext of each first test polynomial and the first RGSW ciphertext to obtain a plurality of first RLWE ciphertexts; and calculating an LWE ciphertext of a second function value corresponding to the first plaintext of the function based on the plurality of first RLWE ciphertexts.

Description

Technical Field

[0001] The embodiments of this specification belong to the field of data processing technology, and more particularly, to a method and computing device for performing homomorphic function operations. Background Art

[0002] Homomorphic encryption algorithms can theoretically support arbitrary calculations, such as matrix-vector multiplication, activation functions in neural networks, and private information retrieval and private information intersection. When dealing with large precision and complex task circuits, fully homomorphic encryption (FHE) schemes all rely on a core operation - bootstrapping, which is a concept defined in the first FHE solution proposed by Gentry in 2009. The purpose of bootstrapping is to refresh the ciphertext, reduce the noise level of the ciphertext, and prevent the noise from expanding too much during homomorphic calculations, resulting in decryption failure. The bootstrapping algorithm is always the most time-consuming part of FHE applications. FHEW and TFHE are currently one of the most practical FHE schemes, Boolean type fully homomorphic encryption algorithms. TFHE currently has the lowest bootstrap latency among all fully homomorphic encryption schemes, and gate bootstrapping only takes about 13ms. In contrast, the bootstrapping algorithms of BFV and BGV schemes take several minutes; CKKS takes several seconds and comes at the cost of precision loss. FHEW and TFHE schemes are more advantageous in processing large-precision function operations. In essence, it can embed any table lookup function during bootstrapping, i.e., functional bootstrapping (FBS). Functional bootstrapping schemes can be used to evaluate nonlinear functions in neural networks, such as sigmoid, ReLU, etc.

[0003] However, function bootstrapping (FBS) can only evaluate the function of a single input, which limits the use of function bootstrapping techniques. et al. extended the functional bootstrapping to tree-based bootstrapping (TFBS), which can calculate arbitrarily large functions, where the function can include any number of variables. However, the computational cost of the tree-based functional bootstrapping (TFBS) is very high. Summary of the invention

[0004] The object of the present invention is to provide a method for performing homomorphic function operations, which combines circuit bootstrapping and function bootstrapping algorithms to perform bootstrapping in homomorphic function operations with lower computational cost.

[0005] A first aspect of the present specification provides a method for performing homomorphic function operations, wherein a function corresponding to the homomorphic function operations includes at least a first variable and a second variable, and the method includes:

[0006] Obtain a first LWE ciphertext of a first plaintext, where the first plaintext is a substitution value of the first variable;

[0007] generating RLWE ciphertexts of a plurality of first test polynomials corresponding to the first variable, each of the first test polynomials being generated based on a lookup table of the function, the lookup table comprising first function values ​​corresponding to different variable values ​​of the function;

[0008] generating a first RGSW ciphertext based on the first LWE ciphertext, wherein the first RGSW ciphertext corresponds to a polynomial including a first term, and a power of the first term is a negative number of the first plaintext;

[0009] Calculate the outer product of the RLWE ciphertext of each first test polynomial and the first RGSW ciphertext to obtain a plurality of first RLWE ciphertexts;

[0010] An LWE ciphertext of a second function value of the function corresponding to the first plaintext is calculated based on the several first RLWE ciphertexts.

[0011] The second aspect of the present specification provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, causes the computer to execute the method described in the first aspect.

[0012] A third aspect of the specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method described in the first aspect is implemented.

[0013] The fourth aspect of this specification provides a computer program product, including a computer program / instruction, which implements the steps of the method described in the first aspect when executed by a processor.

[0014] The embodiments of this specification provide a method for performing homomorphic function operations, in which a new tree-type bootstrap framework is constructed. By using a circuit bootstrap variant algorithm to convert LWE ciphertext into RGSW ciphertext, the outer product operation of RLWE ciphertext and RGSW ciphertext can be used to replace the blind rotation process in the function bootstrap, thereby reducing the amount of calculation and improving the efficiency of the bootstrap. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] In order to more clearly illustrate the technical solutions of the embodiments of this specification, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0016] Figure 1 is a flow chart of a function bootstrapping method in one embodiment;

[0017] Figure 2 is a flow chart of a TFBS method in one embodiment;

[0018] Figure 3 is a schematic diagram of a TFBS method in one embodiment;

[0019] Figure 4 A schematic diagram of a tree-type bootstrapping method in an embodiment of this specification;

[0020] Figure 5 This is a flow chart of a method for performing homomorphic function operations in an embodiment of this specification;

[0021] Figure 6 This is a flow chart of a method for performing homomorphic function operations in an embodiment of this specification. DETAILED DESCRIPTION

[0022] In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this specification.

[0023] Currently, most FHE schemes are based on the Learning with Errors Assumption (LEW) or the Ring Learning with Errors assumption (RLWE). Correspondingly, the FHE scheme can include the following ciphertexts:

[0024] LWE ciphertext: Given two positive integers n and q, the LWE ciphertext of plaintext m (m is an integer) is defined as in, Represents n+1 dimensions space, The space represents the set of integers modulo q, ranging from {0,1,2,…,q-1}, a is a randomly obtained vector in the n-dimensional vector space, s is the homomorphic encryption private key, s∈{0,1} n , b = a·s+m+e mod q, where the error e is obtained by sampling from the error distribution.

[0025] RLWE ciphertext: RLWE ciphertext is LWE ciphertext in polynomial space The ring form in the polynomial The RLWE ciphertext is defined as: Where b = a·s+m+e mod Q, where In this article, bold letters are used to represent vectors or polynomials.

[0026] RLWE′ ciphertext: Given a gadget vector v = (v 0 ,v 1 ,…,v l-1 ), the gadget RLWE ciphertext can be expressed as RLWE′ ciphertext: RLWE′ s,Q (m) = (RLWE s,Q (v 0 ·m),…,RLWE s,Q (v l-1 ·m)). Among them, Indicates log B q is rounded up, q is the modulus of the space, and B is the gadget basis.

[0027] RGSW ciphertext: RGSW s,Q (m) = (RLWE′ s,Q (s·m),RLWE′ s,Q (m)).

[0028] The following first briefly describes the function bootstrapping scheme and the tree-based function bootstrapping scheme in the related technical field.

[0029] Figure 1 Flow chart of a function bootstrapping method in one embodiment.

[0030] like Figure 1 As shown, first, in step S101, the LWE ciphertext LWE(m) and the test polynomial P(X) of the target function f(x) are obtained.

[0031] The method can be executed by a computing device that performs homomorphic function operations. The computing device can receive LWE(m)=(a,b) from other devices, and the other devices can homomorphically encrypt the plaintext m through a homomorphic encryption algorithm to obtain a ciphertext (a,b), and send the ciphertext to the computing device. After receiving the ciphertext (a,b), the computing device can calculate the ciphertext through a function bootstrapping method to obtain a noise-reduced LWE (f(m)).

[0032] The test polynomial P(X) of the objective function f(x) can be expressed as formula (1):

[0033]

[0034] Among them, f(x) satisfies B is the modulus of the function space, t = 2B, q = 2N, According to formula (1), the coefficients of the test polynomial P(X) include p f(0), p f(1), ..., p f(B-1) arranged in sequence, where p is determined based on t and q.

[0035] Therefore, we can first generate a lookup table of the function f(x), that is, the values ​​of f(0), f(1), ...f(B-1), and then substitute the values ​​of f(0), f(1), ...f(B-1) into formula (1), thereby obtaining the test polynomial P(X).

[0036] In step S103, blind rotation is performed based on the LWE ciphertext LWE(m), and the obtained in

[0037]

[0038] In one embodiment, ACC←RLWE(X -b P(X)), and then for i=0 to n-1, the calculation shown in formula (2) is performed repeatedly:

[0039]

[0040] Among them, the blind rotation key BK i =RGSW(s[i]).

[0041] Formula (2) is equivalent to calculation formula (3):

[0042]

[0043] in, Represents the outer product between the RLWE ciphertext ACC and RGSW(s[i]).

[0044] Here first Let's take an example to explain the calculation of the outer product. Assume that RLWE(m 1 )=(a,b), then

[0045]

[0046] Where ⊙ represents the gadget product, here b⊙RLWE′(m 2 ) as an example to describe the calculation of gadget product:

[0047]

[0048] Among them, bi For b, the gadget vector v = (v 0 ,v 1 ,…,v l-1 ) gadget decomposes the polynomial,

[0049] According to formula (4), The result is approximately m 1 ·m 2 The RLWE ciphertext.

[0050] Therefore, when s[i] corresponds to the constant 0, The corresponding plaintext is 0. According to formula (3), ACC remains unchanged. When s[i] corresponds to the constant 1, The corresponding plaintext is the plaintext corresponding to ACC. According to formula (3), ACC becomes After n cycles, it is equivalent to calculating

[0051] In step S105, from the ciphertext Extract and obtain LWE(f(m)).

[0052] After getting the ciphertext Afterwards, due to can be approximately equal to m, so, Since the Xth m The coefficients of the term include f(m), the Xth m Item and X -m The product of That is to say, The constant term of includes f(m). Therefore, the ciphertext can be obtained The constant term is the LWE ciphertext corresponding to LWE(f(m)). By performing key switching and modulus switching on the LWE ciphertext, the noise-reduced ciphertext LWE(f(m)) is obtained. The key switching and modulus switching here refer to LWE key switching and LWE modulus switching, which are used to convert the ciphertext The constant term of is converted to a key of the same modulus and dimension as the initial LWE(m).

[0053] Specifically, in LWE modular transformation, given the LWE ciphertext This can be converted to:

[0054]

[0055] Among them, s is the key, n is the dimension of the key s, and Q is the module.

[0056] In LWE key transformation, given the LWE ciphertext It can be converted to

[0057]

[0058] in, The above function bootstrapping method is usually applicable to a function f(x) including a single variable. As mentioned above, the TFBS algorithm can be applied to a function including any number of variables.

[0059] Figure 2 FIG. 4 is a flow chart of a TFBS method in one embodiment. Figure 3 For Figure 2 Schematic diagram of the TFBS method corresponding to the method flowchart shown.

[0060] like Figure 2 As shown, in step S201, the LWE ciphertext LWE(m 1 )、LWE(m 2 ) and the test polynomial of the objective function f(x,y) where i∈[0,B-1], m 1 is the value of x to be input into the objective function f, m 2 is the value of y to be input into the objective function f.

[0061] The method can be executed by a computing device that performs homomorphic function operations. The computing device can receive LWE (m 1 )、LWE(m 2 ), the other device can use the homomorphic encryption algorithm to encrypt the plaintext m 1 and plaintext m 2 And perform homomorphic encryption to obtain the ciphertext LWE(m 1 ) and LWE(m 2 ), and the ciphertext LWE(m 1 )、LWE(m 2 ) is sent to the computing device. The computing device receives the ciphertext LWE(m 1 )、LWE(m 2 ) After that, the two ciphertexts can be calculated based on the function bootstrapping method to obtain the noise-reduced LWE(f(m 1 , m 2 )).

[0062] First, we can calculate the value x of x for the function f(x,y) i , where x i ∈[0,B-1], get the objective function f(xi ,y) It can be shown as formula (5):

[0063]

[0064] Similar to P(X) described above, according to formula (5), the test polynomial The coefficients of the equation include p f(x i ,0), p f(x i ,1),…,p f(x i ,B-1), where p is determined based on t and q.

[0065] Therefore, for each x i , we can first generate the function f(x i ,y), that is, f(f(x i ,0)、f(x i ,1),…f(x i ,B-1), and then f(x i ,0)、f(x i ,1),…f(x i ,B-1) into formula (5), and we can get the test polynomial

[0066] For example, refer to Figure 3 As shown, assuming B = 4, then x i The values ​​include 0, 1, 2, 3. For x i = 0, a lookup table of f(0,y) can be generated: f(0,0), f(0,1), f(0,2), f(0,3), and a test polynomial P can be generated based on the lookup table. 0 (Y):

[0067]

[0068] Figure 3 The left side shows the test polynomial P 0 (i.e. P 0 (Y)) and its corresponding coefficients, according to formula (6), the polynomial P 0 After expansion, it is as follows:

[0069] P 0 (Y)=f(0,0)+f(0,0)Y+…f(0,0)Y p-1 +f(0,1)Y p +f(0,1)Y p+1 +…f(0,1)Y 2p-1 +

[0070] …f(0,1)Yp +f(0,3)Y 3p +…f(0,3)Y 4p-1

[0071] For x i =1, a lookup table of f(1,y) can be generated: f(1,0), f(1,1), f(1,2), f(1,3), and a test polynomial P can be generated based on this lookup table. 1 (Y):

[0072]

[0073] For x i =2, a lookup table of f(2,y) can be generated: f(2,0), f(2,1), f(2,2), f(2,3), based on which the test polynomial P can be generated. 2 (Y):

[0074]

[0075] For x i =3, a lookup table of f(3,y) can be generated: f(3,0), f(3,1), f(3,2), f(3,3), based on which the test polynomial P can be generated. 3 (Y):

[0076]

[0077] In step S203, for each Based on LWE ciphertext LWE(m 2 ) is blindly rotated to obtain Among them, LWE (m 2 )=(a2,b2),

[0078] Referring to the above description of step S103, for each x i , by 2 Corresponding to m in step S103, Corresponding to P(X) in step S103, the ciphertext can be calculated based on formulas (2) to (4) to obtain

[0079] For example, for Figure 3 For the example shown, for x i =0, the ciphertext can be calculated For x i =1, the ciphertext can be calculated For x i =2, the ciphertext can be calculated For x i =3, the ciphertext can be calculated

[0080] In step S205, from the ciphertext Extract LWE(f(x i ,m 2 )).

[0081] Referring to the above description of step S105, for each x i , can be obtained from the ciphertext The constant term is obtained from the LWE(f(x i ,m 2 ))’s LWE ciphertext.

[0082] refer to Figure 3 , assuming m 2 =1, then we can Extract LWE(f(0,1)) from Extract LWE(f(1,1)) from Extract LWE(f(2,1)) from Extract LWE(f(3,1)).

[0083] In step S207, the LWE-RLWE key conversion algorithm is used based on LWE(f(x i ,m 2 )) Generate a test polynomial for the objective function f The RLWE ciphertext.

[0084] In this step, each LWE(f(x i ,m 2 )) is converted to RLWE ciphertext, where each LWE(f(x i ,m 2 )) corresponds to the continuous coefficients of the RLWE ciphertext, which is equivalent to generating the test polynomial of the objective function f

[0085] RLWE ciphertext Figure 3 It is abbreviated as RLWE(P), where the polynomial In each f(x i ,m 2 ) as a polynomial The coefficient of .

[0086] Specifically, the above-mentioned LWE ciphertext can be converted to RLWE ciphertext through base-aware key switching (BAKS).

[0087] The inputs to the BAKS algorithm include:

[0088] B LWE ciphertexts, in this embodiment, are LWE(f(x i ,m 2 )), where i∈[0,B-1];

[0089] BAKS Key Among them, i∈[0,N-1],j∈[0,l BA -1],b∈[0,B-1].

[0090] The output of the BAKS algorithm is the test polynomial The RLWE ciphertext.

[0091] Specifically, assuming that each LWE ciphertext is (a (i) ,b (i) ), the BAKS algorithm can be calculated by the algorithm:

[0092] make

[0093]

[0094] In step S209, based on LWE(m 1 ) is blindly rotated to obtain Among them, LWE (m 1 )=(a1,b1),

[0095] Specifically, reference Figure 3 , we can first calculate That is equivalent to Then, referring to the description of step S103 above, the ACC is calculated based on formula (2) to formula (4) to obtain Among them, a1 in this step i Corresponding to a in step S103 i .

[0096] In step S211, Extract LWE(f(m 1 , m 2 )).

[0097] Referring to the description of step S105 above, the ciphertext The constant term is obtained from the LWE(f(m1 , m 2 )) of the LWE ciphertext, and by performing key switching and module switching on the LWE ciphertext, the LWE(m 1 ) and LWE(m 2 )'s key and the ciphertext corresponding to the modulus LWE(f(m 1 , m 2 )).

[0098] refer to Figure 3 , assuming m 1 =2, then we can get the ciphertext Extract LWE(f(2,1)). That is, the computing device passes Figure 2 The algorithm shown is based on LWE(m 1 )、LWE(m 2 ) obtains the noise-reduced ciphertext LWE(f(m 1 , m 2 )).

[0099] In the above TFBS method, a function f including variables x and y is used as an example for description, wherein for variables y and x arranged in sequence, and B=4, it is necessary to obtain B of y 2-1 = 4 test polynomials to perform 4-time function bootstrapping. It is understood that function f can include any number of variables. For example, when function f includes d variables, for the variable ranked first, it is necessary to obtain the B d-1 test polynomials to perform B d-1 Secondary function bootstrap, for the variable ranked in the kth position (k is 0 to d-1) among the d variables, it is necessary to obtain the B of the variable d-k-1 test polynomials to perform B d-k-1 Subfunction bootstrapping.

[0100] That is to say, in the above TFBS method, multiple function bootstrapping is required. Referring to the description in step S103, each function bootstrapping includes n outer product calculations. The computational complexity of the outer product calculations is large. Therefore, the computational cost of the TFBS method is high.

[0101] In view of the problems existing in the above-mentioned TFBS method, the embodiments of this specification provide a method for performing homomorphic function operations, in which a new tree-type bootstrapping framework is constructed. Figure 4 Schematic diagram of a tree-type bootstrapping method in an embodiment of this specification. Figure 4 The green square box in represents the RLWE ciphertext, and the letters in the square box represent the plaintext polynomial corresponding to the RLWE ciphertext (i.e., the test polynomial mentioned above), such as Figure 4 As shown in 1)、LWE(m 2 ), using the Circuit Bootstrapping Variant (CBSV) to convert the ciphertext LWE (m 1 ) and LWE(m 2 ) are converted to and By dividing each RLWE(P i )and By performing the outer product, we can get each RLWE ciphertext So that it can be Figure 3 Similarly, in the process shown, based on each Then, by combining RLWE(P) with Perform the outer product to get the RLWE ciphertext Then, refer to the description of step S211 above. Extraction of LWE(f(m 1 , m 2 )).

[0102] Compared with the above process Figure 3 The function bootstrapping process shown in the figure converts the LWE ciphertext into the RGSW ciphertext by using the circuit bootstrapping variant algorithm, so that the outer product operation of the RLWE ciphertext and the RGSW ciphertext can be replaced Figure 3 The blind rotation process in , thereby reducing the amount of calculation and improving the efficiency of bootstrapping.

[0103] In order to better describe the solution of the embodiment of this specification, the circuit bootstrap algorithm and the circuit bootstrap variant algorithm in the embodiment of this specification are first introduced.

[0104] The circuit bootstrapping algorithm can be used to convert the high-noise LWE ciphertext into the low-noise RGSW ciphertext. The TFHE circuit bootstrapping algorithm includes the following steps:

[0105] (1) Function bootstrapping step: In this step, for LWE(m), by calling the function bootstrapping algorithm and sample extraction l times, l noise-updated LWE′(m) are obtained, and each LWE′(m) is converted into LWE(v i ·m), where the gadget vector v = (v 0 ,v 1 ,…,v l-1 ).

[0106] (2) Ciphertext conversion step: In this step, the PrivateKS algorithm is called 2l times to convert LWE(v i ·m) to RLWE(v i m) and RLWE(vi ·s·m), thus obtaining RGSW(m) = (RLWE(v i ·m), RLWE(v i ·s·m)).

[0107] However, the above circuit bootstrapping method is used to convert the ciphertext LWE(m) into RGSW(m), which is not applicable to the method of the embodiments of this specification. Therefore, the embodiments of this specification provide a circuit bootstrapping variant algorithm (CBSV) for converting the ciphertext LWE(m) into . Compared with the above circuit bootstrapping method, after calling the function bootstrapping l times, the circuit bootstrapping variant algorithm omits the sample extraction step, thereby generating

[0108] In the circuit bootstrapping variant algorithm, for the LWE ciphertext Initialize acc to v i ·X -b , and through l times of function bootstrapping, can be obtained by Using the SKS key conversion algorithm to embed the key s, Thus obtaining

[0109] Among them, the SKS key conversion algorithm includes the following steps: Given the key conversion key RSK = RLWE s ′(s 2 ) and the ciphertext RLWE s (m) = (a, b), it can be calculated that SKS.KeySwitch(ct, RSK) = a ⊙ RSK + (b, 0) = RLWE s (s·m).

[0110] In one implementation, the LWE ciphertext ct can be first converted into a low-dimensional LWE ciphertext where k < n, and then performs the above circuit bootstrapping variant algorithm. Since the number of outer products in the function bootstrapping corresponds to the dimension of the key, by converting the LWE ciphertext ct into an LWE ciphertext with a lower-dimensional key, the computational complexity can be greatly reduced.

[0111] Specifically, in a circuit bootstrapping variant algorithm, the input of the algorithm includes:

[0112] gadget vector

[0113] LWE ciphertext, where q = 2N;

[0114] Blind rotation key BRK: {RGSW Q,N (s i )}, where i∈[0,n-1];

[0115] Key conversion SKS = RLWE s ′(s 2 ).

[0116] The output of the algorithm is RGSW ciphertext

[0117] The algorithm may include the following loop:

[0118]

[0119] Figure 5 This is a flow chart of a method for performing homomorphic function operations in an embodiment of this specification. The method can be executed by a computing device that performs homomorphic function operations.

[0120] like Figure 5 As shown, in step S501, based on a lookup table of a multivariable function, RLWE ciphertexts of several first test polynomials corresponding to the first variable of the function are generated.

[0121] Among them, the lookup table LUT of function f can be defined as f:[0,B-1] d →[0,B-1] d′ , where d is the number of input variables of function f, d′ is the number of output values ​​of function f, that is, function f can include multiple outputs, and B is the modulus of the function space.

[0122] The function includes at least two variables, for example, the function is f(x, y). It is assumed that y is the first variable. It can be understood that the embodiments of this specification are not limited to setting y as the first variable, and x can also be set as the first variable, and there is no limitation on this.

[0123] Referring to the above description of step S201, for each x i , we can first generate the function f(x i ,y), that is, f(f(x i ,0)、f(x i ,1),…f(x i ,B-1), and then f(x i ,0)、f(x i ,1),…f(x i Substituting the value of B-1 into the above formula (5), we can get the test polynomial where i∈[0,B-1].

[0124] Taking B=4 as an example, the first test polynomial P can be generated based on f(0,0), f(0,1), f(0,2), and f(0,3). 0 (Y); Generate the first test polynomial P based on f(1,0), f(1,1), f(1,2), and f(1,3) 1 (Y); Generate the first test polynomial P based on f(2,0), f(2,1), f(2,2), and f(2,3) 2 (Y); Generate the first test polynomial P based on f(3,0), f(3,1), f(3,2), and f(3,3) 3 (Y).

[0125] After generating several first test polynomials, each first test polynomial can be homomorphically encrypted based on the public key corresponding to the key s to obtain the RLWE ciphertext of each first test polynomial

[0126] In step S503, the first plaintext m is obtained. 1 The first LWE ciphertext LWE(m 1 ) and the second plaintext m 2 The second LWE ciphertext LWE(m 2 ). is the value of x to be input into the function f, is the value of y to be input into the function f.

[0127] The computing device can receive LWE(m 1 )、LWE(m 2 ), the other device can use the homomorphic encryption algorithm to encrypt the plaintext m 1 and plaintext m 2 And perform homomorphic encryption to obtain the ciphertext LWE(m 1 ) and LWE(m 2 ), and the ciphertext LWE(m 1 )、LWE(m 2 ) is sent to the computing device.

[0128] In step S505, based on the first LWE ciphertext LWE(m 1 ) generates the first RGSW ciphertext, based on the second LWE ciphertext LWE(m 2 )Generate the second RGSW ciphertext.

[0129] The first RGSW ciphertext corresponds to a polynomial including a first term, wherein the first term (ie, ) is a negative number of the first plaintext, the second RGSW ciphertext corresponds to a polynomial including a second term, and the second term (ie, ) is a power of the negative of the second plaintext.

[0130] For example, the ciphertext LWE(m 1 ) and LWE(m 2 ) are converted to and Among them, as mentioned above, Similarly,

[0131] Specifically, Here k can be 1 or 2, and BK is the blind rotation key BK i =RGSW(s[i]), RSK is the key conversion key RSK=RLWE as described above s ′(s 2 ), the specific conversion process of the CBSV algorithm can refer to the description of the algorithm above, which will not be repeated here.

[0132] In step S507, the outer product of the RLWE ciphertext of each first test polynomial and the first RGSW ciphertext is calculated to obtain a plurality of first RLWE ciphertexts.

[0133] The RLWE ciphertext can be regarded as a 2-dimensional vector, the first RGSW ciphertext can be regarded as a 2*2 matrix, and calculating the outer product of the RLWE ciphertext and the first RGSW ciphertext can be equivalent to the multiplication of the vector and the matrix to obtain a 2-dimensional vector, which constitutes the RLWE ciphertext. The product of the vector element and the matrix element is the multiplication of the polynomial and the polynomial.

[0134] In step S509, a second test polynomial P is generated based on the first RLWE ciphertexts. m2 (X)’s RLWE ciphertext.

[0135] Specifically, referring to the description of the outer product above,

[0136]

[0137] First, referring to the description of step S205 above, Extract LWE(f(x i ,m 2 )).

[0138] According to formula (10), when j = m 2 , corresponding to the item in the above RLWE ciphertext:

[0139]

[0140] because Approximately equal to -m 2 , so formula (11) corresponds to the constant term in formula (10). Therefore, the constant term can be extracted from the polynomial corresponding to formula (10) and LWE(f(x i ,m 2 )).

[0141] Then, referring to the description of step S207 above, the LWE-RLWE key conversion algorithm is used to convert the LWE(f(x i ,m 2 )) Test polynomial for generating function f RLWE ciphertext Specifically:

[0142]

[0143] Wherein, BAKS is the BAKS key as described in step S207 above. Wherein, P m2 (X) with f(x 0 ,m 2 )、f(x 1 ,m 2 ),…,f(x B-1 ,m 2 ) as the coefficients of each term.

[0144] In step S511, the outer product of the RLWE ciphertext of the second test polynomial and the second RGSW ciphertext is calculated to obtain the second RLWE ciphertext.

[0145] The outer product of the RLWE ciphertext of the second test polynomial and the second RGSW ciphertext may be calculated similarly to step S507 .

[0146] In step S513, an LWE ciphertext of the function value is obtained based on the second RLWE ciphertext.

[0147] Specifically,

[0148]

[0150] Referring to the description of step S507, the constant term can be extracted from the polynomial corresponding to formula (12), and the constant term corresponding to LWE(f(m 1 ,m 2 )) of the LWE ciphertext. In addition, referring to the description of step S211, by performing key switching and module switching on the LWE ciphertext, the LWE ciphertext is obtained. 1 ) and LWE(m 2 )'s key and the ciphertext corresponding to the modulus LWE(f(m 1 , m 2)).

[0151] It can be understood that although the above description is based on the function including two variables, the embodiments of this specification are not limited to this. Function f may include d variables and d′ outputs. Then the computing device may obtain d LWE ciphertexts corresponding to the d variables: LWE(m 0 )、LWE(m 1 )…LWE(m d-1 ). Then the d LWE ciphertexts LWE(m k ) are converted to Here, k is from 0 to d-1.

[0152] Afterwards, the computing device can obtain d′ outputs by executing the following loop process Where t is from 0 to d′-1:

[0153]

[0154] Among them, SampleExtract(ct t,k,i ) indicates that from ct t,k,i Extract the LWE ciphertext of the constant term, LWE.KeySwitch(ct t ,LKSK) means converting the LWE ciphertext under the current dimension key into the LWE ciphertext under the target dimension key, where LKSK is the LWE-LWE key conversion key.

[0155] According to the above algorithm, when the function includes multiple (for example, d) variables, for multiple variables arranged in sequence, the number of test polynomials corresponding to the first variable as the 0th variable is B d-1 For the kth variable, the number of test polynomials corresponding to it is B d-k-1 indivual.

[0156] For example, for f(x,y,z), when B=4, the number of test polynomials corresponding to variable z is 4 2 = 16, the number of test polynomials corresponding to variable y is 4 3-1-1 =4, the number of test polynomials corresponding to variable x is 4 3-2-1 = 1. In this process, the computing device can receive LWE (m 1 )、LWE(m 2 ) and LWE(m 3 ), and convert them into and Where m 1 、m 2 、m 3 are the values ​​of x, y, and z respectively. Figure 4 Similarly, by comparing the RLWE ciphertext of each of the four test polynomials of variable z with By performing the outer product, four RLWE ciphertexts can be obtained. Based on the four RLWE ciphertexts, a test polynomial corresponding to the variable y can be obtained, so that a total of four test polynomials corresponding to the variable y can be obtained. Figure 4 The process shown in the figure is to compare the four test polynomials corresponding to the variable y with The outer product is calculated to obtain the test polynomial P of the variable x, and the test polynomial P is combined with Perform the outer product, so that the ciphertext LWE(f(m 1 ,m 2 ,m 3 )).

[0157] Figure 6 This is a flow chart of a method for performing homomorphic function operation in an embodiment of this specification. The function corresponding to the homomorphic function operation includes at least a first variable and a second variable. The method includes:

[0158] Step S601, obtaining a first LWE ciphertext of a first plaintext, where the first plaintext is a substitution value of the first variable;

[0159] Step S603, generating RLWE ciphertexts of several first test polynomials corresponding to the first variable, each of the first test polynomials is generated based on a lookup table of the function, the lookup table including first function values ​​corresponding to different variable values ​​of the function;

[0160] Step S605: generating a first RGSW ciphertext based on the first LWE ciphertext, where the first RGSW ciphertext corresponds to a polynomial including a first term, where a power of the first term is a negative number of the first plaintext;

[0161] Step S607, calculating the outer product of the RLWE ciphertext of each first test polynomial and the first RGSW ciphertext to obtain a plurality of first RLWE ciphertexts;

[0162] Step S609: Calculate the LWE ciphertext of the second function value of the function corresponding to the first plaintext based on the several first RLWE ciphertexts.

[0163] Figure 6 The specific implementation of each step shown can refer to the description of the relevant steps above, which will not be repeated here.

[0164] Understandably, Figure 6The first variable in is not limited to the variable arranged at the 0th position in the above text (such as the variable y in the above text), but can be a variable arranged at the kth position among multiple variables. The coefficient of the test polynomial corresponding to the variable arranged at the kth position is converted by a multi-layer lookup table based on a function (the conversion can be referred to Figure 4 From RLWE(P 0 )、RLWE(P 1 )、RLWE(P 2 )、RLWE(P 3 ) to RLWE(P)), so it can be considered that the coefficients of the test polynomial corresponding to the k-th variable are still generated based on the function lookup table.

[0165] In one implementation, the method further includes: obtaining a second LWE ciphertext of a second plaintext, wherein the second plaintext is a substitution value of the second variable; generating a second RGSW ciphertext based on the second LWE ciphertext, wherein the second RGSW ciphertext corresponds to a polynomial including a second term, and the power of the second term is a negative number of the second plaintext; the calculating the LWE ciphertext of a second function value of the function corresponding to the first plaintext based on the several first RLWE ciphertexts includes: generating an RLWE ciphertext of a second test polynomial based on the several first RLWE ciphertexts; calculating the outer product of the RLWE ciphertext of the second test polynomial and the second RGSW ciphertext to obtain a second RLWE ciphertext; and obtaining the LWE ciphertext of a second function value of the function corresponding to the first plaintext and the second plaintext based on the second RLWE ciphertext.

[0166] In one embodiment, the method further includes: obtaining from the lookup table a plurality of first function values ​​corresponding to several first preset values ​​of the first variable and a target second preset value of the second variable, and generating the above-mentioned target first test polynomial by using the plurality of first function values ​​as coefficients of each term of the target first test polynomial, wherein the target first test polynomial corresponds to the target second preset value.

[0167] In one embodiment, the function includes d variables, and the number of the first test polynomials corresponding to the first variable is determined based on the number of multiple variables included in the function, the modulus of the function space, and the arrangement order of the first variable in the d variables.

[0168] In one implementation, generating the RLWE ciphertext of the second test polynomial based on the plurality of first RLWE ciphertexts includes: generating a plurality of RLWE ciphertexts of the second test polynomial based on the plurality of first RLWE ciphertexts.

[0169] In one implementation, generating the first RGSW ciphertext based on the first LWE ciphertext includes: performing multiple function bootstrapping based on the LWE ciphertext to obtain multiple third RLWE ciphertexts, the third RLWE ciphertexts corresponding to a polynomial including a third term, and the power of the third term is a negative number of the first plaintext; embedding a key in each third RLWE ciphertext based on a key conversion key to obtain multiple fourth RLWE ciphertexts; and obtaining the first RGSW ciphertext based on the multiple third RLWE ciphertexts and the multiple fourth RLWE ciphertexts.

[0170] In one implementation, performing multiple function bootstrapping based on the LWE ciphertext to obtain multiple third RLWE ciphertexts includes: converting the first LWE ciphertext into a third LWE ciphertext with a smaller dimension; and performing multiple function bootstrapping based on the third LWE ciphertext.

[0171] In one implementation, generating the RLWE ciphertext of the second test polynomial based on the several first RLWE ciphertexts includes: obtaining a first constant term from each of the first RLWE ciphertexts, wherein each first constant term is a fourth LWE ciphertext; based on the LWE-RLWE key conversion algorithm, converting the obtained several fourth LWE ciphertexts into a fifth RLWE ciphertext as the RLWE ciphertext of the second test polynomial, wherein the second test polynomial uses the plaintext corresponding to the several fourth LWE ciphertexts as coefficients.

[0172] In one implementation, the obtaining of the LWE ciphertext of the second function value of the function corresponding to the first plaintext and the second plaintext based on the second RLWE ciphertext includes: obtaining a second constant term from the second RLWE ciphertext as the LWE ciphertext of the second function value of the function corresponding to the first plaintext and the second plaintext.

[0173] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0174] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0175] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a server system. Of course, the present application does not exclude that with the development of computer technology in the future, the computer that implements the functions of the above embodiments may be, for example, a personal computer, a laptop computer, a vehicle-mounted human-computer interaction device, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0176] Although one or more embodiments of the present specification provide method operation steps as described in the embodiments or flow charts, more or less operation steps may be included based on conventional or non-creative means. The order of steps listed in the embodiments is only one way of executing the order of many steps, and does not represent the only execution order. When the device or terminal product in practice is executed, it can be executed in sequence or in parallel according to the method shown in the embodiments or the drawings (for example, a parallel processor or a multi-threaded processing environment, or even a distributed data processing environment). The term "include", "include" or any other variant thereof is intended to cover non-exclusive inclusion, so that the process, method, product or equipment including a series of elements includes not only those elements, but also includes other elements that are not explicitly listed, or also includes elements inherent to such a process, method, product or equipment. In the absence of more restrictions, it is not excluded that there are other identical or equivalent elements in the process, method, product or equipment including the elements. For example, if the words first, second, etc. are used to represent the name, they do not represent any specific order.

[0177] For the convenience of description, the above devices are described in various modules according to their functions. Of course, when implementing one or more of the present specification, the functions of each module can be implemented in the same or more software and / or hardware, or the module implementing the same function can be implemented by a combination of multiple sub-modules or sub-units, etc. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0178] The present invention is described with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0179] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0180] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0181] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0182] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0183] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic disk storage, graphene storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0184] It should be understood by those skilled in the art that one or more embodiments of the present specification may be provided as a method, system or computer program product. Therefore, one or more embodiments of the present specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, one or more embodiments of the present specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0185] One or more embodiments of the present specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. One or more embodiments of the present specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0186] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. In the description of this specification, the description of the reference terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of this specification. In this specification, the schematic representation of the above terms does not necessarily target the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described can be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples without contradiction.

[0187] The above description is only an example of one or more embodiments of the present specification and is not intended to limit one or more embodiments of the present specification. For those skilled in the art, one or more embodiments of the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims.

Claims

1. A method for performing homomorphic function operation, wherein the function corresponding to the homomorphic function operation includes at least a first variable and a second variable, the method comprising: Obtain a first LWE ciphertext of a first plaintext, where the first plaintext is a substitution value of the first variable; generating RLWE ciphertexts of a plurality of first test polynomials corresponding to the first variable, each of the first test polynomials being generated based on a lookup table of the function, the lookup table comprising first function values ​​corresponding to different variable values ​​of the function; generating a first RGSW ciphertext based on the first LWE ciphertext, wherein the first RGSW ciphertext corresponds to a polynomial including a first term, and a power of the first term is a negative number of the first plaintext; Calculate the outer product of the RLWE ciphertext of each first test polynomial and the first RGSW ciphertext to obtain a plurality of first RLWE ciphertexts; An LWE ciphertext of a second function value of the function corresponding to the first plaintext is calculated based on the several first RLWE ciphertexts.

2. The method according to claim 1, further comprising: Obtain a second LWE ciphertext of a second plaintext, where the second plaintext is a substitution value of the second variable; generating a second RGSW ciphertext based on the second LWE ciphertext, wherein the second RGSW ciphertext corresponds to a polynomial including a second term, and a power of the second term is a negative number of the second plaintext; The calculating, based on the plurality of first RLWE ciphertexts, an LWE ciphertext of a second function value of the function corresponding to the first plaintext comprises: generating a RLWE ciphertext of a second test polynomial based on the plurality of first RLWE ciphertexts; Calculate the outer product of the RLWE ciphertext of the second test polynomial and the second RGSW ciphertext to obtain a second RLWE ciphertext; An LWE ciphertext of a second function value of the function corresponding to the first plaintext and the second plaintext is obtained based on the second RLWE ciphertext.

3. The method according to claim 2, further comprising: A plurality of first function values ​​corresponding to several first preset values ​​of the first variable and a target second preset value of the second variable are obtained from the lookup table, and the target first test polynomial is generated by using the plurality of first function values ​​as coefficients of each term of the target first test polynomial, wherein the target first test polynomial corresponds to the target second preset value.

4. According to the method of claim 2, the function includes d variables, and the number of the first test polynomials corresponding to the first variable is determined based on the number of multiple variables included in the function, the modulus of the function space, and the arrangement order of the first variable in the d variables.

5. The method according to claim 4, wherein generating the RLWE ciphertext of the second test polynomial based on the plurality of first RLWE ciphertexts comprises: A plurality of RLWE ciphertexts of second test polynomials are generated based on the plurality of first RLWE ciphertexts.

6. The method according to claim 1, wherein generating a first RGSW ciphertext based on the first LWE ciphertext comprises: Performing multiple function bootstrapping based on the first LWE ciphertext to obtain multiple third RLWE ciphertexts, where the third RLWE ciphertexts correspond to a polynomial including a third term, and the power of the third term is a negative number of the first plaintext; embedding a key into each third RLWE ciphertext based on the key conversion key to obtain a plurality of fourth RLWE ciphertexts; The first RGSW ciphertext is obtained based on the plurality of third RLWE ciphertexts and the plurality of fourth RLWE ciphertexts.

7. The method according to claim 6, wherein the step of performing multiple function bootstrapping based on the first LWE ciphertext to obtain multiple third RLWE ciphertexts comprises: Converting the first LWE ciphertext into a third LWE ciphertext having a smaller dimension; Perform multiple function bootstrapping based on the third LWE ciphertext.

8. The method according to claim 2, wherein generating the RLWE ciphertext of the second test polynomial based on the plurality of first RLWE ciphertexts comprises: Obtaining a first constant term from each of the first RLWE ciphertexts, wherein each of the first constant terms is a fourth LWE ciphertext; Based on the LWE-RLWE key conversion algorithm, the obtained fourth LWE ciphertexts are converted into fifth RLWE ciphertexts as RLWE ciphertexts of the second test polynomial, wherein the second test polynomial uses plaintexts corresponding to the fourth LWE ciphertexts as coefficients.

9. The method according to claim 2, wherein obtaining the LWE ciphertext of the second function value of the function corresponding to the first plaintext and the second plaintext based on the second RLWE ciphertext comprises: A second constant term is obtained from the second RLWE ciphertext as an LWE ciphertext of a second function value of the function corresponding to the first plaintext and the second plaintext.

10. A computing device comprising a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 9 is implemented.

Images