Homomorphic encryption arithmetic device and operating method thereof

Abstract

The invention provides a homomorphic encryption arithmetic device and an operation method thereof. There is provided an operation method of a homomorphic encryption arithmetic device, the operation method including receiving a public key and an input identification value from a client, generating an authenticator based on a result of comparing the input identification value with a plurality of user identification values stored in a first database, obtaining a search result value by searching a second database based on an input query, and generating a homomorphic encryption arithmetic device based on the search result value. Generating an arithmetic result value by performing an operation using the search result value and the authenticator, and transmitting the arithmetic result value to the client.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application is based on and claims the benefit of priority from Korean Patent Application No. 10-2023-0087988 filed in the Korean Intellectual Property Office on July 6, 2023, the disclosure of which is incorporated herein by reference in its entirety. Technical Field

[0003] The present inventive concept relates to a homomorphic encryption operation method, and in particular, to an apparatus for processing user data by using an anonymous signature protocol based on homomorphic encryption and an operation method thereof. Background Art

[0004] With the development of communication technology and the active popularization of electronic devices, efforts to maintain the security of communications between electronic devices are ongoing, and therefore, encryption / decryption technology is used in most communication environments.

[0005] When a message encrypted by encryption technology is delivered to another party, the other party decrypts the encrypted message to read the original unencrypted message. In this way, when a third-party hacker attack occurs during the period when the other party has temporarily decrypted the message for operation, the decrypted message may be easily leaked to the third party.

[0006] To solve this problem, homomorphic encryption methods are being studied. With homomorphic encryption, even if the encrypted information is not decrypted and an operation is performed in the ciphertext state, the same result as the encrypted value can be obtained after performing the operation on the plaintext. Therefore, various operations can be performed without decrypting the ciphertext. Summary of the invention

[0007] Principles and embodiments of the inventive concept relate to homomorphic encryption operation methods and systems that use cryptographic authenticators to provide security and reliability.

[0008] The principles and embodiments of the inventive concept are not limited to the above-mentioned aspects, and those skilled in the art can clearly understand other aspects and details not mentioned from the following description.

[0009] According to one aspect of the present invention, there is provided an operation method of a homomorphic encryption arithmetic device, the operation method comprising: receiving a public key and an encrypted input identification value based on the public key; generating an authenticator based on a comparison result of the input identification value and a plurality of user identification values; obtaining a search result value based on an input query received from a client; generating an arithmetic result value by using the search result value and the authenticator; and sending the arithmetic result value to the client.

[0010] According to another aspect of the present invention, there is provided a homomorphic encryption arithmetic device, comprising: a memory, comprising a first database configured to store a plurality of user identification values ​​and a second database configured to store a plurality of field values; an authenticator generator, configured to receive a public key and an encrypted input identification value based on the public key, and configured to generate an authenticator based on a comparison result of the input identification value and a plurality of user identification values; and an arithmetic device, configured to obtain a search result value by searching the second database based on an input query, so as to obtain an arithmetic result value by performing an operation using the search result value and the authenticator, and to send the arithmetic result value to a client.

[0011] According to another aspect of the present invention, a non-temporary computer-readable storage medium storing commands is provided, wherein the commands, when executed by a processor, cause the processor to perform homomorphic encryption operations, the processor being configured to receive a public key and an encrypted input identification value based on the public key from a client, generate an authenticator based on a comparison result of the input identification value with a plurality of user identification values ​​stored in a first database, obtain a search result value by searching a second database based on an input query received from the client, generate an arithmetic result value by performing operations using the search result value and the authenticator, and send the arithmetic result value to the client. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Embodiments of the present inventive concept will be more clearly understood from the following detailed description in conjunction with the accompanying drawings, in which:

[0013] Figure 1 is a block diagram illustrating a system according to an embodiment;

[0014] Figure 2 is a block diagram showing a server device according to an embodiment;

[0015] Figure 3 is a diagram illustrating an operation method of an authenticator generator according to an embodiment;

[0016] Figure 4 is a diagram illustrating an operation method of an arithmetic device according to an embodiment;

[0017] Figure 5 is a flowchart illustrating an operation method of a server device according to an embodiment;

[0018] Figure 6 is a diagram illustrating an operating method of a server device according to another embodiment;

[0019] Figure 7 is a diagram illustrating an operating method of a server device according to another embodiment;

[0020] Figure 8is a diagram illustrating an operation method of a client device and a server device according to an embodiment;

[0021] Fig. 9 is a block diagram showing an electronic device according to an embodiment; and

[0022] Fig.10 is a block diagram illustrating a solid state drive (SSD) system according to an embodiment. DETAILED DESCRIPTION

[0023] The embodiments are described in detail with reference to the accompanying drawings, wherein the same or corresponding components are assigned the same reference numerals and a redundant description thereof may be omitted.

[0024] Figure 1 is a block diagram illustrating a system 10 according to an embodiment.

[0025] refer to Figure 1 , the system 10 may include a client device 100 and a server device 200. The system 10 may be referred to as an authentication system based on homomorphic encryption. In this specification, the client device 100 may be referred to as a first homomorphic encryption device, or may be referred to as a client. The server device 200 may be referred to as a second homomorphic encryption device or a homomorphic encryption arithmetic device, or may be referred to as a server.

[0026] In various embodiments, the client device 100 may encrypt data sent to the server device 200 by a homomorphic encryption algorithm, wherein the initially unencrypted data may be encrypted by the client device 100 using the homomorphic encryption algorithm. The client device 100 may generate a public key PUK, a private key PVK, and an evaluation key EVK. The client device 100 may include a memory 120, wherein the memory 120 may be configured to store the public key PUK, the private key PVK, and the evaluation key EVK generated by the client device 100. In an embodiment, the client device 100 may generate a ciphertext CPT by encrypting plaintext according to the homomorphic encryption algorithm. The ciphertext CPT may be data obtained by encrypting plaintext using the public key PUK.

[0027] In various embodiments, the public key PUK, the private key PVK, and / or the evaluation key EVK stored in the memory of the client device may be used to encrypt the plaintext to obtain the ciphertext CPT for transmission to the server device 200. The ciphertext CPT may be an encrypted query.

[0028] In various embodiments, the client device 100 may send at least one key and a ciphertext CPT to the server device 200. In an embodiment, the ciphertext CPT may include information identifying a user of the client device 100. The information identifying the user may refer to, for example, an identification (ID) and password of the user, fingerprint information, and / or iris information, and may refer to other data that may identify the user. As used herein, the information identifying the user may be referred to as a user identification value, and the user identification value included in the ciphertext CPT may be referred to as an input user identification value or an input identification value.

[0029] In an embodiment, the key sent by the client device 100 to the server device 200 may include a public key PUK and an evaluation key EVK.

[0030] In an embodiment, the ciphertext CPT may be a query generated by the client device 100 to obtain data from a database of the server device 200. The query may be a query encrypted by a public key PUK generated by the client device 100.

[0031] In an embodiment, the client device 100 may send an unencrypted query to the server device 200 to obtain data from a database of the server device 200 .

[0032] In various embodiments, the client device 100 may receive the arithmetic result value ERES from the server device 200. The client device 100 may decrypt the arithmetic result value ERES by using the private key PVK, wherein the decryption result may be a value corresponding to the query provided by the client device 100 or a virtual value unrelated to the query provided by the client device 100, according to the ciphertext CPT delivered by the client device 100 to the server device 200. Figure 3 and Figure 4 A detailed description of the decryption result is given.

[0033] In various embodiments, the server device 200 may perform an operation using the ciphertext CPT received from the client device 100, wherein the server device 200 may process the ciphertext CPT by performing an operation on the ciphertext CPT. The operation may be, for example, an addition operation, a multiplication operation, an approximation operation, or a comparison operation, wherein the operation refers to an operation according to a homomorphic encryption algorithm. The server device 200 may maintain the security of the user data by performing an encryption operation on the user data based on the homomorphic encryption algorithm.

[0034] In various embodiments, the server device 200 may include a processor 210, a memory 220, an authenticator generator 230, and an arithmetic device 240, wherein, for example, the server device 200 may be a computing system such as a personal computer, a mobile phone, a server, etc., and may be a module in which multiple processing cores and memories are mounted on a substrate as independent packages, and the multiple processing cores and memories may be a system-on-chip embedded in one chip.

[0035] In various embodiments, the processor 210 may communicate with the memory 220 and execute instructions. In various embodiments, the processor 210 may execute a program stored in the memory 220. The program may include a series of instructions. The processor 210 may be hardware capable of independently executing instructions and may be referred to as an application processor (AP), a communication processor (CP), a central processing unit (CPU), a processor core, a core, etc.

[0036] In various embodiments, the processor 210 and the memory 220 may communicate with each other. The memory 220 may be accessed by the processor 210 and may store software elements that may be executed by the processor 210. As non-limiting examples, software elements may include software components, programs, applications, computer programs, applications, system programs, software development programs, machine programs, operating system (OS) software, middleware, firmware, software modules, routines, subroutines, functions, methods, processes, software interfaces, application program interfaces (APIs), instruction sets, computing codes, computer codes, code segments, computer code segments, compilers, words, values, symbols, or any combination of two or more thereof.

[0037] In various embodiments, the memory 220 may be hardware that can be configured to store information and can be accessed by the processor 210. For example, the memory 220 may include a read-only memory (ROM), a random access memory (RAM), a dynamic random access memory (DRAM), a double data rate dynamic random access memory (DDR-DRAM), a synchronous dynamic random access memory (SDRAM), a static random access memory (SRAM), a magnetoresistive random access memory (MRAM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, a polymer memory, a phase change memory, a ferroelectric memory, a silicon-oxide-nitride-oxide-silicon (SONOS) memory, a magnetic card / disk, an optical card / disk, or any combination of two or more thereof. In an embodiment, the memory 220 may include a first database for storing a plurality of user identification values. In various embodiments, each of the plurality of user identification values ​​stored in the first database may be stored in an encrypted form by a homomorphic encryption algorithm, wherein the first database may be encrypted. The memory 220 may include a second database for storing a field value, which is data corresponding to a query received from the client device 100. In various embodiments, the data stored in the second database may be encrypted by a homomorphic encryption algorithm. The memory 220 may include a first database and a second database, wherein the memory 220 may also include an additional database, so that one or more databases may be stored in the memory 220. In a non-limiting exemplary embodiment, the data may be stored as two or more tables in one database, wherein multiple user identification values ​​may be stored in the first table and multiple field values ​​may be stored in the second table.

[0038] In various embodiments, the authenticator generator 230 may generate an authenticator based on a user identification value received from the client device 100. The authenticator generator 230 may compare the user identification value included in the ciphertext CPT sent from the client device 100 with a plurality of user identification values ​​stored in a first database in the memory 220 of the server 200. The authenticator generator 230 may compare the plurality of user identification values ​​stored in the memory 220 with the user identification value received from the client device 100. The authenticator generator 230 may generate an authenticator having a first value or an authenticator having a second value based on the comparison result. The authenticator generator 230 may provide the authenticator to the arithmetic device 240, wherein the arithmetic device 240 may be configured to generate an arithmetic result value ERES based on the value of the authenticator. Reference will be made later to Figure 2 and Figure 3 Describe authenticator generation in detail.

[0039] In various embodiments, the arithmetic device 240 may perform a search of the second database based on an input query included in the ciphertext CPT received from the client device 100, wherein a search result value may be obtained by searching the second database 222 based on the input query EQY received from the client. The arithmetic device 240 may generate an arithmetic result value by multiplying the search result value by the authenticator received from the authenticator generator 230. In response to the authenticator having a first value, the arithmetic result value ERES may be assigned a search result value, or in response to the authenticator having a second value, the arithmetic result value ERES may be assigned a virtual value. The arithmetic device 240 may send the arithmetic result value ERES to the client device 100. Reference will be made later to Figure 2 and Figure 4 A detailed description of the arithmetic processing by the arithmetic device 240 is described.

[0040] In various embodiments, the homomorphic encryption arithmetic device and the method of operating the homomorphic encryption arithmetic device may be stored in a non-transitory computer-readable storage medium, depending on the embodiment. The term "computer-readable medium" may include any type of medium that can be accessed by a computer, such as a read-only memory (ROM), a random access memory (RAM), a hard drive, a compact disk (CD), a digital video disk (DVD), or other types of media. Non-transitory computer-readable media may not include wired, wireless, optical, or other communication links that send temporary power or other signals, and may include media that can permanently store data, as well as media that can store data and then rewrite data thereon, such as a rewritable optical disk or an erasable memory device.

[0041] Figure 2 2 is a block diagram showing a server device 200 according to an embodiment. Figure 1 To describe Figure 2 , and redundant descriptions can be omitted.

[0042] refer to Figure 2 , the server device 200 may include a memory 220, an authenticator generator 230, and an arithmetic device 240. The memory 220 may include a first database 221 and a second database 222. The first database 221 may be configured to store user identification values. In an embodiment, the first database 221 may store multiple user identification values, wherein each user identification value stored in the first database 221 may be a value encrypted by a homomorphic encryption algorithm.

[0043] In various embodiments, the server device 200 may receive the public key PUK and the evaluation key EVK from the client device 100. The received public key PUK and the evaluation key EVK may be stored in the memory 220, wherein the public key PUK and the evaluation key EVK may be stored in the second database 222.

[0044] In various embodiments, the second database 222 may be configured to store data to be provided to the client device 100, wherein the second database 222 may be configured to store a field value that is a result value corresponding to an entry query received from the client device 100. The second database 222 may store a plurality of field values.

[0045] In various embodiments, the authenticator generator 230 may receive an input identification value EID from the client device 100, wherein the input identification value EID may be a value encrypted by a homomorphic encryption algorithm. For example, the input identification value EID may be a value encrypted by using a public key PUK generated by the client device 100.

[0046] In various embodiments, the authenticator generator 230 may include a comparator 231. The authenticator generator 230 may search for multiple user identification values ​​stored in the first database 221, and may use the comparator 231 to compare the input identification value EID with the multiple user identification values ​​stored in the first database 221. The authenticator generator 230 may determine whether there is a match between the input identification value EID and the value stored in the first database 221. In various embodiments, the comparator 231 may be referred to as a homomorphic comparator.

[0047] In an embodiment, in response to a match between the input identification value EID and at least one of the user identification values ​​stored in the first database 221, the authenticator generator 230 may generate an authenticator EAI having a first value. In an embodiment, in response to a mismatch between the input identification value EID and any of the user identification values ​​stored in the first database 221, the authenticator generator 230 may generate an authenticator EAI having a second value. Figure 3 A detailed description of a process in which the authenticator generator 230 generates the authenticator EAI is described.

[0048] In various embodiments, the arithmetic device 240 may include a homomorphic arithmetic circuit 241 and a multiplier 242. The arithmetic device 240 may search for field values ​​stored in the second database 222. The homomorphic arithmetic circuit 241 may perform an operation to compare an input query EQY received from the client device 100 with a query corresponding to a field value stored in the second database 222, and obtain a comparison operation result value ECR. The homomorphic arithmetic circuit 241 may provide the comparison operation result value ECR to the multiplier 242. In an embodiment, the client device 100 may generate an input query EQY, and the input query EQY may be encrypted using a public key PUK generated by the client device 100.

[0049] As used herein, searching the second database 222 may mean that the arithmetic device 240 performs a series of actions to obtain a search result value. For example, searching the second database 222 may mean that the arithmetic device 240 performs the following two actions: First, the arithmetic device 240 may perform a comparison operation via the homomorphic arithmetic circuit 241 to determine whether the input query EQY is a query to retrieve a specific record stored in the second database 222. The result of the comparison operation may be a set of comparison operation result values ​​ECR. This will be referred to later. Figure 4 This is specifically described in Equation 7. Second, the arithmetic device 240 can obtain the search result value by multiplying the comparison operation result value ECR by the field value corresponding to each comparison operation result value ECR through the multiplier 242 to obtain the search result value. This will refer to Figure 4 and Equation 8 further describes.

[0050] In various embodiments, the multiplier 242 may obtain a search result value by multiplying each comparison operation result value ECR received from the homomorphic arithmetic circuit 241 by a field value corresponding to each comparison operation result value ECR. The multiplier 242 may obtain an arithmetic result value ERES by multiplying the search result value by the authenticator EAI received from the authenticator generator 230. An arithmetic result value including a field value corresponding to an input query may be generated in response to the authenticator having a first value during decryption by using a private key corresponding to a public key. An arithmetic result value including a virtual value may be generated in response to the authenticator having a second value during decryption by using a private key corresponding to a public key. The multiplier 242 may provide the arithmetic result value ERES to the client device 100. The client device 100 may decrypt the arithmetic result value ERES received from the server device 200 using the private key PVK. In various embodiments, the multiplier 242 may be referred to as a homomorphic multiplier. Reference will be made later to Figure 4 A detailed description will be given of the multiplication operation of the multiplier 242 and the decryption operation of the arithmetic result value ERES.

[0051] Figure 3 2 is a diagram showing an operation method of the authenticator generator 230 according to an embodiment. Figure 1 and Figure 2 To describe Figure 3 , and redundant descriptions can be omitted.

[0052] In various embodiments, the memory 220 may include a first database 221. In an embodiment, the first database 221 may include N records (where N is an integer of 1 or greater), and the N records include N user identification values ​​ENC (ID1) to ENC (IDN). Each record included in the first database 221 may be classified according to an index value. Each user identification value may be a value encrypted by a homomorphic encryption algorithm. Each user identification value may be a value encrypted by a different public key. In the following, it may be assumed that the input identification value EID is the same value as the i-th user identification value ENC (IDi), and the i-th user identification value ENC (IDi) is the i-th user identification value (where i is an integer of 1 or greater) among the user identification values ​​included in the first database 221.

[0053] In various embodiments, the authenticator generator 230 may include a comparator 231. The authenticator generator 230 may receive an input identification value EID from the client device 100. The authenticator generator 230 may perform a comparison operation on the first database 221 based on the input identification value EID, and may generate an authenticator EAI, which may be a first value or a second value.

[0054] In an embodiment, the comparator 231 may perform an operation of comparing the input identification value EID with the N user identification values ​​ENC(ID1) to ENC(IDN). The comparison operation of the comparator 231 may be expressed as Equation 1 below.

[0055] [Equation 1]

[0056]

[0057] In various embodiments, ENC(1) may be referred to as a first value, and ENC(0) may be referred to as a second value. The first value and the second value may be values ​​encrypted using a public key PUK generated by the client device 100. In an embodiment, the first value may be a value obtained by encrypting an integer 1 using a public key PUK generated by the client device 100, and the second value may be a value obtained by encrypting an integer 0 using a public key PUK generated by the client device 100. In an embodiment, according to the present disclosure, the second value ENC(0) may be a unit element of an addition operation. The first value ENC(1) may be a unit element of a multiplication operation. In other words, the addition operation of the first value ENC(1) and the second value ENC(0) may be operated as shown in the following Equations 2 and 3. In an embodiment, when the server device 200 performs a binary operation, such as an addition operation or a multiplication operation, using the first value or the second value, a commutative property may be established.

[0058] [Equation 2]

[0059]

[0060] [Equation 3]

[0061]

[0062] In various embodiments, the comparator 231 may perform a comparison operation such as Equation 1 on each of the first to Nth user identification values ​​ENC(ID1) to ENC(IDN). The comparison operation may be expressed as Equation 4 below.

[0063] [Equation 4]

[0064]

[0065] In Equation 4, F(ENC(IDi)) may refer to a function that allows the comparator 231 to receive the input identification value EID as an input value and perform a comparison operation between the input identification value EID and the user identification value stored in the first database 221. The comparator 231 may perform the comparison operation according to Equation 4 and generate the authenticator EAI. The authenticator EAI may be represented by Equation 5.

[0066] [Equation 5]

[0067]

[0068] Considering Equation 2 and Equation 3, Equation 5 can be expressed as Equation 6.

[0069] [Equation 6]

[0070]

[0071] The comparator 231 may generate an authenticator EAI having a first value or a second value depending on whether there is a match between the input identification value EID and the user identification value included in the first database 221. It is possible to classify whether the user is an authenticated user or an unauthenticated user according to the value of the authenticator EAI, wherein, for example, when the authenticator EAI has a first value, this may mean that the user of the client device 100 that has sent the input identification value EID is an authenticated user. When the authenticator EAI has a second value, this may mean that the user of the client device 100 that has sent the input identification value EID is an unauthenticated user.

[0072] In various embodiments, the authenticator EAI may have a first value or a second value, which may be a value encrypted based on a public key PUK generated by the client device 100. Therefore, the authenticator EAI may also be a value encrypted according to a homomorphic encryption algorithm. The authenticator EAI may be a value encrypted using the public key PUK. The authenticator generator 230 may provide the generated authenticator EAI to the arithmetic device 240.

[0073] Figure 4 2 is a diagram illustrating a method of operating the arithmetic device 240 according to an embodiment. Figures 1 to 3 To describe Figure 4 , and redundant descriptions can be omitted.

[0074] In various embodiments, the memory 220 may include a second database 222. In an embodiment, the second database 222 may include M records (where M is an integer of 1 or greater). Each record may include at least one field. Each record included in the second database 222 may be classified according to an index value. In the following, it may be assumed that each record includes one field. The second database 222 may include first to Mth field values ​​DB1 to DBM, wherein each field value may be a value encrypted by a homomorphic encryption algorithm. Each field value may be a value encrypted by a different public key. The first field value DB1 to the Mth field value DBM included in the second database 222 may correspond to the first query ENC (q1) to the Mth query ENC (qM), respectively. For example, when the input query EQY is the first query ENC (q1), the input query EQY may be a query for obtaining the first field value DB1. Similarly, when the input query EQY is the Mth query ENC (qM), the input query EQY may be a query for obtaining the Mth field value DBM. In an embodiment, the first query ENC (q1) to the Mth query ENC (qM) may be values ​​encrypted according to a homomorphic encryption algorithm. Hereinafter, it is assumed that the input query EQY and the kth query ENC (qk) are the same value, and the kth query ENC (qk) is a query for obtaining the kth field value (k is an integer of 1 or greater) among the field values ​​included in the second database 222.

[0075] In various embodiments, the arithmetic device 240 may include a homomorphic arithmetic circuit 241 and a multiplier 242. The arithmetic device 240 may receive an input query EQY from the client device 100. The arithmetic device 240 may receive an authenticator EAI from the authenticator generator 230. The arithmetic device 240 may generate an arithmetic result value ERES based on the input query EQY and the authenticator EAI. The input query EQY may be a value encrypted based on a public key generated by the client device 100.

[0076] In an embodiment, the arithmetic device 240 may search the second database 222 in the memory 220 using the input query EQY. The homomorphic arithmetic circuit 241 may perform an operation of comparing the input query EQY with the first query ENC (q1) to the Mth query ENC (qM) to generate a query comparison result value. The comparison operation of the homomorphic arithmetic circuit 241 may be expressed as the following equation 7.

[0077] [Equation 7]

[0078]

[0079] In various embodiments, the homomorphic arithmetic circuit 241 may obtain first to Mth field values ​​DB1 to DBM corresponding to first to Mth query ENCs (q1) to (qM), and may provide the query comparison result value and the field value to the multiplier 242 .

[0080] In various embodiments, the operation of comparing the input query EQY of the homomorphic arithmetic circuit 241 with the first query ENC (q1) to the Mth query ENC (qM) may be performed a total of M times, wherein each of the first query ENC (q1) to the Mth query ENC (qM) may be compared. Therefore, the M query comparison operation result values ​​ECR and the M field values ​​may be provided to the multiplier 242.

[0081] In various embodiments, the multiplier 242 may obtain a search result value by multiplying each received query comparison operation result value ECR by the corresponding field value and adding each multiplied value. The search result value may be expressed as the following equation 8.

[0082] [Equation 8]

[0083]

[0084] In Equation 8, H(ENC(qk), DBF) may refer to a function that allows the arithmetic device 240 to perform a comparison operation by receiving as inputs the k-th query ENC(qk) and the field value DBF of the second database 222. As used herein, the field value DBF may refer to a term for all field values ​​stored in the second database 222, and the j-th field value DBj may refer to a term for the j-th field value of the field value DBF, where j is a natural number greater than or equal to 1.

[0085] The multiplier 242 may obtain an arithmetic result value by multiplying the search result value obtained through Equation 8 by the authenticator EAI received from the authenticator generator 230. The arithmetic result value may be expressed as Equation 9 below.

[0086] [Equation 9]

[0087]

[0088] In Equation 9, G(EAI, ENC(qk), DBF) may refer to a function that allows the arithmetic device 240 to perform an operation by receiving as inputs the authenticator EAI, the k-th query ENC(qk), and the field value DBF of the second database 222. The arithmetic device 240 may perform multiplication on the search result value received from the arithmetic circuit 241 through the multiplier 242 and the authenticator EAI received from the authenticator generator 230.

[0089] Since the authenticator EAI may have the first value or the second value depending on whether the user of the client device 100 is an authenticated user, Equation 9 may be expressed as Equation 10 below.

[0090] [Equation 10]

[0091]

[0092] In an embodiment, a multiplication operation of the first value ENC(1), the second value ENC(0), and the j-th field value DBj among the M field values ​​DBF included in the second database may be calculated as Equations 11 to 15.

[0093] [Equation 11]

[0094]

[0095] [Equation 12]

[0096]

[0097] [Equation 13]

[0098]

[0099] [Equation 14]

[0100]

[0101] [Equation 15]

[0102]

[0103] In an embodiment, the second database 222 may be an unencrypted database, wherein the field value DBF included in the second database 222 may be an unencrypted value DBj, as described in Equation 15. Even if the field value DBF included in the second database 222 is not encrypted, each field value DBF may be homomorphically encrypted through a multiplication operation, such as Equation 15.

[0104] [Equation 16]

[0105]

[0106] In an embodiment, the second database 222 may be an encrypted database. In other words, each field value included in the second database 222 may be an encrypted value ENC(DBj), as shown in Equation 16. According to Equations 11 to 16, Equation 10 may be expressed as Equation 17.

[0107] [Equation 17]

[0108]

[0109] In various embodiments, the arithmetic device 240 may perform the operation shown in Equation 17 and generate an arithmetic result value ERES, wherein the multiplier 242 may output the arithmetic result value ERES. The arithmetic device 240 may provide the generated arithmetic result value ERES to the client device 100.

[0110] In various embodiments, the client device 100 may decrypt the received arithmetic result value ERES using a private key PVK generated by the client device 100. In an embodiment, when the input identification value EID sent by the client device 100 exists in the first database 221, the client device 100 may be an authenticated device, wherein the user of the client device 100 may be an authenticated user. When the authenticated client device 100 decrypts the arithmetic result value ERES by using the private key PVK, the decrypted result may be a k-th field value DBk stored in the second database 222, wherein k is an index value from 1 to M.

[0111] In an embodiment, when the input identification value EID sent by the client device 100 does not exist in the first database 221, the client device 100 may be an unauthenticated device, wherein the user of the client device 100 may be an unauthenticated user. When the unauthenticated client device 100 decrypts the arithmetic result value ERES by using the private key PVK, the decryption result may be a virtual value. For example, the virtual value may be 0, NULL, or a garbage value. The virtual value may be a value independent of the multiple field values ​​DBF stored in the second database 222. The decryption result may be a value corresponding to the query provided by the client device 100 or a virtual value unrelated to the query provided by the client device 100.

[0112] Through the above-mentioned operation method of the homomorphic encryption arithmetic device of the present disclosure, by decrypting the arithmetic result value ERES obtained from the server device 200, the authenticated client device 100 can obtain a value corresponding to the input query EQY sent by the client device 100, wherein the arithmetic device 240 can generate the arithmetic result value ERES. The unauthenticated client device 100 can obtain a value unrelated to the input query EQY sent by the client device 100 by decrypting the arithmetic result value ERES obtained from the server device 200. The operation method of the homomorphic encryption arithmetic device of the present disclosure can be called a blind authentication protocol. A system operating based on this anonymous authentication protocol can resist a man-in-the-middle attack.

[0113] Figure 5 2 is a flowchart showing a method of operating the server device 200 according to an embodiment. Figure 1 and Figure 2 To describe Figure 5 , and redundant descriptions can be omitted.

[0114] refer to Figure 5 In operation S110, the server device 200 may receive a public key PUK and an input identification value EID from the client device 100. The input identification value EID may be a value encrypted by a homomorphic encryption algorithm.

[0115] In an embodiment, the server device 200 may receive an evaluation key EVK for a homomorphic encryption operation. That is, the server device 200 may receive a public key PUK, an evaluation key EVK, and an input identification value EID from the client device 100.

[0116] In operation S120, the server device 200 may generate an authenticator EAI based on a comparison result of the input identification value EID and the multiple user identification values, wherein the server device 200 may search for the multiple user identification values ​​stored in the first database 221. The user identification values ​​stored in the first database 221 may be stored in an encrypted form by a homomorphic encryption algorithm. The server device 200 may compare the input identification value EID with the multiple user identification values ​​found in the first database 221. The server device 200 may generate an authenticator EAI based on the comparison result.

[0117] In an embodiment, the server device 200 may generate the authenticator EAI based on the evaluation key EVK by performing an operation of comparing the input identification value EID with a plurality of user identification values ​​stored in the first database 221. Figure 6 The detailed description of operation S120 is described in detail.

[0118] In operation S130, the server device 200 may receive an input query EQY from the client device 100. The server device 200 may obtain a search result value by searching the second database 222 based on the input query EQY.

[0119] Specifically, the server device 200 may perform an operation of comparing the input query EQY received from the client device 100 with the queries ENC(q1) to ENC(qM) corresponding to the field values ​​stored in the second database 222, and obtain a comparison operation result ECR. The server device 200 may obtain a search result value by multiplying each comparison operation result value ECR by the field value DBF corresponding to each comparison operation result value ECR.

[0120] In an embodiment, the server device 200 may perform an operation of comparing the input query EQY with an encrypted query corresponding to a field value DBF included in the second database 222 based on the evaluation key EVK.

[0121] In an embodiment, the server device 200 may multiply each comparison operation result value ECR by a field value DBF corresponding to each comparison operation result value ECR based on the evaluation key EVK. Figure 7 A detailed description of operation S130 is described in detail.

[0122] In operation S140, the server device 200 may generate an arithmetic result value ERES by performing an operation using the search result value and the authenticator EAI, wherein the server device 200 may obtain the arithmetic result value ERES by multiplying the search result value by the authenticator EAI based on the input identification value EID.

[0123] In an embodiment, when the authenticator EAI has a first value, the server device 200 may multiply the first value by the search result value, and the server device 200 may output the search result value as the arithmetic result value ERES.

[0124] In an embodiment, when the authenticator EAI has the second value, the server device 200 may multiply the second value by the search result value, and the server device 200 may output a dummy value as the arithmetic result value ERES.

[0125] In an embodiment, the server device 200 may perform an operation of multiplying the search result value by the authenticator EAI based on the evaluation key EVK.

[0126] In operation S150, the server device 200 may provide the arithmetic result value ERES to the client device 100. The client device 100 may decrypt the arithmetic result value ERES received from the server device 200 using the private key PVK.

[0127] In an embodiment, when the authenticator EAI has the first value, the result of decrypting the arithmetic result value ERES may include a field value corresponding to the input query EQY among the values ​​stored in the second database 222 .

[0128] In an embodiment, when the authenticator EAI has the second value, the result of decrypting the arithmetic result value ERES may be a dummy value.

[0129] Figure 6 2 is a diagram showing a method of operating a server device 200 according to another embodiment. Specifically, Figure 6 Is used to describe Figure 5 Refer to the diagram of operation S120. Figure 1 , Figure 2 and Figure 5 To describe Figure 6 , and redundant descriptions can be omitted.

[0130] refer to Figure 6 In operation S121 , the server device 200 may determine whether there is a match between the input identification value EID and the user identification value stored in the first database 221 .

[0131] In operation S122, the server device 200 may generate an authenticator EAI having a first value when the input identification value EID matches at least one of the user identification values ​​stored in the first database 221. In other words, in response to the input identification value EID matching at least one of the plurality of user identification values ​​stored in the first database 221, the server device 200 may generate an authenticator EAI having a first value.

[0132] In operation S123, when the input identification value EID does not have a matching user identification value among the user identification values ​​stored in the first database 221, the server device 200 may generate an authenticator EAI having a second value. In response to the input identification value EID not matching any of the plurality of user identification values ​​stored in the first database 221, the server device 200 may generate an authenticator EAI having a second value. In response to the input identification value not matching the plurality of user identification values ​​stored in the first database, the authenticator EAI may have the second value.

[0133] Figure 7 2 is a diagram showing a method of operating a server device 200 according to another embodiment. Specifically, Figure 7 Is used to describe Figure 5 Refer to the diagram of operation S130. Figure 1 , Figure 2 and Figure 5 To describe Figure 7, and redundant descriptions can be omitted.

[0134] refer to Figure 7 In operation S131, the server device 200 may receive an input query EQY from the client device 100. In an embodiment, the input query EQY may be encrypted based on a homomorphic encryption algorithm, wherein the input query EQY may be encrypted based on a public key PUK.

[0135] In operation S132, the server device 200 may determine whether there is a match between the input query EQY and the query corresponding to each field value stored in the second database 222. Specifically, an operation of comparing the input query EQY with the encrypted query corresponding to the field value included in the second database 222 may be performed. The server device 200 may perform an operation of comparing the input query EQY received from the client device 100 with the query corresponding to the field value stored in the second database 222.

[0136] In an embodiment, the query to be compared with the input query EQY may be a query encrypted based on a homomorphic encryption algorithm.

[0137] In operation S133, in response to determining that there is at least one matching query, as a result of the comparison in operation S132, the server device 200 may determine a first value as a comparison operation result value. The server device 200 may obtain a comparison operation result value corresponding to the first value by performing the comparison operation in operation S132.

[0138] In operation S134, in response to determining that there is no matching query, as a result of the comparison in operation S132, the server device 200 may determine a second value as a result of the comparison operation result value. The server device 200 may obtain a comparison operation result value corresponding to the second value by performing the comparison operation in operation S132.

[0139] In operation S135, the server device 200 may obtain a search result value by multiplying the comparison operation result value by the field value. In an embodiment, when the number of field values ​​stored in the second database is M, the number of comparison operation result values ​​may also be M. The number of values ​​obtained by multiplying each of the M comparison operation result values ​​by the field value corresponding thereto may also be M. In an embodiment, the search result value may be a value obtained by summing all M multiplied values.

[0140] Figure 8 2 is a diagram showing a method of operating the client device 100 and the server device 200 according to an embodiment. Figure 1 and Figure 2 To describe Figure 8, and redundant descriptions can be omitted.

[0141] refer to Figure 8 In operation S210, the client device 100 may generate a public key PUK, a private key PVK, and an evaluation key EVK. The keys generated by the client device 100 may be generated according to a homomorphic encryption algorithm.

[0142] In operation S220, the client device 100 may encrypt the input identification value EID according to a homomorphic encryption algorithm. In an embodiment, the input identification value EID may be encrypted using a public key PUK.

[0143] In operation S230, the client device 100 may send the public key PUK, the evaluation key EVK, and the encrypted input identification value EID to the server device 200. The server device 200 may receive the public key and the input identification value encrypted based on the public key from the client device 100.

[0144] In operation S240, the server device 200 may compare the received input identification value EID with the user identification value stored in the first database 221, and generate an authenticator EAI based on the comparison result.

[0145] In operation S250, the client device 100 may encrypt the input query EQY. In an embodiment, the input query EQY may be encrypted using a public key PUK.

[0146] In operation S260, the client device 100 may send the public key PUK, the evaluation key EVK, and the encrypted input query EQY to the server device 200. In an embodiment, since the public key PUK and the evaluation key EVK are sent to the server device 200 in operation S230, only the input query EQY may be sent to the server device 200 in operation S260.

[0147] In operation S270, the server device 200 may obtain a search result value by searching the second database 222 based on the input query EQY. The server device 200 may generate an arithmetic result value ERES by performing an operation using the search result value and the authenticator EAI.

[0148] In operation S280, the server device 200 may transmit the arithmetic result value ERES to the client device 100. In an embodiment, the arithmetic result value ERES may be a value encrypted using a public key PUK.

[0149] In operation S290, the client device 100 may decrypt the arithmetic result value ERES. Specifically, the client device 100 may decrypt the arithmetic result value ERES using the private key PVK.

[0150] According to an embodiment of the present disclosure, the operation of sending the result of verifying the input identification value EID received from the client device 100 by the server device 200 to the client device 100 can be omitted. The server device 200 can perform the operation using the authenticator EAI without sending the verification result to the client device 100. Therefore, according to the operation method of the homomorphic encryption arithmetic device, the authentication stage of authenticating the user can be reduced, so the communication process between the client device 100 and the server device 200 can be reduced, and the overhead of computing resources required for communication can be reduced.

[0151] Fig. 9 is a block diagram showing an electronic device 1000 according to an embodiment.

[0152] In various embodiments, the electronic device 1000 may include a processor 1100 , an encryption device 1200 , an interface 1300 , a memory subsystem 1400 , a storage device 1410 , and a bus 1500 . Fig. 9 The electronic device 1000 may correspond to the client device 100 and / or the server device 200. Components included in the electronic device 1000 may communicate with each other through the bus 1500.

[0153] In various embodiments, the electronic device 1000 may be implemented as or included in various electronic devices. For example, the electronic device may include a drone, a robot device such as an advanced driver assistance system (ADAS), a smart TV, a smart phone, a medical device, a mobile device, a video display device, an instrument device, an Internet of Things (IoT) device, etc.

[0154] In various embodiments, the electronic device 1000 may be a system on chip (SoC), in which components are implemented in one chip, and the storage device 1410 may be external to the system on chip. Fig. 9 At least one of the illustrated components may be omitted from the electronic device 1000 .

[0155] In various embodiments, the processor 1100 may control the operation of the electronic device 1000 at the top level, and may control other components of the electronic device 1000. The processor 1100 may communicate with the memory subsystem 1400 and execute instructions. In various embodiments, the processor 1100 may execute a program stored in the memory subsystem 1400. The program may include a series of instructions stored in the memory subsystem 1400. The processor 1100 may be hardware capable of independently executing instructions, and may be referred to as an application processor (AP), a communication processor (CP), a central processing unit (CPU), a processor core, a core, etc. The processor 1100 may perform a method of operating a homomorphic encryption arithmetic device according to the concept of the present invention.

[0156] In various embodiments, the encryption device 1200 may encrypt and / or decrypt data DT received from outside the electronic device 1000. The encryption device 1200 may maintain the security of the data DT by performing encryption operations based on an encryption algorithm. The encryption algorithm may be, for example, an algorithm that generates encrypted data using an encryption key. In various embodiments, the encryption algorithm may be a homomorphic encryption algorithm, wherein operations may be performed on the data DT encrypted using the homomorphic encryption algorithm while maintaining the security of the data DT.

[0157] In various embodiments, the interface 1300 may provide an interface for obtaining input from the outside of the electronic device 1000 and providing output to the outside of the electronic device 1000. In an embodiment, the electronic device 1000 may send data DT to the outside of the electronic device 1000 and receive data DT therefrom, wherein for example, the electronic device 1000 may send data DT to and receive data DT therefrom a smart card, a memory card, or other devices.

[0158] In various embodiments, the memory subsystem 1400 can be accessed by other components connected to the bus 1500. In some embodiments, the memory subsystem 1400 may include volatile memory such as DRAM and SRAM, or non-volatile memory such as flash memory and resistive random access memory (RRAM). In various embodiments, the memory subsystem 1400 may provide an interface to the storage device 1410. The storage device 1410 may be a storage medium that does not lose data even if power is off. For example, the storage device 1410 may include a semiconductor memory device such as a non-volatile memory, and may include a storage medium such as a magnetic card / disk or an optical card / disk. The operating method of the homomorphic encryption arithmetic device according to an embodiment of the present disclosure may be stored in the memory subsystem 1400 and / or the storage device 1410.

[0159] In various embodiments, the memory subsystem 1400 may be accessible by the processor 1100 and may store software elements that may be executed by the processor 1100. As non-limiting examples, software elements may include software components, programs, applications, computer programs, applications, system programs, software development programs, machine programs, operating system (OS) software, middleware, firmware, software modules, routines, subroutines, functions, methods, processes, software interfaces, application program interfaces (APIs), instruction sets, computing codes, computer codes, code segments, computer code segments, words, values, symbols, or any combination of two or more thereof.

[0160] In various embodiments, bus 1500 can operate based on one of various bus protocols, wherein the various bus protocols may include at least one of the Advanced Microcontroller Bus Architecture (AMBA) protocol, the Universal Serial Bus (USB) protocol, the MultiMediaCard (MMC) protocol, the Peripheral Component Interconnect (PCI) protocol, the PCI-Express (PCI-E) protocol, the Advanced Technology Attachment (ATA) protocol, the Serial ATA protocol, the Parallel ATA protocol, the Small Computer Mini Interface (SCSI) protocol, the Enhanced Minidisk Interface (ESDI) protocol, the Integrated Drive Electronics (IDE) protocol, the Mobile Industry Processor Interface (MIPI) protocol, the Universal Flash Storage (UFS) protocol, and the like.

[0161] Fig.10 is a block diagram illustrating a solid state drive (SSD) system 2000 according to an embodiment.

[0162] In various embodiments, the SSD system 2000 may include a host 2100 and an SSD 2200. The SSD 2200 may send a signal SIG to the host 2100 and receive a signal SIG from the host 2100 through a signal connector, and may receive a power supply PWR through a power connector. The SSD 2200 may include an SSD controller 2210, an auxiliary power supply 2220, and a plurality of flash memory devices 2230, 2240, and 2250. The SSD controller 2210 may communicate with a plurality of flash memory devices through a first channel Ch1 to an nth channel Cn (n is an integer of 1 or more).

[0163] In various embodiments, the flash memory devices 2230, 2240, and 2250 may include a first database 2231 and a second database 2241. The first database 2231 may correspond to Figure 2 The first database 221 and the second database 2241 shown may correspond to Figure 2 The second database 222 is shown.

[0164] In various embodiments, the SSD controller 2210 may include an authenticator generator 2211 and an arithmetic device 2212. The authenticator generator 2211 and the arithmetic device 2212 may be configured to generate an authenticator generator 2211 and an arithmetic device 2212. Figures 1 to 9 The embodiment shown is implemented.

[0165] While the inventive concept has been particularly shown and described with reference to embodiments thereof, it will be understood that various changes in form and details may be made therein without departing from the spirit and scope of the appended claims.

Claims

1. A method for operating a homomorphic encryption arithmetic device, the method comprising: Receive a public key and an input identification value encrypted based on the public key from a client; generating an authenticator based on a comparison result of the input identification value and a plurality of user identification values; obtaining search result values ​​based on an input query received from a client; Generate an arithmetic result value using the search result value and the authenticator; as well as Sends the arithmetic result value to the client.

2. The method according to claim 1, wherein: Generating the authentication token includes: generating an authenticator having a first value in response to the input identification value matching at least one of the plurality of user identification values ​​stored in the first database; and In response to the input identification value not matching the plurality of user identification values ​​stored in the first database, an authenticator having a second value is generated.

3. The method according to claim 2, wherein: Generating the arithmetic result value includes: Multiply the search result value by the authenticator, where In response to the authenticator having the first value, the arithmetic result value is assigned the search result value; and In response to the authenticator having the second value, the arithmetic result value is assigned a dummy value.

4. The method according to claim 2, wherein: Generating the arithmetic result value includes: In response to the authenticator having the first value, generating an arithmetic result value including a field value corresponding to the input query during decryption by using a private key corresponding to the public key; and In response to the authenticator having the second value, an arithmetic result value having a dummy value is generated during decryption by using the private key.

5. The method according to claim 1, wherein: The input query is encrypted based on a public key.

6. The method according to claim 5, wherein: The search result value is obtained by searching a second database, wherein the search includes: obtaining a comparison operation result value by performing an operation of comparing the input query with an encrypted query corresponding to a field value included in the second database; Obtaining a search result value by multiplying each comparison operation result value by a field value corresponding to the comparison operation result value; and An arithmetic result value is obtained by multiplying the search result value by the authenticator.

7. The method according to claim 1, further comprising: Receive an evaluation key from the client; as well as An authenticator is generated by comparing the input identification value with the plurality of user identification values ​​stored in the first database based on the evaluation key.

8. The method according to claim 1, wherein: The obtaining of the search result value includes: An evaluation key is received from the client, and a second database is searched, wherein The search of the second database includes: obtaining a comparison operation result value by comparing the input query with an encrypted query corresponding to a field value included in the second database based on the evaluation key; Based on the evaluation key, multiply each comparison operation result value by the field value corresponding to the comparison operation result value to obtain a search result value; and Based on the evaluation key, the search result value is multiplied by the authenticator.

9. A homomorphic encryption arithmetic device comprising: a memory including a first database and a second database, wherein the first database is configured to store a plurality of user identification values, and the second database is configured to store a plurality of field values; an authenticator generator configured to receive a public key and an input identification value encrypted based on the public key, and configured to generate an authenticator based on a comparison result of the input identification value and the plurality of user identification values; and The arithmetic device is configured to obtain a search result value by searching the second database based on the input query, obtain an arithmetic result value by performing an operation using the search result value and an authenticator, and transmit the arithmetic result value to the client.

10. The homomorphic encryption arithmetic device according to claim 9, wherein: The authenticator generator is configured to: generating an authenticator having a first value in response to the input identification value matching at least one of the plurality of user identification values ​​stored in the first database; as well as In response to the input identification value not matching the plurality of user identification values ​​stored in the first database, an authenticator having a second value is generated.

11. The homomorphic encryption arithmetic device according to claim 10, wherein: The arithmetic device is configured to: When the first value is multiplied by the search result value, an arithmetic result value having the search result value is generated; as well as When the second value is multiplied by the search result value, an arithmetic result value having a virtual value is generated.

12. The homomorphic encryption arithmetic device according to claim 10, wherein: The arithmetic device is configured to: In response to the authenticator having the first value, generating an arithmetic result value including a field value corresponding to the input query during decryption by using a private key corresponding to the public key; as well as In response to the authenticator having the second value, an arithmetic result value having a dummy value is generated during decryption by using the private key.

13. The homomorphic encryption algorithm device according to claim 9, wherein: The input query is encrypted based on a public key.

14. The homomorphic encryption arithmetic device according to claim 13, wherein: The arithmetic device is configured to: obtaining a comparison operation result value by performing an operation of comparing the input query with an encrypted query corresponding to a field value included in the second database; The search result value is obtained by multiplying each comparison operation result value by the field value corresponding to the comparison operation result value; as well as An arithmetic result value is obtained by multiplying the search result value by the authenticator.

15. The homomorphic encryption arithmetic device according to claim 9, wherein: The authenticator generator is configured to: receiving an evaluation key from the client; and An authenticator is generated by comparing the input identification value with the plurality of user identification values ​​stored in the first database based on the evaluation key.

16. The homomorphic encryption arithmetic device according to claim 9, wherein: The arithmetic device is configured to: Receive an evaluation key from the client; as well as obtaining a comparison operation result value by comparing the input query with an encrypted query corresponding to a field value included in the second database based on the evaluation key; Based on the evaluation key, multiply each comparison operation result value by the field value corresponding to the comparison operation result value to obtain a search result value; as well as Based on the evaluation key, the search result value is multiplied by the authenticator.

17. A non-transitory computer-readable storage medium storing instructions that, when executed by a processor, cause the processor to perform homomorphic encryption operations, the processor being configured to: Receive a public key and an input identification value encrypted based on the public key from the client; generating an authenticator based on a comparison of the input identification value with a plurality of user identification values ​​stored in the first database; obtaining a search result value by searching a second database based on an input query received from a client; generating an arithmetic result value by performing an operation using the search result value and the authenticator; as well as Sends the arithmetic result value to the client.

18. The non-transitory computer-readable storage medium of claim 17, wherein: The generation of the authentication token includes: generating an authenticator having a first value in response to the input identification value matching at least one of the plurality of user identification values ​​stored in the first database; and In response to the input identification value not matching the plurality of user identification values ​​stored in the first database, an authenticator having a second value is generated.

19. The non-transitory computer-readable storage medium of claim 18, wherein: The generation of the arithmetic result value includes: In response to the authenticator having the first value, generating an arithmetic result value including a field value corresponding to the input query during decryption by using a private key corresponding to the public key; and In response to the authenticator having the second value, an arithmetic result value having a dummy value is generated during decryption by using the private key.

20. The non-transitory computer-readable storage medium of claim 17, wherein: The second database search included: obtaining a comparison operation result value by performing an operation of comparing the input query with an encrypted query corresponding to a field value included in the second database; Obtaining a search result value by multiplying each comparison operation result value by a field value corresponding to the comparison operation result value; and An arithmetic result value is obtained by multiplying the search result value by the authenticator.

Images