Key generation method and unit, acceleration unit, electronic equipment and storage medium

Abstract

The embodiment of the invention provides a secret key generation method and unit, an acceleration unit, electronic equipment and a storage medium, the secret key generation method is used for generating a rotation secret key required for performing noise reduction processing on a ciphertext to be subjected to noise reduction, and the method comprises the following steps: reading a plurality of fault-tolerant learning ciphertexts generated according to the ciphertext to be subjected to noise reduction, the to-be-denoised ciphertext is obtained based on a ciphertext output by a fully homomorphic encryption function; reading a bootstrap key according to the number of rounds of denoising processing on the ciphertext to be denoised; according to the plurality of fault-tolerant learning ciphertexts, respectively shifting coefficients of a plurality of polynomials included in the bootstrap key to obtain a plurality of rotating keys; and respectively outputting the plurality of rotation keys, so that the plurality of rotation keys are used for carrying out noise reduction processing on the ciphertext to be subjected to noise reduction. According to the scheme, the hardware storage and bandwidth consumption in the ciphertext noise reduction process can be reduced.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of chip technology, and in particular to a key generation method and unit, an acceleration unit, an electronic device, and a storage medium. Background Art

[0002] The ciphertext generated by the encryption function that satisfies Fully Homomorphic Encryption (FHE) includes a valid signal and noise. The valid signal is a function corresponding to the plaintext value. When the proportion of noise included in the ciphertext is too large, the correct plaintext cannot be obtained by decrypting the ciphertext. The bootstrap algorithm can reduce the noise in the ciphertext so that calculations can be performed on the ciphertext without decrypting the ciphertext. In the process of denoising the ciphertext by the bootstrap algorithm, each round of denoising needs to generate multiple rotating keys based on the ciphertext, and the denoising process is controlled by the generated rotating keys to denoise the ciphertext to be denoised.

[0003] At present, multiple rotating keys are generated based on ciphertext through multiple threads. Each thread reads a bootstrap key and a learning with errors (LWE) ciphertext respectively, and generates a rotating key corresponding to the thread according to the read bootstrap key and LWE ciphertext.

[0004] However, in one round of denoising, different threads read the bootstrap key separately to generate a rotation key, which requires multiple readings of the bootstrap key. The bootstrap key has a large amount of data, resulting in a large consumption of hardware storage and bandwidth in the ciphertext denoising process. Summary of the invention

[0005] In view of this, embodiments of the present application provide a key generation method and unit, an acceleration unit, an electronic device and a storage medium to at least partially solve the above problems.

[0006] According to a first aspect of an embodiment of the present application, a key generation method is provided for generating a rotation key required for denoising a ciphertext to be denoised, the method comprising: reading a plurality of fault-tolerant learning ciphertexts generated according to the ciphertext to be denoised, the ciphertext to be denoised being obtained based on a ciphertext output by a fully homomorphic encryption function; reading a bootstrap key according to the number of rounds of denoising the ciphertext to be denoised; shifting the coefficients of a plurality of polynomials included in the bootstrap key according to the plurality of fault-tolerant learning ciphertexts respectively to obtain a plurality of rotation keys; and outputting the plurality of rotation keys respectively so as to use the plurality of rotation keys for denoising the ciphertext to be denoised.

[0007] According to a second aspect of an embodiment of the present application, a key generation unit is provided for generating a rotation key required for denoising a ciphertext to be denoised, the key generation unit comprising: a first reading subunit, a second reading subunit, a fan-in subunit, a fan-out subunit and a rotation subunit; the first reading subunit is used to read a plurality of fault-tolerant learning ciphertexts generated according to the ciphertext to be denoised, and send the plurality of fault-tolerant learning ciphertexts to the fan-in subunit, the ciphertext to be denoised is obtained based on the ciphertext output by a fully homomorphic encryption function; the second reading subunit is used to generate a rotation key required for denoising a ciphertext to be denoised according to the ciphertext to be denoised The bootstrap key is read according to the number of rounds of denoising of the ciphertext, and the bootstrap key is sent to the rotation subunit; the fan-in subunit is used to send the multiple fault-tolerant learning ciphertexts to the rotation subunit respectively; the rotation subunit is used to shift the coefficients of the multiple polynomials included in the bootstrap key according to the multiple fault-tolerant learning ciphertexts, obtain multiple rotation keys, and send the multiple rotation keys to the fan-out subunit; the fan-out subunit is used to output the multiple rotation keys respectively, so as to use the multiple rotation keys to perform denoising on the ciphertext to be denoised.

[0008] According to a third aspect of an embodiment of the present application, an acceleration unit is provided, comprising: a key generation unit as described in the second aspect above; a ciphertext generation unit, used to generate a plurality of fault-tolerant learning ciphertexts based on the ciphertext to be denoised, and send the plurality of fault-tolerant learning ciphertexts to the key generation unit, wherein the ciphertext to be denoised is obtained based on the ciphertext output by a fully homomorphic encryption function; a ciphertext denoising unit, used to receive a plurality of rotation keys output by the key generation unit, and perform denoising on the ciphertext to be denoised according to the plurality of rotation keys.

[0009] According to the fourth aspect of an embodiment of the present application, an electronic device is provided, comprising: a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other through the communication bus; the memory is used to store at least one executable instruction, and the executable instruction enables the processor to perform operations corresponding to the method described in the first aspect above.

[0010] According to a fifth aspect of an embodiment of the present application, a computer storage medium is provided, on which a computer program is stored. When the program is executed by a processor, the method described in the first aspect above is implemented.

[0011] According to a sixth aspect of an embodiment of the present application, a computer program product is provided, comprising computer instructions, wherein the computer instructions instruct a computing device to execute the method described in the first aspect above.

[0012] It can be seen from the above technical solution that when denoising the ciphertext to be denoised, corresponding rotating keys need to be generated for different threads. The rotating keys for different threads are generated based on different LWE ciphertexts and the same bootstrap key. Therefore, multiple LWE ciphertexts and one bootstrap key are read, and the same bootstrap key is shared when rotating keys are generated for different threads, which reduces the number of times the bootstrap key is read, thereby reducing the storage and bandwidth consumption of hardware in the ciphertext denoising process. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the embodiments of the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0014] Figure 1 is a schematic diagram of an exemplary system used in one embodiment of the present application;

[0015] Figure 2 is a flow chart of a key generation method according to an embodiment of the present application;

[0016] Figure 3 is a schematic diagram of a computing device according to an embodiment of the present application;

[0017] Figure 4 is a schematic diagram of an acceleration unit according to an embodiment of the present application;

[0018] Figure 5 is a schematic diagram of an acceleration unit according to another embodiment of the present application;

[0019] Figure 6 is a schematic diagram of a noise reduction process according to an embodiment of the present application;

[0020] Figure 7 is a schematic diagram of a key generation unit according to an embodiment of the present application;

[0021] Figure 8 is a schematic diagram of a key generation process of an embodiment of the present application;

[0022] Fig. 9 It is a schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] The present application is described below based on embodiments, but the present application is not limited to these embodiments. In the detailed description of the present application below, some specific details are described in detail. It is possible for a person skilled in the art to fully understand the present application without the description of these details. In order to avoid confusing the essence of the present application, known methods, processes, and flows are not described in detail. In addition, the drawings are not necessarily drawn to scale.

[0024] First, some nouns or terms that appear in the process of describing the embodiments of the present application are subject to the following explanations.

[0025] Fully homomorphic encryption function: If an encryption function f satisfies f(A)+f(B)=f(A+B), then the encryption function satisfies additive homomorphism. If an encryption function f satisfies f(A)×f(B)=f(A×B), then the encryption function satisfies multiplicative homomorphism. If an encryption function satisfies both additive homomorphism and multiplicative homomorphism, then the encryption function is called a fully homomorphic encryption function, and various types of operations can be performed on the encrypted ciphertext of the encryption function, such as addition, subtraction, multiplication, division, polynomial evaluation, exponential, logarithmic, and trigonometric functions.

[0026] Fast Fourier Transform: Fast Fourier Transform (FFT) is a fast algorithm for discrete Fourier transform, which can overcome the computational barriers of conversion between time domain and frequency domain, and is widely used in spectrum, atmospheric spectrum analysis, digital signal processing, etc. Fast Fourier transform can realize a fast algorithm for polynomial multiplication.

[0027] Polynomial: A polynomial is an algebraic expression consisting of the addition (or subtraction) of several monomials. The terms without letters in a polynomial are called constant terms.

[0028] Fully Homomorphic Encryption over the Torus: The Fully Homomorphic Encryption over the Torus (TFHE) algorithm is a fully homomorphic encryption algorithm with relatively efficient bootstrapping capabilities. It has the characteristics of small parameters, simple algorithm, and support for multi-lookup table calculation.

[0029] Exemplary Systems

[0030] Figure 1 An exemplary system of a key generation method applicable to an embodiment of the present application is shown. Figure 1 As shown, the system may include a cloud service end 102, a communication network 104 and at least one user device 106. Figure 1The example is a plurality of user devices 106. It should be noted that the solution of the embodiment of the present application can be applied to both the cloud service end 102 and the user device 106.

[0031] The cloud service end 102 may be any suitable device for storing information, data, programs and / or any other suitable type of content, including but not limited to distributed storage system devices, server clusters, computing cloud service end clusters, etc. In some embodiments, the cloud service end 102 may perform any suitable function. For example, in some embodiments, the cloud service end 102 may be used to generate a rotating key, which is used to perform noise reduction processing on the ciphertext to be denoised. As an optional example, in some embodiments, the cloud service end 102 may encrypt data through a fully homomorphic encryption function to obtain a ciphertext, then perform a calculation operation on the ciphertext, and perform noise reduction processing on the ciphertext output by the fully homomorphic encryption function or the ciphertext obtained after the calculation operation, and generate the rotating key required for the noise reduction process. In other embodiments, the cloud service end 102 may receive a ciphertext from a user device 106, perform a calculation operation on the received ciphertext, and generate a rotating key for performing noise reduction processing on the ciphertext obtained by the calculation operation, and then perform noise reduction processing on the obtained key through the generated rotating key.

[0032] The communication network 104 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 104 can include any one or more of the following: the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), and / or any other suitable communication network. The user device 106 can be connected to the communication network 104 via one or more communication links (e.g., communication link 112), and the communication network 104 can be linked to the cloud service end 102 via one or more communication links (e.g., communication link 114). The communication link can be any communication link suitable for transmitting data between the cloud service end 102 and the user device 106, such as a network link, a dial-up link, a wireless link, a hard-wired link, any other suitable communication link, or any suitable combination of such links.

[0033] The user device 106 may include any one or more user devices suitable for interaction. In some embodiments, when the cloud service end 102 performs ciphertext denoising, the user device 106 may send a data processing request to the cloud service end 102, the data care request including the fully homomorphically encrypted ciphertext and the required operation to trigger the cloud service end 102 to perform the corresponding operation on the ciphertext included in the request according to the operation indicated by the request, and denoise the ciphertext obtained by the operation, generate a rotation key during the ciphertext denoising process, and then feed back the operation result to the user device 106. In other embodiments, the user device 106 may perform ciphertext denoising locally and generate the rotation key required during the ciphertext denoising process. The user device 106 may include any suitable type of device, for example, the user device 106 may include a mobile device, a tablet computer, a laptop computer, a desktop computer, a wearable computer, a vehicle system and / or any other suitable type of user device.

[0034] The embodiments of the present application mainly focus on the process of ciphertext denoising by the cloud service end 102 or the user device 106, and the ciphertext denoising method will be described in detail later.

[0035] Key generation method

[0036] Based on the above system, an embodiment of the present application provides a key generation method for generating a rotation key required for denoising a ciphertext to be denoised. The key generation method is described in detail through multiple embodiments below.

[0037] Figure 2 : is a flowchart of a key generation method according to an embodiment of the present application. Figure 2 As shown, the key generation method includes the following steps:

[0038] Step 201: read multiple fault-tolerant learning ciphertexts generated according to the ciphertext to be denoised.

[0039] The ciphertext to be denoised is obtained based on the ciphertext output by the fully homomorphic encryption function. The ciphertext to be denoised can be the ciphertext obtained by encrypting the data through the fully homomorphic encryption function, or it can be the ciphertext obtained after performing a calculation operation on the ciphertext output by the fully homomorphic encryption function. When the ciphertext to be denoised is denoised, multiple rounds of denoising are required. The output ciphertext of the previous round of denoising is used as the input ciphertext of the next round of denoising. The input ciphertext of the first round of denoising is obtained based on the ciphertext to be denoised. Based on the result of the last round of denoising, the denoised ciphertext corresponding to the ciphertext to be denoised can be obtained.

[0040] According to the ciphertext to be denoised, multiple learning-tolerance-error (LWE) ciphertexts can be determined. In the process of denoising the ciphertext to be denoised, ciphertext denoising is performed in parallel through multiple threads, and different threads perform ciphertext denoising based on different LWE ciphertexts. The output ciphertext of each thread in the previous round of denoising will be used as the input ciphertext of the thread in the next round of denoising. According to the output ciphertext of each thread after the last round of denoising, the denoised ciphertext corresponding to the ciphertext to be denoised can be obtained.

[0041] The number of LWE ciphertexts can be equal to or greater than the number of threads. When the number of LWE ciphertexts is greater than the number of threads, the LWE ciphertexts need to be divided into multiple ciphertext groups according to the number of threads, and ciphertext denoising is performed in batches based on the LWE ciphertexts included in the ciphertext group by each thread. For example, if the number of LWE ciphertexts is 16 and the number of threads is 8, the LWE ciphertexts are divided into two ciphertext groups, each ciphertext group includes 8 LWE ciphertexts, and 8 threads are used to perform multiple rounds of ciphertext denoising based on the 8 LWE ciphertexts included in the first ciphertext group to obtain the denoising results corresponding to the 8 LWE ciphertexts included in the first ciphertext group, and then 8 threads are used to perform multiple rounds of ciphertext denoising based on the 8 LWE ciphertexts included in the second ciphertext group to obtain the denoising results corresponding to the 8 LWE ciphertexts included in the second ciphertext group, and then the denoised ciphertext corresponding to the ciphertext to be denoised is obtained according to the denoising results corresponding to the 16 LWE ciphertexts.

[0042] Step 202: Read the bootstrap key according to the number of rounds of denoising the ciphertext to be denoised.

[0043] The bootstrap key is pre-set based on the bootstrap algorithm, and the bootstrap key does not change with the different ciphertexts input to the bootstrap algorithm. The bootstrap key is a matrix with polynomials as elements. When the denoised ciphertext is subjected to denoising based on the bootstrap algorithm, multiple rounds of denoising are required, and different rounds of denoising correspond to different bootstrap keys. For example, if the bootstrap algorithm needs to perform n rounds of denoising on the denoised ciphertext, at least n bootstrap keys are pre-set, and the i-th bootstrap key is read in the i-th round of denoising, where i is a positive integer greater than or equal to 1.

[0044] Step 203: According to the multiple fault-tolerant learning ciphertexts, the coefficients of the multiple polynomials included in the bootstrap key are shifted respectively to obtain multiple rotation keys.

[0045] The LWE ciphertext includes multiple elements, the number of elements included in the LWE ciphertext is equal to the number of rounds of ciphertext denoising, and the elements included in the LWE ciphertext are integers. The elements included in the LWE ciphertext define the step size of the bootstrap key shift during the corresponding round of denoising.

[0046] Different threads perform ciphertext denoising according to different LWE ciphertexts. When performing ciphertext denoising, a thread determines a corresponding element from the LWE ciphertext corresponding to the thread as the rotation step length of the current round of denoising according to the number of rounds of denoising of the ciphertext to be denoised, and then shifts the multiple polynomials included in the bootstrap key corresponding to the current round of denoising based on the determined rotation step length to obtain the rotation key corresponding to the thread. The bootstrap key includes multiple polynomials. When shifting the multiple polynomials included in the bootstrap key, each polynomial included in the bootstrap key is shifted separately. When shifting the polynomial, the coefficients of the multiple monomials included in the polynomial are shifted according to the rotation step.

[0047] It should be understood that in one round of noise reduction processing, different threads use the same bootstrap key, but different threads correspond to different LWE ciphertexts, resulting in different rotation step sizes corresponding to different threads, so the rotated ciphertexts generated for different threads may be different.

[0048] In one example, eight threads perform denoising on the denoised ciphertext in parallel. Thread 0 performs denoising on the LWE ciphertext LWE. (0) Perform ciphertext denoising, thread 1 based on LWE ciphertext LWE (1) Perform ciphertext noise reduction, and so on, thread 7 is based on LWE ciphertext LWE (+) When the 10th round of denoising is being performed on the denoised ciphertext, thread 0 starts from LWE (0) The rotation step corresponding to the round number 10 is determined in the process, and the bootstrap key BSK9 corresponding to the 10th round of denoising is shifted based on the rotation step to obtain the rotation key used by thread 0 for the 10th round of denoising. Thread 1 from LWE (1) The rotation step corresponding to the round number 10 is determined in the process, and the bootstrap key BSK9 corresponding to the 10th round of noise reduction processing is shifted based on the rotation step to obtain the rotation key used by thread 1 for the 10th round of noise reduction processing. Similarly, thread 7 starts from LWE (+) The rotation step corresponding to the round number 10 is determined in the process, and the bootstrap key BSK9 corresponding to the 10th round of noise reduction processing is shifted based on the rotation step to obtain the rotation key used by thread 7 for the 10th round of noise reduction processing.

[0049] Step 204: output the obtained multiple rotation keys respectively, so as to use the multiple rotation keys to perform denoising processing on the ciphertext to be denoised.

[0050] After obtaining a plurality of rotating keys, the plurality of rotating keys are output to corresponding threads respectively, and the corresponding threads perform ciphertext denoising processing according to the received rotating keys.

[0051] For example, when the denoising ciphertext is subjected to the 10th round of denoising, the rotation key is obtained. to The key will be rotated Output to thread 0, which will rotate the key Output to thread 1, and so on, the key will be rotated The output is sent to thread 7, and threads 0 to 7 perform the 10th round of ciphertext denoising based on the received rotation key.

[0052] In an embodiment of the present application, when performing denoising processing on the denoised ciphertext, it is necessary to generate corresponding rotation keys for different threads. The rotation keys for different threads are generated based on different LWE ciphertexts and the same bootstrap key. Therefore, multiple LWE ciphertexts and a bootstrap key are read, and the same bootstrap key is shared when generating rotation keys for different threads, which reduces the number of times the bootstrap key is read, thereby reducing the storage and bandwidth consumption of the hardware in the ciphertext denoising process.

[0053] In a possible implementation, an LWE ciphertext is obtained based on a ciphertext to be denoised. The ciphertext to be denoised includes a first polynomial and a second polynomial, coefficients of multiple monomials included in the first polynomial are first coefficients, coefficients of multiple monomials included in the second polynomial are second coefficients, and multiple LWE ciphertexts can be generated according to the first coefficient and the second coefficient, and the generated LWE ciphertext includes at least one second coefficient.

[0054] The ciphertext to be denoised is obtained based on the ciphertext output by the fully homomorphic encryption function. The ciphertext to be denoised includes a first polynomial and a second polynomial. The noise included in the ciphertext to be denoised is located in the second polynomial, that is, the coefficient deviation of the monomial in the second polynomial causes the noise. An LWE ciphertext is generated according to the first coefficient of the monomial in the first polynomial and the second coefficient of the monomial in the second polynomial. The LWE ciphertext includes at least one second coefficient, so that denoising processing is performed based on multiple LWE ciphertexts to eliminate or reduce the noise caused by the second coefficient.

[0055] It should be understood that since the LWE ciphertext defines the step size for shifting the polynomial in the bootstrap key, the elements included in the LWE ciphertext are integers, and the elements of the LWE ciphertext are composed of the first coefficient and the second coefficient, so the first coefficient and the second coefficient are both integers.

[0056] In an embodiment of the present application, the ciphertext to be denoised includes a first polynomial and a second polynomial, and the noise included in the ciphertext to be denoised is located in the second polynomial, so multiple LWE ciphertexts are generated based on the first coefficient of the monomial in the first polynomial and the second coefficient of the monomial in the second polynomial, and the LWE ciphertext includes at least one second coefficient. Therefore, when a rotation key is generated based on the LWE ciphertext for noise reduction processing, the noise caused by the second coefficient can be eliminated or reduced to achieve the effect of denoising the ciphertext to be denoised, and the effect of denoising the ciphertext to be denoised can be guaranteed.

[0057] In a possible implementation, when generating LWE ciphertext according to the first coefficient and the second coefficient, each first coefficient may be sorted multiple times in a cyclically decreasing order of the number of the corresponding monomials to obtain M coefficient sequences, where M is the number of monomials included in the first polynomial. For each obtained coefficient sequence, according to the order of the first coefficients in the coefficient sequence, the coefficient sequence is combined with the corresponding second coefficient, and the positive and negative properties of the first coefficients in the obtained combined sequence are set, and the combined sequence after the positive and negative properties of the included first coefficients are set is determined as the LWE ciphertext.

[0058] In one example, the first polynomial a0+a1x+a2x 2 +a3x 3 , the second polynomial is b0+b1x+b2x 2 +b3x 3, the first coefficients a0, a1, a2 and a3 are sorted multiple times in the order of cyclically decreasing degrees of the corresponding monomials to obtain the following four coefficient sequences: (a3, a2, a1, a0), (a2, a1, a0, a3), (a1, a0, a3, a2) and (a0, a3, a2, a1). According to the order of the first coefficient in the coefficient sequence, the coefficient sequence (a3, a2, a1, a0) is combined with the second coefficient b3 to obtain the combined sequence (a3, a2, a1, a0, b3), the coefficient sequence (a2, a1, a0, a3) is combined with the second coefficient b2 to obtain the combined sequence (a2, a1, a0, a3, b2), the coefficient sequence (a1, a0, a3, a2) is combined with the second coefficient b1 to obtain the combined sequence (a1, a0, a3, a2, b1), and the coefficient sequence (a0, a3, a2, a1) is combined with the second coefficient b0 to obtain the combined sequence (a0, a3, a2, a1, b0). According to the order of the first coefficient in the coefficient sequence, the positivity of the first coefficient in the corresponding combined sequence is set, and a positive sign is added to each first coefficient in the combined sequence (a3, a2, a1, a0, b3). Therefore, after setting the positivity of the first coefficient, the combined sequence is still (a3, a2, a1, a0, b3), and the combined sequence (a2, a1, a0, a3, b2) is adjusted to (a2, a1, a0, -a3, b2), the combined sequence (a1, a0, a3, a2, b1) is adjusted to (a1, a0, -a3, -a2, b1), and the combined sequence (a0, a3, a2, a1, b0) is adjusted to (a0, -a3, -a2, -a1, b0). After adjusting the positive and negative properties of the first coefficients, the combined sequences (a0, -a3, -a2, -a1, b0), (a1, a0, -a3, -a2, b1), (a2, a1, a0, -a3, b2) and (a3, a2, a1, a0, b3) are determined as 4 LWE ciphertexts.

[0059] It should be noted that in the above example, the first polynomial and the second polynomial include 4 monomials, generating 4 LWE ciphertexts, each of which includes 5 elements. However, this does not limit the number of monomials included in the first polynomial and the second polynomial in the denoised ciphertext. The first polynomial and the second polynomial in the denoised ciphertext may include a larger number of monomials. For example, the first polynomial and the second polynomial both include 2 n monomials, n is a positive integer greater than 2. When the first polynomial and the second polynomial both include 2 n When there are monomials, referring to the combination method and the positive and negative setting method in the above example, 2 n LWE ciphertexts, each of which consists of 2 n +1 element.

[0060] In an embodiment of the present application, multiple coefficient sequences can be obtained by sorting the first coefficients in the order of cyclically decreasing degrees of the corresponding monomials, and multiple combined sequences can be obtained by combining each coefficient sequence with a second coefficient. After adjusting the positivity of the first coefficient in the combined sequence according to the order of the first coefficients in the combined sequence, multiple LWE ciphertexts are obtained. Since the noise included in the ciphertext to be denoised is caused by the second coefficient, the second coefficient is split into different LWE ciphertexts so that each LWE ciphertext includes a second coefficient, and then different rotated ciphertexts are generated based on different LWE ciphertexts. Ciphertext denoising is performed according to the rotated ciphertexts to eliminate or reduce the noise caused by the second coefficient, thereby ensuring the effect of denoising the ciphertext to be denoised.

[0061] In a possible implementation, when the coefficients of the polynomial included in the bootstrap key are shifted according to the LWE ciphertext, the rotation step size can be determined from the elements included in the LWE ciphertext according to the number of rounds of denoising processing on the denoised ciphertext, and then the coefficients of the polynomial included in the bootstrap key are shifted according to the determined rotation step size to obtain the corresponding rotation key.

[0062] Since there are multiple LWE ciphertexts, different LWE ciphertexts are used by different threads, and different threads perform shift processing on the bootstrap key based on their corresponding LWE ciphertexts. The LWE ciphertext includes multiple elements, and different elements define the rotation step lengths of different noise reduction processing rounds. According to the number of rounds of noise reduction processing for the denoised ciphertext to be processed, the rotation step length corresponding to the current round of noise reduction processing can be determined from each element included in the LWE ciphertext. The rotation step length corresponding to the current round of noise reduction processing is determined from different LWE ciphertexts, so that different threads can shift the coefficients of the polynomial included in the bootstrap key in parallel based on the corresponding rotation step length.

[0063] The bootstrap key corresponds to the round of denoising processing for the denoised ciphertext to be processed, and different denoising processing rounds may correspond to different bootstrap keys. The bootstrap key includes multiple polynomials, each polynomial includes multiple monomials, and when the thread shifts the bootstrap key according to the rotation step corresponding to the current round of denoising processing, the multiple polynomials included in the bootstrap key are shifted respectively according to the rotation step. When the polynomial is shifted according to the rotation step, the coefficients of the multiple monomials included in the polynomial are cyclically shifted according to the rotation step.

[0064] In an embodiment of the present application, according to the number of rounds of denoising the ciphertext to be denoised, the rotation step corresponding to the current round of denoising is determined from the elements included in the LWE ciphertext, and then the coefficients of the polynomial included in the bootstrap key are shifted according to the rotation step to obtain a rotation key, and different rotation keys can be obtained for different LWE ciphertexts. Since the LWE ciphertext is obtained based on the ciphertext to be denoised, the rotation key is generated based on the LWE ciphertext and the bootstrap key, the noise included in the ciphertext to be denoised is transferred to the rotation key, and then the ciphertext to be denoised is denoised according to the rotation key, the purpose of eliminating the noise in the ciphertext to be denoised can be achieved, and the effect of denoising the ciphertext to be denoised can be ensured.

[0065] In a possible implementation, when determining the rotation step from the elements included in the LWE ciphertext according to the number of rounds of denoising processing performed on the denoised ciphertext, the mth element in the LWE ciphertext can be determined as the rotation step corresponding to the current round of denoising processing according to the arrangement order of multiple elements included in the LWE ciphertext, where m is the number of rounds corresponding to the current round of denoising processing performed on the denoised ciphertext.

[0066] The first polynomial and the second polynomial included in the ciphertext to be denoised both include M monomials, then M LWE ciphertexts can be generated according to the coefficients of the first polynomial and the coefficients of the second polynomial, and each LWE ciphertext includes M+1 elements. When the ciphertext to be denoised is subjected to denoising, the ciphertext to be denoised is subjected to M+1 rounds of denoising. When the ciphertext to be denoised is subjected to the mth round of denoising, the mth element in the LWE ciphertext is determined as the rotation step corresponding to the mth round of denoising, where m is an integer greater than or equal to 1 and less than or equal to M+1.

[0067] In an example, the four LWE ciphertexts are LWE (0) =(a0,-a3,-a2,-a1,b0), LWE (1) =(a1, a0, -a3, -a2, b1), LWE (2) =(a2, a1, a0, -a3, b2) and LWE (3) =(a3, a2, a1, a0, b3).

[0068] When performing the first round of denoising on the denoised ciphertext, LWE (0) The element a0 in is determined as the rotation step corresponding to the current round of denoising processing, and LWE (1) The element a1 in is determined as the rotation step corresponding to the current round of denoising processing, and LWE (2) The element a2 in is determined as the rotation step corresponding to the current round of denoising processing, and LWE (3) The element a3 in is determined as the rotation step size corresponding to the current round of denoising. (0)Thread 0 shifts the polynomial included in the bootstrap key BSK0 according to the rotation step a0, corresponding to LWE (1) Thread 1 shifts the polynomial included in the bootstrap key BSK0 according to the rotation step a1, corresponding to LWE (2) Thread 2 shifts the polynomial included in the bootstrap key BSK0 according to the rotation step a2, corresponding to LWE (3) Thread 3 shifts the polynomial included in the bootstrap key BSK0 according to the rotation step a3.

[0069] When performing the third round of denoising on the denoised ciphertext, LWE (0) The element -a2 in is determined as the rotation step corresponding to the current round of denoising processing, and LWE (1) The element -a3 in is determined as the rotation step corresponding to the current round of denoising processing, and LWE (2) The element a0 in is determined as the rotation step corresponding to the current round of denoising processing, and LWE (3) The element a1 in is determined as the rotation step size corresponding to the current round of denoising. (0) Thread 0 shifts the polynomial included in the bootstrap key BSK2 according to the rotation step -a2, corresponding to LWE (1) Thread 1 shifts the polynomial included in the bootstrap key BSK2 according to the rotation step -a3, corresponding to LWE (2) Thread 2 shifts the polynomial included in the bootstrap key BSK2 according to the rotation step a0, corresponding to LWE (3) Thread 3 shifts the polynomial included in the bootstrap key BSK2 according to the rotation step a1.

[0070] In an embodiment of the present application, when the denoised ciphertext is subjected to the mth round of denoising, the mth element in the LWE ciphertext is determined as the rotation step corresponding to the mth round of denoising according to the arrangement order of the elements in the LWE ciphertext, so as to conveniently determine the rotation step corresponding to the current round of denoising, and ensure that the bootstrap key can be shifted in sequence according to the elements included in the LWE ciphertext, thereby ensuring the effect of denoising the ciphertext to be subjected to the denoising.

[0071] In a possible implementation, when shifting the coefficients of multiple polynomials included in the bootstrap key according to the rotation step, the coefficients of each polynomial included in the bootstrap key can be shifted separately according to the rotation step. When shifting the coefficients of a polynomial according to the rotation step, the coefficients of each monomial included in the polynomial can be circularly shifted according to the rotation step in the order of increasing or decreasing degree of the monomial. For example, if the rotation step is 1, the coefficients of each monomial in the polynomial are shifted by 1 in the order of increasing degree of the monomial, the coefficient of the monomial with degree 1 is shifted to the coefficient of the monomial with degree 2, the coefficient of the monomial with degree 2 is shifted to the coefficient of the monomial with degree 3, and the coefficient of the monomial with the largest corresponding degree is negated and then shifted to the coefficient of the monomial with degree 0.

[0072] If the polynomial in the bootstrap key is A(x), the coefficients of each monomial included in the polynomial A(x) can be shifted according to the rotation step corresponding to the current round of noise reduction processing to obtain the shifted polynomial A′(x), where

[0073] A(x) = a0 + a1x + a2x 2 +…+ a N-1 x N-1

[0074] A′(x) = -a N-n -a N-n+1 x - a N-n+2 x 2 -…- a N-1 x n-1 + a0x n + a1x n+1 +…+ a N-n-1 x N-1

[0075] N is used to represent the number of monomials included in the polynomial A(x), and N is a positive integer greater than or equal to 2; a0, a1, …, a N-1 are used to represent the coefficients of the monomials included in the polynomial A(x), and a0, a1, …, a N-1 are all integers greater than or equal to 0; n is used to represent the rotation step, and n is a positive integer greater than or equal to 1 and less than N.

[0076] In the above expression of A′(x), N - n < N - n + 1 < N - n + 2 < N - 1. When the value of n is different, the number of integers between N - n and N - 1 is a positive integer greater than or equal to 0. When n is equal to 1, N - n = N - 1, and there is a N-1 in the expression of A′(x), and there is no a N-n , a N-n+1 and a N-n+2When n is equal to 2, Nn = N-1, the number of integers from Nn to N-1 is 0, and there is a in the expression of A'(x) N-1 and a N-n , there is no a N-n+1 and a N-n+2 For example, if the rotation step is 1, then A′(x)=-a N-1 +a0x 1 +a1x 2 +…+a N-2 x N-1 , if the rotation step is 2, then A′(x)=-a N-2 -a N-1 x+a0x 2 +a1x 3 +…+a N-3 x N-1 .

[0077] N is the number of monomials included in the polynomial in the bootstrap key. The value of N is a positive integer. N can be equal to a positive integer power of 2, for example, N is equal to 1024 or 2048.

[0078] Since the bootstrap key includes multiple polynomials, after the multiple polynomials included in the bootstrap key are shifted in the above manner, multiple shifted polynomials are obtained, and then a matrix including the obtained multiple shifted polynomials is determined as a rotation key. Since the rotation step lengths are determined from different LWE ciphertexts, the polynomials included in the bootstrap key are shifted according to the rotation step lengths obtained from different LWE ciphertexts, so that the rotation keys corresponding to different LWE ciphertexts can be obtained.

[0079] In an embodiment of the present application, according to the determined rotation step, the coefficients of each monomial included in the polynomial in the bootstrap key are cyclically shifted in the order of increasing or decreasing degrees of the monomial. When multiple rounds of denoising are performed on the denoised ciphertext, the elements in the matrix corresponding to the bootstrap key can be cyclically shifted by rows or columns, thereby more comprehensively denoising the denoised ciphertext and improving the effect of denoising the denoised ciphertext.

[0080] Computing Devices

[0081] Figure 3 FIG. 1 is a block diagram showing the internal structure of a computing device 30 (electronic device or system on chip) according to an embodiment of the present application. Figure 3As shown, the computing device 30 includes a bus-connected memory 32, a scheduling unit cluster 34, and an acceleration unit cluster 36. The scheduling unit cluster 34 includes a plurality of scheduling units 340. The acceleration unit cluster 36 includes a plurality of acceleration units 360. The acceleration unit 360 in the embodiment of the present application is a special processing unit designed mainly for fully homomorphic encryption operations, which can be embodied as a processing unit (Central Processing Unit, CPU), a graphics processor (Graphics Processing Unit, GPU), an infrastructure processor (Infrastructure Processing Units, IPU), an application-specific integrated circuit (Application Specific Integrated Circuit, ASIC) and a field programmable gate array (Field Programmable Gate Array, FPGA) specially designed for privacy computing. The scheduling unit 340 is a unit that schedules the acceleration unit 360 and allocates the sequence of instructions to be executed to each acceleration unit 360. It can take the form of a processing unit (CPU), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), and the like.

[0082] The architecture design of traditional processors makes the scheduling unit and storage occupy a large part of the space in the architecture, while the computing unit occupies insufficient space. Therefore, it is very effective in logic control, but not efficient enough in large-scale parallel computing. Therefore, various specialized acceleration units have been developed to more effectively improve the computing speed for calculations of different functions and different fields. The acceleration unit proposed in this application is a processing unit dedicated to accelerating the speed of fully homomorphic encryption operations, which can support fully homomorphic algorithms such as TFHE and improve the efficiency of fully homomorphic encryption operations.

[0083] The acceleration unit 360 is subject to the scheduling of the scheduling unit 340. Figure 3 As shown, the memory 32 stores data to be operated, and the data to be operated is transmitted to an acceleration unit 360 by a scheduling unit 340. The scheduling unit 340 can send the address of the data to be operated in the memory 32 to the acceleration unit 360 in the form of an instruction. When the acceleration unit 360 performs a fully homomorphic encryption operation, it directly addresses the data to be operated in the memory 32, temporarily stores the data to be operated in its on-chip memory, and then the acceleration unit 360 can operate on the data to be operated. The embodiment of the present application mainly focuses on the process of denoising the ciphertext by the acceleration unit 360 during the fully homomorphic encryption operation, especially the process of generating a rotation key during the denoising process. The process of generating the rotation key required for denoising will be described in detail later.

[0084] Acceleration Unit

[0085] Figure 4 FIG. 3 shows an internal structure block diagram of an acceleration unit 360 according to an embodiment of the present application. Figure 4 As shown, the acceleration unit 360 includes a key generation unit 361, a ciphertext generation unit 362, and a ciphertext denoising unit 363. The ciphertext generation unit 362 can generate a plurality of LWE ciphertexts according to the ciphertext to be denoised, and send the generated plurality of LWE ciphertexts to the key generation unit 361. The key generation unit 361 generates a plurality of rotation keys based on the received LWE ciphertext and the read bootstrap key, and sends the generated plurality of rotation keys to the ciphertext denoising unit 363 respectively. The ciphertext denoising unit 363 can perform denoising on the ciphertext to be denoised according to the received plurality of rotation keys.

[0086] In an embodiment of the present application, the key generation unit 361 performs denoising on the denoised ciphertext in parallel through multiple threads, and different threads perform denoising based on different LWE ciphertexts and the same bootstrap key. The key generation unit 361 reads multiple LWE ciphertexts from the ciphertext generation unit 362, and reads a bootstrap key. When generating rotating keys for different threads, a bootstrap key is shared, which reduces the number of times the bootstrap key is read, thereby reducing the consumption of hardware storage and bandwidth during the ciphertext denoising process.

[0087] In a possible implementation, the ciphertext generation unit 362 can obtain the first coefficients of multiple monomials included in the first polynomial in the ciphertext to be denoised, and obtain the second coefficients of multiple monomials included in the second polynomial in the ciphertext to be denoised, and sort each first coefficient multiple times in the order of cyclically decreasing number of corresponding monomials to obtain M coefficient sequences, where M is the number of monomials included in the first polynomial, and combine the coefficient sequence with the corresponding second coefficient according to the order of the first coefficients in the coefficient sequence, and set the positive and negative of the first coefficient in the obtained combined sequence, and determine the combined sequence after setting the positive and negative of the included first coefficients as an LWE ciphertext, and the LWE ciphertext includes at least one second coefficient.

[0088] It should be noted that, for the process of generating LWE ciphertext by the ciphertext generating unit 362, reference may be made to the description of the LWE ciphertext generating process in the above-mentioned key generating method embodiment, which will not be described in detail here.

[0089] Figure 5 FIG. 3 is a block diagram of the internal structure of the acceleration unit 360 of another embodiment of the present application. Figure 5 As shown, the ciphertext denoising unit 363 includes a fusion subunit 3631 and multiple denoising subunits 3632 , and different denoising subunits 3632 obtain different rotation keys from the key generating unit 361 .

[0090] The denoising subunit 3632 may split the first ring learning with errors (RLWE) ciphertext into multiple first sub-items, perform number theory transformations (NTT) on the multiple first sub-items respectively, obtain multiple second sub-items, calculate the outer product of the matrix composed of the multiple second sub-items and the rotation key to obtain the denoising item, perform inverse number theory transformation (INTT) on the denoising item, and obtain the second RLWE ciphertext. Wherein, when the denoising ciphertext is subjected to the first round of denoising, the first RLWE ciphertext is a preset polynomial, and when the denoising ciphertext is subjected to the i-th round of denoising, the first RLWE ciphertext is the second RLWE ciphertext obtained by the denoising subunit 3632 when the denoising ciphertext is subjected to the i-1th round of denoising, and i is a positive integer greater than or equal to 2.

[0091] The fusion subunit 3631 may generate a denoised ciphertext corresponding to the ciphertext to be denoised based on the second RLWE ciphertext obtained by each denoising subunit 3632 after the last round of denoising processing on the ciphertext to be denoised.

[0092] When the ciphertext denoising unit 363 performs denoising on the denoised ciphertext to be denoised, the denoising can be performed in parallel through multiple threads, and each thread performs denoising through a denoising sub-unit 3632. Since multiple rounds of denoising are required when the denoised ciphertext to be denoised are processed, each denoising sub-unit 3632 needs to perform multiple rounds of denoising. The input of the denoising sub-unit 3632 is the first RLWE ciphertext and the rotation key, and the output is the second RLWE ciphertext. In the first round of denoising, the first RLWE ciphertext is a preset polynomial, and in each subsequent round of denoising, the first RLWE ciphertext is the second RLWE ciphertext output by the previous round of denoising.

[0093] Figure 6 FIG. 1 is a schematic diagram of a noise reduction process according to an embodiment of the present application. Figure 6As shown, when the first round of denoising is performed on the denoised ciphertext, the key generation unit 361 generates a rotation key Rot0 based on the read LWE ciphertext LWE and the bootstrap key BSK0, and the denoising subunit 3632 generates a second RLWE ciphertext Ct1 based on the input first RLWE ciphertext Ct0 and the rotation key Rot0. When the second round of denoising is performed on the denoised ciphertext, the key generation unit 361 generates a rotation key Rot1 based on the read LWE ciphertext LWE and the bootstrap key BSK1, and the denoising subunit 3632 generates a second RLWE ciphertext Ct2 based on the input first RLWE ciphertext Ct1 and the rotation key Rot1. When the total number of rounds of denoising for the denoised ciphertext is n, n is a positive integer greater than 2. When the nth round of denoising is performed on the denoised ciphertext, the key generation unit 361 generates a rotation key Rot1 based on the read LWE ciphertext LWE and the bootstrap key BSK1, and the denoising subunit 3632 generates a second RLWE ciphertext Ct2 based on the input first RLWE ciphertext Ct1 and the rotation key Rot1. n-1 Generate Rotation Key n-1 The denoising subunit 3632 is based on the input first RLWE ciphertext Ct n-2 and the rotation key Rot n-1 , generate the second RLWE ciphertext Ct n-1 .

[0094] It should be noted that in Figure 6 In the denoising process shown, the key generation unit 361 uses the same LWE ciphertext in different rounds of denoising, but uses different elements in the LWE ciphertext when generating rotating keys for different rounds of denoising. For example, when generating the rotating key for the first round of denoising, the first element LWE0 in the LWE ciphertext and the bootstrap key BSK0 are used to generate Rot1. When generating the rotating key for the second round of denoising, the second element LWE1 in the LWE ciphertext and the bootstrap key BSK1 are used to generate the rotating key Rot1. When generating the rotating key for the nth round of denoising, the nth element LWE in the LWE ciphertext is used. n-1 and BSK n-1 Generate Rotation Key n-1 .

[0095] Figure 6Only one denoising subunit 3632 is shown to perform denoising. In the process of denoising the ciphertext to be denoised, multiple denoising subunits 3632 perform denoising in parallel, and different denoising subunits 3632 perform denoising according to different LWE ciphertexts and the same bootstrap key. The denoising subunit 3632 performs multiple rounds of denoising on one LWE ciphertext to obtain the denoising result corresponding to the LWE ciphertext (the second RLWE ciphertext obtained by the last round of denoising). When the number of LWE ciphertexts is greater than the number of denoising subunits 3632, it is necessary to perform denoising on the LWE ciphertexts in multiple batches because it is impossible to perform denoising on all LWE ciphertexts simultaneously. After obtaining the denoising results corresponding to all LWE ciphertexts, the fusion subunit 3631 generates the denoised ciphertext corresponding to the ciphertext to be denoised according to the denoising results corresponding to all LWE ciphertexts.

[0096] To perform denoising on the denoised ciphertext, multiple rounds of denoising are usually required. For example, if 500 to 600 rounds of denoising are required, the denoising subunit 3632 needs to read a corresponding number of elements from the LWE ciphertext and perform a round of denoising on each element read.

[0097] When the first round of denoising is performed on the denoised ciphertext, the first RLWE ciphertext input to the denoising subunit 3632 is a preset polynomial.

[0098] like Figure 6 As shown, when the denoising subunit 3632 generates the second RLWE ciphertext based on the first RLWE ciphertext and the rotation key, it splits the first RLWE ciphertext into multiple first sub-items, performs number theoretic transformation (NTT) on each first sub-item to obtain the corresponding second sub-item, calculates the outer product of the matrix composed of each second sub-item and the rotation key to obtain the denoised item, and performs inverse number theoretic transformation (INTT) on the denoised item to obtain the second RLWE ciphertext.

[0099] When splitting the first RLWE ciphertext into multiple first sub-items, the denoising sub-unit 3632 may first convert the remainder coefficient representation into a single modulus Q representation using the China Remainder Theorem (CRT), and then perform polynomial decomposition (Decompose) to obtain multiple first sub-items.

[0100] When the denoising subunit 3632 performs a number-theoretic transformation on the first sub-item, it may perform FFT on the first sub-item. Correspondingly, when performing an inverse number-theoretic transformation on the denoising item, it may perform an inverse fast Fourier transform (IFFT) on the denoising item.

[0101] In an embodiment of the present application, the ciphertext denoising unit 363 includes a fusion subunit 3631 and multiple denoising subunits 3632. The denoising subunit 3632 generates a second RLWE ciphertext based on the first RLWE ciphertext and the rotation key, completing a round of denoising of the ciphertext to be denoised. After the denoising subunit 3632 performs multiple rounds of denoising on the ciphertext to be denoised, the fusion subunit 3631 generates a denoised ciphertext corresponding to the ciphertext to be denoised based on the second RLWE ciphertext obtained by each denoising subunit 3632 at the end of the denoising process, thereby ensuring the efficiency and accuracy of the denoising processing on the ciphertext to be denoised.

[0102] Key Generation Unit

[0103] Figure 7 : is a block diagram of the internal structure of the key generation unit 361 of an embodiment of the present application. Figure 7 As shown, the key generation unit 361 includes: a first reading subunit 3611, a second reading subunit 3612, a fan-in subunit 3613, a fan-out subunit 3614 and a rotation subunit 3615;

[0104] The first reading subunit 3611 is used to read multiple fault-tolerant learning ciphertexts generated according to the ciphertext to be denoised, and send the multiple fault-tolerant learning ciphertexts to the fan-in subunit 3613, where the ciphertext to be denoised is obtained based on the ciphertext output by the fully homomorphic encryption function;

[0105] The second reading subunit 3612 is used to read the bootstrap key according to the number of rounds of denoising the ciphertext to be denoised, and send the bootstrap key to the rotation subunit 3615;

[0106] The fan-in subunit 3613 is used to send the multiple fault-tolerant learning ciphertexts to the rotation subunits respectively;

[0107] The rotation subunit 3615 is used to shift the coefficients of the multiple polynomials included in the bootstrap key according to the multiple fault-tolerant learning ciphertexts, obtain multiple rotated keys, and send the multiple rotated keys to the fan-out subunit 3614;

[0108] The fan-out subunit 3614 is used to output the multiple rotation keys respectively, so as to use the multiple rotation keys to perform denoising on the ciphertext to be denoised.

[0109] Figure 8 FIG. 1 is a schematic diagram of a key generation process according to an embodiment of the present application. Figure 8As shown, the first reading subunit 3611 reads multiple LWE ciphertexts through multiple threads, reads one LWE element from multiple elements included in each LWE ciphertext, and sends the read multiple LWE elements to the fan-in subunit 3613. The fan-in subunit 3613 sends the multiple LWE elements to the rotation subunit 3615 in a fan-in manner. The rotation subunit 3615 generates multiple rotation keys according to each LWE element and the bootstrap key read by the second reading subunit 3612, and sends the generated multiple rotation keys to the fan-out subunit 3614. The fan-out subunit 3614 sends the multiple rotation keys to different noise reduction subunits 3632 in a fan-out manner.

[0110] Figure 8 Taking the first round of denoising for the denoised ciphertext as an example, thread 0 extracts the LWE ciphertext LWE from (0) Read the first element in Thread 1 obtains the LWE ciphertext from LWE (1) Read the first element in Similarly, thread 7 starts from LWE ciphertext LWE (7) Read the first element in The second reading subunit 3612 reads the bootstrap key BSK0 corresponding to the first round of noise reduction processing. The rotation subunit 3615 is based on Generate a rotating key with BSK0 based on Generate a rotating key with BSK0 And so on. Generate a rotating key with BSK0

[0111] It should be noted that Figure 8 The first reading subunit 3611 reads the LWE ciphertext through 8 threads, which does not limit the number of threads for reading the LWE ciphertext. The first reading subunit 3611 can also read the LWE ciphertext in parallel through other numbers of threads, such as reading the LWE ciphertext in parallel through 12, 16 or 32 threads.

[0112] In an embodiment of the present application, the fan-in subunit 3613 sends multiple LWE elements to the rotation subunit 3615 in a fan-in manner, and the rotation subunit 3615 sends the generated multiple rotation keys to the fan-out subunit 3614. The fan-out subunit 3614 outputs the multiple rotation keys separately in a fan-out manner, so that the rotation subunit 3615 can share a bootstrap key when shifting the bootstrap key according to different LWE elements. Therefore, the bootstrap key is read once in each round of noise reduction processing, which reduces the number of times the bootstrap key is read, thereby reducing the storage and bandwidth consumption of the hardware in the ciphertext noise reduction process.

[0113] In a possible implementation, the rotation subunit 3615 may determine the mth element in the LWE ciphertext as the rotation step corresponding to the LWE ciphertext according to the arrangement order of the multiple elements included in the LWE ciphertext, shift the coefficients of the polynomial A(x) included in the bootstrap key according to the rotation step determined from the LWE ciphertext, obtain the shifted polynomial A′(x) corresponding to the polynomial A(x), and determine the matrix including the multiple shifted polynomials corresponding to the multiple polynomials in the bootstrap key as the rotation key corresponding to the LWE ciphertext, wherein,

[0114] A(x)=a0+a1x+a2x 2 +…+a N-1 x N-1

[0115] A′(x)=-a N-n -a N-n+1 x N-n+2 x 2 -…-a N-1 x n-1 +a0x n +a1x n+1 +…+a N-n-1 x N-1

[0116] N is used to represent the number of monomials included in the polynomial A(x), and N is a positive integer greater than or equal to 2; a0, a1, ..., a N-1 The coefficients used to characterize the monomials included in the polynomial A(x), a0, a1, ..., a N-1 are all integers greater than or equal to 0; n is used to represent the rotation step size, and n is a positive integer greater than or equal to 1 and less than N; m is the number of rounds corresponding to the current round of denoising processing performed on the denoised ciphertext to be denoised.

[0117] It should be noted that the process of the key generation unit 361 generating the rotation key can be referred to the description in the above-mentioned key generation method embodiment, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0118] Electronic devices

[0119] Fig. 9 This is a schematic block diagram of an electronic device provided in an embodiment of the present application. The specific embodiment of the present application does not limit the specific implementation of the electronic device. Fig. 9 As shown, the electronic device may include: a processor (processor) 902, a communication interface (Communications Interface) 904, a memory (memory) 906, and a communication bus 908. Among them:

[0120] The processor 902 , the communication interface 904 , and the memory 906 communicate with each other via a communication bus 908 .

[0121] The communication interface 904 is used to communicate with other electronic devices or servers.

[0122] The processor 902 is used to execute the program 910, and specifically can execute the relevant steps in any of the aforementioned key generation method embodiments.

[0123] Specifically, the program 910 may include program codes, which include computer operation instructions.

[0124] The processor 902 may be a CPU, or an application specific integrated circuit ASIC (Application Specific Integrated Circuit), or one or more integrated circuits configured to implement the embodiments of the present application. The one or more processors included in the smart device may be processors of the same type, such as one or more CPUs; or processors of different types, such as one or more CPUs and one or more ASICs.

[0125] RISC-V is an open source instruction set architecture based on the Reduced Instruction Set (RISC) principle. It can be applied to various aspects such as single-chip microcomputers and FPGA chips. Specifically, it can be applied to the fields of IoT security, industrial control, mobile phones, personal computers, etc., and because it is designed with small, fast, and low-power realities in mind, it is particularly suitable for modern computing devices such as warehouse-scale cloud computers, high-end mobile phones, and tiny embedded systems. With the rise of artificial intelligence Internet of Things (AIoT), the RISC-V instruction set architecture has also received more and more attention and support, and is expected to become the next generation of widely used CPU architecture.

[0126] The computer operation instructions in the embodiment of the present application may be computer operation instructions based on the RISC-V instruction set architecture, and correspondingly, the processor 902 may be designed based on the RISC-V instruction set. Specifically, the chip of the processor in the electronic device provided in the embodiment of the present application may be a chip designed with the RISC-V instruction set, and the chip may execute executable code based on the configured instructions, thereby implementing the key generation method in the above embodiment.

[0127] The memory 906 is used to store the program 910. The memory 906 may include a high-speed RAM memory, and may also include a non-volatile memory (non-volatile memory), such as at least one disk memory.

[0128] The program 910 may be specifically used to enable the processor 902 to execute the key generation method in any of the aforementioned embodiments.

[0129] The specific implementation of each step in program 910 can refer to the corresponding description of the corresponding steps and units in any of the aforementioned key generation method embodiments, which will not be repeated here. Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working process of the above-described devices and modules can refer to the corresponding process description in the aforementioned method embodiments, which will not be repeated here.

[0130] Through the electronic device of the embodiment of the present application, when performing noise reduction processing on the denoised ciphertext, it is necessary to generate corresponding rotation keys for different threads. The rotation keys for different threads are generated based on different LWE ciphertexts and the same bootstrap key. Therefore, multiple LWE ciphertexts and one bootstrap key are read, and the same bootstrap key is shared when generating rotation keys for different threads, which reduces the number of times the bootstrap key is read, thereby reducing the storage and bandwidth consumption of hardware in the ciphertext denoising process.

[0131] Computer storage media

[0132] The present application also provides a computer-readable storage medium storing instructions for causing a machine to execute the key generation method as described herein. Specifically, a system or device equipped with a storage medium can be provided, on which a software program code implementing the functions of any of the above embodiments is stored, and a computer (or CPU or MPU) of the system or device is enabled to read and execute the program code stored in the storage medium.

[0133] In this case, the program code read from the storage medium itself can implement the function of any one of the above embodiments, so the program code and the storage medium storing the program code constitute part of the present application.

[0134] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0135] Computer program product

[0136] An embodiment of the present application also provides a computer program product, including computer instructions, which instruct a computing device to perform any corresponding operation in the above-mentioned multiple method embodiments.

[0137] It should be pointed out that, according to the needs of implementation, the various components / steps described in the embodiments of the present application can be split into more components / steps, or two or more components / steps or partial operations of components / steps can be combined into new components / steps to achieve the purpose of the embodiments of the present application.

[0138] The above-mentioned method according to the embodiment of the present application can be implemented in hardware, firmware, or implemented as software or computer code that can be stored in a recording medium (such as a CD ROM, RAM, floppy disk, hard disk or magneto-optical disk), or implemented as a computer code originally stored in a remote recording medium or a non-temporary machine-readable medium downloaded through a network and to be stored in a local recording medium, so that the method described herein can be stored in such software processing on a recording medium using a general-purpose computer, a special-purpose processor or programmable or special-purpose hardware (such as an ASIC or FPGA). It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component (e.g., RAM, ROM, flash memory, etc.) that can store or receive software or computer code, and when the software or computer code is accessed and executed by a computer, a processor or hardware, the method described herein is implemented. In addition, when a general-purpose computer accesses the code for implementing the method shown here, the execution of the code converts the general-purpose computer into a special-purpose computer for executing the method shown here.

[0139] It should be noted that the user-related information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to sample data used to train the model, data used for analysis, stored data, displayed data, etc.) involved in the embodiments of the present disclosure are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions, and provide corresponding operation entrances for users to choose to authorize or refuse.

[0140] It should be understood that the various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other, and the embodiments focus on the differences from other embodiments. In particular, for the method embodiment, since it is basically similar to the method described in the device and system embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of other embodiments.

[0141] It should be understood that the above is a description of a specific embodiment of the present specification. Other embodiments are within the scope of the claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0142] It should be understood that an element described in singular form herein or shown in the drawings as only one does not limit the number of the element to one. In addition, modules or elements described or shown as separate herein may be combined into a single module or element, and modules or elements described or shown as single herein may be split into multiple modules or elements.

[0143] It should also be understood that the terms and expressions used herein are for description only, and one or more embodiments of this specification should not be limited to these terms and expressions. The use of these terms and expressions does not mean to exclude any equivalent features of the illustrations and descriptions (or parts thereof), and it should be recognized that various modifications that may exist should also be included in the scope of the claims. Other modifications, changes and substitutions may also exist. Accordingly, the claims should be deemed to cover all such equivalents.

Claims

1. A key generation method for generating a rotation key required for denoising a ciphertext to be denoised, the method comprising: Reading a plurality of fault-tolerant learning ciphertexts generated according to the ciphertext to be denoised, wherein the ciphertext to be denoised is obtained based on the ciphertext output by the fully homomorphic encryption function; Reading a bootstrap key according to the number of rounds of denoising the ciphertext to be denoised; According to the multiple fault-tolerant learning ciphertexts, respectively shifting coefficients of multiple polynomials included in the bootstrap key to obtain multiple rotation keys; The multiple rotation keys are outputted respectively, so as to use the multiple rotation keys to perform denoising processing on the ciphertext to be denoised.

2. The method according to claim 1, further comprising: Obtaining a first polynomial and a second polynomial included in the ciphertext to be denoised; Obtaining first coefficients of a plurality of monomials included in the first polynomial, and obtaining second coefficients of a plurality of monomials included in the second polynomial; A plurality of the fault-tolerant learning ciphertexts are generated according to the first coefficient and the second coefficient, wherein the fault-tolerant learning ciphertexts include at least one of the second coefficients.

3. The method according to claim 2, wherein: The step of generating a plurality of the fault-tolerant learning ciphertexts according to the first coefficient and the second coefficient comprises: Sorting each of the first coefficients multiple times in a cyclically decreasing order of the number of times of the corresponding monomials to obtain M coefficient sequences, where M is the number of monomials included in the first polynomial; According to the order of the first coefficients in the coefficient sequence, the coefficient sequence is combined with the corresponding second coefficients, and the positive and negative properties of the first coefficients in the obtained combined sequence are set, and the combined sequence after setting the positive and negative properties of the included first coefficients is determined as the fault-tolerant learning ciphertext.

4. The method according to any one of claims 1 to 3, wherein: The step of shifting coefficients of multiple polynomials included in the bootstrap key according to the multiple fault-tolerant learning ciphertexts to obtain multiple rotation keys includes: Determining a rotation step length from elements included in the fault-tolerant learning ciphertext according to the number of rounds of denoising processing performed on the ciphertext to be denoised; According to the rotation step determined from the fault-tolerant learning ciphertext, the coefficients of the multiple polynomials included in the bootstrap key are shifted to obtain the rotation key corresponding to the fault-tolerant learning ciphertext.

5. The method according to claim 4, wherein: The step of determining the rotation step from the elements included in the fault-tolerant learning ciphertext according to the number of rounds of denoising the ciphertext to be denoised comprises: According to the arrangement order of multiple elements included in the fault-tolerant learning ciphertext, the mth element in the fault-tolerant learning ciphertext is determined as the rotation step corresponding to the current round of denoising processing, wherein m is the number of rounds corresponding to the current round of denoising processing performed on the ciphertext to be denoised.

6. The method according to claim 4, wherein: The step of shifting the coefficients of the multiple polynomials included in the bootstrap key according to the rotation step determined from the fault-tolerant learning ciphertext to obtain the rotation key corresponding to the fault-tolerant learning ciphertext includes: According to the rotation step determined from the fault-tolerant learning ciphertext, the coefficients of the polynomial A(x) included in the bootstrap key are shifted to obtain the shifted polynomial A corresponding to the polynomial A(x) ′ (x), determining a matrix including a plurality of shifted polynomials corresponding to a plurality of polynomials in the bootstrap key as a rotation key corresponding to the fault-tolerant learning ciphertext, wherein: A(x)=a0+a1x+a2x 2 +…+a N-1 x N-1 A ′ (x) = -a N-n -a N-n+1 x N-n+2 x 2 -…-a N-1 xn -1 +a0xn+a1xn +1 +…+a N-n-1 x N-1 N is used to represent the number of monomials included in the polynomial A(x), and N is a positive integer greater than or equal to 2; a0, a1, ..., a N-1 The coefficients used to characterize the monomials included in the polynomial A(x), a0, a1, ..., a N-1 are all integers greater than or equal to 0; n is used to characterize the rotation step, and n is a positive integer greater than or equal to 1 and less than N.

7. A key generation unit, used to generate a rotation key required for denoising a ciphertext to be denoised, the key generation unit comprising: a first reading subunit, a second reading subunit, a fan-in subunit, a fan-out subunit, and a rotation subunit; The first reading subunit is used to read a plurality of fault-tolerant learning ciphertexts generated according to the ciphertext to be denoised, and send the plurality of fault-tolerant learning ciphertexts to the fan-in subunit, wherein the ciphertext to be denoised is obtained based on the ciphertext output by the fully homomorphic encryption function; The second reading subunit is used to read the bootstrap key according to the number of rounds of denoising the ciphertext to be denoised, and send the bootstrap key to the rotation subunit; A fan-in subunit, used to send the multiple fault-tolerant learning ciphertexts to the rotation subunit respectively; The rotation subunit is used to shift the coefficients of the multiple polynomials included in the bootstrap key respectively according to the multiple fault-tolerant learning ciphertexts to obtain multiple rotation keys, and send the multiple rotation keys to the fan-out subunit; The fan-out subunit is used to output the multiple rotation keys respectively, so as to use the multiple rotation keys to perform denoising on the ciphertext to be denoised.

8. The key generation unit according to claim 7, wherein: The rotation subunit is used to determine the mth element in the fault-tolerant learning ciphertext as the rotation step corresponding to the fault-tolerant learning ciphertext according to the arrangement order of the multiple elements included in the fault-tolerant learning ciphertext, and shift the coefficients of the polynomial A(x) included in the bootstrap key according to the rotation step determined from the fault-tolerant learning ciphertext to obtain the shifted polynomial A corresponding to the polynomial A(x). ′ (x), determining a matrix including a plurality of shifted polynomials corresponding to a plurality of polynomials in the bootstrap key as a rotation key corresponding to the fault-tolerant learning ciphertext, wherein: A(x)=a0+a1x+a2x 2 +…+a N-1 x N-1 A ′ (x) = -a N-n -a N-n+1 x N-n+2 x 2 -…-a N-1 xn -1 +a0xn+a1xn +1 +…+a N-n-1 x N-1 N is used to represent the number of monomials included in the polynomial A(x), and N is a positive integer greater than or equal to 2; a0, a1, ..., a N-1 The coefficients used to characterize the monomials included in the polynomial A(x), a0, a1, ..., a N-1 are all integers greater than or equal to 0; n is used to represent the rotation step, and n is a positive integer greater than or equal to 1 and less than N; m is the number of rounds corresponding to the current round of denoising processing performed on the ciphertext to be denoised.

9. An acceleration unit, comprising: The key generation unit as claimed in any one of claims 7 to 8; A ciphertext generation unit, configured to generate a plurality of fault-tolerant learning ciphertexts according to the ciphertext to be denoised, and send the plurality of fault-tolerant learning ciphertexts to the key generation unit, wherein the ciphertext to be denoised is obtained based on the ciphertext output by the fully homomorphic encryption function; The ciphertext denoising unit is used to receive the multiple rotation keys output by the key generating unit, and perform denoising processing on the ciphertext to be denoised according to the multiple rotation keys.

10. The acceleration unit according to claim 9, wherein: The ciphertext generation unit is used to obtain the first coefficients of multiple monomials included in the first polynomial in the ciphertext to be denoised, and obtain the second coefficients of multiple monomials included in the second polynomial in the ciphertext to be denoised, and sort each of the first coefficients multiple times in the order of cyclically decreasing numbers of the corresponding monomials to obtain M coefficient sequences, where M is the number of monomials included in the first polynomial, and combine the coefficient sequence with the corresponding second coefficient according to the order of the first coefficients in the coefficient sequence, and set the positive and negative of the first coefficient in the obtained combined sequence, and determine the combined sequence after setting the positive and negative of the included first coefficients as the fault-tolerant learning ciphertext, and the fault-tolerant learning ciphertext includes at least one second coefficient.

11. The acceleration unit according to claim 9, wherein: The ciphertext denoising unit comprises: a fusion subunit and a plurality of denoising subunits, and different denoising subunits obtain different rotation keys; The denoising subunit is used to split the first on-ring fault-tolerant learning ciphertext into multiple first sub-items, perform number theory transformation on the multiple first sub-items respectively to obtain multiple second sub-items, calculate the outer product of the matrix composed of the multiple second sub-items and the rotation key to obtain the denoising item, perform inverse number theory transformation on the denoising item to obtain the second on-ring fault-tolerant learning ciphertext, wherein, when the denoising ciphertext to be denoised is subjected to the first round of denoising, the first on-ring fault-tolerant learning ciphertext is a preset polynomial, and when the denoising ciphertext to be denoised is subjected to the i-th round of denoising, the first on-ring fault-tolerant learning ciphertext is the second on-ring fault-tolerant learning ciphertext obtained by the denoising subunit when the denoising ciphertext to be denoised is subjected to the i-1th round of denoising, and i is a positive integer greater than or equal to 2; The fusion subunit is used to generate a denoised ciphertext corresponding to the ciphertext to be denoised based on the second on-ring fault-tolerant learning ciphertext obtained by each of the denoising subunits after the last round of denoising processing is performed on the ciphertext to be denoised.

12. An electronic device comprising: A processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface communicate with each other via the communication bus; The memory is used to store at least one executable instruction, and the executable instruction enables the processor to execute an operation corresponding to any one of the methods in claims 1-8.

13. A computer storage medium having a computer program stored thereon, which, when executed by a processor, implements the method according to any one of claims 1 to 8.

14. A computer program product comprising computer instructions, the computer instructions instructing a computing device to execute the method according to any one of claims 1 to 8.

Images