Fully homomorphic encryption and decryption method and computing device

Abstract

The embodiment of the invention discloses a fully homomorphic encryption and decryption method and a computing device, which are used for performing global programmable bootstrap on a ciphertext, support global linear operation and expand the application range. The fully homomorphic encryption and decryption method comprises the following steps: after selecting a noise value from Gaussian distribution, encoding a message into encoded data by using a plaintext modulus and the noise value, encrypting the encoded data into an LWE ciphertext by using a random vector and a private key, and sending the LWE ciphertext, a bootstrap key and a data processing request to a second computing device, and after the second computing device performs homomorphic operation on the LWE ciphertext according to the data processing request, the first computing device receives a homomorphic operation result sent by the second computing device and decrypts the homomorphic operation result according to the private key.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of cryptography, and in particular to a fully homomorphic encryption and decryption method and computing device. Background Art

[0002] Homomorphic encryption refers to the use of functions and ciphertext operations to obtain homomorphic operation results. The result obtained by decrypting the homomorphic operation result is the same as the result obtained by using the function to calculate the plaintext. Since ciphertext calculations can be completed in an untrusted environment, it has good security. Fully homomorphic encryption refers to an encryption method that satisfies both additive homomorphism and multiplicative homomorphism.

[0003] At present, there is a fully homomorphic encryption method that is roughly as follows: the message value is recorded as m, the noise value is recorded as e, and the message sender follows The message value and the noise value are encoded into encoded data, and after the encoded data is encrypted into a learning with errors (LWE) ciphertext, the LWE ciphertext is sent to the homomorphic computing device. The message receiving end uses a test polynomial to perform programmable bootstrapping on the LWE ciphertext. The test polynomial has N coefficients, and the N coefficients can be used to implement a lookup table function to ensure that the test polynomial is correct in Z. N Correctness within the scope.

[0004] However, when When the coded data is greater than N, the correct result may not be found according to the test polynomial. Therefore, the value range of m in the above method is To ensure the correctness of the bootstrap result, the noise is located in the low position of the encoded data, the message value is located in the high position of the encoded data, and the highest position of the message value is 0, such as Figure 1 shown. Summary of the invention

[0005] The embodiments of the present application provide a fully homomorphic encryption and decryption method and computing device, which can obtain encoded data including high-bit noise and low-bit messages, perform global programmable bootstrapping on the LWE ciphertext corresponding to the encoded data, support linear operations in the modular sense, and therefore have a wider range of applications.

[0006] A first aspect provides a fully homomorphic encryption and decryption method, the method comprising: after selecting a noise value from a Gaussian distribution, using a plaintext modulus and the noise value to encode a message into encoded data, then obtaining a random vector, a private key and a bootstrap key, using the random vector and the private key to encrypt the encoded data into an LWE ciphertext, sending at least one LWE ciphertext, the bootstrap key and a data processing request to a second computing device, after the second computing device performs a homomorphic operation on the at least one LWE ciphertext according to the data processing request, the first computing device receives the homomorphic operation result sent by the second computing device, and decrypts the homomorphic operation result according to the private key.

[0007] Since the coded data is equal to the sum of the product of the plaintext modulus and the noise value and the message value, and the message value is less than the plaintext modulus, the message is in the low bit of the coded data, and the multiple of the noise value is in the high bit of the coded data. During programmable bootstrapping, the message value of mod t can make the coded data range as follows: This expands the range of message values, and uses a test polynomial with N coefficients to perform global programmable bootstrapping on the LWE ciphertext corresponding to the encoded data, so it has a wider range of applicability.

[0008] In a first possible implementation of the first aspect, encrypting the encoded data into an LWE ciphertext using a random vector and a private key includes: calculating the inner product of the private key and the random vector, subtracting the inner product from the encoded data to obtain a parameter value to be modulo-operated; performing a modulo operation on the ciphertext modulus using the parameter value to be modulo-operated; and combining the random vector and the first parameter value obtained by the modulo-operation into an LWE ciphertext. The LWE ciphertext has good security, and a receiver of the LWE ciphertext cannot recognize a message corresponding to the LWE ciphertext.

[0009] In a second possible implementation of the first aspect, decrypting the homomorphic operation result according to the private key and the plaintext modulus includes: adding the inner product of the private key and the target vector to the second parameter value; performing a modulus operation on the ciphertext modulus using the addition operation result; and performing a modulus operation on the plaintext modulus using the modulus operation result. The homomorphic operation result includes the target vector and the second parameter value. According to this implementation, the data obtained by decrypting the homomorphic operation result is the same as the result obtained by performing a data operation corresponding to the data processing request on the message.

[0010] In another possible implementation of the first aspect, the fully homomorphic encryption and decryption method of the present application further includes: RGSW encrypting the private key to obtain a bootstrap key, thereby providing a bootstrap key that can be used for programmable bootstrapping.

[0011] In another possible implementation manner of the first aspect, the element value of the private key belongs to {0,1}.

[0012] In another possible implementation manner of the first aspect, the element value of the private key belongs to {-1, 0, 1}.

[0013] The second aspect provides a fully homomorphic encryption and decryption method, the method comprising: after receiving at least one LWE ciphertext, a bootstrap key and a data processing request sent by a first computing device, determining a homomorphic operation rule according to the data processing request; in the case where the homomorphic operation rule includes a univariate nonlinear function, determining the LWE ciphertext to be bootstrapped according to at least one LWE ciphertext and a univariate nonlinear function, determining a test polynomial according to the univariate nonlinear function, and then generating an RLWE ciphertext according to the test polynomial, the bootstrap key and the LWE ciphertext to be bootstrapped, generating a bootstrapped LWE ciphertext according to the RLWE ciphertext, determining a homomorphic operation result according to the homomorphic operation rule and the bootstrapped LWE ciphertext, and then sending the homomorphic operation result to the first computing device. Among them, the test polynomial includes N coefficients. Since the test polynomial includes N coefficients, the test polynomial can be used to perform full-domain programmable bootstrapping on the LWE ciphertext, supporting linear operations in the modular sense, and therefore has a wider range of application.

[0014] According to this implementation, the LWE ciphertext received by the second computing device or the LWE ciphertext obtained by homomorphic operation can be programmably bootstrapped to realize homomorphic operation of a unary nonlinear function, and the noise can be reduced, so that after the bootstrapped LWE ciphertext is homomorphically operated according to other rules, there will be no homomorphic operation errors due to excessive noise. It should be noted that in addition to the homomorphic operation of a unary nonlinear function, the homomorphic operation rules can also include linear operation rules, and multiple LWE ciphertexts can be homomorphically added based on the linear operation rules. When the homomorphic operation rules include linear operation rules and unary nonlinear functions, various complex operations can be realized.

[0015] In a possible implementation of the second aspect, the LWE ciphertext to be bootstrapped is selected from at least one LWE ciphertext according to an independent variable of the unary nonlinear function, so that all or part of the LWE ciphertext sent by the first computing device can be programmably bootstrapped.

[0016] In another possible implementation of the second aspect, determining the LWE ciphertext to be bootstrapped according to at least one LWE ciphertext and a unary nonlinear function includes: selecting an LWE ciphertext from at least one LWE ciphertext according to a linear operation rule; performing a linear operation on the selected LWE ciphertext according to the linear operation rule; and when a linear operation result of the selected LWE ciphertext is input data of the unary nonlinear function, using the linear operation result as the LWE ciphertext to be bootstrapped. In this way, the linear operation results of one or more LWE ciphertexts can be programmably bootstrapped.

[0017] In another possible implementation manner of the second aspect, the univariate nonlinear function and the test polynomial satisfy the following formula:

[0018]

[0019] Among them, testp is the test polynomial and f() is a univariate nonlinear function.

[0020] In another possible implementation manner of the second aspect, generating a bootstrapped LWE ciphertext based on the RLWE ciphertext includes: extracting an LWE ciphertext sample from the RLWE ciphertext; performing a key conversion on the LWE ciphertext sample; and performing a modulus-to-digital conversion on the key conversion result to obtain the bootstrapped LWE ciphertext.

[0021] In another possible implementation of the second aspect, blindly rotating the LWE ciphertext to be bootstrapped according to the test polynomial and the bootstrap key includes steps A to F, wherein step A includes: setting a first variable of a variable group of an accumulator to 0, setting a second variable of the variable group of the accumulator to X b ” and the product of the test polynomial, step B includes: setting i equal to 0; step C includes: judging whether i is less than n, executing step D when i is less than n, and executing step F when i is equal to n; step D includes: calculating the variable group of the accumulator, the vector to be processed and the bootstrap key according to the formula corresponding to the bootstrap key, and updating the variable group of the accumulator to the calculation result; step E includes: after calculating i+1, updating i to i+1, and jumping to step C; step F includes: determining that the RLWE ciphertext is the variable group of the accumulator. Among them, the LWE ciphertext to be bootstrapped includes the vector to be processed and the parameter value to be processed, and b" is the parameter value to be processed. This provides a specific and feasible blind rotation method.

[0022] In another possible implementation manner of the second aspect, the bootstrap key includes n elements, and the formula corresponding to the bootstrap key is: acc is the variable group of the accumulator, a i " is the i-th element of the vector to be processed, bsk i is the i-th element of the bootstrap key.

[0023] In another possible implementation manner of the second aspect, the bootstrap key includes a first subkey and a second subkey, and the formula corresponding to the bootstrap key is: acc is the variable group of the accumulator, a i " is the i-th element of the vector to be processed, bsk i,0 is the i-th element of the first subkey, bsk i,1 is the i-th element of the second subkey.

[0024] The third aspect provides a computing device. Specifically, the computing device includes a module or unit for executing the method in the above-mentioned first aspect or any possible implementation of the first aspect, such as a receiving module, a sending module, an encryption module, a decryption module or a key module.

[0025] A fourth aspect provides a computing device for executing the method in the second aspect or any possible implementation of the second aspect. Specifically, the computing device includes a module or unit for executing the method in the second aspect or any possible implementation of the second aspect, such as a receiving module, a homomorphic operation module, or a sending module.

[0026] The fifth aspect provides a computing device, which includes a processor and a memory, the memory is used to store programs; the processor is used to implement the method of the first aspect or the second aspect by executing the program.

[0027] The sixth aspect provides a computing device cluster, which includes at least one computing device, each computing device includes a processor and a memory, and the processor of at least one computing device is used to execute instructions stored in the memory of at least one computing device, so that the computing device cluster executes the method of the first aspect or the second aspect.

[0028] A seventh aspect provides a computer-readable storage medium, in which instructions are stored. When the computer program instructions are executed on a computing device, the computing device executes the methods of the above aspects.

[0029] An eighth aspect provides a computer program product comprising instructions. When the instructions are executed on a computing device, the computing device executes the methods of the above aspects. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A schematic diagram of encoding data in the prior art;

[0031] Figure 2 A schematic diagram of fully homomorphic encryption and fully homomorphic decryption in an embodiment of the present application;

[0032] Figure 3 A structural diagram of a computing device in an embodiment of the present application;

[0033] Figure 4 Another structural diagram of a computing device in an embodiment of the present application;

[0034] Figure 5 A flowchart of the fully homomorphic encryption and decryption method in an embodiment of the present application;

[0035] Figure 6 A flowchart of blind rotation in an embodiment of the present application;

[0036] Figure 7 Another flowchart of blind rotation in an embodiment of the present application;

[0037] Figure 8 A structural diagram of a computing device in an embodiment of the present application;

[0038] Fig. 9 A structural diagram of a computing device cluster in an embodiment of the present application;

[0039] Fig.10 Another structural diagram of a computing device cluster in an embodiment of the present application;

[0040] Fig.11 This is another structural diagram of a computing device cluster in an embodiment of the present application. DETAILED DESCRIPTION

[0041] First, let’s introduce the professional terms of this application:

[0042] 1. The LWE encryption and decryption process includes:

[0043] Step 101: Use noise and plaintext modulus to low-order encode the message.

[0044] The encoded data is recorded as LSB_Encode(m), LSB_Encode(m)=m+te. The noise value e is taken from a Gaussian distribution with a standard deviation of σ.

[0045] Step 102: Obtain a random vector a, and encrypt the encoded data using the random vector a and the private key s.

[0046] b=-<a,s> +LSB_Encode(m)=-<a,s> +m+te.<a,s> represents the inner product of random vector a and private key s. Both random vector a and private key s are n-dimensional vectors.

[0047] LWE s (m)=(a,b)mod q,LWE s (m) represents the LWE ciphertext of message m under private key s.

[0048] Step 103: decrypt the encrypted ciphertext according to the random vector a, the private key s and the first parameter value b.

[0049] b+<a,s> =LSB_Encode(m)=m+te.

[0050] Step 104: Decode the decrypted data to obtain a message.

[0051] The message value m satisfies m=(m+te)mod t.

[0052] 2. The encryption and decryption process of ring learning with errors (RLWE) includes:

[0053] Step 201: Use the noise polynomial and the plaintext modulus to low-order encode the message polynomial.

[0054] The encoded data is recorded as LSB_Encode(m'), LSB_Encode(m') = m' + te'. The coefficients of the noise polynomial e' are taken from a Gaussian distribution with a standard deviation of σ. LSB_Encode(m')∈R Q , R Q =Z Q / (X N +1).

[0055] Step 202: From the polynomial ring R Q Randomly select polynomial a R , using the polynomial a R and private keys R Encrypt the encoded data.

[0056] Private Keys R Taken from the ternary distribution {-1,0,1} / (X N +1) or binary distribution {0,1} / (X N +1).

[0057] Represents the message polynomial m' in the private key s R The RLWE ciphertext under

[0058] Step 203: Decrypt the encrypted ciphertext according to the random vector a, the private key s and the vector b.

[0059] b R +a R s R =LSB_Encode(m')=(m'+te')mod R Q .

[0060] Step 204: Decode the decrypted data to obtain a message. The message m satisfies m=(m+te)mod t.

[0061] 3. RLWE ciphertext is the ciphertext obtained by RGSW encrypting the message using the private key. s (m)=(ct 0 ||...||ct 2l-1 )+mG, RGSW s(m) is the ciphertext obtained by RGSW-encrypting message m using private key s. The full name of GSW is gentry sahai waters, which is a fully homomorphic encryption scheme. RGSW can be called ring GSW, which is an optimization scheme of GSW.

[0062] The gadget matrix is ​​denoted as G, then I n represents the identity matrix, Represents the tensor product. g T is the transposed matrix of g, Gadget vector g=(1,B,...,B l-1 ). s (0) is the ciphertext of 0 under RLWE, ct i ∈RLWE s (0), || indicates column cascading.

[0063] 4. ⊙ is the outer product operator, also called external product. RLWE s (m1)⊙RGSW s (m2) = RLWE s (m1*m2).RLWE s (m1) represents the ciphertext obtained by RLWE encryption of message m1 using private key s. s (m2) represents the ciphertext obtained by RGSW-encrypting message m2 using private key s. s (m1*m2) represents the ciphertext obtained by RLWE-encrypting m1*m2 using the private key s.

[0064] 5. RLWE ciphertext sampling refers to extracting an LWE ciphertext from an RLWE ciphertext. The LWE ciphertext can be recorded as The message encrypted using this LWE ciphertext is a constant term of the RLWE encrypted plaintext polynomial.

[0065]

[0066] LWE φ(s) (m 0 )=(a 0 ,-a N-1 ,-a N-2 ,...,-a 1 ,b 0 ).

[0067] φ(s)=(s 0 ,s 1 ,...,s N-1 ).

[0068] s=s 0 +s1 X+…+s N-1 X N-1 .

[0069] 6. The key conversion of this application refers to the conversion of ciphertexts encrypted by different private keys.

[0070] The private key before conversion is denoted as s', s'∈Z N The converted private key is denoted as s, s∈Z n .Conversion Key Among them, i∈{1,...,N}, j∈{0,...,l ks -1},v∈{0,...,B ks}.

[0071] According to vector a and basis B ks Get target data

[0072] ct'=(0,b)-∑ i,j ksk i,j,v a i,j .

[0073] 7. The modulus conversion of this application refers to converting a ciphertext with a large modulus into a ciphertext with a small modulus while keeping the encrypted message unchanged.

[0074] For Q>q>t,Q≡1mod t,q≡1mod t. Input the ciphertext ct,ct=(a,b)mod Q, and convert its modulus to ct', Among them, ct i ' is the closest An integer, and ct i '≡ct i mod t, i∈[0,1].

[0075] An embodiment of the present application provides a fully homomorphic encryption and decryption method for use in cloud computing scenarios, artificial intelligence (AI) scenarios based on fully homomorphic encryption, data retrieval scenarios, or privacy computing scenarios.

[0076] like Figure 2 As shown, in a cloud computing scenario, the terminal 21 obtains d user data (ie, m 1 ,m 2 ,...,m d ), user data may include but is not limited to messages, user identity information and medical data. 1 ,m 2 ,...,m d Encrypted to c 1 ,c2 ,...,c d , then terminal 21 will c 1 ,c 2 ,...,c d The encrypted user data is sent to the cloud server 22, and the cloud server 22 can store the encrypted user data in the cloud server 22. After the cloud server 22 receives the data processing request sent by the terminal 21, the cloud server 22 will c 1 ,c 2 ,...,c d Perform homomorphic operations, and then convert the homomorphic operation result c f Send to terminal 21, terminal 21 will c f Decrypted to f(m 1 ,m 2 ,...,m d ).

[0077] The operation corresponding to function f can be query, retrieval or calculation. For example, the user sends a query request to the cloud server 22 through the terminal 21. The cloud server 22 performs homomorphic operations on the homomorphically encrypted user data according to the query request, and sends the homomorphic operation results in ciphertext to the terminal 21. The terminal 21 performs the corresponding homomorphic decryption on the operation results to obtain the query results. Since the user data stored in the cloud server 22 are all ciphertext, the fully homomorphic encryption and decryption method can provide good security.

[0078] Artificial intelligence scenarios include machine learning scenarios, deep learning scenarios or reinforcement learning scenarios. When training models in artificial intelligence scenarios, convolutional layers, pooling layers and connection layers need to perform linear or nonlinear operations. The present application can encrypt the original data into training data, and the training device performs linear operations or programmable bootstrapping on the encrypted data, and implements nonlinear operations through programmable bootstrapping to obtain encrypted model operation results, thereby ensuring the security of the original data.

[0079] The private data involved in privacy computing includes but is not limited to financial data, corporate confidential data, government data or medical data. After encrypting the private data, perform homomorphic operations on the encrypted data, and decrypt the homomorphic operation results to obtain the private computing results, thereby effectively protecting privacy.

[0080] The computing device of the present application is introduced below. Figure 3 In one embodiment, the computing device 300 includes an encryption module 301 , a sending module 302 , a receiving module 303 , a decryption module 304 and a key module 305 .

[0081] The encryption module 301 is used to select a noise value from a Gaussian distribution; encode a message into encoded data using a plaintext modulus and the noise value; obtain a random vector, a private key, and a bootstrap key; and encrypt the encoded data into an LWE ciphertext using the random vector and the private key;

[0082] The sending module 302 is used to send the bootstrap key and at least one LWE ciphertext to the second computing device;

[0083] The sending module 302 is also used to send the data processing request to the second computing device;

[0084] The receiving module 303 is used to receive the homomorphic operation result sent by the second computing device;

[0085] The decryption module 304 is used to decrypt the homomorphic operation result according to the private key.

[0086] In another optional embodiment, the encryption module 301 is specifically used to calculate the inner product of the private key and the random vector; subtract the inner product from the encoded data to obtain the parameter value to be modulo; perform a modulo operation on the ciphertext modulus of the parameter value to be modulo; and combine the random vector and the first parameter value obtained by the modulo operation into an LWE ciphertext.

[0087] In another optional embodiment, the decryption module 304 is specifically used to add the inner product of the private key and the target vector to the second parameter value, perform a modulus operation on the ciphertext modulus on the addition result; and perform a modulus operation on the plaintext modulus on the modulus operation result.

[0088] In another optional embodiment, the key module 305 is used to perform RGSW encryption on the private key to obtain the bootstrap key. Optionally, the key module 305 is specifically used to obtain the gadget matrix and the RLWE ciphertext matrix, the RLWE ciphertext matrix is ​​obtained by cascading a preset number of RLWE ciphertext columns to be processed, and the RLWE ciphertext to be processed is obtained by performing RLWE encryption on 0 using the key; and the bootstrap key is calculated using the private key, the gadget matrix and the RLWE ciphertext matrix.

[0089] As an example of a software functional unit, the encryption module 301 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Further, the above-mentioned computing instance may be one or more. For example, the encryption module 301 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple data centers with similar geographical locations. Among them, usually a region may include multiple AZs.

[0090] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0091] As an example of a hardware functional unit, the encryption module 301 may include at least one computing device, such as a server, etc. Alternatively, the encryption module 301 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof.

[0092] The multiple computing devices included in the encryption module 301 can be distributed in the same region or in different regions. The multiple computing devices included in the encryption module 301 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the encryption module 301 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0093] It should be noted that, in other embodiments, the encryption module 301 may be used to execute Figure 5 In any step of the fully homomorphic encryption and decryption method in the embodiment shown, the sending module 302 can be used to perform Figure 5 In any step of the method for fully homomorphic encryption and decryption in the embodiment shown, the receiving module 303 can be used to perform Figure 5 In any step of the method for fully homomorphic encryption and decryption in the embodiment shown, the decryption module 304 can be used to perform Figure 5 In any step of the method for fully homomorphic encryption and decryption in the embodiment shown, the key module 305 can be used to perform Figure 5 In the embodiment shown, any step in the method of fully homomorphic encryption and decryption, the steps that each module is responsible for implementing can be specified as needed, and all functions of the first computing device are realized by each module implementing different steps in the method of fully homomorphic encryption and decryption. The key module 305 is an optional module.

[0094] See also Figure 4 In one embodiment, the computing device 400 includes a receiving module 401, a homomorphic operation module 402, and a sending module 403. The receiving module 401 is used to receive at least one LWE ciphertext and a bootstrap key sent by the first computing device; the receiving module 401 is also used to receive a data processing request sent by the first computing device; the homomorphic operation module 402 is used to determine a homomorphic operation rule according to the data processing request, and when the homomorphic operation rule includes a univariate nonlinear function, determine the LWE ciphertext to be bootstrapped according to at least one LWE ciphertext and the univariate nonlinear function; determine a test polynomial according to the univariate nonlinear function; generate an RLWE ciphertext according to the test polynomial, the bootstrap key, and the LWE ciphertext to be bootstrapped; generate a bootstrapped LWE ciphertext according to the RLWE ciphertext; determine a homomorphic operation result according to the homomorphic operation rule and the bootstrapped LWE ciphertext; and the sending module 403 is used to send the homomorphic operation result to the first computing device.

[0095] In an optional embodiment, the homomorphic operation module 402 is specifically configured to select the LWE ciphertext to be bootstrapped from at least one LWE ciphertext according to an independent variable of the unary nonlinear function.

[0096] In another optional embodiment, the homomorphic operation module 402 is specifically used to select an LWE ciphertext from at least one LWE ciphertext according to a linear operation rule; perform a linear operation on the selected LWE ciphertext according to the linear operation rule; and when the linear operation result of the selected LWE ciphertext is input data of a unary nonlinear function, use the linear operation result of the selected LWE ciphertext as the LWE ciphertext to be bootstrapped.

[0097] In another optional embodiment, the homomorphic operation module is specifically used to extract LWE ciphertext samples from RLWE ciphertext; perform key conversion on the LWE ciphertext samples; and perform analog-to-digital conversion on the key conversion result to obtain the bootstrapped LWE ciphertext.

[0098] In another optional embodiment, the homomorphic operation module 402 is specifically used to perform steps A to F. Steps A to F can be found in Figure 5 The corresponding description in the illustrated embodiment.

[0099] As an example of a software functional unit, the homomorphic operation module 402 may include code running on a computing instance. Among them, the computing instance may include at least one of a physical host (computing device), a virtual machine, and a container. Furthermore, the above-mentioned computing instance may be one or more. For example, the homomorphic operation module 402 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region (region) or in different regions. Furthermore, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one data center or multiple data centers with close geographical locations. Among them, usually a region may include multiple AZs.

[0100] Similarly, multiple hosts / virtual machines / containers used to run the code can be distributed in the same virtual private cloud (VPC) or in multiple VPCs. Usually, a VPC is set up in a region. For cross-region communication between two VPCs in the same region and between VPCs in different regions, a communication gateway needs to be set up in each VPC to achieve interconnection between VPCs through the communication gateway.

[0101] As an example of a hardware functional unit, the homomorphic operation module 402 may include at least one computing device, such as a server, etc. Alternatively, the homomorphic operation module 402 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.

[0102] The multiple computing devices included in the homomorphic operation module 402 can be distributed in the same region or in different regions. The multiple computing devices included in the homomorphic operation module 402 can be distributed in the same AZ or in different AZs. Similarly, the multiple computing devices included in the homomorphic operation module 402 can be distributed in the same VPC or in multiple VPCs. The multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0103] It should be noted that, in other embodiments, the homomorphic operation module 402 can be used to execute Figure 5 In any step of the fully homomorphic encryption and decryption method in the embodiment shown, the receiving module 401 can be used to perform Figure 5 In any step of the method for fully homomorphic encryption and decryption in the embodiment shown, the sending module 403 can be used to perform Figure 5 For any step in the method of fully homomorphic encryption and decryption in the illustrated embodiment, the steps that each module is responsible for implementing can be specified as needed, and all functions of the second computing device can be realized by each module implementing different steps in the method of fully homomorphic encryption and decryption respectively.

[0104] Combine the following Figure 5 For an introduction to the fully homomorphic encryption and decryption method of this application, see Figure 5 , an embodiment of the fully homomorphic encryption and decryption method of the present application includes:

[0105] Step 501: A first calculation device selects a noise value from a Gaussian distribution.

[0106] When the standard deviation of the Gaussian distribution is greater than or equal to 3.2, the noise value in the Gaussian distribution is used for fully homomorphic encryption, which has good security. For Gaussian distributions with standard deviations <3.2 and Gaussian distributions with standard deviations ≥3.2, the security of encryption using the noise value of the former Gaussian distribution is lower than the security of encryption using the noise value of the latter Gaussian distribution.

[0107] Step 502: The first computing device encodes the message into encoded data using the plaintext modulus and the noise value.

[0108] The encoded data is equal to the sum of the product of the plaintext modulus and the noise value and the message value. The encoded data is recorded as LSB_Encode(m), LSB_Encode(m) = m + te. m is the message value (i.e. the value corresponding to the message), and the value range of m is t, for example t is the plaintext modulus. e is the noise value. because and Therefore, it can be guaranteed There are N possible values ​​for the encoded data.

[0109] Step 503: The first computing device obtains a random vector, a private key, and a bootstrap key.

[0110] Specifically, from Z q Select n elements as random vectors. q is a set of integers consisting of q values.

[0111] Optionally, the private key s includes n elements, each element belongs to {0,1}, that is, the value of each element is 0 or 1. Alternatively, the private key s includes n elements, each element belongs to {-1,0,1}, that is, the value of each element is -1, 0 or 1.

[0112] Step 504: The first computing device encrypts the encoded data into LWE ciphertext using the random vector and the private key.

[0113] Optionally, step 504 includes: calculating the inner product of the private key and the random vector; subtracting the inner product from the encoded data to obtain the parameter value to be modulo; performing a modulo operation on the ciphertext modulus of the parameter value to be modulo; and combining the random vector and the first parameter value obtained by the modulo operation into an LWE ciphertext.

[0114] The LWE ciphertext is recorded as (a, b), where a is a random vector and b is the first parameter value. The private key s, the random vector a, the encoded data LSB_Encode(m), the ciphertext modulus q and the first parameter value b satisfy the following formula: b = (-<a,s> +LSB_Encode(m))modq. The value of q is a positive integer multiple of 2N, such as 2N, 4N.

[0115] According to step 501 to step 504, d messages can be encrypted into d LWE ciphertexts, and each message corresponds to one LWE ciphertext. d is a positive integer, and the value of d can be set according to actual conditions.

[0116] Step 505: The first computing device sends the bootstrap key and at least one LWE ciphertext bootstrap key to the second computing device.

[0117] Step 506: The first computing device sends a data processing request to the second computing device.

[0118] Step 505 and step 506 may be performed separately or together. When step 505 and step 506 are performed simultaneously, the data processing request may carry a bootstrap key and one or more LWE ciphertexts.

[0119] Step 507: The second computing device determines a homomorphic operation rule according to the data processing request.

[0120] The homomorphic operation rule includes a univariate nonlinear function and / or a linear operation rule. The independent variable value of the univariate nonlinear function can be the LWE ciphertext sent by the first computing device, or the bootstrapped LWE ciphertext obtained by programmably bootstrapping any LWE ciphertext based on the univariate nonlinear function, or the LWE ciphertext calculated based on the linear operation rule. The input data of the linear operation rule includes one or more of the LWE ciphertext sent by the first computing device, the bootstrapped LWE ciphertext obtained by programmably bootstrapping any LWE ciphertext based on the univariate nonlinear function, or the LWE ciphertext calculated based on the linear operation rule.

[0121] Step 508: When the homomorphic operation rule includes a unary nonlinear function, the second computing device determines the LWE ciphertext to be bootstrapped according to at least one LWE ciphertext and the unary nonlinear function.

[0122] Optionally, step 508 includes: selecting a to-be-bootstrapped LWE ciphertext from at least one LWE ciphertext according to an independent variable of the univariate nonlinear function. The to-be-bootstrapped LWE ciphertext is a LWE ciphertext selected from at least one LWE ciphertext and serving as an independent variable of the univariate nonlinear function.

[0123] For example, LWE(m1) is a univariate nonlinear function f(x)=3x 2 The input data is determined to be LWE(m1) as the LWE ciphertext to be bootstrapped.

[0124] Alternatively, step 508 includes: when the homomorphic operation rule includes a linear operation rule, selecting an LWE ciphertext from at least one LWE ciphertext according to the linear operation rule; performing a linear operation on the selected LWE ciphertext according to the linear operation rule; when the linear operation result of the selected LWE ciphertext is input data of a unary nonlinear function, using the linear operation result of the selected LWE ciphertext as the LWE ciphertext to be bootstrapped.

[0125] For example, LWE(m2) and LWE(m3) are both input data of f(x)=2x+1, and it is determined that LWE(m2) and LWE(m3) are both LWE ciphertexts to be bootstrapped. It should be understood that a univariate linear function belongs to a linear operation rule.

[0126] For example, LWE(m4), LWE(m5) and LWE(m6) are multivariate functions y=4x 1 +2x 2 +x 3 Input data, and f(y) = y 2 , determine that the linear operation results of LWE(m4), LWE(m5) and LWE(m6) are 4LWE(m4)+2LWE(m5)+LWE(m6), and the linear operation result is the LWE ciphertext to be bootstrapped. When the weight of each LWE ciphertext is 1, the linear operation result of multiple LWE ciphertexts is the sum of the multiple LWE ciphertexts.

[0127] Step 509: The second calculation device determines a test polynomial according to the univariate nonlinear function.

[0128] Specifically, the second computing device may generate a test polynomial according to a univariate nonlinear function. Alternatively, the second computing device may pre-store a mapping set of test polynomials and univariate nonlinear functions, and search for the test polynomial from the mapping set according to the univariate nonlinear function.

[0129] Optionally, the univariate nonlinear function f() and the test polynomial testP satisfy the following formula:

[0130]

[0131] Step 510: The second computing device blindly rotates the LWE ciphertext to be bootstrapped according to the test polynomial and the bootstrapped key.

[0132] The LWE ciphertext to be bootstrapped can be recorded as (a", b"), where a" is the vector to be processed and b" is the parameter value to be processed. Step 510 specifically includes steps A to F.

[0133] Step A: Set the first variable of the accumulator variable group to 0 and the second variable of the accumulator variable group to X b” product with the test polynomial;

[0134] Step B: Set i equal to 0;

[0135] Step C: Determine whether i is less than n, and execute step D when i is less than n, and execute step F when i is equal to n;

[0136] Step D: Calculate the variable group of the accumulator, the vector to be processed and the bootstrap key according to the formula corresponding to the bootstrap key, and update the variable group of the accumulator to the calculation result;

[0137] Step E: Calculate i+1, update i to i+1, and jump to step C;

[0138] Step F: Determine the variable group of the RLWE ciphertext as the accumulator.

[0139] Optionally, the bootstrap key includes n elements, and the formula corresponding to the bootstrap key is acc is the variable group of the accumulator, a i " is the i-th element of the vector to be processed, bsk i is the i-th element of the bootstrap key.

[0140] Alternatively, the bootstrap key includes a first subkey and a second subkey, and the formula corresponding to the bootstrap key is: acc is the variable group of the accumulator, a i " is the i-th element of the vector to be processed, bsk i,0 is the i-th element of the first subkey, bsk i,1 is the i-th element of the second subkey.

[0141] Step 511: The second computing device generates a bootstrapped LWE ciphertext based on the RLWE ciphertext obtained by blind rotation.

[0142] Optionally, step 511 includes: extracting LWE ciphertext samples from RLWE ciphertext; performing key conversion on the LWE ciphertext samples; performing analog-to-digital conversion on the key conversion result, and the analog-to-digital conversion result is the bootstrapped LWE ciphertext.

[0143] Specifically, the first computing device can generate a conversion key based on the private key, the key and the basis, and the second computing device can receive the conversion key sent by the first computing device. The LWE ciphertext sample is key-converted using the conversion key to obtain a ciphertext conversion result. The LWE ciphertext sample can be considered as the LWE ciphertext encrypted using the key s', and the ciphertext conversion result can be considered as the LWE ciphertext encrypted using the private key, and the ciphertext modulus of the ciphertext conversion result is Q.

[0144] Private key s, secret key s', basis B ks and conversion key kski,j,v Satisfies the following formula: Base B ks The j-th element of .

[0145] The second computing device performs a modulus-to-digital conversion on the ciphertext conversion result obtained by the key conversion. The ciphertext conversion result is recorded as ct, ct = (a, b) mod Q, and the bootstrapped LWE ciphertext is recorded as LWE s (f(m))=(a',b')mod q,b'=-<a’,s> +f(m)+te'.

[0146] The programmable bootstrap process of the present application includes steps 509 to 511. Nonlinear operations can be implemented based on a univariate nonlinear function, and linear operations can be implemented based on a linear operation rule. When the homomorphic operation rule includes a univariate nonlinear function and a linear operation rule, various complex operations can be implemented based on the homomorphic operation rule. The univariate nonlinear function can be set according to actual conditions and plays a programmable role.

[0147] Step 512: The second computing device determines a homomorphic operation result according to the homomorphic operation rule and the bootstrapped LWE ciphertext.

[0148] After the second computing device performs programmable bootstrapping on the LWE ciphertext to be bootstrapped, it operates on the bootstrapped LWE ciphertext based on the residual rule of the homomorphic operation rule to obtain a homomorphic operation result. The residual rule is the part obtained by removing the above-mentioned univariate nonlinear function and linear operation rule from the homomorphic operation rule. The residual rule can be set according to actual conditions, and this application does not limit it.

[0149] Step 513: The second computing device sends the homomorphic operation result to the first computing device.

[0150] Step 514: The first computing device decrypts the homomorphic operation result according to the private key.

[0151] The homomorphic operation result includes the target vector and the second parameter value. Specifically, step 514 includes: adding the inner product of the private key and the target vector to the second parameter value, that is, b'+<a’,s> =f(m)+te'; perform a modulo operation on the ciphertext modulus using the result of the addition operation, and then perform a modulo operation on the plaintext modulus using the result of the modulo operation, that is, perform a modulo operation on t using (f(m)+te')mod q to obtain f(m).

[0152] In this embodiment, since the coded data is equal to the sum of the product of the plaintext modulus and the noise value and the message value, and the message value is less than the plaintext modulus, the message is in the low bit of the coded data, and the multiple of the noise value is in the high bit of the coded data. In programmable bootstrapping, the value range of m is [0, t), and the value range of the coded data is The range of message values ​​is expanded. In this way, the LWE ciphertext can be fully programmable and bootstrapped using a test polynomial with N coefficients, supporting linear operations in the modular sense, and thus having a wider range of applicability.

[0153] Secondly, programmable bootstrapping of the bootstrapped LWE ciphertext according to the univariate nonlinear function can be considered as homomorphic univariate nonlinear function operation on the bootstrapped LWE ciphertext. Each programmable bootstrapping can realize homomorphic calculation of the univariate nonlinear function once, so the calculation speed is very fast.

[0154] Again, LWE ciphertext has good security. The recipient of the LWE ciphertext cannot recognize the message corresponding to the LWE ciphertext. Moreover, the second computing device can perform homomorphic operations according to the data processing request. The result of the homomorphic operation is the same as the result obtained by performing the data operation corresponding to the data processing request on the message.

[0155] When the elements of the private key belong to {0,1}, the private key can be represented as s∈{0,1} n When the elements of the private key belong to {-1,0,1}, the private key can be expressed as s∈{-1,0,1} n The two private keys correspond to different bootstrap keys, which are introduced below:

[0156] When s∈{0,1} n When , the relationship between the binary private key and the bootstrap key satisfies the following formula: Among them, s i is the i-th element of the private key, bsk i is the i-th element of the bootstrap key. The key s' consists of N elements, each of which belongs to Z N , Z N is a set of integers consisting of N values.

[0157] Specifically, according to the key s′ and 2l g A random vector performs RLWE encryption on 0 to obtain 2l g RLWE ciphertext, that is ct i ∈RLWE s′ (0). g The random vector columns are concatenated into the RLWE ciphertext matrix, which can be used The gadget matrix satisfies I n represents the identity matrix, Represents the tensor product. g T is the transpose of the gadget vector g, B g is the basis of g, Bg The value of can be set according to actual conditions and is not limited in this application.

[0158] In this application, when the formula corresponding to the bootstrap key is When , steps A to F correspond to steps 601 to 606 respectively. When the formula corresponding to the bootstrap key is When step A to step F correspond to step 701 to step 706 respectively.

[0159] Combine the following Figure 6 Use the bootstrap key bsk i The process of performing blind rotation is introduced. In an optional embodiment, step 510 includes:

[0160] Step 601, acc=(0,X b” ·testP).

[0161] Step 602, i=0.

[0162] Step 603, determine whether i is less than n, if i is less than n, execute step 604, if i is equal to n, execute step 606;

[0163] Step 604: acc is the variable group of the accumulator, a i " is the i-th element of the vector to be bootstrapped, bsk i is the i-th element of the bootstrap key.

[0164] Step 605 , i=i+1, jump to step 603 .

[0165] Step 606: When i is equal to n, determine the RLWE ciphertext as a variable group of the accumulator.

[0166] After the accumulator calculation, it can be determined When the LWE ciphertext to be bootstrapped is the LWE ciphertext sent by the first computing device, and the encoded data corresponding to the LWE ciphertext is m+te, then When e=-1, m=1, then m+te=1-t, then X m+te =X 1-t Since f(1)X in testP t-1 With X 1-t The product of is the constant term, and the other terms of testP are related to X 1-t The product of is not a constant term. This can determine testP*X m+te The constant term is f(1), that is, f(m). In this way, we can get that the RLWE ciphertext is equal to RLWE s′ (f(m)+c 1 X+…+c N-1 XN-1 , c 1 ~c N-1 are polynomial coefficients, which are independent of the results of homomorphic operations. testP has N coefficients, and the testP coefficient corresponding to each value can be pre-set by exhaustively enumerating integers in [0, N-1]. In this way, the lookup table operation can be implemented based on the testP coefficients.

[0167] When s∈{-1,0,1} n When the bootstrap key is recorded as (bsk i,0 ,bsk i,1 ),i∈[0,n-1]. bsk i,0 is the i-th element of the first subkey, bsk i,1 is the i-th element of the second subkey. The relationship between the bootstrap key and the private key satisfies the following relationship: when s i =-1, then bsk i,0 =RGSW s′ (0),bsk i,1 =RGSW s′ (1); When s i =1, then bsk i,0 =RGSW s′ (1),bsk i,1 =RGSW s′ (0); when s i =0, then bsk i,0 =RGSW s′ (0),bsk i,1 =RGSW s′ (0). Among them, s i is the i-th element of the private key. The key s' consists of N elements, each of which belongs to Z N , Z N is a set of integers consisting of N values.

[0168] Combine the following Figure 7 Use the bootstrap key (bsk i,0 ,bsk i,1 ) is used to introduce the process of blind rotation. In another optional embodiment, step 510 includes:

[0169] Step 701: acc=(0,X b” ·testP).

[0170] Step 702: i=0.

[0171] Step 703: Determine whether i is less than n, and execute step 704 when i is less than n, and execute step 706 when i is equal to n;

[0172] Step 704: acc is the variable group of the accumulator, a i " is the i-th element of the random vector, bsk i is the i-th element of the bootstrap key.

[0173] Step 705: i=i+1, jump to step 703.

[0174] Step 706: When i is equal to n, determine the RLWE ciphertext as a variable of the accumulator.

[0175] After the accumulator calculation, it can be determined When the LWE ciphertext to be bootstrapped is the LWE ciphertext sent by the first computing device, and the encoded data corresponding to the LWE ciphertext is m+te, then When e=-1, m=1, then m+te=1-t, then X m+te =X 1-t Since f(1)X in testP t-1 With X 1-t The product of is the constant term, and the other terms of testP are related to X 1-t The product of is not a constant term. This can determine testP*X m+te The constant term is f(1), that is, f(m). In this way, we can get that the RLWE ciphertext is equal to RLWE s′ (f(m)+c 1 X+…+c N-1 X N-1 , c 1 ~c N-1 are polynomial coefficients, which are independent of the results of homomorphic operations. testP has N coefficients, and the testP coefficient corresponding to each value can be pre-set by exhaustively enumerating integers in [0, N-1]. In this way, the lookup table operation can be implemented based on the testP coefficients.

[0176] In an optional embodiment, the fully homomorphic encryption and decryption method of the present application also includes: when the homomorphic operation rules include an identity function, the second computing device determines the LWE ciphertext to be bootstrapped according to the independent variable of the identity function, determines the test polynomial according to the identity function, and blindly rotates the LWE ciphertext to be bootstrapped according to the test polynomial and the bootstrap key; generates the bootstrapped LWE ciphertext according to the RLWE ciphertext obtained by the blind rotation; and determines the homomorphic operation result according to the homomorphic operation rules and the bootstrapped LWE ciphertext.

[0177] In this embodiment, the LWE ciphertext to be bootstrapped is the independent variable of the identity function, and the independent variable value of the identity function can be the LWE ciphertext sent by the first computing device, or the bootstrapped LWE ciphertext obtained by programmably bootstrapping any LWE ciphertext based on a unary nonlinear function, or the LWE ciphertext calculated based on a linear operation rule.

[0178] The test polynomial corresponding to the identity function can be used to bootstrap the LWE ciphertext to be bootstrapped, so as to reduce the noise of the LWE ciphertext to be bootstrapped.

[0179] The following uses several examples to introduce the bootstrapping method of the present application. In one example, taking the identity function as an example, the function can be expressed as: f(x) = x. When the private key element belongs to {0, 1} and the parameter values ​​of the fully homomorphic encryption and decryption are as shown in Table 1, the bootstrapping time is 111 milliseconds (ms).

[0180] n N σ t q Q <![CDATA[B g ]]> <![CDATA[l g ]]> <![CDATA[B ks ]]> <![CDATA[l ks ]]> 830 1024 3.19 23 2048 <![CDATA[≈2 27 ]]> <![CDATA[2 9 ]]> 3 <![CDATA[2 7 ]]> 4

[0181] Table 1

[0182] Among them, n is the dimension of the private key (that is, the total number of elements in the private key), which is also the dimension of the random vector.

[0183] N is the dimension of the polynomial ring.

[0184] σ is the standard deviation of the Gaussian distribution.

[0185] t is the plaintext modulus.

[0186] q is the ciphertext modulus. q satisfies q=2N and q≡1mod t.

[0187] Q is the ciphertext modulus before modulus conversion. Q is a prime number, so Q satisfies Q≡1mod 2N, based on which number theoretic transforms (NTT) can be used to accelerate the calculation.

[0188] B g is the basis of the gadget vector, l g is the length of the gadget vector.

[0189] B ks is the basis used for key transformation, l ks According to B ks The length of the vector expansion of the LWE ciphertext sample.

[0190] In another example, taking the identity function as an example, when the private key element belongs to {-1, 0, 1} and the parameters of the fully homomorphic encryption and decryption method are as shown in Table 2, the bootstrap time is 121 milliseconds.

[0191] n N σ t q Q <![CDATA[B g ]]> <![CDATA[l g ]]> <![CDATA[B ks ]]> <![CDATA[l ks ]]> 512 1024 3.19 23 2048 <![CDATA[≈2 27 ]]> <![CDATA[2 9 ]]> 3 <![CDATA[2 7 ]]> 4

[0192] Table 2

[0193] In another example, the unary non-linear function is the Relu function, which is a non-linear function in a neural network model. The Relu function is as follows:

[0194]

[0195] where λ ~ U(l, u), l < u and l ∈ [0, 1), u ∈ [0, 1).

[0196] When the private key element belongs to {-1, 0, 1} and the parameters of the fully homomorphic encryption and decryption method are as shown in Table 3, the bootstrapping duration is 388 milliseconds.

[0197] n N σ t q Q <![CDATA[B g ]]> <![CDATA[l g ]]> <![CDATA[B ks ]]> <![CDATA[l ks ]]> 1024 2048 3.19 35 4096 <![CDATA[≈2 50 ]]> <![CDATA[2 25 ]]> 2 <![CDATA[2 17 ]]> 3

[0198] Table 3

[0199] It should be noted that the parameters, private keys, and functions in the above examples are all illustrative examples and do not limit this application. As can be seen from the above examples, the fully homomorphic encryption and decryption method of this application can perform linear operations or non-linear operations globally, and thus can be applied to all calculation scenarios.

[0200] This application also provides a computing device 800, as Figure 8 shown, the computing device 800 includes: a bus 802, a processor 804, a memory 806, and a communication interface 808. The processor 804, the memory 806, and the communication interface 808 communicate with each other through the bus 802. The computing device 800 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 800.

[0201] The bus 802 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus, etc. The bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience of representation, Figure 8 only one line is shown in, but it does not mean that there is only one bus or one type of bus. The bus 804 can include a path for transmitting information between various components (for example, the memory 806, the processor 804, the communication interface 808) of the computing device 800.

[0202] The processor 804 may include any one or more of a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0203] The memory 806 may include a volatile memory, such as a random access memory (RAM). The processor 804 may also include a non-volatile memory, such as a read-only memory (ROM), a flash memory, a hard disk drive (HDD), or a solid state drive (SSD).

[0204] An executable program code is stored in the memory 806. In an optional embodiment, the processor 804 executes the executable program code to respectively implement the functions of the aforementioned encryption module, sending module, receiving module, decryption module and key module, thereby realizing the fully homomorphic encryption and decryption method. In another optional embodiment, the processor 804 executes the executable program code to respectively implement the functions of the aforementioned receiving module, homomorphic operation module and sending module, thereby realizing the fully homomorphic encryption and decryption method. That is, the memory 806 stores instructions for executing the fully homomorphic encryption and decryption method.

[0205] The communication interface 808 uses a transceiver module such as, but not limited to, a network interface card or a transceiver to implement communication between the computing device 800 and other devices or communication networks.

[0206] The embodiment of the present application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smart phone.

[0207] like Fig. 9 As shown, the computing device cluster includes at least one computing device 800. The memory 806 in one or more computing devices 800 in the computing device cluster may store the same instructions for executing the fully homomorphic encryption and decryption method.

[0208] In some possible implementations, the memory 806 of one or more computing devices 800 in the computing device cluster may also store partial instructions for executing the fully homomorphic encryption and decryption method. In other words, the combination of one or more computing devices 800 can jointly execute instructions for executing the fully homomorphic encryption and decryption method.

[0209] It should be noted that the memory 806 in different computing devices 800 in the computing device cluster can store different instructions, which are respectively used to execute part of the functions of the computing device. That is, the instructions stored in the memory 806 in different computing devices 800 can implement the functions of one or more modules among the encryption module, the sending module, the receiving module, the sending module and the key module.

[0210] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig.10 A possible implementation is shown. Fig.10 As shown, two computing devices 800A and 800B are connected via a network. Specifically, they are connected to the network via a communication interface in each computing device. In this type of possible implementation, the memory 806 in the computing device 800A stores instructions for executing the functions of the receiving module and the sending module. At the same time, the memory 806 in the computing device 800B stores instructions for executing the functions of the encryption module, the decryption module, and the key module.

[0211] In some possible implementations, one or more computing devices in the computing device cluster may be connected via a network, which may be a wide area network or a local area network. Fig.11 A possible implementation is shown. Fig.11 As shown, two computing devices 800A and 800B are connected via a network. Specifically, they are connected to the network via a communication interface in each computing device. In this type of possible implementation, the memory 806 in the computing device 800A stores instructions for executing the functions of a receiving module, a sending module, an encryption module, a decryption module, and a key module. At the same time, the memory 806 in the computing device 800B stores instructions for executing the functions of a receiving module, a sending module, and a homomorphic operation module.

[0212] The embodiment of the present application also provides a computer program product including instructions. The computer program product may be a software or program product including instructions that can be run on a computing device or stored in any available medium. When the computer program product is run on at least one computing device, the at least one computing device performs a fully homomorphic encryption and decryption method.

[0213] The embodiment of the present application also provides a computer-readable storage medium. The computer-readable storage medium can be any available medium that can be stored by a computer or a data storage device such as a data center containing one or more available media. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk). The computer-readable storage medium includes instructions that instruct the computer to perform a fully homomorphic encryption and decryption method.

[0214] The present application also provides a chip system, which includes a processor and a memory coupled to each other. The memory is used to store computer programs or instructions, and the processor is used to execute the computer programs or instructions stored in the memory, so that the server executes the steps executed in the above embodiment. Optionally, the memory is a memory in the chip, such as a register, a cache, etc., and the memory can also be a memory located outside the chip in the site, such as a read-only memory or other types of static storage devices that can store static information and instructions, a random access memory, etc. The processor mentioned in any of the above places can be a general-purpose central processing unit, a microprocessor, a dedicated integrated circuit, or one or more integrated circuits for implementing the above-mentioned fully homomorphic encryption and decryption method.

[0215] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0216] In the several embodiments provided in the present application, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0217] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0218] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0219] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, read-only memory), random access memory (RAM, random access memory), disk or optical disk and other media that can store program code.

Claims

1. A fully homomorphic encryption and decryption method, characterized in that: The method is applied to a data processing system, the data processing system comprising a first computing device and a second computing device, the first computing device storing a private key and a bootstrap key, the second computing device being used for homomorphic computing, the method comprising: Select noise values ​​from a Gaussian distribution; Encoding a message into encoded data using a plaintext modulus and the noise value, the encoded data being equal to a sum of a product of the plaintext modulus and the noise value and a message value, the message value corresponding to the message and being less than the plaintext modulus; Get the random vector, private key, and bootstrap key; Encrypting the encoded data into a fault-tolerant learning LWE ciphertext using the random vector and the private key; sending the bootstrap key and at least one of the LWE ciphertexts to a second computing device; sending a data processing request to the second computing device; receiving a homomorphic operation result sent by the second computing device, where the homomorphic operation result is obtained by the second computing device performing a homomorphic operation on at least one of the LWE ciphertexts according to the data processing request; The homomorphic operation result is decrypted according to the private key.

2. The method according to claim 1, characterized in that The encrypting the encoded data into LWE ciphertext using the random vector and the private key comprises: Calculating the inner product of the private key and the random vector; Subtract the inner product from the encoded data to obtain a parameter value to be modulo-measured; Performing a modulo operation on the ciphertext modulus using the parameter value to be modulo-calculated; The random vector and the first parameter value obtained by the modulo operation are combined into an LWE ciphertext.

3. The method according to claim 1, characterized in that The homomorphic operation result includes a target vector and a second parameter value, and decrypting the homomorphic operation result according to the private key includes: Performing an addition operation on the inner product of the private key and the target vector and the second parameter value; Perform a modulus operation on the ciphertext modulus using the result of the addition operation; The modulo operation result is used to perform a modulo operation on the plaintext modulus.

4. The method according to any one of claims 1 to 3, characterized in that The method further comprises: The private key is encrypted by RGSW to obtain a bootstrap key.

5. A fully homomorphic encryption and decryption method, characterized in that: The method is applied to a data processing system, the data processing system comprising a first computing device and a second computing device, the first computing device storing a private key and a bootstrap key, the method comprising: receiving a bootstrap key and at least one fault-tolerant learning LWE ciphertext sent by a first computing device; receiving a data processing request sent by the first computing device; Determining a homomorphic operation rule according to the data processing request; In a case where the homomorphic operation rule includes a unary nonlinear function, determining the LWE ciphertext to be bootstrapped according to at least one of the LWE ciphertexts and the unary nonlinear function; Determine a test polynomial according to the univariate nonlinear function; Blindly rotating the LWE ciphertext to be bootstrapped according to the test polynomial and the bootstrapped key; Generate bootstrapped LWE ciphertext based on the ring-based fault-tolerant learning RLWE ciphertext obtained by blind rotation; Determine a homomorphic operation result according to the homomorphic operation rule and the bootstrapped LWE ciphertext; The homomorphic operation result is sent to the first computing device.

6. The method according to claim 5, characterized in that Determining the LWE ciphertext to be bootstrapped according to at least one of the LWE ciphertexts and the unary nonlinear function comprises: The LWE ciphertext to be bootstrapped is selected from the at least one LWE ciphertext according to the independent variable of the univariate nonlinear function.

7. The method according to claim 5, characterized in that The homomorphic operation rules also include linear operation rules; Determining the LWE ciphertext to be bootstrapped according to at least one of the LWE ciphertexts and the unary nonlinear function comprises: Selecting an LWE ciphertext from at least one of the LWE ciphertexts according to the linear operation rule; Performing a linear operation on the selected LWE ciphertext according to the linear operation rule; When the linear operation result is input data of a univariate nonlinear function, the linear operation result is used as the LWE ciphertext to be bootstrapped.

8. The method according to claim 5, characterized in that The univariate nonlinear function and the test polynomial satisfy the following formula: Among them, testp is the test polynomial and f() is a univariate nonlinear function.

9. The method according to any one of claims 5 to 8, characterized in that The generating of the bootstrapped LWE ciphertext according to the RLWE ciphertext comprises: extracting LWE ciphertext samples from the RLWE ciphertext; performing key conversion on the LWE ciphertext samples; and performing modulus-to-digital conversion on the key conversion result to obtain the bootstrapped LWE ciphertext.

10. The method according to any one of claims 5 to 8, characterized in that The LWE ciphertext to be bootstrapped includes a vector to be processed and a parameter value to be processed, and the blind rotation of the LWE ciphertext to be bootstrapped according to the test polynomial and the bootstrapped key includes: step A: setting the first variable of the variable group of the accumulator to 0, setting the second variable of the variable group of the accumulator to the product of Xb" and the test polynomial, where b" is the parameter value to be processed; Step B: Set i equal to 0; Step C: Determine whether i is less than n, and execute step D when i is less than n, and execute step F when i is equal to n; Step D: Calculate the variable group of the accumulator, the vector to be processed and the bootstrap key according to the formula corresponding to the bootstrap key, and update the variable group of the accumulator to the calculation result; Step E: Calculate i+1, update i to i+1, and jump to step C; Step F: Determine the variable group of the RLWE ciphertext as the accumulator.

11. The method according to claim 10, characterized in that The bootstrap key includes n elements, and the formula corresponding to the bootstrap key is: The acc is the variable group of the accumulator, a i " is the i-th element of the vector to be processed, and the bsk i is the i-th element of the bootstrap key.

12. The method according to claim 10, characterized in that The bootstrap key includes a first subkey and a second subkey. The formula corresponding to the bootstrap key is: The acc is the variable group of the accumulator, a i " is the i-th element of the vector to be processed, and the bsk i,0 is the i-th element of the first subkey, the bsk i,1 is the i-th element of the second subkey.

13. A computing device, characterized in that: include: An encryption module, used to select noise values ​​from Gaussian distribution; Encode the message into encoded data using the plaintext modulus and the noise value, wherein the encoded data is equal to the sum of the product of the plaintext modulus and the noise value and the message value, wherein the message value corresponds to the message and is less than the plaintext modulus; obtain a random vector, a private key, and a bootstrap key; Encrypting the encoded data into a fault-tolerant learning LWE ciphertext using the random vector and the private key; a sending module, configured to send the bootstrap key and at least one of the LWE ciphertexts to a second computing device; The sending module is also used to send the data processing request to the second computing device; A receiving module, configured to receive a homomorphic operation result sent by the second computing device, wherein the homomorphic operation result is obtained by the second computing device performing a homomorphic operation on at least one of the LWE ciphertexts according to the data processing request; A decryption module is used to decrypt the homomorphic operation result according to the private key.

14. The computing device according to claim 13, characterized in that: The encryption module is specifically used to calculate the inner product of the private key and the random vector; subtract the inner product from the encoded data to obtain the parameter value to be modulo; perform a modulo operation on the ciphertext modulus with the parameter value to be modulo; and compose an LWE ciphertext with the random vector and the first parameter value obtained by the modulo operation.

15. The computing device according to claim 13, characterized in that: The decryption module is specifically used to perform an addition operation on the inner product of the private key and the target vector and the second parameter value; perform a modulus operation on the ciphertext modulus using the addition operation result; and perform a modulus operation on the plaintext modulus using the modulus operation result.

16. The computing device according to any one of claims 13 to 15, characterized in that: The computing device further includes: a key module, configured to perform RGSW encryption on the private key to obtain a bootstrap key.

17. A computing device, characterized in that: include: A receiving module, configured to receive a bootstrap key and at least one fault-tolerant learning LWE ciphertext sent by a first computing device; The receiving module is also used to receive a data processing request sent by the first computing device; A homomorphic operation module, configured to determine a homomorphic operation rule according to the data processing request, and when the homomorphic operation rule includes a univariate nonlinear function, determine the LWE ciphertext to be bootstrapped according to at least one of the LWE ciphertexts and the univariate nonlinear function; and determine a test polynomial according to the univariate nonlinear function; Generate a ring-based fault-tolerant learning RLWE ciphertext according to the test polynomial, the bootstrap key and the LWE ciphertext to be bootstrapped; generate a bootstrapped LWE ciphertext according to the RLWE ciphertext; determine a homomorphic operation result according to the homomorphic operation rule and the bootstrapped LWE ciphertext; A sending module is used to send the homomorphic operation result to the first computing device.

18. The device according to claim 17, characterized in that The homomorphic operation module is specifically used to select the LWE ciphertext to be bootstrapped from at least one of the LWE ciphertexts according to the independent variable of the unary nonlinear function.

19. The device according to claim 17, characterized in that The homomorphic operation module is specifically used to select an LWE ciphertext from at least one of the LWE ciphertexts according to a linear operation rule; and perform a linear operation on the selected LWE ciphertext according to the linear operation rule; When the linear operation result is input data of a univariate nonlinear function, the linear operation result is used as the LWE ciphertext to be bootstrapped.

20. The device according to claim 17, characterized in that The univariate nonlinear function and the test polynomial satisfy the following formula: Among them, testp is the test polynomial and f() is a univariate nonlinear function.

21. The device according to any one of claims 17 to 20, characterized in that The homomorphic operation module is specifically used to extract LWE ciphertext samples from the RLWE ciphertext; perform key conversion on the LWE ciphertext samples; and perform modulus-to-digital conversion on the key conversion result to obtain the bootstrapped LWE ciphertext.

22. The device according to any one of claims 17 to 20, characterized in that The homomorphic operation module is specifically used to perform the following steps: Step A: Set the first variable of the variable group of the accumulator to 0, and set the second variable of the variable group of the accumulator to X b” The product of the test polynomial, wherein b" is the parameter value to be processed; Step B: Set i equal to 0; Step C: Determine whether i is less than n, and execute step D when i is less than n, and execute step F when i is equal to n; Step D: Calculate the variable group of the accumulator, the vector to be processed and the bootstrap key according to the formula corresponding to the bootstrap key, and update the variable group of the accumulator to the calculation result; Step E: After calculating i+1, update i to i+1 and jump to step C; Step F: Determine the RLWE ciphertext as the variable group of the accumulator.

23. The device according to claim 22, characterized in that The bootstrap key includes n elements, and the formula corresponding to the bootstrap key is: The acc is the variable group of the accumulator, a i " is the i-th element of the vector to be processed, and the bsk i is the i-th element of the bootstrap key.

24. The device according to claim 22, characterized in that The bootstrap key includes a first subkey and a second subkey. The formula corresponding to the bootstrap key is: The acc is the variable group of the accumulator, a i " is the i-th element of the vector to be processed, and the bsk i,0 is the i-th element of the first subkey, the bsk i,1 is the i-th element of the second subkey.

25. A computing device cluster, characterized in that: The method comprises at least one computing device, each computing device comprises a processor and a memory, the processor of the at least one computing device is used to execute instructions stored in the memory of the at least one computing device, so that the computing device cluster executes the method according to any one of claims 1 to 12.

26. A computer-readable storage medium, characterized in that: The method comprises computer program instructions. When the computer program instructions are executed by a computing device cluster, the computing device cluster performs the method according to any one of claims 1 to 12.

27. A computer program product comprising instructions, characterized in that When the instructions are executed by a computing device cluster, the computing device cluster executes the method according to any one of claims 1 to 12.

Images