A fully homomorphic encryption method and computing device

Abstract

This application discloses a fully homomorphic encryption / decryption method and computing device for performing fully programmable bootstrapping on ciphertext, supporting fully linear operations and expanding its applicability. The fully homomorphic encryption / decryption method includes: selecting noise values ​​from a Gaussian distribution; encoding the message into encoded data using the plaintext modulus and the noise values; encrypting the encoded data into LWE ciphertext using a random vector and a private key; sending the LWE ciphertext, bootstrapping key, and data processing request to a second computing device; performing homomorphic operations on the LWE ciphertext according to the data processing request by the second computing device; and receiving the homomorphic operation result from the second computing device and decrypting the homomorphic operation result using the private key.

Description

Technical Field

[0001] This application relates to the field of cryptography, and more particularly to a fully homomorphic encryption / decryption method and computing device. Background Technology

[0002] Homomorphic encryption refers to using a function and ciphertext to perform homomorphic operations, and decrypting this result yields the same result as calculating the plaintext using the same function. Because ciphertext computation can be performed in an untrusted environment, it offers good security. Fully homomorphic encryption is an encryption method that simultaneously satisfies both additive and multiplicative homomorphism.

[0003] One current fully homomorphic encryption method is roughly as follows: The message value is denoted as m, the noise value as e, and the message sender follows... The message value and noise value are encoded into encoded data. This encoded data is then encrypted into learning-with-errors (LWE) ciphertext, which is sent to the homomorphic computing device. The message receiver uses a test polynomial to programmably bootstrap the LWE ciphertext. The test polynomial has N coefficients, which can be used to implement a lookup table function, ensuring that within Z... N Correctness within the specified range.

[0004] However, when When the encoded data is greater than N, the correct result may not be found based on the test polynomial. Therefore, the range of values ​​for m in the above method is... To ensure the bootstrapping result is correct, noise must be located in the low-order bits of the encoded data, and the message value must be located in the high-order bits. The highest bit of the message value must be 0. Figure 1 As shown. Summary of the Invention

[0005] This application provides a fully homomorphic encryption / decryption method and computing device, which can obtain encoded data including high-bit noise and low-bit message, perform fully programmable bootstrapping on the LWE ciphertext corresponding to the encoded data, and support linear operations in the modulo sense, thus having a wider range of applications.

[0006] The first aspect provides a fully homomorphic encryption / decryption method, which includes: selecting noise values ​​from a Gaussian distribution, encoding a message into encoded data using the plaintext modulus and the noise values, obtaining a random vector, a private key, and a bootstrap key, encrypting the encoded data into LWE ciphertext using the random vector and the private key, sending at least one LWE ciphertext, the bootstrap key, and a data processing request to a second computing device, performing a homomorphic operation on the at least one LWE ciphertext according to the data processing request, receiving the homomorphic operation result sent by the second computing device, and decrypting the homomorphic operation result according to the private key.

[0007] Since the encoded data equals the product of the plaintext modulus and the noise value plus the message value, and the message value is less than the plaintext modulus, the message value is in the lower bits of the encoded data, and the multiples of the noise value are in the higher bits. In programmable bootstrapping, a message value modulo t allows the encoded data to take on a range of values. This expands the range of message values ​​and uses a test polynomial with N coefficients to perform fully programmable bootstrapping on the LWE ciphertext corresponding to the encoded data, thus having a wider range of applications.

[0008] In a first possible implementation of the first aspect, encrypting encoded data into LWE ciphertext using a random vector and a private key includes: calculating the inner product of the private key and the random vector, subtracting the inner product from the encoded data to obtain the modulo parameter value; performing a modulo operation on the modulo of the ciphertext using the modulo parameter value; and combining the random vector and the first parameter value obtained from the modulo operation to form the LWE ciphertext. The LWE ciphertext has good security, and the recipient of the LWE ciphertext cannot identify the message corresponding to it.

[0009] In the second possible implementation of the first aspect, decrypting the homomorphic operation result based on the private key and the plaintext modulus includes: adding the inner product of the private key and the target vector to the second parameter value; performing a modulo operation on the ciphertext modulus of the addition result; and performing a modulo operation on the plaintext modulus of the modulo operation result. The homomorphic operation result includes the target vector and the second parameter value. By implementing this, the data obtained by decrypting the homomorphic operation result is the same as the result obtained by performing data operations corresponding to the data processing request on the message.

[0010] In another possible implementation of the first aspect, the fully homomorphic encryption / decryption method of this application further includes: encrypting the private key using RGSW to obtain a bootstrap key. This provides a bootstrap key that can be used for programmable bootstrapping.

[0011] In another possible implementation of the first aspect, the element values ​​of the private key belong to {0,1}.

[0012] In another possible implementation of the first aspect, the element values ​​of the private key belong to {-1, 0, 1}.

[0013] The second aspect provides a fully homomorphic encryption / decryption method, which includes: receiving at least one LWE ciphertext, a bootstrap key, and a data processing request from a first computing device; determining homomorphic operation rules based on the data processing request; if the homomorphic operation rules include a univariate nonlinear function, determining the LWE ciphertext to be bootstrapped based on the at least one LWE ciphertext and the univariate nonlinear function; determining a test polynomial based on the univariate nonlinear function; generating an RLWE ciphertext based on the test polynomial, the bootstrap key, and the LWE ciphertext to be bootstrapped; generating a bootstrap LWE ciphertext based on the RLWE ciphertext; determining the homomorphic operation result based on the homomorphic operation rules and the bootstrap LWE ciphertext; and then sending the homomorphic operation result to the first computing device. The test polynomial includes N coefficients. Because the test polynomial includes N coefficients, using this test polynomial allows for fully programmable bootstrapping of the LWE ciphertext, supports linear operations in the modular sense, and therefore has a wider range of applications.

[0014] This implementation allows for programmable bootstrapping of LWE ciphertext received by the second computing device or LWE ciphertext obtained through homomorphic operations, enabling homomorphic operations on univariate nonlinear functions. Furthermore, it reduces noise, preventing errors in homomorphic operations caused by excessive noise when performing homomorphic operations on bootstrap LWE ciphertext according to other rules. It should be noted that, in addition to homomorphic operations on univariate nonlinear functions, homomorphic operation rules can also include linear operation rules. Based on linear operation rules, homomorphic addition operations can be performed on multiple LWE ciphertexts. When the homomorphic operation rules include both linear operation rules and univariate nonlinear functions, various complex operations can be implemented.

[0015] In one possible implementation of the second aspect, the LWE ciphertext to be bootstrapping is selected from at least one LWE ciphertext based on the independent variable of a univariate nonlinear function. This allows for programmable bootstrapping of all or part of the LWE ciphertexts sent by the first computing device.

[0016] In another possible implementation of the second aspect, determining the LWE ciphertext to be bootstrapping based on at least one LWE ciphertext and a univariate nonlinear function includes: selecting an LWE ciphertext from at least one LWE ciphertext according to linear operation rules; performing a linear operation on the selected LWE ciphertext according to the linear operation rules; and if the result of the linear operation on the selected LWE ciphertext is the input data of the univariate nonlinear function, using the result of the linear operation as the LWE ciphertext to be bootstrapping. This allows for programmable bootstrapping of the linear operation results of one or more LWE ciphertexts.

[0017] In another possible implementation of the second aspect, the univariate nonlinear function and the test polynomial satisfy the following formula:

[0018]

[0019] Where testp is the test polynomial and f() is a univariate nonlinear function.

[0020] In another possible implementation of the second aspect, generating bootstrap LWE ciphertext from RLWE ciphertext includes: extracting LWE ciphertext samples from RLWE ciphertext; performing key conversion on the LWE ciphertext samples; and performing analog-to-digital conversion on the key conversion result to obtain bootstrap LWE ciphertext.

[0021] In another possible implementation of the second aspect, blindly rotating the LWE ciphertext to be bootstrapping according to the test polynomial and the bootstrap key includes steps A to F. Step A includes: setting the first variable of the accumulator's variable group to 0, and setting the second variable of the accumulator's variable group to X. b The product of the test polynomial and step B includes: setting i equal to 0; step C includes: determining whether i is less than n, and if i is less than n, proceeding to step D, and if i equals n, proceeding to step F; step D includes: calculating the accumulator's variable set, the vector to be processed, and the bootstrap key according to the formula corresponding to the bootstrap key, and updating the accumulator's variable set to the calculation result; step E includes: calculating i+1, updating i to i+1, and jumping to step C; step F includes: determining the RLWE ciphertext as the accumulator's variable set. The bootstrap LWE ciphertext includes the vector to be processed and the parameter value to be processed, where b” is the parameter value to be processed. This provides a specific and feasible blind rotation method.

[0022] In another possible implementation of the second aspect, the bootstrap key comprises n elements, and the formula corresponding to the bootstrap key is: acc is the variable set of the accumulator, a i " represents the i-th element of the vector to be processed, bsk i It is the i-th element of the bootstrap key.

[0023] In another possible implementation of the second aspect, the bootstrap key includes a first subkey and a second subkey, and the formula corresponding to the bootstrap key is: acc is the variable set of the accumulator, a i " represents the i-th element of the vector to be processed, bsk i,0 bsk is the i-th element of the first subkey. i,1 It is the i-th element of the second subkey.

[0024] A third aspect provides a computing device, specifically, the computing device including modules or units for performing the methods of the first aspect or any possible implementation thereof, such as a receiving module, a sending module, an encryption module, a decryption module or a key module.

[0025] A fourth aspect provides a computing device for performing the methods of the second aspect or any possible implementation thereof. Specifically, the computing device includes modules or units for performing the methods of the second aspect or any possible implementation thereof, such as a receiving module, a homomorphic operation module, or a transmitting module.

[0026] The fifth aspect provides a computing device including a processor and a memory, the memory being used to store a program; the processor executing the program to implement the method of the first aspect or the second aspect.

[0027] A sixth aspect provides a computing device cluster including at least one computing device, each computing device including a processor and a memory, wherein the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the computing device cluster to perform the methods of the first aspect or the second aspect.

[0028] The seventh aspect provides a computer-readable storage medium storing instructions that, when executed on a computing device, cause the computing device to perform the methods described above.

[0029] The eighth aspect provides a computer program product containing instructions that, when executed on a computing device, cause the computing device to perform the methods described above. Attached Figure Description

[0030] Figure 1 This is a schematic diagram of encoded data in the prior art;

[0031] Figure 2 This is a schematic diagram of fully homomorphic encryption and fully homomorphic decryption in an embodiment of this application;

[0032] Figure 3 This is a structural diagram of a computing device in an embodiment of this application;

[0033] Figure 4 This is another structural diagram of the computing device in the embodiments of this application;

[0034] Figure 5 This is a flowchart of a fully homomorphic encryption / decryption method in an embodiment of this application;

[0035] Figure 6 This is a flowchart of a blind rotation embodiment in this application;

[0036] Figure 7 This is another flowchart of blind rotation in an embodiment of this application;

[0037] Figure 8 This is a structural diagram of a computing device in an embodiment of this application;

[0038] Figure 9 This is a structural diagram of a computing device cluster in an embodiment of this application;

[0039] Figure 10 This is another structural diagram of the computing device cluster in the embodiments of this application;

[0040] Figure 11 This is another structural diagram of the computing device cluster in the embodiments of this application. Detailed Implementation

[0041] First, let's introduce the technical terms used in this application:

[0042] I. The LWE encryption / decryption process includes:

[0043] Step 101: Encode the message in low bits using noise and plaintext modulus.

[0044] The encoded data is denoted as LSB_Encode(m), where LSB_Encode(m) = m + te. The noise value e is taken from a Gaussian distribution with a standard deviation of σ.

[0045] Step 102: Obtain a random vector a, and use the random vector a and the private key s to encrypt the encoded data.

[0046] b = -<a,s> +LSB_Encode(m)=-<a,s> +m+te.<a,s> Let represent the inner product of the random vector 'a' and the private key 's'. Both the random vector 'a' and the private key 's' are n-dimensional vectors.

[0047] LWE s (m) = (a, b) mod q, LWE s (m) represents the LWE ciphertext of message m under private key s.

[0048] Step 103: Decrypt the encrypted ciphertext based on the random vector a, the private key s, and the first parameter value b.

[0049] b+<a,s> =LSB_Encode(m)=m+te.

[0050] Step 104: Decode the decrypted data to obtain the message.

[0051] The message value m satisfies m = (m + te) mod t.

[0052] II. The encryption and decryption process of ring learning with errors (RLWE) includes:

[0053] Step 201: Encode the message polynomial in the low-order bits using the noise polynomial and the plaintext modulus.

[0054] The encoded data is denoted as LSB_Encode(m'), where LSB_Encode(m') = m' + te'. The coefficients of the noise polynomial e' are taken from a Gaussian distribution with a standard deviation of σ. LSB_Encode(m') ∈ R Q R Q =Z Q / (X N +1).

[0055] Step 202, from the polynomial ring R Q Randomly select polynomial a R Using polynomial a R and private key R The encoded data is then encrypted.

[0056] Private key s R Taken from the ternary distribution {-1,0,1} / (X) N +1) or binary distribution {0,1} / (X) N +1).

[0057] This indicates that the message polynomial m' is in the private key s R The RLWE ciphertext below,

[0058] Step 203: Decrypt the encrypted ciphertext using random vector a, private key s, and vector b.

[0059] b R +a R s R =LSB_Encode(m')=(m'+te')mod R Q .

[0060] Step 204: Decode the decrypted data to obtain the message. The message m satisfies m = (m + te) mod t.

[0061] 3. RLWE ciphertext is the ciphertext obtained by encrypting the message using RGSW with the private key. RGSW s (m)=(ct0||...||ct 2l-1 )+mG, RGSW s (m) is the ciphertext obtained by encrypting message m using the private key s using RGSW. GSW stands for Gentry Sahai Waters, a fully homomorphic encryption scheme. RGSW can also be called Ring GSW, which is an optimized version of GSW.

[0062] Let the gadget matrix be G, then I n Represents the identity matrix. Represents the tensor product. g T Let g be the transpose of g, and let g be the Gadget vector g = (1, B, ..., B). l-1 ). RLWE s (0) is the ciphertext of 0 under RLWE, ct i ∈RLWE s (0), || indicates column concatenation.

[0063] IV. ⊙ is the outer product operator, also known as the external product. RLWE s (m1)⊙RGSW s (m2)=RLWE s (m1*m2). RLWE s (m1) represents the ciphertext obtained by RLWE encryption of message m1 using the private key s. RGSW s (m2) represents the ciphertext obtained by encrypting message m2 using the private key s via RGSW. RLWE s (m1*m2) represents the ciphertext obtained by RLWE encryption of m1*m2 using the private key s.

[0064] V. RLWE ciphertext sampling refers to extracting an LWE ciphertext from an RLWE ciphertext. This LWE ciphertext can be denoted as... The message encrypted using this LWE ciphertext is the constant term of the RLWE encrypted plaintext polynomial.

[0065]

[0066] LWE φ(s) (m0)=(a0,-a N-1 ,-a N-2 ,...,-a1,b0).

[0067] φ(s)=(s0,s1,...,s N-1 ).

[0068] s = s0 + s1X + ... + s N-1 X N-1 .

[0069] VI. The key conversion in this application refers to the conversion of ciphertext encrypted with different private keys.

[0070] Let the private key before conversion be denoted as s', where s'∈Z N The converted private key is denoted as s, where s∈Z. n Key conversion Where i∈{1,...,N}, j∈{0,...,l} ks -1},v∈{0,...,B ks}

[0071] Based on vector a and basis B ks Obtain target data

[0072] ct'=(0,b)-∑ i,j ksk i,j,v a i,j .

[0073] VII. The modular-to-digital conversion in this application refers to converting ciphertext with a large modulus into ciphertext with a small modulus while keeping the encrypted message unchanged.

[0074] For Q > q > t, Q ≡ 1 mod t, q ≡ 1 mod t. Given the ciphertext ct, ct = (a, b) mod Q, convert its modulus to ct'. Among them, ct i ' is the closest an integer, and ct i '≡ct i mod t, i∈[0,1].

[0075] This application provides a fully homomorphic encryption / decryption method for use in cloud computing scenarios, artificial intelligence (AI) scenarios based on fully homomorphic encryption, data retrieval scenarios, or privacy computing scenarios.

[0076] like Figure 2 As shown, in a cloud computing scenario, terminal 21 acquires d user data (i.e., m1, m2, ..., m...). d User data can include, but is not limited to, messages, user identity information, and medical data. Let m1, m2, ..., m d Encrypted as c1, c2, ..., c d Then terminal 21 will assign c1, c2, ..., c d The data is sent to cloud server 22, which can then store the encrypted user data. After receiving the data processing request from terminal 21, cloud server 22 will process c1, c2, ..., c... d Perform homomorphic operations, and then process the homomorphic operation result c. f Send to terminal 21, terminal 21 will send c f Decrypted as f(m1,m2,...,m) d ).

[0077] The operation corresponding to function f can be querying, retrieving, or calculating. For example, a user sends a query request to cloud server 22 through terminal 21. Cloud server 22 performs a homomorphic operation on the homomorphically encrypted user data according to the query request, and sends the homomorphic operation result in ciphertext form to terminal 21. Terminal 21 performs the corresponding homomorphic decryption on the operation result to obtain the query result. Since the user data stored on cloud server 22 is all ciphertext, the fully homomorphic encryption and decryption method can provide good security.

[0078] Artificial intelligence scenarios include machine learning, deep learning, and reinforcement learning. When training models in artificial intelligence scenarios, convolutional layers, pooling layers, and connection layers require linear or non-linear operations. This application encrypts the original data into training data. The training device performs linear operations or programmable bootstrapping on the encrypted data. Non-linear operations are achieved through programmable bootstrapping, thereby obtaining the encrypted model's computational results. This ensures the security of the original data.

[0079] Privacy-preserving computation involves privacy-sensitive data, including but not limited to financial data, confidential corporate data, government data, and medical data. By encrypting this privacy-sensitive data, performing homomorphic operations on it, and then decrypting the result, the privacy-preserving computation outcome can be obtained, thus effectively protecting privacy.

[0080] The computing device of this application is described below, see reference. Figure 3 In one embodiment, the computing device 300 includes an encryption module 301, a sending module 302, a receiving module 303, a decryption module 304, and a key module 305.

[0081] Encryption module 301 is used to select noise values ​​from a Gaussian distribution; encode the message into encoded data using the plaintext modulus and the noise values; obtain a random vector, a private key, and a bootstrap key; and encrypt the encoded data into LWE ciphertext using the random vector and the private key.

[0082] The sending module 302 is used to send the bootstrap key and at least one LWE ciphertext to the second computing device;

[0083] The sending module 302 is also used to send the data processing request to the second computing device;

[0084] The receiving module 303 is used to receive the homomorphic operation results sent by the second computing device;

[0085] The decryption module 304 is used to decrypt the homomorphic operation result based on the private key.

[0086] In another optional embodiment, the encryption module 301 is specifically used to calculate the inner product of the private key and the random vector; subtract the inner product from the encoded data to obtain the modulus parameter value to be taken; perform a modulo operation on the modulus of the ciphertext using the modulus parameter value to be taken; and combine the random vector and the first parameter value obtained by the modulo operation to form the LWE ciphertext.

[0087] In another optional embodiment, the decryption module 304 is specifically used to perform an addition operation on the inner product of the private key and the target vector and the second parameter value, and to perform a modulo operation on the ciphertext modulus of the addition result; and to perform a modulo operation on the plaintext modulus of the modulo operation result.

[0088] In another optional embodiment, the key module 305 is used to encrypt the private key using RGSW to obtain the bootstrap key. Optionally, the key module 305 is specifically used to obtain the gadget matrix and the RLWE ciphertext matrix, wherein the RLWE ciphertext matrix is ​​obtained by concatenating a preset number of RLWE ciphertext columns to be processed, and the RLWE ciphertext to be processed is obtained by RLWE encryption of 0 using the key; and the bootstrap key is calculated using the private key, the gadget matrix, and the RLWE ciphertext matrix.

[0089] As an example of a software functional unit, the encryption module 301 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, or a container. Furthermore, the aforementioned computing instance may be one or more. For example, the encryption module 301 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed within the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed within the same availability zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region may include multiple AZs.

[0090] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0091] As an example of a hardware functional unit, the encryption module 301 may include at least one computing device, such as a server. Alternatively, the encryption module 301 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0092] The multiple computing devices included in the encryption module 301 can be distributed in the same region or in different regions. Similarly, the multiple computing devices included in the encryption module 301 can be distributed in the same Availability Zone (AZ) or in different AZs. Likewise, the multiple computing devices included in the encryption module 301 can be distributed in the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0093] It should be noted that, in other embodiments, the encryption module 301 can be used to perform... Figure 5 In the illustrated embodiment, the sending module 302 can execute any step of the fully homomorphic encryption / decryption method. Figure 5 The receiving module 303 can execute any step in the fully homomorphic encryption / decryption method shown in the embodiment. Figure 5 In the fully homomorphic encryption / decryption method shown in the embodiment, the decryption module 304 can execute any step. Figure 5 In the fully homomorphic encryption / decryption method shown in the embodiment, the key module 305 can be used to execute any step. Figure 5 In the illustrated embodiment, any step in the fully homomorphic encryption / decryption method can be implemented by each module, and the steps implemented by each module can be specified as needed. By implementing different steps in the fully homomorphic encryption / decryption method through each module, all functions of the first computing device are achieved. The key module 305 is an optional module.

[0094] See Figure 4In one embodiment, the computing device 400 includes a receiving module 401, a homomorphic operation module 402, and a sending module 403. The receiving module 401 is configured to receive at least one LWE ciphertext and a bootstrap key sent by the first computing device; the receiving module 401 is also configured to receive a data processing request sent by the first computing device; the homomorphic operation module 402 is configured to determine homomorphic operation rules based on the data processing request; if the homomorphic operation rules include a univariate nonlinear function, it determines the LWE ciphertext to be bootstrap based on at least one LWE ciphertext and the univariate nonlinear function; determines a test polynomial based on the univariate nonlinear function; generates an RLWE ciphertext based on the test polynomial, the bootstrap key, and the LWE ciphertext to be bootstrap; generates a bootstrap LWE ciphertext based on the RLWE ciphertext; and determines the homomorphic operation result based on the homomorphic operation rules and the bootstrap LWE ciphertext; the sending module 403 is configured to send the homomorphic operation result to the first computing device.

[0095] In an optional embodiment, the homomorphic operation module 402 is specifically configured to select a bootstrap LWE ciphertext from at least one LWE ciphertext based on the independent variable of the univariate nonlinear function.

[0096] In another optional embodiment, the homomorphic operation module 402 is specifically used to select an LWE ciphertext from at least one LWE ciphertext according to the linear operation rules; perform linear operation on the selected LWE ciphertext according to the linear operation rules; and if the linear operation result of the selected LWE ciphertext is the input data of a univariate nonlinear function, use the linear operation result of the selected LWE ciphertext as the LWE ciphertext to be bootstrapping.

[0097] In another optional embodiment, the homomorphic operation module is specifically used to extract LWE ciphertext samples from RLWE ciphertext; perform key conversion on the LWE ciphertext samples; and perform analog-to-digital conversion on the key conversion result to obtain bootstrap LWE ciphertext.

[0098] In another alternative embodiment, the homomorphic operation module 402 is specifically used to perform steps A to F. Steps A to F can be found in [reference needed]. Figure 5 The corresponding description in the illustrated embodiment.

[0099] As an example of a software functional unit, the homomorphic operation module 402 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, or a container. Further, the aforementioned computing instance may be one or more. For example, the homomorphic operation module 402 may include code running on multiple hosts / virtual machines / containers. It should be noted that the multiple hosts / virtual machines / containers used to run the code may be distributed in the same region or in different regions. Further, the multiple hosts / virtual machines / containers used to run the code may be distributed in the same availability zone (AZ) or in different AZs, each AZ including one or more geographically proximate data centers. Typically, a region may include multiple AZs.

[0100] Similarly, multiple hosts / virtual machines / containers used to run this code can be distributed within the same Virtual Private Cloud (VPC) or across multiple VPCs. Typically, a VPC is set up within a region. Communication between two VPCs within the same region, as well as between VPCs in different regions, requires a communication gateway to be set up within each VPC to enable interconnection between VPCs.

[0101] As an example of a hardware functional unit, the homomorphic operation module 402 may include at least one computing device, such as a server. Alternatively, the homomorphic operation module 402 may also be a device implemented using an application-specific integrated circuit (ASIC) or a programmable logic device (PLD). The PLD may be implemented using a complex programmable logical device (CPLD), a field-programmable gate array (FPGA), generic array logic (GAL), or any combination thereof.

[0102] The homomorphic operation module 402 includes multiple computing devices that can be distributed in the same region or in different regions. Similarly, the homomorphic operation module 402 can be distributed within the same Availability Zone (AZ) or in different AZs. Likewise, the homomorphic operation module 402 can be distributed within the same Virtual Private Cloud (VPC) or in multiple VPCs. These multiple computing devices can be any combination of computing devices such as servers, ASICs, PLDs, CPLDs, FPGAs, and GALs.

[0103] It should be noted that, in other embodiments, the homomorphic operation module 402 can be used to perform... Figure 5 In the illustrated embodiment, the receiving module 401 can execute any step of the fully homomorphic encryption / decryption method. Figure 5 In the fully homomorphic encryption / decryption method shown in the embodiment, the sending module 403 can be used to execute any step. Figure 5 In the fully homomorphic encryption and decryption method shown in the embodiment, each module is responsible for implementing any step, and the steps can be specified as needed. By having each module implement different steps in the fully homomorphic encryption and decryption method, all functions of the second computing device can be realized.

[0104] The following is combined Figure 5 This application introduces the fully homomorphic encryption and decryption method; please refer to [link / reference]. Figure 5 One embodiment of the fully homomorphic encryption / decryption method of this application includes:

[0105] Step 501: The first computing device selects noise values ​​from a Gaussian distribution.

[0106] When the standard deviation of a Gaussian distribution is greater than or equal to 3.2, using the noise value from that distribution for fully homomorphic encryption provides good security. For Gaussian distributions with a standard deviation < 3.2 and those with a standard deviation ≥ 3.2, encryption using the noise value from the former distribution is less secure than encryption using the noise value from the latter distribution.

[0107] Step 502: The first computing device encodes the message into encoded data using the plaintext modulus and noise value.

[0108] The encoded data equals the product of the plaintext modulus and the noise value, plus the message value. The encoded data is denoted as LSB_Encode(m), where LSB_Encode(m) = m + te. m is the message value (i.e., the numerical value corresponding to the message), and the range of m is t, for example... t is the plaintext modulus. e is the noise value. because and Therefore, it can be guaranteed There are N possible values ​​for the encoded data.

[0109] Step 503: The first computing device obtains the random vector, the private key, and the bootstrap key.

[0110] Specifically, from Z q Select n elements as a random vector. Z q It is a set of q integers.

[0111] Optionally, the private key s consists of n elements, each belonging to {0,1}, meaning each element has a value of 0 or 1. Alternatively, the private key s consists of n elements, each belonging to {-1,0,1}, meaning each element has a value of -1, 0, or 1.

[0112] Step 504: The first computing device uses a random vector and a private key to encrypt the encoded data into LWE ciphertext.

[0113] Optionally, step 504 includes: calculating the inner product of the private key and the random vector; subtracting the inner product from the encoded data to obtain the modulus parameter value to be taken; performing a modulo operation on the modulus of the ciphertext using the modulus parameter value to be taken; and combining the random vector and the first parameter value obtained from the modulo operation to form the LWE ciphertext.

[0114] The LWE ciphertext is denoted as (a, b), where a is a random vector and b is the first parameter value. The private key s, random vector a, encoded data LSB_Encode(m), ciphertext modulus q, and first parameter value b satisfy the following formula: b = (-<a,s> +LSB_Encode(m))modq. The value of q is a positive integer multiple of 2N, such as 2N, 4N.

[0115] Steps 501 to 504 can encrypt d messages into d LWE ciphertexts, with each message corresponding to one LWE ciphertext. d is a positive integer, and its value can be set according to the actual situation.

[0116] Step 505: The first computing device sends the bootstrap key and at least one LWE ciphertext bootstrap key to the second computing device.

[0117] Step 506: The first computing device sends a data processing request to the second computing device.

[0118] Steps 505 and 506 can be executed separately or together. When steps 505 and 506 are executed simultaneously, the data processing request can carry a bootstrap key and one or more LWE ciphertexts.

[0119] Step 507: The second computing device determines the homomorphic operation rules based on the data processing request.

[0120] Homomorphic operation rules include univariate nonlinear functions and / or linear operation rules. The independent variable value of the univariate nonlinear function can be the LWE ciphertext sent by the first computing device, or the bootstrap LWE ciphertext obtained by programmably bootstrapping any LWE ciphertext based on the univariate nonlinear function, or the LWE ciphertext calculated based on the linear operation rules. The input data of the linear operation rules includes one or more of the following: the LWE ciphertext sent by the first computing device, the bootstrap LWE ciphertext obtained by programmably bootstrapping any LWE ciphertext based on the univariate nonlinear function, or the LWE ciphertext calculated based on the linear operation rules.

[0121] Step 508: When the homomorphic operation rule includes a univariate nonlinear function, the second computing device determines the LWE ciphertext to be bootstrapping based on at least one LWE ciphertext and the univariate nonlinear function.

[0122] Optionally, step 508 includes: selecting a bootstrap LWE ciphertext from at least one LWE ciphertext based on the independent variable of the univariate nonlinear function. The bootstrap LWE ciphertext is the LWE ciphertext selected from at least one LWE ciphertext and serves as the independent variable of the univariate nonlinear function.

[0123] For example, LWE(m1) is a univariate nonlinear function f(x) = 3x 2 The input data is used to determine that LWE(m1) is the LWE ciphertext to be bootstrapping.

[0124] Alternatively, step 508 includes: if the homomorphic operation rule includes a linear operation rule, selecting an LWE ciphertext from at least one LWE ciphertext according to the linear operation rule; performing a linear operation on the selected LWE ciphertext according to the linear operation rule; if the linear operation result of the selected LWE ciphertext is the input data of a univariate nonlinear function, using the linear operation result of the selected LWE ciphertext as the LWE ciphertext to be bootstrapping.

[0125] For example, if LWE(m2) and LWE(m3) are both input data for f(x) = 2x + 1, then LWE(m2) and LWE(m3) are both bootstrap LWE ciphertexts. It should be understood that univariate linear functions belong to the linear operation rules.

[0126] For example, LWE(m4), LWE(m5), and LWE(m6) are the input data for the multivariate function y = 4x1 + 2x2 + x3, and f(y) = y 2 The linear operation result of LWE(m4), LWE(m5), and LWE(m6) is determined to be 4LWE(m4) + 2LWE(m5) + LWE(m6), which is the LWE ciphertext to be bootstrapping. When the weight of each LWE ciphertext is 1, the linear operation result of multiple LWE ciphertexts is the sum of the multiple LWE ciphertexts.

[0127] Step 509: The second computing device determines the test polynomial based on the univariate nonlinear function.

[0128] Specifically, the second computing device can generate a test polynomial based on a univariate nonlinear function. Alternatively, the second computing device can pre-store a mapping set of test polynomials and univariate nonlinear functions, and look up the test polynomial from the mapping set based on the univariate nonlinear function.

[0129] Optionally, the univariate nonlinear function f() and the test polynomial testP satisfy the following formula:

[0130]

[0131] Step 510: The second computing device rotates the LWE ciphertext to be bootstrapping according to the test polynomial and the bootstrap key.

[0132] The LWE ciphertext to be bootstrapping can be denoted as (a”, b”), where a” is the vector to be processed and b” is the parameter value to be processed. Step 510 specifically includes steps A to F.

[0133] Step A: Set the first variable in the accumulator's variable group to 0, and set the second variable in the accumulator's variable group to X. b” The product of the test polynomial;

[0134] Step B: Set i to 0;

[0135] Step C: Determine if i is less than n. If i is less than n, proceed to step D; if i is equal to n, proceed to step F.

[0136] Step D: Calculate the accumulator's variable set, the vector to be processed, and the bootstrap key according to the formula corresponding to the bootstrap key, and update the accumulator's variable set with the calculation result;

[0137] Step E: Calculate i+1, update i to i+1, and jump to step C;

[0138] Step F: Determine the variable group of the RLWE ciphertext as the accumulator.

[0139] Optionally, the bootstrap key consists of n elements, and the formula corresponding to the bootstrap key is: acc is the variable set of the accumulator, a i " represents the i-th element of the vector to be processed, bsk i It is the i-th element of the bootstrap key.

[0140] Alternatively, the bootstrap key includes a first subkey and a second subkey, and the formula corresponding to the bootstrap key is as follows: acc is the variable set of the accumulator, a i " represents the i-th element of the vector to be processed, bsk i,0 bsk is the i-th element of the first subkey. i,1 It is the i-th element of the second subkey.

[0141] Step 511: The second computing device generates a bootstrap LWE ciphertext based on the RLWE ciphertext obtained from the blind rotation.

[0142] Optionally, step 511 includes: extracting LWE ciphertext samples from RLWE ciphertext; performing key conversion on the LWE ciphertext samples; performing analog-to-digital conversion on the key conversion result, and the analog-to-digital conversion result is the bootstrap LWE ciphertext.

[0143] Specifically, the first computing device can generate a conversion key based on the private key, the key, and the base, and the second computing device can receive the conversion key sent by the first computing device. The LWE ciphertext sample is then converted using the conversion key to obtain the ciphertext conversion result. The LWE ciphertext sample can be considered as LWE ciphertext encrypted using key s', and the ciphertext conversion result can be considered as LWE ciphertext encrypted using the private key. The ciphertext modulus of the ciphertext conversion result is Q.

[0144] Private key s, key s', base B ks and conversion key ksk i,j,v Satisfy the following formula: For base B ks The j-th element.

[0145] The second computing device performs an analog-to-digital conversion on the ciphertext conversion result obtained from the key conversion. The ciphertext conversion result is denoted as ct, where ct = (a,b) mod Q. The bootstrap LWE ciphertext is denoted as LWE. s (f(m))=(a',b')mod q,b'=-<a’,s> +f(m)+te'.

[0146] The programmable bootstrapping process of this application includes steps 509 to 511. Nonlinear operations can be implemented based on univariate nonlinear functions, and linear operations can be implemented based on linear operation rules. When the homomorphic operation rules include both univariate nonlinear functions and linear operation rules, various complex operations can be implemented based on these homomorphic operation rules. The univariate nonlinear function can be set according to actual conditions, thus serving a programmable function.

[0147] Step 512: The second computing device determines the homomorphic operation result based on the homomorphic operation rules and the bootstrap LWE ciphertext.

[0148] The second computing device performs programmable bootstrapping on the LWE ciphertext to be bootstrapping, and then performs operations on the bootstrapping LWE ciphertext based on the residual rules of homomorphic operations to obtain the homomorphic operation result. The residual rules are the portion obtained by removing the aforementioned univariate nonlinear function and linear operation rules from the homomorphic operation rules. The residual rules can be set according to actual conditions, and this application does not impose any limitations.

[0149] Step 513: The second computing device sends the homomorphic operation result to the first computing device.

[0150] Step 514: The first computing device decrypts the homomorphic operation result using the private key.

[0151] The homomorphic operation result includes the target vector and the second parameter value. Specifically, step 514 includes: adding the inner product of the private key and the target vector to the second parameter value, i.e., b' +<a’,s> =f(m)+te'; The result of the addition operation is modulo the ciphertext modulus, and then the result of the modulo operation is modulo the plaintext modulus. That is, (f(m)+te')mod q modulo t to get f(m).

[0152] In this embodiment, since the encoded data equals the product of the plaintext modulus and the noise value plus the message value, and the message value is less than the plaintext modulus, the message is in the lower bits of the encoded data, and the multiple of the noise value is in the higher bits of the encoded data. During programmable bootstrapping, the value range of m is [0, t), and the value range of the encoded data is... The range of message values ​​has been expanded. This allows for fully programmable bootstrapping of LWE ciphertexts using a test polynomial with N coefficients, supporting linear operations in the modular sense, and thus has a wider range of applicability.

[0153] Secondly, programmable bootstrapping of the LWE ciphertext to be bootstrapping using a univariate nonlinear function can be considered as performing a homomorphic univariate nonlinear function operation on the LWE ciphertext. Each programmable bootstrapping can perform one homomorphic computation of the univariate nonlinear function, thus the computation speed is very fast.

[0154] Furthermore, LWE ciphertext has good security. The recipient of LWE ciphertext cannot identify the message corresponding to LWE ciphertext. Moreover, the second computing device can perform homomorphic operations according to the data processing request. The result of the homomorphic operation is the same as the result obtained by performing the data operation corresponding to the data processing request on the message.

[0155] When the elements of the private key belong to {0,1}, the private key can be represented as s∈{0,1}. n When the elements of the private key belong to {-1, 0, 1}, the private key can be represented as s∈{-1, 0, 1}. n The two private keys correspond to different bootstrap keys, which will be introduced below:

[0156] When s∈{0,1} n At this time, the relationship between the private key and the bootstrap key of the binary number satisfies the following formula: Among them, s i bsk is the i-th element of the private key. i Let be the i-th element of the bootstrap key. The key s' consists of N elements, each belonging to Z. N Z N It is a set of integers containing N values.

[0157] Specifically, based on the use of keys s′ and 2l g RLWE encryption of 0 using random vectors yields 2l g RLWE ciphertext, i.e. ct i ∈RLWE s′ (0). 2l g A concatenation of random vector columns forms an RLWE ciphertext matrix, which can be used as a ciphertext matrix. The gadget matrix satisfies... I n Represents the identity matrix. Represents the tensor product. g T This is the transpose of the gdget vector g. B g B is the basis of g. g The value can be set according to the actual situation, and this application does not impose any restrictions.

[0158] In this application, the formula corresponding to the bootstrap key is: At that time, steps A to F correspond to steps 601 to 606, respectively. When the formula corresponding to the bootstrap key is... At that time, steps A to F correspond to steps 701 to 706 respectively.

[0159] The following is combined Figure 6 For using the bootstrap key bsk i The process of performing blind rotation is described. In one optional embodiment, step 510 includes:

[0160] Step 601, acc = (0, X b” ·testP).

[0161] Step 602, i = 0.

[0162] Step 603: Determine if i is less than n. If i is less than n, proceed to step 604. If i is equal to n, proceed to step 606.

[0163] Step 604 acc is the variable set of the accumulator, a i " is the i-th element of the bootstrap vector to be bootstrapping, bsk i It is the i-th element of the bootstrap key.

[0164] Step 605, i = i + 1, jump to step 603.

[0165] Step 606: When i equals n, determine the variable group of the RLWE ciphertext as the accumulator.

[0166] After calculation by the accumulator, it can be determined When the LWE ciphertext to be bootstrapping is the LWE ciphertext sent by the first computing device, and the encoded data corresponding to this LWE ciphertext is m+te, then When e = -1 and m = 1, then m + te = 1 - t, at which point X m+te =X 1-t Because in testP, f(1)X t-1 With X 1-t The product of these terms is a constant term, and the other terms of testP are related to X. 1-t The product of these terms is not a constant term. This allows us to determine that testP*X m+te The constant term is f(1), which is f(m). Thus, the RLWE ciphertext is equal to RLWE. s′ (f(m)+c1X+…+c N-1 X N-1 ,c1~c N-1 These are polynomial coefficients, which are independent of the results of homomorphic operations. `testP` has N coefficients, which can be pre-set by enumerating integers in the range [0, N-1]. This allows for lookup table operations based on the `testP` coefficients.

[0167] When s∈{-1,0,1} n At that time, the bootstrap key is denoted as (bsk). i,0 ,bsk i,1 ), i∈[0,n-1]. bsk i,0 bsk is the i-th element of the first subkey. i,1 Let be the i-th element of the second subkey. The bootstrap key and the private key satisfy the following relationship: when s i =-1, then bsk i,0 =RGSW s′ (0),bsk i,1 =RGSW s′ (1); when s i =1, then bsk i,0 =RGSW s′ (1),bsk i,1 =RGSWs′ (0); when s i =0, then bsk i,0 =RGSW s′ (0),bsk i,1 =RGSW s′ (0). Where, s i Let be the i-th element of the private key. The key s' consists of N elements, each belonging to Z. N Z N It is a set of integers containing N values.

[0168] The following is combined Figure 7 For the use of bootstrap keys (bsk) i,0 ,bsk i,1 The process of performing blind rotation is described below. In another alternative embodiment, step 510 includes:

[0169] Step 701: acc = (0, X b” ·testP).

[0170] Step 702: i = 0.

[0171] Step 703: Determine if i is less than n. If i is less than n, proceed to step 704. If i is equal to n, proceed to step 706.

[0172] Step 704: acc is the variable set of the accumulator, a i " is the i-th element of the random vector, bsk i It is the i-th element of the bootstrap key.

[0173] Step 705: i = i + 1, jump to step 703.

[0174] Step 706: When i equals n, determine the RLWE ciphertext as the variable of the accumulator.

[0175] After calculation by the accumulator, it can be determined When the LWE ciphertext to be bootstrapping is the LWE ciphertext sent by the first computing device, and the encoded data corresponding to this LWE ciphertext is m+te, then When e = -1 and m = 1, then m + te = 1 - t, at which point X m+te =X 1-t Because in testP, f(1)X t-1 With X 1-t The product of these terms is a constant term, and the other terms of testP are related to X. 1-t The product of these terms is not a constant term. This allows us to determine that testP*X m+te The constant term is f(1), which is f(m). Thus, the RLWE ciphertext is equal to RLWE.s′ (f(m)+c1X+…+c N-1 X N-1 ,c1~c N-1 These are polynomial coefficients, which are independent of the results of homomorphic operations. `testP` has N coefficients, which can be pre-set by enumerating integers in the range [0, N-1]. This allows for lookup table operations based on the `testP` coefficients.

[0176] In an optional embodiment, the fully homomorphic encryption and decryption method of this application further includes: when the homomorphic operation rule includes an identity function, the second computing device determines the LWE ciphertext to be bootstrapping based on the independent variable of the identity function, determines the test polynomial based on the identity function, performs blind rotation on the LWE ciphertext to be bootstrapping based on the test polynomial and the bootstrapping key; generates bootstrapping LWE ciphertext based on the RLWE ciphertext obtained from the blind rotation; and determines the homomorphic operation result based on the homomorphic operation rule and the bootstrapping LWE ciphertext.

[0177] In this embodiment, the LWE ciphertext to be bootstrapping is the independent variable of the identity function. The value of the independent variable of the identity function can be the LWE ciphertext sent by the first computing device, or the bootstrap LWE ciphertext obtained by programmably bootstrapping any LWE ciphertext based on a univariate nonlinear function, or the LWE ciphertext calculated based on linear operation rules.

[0178] Using the test polynomial corresponding to the identity function can bootstrap the LWE ciphertext to be bootstrapped, thereby reducing the noise in the LWE ciphertext to be bootstrapped.

[0179] The following examples illustrate the bootstrapping method of this application. In one example, the identity function can be expressed as f(x) = x. With the private key elements belonging to {0, 1} and the parameter values ​​for fully homomorphic encryption / decryption as shown in Table 1, the bootstrapping time is 111 milliseconds (ms).

[0180] n N σ t q Q <![CDATA[B g ]]> <![CDATA[l g ]]> <![CDATA[B ks ]]> <![CDATA[l ks ]]> 830 1024 3.19 23 2048 <![CDATA[≈2 27 ]]> <![CDATA[2 9 ]]> 3 <![CDATA[2 7 ]]> 4

[0181] Table 1

[0182] Where n is the dimension of the private key (i.e., the total number of elements in the private key), and also the dimension of the random vector.

[0183] N is the dimension of the polynomial ring.

[0184] σ is the standard deviation of the Gaussian distribution.

[0185] t is the plaintext modulus.

[0186] q is the ciphertext modulus. q satisfies q = 2N and q ≡ 1 mod t.

[0187] Q is the ciphertext modulus before modulus conversion. Q is a prime number, so Q satisfies Q ≡ 1 mod 2N, based on which number theoretic transforms (NTT) can be used for accelerated operations.

[0188] B g is the basis of the gadget vector, and l g is the length of the gadget vector.

[0189] B ks is the basis used for key conversion, and l ks is the length of the vector expansion of the LWE ciphertext sample according to B ks

[0190] In another example, taking the identity function as an example, when the private key elements belong to {-1, 0, 1} and the parameters of the fully homomorphic encryption and decryption method are as shown in Table 2, the bootstrapping duration is 121 milliseconds.

[0191] n N σ t q Q <![CDATA[B g ]]> <![CDATA[l g ]]> <![CDATA[B ks ]]> <![CDATA[l ks ]]> 512 1024 3.19 23 2048 <![CDATA[≈2 27 ]]> <![CDATA[2 9 ]]> 3 <![CDATA[2 7 ]]> 4

[0192] Table 2

[0193] In another example, the unary non-linear function is the Relu function, and the Relu function is a non-linear function in the neural network model. The Relu function is:

[0194]

[0195] where λ ~ U(l, u), l < u and l ∈ [0, 1), u ∈ [0, 1).

[0196] When the private key elements belong to {-1, 0, 1} and the parameters of the fully homomorphic encryption and decryption method are as shown in Table 3, the bootstrapping duration is 388 milliseconds.

[0197] n N σ t q Q <![CDATA[B g ]]> <![CDATA[l g ]]> <![CDATA[B ks ]]> <![CDATA[l ks ]]> 1024 2048 3.19 35 4096 <![CDATA[≈2 50 ]]> <![CDATA[2 25 ]]> 2 <![CDATA[2 17 ]]> 3

[0198] Table 3

[0199] It should be noted that the parameters, private keys, and functions in the above examples are all illustrative examples and do not limit this application. As can be seen from the above examples, the fully homomorphic encryption and decryption method of this application can perform linear operations or non-linear operations over the entire domain, so it can be applied to all calculation scenarios.

[0200] This application also provides a computing device 800, such as Figure 8 ​As shown, the computing device 800 includes a bus 802, a processor 804, a memory 806, and a communication interface 808. The processor 804, the memory 806, and the communication interface 808 communicate with each other via the bus 802. The computing device 800 can be a server or a terminal device. It should be understood that this application does not limit the number of processors and memories in the computing device 800.

[0201] The 802 bus can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of representation, Figure 8 The bus 804 may be represented by a single line, but this does not mean that there is only one bus or one type of bus. The bus 804 may include a path for transmitting information between various components of the computing device 800 (e.g., memory 806, processor 804, communication interface 808).

[0202] Processor 804 may include any one or more processors such as a central processing unit (CPU), a graphics processing unit (GPU), a microprocessor (MP), or a digital signal processor (DSP).

[0203] The memory 806 may include volatile memory, such as random access memory (RAM). The processor 804 may also include non-volatile memory, such as read-only memory (ROM), flash memory, hard disk drive (HDD), or solid state drive (SSD).

[0204] The memory 806 stores executable program code. In one optional embodiment, the processor 804 executes the executable program code to implement the functions of the aforementioned encryption module, sending module, receiving module, decryption module, and key module, thereby implementing a fully homomorphic encryption / decryption method. In another optional embodiment, the processor 804 executes the executable program code to implement the functions of the aforementioned receiving module, homomorphic operation module, and sending module, thereby implementing a fully homomorphic encryption / decryption method. That is, the memory 806 stores instructions for executing the fully homomorphic encryption / decryption method.

[0205] The communication interface 808 uses transceiver modules such as, but not limited to, network interface cards and transceivers to enable communication between the computing device 800 and other devices or communication networks.

[0206] This application also provides a computing device cluster. The computing device cluster includes at least one computing device. The computing device can be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device can also be a terminal device such as a desktop computer, a laptop computer, or a smartphone.

[0207] like Figure 9 As shown, the computing device cluster includes at least one computing device 800. The memory 806 in one or more computing devices 800 in the computing device cluster may store the same instructions for performing fully homomorphic encryption and decryption methods.

[0208] In some possible implementations, the memory 806 of one or more computing devices 800 in the computing device cluster may also store partial instructions for executing the fully homomorphic encryption / decryption method. In other words, a combination of one or more computing devices 800 can jointly execute instructions for executing the fully homomorphic encryption / decryption method.

[0209] It should be noted that the memories 806 in different computing devices 800 within the computing device cluster can store different instructions, each used to execute a portion of the computing device's functions. That is, the instructions stored in the memories 806 of different computing devices 800 can implement the functions of one or more modules among the encryption module, the sending module, the receiving module, and the key module.

[0210] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN), a local area network (LAN), or similar. Figure 10 One possible implementation is shown. For example... Figure 10As shown, two computing devices 800A and 800B are connected via a network. Specifically, they are connected to the network through communication interfaces in each computing device. In this possible implementation, the memory 806 in computing device 800A stores instructions for performing the functions of the receiving and transmitting modules. Meanwhile, the memory 806 in computing device 800B stores instructions for performing the functions of the encryption, decryption, and key modules.

[0211] In some possible implementations, one or more computing devices in a computing device cluster can be connected via a network. This network can be a wide area network (WAN), a local area network (LAN), or similar. Figure 11 One possible implementation is shown. For example... Figure 11 As shown, two computing devices 800A and 800B are connected via a network. Specifically, they are connected to the network through communication interfaces in each computing device. In this possible implementation, the memory 806 in computing device 800A stores instructions for performing the functions of a receiving module, a transmitting module, an encryption module, a decryption module, and a key module. Simultaneously, the memory 806 in computing device 800B stores instructions for performing the functions of a receiving module, a transmitting module, and a homomorphic operation module.

[0212] This application also provides a computer program product containing instructions. The computer program product may be a software or program product containing instructions capable of running on a computing device or stored on any usable medium. When the computer program product runs on at least one computing device, it causes the at least one computing device to perform a fully homomorphic encryption / decryption method.

[0213] This application also provides a computer-readable storage medium. The computer-readable storage medium can be any usable medium that a computer can store, or a data storage device such as a data center containing one or more usable media. The usable medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid-state drive). The computer-readable storage medium includes instructions that instruct a computer to perform a fully homomorphic encryption / decryption method.

[0214] This application also provides a chip system comprising a processor and a memory coupled together. The memory stores computer programs or instructions, and the processor executes the computer programs or instructions stored in the memory to cause the server to perform the steps described in the above embodiments. Optionally, the memory is on-chip memory, such as registers, caches, etc., or it can be off-chip memory within the site, such as read-only memory or other types of static storage devices capable of storing static information and instructions, random access memory, etc. The processor mentioned above can be a general-purpose central processing unit, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for implementing the above-described fully homomorphic encryption / decryption method.

[0215] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0216] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection between apparatuses or units through some interfaces, and may be electrical, mechanical, or other forms.

[0217] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0218] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0219] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

Claims

1. A fully homomorphic encryption and decryption method, characterized by, The method is applied to a data processing system comprising a first computing device and a second computing device, the first computing device storing a private key and a bootstrapping key, and the second computing device being configured to perform homomorphic operations, the method comprising: selecting a noise value from a Gaussian distribution; encoding a message into encoded data using a plaintext modulus and the noise value, the encoded data being equal to a sum of a product of the plaintext modulus and the noise value and a message value, the message value corresponding to the message and being less than the plaintext modulus; obtaining a random vector, the private key and the bootstrapping key; encrypting the encoded data into a learning with errors (LWE) ciphertext using the random vector and the private key; sending the bootstrapping key and at least one of the LWE ciphertexts to the second computing device; sending a data processing request to the second computing device; receiving a homomorphic operation result sent by the second computing device, the homomorphic operation result being obtained by the second computing device performing a homomorphic operation on at least one of the LWE ciphertexts according to the data processing request; and decrypting the homomorphic operation result according to the private key.

2. The method of claim 1, wherein, The encrypting the encoded data into a LWE ciphertext using the random vector and the private key comprises: calculating an inner product of the private key and the random vector; subtracting the inner product from the encoded data to obtain a to-be-modulo parameter value; performing a modulo operation on the to-be-modulo parameter value with respect to a ciphertext modulus; and composing the LWE ciphertext with the random vector and a first parameter value obtained by the modulo operation.

3. The method of claim 1, wherein, The homomorphic operation result comprises a target vector and a second parameter value, and the decrypting the homomorphic operation result according to the private key comprises: performing an addition operation on an inner product of the private key and the target vector and the second parameter value; performing a modulo operation on a result of the addition operation with respect to a ciphertext modulus; and performing a modulo operation on a result of the modulo operation with respect to the plaintext modulus.

4. The method according to any one of claims 1 to 3, characterized in that, The method further comprises: performing RGSW encryption on the private key to obtain the bootstrapping key.

5. A fully homomorphic encryption and decryption method, characterized by, The method is applied to a data processing system comprising a first computing device and a second computing device, the first computing device storing a private key and a bootstrapping key, and the method comprising: receiving a bootstrapping key and at least one learning with errors (LWE) ciphertext sent by the first computing device, the LWE ciphertext being encrypted from encoded data using a random vector and the private key, the encoded data being encoded from a message using a plaintext modulus and a noise value, the noise value being selected from a Gaussian distribution, the encoded data being equal to a sum of a product of the plaintext modulus and the noise value and a message value, the message value corresponding to the message and being less than the plaintext modulus, and receiving a data processing request sent by the first computing device; determining a homomorphic operation rule according to the data processing request; in a case where the homomorphic operation rule comprises a unary nonlinear function, determining a to-be-bootstrapped LWE ciphertext according to at least one of the LWE ciphertexts and the unary nonlinear function; determining a test polynomial according to the unary nonlinear function; blindly rotating the to-be-bootstrapped LWE ciphertext according to the test polynomial and the bootstrapping key; and performing a homomorphic operation on the blindly rotated to-be-bootstrapped LWE ciphertext according to the homomorphic operation rule. The RLWE ciphertext generated by the blind rotation on the ring generates the bootstrapped LWE ciphertext from the fault-tolerant learning; The homomorphic operation result is determined according to the homomorphic operation rule and the bootstrapped LWE ciphertext; The homomorphic operation result is sent to the first computing device.

6. The method of claim 5, wherein, The LWE ciphertext to be bootstrapped is determined according to at least one LWE ciphertext and the unary nonlinear function, and includes: The LWE ciphertext to be bootstrapped is selected from the at least one LWE ciphertext according to the independent variable of the unary nonlinear function.

7. The method of claim 5, wherein, The homomorphic operation rule further includes a linear operation rule; The LWE ciphertext to be bootstrapped is determined according to at least one LWE ciphertext and the unary nonlinear function, and includes: The LWE ciphertext is selected from at least one LWE ciphertext according to the linear operation rule; The selected LWE ciphertext is linearly operated according to the linear operation rule; In a case where the linear operation result is input data of the unary nonlinear function, the linear operation result is taken as the LWE ciphertext to be bootstrapped.

8. The method of claim 5, wherein, The unary nonlinear function and the test polynomial satisfy the following formula: ； wherein is a test polynomial, is a univariate nonlinear function, the test polynomial including the N coefficients, , , the is a base, the q is a ciphertext modulus, and the t is the plaintext modulus.

9. The method according to any one of claims 5 to 8, characterized in that, The RLWE ciphertext generated by the blind rotation on the ring generates the bootstrapped LWE ciphertext from the fault-tolerant learning, and includes:

10. The method according to any one of claims 5 to 8, characterized in that, The LWE ciphertext sample is extracted from the RLWE ciphertext; the LWE ciphertext sample is subjected to key conversion; and the key conversion result is subjected to analog-digital conversion to obtain the bootstrapped LWE ciphertext. Step A: setting a first variable of a variable group of an accumulator to 0 and a second variable of the variable group of the accumulator to a product with a test polynomial, is a parameter value to be processed; The LWE ciphertext to be bootstrapped includes a to-be-processed vector and a to-be-processed parameter value, and the LWE ciphertext to be bootstrapped is subjected to blind rotation according to the test polynomial and the bootstrap key, and includes: Step B: set i equal to 0; Step C: determine whether i is less than n, execute step D when i is less than n, and execute step F when i is equal to n, wherein n is the number of elements in the bootstrap key; Step D: calculate the variable group of the accumulator, the to-be-processed vector and the bootstrap key according to the formula corresponding to the bootstrap key, and update the variable group of the accumulator to the calculation result; Step E: calculate i+1, update i to i+1, and jump to step C; 11. The method of claim 10, wherein, The bootstrap key comprises n elements, and a formula corresponding to the bootstrap key is , wherein is a variable group of an accumulator, is an i th element of the to-be-processed vector, and is an i th element of the bootstrap key.

12. The method of claim 10, wherein, The bootstrap key comprises a first sub-key and a second sub-key, and a corresponding formula of the bootstrap key is , wherein is a variable group of an accumulator, is an i-th element of the to-be-processed vector, is an i-th element of the first sub-key, and is an i-th element of the second sub-key.

13. A computing device, comprising: Step F: determine that the RLWE ciphertext is the variable group of the accumulator. It includes: The encryption module is configured to select a noise value from a Gaussian distribution; The message is encoded into encoded data using a plaintext modulus and the noise value, the encoded data being equal to the sum of the product of the plaintext modulus and the noise value and a message value, the message value corresponding to the message and the message value being less than the plaintext modulus; a random vector, a private key and a bootstrap key are obtained; The encoded data is encrypted into a fault-tolerant learning LWE ciphertext using the random vector and the private key; The sending module is configured to send the bootstrap key and at least one LWE ciphertext to a second computing device; The sending module is further configured to send a data processing request to the second computing device; The receiving module is configured to receive a homomorphic operation result sent by the second computing device, the homomorphic operation result being obtained by the second computing device from homomorphic operation on at least one LWE ciphertext according to the data processing request; The decryption module is configured to decrypt the homomorphic operation result according to the private key.

14. The computing device of claim 13, wherein, The encryption module is specifically configured to calculate an inner product of the private key and the random vector; subtract the inner product from the encoded data to obtain a to-be-modulo parameter value; perform modulo operation on the to-be-modulo parameter value with respect to a ciphertext modulus; and compose the random vector and the first parameter value obtained through the modulo operation to obtain the LWE ciphertext.

15. The computing device of claim 13, wherein, The homomorphic operation result includes a target vector and a second parameter value, and the decryption module is specifically configured to perform addition operation on the inner product of the private key and the target vector and the second parameter value; perform modulo operation on the addition operation result with respect to the ciphertext modulus; and perform modulo operation on the modulo operation result with respect to the plaintext modulus.

16. The computing device of any of claims 13 to 15, wherein, The computing device further includes: The key module is configured to perform RGSW encryption on the private key to obtain the bootstrap key.

17. A computing device, comprising: The computing device further includes: The receiving module is configured to receive the bootstrap key and at least one fault-tolerant learning LWE ciphertext sent by the first computing device, the LWE ciphertext being obtained by encrypting encoded data using a random vector and a private key, the encoded data being obtained by encoding a message using a plaintext modulus and a noise value, the noise value being selected from a Gaussian distribution, the encoded data being equal to a product of the plaintext modulus and the noise value and a message value, the message value corresponding to the message and being less than the plaintext modulus; The receiving module is further configured to receive a data processing request sent by the first computing device; The homomorphic operation module is configured to determine a homomorphic operation rule according to the data processing request, determine to-be-bootstrapped LWE ciphertext according to at least one LWE ciphertext and a univariate nonlinear function in a case where the homomorphic operation rule includes the univariate nonlinear function, and determine a test polynomial according to the univariate nonlinear function; blindly rotate the to-be-bootstrapped LWE ciphertext according to the test polynomial and the bootstrap key, generate a bootstrapped LWE ciphertext according to a ring fault-tolerant learning RLWE ciphertext obtained through the blind rotation, and determine a homomorphic operation result according to the homomorphic operation rule and the bootstrapped LWE ciphertext; The sending module is configured to send the homomorphic operation result to the first computing device.

18. The apparatus of claim 17, wherein, The homomorphic operation module is specifically configured to select to-be-bootstrapped LWE ciphertext from at least one LWE ciphertext according to an independent variable of the univariate nonlinear function.

19. The apparatus of claim 17, wherein, The homomorphic operation module is specifically configured to select LWE ciphertext from at least one LWE ciphertext according to a linear operation rule, and perform linear operation on the selected LWE ciphertext according to the linear operation rule. In a case where the linear operation result is input data of a univariate nonlinear function, the linear operation result is taken as to-be-bootstrapped LWE ciphertext.

20. The apparatus of claim 17, wherein, The univariate nonlinear function and the test polynomial satisfy the following formula: ； wherein is a test polynomial, is a univariate nonlinear function, the test polynomial including the N coefficients, , , the is a base, the q is a ciphertext modulus, and the t is the plaintext modulus.

21. The apparatus of any one of claims 17-20, wherein, The homomorphic operation module is specifically configured to extract an LWE ciphertext sample from the RLWE ciphertext, perform key conversion on the LWE ciphertext sample, and perform modulus conversion on the key conversion result to obtain a bootstrapped LWE ciphertext.

22. The apparatus of any one of claims 17-20, wherein, The homomorphic operation module is specifically configured to perform the following steps: Step A: setting a first variable of a variable set of an accumulator to 0, a second variable of the variable set of the accumulator to a product with the test polynomial, the is a parameter value to be processed; Step B: set i to 0; Step C: judging whether i is less than n, when i is less than n, executing Step D, when i is equal to n, executing Step F, the n is the number of elements in the bootstrap key; Step D: calculating the accumulator's variable group, the to-be-processed vector and the bootstrap key according to the formula corresponding to the bootstrap key, updating the accumulator's variable group as the calculation result; Step E: calculating i+1, updating i to i+1, and jumping to Step C; Step F: determining the RLWE ciphertext as the accumulator's variable group.

23. The apparatus of claim 22, wherein, The bootstrap key comprises n elements, and the formula corresponding to the bootstrap key is: The For the variable group of the accumulator, For the i-th element of the vector to be processed, the It is the i-th element of the bootstrap key.

24. The apparatus of claim 22, wherein, The bootstrap key comprises a first sub-key and a second sub-key, and a corresponding formula of the bootstrap key is , wherein is a variable group of an accumulator, is an i-th element of the to-be-processed vector, is an i-th element of the first sub-key, is an i-th element of the second sub-key.

25. A cluster of computing devices, characterized in that, comprising at least one computing device, each computing device comprising a processor and a memory, the processor of the at least one computing device being configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the method of any one of claims 1 to 12.

26. A computer-readable storage medium, characterized in that, comprising computer program instructions which, when executed by a cluster of computing devices, cause the cluster of computing devices to perform the method of any one of claims 1 to 12.

27. A computer program product comprising instructions, wherein: comprising computer program instructions which, when executed by a cluster of computing devices, cause the cluster of computing devices to perform the method of any one of claims 1 to 12.

Images