Homomorphic encryption system conversion method and system from LWEs to RLWE

Abstract

The invention discloses a homomorphic encryption system conversion method and system from LWEs to RLWE. The method comprises the following steps: preprocessing an LWE ciphertext; 1 LWE ciphertext is input, the ciphertext is composed of mask parts and body parts, the mask parts of the input ciphertext are combined into a matrix A, the body parts of the ciphertext are combined into a vector b, and the matrix A and the vector b are output; 2, on the basis of the preprocessed LWE ciphertext, combining two operations of decryption of a contract state part and conversion of a slot vector into a coefficient; a matrix A, a vector b, a constant matrix U related to STC operation and a conversion key RK are input, and an RLWE ciphertext with large noise is output through homomorphic calculation linear combination; and 3, inputting a large-noise RLWE ciphertext, calculating a lifting modulus, converting a coefficient into a slot vector and solving the modulus, outputting a small-noise RLWE ciphertext, and enabling the plaintext of the ciphertext to correspond to the plaintext of the l LWE ciphertext input in the step 1. According to the invention, a plurality of LWE ciphertexts can be converted into one RLWE ciphertext.

Description

Technical Field

[0001] The present application belongs to the field of information security and privacy protection, and specifically relates to a method and system for converting a homomorphic encryption system from LWEs to RLWE. Background Art

[0002] As a key technology for data privacy protection, fully homomorphic encryption has achieved rapid development in recent years, but there is still a large gap between algorithm efficiency and convenient deployment and large-scale practical application. There are still a lot of theoretical and technical problems to be solved. In terms of fully homomorphic encryption algorithm design, since Gentry proposed the first fully homomorphic encryption scheme in 2009, four generations of fully homomorphic encryption schemes have been produced, represented by Gentry09, BGV (BFV), GSW (TFHE), CKKS and other schemes. Different fully homomorphic encryption schemes are suitable for calculating different types of functions. At present, the design structure of the fully homomorphic encryption scheme has basically taken shape, but for large-scale secret state computing, efficient bootstrapping algorithms are still the research focus of the design of fully homomorphic encryption schemes.

[0003] Different fully homomorphic encryption schemes are suitable for calculating different types of functions, and large-scale encrypted computing has created a need for encryption system conversion. In 2020, Boura and others from the Versailles Mathematics Laboratory proposed the first conversion scheme for different fully homomorphic encryption systems, Chimera, which can realize the mutual conversion of the three encryption systems TFHE, BFV and CKKS, and gave the relationship between ciphertext noise and circuit depth and the upper limit of noise during the conversion process between TFHE and CKKS, which can be used to evaluate the error of ciphertext calculation. In 2021, Alibaba Security Gemini Laboratory released the Pegasus scheme, which greatly improved the efficiency of conversion between the CKKS and FHEW schemes. Summary of the invention

[0004] The purpose of the present invention is to propose a method and system for converting a homomorphic encryption system from LWEs to RLWE, which designs homomorphic partial decryption and thin bootstrapping algorithms as a whole, combines the linear calculation components in the two components, and thus improves the efficiency of the homomorphic encryption system conversion method. The present invention includes the following three steps. The operations in all steps are homomorphic operations on ciphertexts, and homomorphic operations on ciphertexts will cause corresponding changes in plaintexts.

[0005] In order to achieve the above object, the present invention adopts the following technical solution:

[0006] A method for converting a homomorphic encryption system from LWEs to RLWE includes the following steps:

[0007] Step 1: LWE ciphertext preprocessing: Input l LWE ciphertexts, the ciphertext consists of a mask part and a body part, combine the mask part of the input ciphertext into a matrix A, and combine the body part of the ciphertext into a vector b, and output the matrix A and vector b;

[0008] Step 2: Based on the preprocessed LWE ciphertext, combine the two operations of homomorphic partial decryption and slot vector conversion into coefficients; input matrix A, vector b, constant matrix U related to STC operation, and conversion key RK, and output RLWE ciphertext with large noise through homomorphic linear combination calculation;

[0009] Step 3: Input the RLWE ciphertext with large noise, calculate the lifting modulus, convert the coefficients into slot vectors, and find the modulus, and output the RLWE ciphertext with small noise. The plaintext of this ciphertext corresponds to the plaintext of the l LWE ciphertexts input in step 1.

[0010] A further improvement of the present invention is that the specific implementation method of step 1 includes:

[0011] Input l LWE ciphertext Satisfaction relationship Where n is the dimension, q is the ciphertext modulus, b j The body part of the ciphertext is called (a j [0],…,a j [n-1]) is called the mask part of the ciphertext, j∈[l], and the corresponding key is s s , the plain text is m j , the noise is e j , Δ is the increment factor used; the conversion key is the converted key, is the converted ciphertext, Ecd(·) represents the encoding function used in homomorphic encryption, which is usually a linear operation. Indicates is the key, is the dimension, q is the set of RLWE ciphertexts with modulus; the rotation key RotK is the key used in the homomorphic modulus operation; the mask part of the input ciphertext is combined into a matrix A, where A j =(a j [0],…,a j [n-1]); the body part of the ciphertext is formed into a vector b = (b0,…,b l ), output matrix A and vector b.

[0012] A further improvement of the present invention is that the specific implementation method of step 2 includes:

[0013] Input the matrix A and vector b related to the homomorphic partial decryption output in step 1, and the matrix U related to STC, calculate the combined coefficient matrix UA, coefficient vector Ub, and convert the key Homomorphic Computation of Linear Combinations UA s +Ub, output ciphertext with large noise

[0014] A further improvement of the present invention is that the specific implementation method of step 3 includes:

[0015] Input ciphertext with large noise In addition to STC, the remaining three components in the calculation of thin bootstrapping are: lifting modulus coefficients into slot vectors, modulus calculation (EvalMod), and outputting small noise RLWE ciphertext Where R q =R / qR,

[0016] Output a RLWE ciphertext Satisfy relationship b j -as=m+e.

[0017] A homomorphic encryption system conversion system from LWEs to RLWE, comprising:

[0018] The ciphertext preprocessing module inputs l LWE ciphertexts, which are composed of a mask part and a body part. The mask part of the input ciphertext is combined into a matrix A, and the body part of the ciphertext is combined into a vector b. The matrix A and vector b are output.

[0019] The ciphertext conversion module combines the two operations of homomorphic partial decryption and slot vector conversion into coefficients based on the preprocessed LWE ciphertext; it inputs the matrix A, vector b, constant matrix U related to the STC operation, and conversion key RK, and outputs the RLWE ciphertext with large noise through homomorphic linear combination calculation;

[0020] The calculation output module inputs the RLWE ciphertext with large noise, calculates the lifting modulus, converts the coefficients into slot vectors, and finds the modulus, and outputs the RLWE ciphertext with small noise. The plaintext of this ciphertext corresponds to the plaintext of the l LWE ciphertexts input in the ciphertext preprocessing module.

[0021] A further improvement of the present invention is that, in the ciphertext preprocessing module, l LWE ciphertexts are input Satisfaction relationship Where n is the dimension, q is the ciphertext modulus, b j The body part of the ciphertext is called (a j [0],…,a j [n-1]) is called the mask part of the ciphertext, j∈[l], and the corresponding key is s s, the plain text is m j , the noise is e j , Δ is the increment factor used; the conversion key is the converted key, is the converted ciphertext, Ecd(·) represents the encoding function used in homomorphic encryption, which is usually a linear operation. Indicates is the key, is the dimension, q is the set of RLWE ciphertexts with modulus; the rotation key RotK is the key used in the homomorphic modulus operation; the mask part of the input ciphertext is combined into a matrix A, where A j =(a j [0],…,a j [n-1]); the body part of the ciphertext is formed into a vector b = (b0,…,b l ), output matrix A and vector b.

[0022] A further improvement of the present invention is that in the ciphertext conversion module, the matrix A and vector b related to the homomorphic partial decryption output by the ciphertext preprocessing module and the matrix U related to the STC are input, the combined coefficient matrix UA and coefficient vector Ub are calculated, and the conversion key is Homomorphic Computation of Linear Combinations UA s +Ub, output ciphertext with large noise

[0023] A further improvement of the present invention is that in the calculation output module, the ciphertext with large noise is input In addition to STC, the remaining three components in the calculation of thin bootstrapping are: lifting modulus coefficients into slot vectors, modulus calculation (EvalMod), and outputting small noise RLWE ciphertext Where R q =R / qR,

[0024] Output a RLWE ciphertext Satisfy relationship b j -as=m+e.

[0025] An electronic device comprises: a processor and a memory coupled to the processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of a method for converting a homomorphic encryption system from LWEs to RLWE are implemented.

[0026] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a method for converting a homomorphic encryption system from LWEs to RLWE.

[0027] Compared with the prior art, the present invention has at least the following beneficial technical effects:

[0028] The present invention provides a method and system for converting a homomorphic encryption system from LWEs to RLWE. The conversion of the homomorphic encryption system from LWEs to RLWE plays an important role in scenarios such as encrypted machine learning reasoning. In the method for converting the homomorphic encryption system from LWEs to RLWE, two components, homomorphic partial decryption and homomorphic modular operation, need to be run in sequence. The existing conversion method implements the two components separately, which is inefficient. The present invention designs the homomorphic partial decryption (linear calculation) and the conversion of slot vectors into coefficient vectors STC (linear calculation) as a whole, thereby reducing the number of linear operations and improving the efficiency of linear operations; the present invention uses a more efficient thin bootstrap algorithm to replace the traditional bootstrap algorithm of the early scheme, so that the output of the linear component in the thin bootstrap algorithm is directly connected to the input of the linear component of the homomorphic partial decryption, thereby facilitating the combination of the two linear calculations; secondly, the thin bootstrap algorithm can use less content space than the traditional bootstrap algorithm, and the algorithm efficiency is higher. Therefore, the present invention can improve the efficiency of the bootstrap algorithm. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] Figure 1 This is the conversion flow chart of the homomorphic encryption system from LWEs to RLWE.

[0030] Figure 2 It is a structural block diagram of the present invention. DETAILED DESCRIPTION

[0031] In the following, only some exemplary embodiments are briefly described. As those skilled in the art will appreciate, the described embodiments may be modified in various ways without departing from the spirit or scope of the present invention. Therefore, the drawings and descriptions are considered to be exemplary and non-restrictive in nature.

[0032] It should be understood that when used in this specification and the appended claims, the terms "include" and "comprises" indicate the presence of described features, integers, steps, operations, elements and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or combinations thereof.

[0033] It should also be understood that the terms used in the present specification are only for the purpose of describing specific embodiments and are not intended to limit the present invention. As used in the present specification and the appended claims, unless the context clearly indicates otherwise, the singular forms "a", "an" and "the" are intended to include plural forms.

[0034] It should be further understood that the term "and / or" used in the present description and the appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0035] Various structural schematic diagrams of the embodiments disclosed in the present invention are shown in the accompanying drawings. These figures are not drawn to scale, and some details are magnified and some details may be omitted for the purpose of clear expression. The shapes of various regions and layers shown in the figures and the relative sizes and positional relationships therebetween are only exemplary, and may deviate in practice due to manufacturing tolerances or technical limitations, and those skilled in the art may additionally design regions / layers with different shapes, sizes, and relative positions according to actual needs.

[0036] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0037] Example 1

[0038] like Figure 1 As shown, the present invention provides a method for converting a homomorphic encryption system from LWEs to RLWE, comprising the following steps:

[0039] Step 1: LWE ciphertext preprocessing. Input l LWE ciphertext Satisfaction relationship Where n is the dimension, q is the ciphertext modulus, b j The body part of the ciphertext is called (a j [0],…,a j [n-1]) is called the mask part of the ciphertext, j∈[l], and the corresponding key is s s , the plain text is m j , the noise is e j , Δ is the increment factor used; the conversion key is the converted key, is the converted ciphertext, Ecd(·) represents the encoding function used in homomorphic encryption, which is usually a linear operation. Indicates is the key, is the dimension, q is the set of RLWE ciphertexts with modulus; the rotation key RotK is the key used in the homomorphic modulus operation. The masked part of the input ciphertext is combined into a matrix A, where A j =(a j [0],…,a j [n-1]); the body part of the ciphertext is formed into a vector b = (b0,…,b l ), output matrix A and vector b.

[0040] Step 2: Combine the operations of homomorphic partial decryption and converting the slot vector to coefficients (STC). STC can convert the slot vector z-encoding into the coefficients of a polynomial, and the conversion process can be expressed using the linear operation Uz (see the preliminary knowledge); the homomorphic partial decryption operation needs to simultaneously run the partial decryption As _ +b, where the j-th row corresponds to the partial decryption result of the ciphertext c j .

[0041] Input the matrix A related to homomorphic partial decryption, vector b, and matrix U related to STC output in Step 1, calculate the combined coefficient matrix UA, coefficient vector Ub, and conversion key Perform the homomorphic calculation of the linear combination UA s +Ub, and output the ciphertext with large noise

[0042] Step 3: Calculate the other components of the skinny bootstrap algorithm to achieve noise reduction. Input the ciphertext output in Step 2, and the skinny bootstrap algorithm can achieve the function of noise reduction. The process of the skinny bootstrap includes four steps: converting the slot vector to coefficients (STC), raising the modulus (ModRaise), converting the coefficients to the slot vector (CTS), and taking the modulus (EvalMod). STC was calculated in Step 2. Step 3 inputs the ciphertext with large noise Calculate the remaining three components in the skinny bootstrap except STC: raising the modulus (ModRaise), converting the coefficients to the slot vector (CTS), and taking the modulus (EvalMod), and output the RLWE ciphertext with small noise where R q =R / qR,

[0043] Raising the modulus (ModRaise). Assume that the plaintext polynomial corresponding to c=(a,b) is z(Y). Raise the modulus of the ciphertext c=(a,b) from the integer q to the integer Q, where Q is much larger than q. This operation outputs the ciphertext of z(Y)+qI(X)(mod Q). Among them, the polynomial coefficient |I|≤K, the polynomial I(X) is the perturbation component generated by the ModRaise operation, and K is the upper bound of |I|, which is usually related to the Hamming weight of the private key in the fully homomorphic encryption algorithm

[0044] Converting the coefficients to the slot vector (CTS). First step, convert the plaintext corresponding to the ciphertext from the polynomial z(Y)+qI(X) to the polynomial where the polynomial is generated by the transformation of I(X), and this step only runs when n<N / 2, where n is the number of components of the message corresponding to the plaintext polynomial. Second step, for the 2n - 1-degree polynomial with coefficients including {z′0,…,z′ n-1}, The ciphertext is converted into a slot vector z′0=(z′0,…,z′ n-1 )’s ciphertext.

[0045] EvalMod. For slot vector z′0=(z′0,…,z′ n-1 ) is modulo the ciphertext (modulo the elements on each slot vector), and the slot vector is z0=(z0,…,z n-1 ) The modulus in the modulus operation is q.

[0046] Step 3 outputs an RLWE ciphertext Satisfy relationship b j -as=m+e,where R q =R / qR, The corresponding key is s, the plaintext is m, and Dcd(m,Δ r )=(m0,…,m N ), e is a small coefficient polynomial noise.

[0047] The present invention takes into consideration the homomorphic partial decryption (linear calculation) and the conversion of slot vectors into coefficient vectors STC (linear calculation) in the conversion from LWEs to RLWE encryption system as a whole, combines two linear operations into one linear operation, and improves the efficiency of linear calculation.

[0048] The present invention uses a thin bootstrap algorithm to replace the traditional bootstrap algorithm. On the one hand, a more efficient thin bootstrap algorithm is usually more efficient than a traditional bootstrap algorithm; on the other hand, the first step of the thin bootstrap algorithm is to convert the slot vector into a coefficient vector STC. This linear step can be directly combined with the linear component of the homomorphic system, which can improve the conversion efficiency of the homomorphic encryption system.

[0049] Example 2

[0050] like Figure 2 As shown, the present invention provides a homomorphic encryption system conversion system from LWEs to RLWE, comprising:

[0051] The ciphertext preprocessing module inputs l LWE ciphertexts, which are composed of a mask part and a body part. The mask part of the input ciphertext is combined into a matrix A, and the body part of the ciphertext is combined into a vector b. The matrix A and vector b are output.

[0052] The ciphertext conversion module combines the two operations of homomorphic partial decryption and slot vector conversion into coefficients based on the preprocessed LWE ciphertext; it inputs the matrix A, vector b, constant matrix U related to the STC operation, and conversion key RK, and outputs the RLWE ciphertext with large noise through homomorphic linear combination calculation;

[0053] The calculation output module inputs the RLWE ciphertext with large noise, calculates the lifting modulus, converts the coefficients into slot vectors, and finds the modulus, and outputs the RLWE ciphertext with small noise. The plaintext of this ciphertext corresponds to the plaintext of the l LWE ciphertexts input in the ciphertext preprocessing module.

[0054] In this embodiment, in the ciphertext preprocessing module, l LWE ciphertexts are input Satisfaction relationship Where n is the dimension, q is the ciphertext modulus, b j The body part of the ciphertext is called (a j [0],…,a j [n-1]) is called the mask part of the ciphertext, j∈[l], and the corresponding key is s s , the plain text is m j , the noise is e j , Δ is the increment factor used; the conversion key is the converted key, is the converted ciphertext, Ecd(·) represents the encoding function used in homomorphic encryption, which is usually a linear operation. Indicates is the key, is the dimension, q is the set of RLWE ciphertexts with modulus; the rotation key RotK is the key used in the homomorphic modulus operation; the mask part of the input ciphertext is combined into a matrix A, where A j =(a j [0],…,a j [n-1]); the body part of the ciphertext is formed into a vector b = (b0,…,b l ), output matrix A and vector b.

[0055] In this embodiment, the ciphertext conversion module inputs the matrix A and vector b related to the homomorphic partial decryption output by the ciphertext preprocessing module, and the matrix U related to the STC, calculates the combined coefficient matrix UA and coefficient vector Ub, and converts the key Homomorphic Computation of Linear Combinations UA s +Ub, output ciphertext with large noise

[0056] In this embodiment, in the calculation output module, the ciphertext with large noise is input In addition to STC, the remaining three components in the calculation of thin bootstrapping are: lifting modulus coefficients into slot vectors, modulus calculation (EvalMod), and outputting small noise RLWE ciphertext Where R q =R / qR,

[0057] Output a RLWE ciphertext Satisfy relationship b j -as=m+e.

[0058] Example 3

[0059] An electronic device provided by the present invention includes: a processor and a memory coupled to the processor, the memory stores a computer program, and when the computer program is executed by the processor, the steps of the method for converting a homomorphic encryption system from LWEs to RLWE are implemented.

[0060] The electronic device may also include one or more of a multimedia component, an input / output (I / O) interface, and a communication component.

[0061] The processor is used to control the overall operation of the electronic device to complete all or part of the steps in the above-mentioned storage medium sharing method. The memory is used to store various types of data to support the operation of the electronic device, and these data may include, for example, instructions for any application or method used to operate on the electronic device, and application-related data, such as contact data, messages sent and received, pictures, audio, video, etc. The memory can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read-Only Memory, referred to as EPROM), programmable read-only memory (Programmable Read-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic memory, flash memory, magnetic disk or optical disk. The multimedia component may include a screen and an audio component. The screen may be, for example, a touch screen, and the audio component is used to output and / or input audio signals. For example, the audio component may include a microphone for receiving external audio signals. The received audio signal may be further stored in a memory or sent through a communication component. The audio component also includes at least one speaker for outputting audio signals. The I / O interface provides an interface between the processor and other interface modules, and the other interface modules may be a keyboard, a mouse, buttons, etc. These buttons may be virtual buttons or physical buttons. The communication component is used for wired or wireless communication between the electronic device and other devices. Wireless communication, such as Wi-Fi, Bluetooth, Near Field Communication (NFC), 2G, 3G or 4G, or a combination of one or more of them, so the corresponding communication component may include: a Wi-Fi module, a Bluetooth module, an NFC module.

[0062] In an exemplary embodiment, the electronic device may be implemented by one or more application specific integrated circuits (ASIC), digital signal processors (DSP), digital signal processing devices (DSPD), programmable logic devices (PLD), field programmable gate arrays (FPGA), controllers, microcontrollers, microprocessors or other electronic components to execute the above-mentioned storage medium sharing method.

[0063] Example 4

[0064] The present invention provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the method for converting a homomorphic encryption system from LWEs to RLWE.

[0065] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0066] The present application is described with reference to the flowcharts and / or block diagrams of the methods, systems and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A system that specifies the functions of a box or multiple boxes.

[0067] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0068] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0069] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It is obvious to those skilled in the art that the present invention is not limited to the details of the above exemplary embodiments, and the present invention can be implemented in other specific forms without departing from the spirit or basic features of the present invention. Therefore, no matter from which point of view, the embodiments should be regarded as exemplary and non-restrictive. The scope of the present invention is defined by the attached claims rather than the above description, and it is intended that all changes falling within the meaning and scope of the equivalent elements of the claims are included in the present invention. Any figure mark in the claims should not be regarded as limiting the claims involved.

[0070] In addition, it should be understood that although this specification is described in accordance with the implementation modes, not every implementation mode contains only one independent technical solution. This description of the specification is only for the sake of clarity. Those skilled in the art should regard the specification as a whole. The technical solutions in each embodiment can also be appropriately combined to form other implementation modes that can be understood by those skilled in the art. The above content is only to illustrate the technical idea of ​​the present invention, and cannot be used to limit the protection scope of the present invention. Any changes made on the basis of the technical solution according to the technical idea proposed by the present invention shall fall within the protection scope of the claims of the present invention.

Claims

1. A method for converting a homomorphic encryption system from LWEs to RLWE, characterized in that: The following steps are involved: Step 1: LWE ciphertext preprocessing; Input l LWE ciphertexts, the ciphertext consists of a mask part and a body part, combine the mask part of the input ciphertext into a matrix A, and combine the body part of the ciphertext into a vector b, and output the matrix A and vector b; Step 2: Based on the preprocessed LWE ciphertext, combine the two operations of homomorphic partial decryption and slot vector conversion into coefficients; input matrix A, vector b, constant matrix U related to STC operation, and conversion key RK, and output RLWE ciphertext with large noise through homomorphic linear combination calculation; Step 3: Input the RLWE ciphertext with large noise, calculate the lifting modulus, convert the coefficients into slot vectors, and find the modulus, and output the RLWE ciphertext with small noise. The plaintext of this ciphertext corresponds to the plaintext of the l LWE ciphertexts input in step 1.

2. According to claim 1, a method for converting a homomorphic encryption system from LWEs to RLWE is characterized in that: The specific implementation methods of step 1 include: Input l LWE ciphertext Satisfaction relationship in n is the dimension, q is the ciphertext modulus, b j The body part of the ciphertext is called (a j [0],…,a j [n-1]) is called the mask part of the ciphertext, j∈[l], and the corresponding key is s , the plain text is m j , the noise is e j , Δ is the increment factor used; the conversion key is the converted key, is the converted ciphertext, Ecd(·) represents the encoding function used in homomorphic encryption, which is usually a linear operation. Indicates is the key, is the dimension, q is the set of RLWE ciphertexts with modulus; the rotation key RotK is the key used in the homomorphic modulus operation; the mask part of the input ciphertext is combined into a matrix A, where A j =(a j [0],…,a j [n-1]); the body part of the ciphertext is formed into a vector b = (b0,…,b l ), output matrix A and vector b.

3. According to claim 2, a method for converting a homomorphic encryption system from LWEs to RLWE is characterized in that: The specific implementation method of step 2 includes: Input the matrix A and vector b related to the homomorphic partial decryption output in step 1, and the matrix U related to STC, calculate the combined coefficient matrix UA, coefficient vector Ub, and convert the key Homomorphic Computation of Linear Combinations UA s +Ub, output ciphertext with large noise 4. The method for converting a homomorphic encryption system from LWEs to RLWE according to claim 3, characterized in that: The specific implementation method of step 3 includes: Input ciphertext with large noise In addition to STC, the remaining three components in the calculation of thin bootstrapping are: lifting modulus coefficients into slot vectors, modulus calculation (EvalMod), and outputting small noise RLWE ciphertext Where R q =R / qR, Output a RLWE ciphertext Satisfy relationship b j -as=m+e.

5. A homomorphic encryption system conversion system from LWEs to RLWE, characterized in that: include: The ciphertext preprocessing module inputs l LWE ciphertexts, which are composed of a mask part and a body part. The mask part of the input ciphertext is combined into a matrix A, and the body part of the ciphertext is combined into a vector b. The matrix A and vector b are output. The ciphertext conversion module combines the two operations of homomorphic partial decryption and slot vector conversion into coefficients based on the preprocessed LWE ciphertext; it inputs the matrix A, vector b, constant matrix U related to the STC operation, and conversion key RK, and outputs the RLWE ciphertext with large noise through homomorphic linear combination calculation; The calculation output module inputs the RLWE ciphertext with large noise, calculates the lifting modulus, converts the coefficients into slot vectors, and finds the modulus, and outputs the RLWE ciphertext with small noise. The plaintext of this ciphertext corresponds to the plaintext of the l LWE ciphertexts input in the ciphertext preprocessing module.

6. According to claim 5, a homomorphic encryption system conversion system from LWEs to RLWE is characterized in that: In the ciphertext preprocessing module, input l LWE ciphertext Satisfaction relationship in n is the dimension, q is the ciphertext modulus, b j The body part of the ciphertext is called (a j [0],…,a j [n-1]) is called the mask part of the ciphertext, j∈[l], and the corresponding key is s , the plain text is m j , the noise is e j , Δ is the increment factor used; the conversion key is the converted key, is the converted ciphertext, Ecd(·) represents the encoding function used in homomorphic encryption, which is usually a linear operation. Indicates is the key, is the dimension, q is the set of RLWE ciphertexts with modulus; the rotation key RotK is the key used in the homomorphic modulus operation; the mask part of the input ciphertext is combined into a matrix A, where A j =(a j [0],…,a j [n-1]); the body part of the ciphertext is formed into a vector b = (b0,…,b l ), output matrix A and vector b.

7. The LWEs to RLWE homomorphic encryption system conversion system according to claim 6, characterized in that: In the ciphertext conversion module, the matrix A and vector b related to the homomorphic partial decryption output by the ciphertext preprocessing module and the matrix U related to STC are input, and the combined coefficient matrix UA and coefficient vector Ub are calculated to convert the key Homomorphic Computation of Linear Combinations UA s +Ub, output ciphertext with large noise 8. The LWEs to RLWE homomorphic encryption system conversion system according to claim 7, characterized in that: In the calculation output module, input the ciphertext with large noise In addition to STC, the remaining three components in the calculation of thin bootstrapping are: lifting modulus coefficients into slot vectors, modulus calculation (EvalMod), and outputting small noise RLWE ciphertext Where R q =R / qR, Output a RLWE ciphertext Satisfy relationship b j -as=m+e.

9. An electronic device, characterized in that: include: A processor and a memory coupled to the processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the steps of a method for converting a homomorphic encryption system from LWEs to RLWE described in any one of claims 1 to 4 are implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of a method for converting a homomorphic encryption system from LWEs to RLWE as described in any one of claims 1-4 are implemented.

Images