Homomorphic encryption system including noise estimator and method of operation thereof

Abstract

An operation method of a homomorphic encryption system includes generating a ciphertext, performing an operation on the ciphertext, generating history information about the operation, generating a noise prediction value by predicting noise accumulated in the ciphertext by the operation based on the history information, and generating an encryption parameter including a guard interval inserted in the ciphertext based on the noise prediction value.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the priority of Korean Patent Application No. 10-2023-0121104 filed in the Korean Intellectual Property Office on September 12, 2023, the disclosure of which is incorporated herein by reference in its entirety. Background Art

[0003] In order to protect information, cryptographic technology is used to encrypt messages. With the development of communications and the widespread use of mobile devices, the demand for the security of personal information is increasing. In order to protect personal information, messages are usually encrypted and sent or stored using keys. However, as encryption technology develops, security attack technology is also developing. Security attackers are trying various techniques to attack private keys. Therefore, concerns about security incidents due to negligent delivery or management of keys are increasing.

[0004] Even though homomorphic encryption operates on ciphertext without decrypting the encrypted information, it can provide the same result as the encrypted value after operating on the plaintext. When homomorphic encryption is used, various operations such as statistical processing and machine learning can be performed without decrypting the ciphertext. The advantage of using homomorphic encryption is that the chance of exposing the key is relatively small. Therefore, homomorphic encryption is a core technology that companies that provide services based on big data are paying attention to.

[0005] In order to encrypt raw data in homomorphic encryption, encryption parameters must be set first. The computing power of homomorphic encryption that can perform operations in an encrypted state is determined by the encryption parameters. When configuring an application system with homomorphic encryption, what operations the application system must support and what bit precision the operation results can support are determined by the encryption parameters.

[0006] Typically, in an application system that predetermines operation information, homomorphic encryption parameters are found and ciphertext is generated. However, it is not an easy problem to transmit the predetermined operation information from the server to the user device. Because the operation information of the server (e.g., machine learning level, weight / bias, model information) is a company secret, it is difficult to disclose it. In addition, in the case of an application with a variable operation structure, in which the number of operations (e.g., iterative operations) cannot be predetermined, the operation information cannot be confirmed. Therefore, the method of generating homomorphic encryption parameters with only predetermined operation information may not support the application system or may cause efficiency problems. Summary of the invention

[0007] In general, in some aspects, the present disclosure relates to a homomorphic encryption system and a method of operating the same, the homomorphic encryption system including a noise predictor that can configure the homomorphic encryption system without knowing operational information of a server.

[0008] According to some aspects of the present disclosure, the operating method of the homomorphic encryption system includes generating ciphertext, performing operations on the ciphertext, generating historical information about the operations, generating a noise prediction value by predicting the noise accumulated in the ciphertext by the operations based on the historical information, and generating encryption parameters including a protection interval inserted into the ciphertext based on the noise prediction value.

[0009] According to some aspects of the present disclosure, a homomorphic encryption system includes a server and a user device, wherein the server is configured to perform an operation on a first ciphertext and generate a noise prediction value by estimating the noise accumulated in the first ciphertext by the operation, and the user device is configured to determine the size of a protection interval added when generating a second ciphertext using the noise prediction value.

[0010] According to some aspects of the present disclosure, the operating method of the homomorphic encryption system includes: a server performs an operation on a ciphertext, the server generates historical information about the operation, the server generates a noise prediction value by predicting the noise accumulated in the ciphertext by the operation based on the historical information, the server sends the noise prediction value to a user device, and the user device generates encryption parameters for encryption based on the noise prediction value. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Exemplary embodiments will be more clearly understood from the following detailed description taken in conjunction with the accompanying drawings.

[0012] Figure 1 is a block diagram illustrating an example of a homomorphic encryption system according to some implementations.

[0013] Figure 2 It is an explanation according to some embodiments Figure 1 A diagram of an example of a method of operation of a homomorphic encryption operator.

[0014] Figure 3 is a diagram illustrating an example of a ciphertext multiplication method used in homomorphic encryption according to some embodiments.

[0015] Figure 4 is a table illustrating examples of methods for generating noise prediction values ​​according to the type of homomorphic encryption operation according to some embodiments.

[0016] Figure 5 According to some embodiments, Figure 1 The configuration of the homomorphic encryption device shown in .

[0017] Figure 6 is a flow chart illustrating an example of a method of configuring a parameter mapping table using noise prediction values ​​according to some embodiments.

[0018] Figure 7 It is to illustrate that according to some embodiments, it can be achieved Figure 6 A diagram of an example of constraints on the security level required by the homomorphic encryption standard described in step S120.

[0019] Figure 8 is a table illustrating examples of upper limit sizes of guard intervals GI according to function block IP sizes of homomorphic encryption devices according to some embodiments.

[0020] Fig. 9 An example of a parameter mapping table according to some embodiments is shown. Figure 7 and Figure 8 Various encryption parameters are generated based on the range of noise prediction values.

[0021] Fig.10 An example of a process for generating noise prediction values ​​and generating and using corresponding parameters for execution in a homomorphic encryption system according to some embodiments is shown.

[0022] Fig.11 is a diagram illustrating an example of the effects in a system using noise prediction values ​​according to some embodiments.

[0023] Fig.12 is a block diagram illustrating an example of a homomorphic encryption system according to some implementations.

[0024] Fig.13 is a diagram showing that according to some embodiments Fig.12 A block diagram of an example configuration of a homomorphic encryption device.

[0025] Fig.14 An example of the generation of a noise prediction value performed in a homomorphic encryption system according to some embodiments and an example of a calculation method using a stop operation ciphertext CT_interm and remaining operation information OP_retained in a homomorphic encryption device according to some embodiments are shown.

[0026] Fig.15 is a block diagram illustrating an example of a homomorphic encryption system according to some implementations. DETAILED DESCRIPTION

[0027] Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings. Wherever possible, the same reference numerals are used in the specification and drawings to refer to the same or similar parts.

[0028] Figure 1 is a block diagram illustrating an example of a homomorphic encryption system according to some embodiments. Figure 1 In the embodiment, the homomorphic encryption system 1000 may include a homomorphic encryption operation device 1100 and a homomorphic encryption device 1200 .

[0029] In some embodiments, the homomorphic encryption operation device 1100 performs an operation on the ciphertext CT sent from the homomorphic encryption device 1200. For example, the homomorphic encryption operation device 1100 may be a server. The server may use distributed computing or mobile edge computing to provide cloud services or ultra-low latency services. In particular, the server may be an intelligent server using machine learning or neural networks.

[0030] The homomorphic encryption operation device 1100 performs an operation on the ciphertext CT sent from the homomorphic encryption device 1200. For security purposes, noise is inserted into the homomorphic encrypted ciphertext CT. When the calculation is performed, the noise in the data increases. If the noise increases beyond an appropriate degree as the number of operations increases, decoding may become impossible. Therefore, when generating the ciphertext, a protection interval (hereinafter referred to as GI) is inserted into the homomorphic encrypted ciphertext CT to prevent the noise from affecting the original data due to the operation between the ciphertexts. The size of the protection interval GI is determined by the encryption parameters of the homomorphic encryption system 1000. The encryption parameters are determined by the operation information of the homomorphic encryption operation device 1100. The calculation information can be, for example, the machine learning layer structure, weight / bias, and calculation flow information used in the homomorphic encryption calculation device 1100. However, the operation information can be an asset of the company, and if the number of calculations is variable, it is difficult to provide a fixed value. Therefore, in the absence of operation information, it is difficult to use an appropriate protection interval GI to generate ciphertext in the homomorphic encryption device 1200.

[0031] The homomorphic encryption operation device 1100 can provide a noise prediction value Naprx so that the homomorphic encryption device 1200 can set an appropriate protection interval GI and perform encryption / decryption without sending operation information. Therefore, the homomorphic encryption operation device 1100 includes a homomorphic encryption operator 1120 and a noise predictor 1140. The homomorphic encryption operator 1120 performs various operations on the ciphertext CT provided by the homomorphic encryption device 1200. Whenever each operation occurs, the homomorphic encryption operator 1120 generates historical information OP_HIS. The historical information OP_HIS can be added and updated to the ciphertext CT generated as a result of the operation in the form of a tag.

[0032] The noise predictor 1140 predicts noise accumulated through the operation of the ciphertext according to the history information OP_HIS provided by the homomorphic encryption operator 1120. Based on the noise prediction value Naprx, the noise predictor 1140 sends the ciphertext CT and the noise prediction value Naprx to the homomorphic encryption apparatus 1200.

[0033] In some embodiments, the homomorphic encryption device 1200 uses a homomorphic encryption algorithm to convert plaintext into ciphertext or to convert ciphertext into plaintext, wherein the homomorphic encryption device 1200 may be a user device. For example, the user device may be a variety of electronic devices, and may include a storage device, a portable communication device (e.g., a smart phone), a computer device, a portable multimedia device, a portable medical device, a camera, a wearable device, or a home appliance device.

[0034] In particular, even without operation information from the homomorphic encryption operation device 1100, the homomorphic encryption device 1200 of the present invention can obtain the protection interval GI for encryption. The homomorphic encryption device 1200 generates an encryption parameter PRMT according to the noise prediction value Naprx provided from the homomorphic encryption operation device 1100. In addition, the homomorphic encryption device 1200 can use the encryption parameter PRMT to obtain the optimal protection interval GI and generate a ciphertext. Therefore, the homomorphic encryption device 1200 may include a homomorphic encryption parameter generator 1220 and an encryption / decryption circuit 1240.

[0035] In some embodiments, the homomorphic encryption parameter generator 1220 may obtain a protection interval GI that satisfies at least one condition from the noise prediction value Naprx provided by the homomorphic encryption operation device 1100. For example, the condition may include a security level that satisfies the homomorphic encryption standard, a size or capability of a functional block (e.g., IP) of the homomorphic encryption device 1200, or a constraint required by an application model. The homomorphic encryption parameter generator 1220 may construct a parameter mapping table based on the noise prediction value Naprx and provide a protection interval GI at high speed.

[0036] In some embodiments, the encryption / decryption circuit 1240 performs encryption and decryption operations using parameters (e.g., protection intervals) provided from the homomorphic encryption parameter generator 1220. For example, the encryption / decryption circuit 1240 may generate ciphertext using the optimized protection interval GI provided from the homomorphic encryption parameter generator 1220 during encryption. In this case, the optimal protection interval GI for encryption may be generated without operation information corresponding to the homomorphic encryption operator 1100 of the server. Therefore, encryption or decryption using encryption parameters (such as the protection interval GI) optimized for the homomorphic encryption system 1000 is possible.

[0037] In some embodiments, the homomorphic encryption system 1000 can obtain the optimal parameters applied to encryption by using the noise prediction value Naprx generated from the noise predictor 1140 instead of the operation information. For example, the size of the optimal protection interval GI for encryption of homomorphic encryption can be generated from the noise prediction value Naprx. Therefore, the optimal protection interval GI required for encryption can be easily generated without the operation information of the server.

[0038] Figure 2 Yes Description Figure 1 A diagram showing an example of a method of operation of a homomorphic encryption operator. Figure 2 In the example, the homomorphic encryption operator 1120 performs a plurality of homomorphic encryption operations on the ciphertext CT. Therefore, the history information OP_HIS including the type or number of operations on the ciphertext CT may be generated.

[0039] The homomorphic encryption operator 1120 may tag the ciphertext CT received from the homomorphic encryption device 1200 with the history information OP_HIS. For example, the history information (OP_HIS, 1122) may be processed like the tag information of the ciphertext (CT, 1124). In addition, before the operation performed by the homomorphic encryption operator 1120 occurs, the history information OP_HIS may be marked as an initialization value in the first ciphertext CT. When the operation is applied to the ciphertext CT by the homomorphic encryption operator 1120, the history information OP_HIS is updated to a value including the corresponding operation characteristics.

[0040] For example, when the first homomorphic encryption operation (#1) is performed in step S21, the homomorphic encryption operator 1120 will generate a ciphertext CT1 as a result of the operation. Therefore, the homomorphic encryption operator 1120 will update the historical information OP_HIS, which includes the historical information OP_HIS of the characteristics of the first homomorphic encryption operation (#1) in the ciphertext CT1. Similarly, when the second homomorphic encryption operation (#2) is performed in step S22, the homomorphic encryption operator 1120 will generate a ciphertext CT2 after performing the operation on the ciphertext CT1. Therefore, the homomorphic encryption operator 1120 will additionally update the ciphertext CT2 using the historical information OP_HIS including the characteristics of the second homomorphic encryption operation (#2). When the nth homomorphic encryption operation (#n) finally performed in this manner completes step S23, the homomorphic encryption operator 1120 performs the operation on the ciphertext CTn-1 and then generates the final ciphertext CT'. In addition, the homomorphic encryption operator 1120 will update the history information OP_HIS, which includes the characteristics of the nth homomorphic encryption operation (#n) in the final ciphertext CT′.

[0041] In some embodiments, the history information OP_HIS may include information such as the number of multiplications or additions between ciphertexts and ciphertexts and the number of multiplications or additions between ciphertexts and plaintexts. For example, the history information OP_HIS may include information about the type and number of various operations applied to the ciphertexts. When the operation is repeated, the number of multiplications or additions recorded in the history information OP_HIS may be updated in a cumulative form.

[0042] In the above, the generation and update process of the history information OP_HIS performed in the homomorphic encryption operator 1120 has been described as an example. The homomorphic encryption operator 1120 may provide the noise predictor 1140 with the history information OP_HIS including operation information accumulated when the operation occurs.

[0043] Figure 3 is a diagram illustrating an example of a multiplication method between ciphertexts used in homomorphic encryption according to some embodiments. Figure 3 In FIG. 1 , the multiplication process of the 1230-bit ciphertext (A, B) is briefly shown.

[0044] Assume that ciphertext A consists of a 1200-bit guard interval A1, 20-bit data bits A2, and 10-bit error bits ea. Similarly, assume that ciphertext B consists of a 1200-bit guard interval B1, 20-bit data bits B2, and 10-bit error bits eb. As a result of the multiplication operation of ciphertexts A and B, a new ciphertext C is output. However, the ciphertext C generated as a result of the multiplication has 19-bit data bits C2 and 41-bit error bits ec added by the multiplication.

[0045] In homomorphic encryption, where messages are encrypted by adding error bits, the number of error bits increases exponentially with the repetition of multiplication operations on the ciphertext. Therefore, there is a limit on the number of multiplication operations in homomorphic encryption. In homomorphic encryption, rescaling is a technique that removes errors caused by calculations so that the errors caused by ciphertext calculations do not increase exponentially. For rescaling, optimal guard intervals GI must be inserted. The insertion of these guard intervals is applied when generating the ciphertext.

[0046] In operation, rescaling can be easily performed by a shift operation. By rescaling, the error bits ec' are reduced to 11 bits. As a result, the plaintext (C2 and ec') remains 30 bits.

[0047] In the process of calculating the above homomorphic encryption, rescaling must be performed to remove errors caused by the calculation so that the noise or errors caused by the calculation do not increase exponentially. However, in order to protect the message part even during rescaling, the size of the noise (or error) in each operation must be identified. However, as described above, the operation information is difficult to disclose. Therefore, when the operation occurs, the historical information OP_HIS is updated, and the noise information accumulated by the operation can be predicted by the updated historical information OP_HIS. The noise prediction value Naprx can be provided to the user device or the homomorphic encryption device 1200 instead of the operation information.

[0048] Figure 4 is a table illustrating an example of a method for generating noise prediction values ​​according to the type of homomorphic encryption operation according to some embodiments. Figure 4In the noise predictor 1140 (see Figure 1 ) can generate a noise prediction value Naprx corresponding to the operation type recorded in the history information OP_HIS.

[0049] First, the operation type described in the history information OP_HIS may include, for example, multiplication between ciphertexts, binary tree multiplication of ciphertexts, and binary tree addition of ciphertexts. In addition, it will be well understood that the type of operation may also include various ciphertext operations.

[0050] If the type of ciphertext operation indicated in the history information OP_HIS is a multiplication operation between ciphertexts, the noise predictor 1140 may determine the noise prediction value Naprx as “log 2 L". Here, 'L' refers to the number of multiplications used for ciphertext multiplication. If the type of ciphertext operation indicated in the history information OP_HIS is binary tree multiplication of ciphertext, the noise predictor 1140 may determine the noise prediction value Naprx as 'L'. Here, 'L' refers to the number of multiplications used in the binary tree multiplication. If the type of ciphertext operation indicated in the history information OP_HIS is binary tree addition of ciphertext, the noise predictor 1140 may determine the noise prediction value Naprx as 'log 2 L". Here, "L" refers to the number of additions used in binary tree addition.

[0051] In this way, the noise predictor 1140 (see Figure 1 ) The noise prediction values ​​Naprx corresponding to various types of operations recorded in the history information OP_HIS can be managed in a table form.

[0052] Figure 5 According to some embodiments, Figure 1 An example of the configuration of a homomorphic encryption device is shown in . Figure 5 In the embodiment, a homomorphic encryption device 1200 that can be implemented in a user device may include a homomorphic encryption parameter generator 1220 and an encryption / decryption circuit 1240.

[0053] The homomorphic encryption parameter generator 1220 may include a parameter generation circuit 1222 and a memory 1224. The parameter generation circuit 1222 receives the noise prediction value Naprx provided from the noise predictor 1140. The parameter generation circuit 1222 stores the received noise prediction value Naprx in the memory 1224. Therefore, the parameter generation circuit 1222 may generate a parameter mapping table 1225 with reference to the noise prediction value Naprx and the constraints of the homomorphic encryption system 1000. The constraints of the homomorphic encryption system 1000 include, for example, the security level of the homomorphic encryption system 1000, the size of the protection interval GI that the homomorphic encryption function block (e.g., IP) can support, and the protection interval GI required to run an application model (e.g., machine learning).

[0054] The memory 1224 stores the parameter mapping table 1225 generated by the parameter generation circuit 1222. The parameter values ​​stored in the parameter mapping table 1225 may be updated by the parameter generation circuit 1222 periodically or when necessary.

[0055] The encryption / decryption circuit 1240 may encrypt or decrypt the data DT using the encryption parameter PRMT provided by the homomorphic encryption parameter generator 1220. The encryption / decryption circuit 1240 may receive the data DT from the outside, and generate a ciphertext CT by homomorphically encrypting the data DT according to the encryption parameter PRMT provided from the parameter generation circuit 1222. For example, the encryption / decryption circuit 1240 may generate a ciphertext CT satisfying the encryption parameter PRMT, which includes the total length of the ciphertext, the size of the guard interval GI, the message length, or the error length.

[0056] In addition, the encryption / decryption circuit 1240 can receive the final ciphertext CT' generated by the calculation from the homomorphic encryption operation device 1100, decrypt it, and output the decrypted data. The encryption / decryption circuit 1240 can decrypt the message data from the final ciphertext CT' by referring to the encryption parameter PRMT including the total length of the ciphertext, the size of the protection interval GI, the length of the message, or the length of the error.

[0057] As described above, the homomorphic encryption apparatus 1200 may perform encryption and decryption using the noise prediction value Naprx provided from the noise predictor 1140 instead of the operation information of the system.

[0058] Figure 6 is a flow chart illustrating an example of a method for configuring a parameter mapping table using noise prediction values ​​Naprx according to some embodiments. Figure 6 , the parameter generation circuit 1222 (see Figure 5 ) According to the homomorphic encryption operation device 1100 (see Figure 1)'s noise predictor 1140 generates the noise prediction value Naprx and the requirements of the homomorphic encryption system to generate the encryption parameter PRMT.

[0059] In step S110 , the parameter generation circuit 1222 receives the noise prediction value Naprx generated from the noise predictor 1140 . The homomorphic encryption operation device 1100 may be implemented as a server in the homomorphic encryption system 1000 .

[0060] In step S120, the parameter generation circuit 1222 can determine the approximate range of the protection interval GI according to the constraints of the security level required by the homomorphic encryption standard. Here, the security level refers to the number of calculations or bits that may cause the password to be unlocked in response to a hacker's attack. Therefore, a range of allowable parameters depending on the security level is provided in the homomorphic encryption standard.

[0061] In step S130, the parameter generation circuit 1222 determines the parameter range that can be supported by various hardware resources included in the homomorphic encryption operator 1120 of the homomorphic encryption device 1200. For example, the size of the optional protection interval GI can vary according to the type, size, number or processing power of the function block IP provided by the encryption / decryption circuit 1240.

[0062] In step S140, the parameter generation circuit 1222 may select the protection interval GI required for the application model of the homomorphic encryption operator 1120 included in the homomorphic encryption operation device 1100 within the range determined in step S130. For example, if the operation applied in the homomorphic encryption operation device 1100 corresponds to machine learning ML based on homomorphic encryption, several functions for the operation executed in the homomorphic encryption operation device 1100 may be implemented in the form of approximate polynomials. Therefore, the more approximations are made with polynomials of higher degrees, the higher the approximation accuracy, and the overall accuracy of the machine learning ML also increases. However, as the order increases, the required protection interval GI also increases. Therefore, the parameter generation circuit 1222 may select the optimal protection interval GI required for the application model used in the calculation of homomorphic encryption within the range determined in step S130.

[0063] The above steps have been described as a process for generating the noise prediction value Naprx generated from the noise predictor 1140 and the encryption parameter PRMT according to the requirements of the homomorphic encryption system 1000. However, the order of the above process is only exemplary, and the advantages of the present invention are not limited to the above order.

[0064] Figure 7 It is to illustrate that according to some embodiments, it can be achieved Figure 6 FIG. 1 is a diagram of an example of the constraints on the security level required by the homomorphic encryption standard described in step S120. Figure 7, the horizontal axis represents the complexity of the homomorphic encryption device 1200 or the user device, and the vertical axis represents the complexity of the application model operated in the server or the homomorphic encryption operation device 1100.

[0065] The parameter generation circuit 1222 may determine a security level that can maintain security based on the complexity of the homomorphic encryption operation device 1100 and the homomorphic encryption device 1200. For example, if the complexity of the homomorphic encryption operation device 1100 and the homomorphic encryption device 1200 is included in the shaded area range (area A), the security level required to satisfy both error performance and security may be selected as 128 bits. In addition, the range of allowable parameters depending on the selected security level may be determined in the homomorphic encryption standard.

[0066] Figure 8 is a table illustrating an example of an upper limit size of a guard interval GI according to a function block IP size of a homomorphic encryption device according to some embodiments. Figure 8 In the embodiment, the parameter generation circuit 1222 can determine the size of the protection interval GI according to the type, size, number or processing capability of the FPGA (field programmable gate array) and the function block IP included in the encryption / decryption circuit 1240.

[0067] When the first FPGA FPGA1 is used in the homomorphic encryption device 1200 and the homomorphic encryption function block HE IP is used, the upper limit of the supportable protection interval GI can be set to 40. The first FPGA FPGA1 can be equipped with a lookup table LUT with 1100K, 2500K, 10MB and 7000, respectively, a trigger FF, a block RAM BRAM and a digital signal processor DSP for calculation. In order to configure the homomorphic encryption function block HE IP, the lookup table LUT, the trigger FF, the block RAM BRAM and the digital signal processor DSP can be equipped with 800K, 800K, 9.5MB and 5000, respectively. Therefore, the upper limit of the size of the protection interval GI can be selected to be 40.

[0068] In some embodiments, when the second FPGA FPGA2 is used in the homomorphic encryption device 1200 and the homomorphic encryption function block HE IP is used, the upper limit of the supportable protection interval GI can be set to 20. The second FPGA FPGA2 will be equipped with a lookup table LUT with 800K, 450K, 4.3MB and 1900, a trigger FF, a block RAM BRAM and a digital signal processor DSP for calculation. In order to configure the homomorphic encryption function block HE IP, the lookup table LUT, the trigger FF, the block RAM BRAM and the digital signal processor DSP are equipped with 450K, 450K, 4MB and 1800, respectively. Therefore, the upper limit of the size of the protection interval GI can be selected as 20.

[0069] Fig. 9 Description of some embodiments based on Figure 7 and Figure 8 The range of noise prediction values ​​Naprx generates examples of various encryption parameters as an example of a parameter mapping table according to some embodiments. Fig. 9 In the example, when the noise prediction value Naprx is given, encryption parameters PRMT, such as the protection interval GI, the polynomial order, the security level, the ciphertext size, etc., can be provided from the parameter mapping table 1225.

[0070] When receiving the noise prediction value Naprx generated by the noise predictor 1140, the parameter generation circuit 1222 may select an encryption parameter PMRT corresponding to the noise prediction value Naprx from the parameter mapping table 1225. For example, when the received noise prediction value Naprx is '25', the parameter generation circuit 1222 sets the protection interval GI, the polynomial order, the security level, and the ciphertext size to 40, 217, 256 bits, and 44MB, respectively. The selected parameters will be provided to the encryption / decryption circuit 1240 as the encryption parameter PMRT.

[0071] Likewise, the parameter mapping table 1225 may provide an optimal guard interval GI, polynomial order, security level, and ciphertext size as encryption parameters PMRT for various noise prediction values ​​Naprx.

[0072] Fig.10 An example of a process for generating and using noise prediction values ​​Naprx and encryption parameters performed in a homomorphic encryption system according to some embodiments is shown. Fig.10 In the embodiment, the homomorphic encryption operation device 1100 and the homomorphic encryption device 1200 can exchange the ciphertext CT and the noise prediction value Naprx.

[0073] In step S210, the ciphertext CT generated in the homomorphic encryption device 1200 is sent to the homomorphic encryption operation device 1100. For example, this may be a case where the homomorphic encryption device 1200 requests the homomorphic encryption operation device 1100 to perform an operation such as machine learning on the ciphertext CT.

[0074] In step S220, the homomorphic encryption operation device 1100 performs a homomorphic encryption operation on the received ciphertext CT. Therefore, historical information OP_HIS is generated, such as the type or number of operations on the ciphertext CT. In some embodiments, the historical information OP_HIS can be added to the ciphertext CT in the form of a tag and updated. For example, the historical information OP_HIS can be the number of multiplications or additions between ciphertexts and ciphertexts, or the number of multiplications or additions between ciphertexts and plaintexts. In some embodiments, the historical information OP_HIS may include information about the type and number of various operations applied to the ciphertext. When the operation is repeated, the number of multiplications or additions recorded in the historical information OP_HIS can be updated in a cumulative form.

[0075] In step S230, the noise predictor 1140 (see Figure 1 ) generates a noise prediction value Naprx corresponding to the type or number of operations recorded in the history information OP_HIS. For example, the operation type described in the history information OP_HIS may include a multiplication operation between ciphertexts, a binary tree multiplication of ciphertexts, and a binary tree addition of ciphertexts. In this way, the noise predictor 1140 can generate noise prediction values ​​Naprx corresponding to various types of operations recorded in the history information OP_HIS. The noise prediction value Naprx is information about the size of the noise generated by the following calculation.

[0076] In step S240, the homomorphic encryption operator 1120 checks whether the noise prediction value Naprx generated in step S230 exceeds the reference value Nreq. If the noise prediction value Naprx does not exceed the reference value Nreq ('No' direction), the process returns to step S220 and continues to calculate the ciphertext. In addition, if the noise prediction value Naprx exceeds the reference value Nreq ('Yes' direction), the process moves to step S250.

[0077] In step S250 , the homomorphic encryption operation device 1100 stops further ciphertext operations and sends the stopped operation intermediate value CT′ and the noise prediction value Naprx to the homomorphic encryption device 1200 .

[0078] In step S260, the homomorphic encryption device 1200 receives the operation intermediate value CT′ and the noise prediction value Naprx sent from the homomorphic encryption operation device 1100. Then, the noise prediction value Naprx is used to generate the encryption parameter PMRT to be used in the encryption or decryption operation of the homomorphic encryption device 1200. For example, the homomorphic encryption device 1200 can use the noise prediction value Naprx to configure the parameter mapping table 1225.

[0079] In step S270, the homomorphic encryption device 1200 re-encrypts the operation intermediate value CT' received from the homomorphic encryption operation device 1100 after stopping the calculation. For example, the homomorphic encryption device 1200 generates a ciphertext CT" by encrypting the operation intermediate value CT' using the encryption parameter PMRT provided by the parameter mapping table 1225.

[0080] In step S280, the homomorphic encryption device 1200 sends the ciphertext CT" generated by the re-encryption operation to the homomorphic encryption operation device 1100 for additional calculation.

[0081] As described above, the operation of the homomorphic encryption operation device 1100 generates a noise prediction value Naprx instead of operation information, and the homomorphic encryption device 1200 generates an encryption parameter PMRT from the noise prediction value Naprx. By using the noise prediction value Naprx, the homomorphic encryption operation device 1100 and the homomorphic encryption device 1200 can perform encryption or ciphertext operations without exchanging operation information used in the homomorphic encryption system 1000.

[0082] Fig.11 is a diagram showing an example of the effect in a system using a noise prediction value Naprx according to some embodiments. Fig.11 , CASE1 (Case 1) without using noise prediction and CASE2 (Case 2) using noise prediction are shown respectively.

[0083] First, without using noise prediction CASE1, the original data DT represents the plaintext data before encryption. The original data DT is encrypted into the first ciphertext CT1 by the homomorphic encryption device 1200. In encryption, noise is inserted for security. By inserting the protection interval GI, the message loss caused by noise when the encryption operation occurs can be prevented.

[0084] The first ciphertext CT1 is delivered to the homomorphic encryption operation device 1100, and the homomorphic encryption operation device 1100 will perform an operation such as multiplication or addition on the first ciphertext CT1. The first ciphertext CT1 is converted into the second ciphertext CT2 by the first operation OP1. The noise size of the second ciphertext CT2 increases due to the first operation OP1. Similarly, the second ciphertext CT2 is converted into the third ciphertext CT3 by the second operation OP2. Through this operation, the noise size of the second ciphertext CT2 increases. The third ciphertext CT3 is converted into the fourth ciphertext CT4 by the third operation OP3. In the fourth ciphertext CT4, the noise becomes too much and no message remains. Therefore, even if the fourth ciphertext CT4 is decrypted, it is impossible to recover the message present in the original data DT, and the decryption of the fourth ciphertext CT4 fails. However, if the operation information of the server is not provided, the decoding failure can only be determined when the decryption is completed.

[0085] On the other hand, when noise prediction CASE2 is used, the stop point of the operation can be monitored by the noise prediction value Naprx. The original data DT is encrypted into the first ciphertext CT1 by the homomorphic encryption device 1200. In the cryptographic operation, noise is inserted for security. And a guard interval GI is also inserted.

[0086] The encrypted first ciphertext CT1 is delivered to the homomorphic encryption operation device 1100, and the homomorphic encryption operation device 1100 will perform a scheduling operation on the first ciphertext CT1. The first ciphertext CT1 may include historical information OP_HIS in the form of a tag. The first ciphertext CT1 is converted into a second ciphertext CT2 through the first operation OP1. Therefore, the noise predictor 1140 (see Figure 1 ) The noise prediction value Naprx is generated using the historical information OP_HIS according to the number or type of operations used in the first operation OP1. In the same way, the noise prediction value Naprx can be generated in the second operation OP2. If it is determined that the noise prediction value Naprx generated in the second operation OP2 exceeds the reference value Nreq or the reserved protection interval GI is exhausted, the homomorphic encryption operation device 1100 stops the additional operation. Then, the operation intermediate value CT' and the noise prediction value Naprx will be sent to the homomorphic encryption device 1200. Therefore, the homomorphic encryption device 1200 generates an encryption parameter PRMT using the received noise prediction value Naprx, and the homomorphic encryption device 1200 can decrypt the operation intermediate value CT' based on the generated encryption parameter PRMT.

[0087] By using noise prediction, the noise level in ciphertext operations can be predicted. In addition, by using the noise prediction value, encryption or decryption of ciphertext is possible even in the absence of operation information.

[0088] Fig.12 is a block diagram illustrating an example of a homomorphic encryption system according to some embodiments. Fig.12 In the embodiment, the homomorphic encryption system 2000 may include a homomorphic encryption operation device 2100 and a homomorphic encryption device 2200. For example, the homomorphic encryption device 2200 may process the ciphertext operation that is not completed in the homomorphic encryption operation device 2100. That is, the homomorphic encryption device 2200 may receive the suspended operation ciphertext CT_interm and the remaining operation information OP_remained to complete the operation that is not completed in the homomorphic encryption operation device 2100.

[0089] The homomorphic encryption operation device 2100 performs an operation on the ciphertext CT sent from the homomorphic encryption device 2200. The homomorphic encryption operation device 2100 may be a server. The homomorphic encryption operation device 2100 performs an operation on the ciphertext CT sent from the homomorphic encryption device 2200. For security purposes, noise is inserted into the homomorphically encrypted ciphertext CT. When calculations are performed, the noise in the data increases. If the noise increases beyond an appropriate degree as the number of operations increases, decoding may become impossible. Therefore, when generating a ciphertext, the homomorphically encrypted ciphertext CT includes a protection interval GI to prevent noise from affecting the original data due to operations between ciphertexts.

[0090] The homomorphic encryption operation device 2100 can generate a noise prediction value Naprx so that the homomorphic encryption device 2200 can set an appropriate protection interval GI and perform encryption / decryption without sending operation information. To this end, the homomorphic encryption operation device 2100 includes a homomorphic encryption operator 2120 and a noise predictor 2140. The homomorphic encryption operator 2120 performs various operations on the ciphertext CT provided by the homomorphic encryption device 2200. Whenever each operation occurs, the homomorphic encryption operator 2120 generates historical information OP_HIS. Therefore, the historical information OP_HIS can be added and updated to the ciphertext CT generated as a result of the operation in the form of a tag.

[0091] The noise predictor 2140 predicts the noise accumulated by the operation of the ciphertext based on the history information OP_HIS provided by the homomorphic encryption operator 2120. The noise predictor 2140 can check the size of the noise prediction value Naprx and determine when to stop the operation. If the noise prediction value Naprx corresponds to the point where the operation is stopped, the operation of the ciphertext can be stopped. The noise predictor 2140 sends the suspended operation ciphertext CT_interm and the remaining operation information OP_remained from the suspended operation to the homomorphic encryption device 2200. Here, the remaining operation information OP_remained refers to information about the remaining operations that the homomorphic encryption operator 2120 failed to perform on the ciphertext CT.

[0092] The homomorphic encryption device 2200 converts plaintext into ciphertext or converts ciphertext into plaintext using a homomorphic encryption algorithm. The homomorphic encryption device 2200 may be a user device. For example, the homomorphic encryption device 2200 receives the suspended operation ciphertext CT_interm and the remaining operation information OP_remained from the homomorphic encryption operation device 2100, and continues the operation stopped in the homomorphic encryption operation device 2100. In addition, the homomorphic encryption device 2200 may use the noise prediction value Naprx to obtain a protection interval GI for encryption without operation information.

[0093] The homomorphic encryption device 2200 generates an encryption parameter PRMT according to the noise prediction value Naprx provided from the homomorphic encryption operation device 2100. In addition, the homomorphic encryption device 2200 can use the encryption parameter PRMT to obtain the optimal protection interval GI and generate a ciphertext. Therefore, the homomorphic encryption device 2200 may include a homomorphic encryption parameter generator 2220 and an encryption / decryption circuit 2240.

[0094] Specifically, the homomorphic encryption device 2200 may use the suspended operation ciphertext CT_interm and the remaining operation information OP_remained to continue the encryption operation stopped in the homomorphic encryption operation device 2100. For example, the homomorphic encryption device 2200 may continue the operation stopped in an incomplete state by the homomorphic encryption operation device 2100. For this purpose, the homomorphic encryption device 2200 may use the suspended operation ciphertext CT_interm and the remaining operation information OP_remained.

[0095] In addition, the homomorphic encryption parameter generator 2220 can obtain a protection interval GI that satisfies at least one condition from the noise prediction value Naprx provided by the homomorphic encryption operation device 2100. For example, the condition may include the security of the homomorphic encryption standard, the size or capability of the functional block IP of the homomorphic encryption device 2200, or the constraints required by the application model. The homomorphic encryption parameter generator 1220 constructs a parameter mapping table based on the noise prediction value Naprx and provides the protection interval GI at high speed.

[0096] The encryption / decryption circuit 2240 performs encryption and decryption operations using parameters (e.g., protection intervals) provided from the homomorphic encryption parameter generator 2220. For example, the encryption / decryption circuit 2240 may generate ciphertext using the optimized protection interval GI provided from the homomorphic encryption parameter generator 2220 during encryption. In this case, the optimal protection interval GI for encryption may be generated without the operation information of the homomorphic encryption operation device 2100 implemented as a server. Therefore, encryption or decryption may be performed using parameters such as the protection interval GI optimized for the homomorphic encryption system 2000.

[0097] In some embodiments, the homomorphic encryption system 2000 can obtain the optimal parameters applied to encryption by using the noise prediction value Naprx generated from the noise predictor 2140 instead of the operation information. For example, the size of the optimal protection interval GI for encryption of homomorphic encryption can be generated from the noise prediction value Naprx. In addition, the homomorphic encryption device 2200 can use the suspended operation ciphertext CT_interm and the remaining operation information OP_remained from the homomorphic encryption operation device 2100 to complete the encryption operation stopped in the homomorphic encryption operation device 2100.

[0098] Fig.13 is a more detailed illustration of some embodiments of the Fig.12 A block diagram of an example configuration of a homomorphic encryption device. Fig.13 In the embodiment, the homomorphic encryption device 2200 may include a homomorphic encryption parameter generator 2220 , a homomorphic encryption operation circuit 2230 , and an encryption / decryption circuit 2240 .

[0099] The homomorphic encryption parameter generator 2220 receives the noise prediction value Naprx provided by the noise predictor 2140. In addition, the homomorphic encryption parameter generator 2220 may generate a parameter mapping table 2225 with reference to the received noise prediction value Naprx and the constraints of the homomorphic encryption system 2000. The constraints of the homomorphic encryption system 2000 may include, for example, the security level of the homomorphic encryption system 2000, the size of the protection interval GI that the homomorphic encryption function block IP can support, and the protection interval GI required to run an application model (e.g., machine learning).

[0100] The homomorphic encryption operation circuit 2230 processes and completes the encryption operation stopped in the homomorphic encryption operation device 2100 using the suspended operation ciphertext CT_interm and the remaining operation information OP_remained sent from the homomorphic encryption operation device 2100. The homomorphic encryption operation circuit 2230 completes the operation using the suspended operation ciphertext CT_interm and the remaining operation information OP_remained, generates a completed ciphertext CT' as a result, and sends it to the decryption circuit 2244.

[0101] The encryption / decryption circuit 2240 may include an encryption circuit 2242 and a decryption circuit 2244. The encryption circuit 2242 may encrypt the data DT using the encryption parameter PRMT provided by the homomorphic encryption parameter generator 2220. The encryption circuit 2242 may receive the data DT from the outside, and generate a ciphertext CT by homomorphically encrypting the data DT according to the encryption parameter PRMT provided from the parameter generation circuit 1222. For example, the encryption circuit 2242 may generate a ciphertext CT that satisfies the encryption parameter (PRMT) (i.e., the total length of the ciphertext, the size of the guard interval GI, the length of the message, or the length of the error).

[0102] The decryption circuit 2244 may receive the final ciphertext CT' generated by completing the remaining calculations from the homomorphic encryption operation circuit 2230, decrypt it, and output the decrypted data PT. The decryption circuit 2244 decrypts the data PT from the final ciphertext CT' by referring to the encryption parameter PRMT (i.e., the total length of the ciphertext, the size of the protection interval GI, the length of the message, or the length of the error).

[0103] As described above, the homomorphic encryption device 2200 can perform encryption and decryption using the noise prediction value Naprx provided from the noise predictor 2140 instead of the operation information of the system. In addition, the homomorphic encryption device 2200 can use the suspended operation ciphertext CT_interm and the remaining operation information OP_remained sent from the homomorphic encryption operation device 2100 to complete the suspended encryption operation.

[0104] Fig.14 An example of the generation of a noise prediction value Naprx performed in a homomorphic encryption system according to some embodiments, and an example of a calculation method using a suspended operation ciphertext CT_interm and remaining operation information OP_remained in a homomorphic encryption device according to some embodiments are shown. Fig.14 In the process, the homomorphic encryption operation device 2100 and the homomorphic encryption device 2200 can exchange the noise prediction value Naprx, the suspended operation ciphertext CT_interm and the remaining operation information OP_remained.

[0105] In step S310 , the ciphertext CT generated by the homomorphic encryption device 2200 is sent to the homomorphic encryption operation device 2100 .

[0106] In step S320, the homomorphic encryption operation device 2100 performs a homomorphic encryption operation on the received ciphertext CT. Therefore, historical information OP_HIS such as the type or number of operations on the ciphertext CT is generated. The historical information OP_HIS can be added to the ciphertext CT in the form of a tag and updated. When the operation is repeated, the number of multiplications or additions recorded in the historical information OP_HIS can be updated in a cumulative form.

[0107] In step S330, the noise predictor 2140 (see Fig.12 ) generates a noise prediction value Naprx corresponding to the type or number of operations recorded in the history information OP_HIS. Therefore, the noise predictor 2140 can generate noise prediction values ​​Naprx corresponding to various types of operations recorded in the history information OP_HIS. The noise prediction value Naprx is estimated information about the size of noise generated by subsequent operations.

[0108] In step S340, the homomorphic encryption operator 2120 checks whether the noise prediction value Naprx generated in step S330 exceeds the reference value Nreq. If the noise prediction value Naprx does not exceed the reference value Nreq ('no' direction), the process returns to step S320 and continues to calculate the ciphertext. If the noise prediction value Naprx exceeds the reference value Nreq ('yes' direction), the process proceeds to step S350.

[0109] In step S350 , the homomorphic encryption operation device 2100 stops further ciphertext operations and sends the suspended operation ciphertext CT_interm, the noise prediction value Naprx and the remaining operation information OP_remained to the homomorphic encryption device 2200 .

[0110] In step S360, the homomorphic encryption device 2200 receives the suspended operation ciphertext CT_interm, the noise prediction value Naprx, and the remaining operation information OP_remained transmitted from the homomorphic encryption operation device 2100. Then, the noise prediction value Naprx is used to generate the encryption parameter PMRT to be used in the encryption or decryption operation of the homomorphic encryption device 2200. In addition, the homomorphic encryption device 2200 may process and complete the suspended encryption operation using the suspended operation ciphertext CT_interm and the remaining operation information OP_remained transmitted from the homomorphic encryption operation device 2100. The homomorphic encryption operation circuit 2230 may complete the operation using the suspended operation ciphertext CT_interm and the remaining operation information OP_remained, and generate the final ciphertext CT' as a result.

[0111] In step S370 , the homomorphic encryption device 1200 may receive the final ciphertext CT′, decrypt it, and output the decrypted data PT.

[0112] As described above, the homomorphic encryption device 2200 can perform encryption and decryption using the noise prediction value Naprx provided from the noise predictor 2140 instead of the operation information of the system. In addition, the homomorphic encryption device 2200 can use the suspended operation ciphertext CT_interm and the remaining operation information OP_remained sent from the homomorphic encryption operation device 2100 to complete the suspended encryption operation.

[0113] Fig.15 is a block diagram illustrating an example of a homomorphic encryption system 3000 according to some embodiments. Fig.15 In FIG. 3 , the homomorphic encryption system 3000 may include a server 3100, a user device 3200, and a network 3300. For example, the server 3100 may be connected to Figure 1 Homomorphic encryption operation device 1100 or Fig.12 The homomorphic encryption operation device 2100 operates substantially the same. The user device 3200 can be used with Figure 1 Homomorphic encryption device 1200 or Fig.12 The homomorphic encryption device 2200 operates substantially the same.

[0114] The server 3100 performs operations on the ciphertext CT sent from the user device 3200. The server 3100 can use distributed computing or mobile edge computing to provide cloud services or ultra-low latency services. In particular, the server can be an intelligent server that performs calculations on the ciphertext CT using machine learning or neural networks.

[0115] The server 3100 provides a noise prediction value Naprx so that the user device 3200 can set an optimal protection interval GI and perform encryption / decryption without operation information. For this purpose, the server 3100 includes a homomorphic encryption operator 3120 and a noise predictor 3140. The homomorphic encryption operator 3120 performs various operations on the ciphertext CT provided by the user device 3200. Whenever each operation occurs, the homomorphic encryption operator 3120 generates historical information OP_HIS. Therefore, the historical information OP_HIS can be added and updated to the ciphertext CT generated as a result of the operation in the form of a tag.

[0116] The noise predictor 3140 predicts the noise accumulated by the operation of the ciphertext according to the history information OP_HIS provided by the homomorphic encryption operator 3120. Based on the noise prediction value Naprx, the noise predictor 3140 transmits the calculated intermediate value CT' and the noise prediction value Naprx to the user equipment 3200.

[0117] The user device 3200 uses a homomorphic encryption algorithm to convert plaintext into ciphertext or to convert ciphertext into plaintext. For example, the user device 3200 can calculate the optimal protection interval GI size for encryption without operation information from the server 3100. Generate an encryption parameter PRMT based on the noise prediction value Naprx provided from the server 3100. In addition, the user device 3200 can use the encryption parameter PRMT to obtain the optimal protection interval GI and generate a ciphertext. Therefore, the user device 3200 may include a homomorphic encryption parameter generator 3220 and an encryption / decryption circuit 3240.

[0118] In some embodiments, the homomorphic encryption parameter generator 3220 may obtain a protection interval GI that satisfies at least one condition from the noise prediction value Naprx provided by the self-server 3100. For example, the condition may include the security of the homomorphic encryption standard, the size or capability of the functional block IP of the user device 3200, or the constraints required by the application model. The homomorphic encryption parameter generator 3220 may construct a parameter mapping table based on the noise prediction value Naprx and provide the protection interval GI at high speed.

[0119] In some embodiments, the encryption / decryption circuit 3240 performs encryption and decryption operations using parameters (e.g., protection intervals) provided from the homomorphic encryption parameter generator 3220. For example, the encryption / decryption circuit 3240 may generate ciphertext using the optimized protection interval GI provided from the homomorphic encryption parameter generator 3220 during encryption. Therefore, even without the operation information provided from the server 3100, an optimal protection interval GI for encryption may be generated. In addition, it is possible to perform encryption or decryption using parameters such as the protection interval GI optimized for the homomorphic encryption system 3000.

[0120] The network 3300 may be an Ethernet communication network. The server 3100 and the user device 3200 may be connected to the network 3300 via an Ethernet switch. However, the network 3300 may be one of any wired / wireless networks, such as a LAN (Local Area Network), a WAN (Wide Area Network), Wi-Fi, etc.

[0121] In some embodiments, the homomorphic encryption system 3000 can obtain the optimal parameters applied to encryption by using the noise prediction value Naprx generated from the noise predictor 3140 instead of the operation information. For example, the size of the optimal protection interval GI for encryption of homomorphic encryption can be generated from the noise prediction value Naprx. Therefore, the optimal protection interval GI required for encryption can be easily generated without the operation information of the server.

[0122] Although the present disclosure contains many specific implementation details, these should not be interpreted as limiting the scope of the protection claimed. Certain features described in the present disclosure in the context of separate implementations may also be implemented in combination in a single implementation. On the contrary, various features described in the context of a single implementation may also be implemented in multiples individually or in any suitable sub-combination. In addition, although the features may be described above as working in certain combinations, one or more features from the combination may be deleted from the combination in some cases, and the combination may be directed to a sub-combination or a variation of the sub-combination.

Claims

1. A method of operating a homomorphic encryption system, comprising: Generate ciphertext; performing an operation on the ciphertext; generating historical information about the operation; generating a noise prediction value by predicting noise accumulated in the ciphertext by the operation based on the history information; generating encryption parameters including a guard interval inserted into the ciphertext based on the noise prediction value; as well as Homomorphic encryption is performed based on the encryption parameters.

2. The method according to claim 1, wherein: Generating the historical information includes: The historical information is marked with a result of the operation on the ciphertext.

3. The method according to claim 2, wherein: The history information includes at least one of the following: (1) the number of multiplications or additions between ciphertexts included in the operation, (2) the number of multiplications or additions between the ciphertext and plaintext, (3) binary tree multiplication of the ciphertext, or (4) binary tree addition.

4. The method according to claim 1, further comprising: determining whether the noise prediction value exceeds a reference value; stopping the operation based on determining that the noise prediction value exceeds the reference value; as well as The noise prediction value and the intermediate value of the stopped operation are sent to the user equipment.

5. The method according to claim 4, further comprising: Based on the noise prediction value not exceeding the reference value, (1) performing the operation, (2) generating the history information, and (3) generating the noise prediction value are repeated.

6. The method according to claim 4, further comprising: The operational intermediate value is re-encrypted at the user equipment using the encryption parameter.

7. The method according to claim 4, further comprising: The server sends the noise prediction value, the operation intermediate value and the remaining operation information to the user equipment; The user equipment generates the encryption parameter using the noise prediction value; as well as An operation after stopping the operation is performed by the user equipment using at least one of the operation intermediate value, the remaining operation information, or the encryption parameter.

8. The method according to claim 7, wherein: The user equipment comprises an arithmetic circuit configured for subsequent operations.

9. The method according to claim 7, wherein: Generating the encryption parameters includes: Selecting a first parameter range corresponding to a security level and hardware complexity of the homomorphic encryption system based on the noise prediction value; selecting a second parameter range corresponding to a capability or size of a homomorphic encryption function block of the homomorphic encryption system based on the noise prediction value; and The encryption parameter is determined based on the first parameter range and the second parameter range.

10. A homomorphic encryption system, comprising: A server, wherein the server is configured to: Performing the operation on the first ciphertext, and generating a noise prediction value by estimating noise accumulated in the first ciphertext by the operation; as well as User equipment, the user equipment is configured to: generating a second ciphertext using the noise prediction value, and The size of the protection interval added based on generating the second ciphertext is determined.

11. The system according to claim 10, wherein: The server comprises: a homomorphic encryption operator configured to perform the operation on the first ciphertext and generate history information including characteristics of the operation; and A noise predictor is configured to generate the noise prediction value based on the historical information. The system according to claim 11 , wherein the history information is marked with the first ciphertext.

13. The system according to claim 11, wherein: The history information includes at least one of the following: the number of multiplications or additions included in the operation, the number of binary tree multiplications or the number of binary tree additions of the first ciphertext.

14. The system according to claim 10, wherein: The server is configured to: stopping the operation based on the noise prediction value exceeding a reference value, and The noise prediction value and the operation intermediate value of the stopped operation are sent to the user equipment.

15. The system of claim 14, wherein: The user equipment is configured to generate encryption parameters from the noise prediction value and to re-encrypt the operational intermediate value using the encryption parameters.

16. The system of claim 15, wherein: The server is configured to send remaining operation information of the stopped operation to the user equipment, The user equipment is configured to use at least one of the operation intermediate value, the remaining operation information or the encryption parameter to perform a subsequent operation of the stopped operation.

17. The system according to claim 10, wherein: The user equipment comprises: a parameter generator configured to generate encryption parameters including the protection interval based on the noise prediction value; and The encryption / decryption circuit is configured to generate the second ciphertext using the encryption parameter.

18. A method of operating a homomorphic encryption system, comprising: The server performs operations on the ciphertext; generating, by the server, historical information about the operation; generating, by the server, a noise prediction value by predicting noise accumulated in the ciphertext by the operation based on the history information; The server sends the noise prediction value to a user device; as well as Generating, by the user equipment, an encryption parameter that can be used for encryption based on the noise prediction value; as well as Homomorphic encryption is performed based on the encryption parameters.

19. The method according to claim 18, further comprising: suspending, by the server, the operation based on the noise prediction value exceeding a reference value; as well as An operation intermediate value of the suspended operation is sent from the server to the user equipment.

20. The method according to claim 18, wherein: Generating the historical information includes: The server uses the operation result of the ciphertext to mark the historical information.

Images