Method for homomorphic determination of symbols of message by expansion, related method and device

Abstract

The invention relates to a method for homomorphic determination of a positive or negative character of a corresponding message [mu] from an encrypted message c encrypted by means of a fault-tolerant learning problem-type method, the message [mu] belonging to a discrete toroidal surface Tp or belonging to a space bijection to Tp, having formula (p), each integer pi being co-prime, the encrypted message c consisting of q components Ci, with formula (c), vi is a Bezout coefficient associated with an integer pi. The method comprises expanding the encrypted message c at least once according to formula (c [1]), wherein p is an odd number greater than or equal to 3. The method further comprises merging the parameters representing the symbols of c and the symbols of c [1].

Description

Technical Field

[0001] The present technical field is the technical field of homomorphic cryptography methods, devices and systems. Background Art

[0002] Homomorphic cryptography has recently attracted much attention. Homomorphic cryptography makes it possible to perform computations or data processing on encrypted data without first decrypting the encrypted data.

[0003] In fact, the digital processing of personal data has become ubiquitous in our daily lives. Therefore, protecting the confidentiality of this data and the privacy of the individuals involved has become crucial as this personal data is increasingly disseminated in digital environments and systems used in daily life.

[0004] In this context, encryption and homomorphic processing technologies appear to be a very promising solution, as they make it possible to process these data in a particularly secure way while maintaining their anonymity and privacy, since the data are not decrypted during processing.

[0005] Therefore, homomorphic cryptography methods face the following technical challenges:

[0006] - enables external (usually remote) services and processing servers to perform "blind" operations on encrypted data without decrypting the encrypted data because the server does not have the key required to decrypt the data,

[0007] - Having the encrypted data provided by another different entity (a client in a computing sense) that has the encryption key available.

[0008] For example, these data processing operations can include performing individual operations on individual data items to format or filter them. However, the most notable applications involve operations that compare, sort, or group data. Therefore, having tools that can compare data efficiently and homomorphically is extremely useful.

[0009] Homomorphic cryptography can be based on the "Learning With Errors" (LWE) encryption scheme, in which the encrypted message c = (a, b) is derived from the unencrypted message μ according to the following formula: b = μ + e + as, where:

[0010] -s is the secret key,

[0011] -a is a randomly chosen vector used to project the secret key s, and

[0012] -e is the random noise component added to μ+as.

[0013] To decrypt the message, someone with the secret key can calculate the parameter b – as (which is equal to μ + e), then round the result to remove the noise component e and recover the message μ. Of course, if the message μ is to be recovered, the noise term e should be small and remain small.

[0014] When two encrypted messages are added, the result is an encrypted message that is an encrypted version of the sum (of the two original unencrypted messages) (with a higher noise component than the two original encrypted messages).

[0015] Therefore, to prevent the noise term from increasing and growing during data processing, a refreshing procedure, often called "bootstrapping," is repeatedly performed. This procedure generates a refreshed version of c, i.e., an encrypted message c', which (when decrypted using s) also decrypts to μ, but with a smaller noise component than c. This bootstrapping procedure is very useful and clever, but also very computationally expensive (especially because the operations involved must be performed homomorphically), and especially because it must be performed very regularly.

[0016] The homomorphic encryption scheme described above that combines the "fault-tolerant learning problem" and bootstrapping therefore has the disadvantage that it is usually very cumbersome to implement and requires a lot of computing power or time.

[0017] To facilitate the operations in question, it is usually chosen to operate on binary messages, that is, messages with a value of 0 or 1. Therefore, the complex tools developed to implement this type of cryptographic scheme (especially tools for bootstrapping) are tools suitable for binary messages.

[0018] To perform homomorphic operations on longer messages, the message is decomposed into multiple binary messages (traditional binary decomposition), each binary message is encrypted separately, and then the operation is performed homomorphically bit by bit. However, in this process, the (encrypted) carry number generated by each addition operation or binary operation should be taken into account and propagated to the next binary operation. Therefore, this is a continuous process, which is particularly expensive in terms of computing time. In addition, the individual binary operations are performed homomorphically, which increases the number of homomorphic operations (and is therefore time-consuming).

[0019] Therefore, in this context, it is useful to use homomorphic encryption techniques that are more computationally efficient and particularly well-suited for database processing operations (e.g., comparison or sorting type operations). Summary of the Invention

[0020] Therefore, the present technology relates to a method for homomorphically determining the positive or negative sign of a corresponding message μ from an encrypted message c without decrypting the encrypted message c, the encrypted message c corresponding to the message μ being encrypted by a fault-tolerant learning problem-type method,

[0021] -The message μ belongs to a discrete torus or belongs to T p The space of bijections, where Each integer p i are mutually prime, the encrypted message c consists of q components c i Composition, of which v i is the integer p i The associated Bézout coefficient, v i by u i p i +v i p / p i =1 definition,

[0022] -The method comprises:

[0023] - a scaling step, which consists in following the formula Determine the dilated encrypted message c [1] ,in is an odd number greater than or equal to 3, and

[0024] - a merging step, which consists in calculating the sum F0(c)+F1(c [1] ), where F0 and F1 represent the homomorphic calculation of the parameter att [0] .gε and parameter att [1] The operation of gε, gε is a step function that is zero on the central interval [-ε / 2,ε / 2] and has two different values ​​on both sides of the central interval, and the coefficient att [1] Less than coefficient att [0] .

[0025] For example, the coefficient att [0] and att [1] So that (att [0] +att [1] ).gε remains between -1 / 2 and 1 / 2.

[0026] By applying the Chinese remainder theorem, the encrypted message c is decomposed into its q independent components c i and from these components c i Reassemble message c.

[0027] The corresponding plaintext message μ can also be decomposed into q components μ in the same wayi (and reassemble from these components).

[0028] The q components c of a message c can be processed independently of each other i , to perform multiple operations on the encrypted message c component by component (for example, homomorphic addition operations ( Figure 6 ), homomorphic multiplication operation ( Figure 7 ) or bootstrap operation), But there is no need to Propagate any carry digits .

[0029] Therefore, a special decomposition of the Chinese theorem is used to process the different components c of the encrypted message c independently and in parallel. i , which speeds up the processing relative to the binary factorization of the propagated (encrypted) carry digits.

[0030] It should be noted that different components c i Corresponding to the encrypted "sub-messages", each sub-message is (through encryption) combined with multiple "sub-messages" μ that make up the entire plaintext message μ i A sub-message in Figure 5 ).

[0031] The plan to use such factorization to develop more efficient homomorphic cryptography techniques is still far from being realized. In fact, as mentioned above, most of the homomorphic cryptography tools currently available are dedicated to binary messages. Therefore, to develop such techniques, it is necessary to go against common practices and prejudices and develop specialized (well-designed) tools for processing messages longer than binary messages (i.e., processing submessages μ i , the sub-message μ i Not only binary information with two values, because they can take p i Value, such as p i = 3, 7, 11, or even 17), it's not even known whether direct homomorphic processing of "long" messages is actually possible, or whether it can be processed efficiently. In particular, building such an encryption scheme requires devising new homomorphic multiplication schemes and new bootstrapping methods. Only once these new tools are developed can inventors determine the feasibility and interest of such a scheme, which would be factored via the Chinese remainder theorem.

[0032] These new tools (new bootstrapping and new homomorphic multiplication for non-binary "long" submessages) are described in detail in patent application PCT / IB2020 / 001147, which has not yet been published and has been filed by the same applicant.

[0033] This advance, based on these new homomorphic computing tools and this use of the Chinese Remainder Theorem, makes it possible to process long messages (e.g., which can take 7×11×13×17×19=323323 different values).

[0034] However, as mentioned in the introduction, in the field of data processing (especially for processing databases of a personal or private nature), a very useful operation is to compare two pieces of information (of data) with each other, such as sorting a database or extracting from it.

[0035] One way to compare two messages (to determine which one is larger) is to compute their difference and then determine the sign of the difference.

[0036] The homomorphic computation of the difference between two messages constructed as described above (from independent sub-messages by means of the Chinese remainder theorem) does not pose any particular difficulty and can be performed component by component. On the other hand, homomorphically determining the sign of such a message presents difficulties.

[0037] In fact, the sign of the "complete" message μ is the same as the different components μ that make up the message. i Therefore, the sign of the message μ cannot be determined component by component.

[0038] The following numerical example illustrates this, where p = p1 × p2 = 3 × 5. Two messages and have positive signs; their corresponding components are and Thus, the signs of the message components are (-1, 1) for message 2 / 15 and (1, 1) for message 7 / 15, but both messages are positive, which aptly illustrates that the sign of the complete message cannot be deduced from the signs of its components.

[0039] However, it is difficult to determine the sign of the complete message μ directly from the complete encrypted message c (without decrypting the components of the encrypted message c) because the sign function is discontinuous at 0 and because of the presence of a noise component e in the complete encrypted message c (where This component is much larger than a single message μ i Therefore, when μ is close enough to 0, it is no longer possible to reliably (homomorphically) determine the positive or negative sign of μ directly from the encrypted message c due to this significant noise component of c.

[0040] This difficulty is due to T p (p=p1×...×p q ) may have a value of μ that is greater than that of T p1 or T pi A single message μ1...μq This is further complicated by the fact that the value of is closer to 0. In other words, the discrete torus T p The different elements of the discrete torus T p1 or T pi The elements of the image are closer together (and are also affected by a larger noise component).

[0041] It should be noted that this difficulty arises for values ​​of μ close to 0 or close to the 1 / 2 and -1 / 2 ends of the torus. On the other hand, for values ​​far from these points (e.g., for values ​​close to 1 / 4 or -1 / 4), the sign of the message μ can be reliably determined directly from the encrypted message c of the message μ by a bootstrapping operation involving the evaluation of a sign function.

[0042] To overcome the above difficulties, the inventors have developed two ingenious techniques.

[0043] The first technique makes it possible to Without dilating (or only slightly dilating) the noise component e Directly operate on the encrypted version c of the message μ to Message μ for scaling , more precisely, dilating the message μ. This dilation operation (which can be performed for several increasingly large dilation factors) makes it possible (if necessary) to bring the message out of the neighborhood of 0 and into a region where its sign can be reliably determined with very low error probability, as Figure 8 Shown schematically.

[0044] The expanded encrypted message c is calculated as follows [1] to perform this inflation of the message value, rather than the associated noise: The expansion coefficient is an odd number greater than or equal to 3.

[0045] Therefore, in the sum Instead of encrypting the sub-message c i Multiply (which would increase its noise component), but instead the coefficient v i Multiply

[0046] And since many Bézout coefficients are limited to p i Internal (ie, for p i modulo), so in this sum, we can keep the multiplication by c i The coefficient of This makes it possible to dilate c (more precisely: to dilate μ) without actually dilating its noise component e.

[0047] As mentioned above, this noiseless dilation operation is very useful if the value of the message μ is close to 0. On the other hand, if the value of μ is already large before dilation (for example, close to 1 / 4), the dilation operation will modify its sign by increasing the value of μ (due to the cyclic nature of the torus), leading to incorrect results. Therefore, the message should be dilated only when necessary.

[0048] But precisely in homomorphic cryptographic protocols, the initial value of the message is unknown, and the operations are performed in a blind manner, always in encrypted form. Therefore, it is not possible to know a priori whether it is necessary to inflate the message or, on the contrary, whether it is necessary to avoid inflating it.

[0049] The second technique implemented in this approach then consists of summing the following:

[0050] - the sign of the non-expanded message μ (in its encrypted version), which is assigned 0 if the message μ is in the uncertainty region, specifically including the central interval of width ε centered at 0, and

[0051] -Expand message μ [1] The sign of (in its encrypted version) is assigned the attenuation coefficient att [1] , this attenuation factor reduces its contribution relative to the sign of the initial message μ.

[0052] Thus, if the initial message μ has a value large enough to determine its sign without error, the first term will (with the aid of the attenuation factor att [1] ) dominates the sum, and it sets the sign of that sum to be a whole (whereas the sign of the expansion message being "false" would override its contribution).

[0053] If, on the contrary, the initial message lies in the uncertainty region in question (has a sign that cannot be reliably determined), then in the sum the first term is zero and the sign of the sum is set by the sign of the expanded message, which, on the contrary, now has the correct value corresponding to the sign of c itself.

[0054] This procedure (with a weighted sum with gradually decreasing coefficients) can be generalized to the case where multiple consecutive expansions are required to escape the uncertainty region.

[0055] In order to homomorphically determine the sign of a message μ from its encrypted message c, while assigning the value 0 to this result when the message is in the uncertainty region in question, the function gε or att [0] gε is applied homomorphically to μ (which is applied when bootstrapping using an integral function computation), where gε is a step function:

[0056] - the step function is zero on the central interval [-ε / 2,ε / 2],

[0057] -The step function has two different values ​​on either side of the central interval, for example -1 and +1 ( Figure 9 ), and

[0058] -The step function is zero near the end points of the torus, on the intervals [1 / 2–ε / 2,1 / 2] and [-1 / 2,-1 / 2+ε / 2].

[0059] The two techniques described above allow homomorphically determining the sign of a message that is decomposed into multiple sub-messages based on the Chinese Remainder Theorem. More generally, they allow applying any piecewise constant function to such a message (e.g., the Heaviside function, or another function with more than two distinct pieces on the interval [-1 / 2, 1 / 2]).

[0060] In addition to the features described above, the method just proposed may include one or more of the following optional features, considered alone or in any technically feasible combination:

[0061] - The scaling step involves performing a multiplication of the inflated encrypted messages c [k] The integer k varies from 1 to K–1, and each expanded encrypted message is determined according to the following formula is determined, and wherein the positive or negative character of the message μ depends on c and the different expanded encrypted messages c [k] To determine, k=1...K–1,

[0062] The merging step comprises a packet merging step during which the following sum is calculated: F0(c)+F1(c [1] )+…+F k (c [k] )+…+F m (c [m] ), where F k Indicates the homomorphic calculation of the parameter att [k] .gε operation, where att [k] is the attenuation coefficient less than 1, the coefficient att [k] The series is decreasing, k = 0...m, and the coefficient att [k] A sequence such that: the sum of the multiple attenuation coefficients following a given attenuation coefficient among the multiple given attenuation coefficients in the sequence is less than the given attenuation coefficient; that is, for example, a geometric sequence with a common ratio less than 1 / 2;

[0063] -m is less than K;

[0064] - The merging step includes the following steps:

[0065] -S1: Merge by package, each package combines m items, and calculates the intermediate result res for each merge of the package i =F0(c [(i-1).m] )+F1(c [(i-1).m+1]) +…+F k (c [(i-1).m+k] )+…+F m-1 (c [i.m-1] ), where i is the package number,

[0066] -S2: Intermediate result res by package i Merge and calculate new intermediate results for each merge of m' intermediate result packages Correspondingly, j is the package number, Indicates the homomorphic calculation of parameters Operation,

[0067] - Repeat step S2 until only a single result is obtained, and apply the operation to that single result This provides a final result which is an encrypted version of the symbols of the message μ.

[0068] - The number of considered inflated encrypted messages K–1 satisfies

[0069] -where the width ε of the central interval is less than

[0070] The present technology also relates to a method for homomorphically applying a Heaviside function H, which is zero for negative values ​​and equal to 1 otherwise, the method comprising executing the method for determining the positive or negative character of a message μ as described above, the function gε being selected to be zero for negative values ​​and equal to 1 for positive values.

[0071] The present technology also relates to a method for homomorphically applying a piecewise constant function f to a message μ, the function f having t different pieces, the method comprising:

[0072] - Decompose the function f into a linear combination of multiple transformed Heaviside functions, namely The coefficient α j is an integer and the horizontal coordinate β of the discontinuous point j belongs to the interval [-1 / 4,1 / 4],

[0073] -Calculation parameters Each term H(μ-β j ) is determined homomorphically by the method just proposed of homomorphically applying the Heaviside function H.

[0074] This technology also relates to a method for not encrypting the message c a and c b In the case of decryption, the encrypted message c a and c b Homomorphically determine two corresponding messages μ a and μ b The maximum value method includes:

[0075] - Apply the Heaviside function H as described above to homomorphically determine the parameter H(μ a –μ b ), thus determined H(μ a –μ b ) is denoted as h, and

[0076] -Calculation parameter Maxh=hc a +(1–h).c b

[0077] - Alternatively, the Heaviside function H is applied as described above to homomorphically determine the parameter H(μ b –μ a ), thus determined H(μ b –μ a ) is recorded as h', and the parameter h'.c b +(1–h').c a .

[0078] This technology also relates to a method for not encrypting the message c a and c b In the case of decryption, the encrypted message c a and c b Homomorphically determine two corresponding messages μ a and μ b The method for the minimum value in the method includes:

[0079] - Apply the Heaviside function H as described above to homomorphically determine the parameter H(μ a –μ b ), thus determined H(μ a –μ b ) is denoted as h, and

[0080] -Calculation parameter Minh=hc b +(1–h).c a

[0081] - Alternatively, the Heaviside function H is applied as described above to homomorphically determine the parameter H(μ b –μ a), thus determined H(μ b –μ a ) is recorded as h', and the parameter h'.c a +(1–h').c b .

[0082] The technology also relates to a method for sorting a database comprising at least a first encrypted message c in a first position of the database. a , and includes at least a second encrypted message c at a second location in the database b The method includes: writing the parameter Maxh determined according to the above method or the parameter Minh determined according to the above method at the first position at least once.

[0083] According to one aspect of the present technology, any of the above-described methods is performed by a computer (programmed or otherwise configured to perform the method in question), that is, an electronic device or system (possibly remotely distributed among multiple remote devices) including at least one processor for performing logical operations and a storage device for storing data.

[0084] The present technology also relates to an encrypted communication and processing method, the method comprising the following steps:

[0085] - The client uses the private key s to encrypt at least one message μ in the form of an encrypted message c through a fault-tolerant learning problem-based method, where the message μ belongs to the discrete torus or belongs to T p The space of bijections, where Each integer p i are relatively prime, the encrypted message c=(c1,...,c i ,...,c q ) consists of q components c i Formed, where v i is the integer p i The associated Bézout coefficient, v i by u i p i +v i p / p i =1 definition,

[0086] - the client sends the encrypted message c or an encrypted database containing the encrypted message c via a communication channel to a server that is different from the client and does not have the private key s,

[0087] - homomorphically processing, by the server, the encrypted message c or the difference between the encrypted message c and another encrypted message, or the encrypted database containing the encrypted message c, according to any of the methods described above,

[0088] -The server sends the result of the homomorphic processing.

[0089] In this method, the encryption step is optional. In addition, the transmission or sending step can be omitted in this method.

[0090] The present technology also relates to a cryptographic processing server, which includes at least a communication module and a computing module:

[0091] The communication module is configured to receive an encrypted message c or an encrypted database containing the encrypted message c from an entity external to the server, the encrypted message c corresponding to a message μ encrypted by a fault-tolerant learning problem-type method, the message μ belonging to a discrete torus or belongs to T p The space of bijections, where Each integer p i are relatively prime, the encrypted message c=(c1,...c i ,...c q ) consists of q components c i Formed, where v i is the integer p i The associated Bézout coefficient, v i by u i p i +v i p / p i =1 definition,

[0092] the calculation module being programmed to homomorphically process the encrypted message c or the difference between the encrypted message c and another encrypted message, or the encrypted database containing the encrypted message c, according to any of the various (processing) methods described above, without decrypting the message c.

[0093] The communication module may be configured to also emit a result of the homomorphic processing.

[0094] The present technology also relates to a cryptographic system comprising:

[0095] - a cryptographic processing server as described above,

[0096] A client configured to encrypt at least one message μ in the form of an encrypted message c and to transmit this encrypted message c or an encrypted database containing this encrypted message c to a server via a communication channel.

[0097] The present technology and its various applications will be better understood by reading the following description and examining the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0098] These drawings are for indicative purposes only and are not limiting.

[0099] [ Figure 1 ] schematically illustrates a cryptographic system for implementing the present technology.

[0100] [ Figure 2 ] schematically shows Figure 1 An exemplary embodiment of a cryptographic processing server that can be employed in a system.

[0101] [ Figure 3 ] schematically shows Figure 1 Another exemplary embodiment of a cryptographic processing server that can be used in a system.

[0102] [ Figure 4 ] schematically shows Figure 1 Another exemplary embodiment of a cryptographic processing server that can be employed in a system is provided, particularly for performing processing operations on an encrypted database.

[0103] [ Figure 5 ] schematically illustrates the encryption operations implemented in such a system.

[0104] [ Figure 6 ] schematically illustrates the component-by-component Figure 5 The encryption operation is performed by homomorphic addition of the two encrypted messages.

[0105] [ Figure 7 ] schematically illustrates the component-by-component Figure 5 The encryption operation is a homomorphic multiplication operation of the two messages encrypted.

[0106] [ Figure 8 ] schematically illustrates the effect of a scaling operation on a message for which a sign is being attempted to be determined.

[0107] [ Figure 9 ] schematically illustrates a function for homomorphically determining the positive or negative character of such a message.

[0108] [ Figure 10 ] schematically illustrates a packet merging method for homomorphically determining the positive or negative character of such a message.

[0109] [ Figure 11 ] shows (in pseudocode) an algorithm that implements this packet merging method.

[0110] [ Figure 12] The values ​​of the Bézout coefficients and the “expanded” Bézout coefficients of the exemplary embodiment for homomorphically determining the positive or negative character of such a message are grouped together in a table. DETAILED DESCRIPTION

[0111] Figure 1 The cryptographic system 1 is generally presented and comprises:

[0112] - Cryptographic processing server 3, and

[0113] An entity 2 distinct from the server 3 , this entity 2 being configured to send one or more messages to the server 3 in encrypted form (for example in the form of an encrypted database DB).

[0114] The server 3 is configured to perform processing operations (applying functions, comparing, sorting) on ​​the received one or more encrypted messages in a homomorphic manner (i.e., without decrypting the messages). In addition, the server 3 does not have a private key for generating the one or more encrypted messages from the one or more unencrypted plaintext messages.

[0115] The entity 2 in question, which is different from the processing server, can be an external database or a client (in the computing sense), which is configured to encrypt one or more messages using a private key s (and possibly to have collected these messages in advance) and then send one or more corresponding encrypted messages to the server 3, which one or more messages are accompanied by, for example, a processing request.

[0116] Communication channel 5 connects entity 2 to server 3. For example, communication channel 5 is a communication channel where transmitted data may be intercepted. Communication channel 5 may be a wireless communication channel or a wired communication channel. Entity 2 and server 3 may be remote from each other, for example, located in different buildings. However, they may also be entities belonging to the same computing system, for example, within the same electronic device (e.g., within the same computer or portable electronic device).

[0117] The cryptographic system 1 may further comprise a destination entity 4 different from the server 3, to which the result of the homomorphic processing performed by the server 3 (the result of its own encryption) is sent via the communication channel 6. The destination entity 4 may be the entity 2 itself, and the communication channels 5 and 6 may form the same bidirectional communication channel.

[0118] The server 3 comprises a communication module for receiving and / or sending data (in practice, one or more encrypted messages are grouped together, for example, in the form of an encrypted database DB) and a computing module for performing the above-mentioned homomorphic processing operations.

[0119] The modules in question may be in the form of dedicated electronic circuits, such as a communication board (for a communication module), or may be in the form of a cryptographic computing circuit comprising at least one processor or programmable circuit and a memory (for a computing module). Thus, the server itself may be in the form of a specific electronic device.

[0120] Each of the modules discussed may also be in the form of a set of instructions that are executed by a computing system (e.g., a computer) so as to execute the steps of receiving and / or sending data (for the communication module) or processing data (for the cryptographic computing module). The server 3 may in particular be in the form of a non-local computing service that is available via a communication network (e.g., via the Internet or via an intranet) in a non-local computing structure, for example of the “cloud” type (a non-local structure on several different supporting electronic devices, remote from each other and networked).

[0121] The server 3 may be programmed to perform different processing operations homomorphically.

[0122] For example, the server 3 can be programmed to apply a piecewise function to the message. Figure 2 For example, the piecewise function in question may be a sign function Sign (which is +1 if the message is positive, -1 if the message is negative, and 0 if the message is zero), or may be a Heaviside function H (which is 0 if the message is zero or negative, and +1 otherwise), or may be a piecewise function f with more than two pieces.

[0123] The server can also be programmed to determine the two encrypted messages c a and c b Compare the two encrypted messages c with the maximum or minimum value in a and c b This corresponds to Figure 3 The case of the server 31 of the exemplary embodiment.

[0124] For example, the server can also be programmed to perform sorting (classification) on such messages in order to sort the encrypted database DB (without decrypting the encrypted database DB) to produce a fully or partially sorted database DB'. This corresponds to Figure 4 The case of the server 32 of the exemplary embodiment.

[0125] These different applications are based on a common tool, which is a method for homomorphically determining the positive or negative sign of a message (for example, by homomorphic computation of sign functions or Heaviside functions), or more generally, a method for determining the position of the message relative to a discontinuity in a piecewise function.

[0126] The following describes the following:

[0127] - the encryption scheme employed is based on the so-called "fault-tolerant learning problem" encryption method and a factorization based on the Chinese remainder theorem, and

[0128] - A method for homomorphically determining the positive or negative character of a message.

[0129] Finally, more details of the discussed applications are given.

[0130] Encryption Scheme

[0131] As mentioned above, the encryption scheme employed is based on the following: decomposition into components based on the Chinese remainder theorem, or in other words, into sub-messages.

[0132] In this scheme, every initial, unencrypted message x belongs to in Each integer p i are coprime.

[0133] Therefore, the message can be decomposed into q components x i , each component x i All belong to where x i =xmod(p i )(i.e., for (p i ) modulo), i = 1...q. This decomposition is Figure 5 Follow step D in .

[0134] For each component x i , then in this paper we calculate the discrete torus T pi The simplified component μ i =x i / p i .

[0135] Therefore, associated with x and belonging to the discrete torus T P The message (plaintext) μ = x / p can be decomposed into q components μ i ,in

[0136] Conversely, the component μ of the message μ can be calculated from the following parametersi Reconstruct the complete message μ: v i is the integer p i The associated Bézout coefficient, v i by u i p i +v i p / p i =1 definition.

[0137] Then, in step E, the private key s is used to learn each component μ according to the so-called fault-tolerant learning problem method. i Encryption is performed to determine the encrypted component c i . Encrypted component c i =(a i ,b i ) is determined as follows:

[0138] - Randomly select vector a i ,as well as

[0139] -Calculation parameter b i =μ i +e i +a i .s, where e i To add to μ i +a i .s noise component.

[0140] As described in this paper, when μ i Belongs to T pi When the noise component e i Belongs to the torus T = [-1 / 2, 1 / 2].

[0141] The complete encrypted message can be represented by the q components c of the encrypted message i Indicates that i = 1...q, and its form is C = (c1,...c i ,...c q ). The complete encrypted message can also be reconstructed explicitly from these components in the form It directly corresponds to the encrypted version of μ (encrypted with the same key s through the fault-tolerant learning problem). The items b of the encrypted message c = (a, b) belong to the torus T = [-1 / 2, 1 / 2], and its different components c i =(a i ,b i ) i The same is true.

[0142] In order to decrypt c (or equivalently decrypt C), the multiple components c i Before reconstructing the complete plaintext message μ, for each component ci Decrypt (to obtain the plaintext component μ i ).

[0143] Each component c i The decryption module with the private key s performs decryption in the following way: Calculate the parameter b i –a i .s(equal to μ i +e i ), and round the result to the discrete torus T pi The closest value to remove the noise component e i To finally obtain μ i .

[0144] Therefore, for the component μ i The encrypted component c is obtained by encryption i It can also be written as

[0145] The above encryption scheme is based on the fact that the message μ belongs to the discrete torus T p However, when the message μ belongs to T p When the discrete set of bijections is This encryption scheme can also be applied when .

[0146] In any case, as pointed out in the "Summary of the Invention" section, the encryption scheme based on the decomposition according to the Chinese Remainder Theorem makes it possible to directly obtain the encrypted message C=(c1,...c i ,...c q ) can be very efficient to perform operations on messages μ (or equivalently on messages x) homomorphically. In fact, by processing the c of C independently of each other (and thus possibly in parallel with each other), i Components, several operations including addition, subtraction, multiplication, and bootstrapping (or "refresh") can be performed directly from message C without propagating the carry bit.

[0147] The homomorphic addition of the two messages C1 and C2, both in encrypted form, is performed as follows ( Figure 6 ):

[0148]

[0149] Parameters Equal to c1 item by item i and c2 i The sum of:

[0150] Similarly, the homomorphic multiplication of the above encrypted messages C1 and C2 is performed as follows ( Figure 7 ):

[0151] C1⊙C2=(c11⊙c21,...,c1 i ⊙c2 i ,....c1 r ⊙c2 r )

[0152] where c1 i ⊙c2 i Indicates two belonging to T pi ×T pi , which is described in detail in the unpublished patent application PCT / IB2020 / 001147 filed by the same applicant (paragraphs 118 to 134 of that earlier application and initial claim 6; in that earlier application, the symbols are generally the same as used herein, but the symbol μ replaces the symbol m and the symbol q replaces the symbol r).

[0153] Similarly, the following parameters C′=(G(c1),...G(c i ),...,G(c r )) to determine a "refreshed" version C' of the encrypted message C, where G represents the pi This bootstrapping operation is described in more detail in paragraphs 85 to 117 of the aforementioned patent application PCT / IB2020 / 001147 and in initial claim 3 of that earlier application.

[0154] Homomorphically determine the positive or negative character of a message

[0155] As explained in the "Summary of the Invention" section, unlike the operations of addition, subtraction, multiplication and bootstrapping, the sign of the message μ cannot be determined from the corresponding signs of the components of the message.

[0156] And it is difficult to determine the sign of the message μ directly from its encrypted version c (explained in detail in the “Summary” section) because the encrypted message c is subject to a significant noise component. This makes it impossible to reliably determine the sign when μ is close to 0.

[0157] Furthermore, more generally, since T p The elements in are close to (than T pi The elements in are closer), and the noise component e is significant (greater than the influence component c i The noise component e i ), so it is usually impossible to directly decrypt the encrypted message c reliably (the decryption involves decrypting each component c iDecrypt and then reconstruct μ).

[0158] As an example,

[0159] - for p = p1×p2×p3×p4×p5×p6×p7=7×11×13×15×17×19×23,

[0160] - and for a single noise component e i , select its amplitude so that it can be adjusted from 1 to 10 -10 The probability of obtaining each component c i The correct decryption of

[0161] - It can be proved that it belongs to T p The probability that the message μ is incorrectly decrypted is greater than 0.65, which clearly shows that it is actually impossible to directly and reliably decrypt c (or directly and reliably determine its sign).

[0162] As explained in the "Summary of the Invention" section, two original techniques are provided to overcome this difficulty and reliably determine the positive or negative sign of a message μ directly from the fully encrypted version c of the message μ in a homomorphic manner. These two original techniques are a scaling technique with little or no added noise and a sign merging technique, which are described in more detail below.

[0163] Noiseless scaling

[0164] When the message μ is close to 0, or close to the 1 / 2 edge and -1 / 2 edge of the torus T, it is in an uncertainty region where the sign of the message μ cannot be reliably determined.

[0165] A scaling operation, or more precisely a dilation operation, which does not significantly increase the noise affecting the message, can be used to bring the value of the message out of this uncertainty region ( Figure 8 The uncertainty regions in question correspond to the intervals: [-ε / 2,ε / 2], [1 / 2–ε / 2,1 / 2] and [-1 / 2,-1 / 2+ε / 2] (where ε is a parameter, explained later).

[0166] The scaling operation consists in following the formula From message c (more precisely, from component c of message c i ) Calculate the expanded encrypted message c [1] , where the expansion coefficient is an odd number greater than or equal to 3 and less than p.

[0167] As mentioned above, this operation makes it possible to inflate the message μ without increasing (or only slightly increasing) the correlated noise component.

[0168] It will be appreciated that for some values ​​of μ, such an expansion enables the value in question to be brought out of the uncertainty region. However, for other smaller values, a larger expansion may be required to bring the value out of the uncertainty region.

[0169] It is worth noting that considering the series k=0,…,∞, indicating that for

[0170] -If μ∈[0,ε′], then there exists an integer k * ∈N * , so that for any 0≤k <k * , all exist and In other words, in the following There is indeed an expansion coefficient For this expansion coefficient Inflation News is outside the uncertainty region (i.e., has a determinate sign) and has the same sign as μ (in the following This is the first expansion coefficient, for which outside the uncertainty region), and

[0171] -If μ∈[1 / 2-ε′,1 / 2], then there exists an integer k * ∈N * , so that for any 0≤k <k * ,exist at the same time

[0172] Prove the existence of k* and limit its value.

[0173] This result can be demonstrated as follows.

[0174] First, it is important to note that:

[0175]

[0176] Furthermore, if μ∈[1 / 2-ε′,1 / 2], then 1 / 2-μ∈[0,ε′], and as above, there exists:

[0177]

[0178] Taking the symmetric modulus 1, we get that if μ∈[1 / 2-ε′,1 / 2], then

[0179] Now assume μ∈[0,ε′]. Let k* be the largest integer such that for any k=1…k*–1, Such integers exist because And if k→∞ then Then, when When, there is

[0180]

[0181] Therefore, use It can be obtained that k* exists and is in Specifies the next higher integer value.

[0182] A symmetric proof shows that when μ∈[1 / 2-ε ′ ,1 / 2], k* also exists and is

[0183] Consider T p The minimum value of μ on (i.e., 1 / (2p)) and the value closest to 1 / 2 (i.e., 1 / 2-1 / (2p)) yield the following bounds on k*:

[0184]

[0185] And, more specifically, considering the maximum value ε' applicable to this protocol, i.e. Also exists:

[0186]

[0187] Since the value of the message μ is unknown (because it is encrypted), during the scaling step the computation is performed with increasingly larger expansion factors Several expanded encrypted messages c [k] Until the news of expansion is confirmed The value has left the uncertainty region.

[0188] In other words, for k = 1...K–1, using the expansion coefficient To calculate multiple expanded encrypted messages c [k] , where K is chosen to be large enough so that K–1 is greater than or equal to the integer k* mentioned above (i.e., in order to ensure that the sequence k=1...K–1 will leave the uncertainty region at some point).

[0189] To this end, given the above bounds on the value of k* established, we choose K such that

[0190] Therefore, K can be chosen as follows: or as follows:

[0191] During the scaling step, according to the following formula to determine each inflated encrypted message, where k = 1...K–1.

[0192] As explained in the "Summary of the Invention" section, in the following for k = 1...K–1,

[0193] - For k < k*, generally, the sign of cannot be reliably determined from the encrypted version c [k] of .

[0194] - For k = k*, the sign of can be reliably determined from the encrypted version c [k] of , and the sign of

[0195] is equal to the sign of the message μ, and - For k > k*, the sign of

[0196] may be incorrect, that is, it is no longer equal to the sign of μ. [k] Then, during the merging step, the different inflated encrypted messages c

[0197] merge

[0198] are considered in a specific way, where k = 1...K–1, in order to deduce the sign of the message μ from these encrypted messages (and the sign obtained in encrypted form, since this is a homomorphic calculation method). [k] In the following c [0] = c, where k = 0...K–1, the inflated encrypted messages are those that allow the determination of a reliable sign (i.e., corresponding to inflated messages located outside the indeterminate region), and it is unknown whether they are the same as the sign of μ. Therefore, all this information is taken into account herein to determine the sign of μ:

[0199] - a) If μ is in the indeterminate region, then the sign of μ is determined by assigning the value 0 to the sign (or the function representing the sign) of each inflated message

[0200] , and

[0201] - b) By using a weighting coefficient att [k]The symbols of each inflated message (or the functions representing those symbols) are weighted so that, relative to the symbols of the next inflated encrypted message (whose symbols may be "wrong", i.e., different from the symbols of μ), greater weight is given to the symbols of the first inflated encrypted message whose "symbol" is non - zero (i.e., the first inflated message outside the uncertainty region).

[0202] Then, the weighted sum of these symbols (or the values representing these symbols) is calculated so that a positive, negative, or zero result (e.g., values +1 / 4, -1 / 4, 0; or +1 / 3, -1 / 3, 0) can be homomorphically obtained depending on whether the message μ is positive, negative, or zero.

[0203] In fact, in this sum:

[0204] - The terms corresponding to k < k* are zero;

[0205] - The first non - zero term associated with the inflated message (in fact, the term F k* (c [k*] )) has the symbol of μ, and

[0206] - Due to the decreasing property of the attenuation coefficient att [k] (more precisely, due to the fact that the sequence of coefficients att [k] satisfies: the sum of each attenuation coefficient after any attenuation coefficient in this sequence is less than that attenuation coefficient, which can be obtained, for example, with a geometric sequence with a common ratio less than 1 / 2), the following terms corresponding to k > k* may have arbitrary signs but do not modify the sign of the sum.

[0207] In practice, to implement this merging technique, for each inflated encrypted message c [k] , the parameter F k (c [k] ) is calculated, where F k represents the operation of homomorphically calculating the parameter gε, or even directly represents the operation of homomorphically calculating the parameter att [k] .gε as described herein, where gε is a step function:

[0208] - This step function is zero on the central interval [-ε / 2, ε / 2],

[0209] - This step function has two different values, for example -1 and +1 ( Figure 9 case) on both sides of this central interval, and

[0210] - This step function is zero near the endpoints of the torus, on the intervals [1 / 2–ε / 2, 1 / 2] and [-1 / 2, -1 / 2 + ε / 2].[[]END]

[0211] Choosing this function gε (instead of the Sign function) means that the value 0 can be assigned to the expanded messages in the above sum that are in the uncertainty region.

[0212] In practice, the parameter F is k (c [k] ) is evaluated (during this bootstrapping operation, the noise is refreshed and, in addition, the considered function is evaluated).

[0213] As for the calculation of the sum, i.e. the combination itself, this can be done directly by calculating the parameters F0(c)+F1(c [1] )+…+F k (c [k] )+…+F K-1 (c [K-1] ) to achieve this, especially when K is small.

[0214] In this case, when the two different values ​​of gε (for positive and negative messages respectively) are -1 and +1, the attenuation coefficients a(k) are preferably chosen such that their sum att [0] +...+att [k] +...att [K-1] is less than 1 / 2. Then, the result of this sum calculation belongs to the torus T (which makes it easier to use the result later in the encryption scheme adopted in this paper). For example, we can calculate the sum by [k] Select the value AR k To obtain this condition and the above-mentioned specific reduction condition, where the common ratio R of the geometric progression is less than 1 / 2, and where A is less than (1–R) / 2.

[0215] Thus, as an example, one may choose R = 1 / 2 and A = 1 / 4, ie att [k] =1 / 2 2+k You can also choose R = 1 / 3 and A = 1 / 3, that is, att [k] =1 / 3 1+k .

[0216] However, difficulties arise in computing such sums (especially if K is large). k (c [k] ), the first non-zero term in k = 0...K–1 corresponds to a relatively large value of k, which is multiplied by a small attenuation coefficient att ([k]) , so it itself has a small value, which is then drowned in noise (this noise inherently affects this sum, since it is the result of a homomorphic computation and is therefore provided in encrypted form and is therefore noisy). This effect can prevent the correct determination of the sign of the sum, and therefore of the message μ.

[0217] To address this difficulty, as described herein, items can be combined in packages of only a few items (so that the decay coefficient remains relatively large in each package), and this combination can be performed several times in succession to gradually perform the combination. As an example, each package can include 2 to 5 items.

[0218] More precisely, this per-package merge can be performed by following these steps:

[0219] -S1: Merge by package, each package combines m items, and calculates the intermediate result res for each merge of the package i =F0(c [(i-1).m] )+F1(c [(i-1).m+1] )+…+F k (c [(i-1).m+k] )+…+F m-1 (c [i.m-1] ), i is the package number,

[0220] -S2: Intermediate result res by package i Merge and calculate new intermediate results for each merge of m' intermediate result packages Correspondingly, j is the package number, Indicates the homomorphic calculation of parameters Operation,

[0221] - Repeat step S2 until only a single result is obtained, and apply the operation to that single result This provides a final result which is an encrypted version of the symbols of the message μ.

[0222] For example, m'=m may be satisfied.

[0223] Figure 10 This method of stepwise merging by packets is schematically represented for the case where K=8 and where each packet comprises two items, ie m=m'=2 (step S2 is then performed twice).

[0224] In the figure, each arrow represents a bootstrap operation, where for F k () type item, for the parameter att [k] .gε evaluates, or for Items of type, for parameters Evaluate.

[0225] is another uncertainty width used to combine the above intermediate results (function is defined in the same way as gε, but replacing ε with ). For example, it is equal to 1 / (2N), where N–1 is a specific bootstrap polynomial W g The number of times [X] is repeated (see claim 3 of application PCT / IB2020 / 001147), also denoted as v[X].

[0226] When K has different values ​​(other than 8) and when the number of items per bag m is different (other than 2), the structure of this calculation for merging by bag is the same as Figure 10 Keep the same.

[0227] So, as an example, Figure 11 A pseudo-code algorithm for performing this merging on a per-packet basis is presented, where in this exemplary embodiment K=27 and m=3 (step S2 is also performed twice, and step S1 is performed once).

[0228] In any case, during such a packet-wise merging, for each packet of m items, the weighted sum is attenuated by a factor att [k] , k=0...m–1 satisfies the same conditions as before (as k decreases, the sum of coefficients after a given coefficient is less than the given coefficient, and the complete sum from 0 to m–1 is less than 1 / 2).

[0229] For convenience, we can assume that K = m r (exist Figure 10 In the example of , for example, m=2 and r=3), and m'=m. In this case, step S2 is performed r-1 times.

[0230] In this case, the result of the entire operation of step-by-step merging by packet (the result is the sign of μ, which is encrypted) can be directly expressed as:

[0231]

[0232] in

[0233] Noise considerations

[0234] Detailed proofs show that the above method can indeed homomorphically determine the sign of the corresponding message μ directly from the encrypted message c with very low error probability.

[0235] As an example, in the following situation:

[0236] -The message μ belongs to T p , where p = p1×p2×p3×p4×p5×p6×p7×p8 = 7×11×13×17×19×23×25×27 (i.e. p = 5019589575>2 32 ), by selecting the following values ​​for the Sign Determination Method parameter: K = 21 and ε / 2 = 255 / 4096 ≈ 0.062, indicating that the probability of error in homomorphically determining the sign of μ is less than 1.03.10 -9 (which is very low),

[0237] - The parameters of the encryption scheme are: n = 412 (n is the number of n The number of components of the key s, where B = {0, 1}, the folding parameter l is then l = 4), N = 1024, and affects each component c i The standard deviation of the noise component σ(e i )for (This standard deviation corresponds to the noise level if 200 homomorphic additions are allowed without bootstrapping between them).

[0238] For this example, Figure 12 is the Bézout coefficient v j The value of the "expanded" Bézout coefficient (which further illustrates that it is advantageous to keep these values ​​small, even though they allow the message to be inflated) and the parameters involved in calculating the noise that affects the inflated encrypted message A table that groups together the values ​​of .

[0239] With the function g ε Related details, and through bootstrapping the function g ε Perform simulation

[0240] The following is given for the attenuation coefficient att [k] =1 / (2 2+k ) These values ​​can be transposed to other values ​​of the attenuation coefficient.

[0241] First, assume that:

[0242]

[0243] Among them, δ in equation (1) [k] is defined as

[0244] The inventors thus proved that there exists k* such that:

[0245] -1. If μ>0, then And for any 0≤k <k * ,

[0246] -2. If μ < 0, then And for any 0≤k <k * , -3. If μ = 0, then for any 0 ≤ k,

[0247] Function g ε Simulation

[0248] As described in detail in patent application PCT / IB2020 / 001147, the goal is to construct a polynomial v[X] such that,

[0249]

[0250] To perform the function g in encrypted form during the bootstrap operation ε Perform simulation.

[0251] Choice of parameter ε

[0252] By constructing, function is a piecewise constant function, at point μ k ∈[-1 / 2,1 / 2] may be discontinuous, making

[0253]

[0254] That is

[0255]

[0256] Since the function g ε is odd and discontinuous to the right of ε / 2 and at 1 / 2–ε / 2, so the natural choice of parameter ε is:

[0257]

[0258] Under this restriction:

[0259]

[0260] That is:

[0261]

[0262] Construction of polynomial v[X]

[0263] For any 2N-periodic function F of Z in T, such that F(j+N)=-F(j), at T N There exists a unique polynomial v in [X] such that f v (j) = F(j).

[0264] The coefficient v of the polynomial j By v j =F(-j), j=0,…,N-1. Therefore, for a given k, we only need to define F on {0,…,N-1} as follows:

[0265]

[0266] Therefore, v j =F(-j), j=0,…,N-1,

[0267] That is, v0=…=v k =0,v k+1 =…=v N-k-1 =-1,v N-k =…=v N-1 =0.

[0268] For this choice of the polynomial and the parameter ε, the above relation (2) is satisfied practically without error.

[0269] rounding

[0270] During the bootstrap operation, the value of μ in relation (2) is taken from k=0,…,k * By [k] ,b [k] )=c [k] ∈T n+1 in and b [k] The values ​​are rounded as follows:

[0271]

[0272] and will Replace with

[0273]

[0274] It should be noted that other alternatives can be considered to perform these rounding operations. The rounding process discussed introduces errors, which are reflected by the term δ in formula (1). [k] Therefore, considering the relationship (2) and δ [k] Definition:

[0275]

[0276] Provided The complete bootstrap function for the encrypted value of is:

[0277]

[0278] It can be observed that δ [k] The definition of can be changed as follows:

[0279]

[0280] Therefore, relation (3) is still valid.

[0281] Bootstrapping symbolic functions

[0282] In 1 / 2 k+2 When μ is not too small (the attenuation coefficient is not too small), the sign of μ can be obtained by calculating the following parameter (which corresponds to direct merging rather than step-by-step merging by packet):

[0283]

[0284] Application Examples

[0285] Computing Heaviside functions homomorphically

[0286] To apply the Heaviside function H homomorphically to the message μ, the above homomorphic sign determination method is applied, but for the function g ε , choosing the values ​​0 on [-1 / 2+ε / 2,-ε / 2] and +1 on [ε / 2,1 / 2-ε / 2] (instead of -1 and +1).

[0287] Homomorphically compute any piecewise constant function

[0288] To apply any piecewise constant function f to a message μ, where function f has t different segments, for example, server 3 would be programmed to do the following:

[0289] - Decompose the function f into a linear combination of multiple transformed Heaviside functions, that is, The coefficient α j is an integer and the horizontal coordinate β of the discontinuous point j belongs to the interval [-1 / 4, 1 / 4],

[0290] -Calculation parameters Each term H(μ-β j ) are all determined homomorphically, as pointed out above for the Heaviside function H.

[0291] Comparison: Homomorphically determine maximum and minimum values

[0292] Let μ a and μ b There are two messages, c a and c b is the corresponding encrypted message obtained using the above encryption scheme.

[0293] Note that h is H(μ a –μ b ), determined as described above (calculation of the Heaviside function).

[0294] Since the encryption operation used in this paper is linear, the parameter hc a +(1–h).c b is μ a .H(μ a –μ b )+μ b .[1–H(μ a –μ b )] is an encrypted version of μ a and μ b The maximum value max(μ a ,μ b ).

[0295] In this way the parameter Maxh=hc is calculated a +(1–h).c b So that max(μ a ,μ b )

[0296] Similarly, the calculation amount Minh=hc b +(1–h).c a So that μ can be obtained homomorphically a and μ b The minimum value min(μ a ,μ b )

[0297] Figure 3 The server 31 in the exemplary embodiment is programmed to perform these operations. The server module 310 performs homomorphic subtraction Then module 30 starts from c d Determine the parameter h. Then, module 311 executes hc a +(1–h).c b and hc b +(1–h).c a Operation, and deliver the corresponding results Maxh and Minh.

[0298] Alternatively, the parameters Maxh and Minh can be determined by the following steps

[0299] - Homomorphically determine H(μ b –μ a ), denoted as h', then

[0300] -Calculate the parameter h'.c b +(1–h').c a (for maximum value) and h'.c a+(1–h').c b (for minimum value).

[0301] Alternatively, we can use the difference μ a –μ b The encrypted version of the symbol determines the parameters Maxh and Minh.

[0302] Sort the database

[0303] Being able to homomorphically determine the maximum and / or minimum value in two messages is particularly interesting because it also makes it possible to homomorphically perform a sort (arrangement, e.g., in ascending or descending order) on a set of encrypted messages.

[0304] Many sorting algorithms are actually based on the basic (repeated) step of message-by-message comparison, that is, comparing two messages in a plurality of messages to be sorted, and then replacing one of the two messages with the maximum value and the other message with the minimum value.

[0305] Figure 4 The server 32 in the exemplary embodiment of is programmed to perform the method of sorting the encrypted database DB.

[0306] The database comprises at least one first encrypted message c located at a first position in the database a and the second encrypted message c located at the second position in the database b .

[0307] The sorting method at least includes:

[0308] -Write in the first position respectively by c a and c b The above parameters Maxh determined or (by c a and c b Determined) the above parameters Minh, and

[0309] - In the second position, the variable Minh or the variable Maxh is written respectively.

[0310] For example, both the first position and the second position in question may be marked in the database by an index number (eg a row number in a matrix-format database) associated with the position in question.

Claims

1. A method for homomorphically determining the positive or negative character of a corresponding message μ from an encrypted message c without decrypting the encrypted message c, the encrypted message c corresponding to the message μ being encrypted by a fault-tolerant learning problem-type method, the message μ belonging to a discrete torus Or belongs to T p The space of bijections, where For each integer p i are relatively prime, the encrypted message c consists of q components c i Composition, of which v i is the same as the integer p i The associated Bézout coefficient, v i byu i p i +v i p / p i =1 definition, the method comprises: - a scaling step, said scaling step comprising the following formula Determine the inflated encrypted message c [1] ,in is an odd number greater than or equal to 3, and - a merging step, said merging step comprising calculating the sum F0(c)+F1(c [1] ), where F0 and F1 represent the homomorphic calculation of the parameter att [0] .gε and parameter att [1] .gε operation, gε is a step function that is zero on the central interval [-ε / 2,ε / 2] and has two different values ​​on both sides of the central interval, and the coefficients att [1] Less than coefficient att [0] .

2. The method according to the preceding claim, wherein: The scaling step includes scaling a plurality of expanded encrypted messages c [k] The integer k varies from 1 to K–1, and each expanded encrypted message is determined according to the following formula is determined, and wherein the positive or negative character of the message μ depends on c and on the encrypted message c after different expansions [k] To determine, k = 1…K–1.

3. The method according to the preceding claim, wherein: The merging step comprises a step of merging packets, during which the following sum is calculated: F0(c)+F1(c [1] )+…+F k (c [k] )+…+F m (c [m] ), where F k Indicates the homomorphic calculation of the parameter att [k] .gε operation, where att [k] is the attenuation coefficient less than 1, the coefficient att [k] The sequence is decreasing, k = 0 ... m, and the coefficient att [k] The sequence is such that the sum of the multiple attenuation coefficients following a given attenuation coefficient among the multiple given attenuation coefficients in the series is less than the given attenuation coefficient.

4. The method according to the preceding claim, wherein: m is less than K, and wherein the merging step comprises the following steps: -S1: Merge by package, each package combines m items, and calculates the intermediate result res for each merge of the package i =F0(c [(i -1).m] )+F1(c [(i-1).m+1] )+…+F k (c [(i-1).m+k] )+…+F m-1 (c [i.m-1] ), where i is the package number, -S2: Intermediate results res by package i Merge and calculate new intermediate results for each merge of m' intermediate result packages Correspondingly, j is the package number, Indicates the calculation of parameters homomorphically Operation, - Repeat step S2 until only a single result is obtained, and apply the operation to the single result This provides a final result which is an encrypted version of the symbols of the message μ.

5. The method according to one of claims 2 to 4, wherein: The number K-1 of the expanded encrypted messages considered satisfies 6. The method according to one of the preceding claims, wherein: The width ε of the central interval is less than 7. A method for homomorphically applying a Heaviside function H, wherein the Heaviside function H is zero for negative values ​​and equal to 1 otherwise, the method comprising performing a method for determining the positive or negative character of the message μ according to any of the preceding claims, the function gε being chosen to be zero for negative values ​​and equal to 1 for positive values.

8. A method for homomorphically applying a piecewise constant function f to a message μ, the function f having t different pieces, the method comprising: - Decompose the function f into a linear combination of transformed Heaviside functions, i.e. The coefficient α j is an integer and the horizontal coordinate of the discontinuous point β j belongs to the interval [-1 / 4,1 / 4], -Calculation parameters Each term H(μ-β j ) is determined homomorphically according to the method of claim 7.

9. A method of not encrypting a message a and c b To decrypt the encrypted message c a and c b Homomorphically determine two corresponding messages μ a and μ b A method for maximizing the value of , the method comprising: - Homomorphically determine the parameter H(μ) according to the method according to claim 7 a –μ b ), thus determining H(μ a –μ b ) is recorded as h, and the parameter Maxh = hc is calculated a +(1–h).c b , - or, in accordance with the method according to claim 7, determining the parameter H(μ b –μ a ), thus determining H(μ b –μ a ) is recorded as h', and the parameter h'.c is calculated b +(1–h').c a .

10. A method of not encrypting a message a and c b To decrypt the encrypted message c a and c b Homomorphically determine two corresponding messages μ a and μ b A method for obtaining the minimum value of a matrix, the method comprising: - Homomorphically determine the parameter H(μ) according to the method according to claim 7 a –μ b ), thus determining H(μ a –μ b ) is recorded as h, and the parameter Minh = hc is calculated b +(1–h).c a , - or, in accordance with the method according to claim 7, determining the parameter H(μ b –μ a ), thus determining H(μ b –μ a ) is recorded as h', and the parameter h'.c is calculated a +(1–h').c b .

11. A method for sorting a database, said database comprising at least a first encrypted message c in a first position of said database a , and includes at least a second encrypted message c at a second location of said database b , the method comprising: The variable Maxh determined according to the method of claim 9 or the variable Minh determined according to the method of claim 10 is written at least once to the first location.

12. An encrypted communication and processing method, comprising the following steps: - Encryption of at least one message μ in the form of an encrypted message c by the client (2) using the private key s, using a fault-tolerant learning problem-based method, wherein the message μ belongs to a discrete torus Or belongs to T p The space of bijections, where For each integer p i are mutually prime, the encrypted message c=(c1,…c i ,...,c q ) consists of q components c i Formation, where v i is the same as the integer p i The associated Bézout coefficient, v i byu i p i +v i p / p i =1 definition, - the encrypted message c or the encrypted database containing the encrypted message c is sent by the client (2) via a communication channel (5) to a server (3; 30; 31; 32), the server (3; 30; 31; 32) being different from the client (2) and not having the private key s, - homomorphically processing, by the server (3; 30; 31; 32), the encrypted message c or the difference between the encrypted message c and another encrypted message, or the encrypted database (DB) containing the encrypted message c, according to a method according to any one of the preceding claims, - The result (res, DB') of the homomorphic processing is sent by the server (3; 30; 31; 32).

13. A cryptographic processing server (3; 30; 31; 32), comprising at least a communication module and a computing module: - the communication module is configured to receive an encrypted message c or an encrypted database (DB) containing the encrypted message c from an entity external to the server, the encrypted message c corresponding to a message μ encrypted by a fault-tolerant learning problem-type method, the message μ belonging to a discrete torus Or belongs to T p The space of bijections, where For each integer p i are mutually prime, the encrypted message c=(c1,...c i ,...c q ) consists of q components c i Formation, where v i is the same as the integer p i The associated Bézout coefficient, v i byu i p i +v i p / p i =1 definition, - the computing module is programmed to process homomorphically the encrypted message c or the difference between the encrypted message c and another encrypted message, or the encrypted database (DB) containing the encrypted message c, according to the method according to any one of claims 1 to 11, without decrypting the message c, - The communication module is also configured to send out the result (res, DB') of the homomorphic processing.

14. A cryptographic system (1), comprising: - A cryptographic processing server (3; 30; 31; 32) according to claim 13, - A client (2) configured to encrypt at least one message μ in the form of an encrypted message c and to transmit the encrypted message c or an encrypted database (DB) containing the encrypted message c to the server (3; 30; 31; 32) via a communication channel (5).

Images