Data processing method and device

Abstract

The embodiment of the invention provides a data processing method and device. The method comprises the steps that a first device determines a homomorphic encrypted ciphertext modulus; the ciphertext modulus is a prime number obtained by accumulation of n different multipliers of power and coefficient of 2, and n is an integer greater than or equal to 2 and less than or equal to 5; and performing homomorphic processing based on the ciphertext modulus, wherein the homomorphic processing can comprise at least one of homomorphic encryption, homomorphic decryption and homomorphic calculation. Generally, homomorphic encryption, homomorphic decryption, homomorphic calculation and other operations involve modulo operation or modulo operation, and the embodiment of the invention designs a modulus, so that the modulo operation or modulo operation can be more convenient and higher in efficiency. Therefore, the processing efficiency of homomorphic encryption, homomorphic decryption, homomorphic calculation and the like including modulo operation / modulo operation can be improved.

Description

Technical Field

[0001] This application relates to the field of communication technologies, and in particular, to a data processing method and apparatus. Background Art

[0002] To protect the privacy of user data, the homomorphic encryption (FHE) technology is proposed. Its basic principle is to use a special encryption algorithm so that the result obtained by performing mathematical operations in the ciphertext state is the same as the result of performing the same operation in the plaintext state. Homomorphic encryption consists of four processes, namely: key generation, homomorphic encryption, homomorphic calculation (also known as homomorphic evaluation), and homomorphic decryption. In key generation, the key generation party generates a homomorphic encryption key, a homomorphic decryption key, and a homomorphic calculation key; in homomorphic encryption, the encrypting party encrypts the plaintext message into ciphertext using the homomorphic encryption key; in homomorphic calculation, the calculating party performs homomorphic calculation based on the ciphertext and the homomorphic calculation key to obtain the ciphertext after homomorphic calculation; in homomorphic decryption, the decrypting party uses the homomorphic decryption key to restore the ciphertext to the plaintext message.

[0003] To support performing arbitrary encryption and / or multiplication calculations on ciphertexts, on the basis of homomorphic encryption, fully homomorphic encryption (FHE) is further proposed. In the existing fully homomorphic encryption process, a small random "noise" component is added to improve the security of the ciphertext. However, when performing homomorphic calculations on the ciphertext with added "noise", as the number of homomorphic calculations increases or the complexity of homomorphic calculations increases, the noise in the ciphertext after homomorphic calculation will be superimposed and enlarged. When the noise of the ciphertext exceeds the critical value, it will damage or even overwrite the original ciphertext, and then lead to the failure of homomorphic decryption. To solve this problem, the FHE scheme proposes the process of bootstrapping, through which a ciphertext with noise approaching or exceeding the critical value can be "refreshed" (processed) into a new ciphertext with very low noise.

[0004] When the above-mentioned algorithms corresponding to homomorphic encryption, homomorphic computation (including the bootstrapping process), and homomorphic decryption are implemented by a computer, they not only involve operations such as addition and / or multiplication, but also involve modulo operations. Computers usually perform operations such as addition and multiplication relatively easily, but performing modulo operations is difficult and the computational efficiency is very low. Moreover, the efficiency of the modulo operation affects the overall execution efficiency of the homomorphic processing (such as homomorphic encryption, homomorphic computation, homomorphic decryption). For example, currently, a blind rotation processing method based on the number theoretic transform (NTT) has been proposed to improve the execution efficiency of the bootstrapping process. In the blind rotation processing based on the NTT, NTT processing is included. In the NTT processing, in order to improve the correctness of the data, modulo operations need to be frequently performed on the result data after multiplication and addition / subtraction, which will affect the overall execution efficiency of the bootstrapping process. Summary of the Invention

[0005] The present application proposes a data processing method and apparatus, which can effectively improve the efficiency of homomorphic processing.

[0006] In a first aspect, an embodiment of the present application provides a data processing method, which may include: a first device determines a ciphertext modulus for homomorphic encryption; the ciphertext modulus is a prime number obtained by accumulating the products of n different powers of 2 and coefficients, where n is an integer greater than or equal to 2 and less than or equal to 5; the first device performs homomorphic processing based on the ciphertext modulus. Among them, the homomorphic processing may include, but is not limited to, at least one of homomorphic encryption, homomorphic decryption, and homomorphic computation.

[0007] In an embodiment of the present application, if the first device performs homomorphic encryption based on the ciphertext modulus, the first device may be a homomorphic encryption party device, or the first device may be executed by a component (such as a module, chip, etc.) corresponding to the homomorphic encryption party device, or the first device may also be a device used in combination with the homomorphic encryption party device. If the first device performs homomorphic decryption based on the ciphertext modulus, the first device may be executed by a homomorphic decryption party device, or the first device may be a component (such as a module, chip, etc.) corresponding to the homomorphic decryption party device, or the first device may also be a device used in combination with the homomorphic decryption party device. If the first device performs homomorphic computation (or homomorphic evaluation) based on the ciphertext modulus, the first device may be a homomorphic computation party device, or the first device may be executed by a component (module, chip, etc.) of the homomorphic computation party device, or the first device may also be a device used in combination with the homomorphic computation party corresponding to it.

[0008] Generally, operations such as homomorphic encryption, homomorphic decryption, and homomorphic computation all involve modulo operations. Usually, the way of modulo operation may be to directly perform long division to obtain the result. However, when the divisor and dividend of the modulo operation are relatively large, it is obviously difficult to obtain the result by long division. For this reason, the solution of this application designs a modulus, which is a prime number obtained by summing the products of n different powers of 2 and coefficients. Based on such a modulus, it is more convenient to perform modulo operations, and the modulo operation efficiency is higher. Thus, the processing efficiency of homomorphic encryption, homomorphic decryption, and homomorphic computation that include modulo operations can all be improved.

[0009] In a possible implementation, the ciphertext modulus can satisfy the following form:

[0010]

[0011] Where Q is the ciphertext modulus, and the exponents k of the first n - 1 different powers of 2 i are integers greater than 0 and less than or equal to m (m ≥ k1 >... k i > k n -1 > 0), the exponent k of the nth power of 2 n is equal to 0 (k n = 0), m is the bit width of the ciphertext modulus Q, and the coefficient a i takes the value of +1 or -1, and i is an integer greater than or equal to 1 and less than or equal to n.

[0012] Exemplarily, when n = 2, the form satisfied by the ciphertext modulus is Where k1 is an integer greater than 0 and less than or equal to m. When n = 3, the form satisfied by the ciphertext modulus is Where both k1 and k2 are integers greater than 0 and less than or equal to m.

[0013] In a possible implementation, the homomorphic encryption, homomorphic decryption, and homomorphic computation all include modulo operations; the first device performs homomorphic processing based on the ciphertext modulus, which may include: performing a modulo operation based on the ciphertext modulus, and the modulo operation includes shift processing and / or logical operation processing; wherein, the number of bits shifted in the shift processing is related to the exponents of the n powers of 2 in the ciphertext modulus, and the number of times of logical operation processing is related to the value of n.

[0014] In a possible implementation, the method may further include: the first device performs the number theoretic transform NTT based on the modulo operation.

[0015] In a possible implementation, one NTT includes M butterfly operations; M is an integer greater than or equal to 3; the first device performs the number-theoretic transform NTT based on a modulo operation, specifically including: performing the modulo operation once every three butterfly operations; and in each butterfly operation, taking the modulo of each multiplication result using a power modulo operation algorithm.

[0016] In a second aspect, an embodiment of the present application further provides a data processing method, which may include: the first device determines a ciphertext modulus for homomorphic encryption; the ciphertext modulus is a composite number obtained by multiplying d different prime numbers, where each prime number is obtained by accumulating the product of n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5, and d is an integer greater than 1; and then performing homomorphic processing based on the ciphertext modulus. In the embodiment of the present application, homomorphic processing may include, but is not limited to, at least one of homomorphic encryption, homomorphic decryption, and homomorphic calculation.

[0017] In the embodiment of the present application, if the first device performs homomorphic encryption based on the ciphertext modulus, the first device may be a homomorphic encryption device, or the first device may be executed by a component (such as a module, chip, etc.) corresponding to the homomorphic encryption device, and the first device may also be a device used in combination with the homomorphic encryption device. If the first device performs homomorphic decryption based on the ciphertext modulus, the first device may be executed by a homomorphic decryption device, or the first device may be a component (such as a module, chip, etc.) corresponding to the homomorphic decryption device, and the first device may also be a device used in combination with the homomorphic decryption device. If the first device performs homomorphic calculation (or homomorphic evaluation) based on the ciphertext modulus, the first device may be a homomorphic calculation device, or the first device may be executed by a component (module, chip, etc.) of the homomorphic calculation device, and the first device may also be a device used in combination with the homomorphic calculation device.

[0018] Generally, operations such as homomorphic encryption, homomorphic decryption, and homomorphic calculation all involve a modulo operation or modulo arithmetic. Usually, the way of the modulo operation or modulo arithmetic may be to directly perform long division to obtain the result. However, when the divisor and dividend of the modulo operation are relatively large, it is obviously difficult to use long division to obtain the result. For this reason, the solution of the present application designs a modulus, which is a composite number obtained by multiplying d different prime numbers, and each prime number is obtained by accumulating the product of n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5. In application, the modulus of the composite number can be first decomposed to obtain the moduli of d different prime numbers, and then the modulo operation / arithmetic is performed based on the moduli of d different prime numbers. Similarly to the above method, the modulo efficiency will be higher, so that the processing efficiency of homomorphic encryption, homomorphic decryption, and homomorphic calculation, etc., which include the modulo operation / modulo arithmetic, can all be improved.

[0019] In a possible implementation, the ciphertext modulus can satisfy the following form:

[0020]

[0021] Where Q represents the ciphertext modulus, and d represents the number of prime numbers Q obtained by successive multiplication; j The prime number Q j Satisfies the following form:

[0022]

[0023] The prime number Q j The exponent k of the power of 2 j i is an integer greater than 0 and less than or equal to m j (m j ≥k j1 >…k j i>k j( n - 1) >k j n = 0), m j Is the bit width size of Q j The coefficient a i Takes the value of +1 or -1.

[0024] In a possible implementation, when the first device performs homomorphic encryption based on the ciphertext modulus, it includes: performing homomorphic encryption on the second ciphertext component of the initial input ciphertext based on the ciphertext modulus to obtain a first ciphertext; the first ciphertext is an RLWE ciphertext; where the initial input ciphertext includes a first ciphertext component and a second ciphertext component, and the first ciphertext component includes N items; N is an integer greater than 1; then performing blind rotation processing on the first ciphertext based on an optimized number-theoretic transform NTT processing and decomposition method to obtain a second ciphertext.

[0025] Exemplarily, the initial input ciphertext is represented as The second ciphertext component of the initial input ciphertext is represented as -b. The first ciphertext is represented as The second ciphertext is represented as

[0026] In the embodiments of the present application, the first device performs blind rotation processing on the first ciphertext based on an optimized number-theoretic transform NTT processing and decomposition algorithm to obtain a second ciphertext, which may include but is not limited to the following implementation manners:

[0027] Implementation manner one: The first device iteratively executes N blind rotation sub-operations based on the optimized number-theoretic transform NTT processing and decomposition method and the first ciphertext to obtain a second ciphertext; N is an integer greater than 1; where each blind rotation sub-operation is executed based on the result or output ciphertext of the previous blind rotation sub-operation;

[0028] Among them, the i-th blind rotation sub-operation is performed, where i ∈ [1, N]; the i-th blind rotation sub-operation is associated with or corresponding to the i-th term a of the first ciphertext component of the initial input ciphertext i and the i-th key component si of the initial input ciphertext, and may include the following:

[0029] First, the current ciphertext is decomposed by a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts are in one-to-one correspondence with d different prime numbers; among them, the j-th third ciphertext contains ciphertext components obtained by decomposing based on the modulus Q j and ciphertext components obtained by decomposing based on other moduli Qk, where Qk ≠ Q j , where j, k ∈ [1, d]; the current ciphertext is the initial input ciphertext (i.e., the first ciphertext) or the output ciphertext of the previous blind rotation sub-operation;

[0030] Then, the d third ciphertexts are used as the initial values of d accumulators; the initial values of the d accumulators are respectively processed by an optimized number-theoretic transform NTT to obtain the transformed values of the d accumulators; the optimized number-theoretic transform NTT includes a modulo operation, and the modulo operation may include a shift process and / or a logical operation process; among them, in the modulo operation included in the NTT processing of the initial value of the j-th accumulator, the number of bits shifted in the shift process is related to the exponent of n powers of 2 in the corresponding j-th prime modulus Q j and the number of times of the logical operation process is related to the value of the number of terms n of the powers of 2 of the j-th prime modulus Q j ;

[0031] Secondly, based on the transformed values of the d accumulators, the corresponding outer product and accumulation processes are respectively performed to obtain the outer product values of the d accumulators;

[0032] Furthermore, the d accumulators' outer product values are respectively processed by INTT to obtain the updated values of the d accumulations;

[0033] Then, the updated values of the d accumulators are processed by the inverse transform of the decomposition method to obtain the output ciphertext; the output ciphertext is used for the next blind rotation sub-operation.

[0034] After performing the above N blind rotation sub-operations, the output ciphertext of the last blind rotation sub-operation is used as the second ciphertext.

[0035] Exemplarily, for the above implementation method 1: The first device iteratively performs N blind rotation sub-operations based on the optimized number-theoretic transform NTT processing, the decomposition method, and the first ciphertext to obtain the second ciphertext, including the following steps:

[0036] Step 1: Decompose the first ciphertext using a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts correspond to d prime numbers one by one. The j-th third ciphertext contains ciphertext components obtained based on the modulus Q j and ciphertext components obtained based on other moduli Qk, where Qk≠Q j , j,k∈[1,d] (j and k are integers, and the value ranges of j and k are from 1 to d, including 1 and d).

[0037] Exemplarily, the above decomposition method can be residue number system (RNS) decomposition, or digit decomposition, or gadget decomposition, etc.

[0038] Step 2: Perform optimized number theoretic transform (NTT) processing on the d third ciphertexts respectively to obtain d transformed fourth ciphertexts.

[0039] In the embodiment of the present application, the optimized NTT processing includes a modulo operation, and the modulo operation can include shift processing and / or logical operation processing; among them, in the modulo operation included in the NTT processing of the j-th third ciphertext, the number of bits shifted in the shift processing is related to the exponent of n powers of 2 in the corresponding j-th prime modulus Q j and the number of times of logical operation processing is related to the value of the number of terms n of powers of 2 in the j-th prime modulus Q j .

[0040] Step 3: Based on the d transformed fourth ciphertexts, perform corresponding outer product and accumulation processing respectively to obtain d fifth ciphertexts.

[0041] In a possible implementation manner, the first device obtains d first bootstrapping keys, and the d first bootstrapping keys respectively satisfy the RGSW ciphertext form; the d first bootstrapping keys are key components corresponding to the d bootstrapping keys, and the moduli of the d bootstrapping ciphertexts correspond to d different prime numbers one by one. When performing Step 3, it may include: performing outer product and accumulation processing based on the d transformed fourth ciphertexts and the d first bootstrapping keys to obtain d fifth ciphertexts.

[0042] Step 4: Perform inverse number theoretic transform (INTT) processing on the d fifth ciphertexts respectively to obtain d sixth ciphertexts.

[0043] Step 5: Process the d sixth ciphertexts through the inverse transform (such as ICRT) of the decomposition method to obtain a seventh ciphertext.

[0044] The above Steps 1 to 5 can be used as the process of a blind rotation sub-operation (which can be called the i = 1st blind rotation sub-operation). If the initial input ciphertext is represented as c, the i-th blind rotation sub-operation and the i-th item ai of the first ciphertext component a of the initial input ciphertext iassociated with or corresponding to the i-th key component si of the initial input ciphertext.

[0045] Step Six: Use the seventh ciphertext as the new input ciphertext (equivalent to the first ciphertext) for Step One in the next blind rotation sub-operation; Iteratively execute the above Steps One to Five N - 1 times, where N is an integer greater than 1. Use the seventh ciphertext obtained in Step Five of the last blind rotation sub-operation (which can be called the i = N-th blind rotation sub-operation) as the second ciphertext.

[0046] Implementation Method Two: The first device uses a decomposition method to decompose the current first ciphertext to obtain d third ciphertexts; the moduli of the d third ciphertexts are in one-to-one correspondence and equality with d different prime numbers; among them, the j-th third ciphertext contains ciphertext components obtained by decomposing based on the modulus Q j and ciphertext components obtained by decomposing based on other moduli Qk, where Qk ≠ Q j , j, k ∈ [1, d]; then respectively perform optimized NTT processing on the d third ciphertexts to obtain d fourth ciphertexts; secondly, use the d fourth ciphertexts as the initial values of d accumulators; based on the initial values of the d accumulators, perform N - 1 times of CMUX gate processing and ciphertext combination processing to obtain the updated values of the d accumulators; N is an integer greater than 1; each time of CMUX gate processing and ciphertext combination processing is performed based on the result or output ciphertext of the previous CMUX gate processing and ciphertext combination processing; further, respectively perform one CMUX gate processing and inverse number theory transform INTT processing on the updated values of the d accumulators to obtain d target ciphertexts; finally, based on the d target ciphertexts, obtain the second ciphertext through the inverse method of the decomposition method.

[0047] In a possible implementation, the first device performs N - 1 times of CMUX gate processing and ciphertext combination processing based on the initial values of the d accumulators to obtain the updated values of the d accumulators, including:

[0048] Perform the i-th CMUX gate processing and ciphertext combination processing, and the i-th CMUX gate processing and ciphertext combination processing is associated with or corresponding to the i-th item a i of the first ciphertext component of the initial input ciphertext and the i-th key component si of the initial input ciphertext, i ∈ [1, N - 1], and may include the following:

[0049] First, respectively perform corresponding outer product and accumulation processing based on the current initial values of the d accumulators to obtain the outer product values of the d accumulators.

[0050] Based on the current outer product values of the d accumulators, d combined ciphertexts are determined; among them, based on the outer product value of the j-th accumulator (any one of the d accumulators), determining the j-th combined ciphertext includes: rearranging and combining the outer product value of the j-th accumulator and the ciphertext component of the k-th accumulator to obtain the j-th combined ciphertext, and the ciphertext component of the k-th accumulator is obtained after performing INTT modulo Qk and NTT modulo Q j of the k-th accumulator, where k≠j; the d combined ciphertexts are used for the next CMUX gate processing and ciphertext combination processing.

[0051] Exemplarily, for the above implementation manner two, the first device performs blind rotation processing on the first ciphertext based on the optimized NTT processing and decomposition algorithm to obtain the second ciphertext, which may include the following steps:

[0052] Step 1: The first device decomposes the first ciphertext using a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts respectively correspond to and are equal to d different prime numbers. The j-th third ciphertext includes the ciphertext component obtained by decomposing based on the modulus Q j and the ciphertext component obtained by decomposing based on other moduli Qk≠Q j ; j,k∈[1,d] (j and k are integers, and the value ranges of j and k are from 1 to d and include 1 and d). j j

[0053] Step 2: The first device respectively performs optimized number-theoretic transform NTT processing on the d third ciphertexts to obtain d transformed fourth ciphertexts.

[0054] In the embodiments of the present application, the optimized number-theoretic transform NTT processing includes a modulo operation, and the modulo operation may include shift processing and / or logical operation processing; among them, in the modulo operation included in the NTT processing of the j-th third ciphertext, the number of bits shifted in the shift processing is related to the exponent of n 2-powers in the corresponding j-th prime modulus Q j and the number of times of logical operation processing is related to the value of the number of terms n of 2-powers in the j-th prime modulus Q j ;

[0055] Step 3: The first device respectively performs corresponding outer product and accumulation and other processing based on the d transformed fourth ciphertexts to obtain d fifth ciphertexts (equivalent to the outer product values of the above d accumulators).

[0056] In a possible implementation, the first device obtains d first bootstrap keys, and the d first bootstrap keys respectively satisfy the RGSW ciphertext form; the d first bootstrap keys are key components corresponding to the d bootstrap keys, and the moduli of the d bootstrap ciphertexts correspond to d different prime numbers one by one. When performing step three, it may include: performing outer product and accumulation processing based on the d transformed fourth ciphertexts and the d first bootstrap keys to obtain d fifth ciphertexts.

[0057] Step four: The first device obtains corresponding d sixth ciphertexts (equivalent to the above d combined ciphertexts) based on the d fifth ciphertexts (equivalent to the outer product values of the above d accumulators).

[0058] In a possible implementation, in this step four, for the j-th fifth ciphertext to obtain the corresponding j-th sixth ciphertext, it may include: based on the k-th (k≠j) fifth ciphertext, performing INTT with modulus Qk and NTT calculation with modulus Q j to obtain the corresponding first ciphertext component; then rearranging and combining the j-th fifth ciphertext and the first ciphertext component to obtain the j-th sixth ciphertext.

[0059] Furthermore, take the d sixth ciphertexts as the new input ciphertexts (equivalent to the fourth ciphertexts in step three); iteratively execute the above steps three to four N - 2 times to obtain the updated values of the d accumulators; N is an integer greater than 1.

[0060] Step five: Perform a CMUX gate processing and an inverse number theory transform INTT processing on the updated values of the d accumulators respectively to obtain d target ciphertexts;

[0061] Step six: The first device obtains the second ciphertext through the inverse transform (such as ICRT) of the decomposition method based on the d target ciphertexts.

[0062] Compared with the above implementation one, in implementation two, the sixth ciphertext is not obtained by performing a complete decomposition operation, but directly stores the fifth ciphertext with modulus Q j in step three, and rearranges and combines it with the first ciphertext components corresponding to other moduli to obtain the corresponding sixth ciphertext. Therefore, for the d sixth ciphertexts, a total of d * 2 NTT or INTT calculation times can be saved. For the process of obtaining the first ciphertext component, a combined single function can also be used to implement two or more consecutive NTT or INTT transforms.

[0063] In a third aspect, the present application further provides a data processing device, which is capable of implementing the functions of the above first aspect. For example, the data processing device includes modules, units, or means corresponding to the operations involved in the above first aspect. The modules, units, or means can be implemented by software, or by hardware, or by hardware executing corresponding software.

[0064] In a possible design, the data processing device includes a communication unit and a processing unit. Among them, the communication unit can be used to transmit and receive data and / or information, etc., to implement communication between the data processing device and other devices; the processing unit can be used to execute some internal operations of the communication device. The functions performed by the processing unit and the communication unit can correspond to the operations involved in the above first aspect.

[0065] In a fourth aspect, the present application further provides a data processing device, which is capable of implementing the functions of the above first aspect. For example, the data processing device includes modules, units, or means corresponding to the operations involved in the above second aspect. The modules, units, or means can be implemented by software, or by hardware, or by hardware executing corresponding software.

[0066] In a possible design, the data processing device includes a communication unit and a processing unit. Among them, the communication unit can be used to transmit and receive data and / or information, etc., to implement communication between the data processing device and other devices; the processing unit can be used to execute some internal operations of the communication device. The functions performed by the processing unit and the communication unit can correspond to the operations involved in the above second aspect.

[0067] In a fifth aspect, an embodiment of the present application provides a data processing device, which includes: at least one processor and a communication interface; wherein, the communication interface is used to communicate with other devices; the processor is used to run a set of programs to enable the data processing device to implement the method provided by the above first aspect or any one of its possible implementation manners.

[0068] In a sixth aspect, an embodiment of the present application provides a data processing device, which includes: at least one processor and a communication interface; wherein, the communication interface is used to communicate with other devices; the processor is used to run a set of programs to enable the data processing device to implement the method provided by the above second aspect or any one of its possible implementation manners.

[0069] In a seventh aspect, the present application provides a computer-readable storage medium storing computer-readable instructions, which, when read and executed by a computer, cause the computer to execute the method provided in the first aspect above or any possible implementation manner thereof, or cause the computer to execute the method provided in the second aspect above or any possible implementation manner thereof.

[0070] In an eighth aspect, the present application provides a computer program product, which, when read and executed by a computer, causes the computer to execute the method provided in the first aspect above or any possible implementation manner thereof, or causes the computer to execute the method provided in the first aspect above or any possible implementation manner thereof.

[0071] In a ninth aspect, the present application provides a chip including a processor coupled to a memory for reading and executing a software program stored in the memory to implement the method provided in the first aspect above or any possible implementation manner thereof, or to implement the method provided in the second aspect above or any possible implementation manner thereof.

[0072] In a possible implementation, the chip may include the memory. Optionally, the processor and the memory may be integrated together.

[0073] In a possible implementation, the memory may be an external memory of the chip.

[0074] In a tenth aspect, the present application provides a communication system including at least one of a homomorphic encryption party, a homomorphic computing party, and a homomorphic decryption party; the homomorphic computing party or the homomorphic computing party or the homomorphic decryption party is configured to execute the method provided in the first aspect above or any possible implementation manner thereof, or the homomorphic computing party or the homomorphic computing party or the homomorphic decryption party is configured to execute the method provided in the second aspect above or any possible implementation manner thereof.

[0075] It should be noted that the technical effects that can be achieved by the third aspect to the tenth aspect above or any possible implementation manner among the third aspect to the tenth aspect can be correspondingly described with reference to the technical effects that can be achieved by the first aspect to the second aspect above or any possible implementation manner of the first aspect and the second aspect; details are not repeated here. Description of the Drawings

[0076] Figure 1 Schematic diagrams of the plaintext and ciphertext forms corresponding to LWE, RLWE, and RGSW;

[0077] Figure 2A Schematic diagram of an algorithm flow for sample extraction;

[0078] Figure 2B It is a schematic structural diagram of a sample extraction;

[0079] Figure 3A It is a schematic diagram of the process of generating a key by a homomorphic key generation party;

[0080] Figure 3B It is a schematic diagram of the encryption process executed by a homomorphic encryption party;

[0081] Figure 3C It is a schematic diagram of the decryption process executed by a homomorphic decryption party;

[0082] Figure 3D It is a schematic diagram of the homomorphic calculation process executed by a homomorphic calculation party;

[0083] Figure 3E It is a schematic diagram of homomorphic encryption;

[0084] Figure 3F It is a schematic diagram of a bootstrapping process;

[0085] Figure 4A It is a schematic structural diagram of a function bootstrapping;

[0086] Figure 4B It is a schematic diagram of an entire blind rotation process;

[0087] Figure 4C It is a schematic flow diagram of GINX blind rotation in the form of a CMux Gate;

[0088] Figure 4D It is a schematic diagram of a GINX blind rotation algorithm based on gadget decomposition;

[0089] Figure 4E It is a schematic diagram of the flow of a TFHE function bootstrapping algorithm;

[0090] Figure 4F It is a schematic diagram of a Montgomery modular algorithm;

[0091] Figure 5 It is a schematic structural diagram of a communication system architecture to which the method of the embodiment of the present application can be applied;

[0092] Figure 6A It is a schematic flow diagram of a data processing method provided by the embodiment of the present application;

[0093] Figure 6B It is a schematic flow diagram of another data processing method provided by the embodiment of the present application;

[0094] Figure 7AIt is a schematic flowchart of an MV-FBS algorithm without sample extraction provided in an embodiment of the present application;

[0095] Figure 7B It is a schematic flowchart of an MV-FBS algorithm without sample extraction provided in an embodiment of the present application

[0096] Figure 8A It is a schematic flowchart of a bootstrapping judgment process of fully homomorphic encryption provided in an embodiment of the present application;

[0097] Figure 8B It is a schematic flowchart of a judgment process of fully homomorphic encryption provided in an embodiment of the present application;

[0098] Figure 8C It is a schematic diagram of a GINX blind rotation algorithm based on RNS decomposition provided in an embodiment of the present application;

[0099] Figure 8D It is a schematic diagram of a direct RNS decomposition and blind rotation process provided in an embodiment of the present application;

[0100] Figure 8E It is a schematic diagram of an RNS decomposition and blind rotation process that can save NTT and INTT provided in an embodiment of the present application;

[0101] Figure 9 It is a schematic diagram of a homomorphic computing scenario to which the method of the embodiment of the present application can be applied;

[0102] Figure 10 It is a schematic structural diagram of a data processing device provided in an embodiment of the present application;

[0103] Figure 11 It is a schematic structural diagram of another data processing device provided in an embodiment of the present application;

[0104] Figure 12 It is a schematic structural diagram of a chip device provided in an embodiment of the present application. Detailed implementation manners

[0105] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present application. The terms used in the following embodiments are only for the purpose of describing specific embodiments and are not intended to limit the present application. As used in the specification and claims of the present application, the singular forms "a", "an", "the", "above", "said", "this" are also intended to include, for example, the expression "one or more", unless there is a clear contrary indication in the context. It should also be understood that in the embodiments of the present application, "one or more" means one, two or more than two; " / ", describing the association relationship of associated objects, indicates that three relationships can exist; for example, A and / or B can represent: A exists alone, A and B exist simultaneously, and B exists alone, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects before and after.

[0106] The terms "including", "comprising", "having" and their variants in the embodiments of the present application all mean "including but not limited to", unless otherwise specifically emphasized in other ways. Words such as "exemplary" or "for example" are used to represent examples, illustrations or explanations. Any embodiment or design described as "exemplarily" or "for example" should not be construed as being more preferred or having more advantages than other embodiments or designs. Using words such as "exemplarily" or "for example" is intended to present relevant concepts in a specific way for easy understanding.

[0107] Multiple in the embodiments of the present application means greater than or equal to two. It should be noted that in the description of the embodiments of the present application, words such as "first" and "second" are only used for the purpose of distinguishing descriptions and cannot be understood as indicating or implying relative importance, nor can they be understood as indicating or implying order.

[0108] The present application provides a data processing method. To better understand the solutions of the embodiments of the present application, the symbols, algorithms and related technical features involved in the embodiments of the present application will be explained below. It should be noted that these explanations are for the purpose of making the embodiments of the present application easier to understand and should not be regarded as limiting the protection scope required by the present application.

[0109] I. Symbol Explanation in the Embodiment of the Present Application:

[0110] Vector: Lowercase bold letters represent vectors. For example, a vector a with n elements is described as a = (a1,..., a n ). <a, b> is the inner product between two vectors.

[0111] Matrix: Represented by uppercase bold letters.

[0112] Denotes the set of integers.

[0113] denotes the set of real numbers. denotes the binary set {0, 1}.

[0114] denotes a ring where ranges over and the ciphertext modulus q is

[0115] r represents a real number,

[0116] The symbols denote, respectively: the floor, ceiling, and round functions.

[0117] denotes the 2N-th cyclotomic ring, which is the set of integer polynomials modulo X N + 1; where N is a power of 2.

[0118] is a quotient ring with coefficients in

[0119] denotes the polynomials with binary coefficients in

[0120] The real torus is the set of real numbers modulo 1.

[0121] are torus polynomials, i.e., where N is a power of 2.

[0122] The polynomial can represent the coefficient vector as φ(m) = (m0, …, m N-1 )

[0123] x ← D: means sampling x according to the distribution D.

[0124] The random variable Var(a) denotes the variance of a, and stddev(a) denotes the standard deviation of a.

[0125] The vector denotes the 2-norm of the polynomial computed by the coefficient vector.

[0126] ​Semicolon: Represents the vertical concatenation of vectors or matrices, e.g., [A; B].

[0127] II. Algorithm Explanation Involved in the Embodiment of the Present Application:

[0128] 1. Decomposition Techniques:

[0129] Gadget decomposition includes various methods such as digit decomposition and residue number system (RNS) decomposition. Among them, digit decomposition is to decompose a large number into multiple independent small numbers using a base. RNS decomposition is to decompose the large modulus of a polynomial into a set of relatively prime integer moduli using the Chinese Remainder Theorem (CRT) technique.

[0130] The following introduces several decomposition techniques related to the embodiments of this application:

[0131] RNS Decomposition (RNSDecomposition) Technique:

[0132] RNS decomposition is a commonly used technique for decomposing multi-precision integers in FHE. When the bit length of the modulus Q in the ring R Q exceeds 64 bits, arithmetic operations on this ring cannot be performed using the native types of most CPUs. To solve this problem, the RNS decomposition technique can be used to decompose the modulus Q into several relatively prime small integers Q1,..., Q d , where each Q i can be stored using 32-bit or 64-bit native integer types.

[0133] Generally, RNS is combined with NTT to improve the efficiency of calculation. Since NTT is essentially CRT, this representation method of storing NTT in the form of RNS is called Double CRT.

[0134] For a polynomial a(x) ∈ R Q , the coefficient vector of the resulting polynomial after RNS decomposition is:

[0135] where a i (x) = a(x) (mod Q i ); the coefficient vector a i = (a i,0 , a i,1 , ···, a i,N-1 ), and its NTT form representation is Therefore, for two polynomials a(x), b(x) ∈ R Q, the multiplication calculation using the RNS decomposition representation can be expressed as:

[0136] For the result after decomposition and calculation, the inverse CRT can be used for recovery to obtain the result on R Q . Exemplarily, the gadget vector is: where Q' i = Q / Q i ,

[0137] Digit decomposition technology:

[0138] Digit decomposition is usually used to decompose the ciphertext in FHE to control the noise in homomorphic multiplication. Three positive integers need to be concerned about in the digit decomposition technology, namely the ciphertext modulus Q, the decomposition base B, and the number of decomposition blocks Let g denote the d-dimensional column vector g = (B 0 , B 1 , ····, B d-1 ) T .

[0139] Given an integer a ∈ Z Q , the decomposition function g -1 can decompose a into d terms in Z B . The decomposition function g -1 or h -1 with base B, the decomposition function g -1 or h -1 is to divide the ciphertext by the decomposition base successively. Taking g -1 as the decomposition function, decomposing a through the decomposition function g -1 satisfies the following formula (1):

[0140]

[0141] The expansion function h or g is to multiply the ciphertext by the base successively. Taking g as the expansion function, decomposing a through the expansion function g satisfies the following formula (2):

[0142]

[0143] g -1 (a) and g(a) satisfy <g -1 (a), g> = a (mod Q).

[0144] Applying the decomposition function g -1, Similarly, the factorization of integers can be extended to the factorization of polynomials. For example, for a polynomial a(x) ∈ R Q , the factorization function satisfies the following formula (3):

[0145]

[0146] where a i is the i-th coefficient of a(x); is the rounding symbol, ∑ is the summation symbol, and mod is the modulo operation symbol. Then, the factorization function g -1 factorizes a polynomial in R Q into d polynomials in R B . Similarly, the polynomial can be recovered by g -1 (a(x))·g = α(x).

[0147] This factorization can be used for an RLWE ciphertext <g -1 (a), g(b)> ≡ a·b mod Q.

[0148] Let I2 be the 2×2 identity matrix, denote the tensor product. Then is a gadget matrix that can be used for digit factorization with base B to ensure the recovery of the ciphertext after multiplication. The factorization function of

[0149]

[0150] is formula (4): -1 which satisfies g its factorization function

[0151] In the outer product operation of the current technology, a homomorphic message ciphertext (such as an RLWE ciphertext) is factorized into small values by a gadget, i.e., g -1 (), similarly, the expression structure of the bootstrapping key conforming to the RGSW ciphertext form also correspondingly uses the gadget expansion function g(), so that g() and g -1 () can be canceled out during the outer product calculation, which not only does not affect the correctness of the calculation result but also reduces the noise.

[0152] Approximate gadget decomposition technology:

[0153] Approximate gadget decomposition requires the introduction of an approximate factor \(P\), which satisfies the relationship Specifically, given a modulus \(Q\) of length \(l\)-bit, an approximate factor \(P\) and a decomposition base \(B\) can be selected to satisfy \(l=\log_2P + d\) g \(\cdot\log_2B\) g (decomposition base). The number of decomposed blocks is g (decomposition base). The number of decomposed blocks is Correspondingly, the gadget vector is For a polynomial \(a\in\mathbb{R}\) Q , its decomposition function can be denoted as Satisfying the following formula (5):

[0154]

[0155] Therefore, through the decomposition technique, a polynomial \(a\in\mathbb{R}\) Q can be decomposed to obtain \(d\) g polynomials This decomposition technique can minimize the decomposition error

[0156] Exemplarily, when using approximate gadget decomposition in the outer product between RLWE and RGSW ciphertexts, the gadget matrix \(G\) P can be expressed as The ciphertext of the RGSW form of the message \(m\) is: where \(ct\) i \(\in\) RLWE sk,Q (0) is an RLWE ciphertext randomly sampled from \(\mathbb{R}\) Q with a noise term \(e'\) i The RLWE ciphertext \(ct=(a,b)\in\) RLWE sk,Q (\(\mu\)) and the outer product of the RGSW ciphertext \(CT\in\) RGSW sk,Q (\(m\)) using approximate gadget decomposition is the following formula (6):

[0157]

[0158] where \(\varepsilon\) is the approximate factor that satisfies , and the plaintext message \(m\in\{0,1\}\). The term \(ct'\) i is the \(i\)-th result of the approximate decomposition on the RLWE ciphertext \(ct\), \(e'\)i is the error term in the RGSW ciphertext, e ct is the error term in the RLWE ciphertext. Therefore, the error generated by using the outer product of the approximate gadget decomposition

[0159] 2. Homomorphic encryption of different ciphertext forms (ciphertext types):

[0160] There are usually multiple forms (types) of ciphertexts. For example, ciphertexts in the form of learning with errors (LWE), torus version of the learning with errors (TLWE) ciphertexts, ring learning with errors assumption (RLWE) form of ciphertexts, torus version of RLWE TRLWE ciphertexts (Torus version of the ring-LWE problem, TRLWE), ring version of Gentry Sahai Water’s (RGSW) form of ciphertexts, and torus version of RGSW TRLWE ciphertexts. In the embodiments of the present application, these several ciphertext forms can be converted into each other to cope with different computing tasks. The following is a corresponding introduction to the foregoing several ciphertext forms.

[0161] (1) LWE:

[0162] An LWE sample is represented as a vector b = <a, s> + e mod q; where the secret key s is an n-dimensional vector and can be sampled from a key distribution χ (such as a Gaussian distribution); is a uniformly random n-dimensional vector, sampled uniformly from The error (which can be regarded as noise) e ← χ δ is sampled from an error distribution (such as a Gaussian distribution). The positive integers n and q represent the vector dimension and the ciphertext modulus respectively.

[0163] For example, the LWE ciphertext of the message m can be represented as where t is the plaintext modulus. The dimensions of b, m, and e are 1.

[0164] (2) TLWE:

[0165] The TLWE ciphertext is the Torus ring version of LWE and can be represented as the ciphertext Specifically, b = <a, s> + m + e, where the vector a is sampled from Uniformly sampled from B, the secret key s is from B n Uniformly sampled from is the plaintext message, and the error e is sampled from a Gaussian distribution with mean 0 and standard deviation σ.

[0166] (3) RLWE:

[0167] RLWE is the ring version of LWE over R Q An effective RLWE sample can be represented as a pair b = as + e mod Q; where the secret key s of the RLWE sample is sampled from a secret key distribution χ (such as a Gaussian distribution), a is uniformly random over R Q and the error is sampled from an error distribution. Then (a, b) corresponds to an RLWE ciphertext of the message 0. For simplicity of description, the polynomial dimension N of RLWE is generally ignored.

[0168] Similar to LWE samples, the RLWE ciphertext of the message m can be expressed as where △ = Q / t and t is the plaintext modulus.

[0169] The encryption of LWE and RLWE corresponds to the following two formulas (7) and (8):

[0170]

[0171]

[0172] The decryption of LWE and RLWE corresponds to the following two formulas (9) and (10):

[0173]

[0174]

[0175] (4) TRLWE:

[0176] The TRLWE ciphertext is the Torus ring version of RLWE and can be expressed as Specifically, b = <a, s> + m + e; where a is uniformly sampled from the secret key s is uniformly sampled from m is the plaintext message polynomial; the error is a polynomial with random coefficients, and the random coefficients are sampled from a Gaussian distribution with mean 0 and standard deviation σ. ​

[0177] (5) RGSW (which can also be denoted as RLWE'):

[0178] An RGSW sample is a vector based on d RLWE samples and can be denoted as Given a gadget vector v = (v0, v1, …, vd-1), RLWE' represents the concept of gadget RLWE and can be defined by the following formula (11):

[0179] RLWE′ sk (m) = (RLWE sk (v0·m), RLWE sk (v1·m), …, RLWE sk (v d-1 ·m)); (11)

[0180] If sk is the secret key, then the RGSW ciphertext of the message m ∈ R q can be denoted by the following formula (12):

[0181] RGSW sk (m) = (RLWE′ sk (sk·m), RLWE′ sk (m)); (12)

[0182] Here, the parameters of the same dimension and ciphertext modulus are omitted.

[0183] (6) TRGSW:

[0184] TRGSW is the toric version of RGSW and can encrypt the plaintext message into the ciphertext where is a matrix, and each row of the matrix Z is the TRLWE ciphertext of the plaintext message 0 under the same secret key; h -1 is the gadget decomposition matrix used to control the noise propagation.

[0185] Assume k = 1, the TRGSW ciphertext can be further denoted by the following formula (13):

[0186]

[0187] where, (a i (x), b i (x)), 1 ≤ i ≤ 2l are the TRLWE ciphertexts encrypting the plaintext message 0 under the same secret key, B g represents the basis of the gadget decomposition, and l is the length of the gadget decomposition.

[0188] The different plaintext and ciphertext forms corresponding to the above-mentioned LWE, RLWE, and RGSW are as follows Figure 1 shown.

[0189] 3. Products Multiplication:

[0190] (1) Gadget Decomposition Product (Gadget Product):

[0191] The gadget product refers to \(R\times RLWE'\to RLWE\), defined as shown in the following formula (14):

[0192]

[0193] where \(t\in R\), \((t_0,t_1,\cdots,t\) l-1 ) is the gadget decomposition of \(t\) based on the gadget decomposition vector \(v\), that is, \(\sum\) i v i t i =t. \(B = \max\{t\) i}\) is the gadget decomposition basis, and \(l\) is the gadget decomposition length. The noise variance of the gadget product result is which is the noise variance of the input RLWE' ciphertext, and \(N\) is the polynomial dimension.

[0194] (2) External Product:

[0195] The input RLWE ciphertext is: RLWE sk (m1)=(a,b), RGSW sk (m2)=(RLWE′ sk (sk·m2), RLWE′ sk (m2)).

[0196] The result of the external product operation (which can be simply referred to as the external product) between the RGSW ciphertext and the RLWE ciphertext is an RLWE ciphertext, that is, as shown in the following formula (15):

[0197] RLWE sk (m1)\(\odot\)RGSW sk (m2)=(a,b)\(\odot\)(RLWE′ sk (sk·m2), RLWE′ sk (m2))

[0198] =a\(\odot\)RLWE′ sk (sk·m2)+b\(\odot\)RLWE′ sk (m2)

[0199] = RLWE sk (a·sk·m2 + b·m2)

[0200] = RLWE sk ((a·sk + b)·m2)

[0201] = RLWE sk (m1·m2 + e1·m2); (15)

[0202] If m2 has a small norm, such as binary, the noise term e1·m2 will be small enough. Thus, the output of the outer product is the RLWE encryption of the message m1·m2, and the upper bound of its noise variance is where represents the noise variance of the gadget product result of the input RGSW ciphertext, represents the noise variance of the input RLWE ciphertext.

[0203] (3) Outer product in blind rotation:

[0204] The homomorphic ciphertext in RLWE form can be expressed as: μ1 can identify the homomorphically encrypted message. Perform gadget decomposition on RLWE(μ1) and divide the decomposed polynomial into l parts (e.g., l = 3), which can be expressed as

[0205] The homomorphic ciphertext in RGSW form can be expressed as: That is, 2l RLWE-form ciphertexts and 1 gadget matrix, and μ2 can be identified as the homomorphic decryption key.

[0206] The outer product in blind rotation can be expressed as the following formula (16):

[0207]

[0208] In the above formula (12), s is a part of the homomorphic decryption key in the RGSW-form homomorphic ciphertext, and (A, A·s) is the homomorphic encryption key, which is equivalent to pk' in the bootstrapping process, is the gadget matrix, g = (B 0 , B 1 ,..., B l-1 ), and B is the decomposition basis of the gadget.

[0209] 4. Sample extraction:

[0210] Through the sample extraction operation, LWE / TLWE ciphertexts can be extracted from RLWE / TRLWE ciphertexts.

[0211] Specifically, given a ciphertext c = (a(x), b(x)) ∈ TRLWE(m(x)) and an index i ∈ [0, N - 1], we can extract the TLWE ciphertext (a, b) of the i-th coefficient of the message m(x) without introducing any new noise. Such an operation can be called SampleExtracti(c). This sample extraction algorithm takes as input an RLWE ciphertext c = (a, b) ∈ RLWE sk,q (m) and a given position i, and can output or return an LWE ciphertext LWE sk,q (mi), where m i is the i-th coefficient of m.

[0212] For example, SampleExtract0(c) is This can be simply proven by decrypting TRLWE. See Figure 2A as shown, which shows the algorithm flow of a sample extraction; Figure 2B shows the schematic diagram of the process of obtaining LWE by sample extraction based on RLWE.

[0213] 5. Modulus switching:

[0214] The modulus switching technique can change the modulus of the ciphertext. Taking the ciphertext as input, the modulus switching algorithm outputs the ciphertext as shown in the following formula (17):

[0215]

[0216] The noise variance satisfies:

[0217] III. Related Technologies Involved in the Embodiment of the Present Application:

[0218] 1. Homomorphic encryption (HE):

[0219] Homomorphic encryption (or fully homomorphic encryption FHE) aims to perform computational processing on ciphertexts of data without exposing the plaintext of the data. It focuses on privacy-preserving computing, which is a technology for realizing data value mining under the premise of providing privacy protection. Homomorphic encryption adds the function of homomorphic calculation under ciphertext based on basic encryption. It allows direct calculation on the ciphertext after encryption, and the calculation result obtained after decrypting the ciphertext calculation result is the same as the calculation result based on the plaintext. Fully homomorphic encryption can be asymmetric public-key encryption or symmetric encryption, as long as the ciphertext has a certain algebraic structure.

[0220] Homomorphic encryption can be divided into single - homomorphic encryption, partially homomorphic encryption, and fully homomorphic encryption. Among them, single - homomorphic encryption can only perform homomorphic addition or homomorphic multiplication; partially homomorphic encryption supports a finite number of arbitrary homomorphic operations, where homomorphic operations can be either homomorphic addition or homomorphic multiplication; fully homomorphic encryption supports an infinite number of arbitrary homomorphic operations. Fully homomorphic encryption can be asymmetric public - key encryption or symmetric encryption as long as the ciphertext has a certain algebraic structure.

[0221] The homomorphic encryption HE=(HE.Keygen, HE.Enc, HE.Dec, HE.Eval) consists of four parts of algorithms. Among them, HE.Keygen represents key generation, HE.Enc represents homomorphic encryption, HE.Dec represents homomorphic decryption, and HE.Eval represents homomorphic evaluation, which can also be called homomorphic computation. The following takes an asymmetric encryption scheme as an example to introduce homomorphic encryption, where n is the security parameter.

[0222] 1.1. Key generation: (pk, evk, sk)←HE.Keygen(1 n )。

[0223] As Figure 3A shown, the homomorphic key - generation party (abbreviated as HEKG) can input key material (such as 1 n ) into the key generator, output the public key (public key, pk) as the homomorphic - encryption key K enc , that is, K enc = pk; output the private key (secret key, sk) as the homomorphic - decryption key K dec , that is, K dec = sk; output the evaluation key (evaluation key, evk) as the homomorphic - evaluation key K eval , that is, K eval = evk. The homomorphic - evaluation key can also be called the homomorphic - computation key.

[0224] 1.2. Homomorphic encryption: c←HE.Enc pk (m).

[0225] As Figure 3B shown, the homomorphic - encryption party (abbreviated as HEenc) can use the homomorphic - encryption key K enc = pk to encrypt a single - bit plaintext message m∈{0,1} into a ciphertext c.

[0226] 1.3. Homomorphic decryption: m ← HE.Dec sk (c).

[0227] As Figure 3C shown, the homomorphic decryption party (abbreviated as HEdec) can use the homomorphic decryption key K dec = sk to decrypt the ciphertext c and recover the plaintext message m ∈ {0, 1}.

[0228] 1.4. Homomorphic evaluation (also known as homomorphic computation): cf ← HE.Eval evk (f, c1, …, c l ).

[0229] As Figure 3D shown, based on the input ciphertexts c1, …, c l and the homomorphic computation key K eval = evk, the homomorphic computation party (abbreviated as HEcalc, or HEeval) can perform the homomorphic computation function f∶{0, 1} l →{0, 1} under the ciphertext and obtain the output ciphertext c f .

[0230] Among them, f represents an arithmetic circuit with addition and multiplication gates over GF(2) (where GF represents a finite field, and GF is the abbreviation of Galois Field). Generally, the homomorphic computation HE.Eval can be decomposed into multiple basic operators, such as homomorphic addition c add ← HE.Add evk (c1, c2) and homomorphic multiplication c mult ← HE.Mult evk (c1, c2).

[0231] The entire homomorphic encryption scheme HE = (HE.Keygen, HE.Enc, HE.Dec, HE.Eval) is as Figure 3E shown. After decrypting the ciphertext calculation result, it is equivalent to the plaintext calculation result. The homomorphic key generation party A generates the homomorphic encryption key K enc , the homomorphic computation key K eval , and the homomorphic decryption key K dec , which need to be distributed to the homomorphic encryption party B, the homomorphic computation party C, and the homomorphic decryption party D respectively.

[0232] In a homomorphic encryption task, there can be multiple homomorphic encryptors to encrypt data from different sources, multiple homomorphic computing parties to execute homomorphic computing circuits, and single-hop or multi-hop homomorphic computing parties. There can also be multiple homomorphic decryptors in a homomorphic encryption task, and the decryption results can be given to multiple data users. Depending on the key deployment, the homomorphic decryptor and the data user can be the same or different entities. The keys of multiple homomorphic encryptors in a homomorphic encryption task can be the same or different. The homomorphic computing keys can include bootstrapping keys (BSK) and keyswitching keys (KSK). BSK can be used in the ciphertext state to reduce noise in the homomorphic computing decryption circuit; KSK can be used to convert the ciphertext product into a new ciphertext with the same dimension as the original ciphertext after ciphertext calculation, and eliminate the cross terms of the corresponding keys to reduce the problem of increased ciphertext size caused by ciphertext multiplication.

[0233] 2. Ciphertext bootstrapping:

[0234] Existing fully homomorphic encryption schemes all have a common feature, that is, adding a small random "noise" component e during the encryption process. Performing homomorphic calculations on ciphertexts will cause these noises to grow. When multiple ciphertexts are superimposed together for homomorphic calculations, the noise in each ciphertext will be superimposed and amplified. In particular, the noise growth caused by homomorphic multiplication may reach exponential levels, and cross terms of noise multiplied by ciphertext will appear. If relatively simple calculations are performed on the ciphertext, the superimposed noise is within a controllable range (critical value), then the ciphertext can be easily restored to plaintext through the decryption algorithm. However, if the calculations performed on the ciphertext are too complex, causing the noise to exceed the controllable range (critical value), then the original plaintext will be destroyed or even overwritten, resulting in the failure of homomorphic decryption. To solve this problem, the FHE scheme proposes the process of bootstrapping. Bootstrapping is a special processing technique for ciphertexts. After processing, a ciphertext with noise close to the critical value can be "refreshed" into a new ciphertext with very low noise. See Figure 3F As shown, the new key k2 is used to convert a high-noise ciphertext Re-encrypt into another fully homomorphic ciphertext And use the new key k2 to encrypt the old key k1 into ciphertext That is, the bootstrapping key (BSK), and then the homomorphic computing party uses the homomorphic decryption circuit corresponding to the homomorphic computing Decrypting the inner ciphertext back to plaintext can obtain a new low-noise FHE ciphertext under a new key.

[0235] 3. Bootstrapping of TFHE:

[0236] The fully homomorphic encryption algorithm TFHE of the Boolean type is one of the most practical FHE schemes at present. It provides a hierarchical homomorphic computing mode, which can efficiently compute hierarchical circuits such as lookup tables (LUTs) with multiple inputs, bit sequence representations (BSRs), and weighted finite automata (WFAs). Since the inputs and outputs of hierarchical homomorphic computing are ciphertexts of different types (forms) and cannot be directly combined for operations, in order to implement homomorphic computing for circuits of arbitrary depth, TFHE introduces two bootstrapping operations to reduce the noise of the ciphertext and at the same time convert the form of the ciphertext, namely gate bootstrapping and circuit bootstrapping. In addition, TFHE currently has the lowest bootstrapping delay among all fully homomorphic encryption schemes, and gate bootstrapping only takes about 13 ms.

[0237] See Figure 4A , which shows the bootstrapping process of TFHE gate bootstrapping. See Figure 4B , which shows the architecture diagram of the hierarchical homomorphic computing mode of TFHE.

[0238] The following introduces the corresponding bootstrapping scheme involved in the embodiments of the present application.

[0239] 3.1. Gate bootstrapping (GBS):

[0240] Gate bootstrapping is a typical bootstrapping, that is, during the process of homomorphic computing, a bootstrapping operation can be performed when passing through each binary gate calculation. The core of gate bootstrapping is blind rotation. Specifically, it rotates a polynomial using a ciphertext and can be implemented by n CMUX gates, and the CMUX gates in blind rotation can be constructed by the outer product of RLWE ciphertext and RGSW ciphertext.

[0241] See Figure 4A As shown in the process of TFHE gate bootstrapping, the input of gate bootstrapping is the high-noise (i.e., large noise) LWE / TLWE homomorphic ciphertext c = (a, b) after homomorphic computing, and its corresponding homomorphic encryption and decryption keys are (pk, sk). The output of gate bootstrapping is a low-noise (i.e., small noise) LWE (or TLWE) ciphertext, that is, the noise is reduced to a lower range. The specific steps can include the following:

[0242] Step 1: The b in the homomorphic ciphertext c can be re-homomorphically encrypted using a new homomorphic encryption key pk', that is, RLWE.Enc(X -b) is denoted as the initial value of the accumulator ACC for blind rotation.

[0243] Step 2: Input the initial value of ACC into the first CMUX gate, rotate a rotation component through the first CMUX gate to obtain the ACC output by the first CMUX gate. The ACC output by the first CMUX gate is then input into the second CMUX gate to form an iteration, and so on. After n iterations of the CMUX gates, the result output by the nth CMUX gate is RLWE.Enc(X -b+<a,s> ).

[0244] For ease of understanding, in the n CMUX gates, the calculation process of the i-th CMUX gate can be expressed by the following formula (18):

[0245] ACC = CMUX((ACC, X a[i] ·ACC), BKi) = ACC + (X a[i] -1)·ACC ⊙ BK i ; (18)

[0246] where X a[i] is the i-th rotation component of the blind rotation sub-operation, i is an integer taking values from 1 to n, and n is the polynomial dimension of a. ACC ⊙ BK i is the outer product of the i-th RLWE pk′ and RGSW pk′ (sk[i]). ACC is a homomorphic ciphertext in RLWE form. BK i is a homomorphic ciphertext in RGSW form, specifically, it can be the ciphertext obtained by homomorphically encrypting the original homomorphic decryption key sk using the new homomorphic encryption key pk'. It can be understood that based on the characteristics of homomorphic calculation, the high-noise homomorphic ciphertext (b, a) of the bootstrap input is multiplied by its corresponding decryption key (1, sk), that is, the high-noise homomorphic ciphertext is homomorphically decrypted, and finally a low-noise homomorphic ciphertext is obtained to achieve noise suppression.

[0247] After n iterations of the CMUX gates for update, through the sample extraction operation, a low-noise homomorphic ciphertext after bootstrap can be obtained, denoted as LWE.Enc(m).

[0248] Blind Rotation:

[0249] Blind rotation is the core part of the bootstrap of the core components in the FHEW and TFHE schemes. It uses the encrypted index to rotate the test polynomial. The blind rotation process is composed of k CMUX gates. The outer product operation of RLWE and RGSW ciphertexts can construct CMUX gates. Specifically, it can include the following steps:

[0250] 1. Set an encrypted rotation position p, which can be expressed as: p = p0·2 0 +…+p j ·2 j +…+p k ·2 k ; where p j is hidden, 2 j is a known constant, and j takes any integer from 0 to k.

[0251] 2. Rotate the encrypted polynomial M according to the encrypted rotation position p, which can be expressed as the following formula (19):

[0252]

[0253] 3. Refer to the above formula (24), and each term therein can be implemented by a CMUX gate. Exemplarily, each term can be determined by the following formula (20):

[0254]

[0255] 4. Refer to Figure 4B , which shows the entire blind rotation process.

[0256] Refer to Figure 4C shown, which is a schematic diagram of the main process of GINX blind rotation in the form of a CMUX gate. Given an LWE ciphertext to be homomorphically decrypted The bootstrap key is the homomorphic ciphertext obtained by re-encrypting the LWE key s = (s0, ·····, s n-1 ), and the bootstrap key is n RGSW ciphertexts bsk = (bsk0, ·····, bsk n-1 ). The blind rotation outputs an RLWE ciphertext encrypted for , whose key is sk and the modulus is Q, where t is a test polynomial. Refer to Figure 4D shown, which is an algorithm for the blind rotation process of GINX based on or with gadget decomposition.

[0257] Line 1 sets the initial polynomial acc as the RLWE ciphertext, Lines 3 to 6 perform the outer product between the RLWE ciphertext and the bootstrap key, which is the calculation of the CMUX gate. Among them, line 3 calls the decomposition technology, such as the digital decomposition or RNS decomposition introduced above. Lines 4 and 6 call the NTT transform and the INTT transform, and the specific NTT transform and INTT transform can be referred to the following introduction. The entire blind rotation includes the calculation and accumulation of the CMUX gate, which can be expressed as the following formula:

[0258]

[0259] 3.2. Functional Bootstrapping (FBS):

[0260] The TFHE scheme supports constructing arbitrary circuits through gate bootstrapping, and this technology has been further developed into functional bootstrapping (FBS), which can compute a single-input single-output lookup table function (LUT) while refreshing the ciphertext. Figure 4E The algorithm flow of functional bootstrapping is shown as follows:

[0261] First, define the test polynomial testP encoded by the LUT function f, and the bootstrapping key is Functional bootstrapping can be expressed as:

[0262] If it is functional bootstrapping in circuit bootstrapping, sk i is the i-th item of the LWE key (such as the private key), that is, the key at level 0 in circuit bootstrapping. is the key at level 2.

[0263] Specifically, the high-noise homomorphic ciphertext obtained through homomorphic calculation is c = (b, a), and its corresponding homomorphic encryption and decryption keys are (pk, sk). It is also possible to first re-homomorphically encrypt b in the homomorphic ciphertext c using the new homomorphic encryption key pk', that is, RLWE.Enc(X -b ). The initial value of the accumulator ACC (which can also be acc) can be recorded as ACC = (0, X -b ·testP). Input the initial value of ACC into the first CMUX gate, rotate a rotation component through the first CMUX gate, and obtain the ACC output by the first CMUX gate. The ACC output by the first CMUX gate is then input into the second CMUX gate to form an iteration. Among them, the calculation process of the i-th CMUX gate can be shown as the following formula (21):

[0264]

[0265] Among them, X a[i] is the i-th rotation component of the blind rotation, i ∈ [1, n], and n is the polynomial dimension of a. is the outer product of the i-th RLWE and RGSW. ACC is the homomorphic ciphertext in RLWE form. is the homomorphic ciphertext in RGSW form.

[0266] After n iterations of updating through the CMUX gates, and then through operations such as sample extraction, the bootstrapped low-noise homomorphic ciphertext can be obtained, denoted as

[0267] 4. NTT and FFT:

[0268] The representation methods of polynomials include the following several kinds:

[0269] 1. Coefficient representation method:

[0270] f(x) = a0 + a1x + a2x 2 + … + an-1x n-1 , and the coefficients of this polynomial can be represented as the vector (a0, a1, …, an-1).

[0271] 2. Point-value representation method: If n different numbers x0, …, xn-1 are selected to evaluate the polynomial, obtaining f(x0), …, f(xn-1), then this polynomial is represented by the point-value representation method as: (xi, f(xi)), 0 ≤ i ≤ n - 1,

[0272] The operation advantage of the point-value representation method lies in that for the multiplication (actually convolution) of two polynomials represented by the point-value representation method (such as (xi, f(xi)) and (xi, g(xi))), the corresponding terms can be directly multiplied, as shown in the following formula (22):

[0273] G(x) = {((x0, f(x0)·g(x0)), (x1, f(x1)·g(x1)), (x2, f(x2)·g(x2)), …, (x n-1 , f(x n-1 )·g(x n-1 )))}; (22)

[0274] The process of converting a polynomial from coefficient representation to point-value representation can be achieved through the discrete Fourier transform DFT, or FFT, or NTT.

[0275] The process of converting a polynomial from point-value representation to coefficient representation can be achieved through the inverse discrete Fourier transform IDFT, or IFFT, or INTT.

[0276] DFT: A linear transformation from the given input vector a = (a0, a1, …, an-1) to the output vector A = (A0, A1, …, An-1), where, is the nth root of unity. The essence of DFT is to substitute n roots of unity and convert from the coefficient expression to the point-value expression.

[0277] FFT: The complex roots ω used in FFT satisfy periodicity, symmetry, and reducibility n . For the DFT expression of the polynomial f(x), it can be recursively decomposed to obtain the FFT form, as shown in the following formula (23):

[0278]

[0279] 4.1. Number Theoretic Transform (NTT):

[0280] NTT is an implementation of the Discrete Fourier Transform (DFT) over a finite field, and NTT is more convenient for modular arithmetic. NTT uses the Chinese Remainder Theorem (CRT) to decompose the polynomial ring, mapping the original ring to several lower-order rings. To ensure that the mapping can be performed, there are parameter requirements to ensure the existence of roots to factor the modular polynomial of the polynomial ring.

[0281] Exemplarily, the forward n-point NTT transform A k = NTT(a) is defined by the following equation (24):

[0282]

[0283] The inverse n-point NTT transform a = INTT(A) is defined by the following equation (25):

[0284]

[0285] Specifically, for a polynomial ring R Q = Z Q [X] / (X N + 1), where N is a power of 2. If the modulus Q is a prime number such that Q ≡ 1 (mod 2N), then there exists a 2N-th primitive root of unity ζ ∈ Z Q . In addition, ζ also satisfies the following 3 properties:

[0286] Periodicity: ζ 0 , ζ 1 , …, ζ 2N-1 are distinct. When i < 2N and k ∈ Z, ζ i+k*(2N) = ζ i (mod Q);

[0287] Symmetry: When i < N, ζ i+N = -ζ i (mod Q);

[0288] Reducibility: When i < N, ζ 2i = ω i(mod Q), where ω is a N-th primitive root of unity.

[0289] Therefore, the root ζ can be used to factor the polynomial X N+1 into multiple linear polynomials X - ζ i , where i = 1, 3, ..., 2N - 1. More specifically, using the property ζ N = -1 (mod Q), there exists a ring isomorphism Subsequent calculations in R Q can be respectively implemented in these two rings with dimensions not exceeding . Thus, for a polynomial a(x) ∈ R Q , its NTT transform NTT Q (a) is to calculate

[0290] Since N is an integer power of 2, the factorization of the polynomial X N+1 can be completed through log2 N levels. Specifically, the fully factorized NTT corresponds to the following ring isomorphisms:

[0291]

[0292] Correspondingly, the CRT is also calculated: φ(a) = (a mod (X - ζ 1 ), a mod (X - ζ 3 ), ···, a mod (X - ζ 2N-1 ))

[0293] Using the symmetry of the root ζ, a product of a coefficient and a primitive root can be used twice in each level, such as and This form of operation is called the Cooley-Tukey butterfly, abbreviated as the CT butterfly. Using the operation of the CT butterfly, the number of multiplications in each level can be reduced to N / 2. Thus, the complexity of a single NTT is O(N · log2 N). The NTT of the coefficient vector a of the polynomial a(x) is the following formula (26):

[0294]

[0295] The INTT of the polynomial is naturally calculated in a similar way for the inverse isomorphism φ -1, by using the negative powers of the primitive root to iteratively reverse the above process, which requires the same number of multiplications at each level. Correspondingly, the basic computational unit in the INTT is the so-called Gentleman-Sande butterfly, abbreviated as GS butterfly. The calculation formula for the INTT vector a' satisfies the following formula (27):

[0296]

[0297] Therefore, the product c(x) = a(x)·b(x) in R can be efficiently calculated by using the negative cyclic convolution to calculate the INTT (NTT(a)⊙NTT(b)), and the computational complexity is O(N·log2 N). Q

[0298] 4.2. Fast Fourier Transform (FFT):

[0299] FFT is a fast algorithm for calculating the DFT in the real number domain using complex numbers as the roots of unity. For the polynomial in R The 2N-th unity root is ζ ∈ R. The 2N-th unity root ζ has the same properties as the roots of unity in the NTT, and its calculation is the same as that of the NTT with complex roots. Then the FFT of the coefficient vector a of the polynomial a(x) satisfies the following formula ():

[0300] FFT(a) = (a(ζ 1 ), a(ζ 3 ), ···, a(ζ 2N-1 )) ∈ R N .

[0301] Similarly, the inverse fast Fourier transform (IFFT) of the FFT vector a' is:

[0302] The computational complexity of calculating the FFT and IFFT using butterfly transforms is O(N·log2 N).

[0303] Since the FFT and NTT are currently applied in the FHE scheme to improve the operation efficiency, and the different characteristics between the FFT and NTT will have different impacts on the operation efficiency.

[0304] The differences between the NTT and FFT include the following:

[0305] (1) Computational domain: NTT performs exact calculations using integers over a finite field, while FFT performs approximate calculations using floating-point numbers over the real field.

[0306] (2) Intermediate data size: FFT can utilize complex roots with magnitudes less than 1 to maintain the amplitude, but due to negacyclic convolution [GLH23], the amplitude in NTT is irregular.

[0307] (3) Data friendliness: In implementation, NTT is more friendly to small data because the smaller the data size, the faster the implementation for integers. FFT is more friendly to large data and uses double-precision floating-point numbers to store all intermediate values.

[0308] (4) Modular Reduction: NTT requires frequent integer modular operations to ensure correctness after multiplication, but there are Barrett and Montgomery algorithms that can be used to accelerate the operations. In FFT, the program itself does not require modular operations, but when mapping the result back to the polynomial ring, modular reduction is needed.

[0309] NTT-based blind rotation is useful in scenarios where only prime moduli can be used, such as in applications of homomorphic traces and automorphisms.

[0310] In a possible implementation, NTT and FFT are applied in the process of bootstrapping (blind rotation) of homomorphic encryption. From the differences between NTT and FFT above, it can be seen that NTT-based blind rotation with prime modulus has lower computational efficiency than FFT-based blind rotation with quadratic power modulus.

[0311] 5. Montgomery Modular Reduction Algorithm:

[0312] The Montgomery modular reduction algorithm mainly utilizes the characteristics of modular operations, which can transform modular operations into addition, subtraction, and shift operations, improving the execution efficiency of modular operations.

[0313] Exemplarily, refer to Figure 4F the shown Montgomery modular reduction algorithm. Given two coefficients x and y, perform modular reduction according to the following steps to obtain the result r:

[0314] Input: Two coefficients x, y ∈ Z Q ;

[0315] Pre-compute the constant Q - 1 mod β.

[0316] Output: r = x · y · β -1 mod Q, -Q < r < Q.

[0317] The specific steps are as follows:

[0318] Step 1. m = lo(x·y)·Q - 1 mod β

[0319] Step 2.

[0320] Step 3. r = hi(x·y) - t.

[0321] In the above, lo (abbreviation of low) represents taking the lower - order bits; hi (abbreviation of high) represents taking the higher - order bits.

[0322] In view of the related technologies introduced above, taking the bootstrapping process of homomorphic encryption as an example, the core part of the bootstrapping process is blind rotation processing. Currently, a blind rotation processing method based on the number theoretic transform (NTT) is proposed to improve the efficiency of the bootstrapping process. In NTT processing, in order to improve the correctness of the data after operation, integer modulo operations need to be frequently performed, thus affecting the execution efficiency of the blind rotation processing method based on NTT. Similarly, in some homomorphic processing (such as homomorphic encryption, homomorphic decryption, or homomorphic calculation, etc.), the overall processing efficiency may be affected due to the involvement of modulo operations.

[0323] Therefore, this application provides a data processing method, which can effectively improve the processing efficiency of homomorphic processing (including homomorphic encryption, homomorphic decryption, homomorphic calculation, etc.). The technical solution provided by the embodiments of this application can be applied to the 4th generation (4G) mobile communication technology system, such as the long - term evolution (LTE) system, or can be applied to the 5G system, such as the NR system, or the next - generation wireless local area network system or various future communication systems, and specific applications are not limited.

[0324] Figure 5 Shows a possible and non - restrictive communication system architecture applicable to the embodiments of this application. As Figure 5 shown, the communication system 5000 includes a radio access network (RAN) 100 and a core network (CN) 200. Optionally, the communication system 5000 may further include the Internet 300. RAN 100 includes at least one network device (such as Figure 5 110a and 110b in Figure 5120a - 120j in it, collectively referred to as 120). The RAN 100 may also include other RAN nodes, for example, wireless relay devices and / or wireless backhaul devices ( Figure 5 not shown in the figure) and so on. The terminal device 120 is connected to the network device 110 in a wireless manner. The network device 110 is connected to the core network 200 in a wireless or wired manner. The core network device in the core network 200 and the network device 110 in the RAN 100 may be different physical devices respectively, or may be the same physical device integrating the core network logic function and the radio access network logic function.

[0325] The RAN 100 may be a cellular system related to the 3rd generation partnership project (3GPP), for example, the 4th generation (4G), 5th generation (5G) mobile communication system, or an evolved system after 5G (such as the 6G mobile communication system). The RAN 100 may also be an open RAN (O-RAN or ORAN), a cloud radio access network (CRAN), or a WiFi system. The RAN 100 may also be a communication system integrating two or more of the above systems.

[0326] It can be understood that Figure 5 only one possible communication system architecture to which the embodiments of the present application can be applied is shown. In other possible scenarios, other devices may also be included in the communication system architecture.

[0327] The network device 110 is a node in the radio access network (RAN), and can also be called an access network device, and can also be called a RAN node (or device). The network device 110 is used to help the terminal device achieve wireless access. Multiple network devices 110 in the communication system 5000 may be of the same type of node, or may be of different types of nodes. In some scenarios, the roles of the network device 110 and the terminal device 120 are relative. For example, Figure 5 the network element 120i in the network can be a helicopter or a drone, which can be configured as a mobile base station. For the terminal devices 120j accessing the RAN 100 through the network element 120i, the network element 120i is a base station; but for the base station 110a, the network element 120i is a terminal device. The network device 110 and the terminal device 120 are sometimes both called communication devices. For example Figure 5The network elements 110a and 110b in the middle can be understood as communication devices with base station functions, and the network elements 120a - 120j can be understood as communication devices with terminal device functions.

[0328] In a possible scenario, the network device can be a base station, an evolved NodeB (eNodeB), a transmitting and receiving point (TRP), a transmitting point (TP), a next generation NodeB (gNB), a next generation base station in a 6th generation (6G) mobile communication system, a base station in a future mobile communication system, a satellite, or an access point (AP) in a WiFi system, an integrated access and backhaul (IAB) node, a network device in a mobile switching center non - terrestrial network (NTN) communication system, that is, it can be deployed on a high - altitude platform or a satellite, etc. The network device can be a macro base station (such as Figure 5 110a in Figure 5 ), a micro base station or an indoor station (such as 110b in ), a relay node or a donor node, or a radio controller in a CRAN scenario. The network device can also be a device that serves as a base station function in device - to - device (D2D) communication, vehicle - to - everything (V2X) communication, drone communication, or machine communication. Optionally, the network device can also be a server, a wearable device, a vehicle or an in - vehicle device, etc. For example, the access network device in vehicle - to - everything (V2X) technology can be a road side unit (RSU).

[0329] In another possible scenario, multiple network devices cooperate to assist a terminal device in achieving wireless access, and different network devices respectively implement some functions of a base station. For example, the network device may be a central unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU), etc. The CU and the DU may be separately provided, or may also be included in the same network element, such as a baseband unit (BBU). The RU may be included in a radio frequency device or a radio frequency unit, such as included in a remote radio unit (RRU), an active antenna unit (AAU), or a remote radio head (RRH). It can be understood that the network device may be a CU node, or a DU node, or a device including a CU node and a DU node. In addition, the CU may be classified as a network device in the radio access network (RAN), or the CU may be classified as a network device in the core network (CN), which is not limited herein.

[0330] In the embodiments of this application, the form of the network device is not limited, and the device for implementing the functions of the network device may be the network device; it may also be a device capable of supporting the network device to implement such functions, such as a chip system. This device may be installed in the network device or used in cooperation with the network device.

[0331] The terminal device 120, also known as a terminal, user equipment (UE), mobile station (MS), mobile terminal (MT), etc., or a device used to provide voice or data connectivity to users, can also be an Internet of Things device. For example, terminal devices include handheld devices with wireless connection capabilities, in-vehicle devices, etc. Currently, terminal devices can be: mobile phones, tablets, laptops, palmtop computers, mobile internet devices (MIDs), wearable devices (such as smartwatches, smart bracelets, pedometers, etc.), in-vehicle devices (such as cars, bicycles, electric vehicles, airplanes, ships, trains, high-speed rails, etc.), satellite terminals, virtual reality (VR) devices, augmented reality (AR) devices, intelligent point-of-sale (POS) machines, customer-premises equipment (CPE), wireless terminals in industrial control, smart home devices (such as refrigerators, TVs, air conditioners, electricity meters, etc.), intelligent robots, robotic arms, workshop equipment, wireless terminals in autonomous driving, wireless terminals in remote healthcare, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, or wireless terminals in smart homes, flying devices (such as intelligent robots, hot air balloons, drones, airplanes), etc. The terminal device can also be other devices with terminal functions. For example, the terminal device can also be a device that serves as a terminal function in D2D communication.

[0332] The embodiments of this application do not limit the device form of the terminal device. The device for implementing the functions of the terminal device can be the terminal device; it can also be a device that can support the terminal device to implement this function, such as a chip system. This device can be installed in the terminal device or used in matching with the terminal device. In the embodiments of this application, the chip system can be composed of chips or can also include chips and other discrete devices.

[0333] In Figure 5 each network element or device in the shown communication system (which can also be called a communication network) may possess at least one of the capabilities of homomorphic encryption, homomorphic decryption, and homomorphic computing. Therefore, in the embodiments of this application, it can be considered to support corresponding homomorphic encryption, homomorphic decryption, and homomorphic computing capabilities in the communication network.

[0334] The solutions provided in the embodiments of this application can be applied to, but are not limited to, homomorphic encryption scenarios, homomorphic decryption scenarios, and homomorphic computing scenarios as Figure 3E shown.

[0335] IV. Introduction to the Embodiment Solution of the Present Application:

[0336] The technical solution of the present application will be introduced below in conjunction with specific embodiments.

[0337] The embodiment of the present application provides a data processing method, which can be applicable to, but not limited to, Figure 5 the communication system shown, and this method can be applicable to, but not limited to, the homomorphic encryption scenario, the homomorphic decryption scenario, and Figure 3E the homomorphic computing scenario shown. In a possible implementation, this method is applied to the homomorphic encryption scenario, and this method can be executed by the homomorphic encryption device, or by the corresponding components (such as modules, chips, etc.) of the homomorphic encryption device, or by the device used in combination with the homomorphic encryption device. In another possible implementation, this method is applied to the homomorphic decryption scenario, and this method can be executed by the homomorphic decryption device, or by the corresponding components (such as modules, chips, etc.) of the homomorphic decryption device, or by the device used in combination with the homomorphic decryption device. In still another possible implementation, this method is applied to the homomorphic computing scenario, and this method can be executed by the homomorphic computing device, or by the components (modules, chips, etc.) of the homomorphic computing device, or by the device used in combination with the homomorphic computing device. It can be understood that the present application does not make specific limitations on the specific structure of the execution subject of the method provided in the embodiment of the present application and the number of each execution subject, as long as it can run the program recording the method provided in the embodiment of the present application and can communicate with other devices. The following uses the first device to represent the execution subject of the method for description. The order of the steps in each of the following processes is only an example. In actual applications, the order of execution of the steps in each process can be adjusted. Refer to Figure 6A As shown, the specific process of the method provided in the embodiment of the present application is as follows:

[0338] S601A: The first device determines the ciphertext modulus of homomorphic encryption, which is a prime number obtained by accumulating the products of n different powers of 2 and coefficients, and n is an integer greater than or equal to 2 and less than or equal to 5.

[0339] In the embodiment of the present application, homomorphic processing may include, but is not limited to, at least one of homomorphic encryption, homomorphic decryption, and homomorphic computing.

[0340] In a possible implementation manner, the ciphertext modulus may satisfy the following form (or it can be understood that the ciphertext modulus and the n different powers of 2 satisfy the following relationship):

[0341]

[0342] where Q is the ciphertext modulus, and the exponents k of the first n - 1 different powers of 2i is an integer greater than 0 and less than or equal to m (m ≥ k1 > … k i > k n -1 > 0), the exponent k of the nth power of 2 n equals 0 (k n = 0), m is the bit width of the ciphertext modulus Q, and the coefficient a i takes values of +1 or -1, and i is an integer greater than or equal to 1 and less than or equal to n.

[0343] Exemplarily, when n is 2, the form satisfied by the ciphertext modulus is where k1 is an integer greater than 0 and less than or equal to m. When n is 3, the form satisfied by the ciphertext modulus is where both k1 and k2 are integers greater than 0 and less than or equal to m.

[0344] S602A: The first device performs homomorphic processing based on the ciphertext modulus.

[0345] In a possible implementation, modular operations are included in both homomorphic encryption, homomorphic decryption, and homomorphic calculation; then the first device performing homomorphic processing based on the ciphertext modulus may include: performing a modular operation based on the ciphertext modulus, and the modular operation includes shift processing and / or logical operation processing; wherein, the number of bits shifted in the shift processing is related to the exponents of n powers of 2 in the ciphertext modulus, and the number of times of logical operation processing is related to the value of n.

[0346] In a possible implementation, the method may further include: The first device performs at least one number theoretic transform NTT based on the modular operation.

[0347] The principle of the number theoretic transform NTT can refer to the NTT in the existing related technologies introduced above in this application embodiment, and will not be elaborated here.

[0348] In a possible implementation, one NTT includes M butterfly operations (or butterfly calculations); M is an integer greater than or equal to 3; then the first device performing the number theoretic transform NTT based on the modular operation may specifically include: performing the modular operation once every three butterfly operations; and performing modular operation on each multiplication result in each butterfly operation using the power modular operation algorithm.

[0349] For example, the above power modular operation algorithm may be the Montgomery algorithm.

[0350] In summary, the embodiment of the present application provides a data processing method, which includes: a first device determines a ciphertext modulus for homomorphic encryption; the ciphertext modulus is a prime number obtained by accumulating the products of n different powers of 2 and coefficients, where n is an integer greater than or equal to 2 and less than or equal to 5; then, homomorphic processing is performed based on the ciphertext modulus, and the homomorphic processing may include at least one of homomorphic encryption, homomorphic decryption, and homomorphic calculation. Generally, operations such as homomorphic encryption, homomorphic decryption, and homomorphic calculation all involve a modulo operation or modulo arithmetic. Usually, the way of the modulo operation or modulo arithmetic may be to directly perform long division to obtain the result. However, when the divisor and dividend of the modulo operation are relatively large, it is obviously difficult to use long division to obtain the result. Therefore, the present application designs a modulus, which is a prime number obtained by accumulating the products of n different powers of 2 and coefficients. Based on such a modulus, it is more convenient to perform the modulo operation or modulo arithmetic, and the efficiency of modulo is higher. Thus, the processing efficiency of homomorphic encryption, homomorphic decryption, and homomorphic calculation, etc., which include the modulo operation / modulo arithmetic, can be improved.

[0351] The embodiment of the present application also provides a data processing method, which can be applied to but is not limited to Figure 5 the communication system shown, and this method can be applied to but is not limited to homomorphic encryption scenarios and homomorphic decryption scenarios, as well as Figure 3E the homomorphic calculation scenario shown. Figure 6B The execution subject of the method can refer to the above Figure 6A content described for the execution subject of the method, which will not be elaborated here. The order of steps in the following various processes is only an example. In actual applications, the order of steps in each process can be adjusted. Refer to Figure 6B As shown, the specific process of the method provided by the embodiment of the present application is as follows:

[0352] S601B: A first device determines a ciphertext modulus for homomorphic encryption; the ciphertext modulus is a composite number obtained by multiplying d different prime numbers, where each prime number is obtained by accumulating the products of n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5, and d is an integer greater than 1.

[0353] In a possible implementation, the ciphertext modulus may satisfy the following form (or it can be understood that the following relationship exists between the ciphertext modulus and the d different prime numbers):

[0354]

[0355] where Q represents the ciphertext modulus, and d represents the number of prime numbers Q j used to multiply to obtain the ciphertext modulus; the prime number Q j may satisfy the following form:

[0356]

[0357] Prime number Q j Exponent k of the power of 2 ji Is an integer greater than 0 and less than or equal to m j Of (m j ≥k j1 >…k ji >k j(n-1) >k jn =0); m j Is the bit width size of Q j Of the coefficient a i The value of is +1 or -1; * is the multiplication sign.

[0358] S602B: The first device performs homomorphic processing based on the ciphertext modulus.

[0359] In the embodiments of the present application, the homomorphic processing may include, but is not limited to, at least one of homomorphic encryption, homomorphic decryption, and homomorphic calculation.

[0360] In the embodiments of the present application, if the first device performs homomorphic encryption based on the ciphertext modulus, the first device may be a homomorphic encryption party device, or the first device may be executed by a component (such as a module, chip, etc.) corresponding to the homomorphic encryption party device, and the first device may also be a device used in combination with the homomorphic encryption party device. If the first device performs homomorphic decryption based on the ciphertext modulus, the first device may be executed by a homomorphic decryption party device, or the first device may be a component (such as a module, chip, etc.) corresponding to the homomorphic decryption party device, and the first device may also be a device used in combination with the homomorphic decryption party device. If the first device performs homomorphic calculation (or homomorphic evaluation) based on the ciphertext modulus, the first device may be a homomorphic calculation party device, or the first device may be executed by a component (module, chip, etc.) of the homomorphic calculation party device, and the first device may also be a device used in combination with the homomorphic calculation party corresponding to it. The present application does not make specific limitations on the form and quantity of the execution subject. In this article, the first device is used to represent the execution subject to introduce the solution.

[0361] In a possible implementation, when the first device performs homomorphic encryption based on the ciphertext modulus, it may include: performing homomorphic encryption on the information to be processed based on the ciphertext modulus to obtain a first ciphertext; and then performing blind rotation processing on the first ciphertext based on an optimized number theoretic transform NTT processing and decomposition method to obtain a second ciphertext.

[0362] In the embodiments of the present application, Figure 6B If the solution shown is applied to the scenario of homomorphic encryption, then the first device may be a homomorphic encryption party device, or a component (such as a module or chip, etc.) corresponding to the encryption party device, and may also be a device used in combination with the homomorphic encryption party device.

[0363] In a possible implementation, when the first device performs homomorphic encryption based on the ciphertext modulus, it includes: performing homomorphic encryption on the second ciphertext component of the initial input ciphertext based on the ciphertext modulus to obtain a first ciphertext; the first ciphertext is an RLWE ciphertext; where the initial input ciphertext includes a first ciphertext component and a second ciphertext component, the first ciphertext component includes N items; N is an integer greater than 1; and then performing a blind rotation process on the first ciphertext based on an optimized number-theoretic transform NTT processing and decomposition method to obtain a second ciphertext.

[0364] Exemplarily, the initial input ciphertext is represented as The second ciphertext component of the initial input ciphertext is represented as -b. The first ciphertext is represented as The second ciphertext is represented as

[0365] In the embodiments of the present application, the first device performs a blind rotation process on the first ciphertext based on an optimized number-theoretic transform NTT processing and decomposition algorithm to obtain a second ciphertext, which may include but is not limited to the following implementation manners:

[0366] Implementation manner one: The first device iteratively executes N blind rotation sub-operations based on the optimized number-theoretic transform NTT processing and decomposition method and the first ciphertext to obtain a second ciphertext; N is an integer greater than 1; where each blind rotation sub-operation is executed based on the result or output ciphertext of the previous blind rotation sub-operation;

[0367] Where, when performing the i-th blind rotation sub-operation, i ∈ [1, N]; the i-th blind rotation sub-operation is associated or corresponding to the i-th item a i of the first ciphertext component of the initial input ciphertext and the i-th key component s i of the initial input ciphertext, and may include the following:

[0368] First, decompose the current ciphertext using a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts are in one-to-one correspondence with d different prime numbers; where the j-th third ciphertext includes a ciphertext component obtained by decomposing based on the modulus Q j and a ciphertext component obtained by decomposing based on another modulus Q k , Q k ≠Q j , j, k ∈ [1, d]; the current ciphertext is the initial input ciphertext (i.e., the first ciphertext) or the output ciphertext of the previous blind rotation sub-operation;

[0369] Then, use the d third ciphertexts as the initial values of the d accumulators; perform optimized Number Theoretic Transform (NTT) processing on the initial values of the d accumulators respectively to obtain the transformed values of the d accumulators; the optimized NTT includes a modulo operation, and the modulo operation may include shift processing and / or logical operation processing; wherein, in the modulo operation included in the NTT processing of the initial value of the j-th accumulator, the number of bits shifted in the shift processing is related to the exponent of n powers of 2 in the corresponding j-th prime modulus Q j and the number of times of the logical operation processing is related to the value of the number of terms n of the power of 2 of the j-th prime modulus Q j ;

[0370] Secondly, based on the transformed values of the d accumulators, perform corresponding outer product and accumulation processing respectively to obtain the outer product values of the d accumulators;

[0371] Furthermore, perform INTT processing on the outer product values of the d accumulators respectively to obtain the updated values of the d accumulations;

[0372] Then, use the inverse transform of the decomposition method to process the updated values of the d accumulators to obtain the output ciphertext; the output ciphertext is used for the next blind rotation sub-operation.

[0373] After performing the above N blind rotation sub-operations, use the output ciphertext of the last blind rotation sub-operation as the second ciphertext.

[0374] Exemplarily, for the above implementation manner 1: The first device iteratively performs N blind rotation sub-operations based on the optimized Number Theoretic Transform (NTT) processing and the decomposition method, and the first ciphertext, to obtain the second ciphertext, which may include the following steps:

[0375] Step 1: Use the decomposition method to decompose the first ciphertext to obtain d third ciphertexts; the moduli of the d third ciphertexts correspond to d prime numbers one by one and are equal. The j-th third ciphertext includes ciphertext components decomposed based on the modulus Q j and ciphertext components decomposed based on other moduli Q k where Q k ≠Q j , j,k ∈ [1,d] (j,k are integers, and the value range of j,k is from 1 to d, and includes 1 and d).

[0376] Exemplarily, the above decomposition method may be Residue Number System (RNS) decomposition, or digital decomposition, or gadget decomposition, etc.

[0377] Step 2: Perform optimized Number Theoretic Transform (NTT) processing on the d third ciphertexts respectively to obtain d transformed fourth ciphertexts.

[0378] In the embodiment of the present application, the optimized number-theoretic transform (NTT) processing includes a modulo operation, and the modulo operation may include shift processing and / or logical operation processing; wherein, in the modulo operation included in the NTT processing of the j-th third ciphertext, the number of bits shifted in the shift processing is related to the exponent of n powers of 2 in the corresponding j-th prime modulus Q j and the number of times of logical operation processing is related to the value of the number of terms n of powers of 2 in the j-th prime modulus Q j of the powers of 2

[0379] Step Three: Based on the d transformed fourth ciphertexts, respectively perform corresponding outer product and accumulation processing to obtain d fifth ciphertexts

[0380] In a possible implementation manner, the first device obtains d first bootstrapping keys, and the d first bootstrapping keys respectively satisfy the RGSW ciphertext form; the d first bootstrapping keys are key components corresponding to the d bootstrapping keys, and the moduli of the d bootstrapping ciphertexts are respectively equal to d different prime numbers one by one. When performing Step Three, it may include: performing outer product and accumulation processing based on the d transformed fourth ciphertexts and the d first bootstrapping keys to obtain d fifth ciphertexts

[0381] Step Four: Respectively perform inverse number-theoretic transform (INTT) processing on the d fifth ciphertexts to obtain d sixth ciphertexts

[0382] Step Five: Process the d sixth ciphertexts through the inverse transform of the decomposition method (such as ICRT) to obtain seventh ciphertexts

[0383] The above Steps One to Five can be used as the process of a blind rotation sub-operation (which can be called the i = 1st blind rotation sub-operation). If the initial input ciphertext is represented as c the i-th blind rotation sub-operation is associated or corresponding to the i-th term a i of the first ciphertext component a of the initial input ciphertext and the i-th key component s i of the initial input ciphertext

[0384] Step Six: Use the seventh ciphertext as the new input ciphertext (equivalent to the first ciphertext) in Step One of the next blind rotation sub-operation; iteratively execute the above Steps One to Five N - 1 times, where N is an integer greater than 1. Use the seventh ciphertext obtained in Step Five of the last blind rotation sub-operation (which can be called the i = Nth blind rotation sub-operation) as the second ciphertext

[0385] Implementation Manner Two: The first device uses the decomposition method to decompose the current first ciphertext to obtain d third ciphertexts; the moduli of the d third ciphertexts are respectively equal to d different prime numbers one by one; wherein, the j-th third ciphertext includes ciphertext components decomposed based on the modulus Q j and ciphertext components decomposed based on other moduli Qk The ciphertext component obtained by decomposition, Q k ≠Q j , j, k ∈ [1, d]; then perform optimized NTT processing on the d third ciphertexts respectively to obtain d fourth ciphertexts; secondly, use the d fourth ciphertexts as the initial values of d accumulators; based on the initial values of the d accumulators, perform N - 1 times of CMUX gate processing and ciphertext combination processing to obtain the updated values of the d accumulators; N is an integer greater than 1; each CMUX gate processing and ciphertext combination processing is performed based on the result or output ciphertext of the previous CMUX gate processing and ciphertext combination processing; further, perform a CMUX gate processing and inverse number theory transform INTT processing on the updated values of the d accumulators respectively to obtain d target ciphertexts; finally, based on the d target ciphertexts, obtain the second ciphertext through the inverse method of the decomposition method.

[0386] In a possible implementation manner, the first device performs N - 1 times of CMUX gate processing and ciphertext combination processing based on the initial values of d accumulators to obtain the updated values of the d accumulators, including:

[0387] Perform the i-th CMUX gate processing and ciphertext combination processing, and the i-th CMUX gate processing and ciphertext combination processing is associated or corresponding to the i-th item a i of the first ciphertext component of the initial input ciphertext and the i-th key component s i of the initial input ciphertext, i ∈ [1, N - 1], and may include the following:

[0388] First, based on the initial values of the current d accumulators, perform corresponding outer product and accumulation processing respectively to obtain the outer product values of the d accumulators.

[0389] Then, based on the outer product values of the current d accumulators, determine d combined ciphertexts; among them, based on the outer product value of the j-th accumulator (any one of the d accumulators), determining the j-th combined ciphertext includes: rearranging and combining the outer product value of the j-th accumulator and the ciphertext component of the k-th accumulator to obtain the j-th combined ciphertext, and the ciphertext component of the k-th accumulator is obtained after performing INTT modulo Qk and NTT modulo Q j on the outer product value of the k-th accumulator, k ≠ j; the d combined ciphertexts are used for the next CMUX gate processing and ciphertext combination processing.

[0390] Exemplarily, for the above implementation manner two, the first device performs blind rotation processing on the first ciphertext based on optimized NTT processing and decomposition algorithm to obtain the second ciphertext, which may include the following steps:

[0391] Step 1: The first device decomposes the first ciphertext using a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts are in one-to-one correspondence with d different prime numbers. The j-th third ciphertext includes a ciphertext component obtained based on the modulus Q j and other ciphertext components obtained based on moduli Qk≠Q j other than Q; j, k ∈ [1, d] (j and k are integers, and the value ranges of j and k are from 1 to d and include 1 and d). j Step 2: The first device performs optimized number-theoretic transform (NTT) processing on the d third ciphertexts respectively to obtain d transformed fourth ciphertexts.

[0392] In the embodiments of the present application, the optimized NTT processing includes a modulo operation, and the modulo operation may include shift processing and / or logical operation processing; among them, in the modulo operation included in the NTT processing of the j-th third ciphertext, the number of bits shifted in the shift processing is related to the exponent of n powers of 2 in the corresponding j-th prime modulus Q

[0393] and the number of times of logical operation processing is related to the value of the number of terms n of powers of 2 of the j-th prime modulus Q j j j j

[0394] Step 3: The first device performs corresponding outer product and accumulation processing based on the d transformed fourth ciphertexts respectively to obtain d fifth ciphertexts (equivalent to the outer product values of the above d accumulators).

[0395] In a possible implementation manner, the first device obtains d first bootstrapping keys, and the d first bootstrapping keys respectively satisfy the RGSW ciphertext form; the d first bootstrapping keys are key components corresponding to the d bootstrapping keys, and the moduli of the d bootstrapping ciphertexts are in one-to-one correspondence with d different prime numbers. When performing Step 3, it may include: performing outer product and accumulation processing based on the d transformed fourth ciphertexts and the d first bootstrapping keys to obtain d fifth ciphertexts.

[0396] Step 4: The first device obtains corresponding d sixth ciphertexts (equivalent to the above d combined ciphertexts) based on the d fifth ciphertexts (equivalent to the outer product values of the above d accumulators).

[0397] In a possible implementation manner, in this Step 4, for the j-th fifth ciphertext, to obtain the corresponding j-th sixth ciphertext, it may include: performing INTT with modulus Qk and NTT calculation with modulus Q j on the k-th (k≠j) fifth ciphertext to obtain the corresponding first ciphertext component; and then rearranging and combining the j-th fifth ciphertext and the first ciphertext component to obtain the j-th sixth ciphertext.

[0398] Further, use the d sixth ciphertexts as the new input ciphertexts (equivalent to the fourth ciphertext in Step 3); iteratively execute the above Step 3 to Step 4 for N - 2 times to obtain the updated values of the d accumulators; N is an integer greater than 1.

[0399] Step 5: Perform a CMUX gate process and an inverse number theory transform INTT process on the updated values of the d accumulators respectively to obtain d target ciphertexts.

[0400] Step 6: Based on the d target ciphertexts, the first device obtains the second ciphertext through the inverse transform (such as ICRT) of the decomposition method.

[0401] Compared with the above implementation method 1, in implementation method 2, the sixth ciphertext is not obtained by performing a complete decomposition operation, but directly stores the fifth ciphertext with the modulus Q j in Step 3, and rearranges and combines it with the first ciphertext components corresponding to other moduli to obtain the corresponding sixth ciphertext. Therefore, for the d sixth ciphertexts, a total of d * 2 NTT or INTT calculation times can be saved. For the process of obtaining the first ciphertext components, a combined single function can also be used to implement two or more consecutive NTT or INTT transforms.

[0402] In summary, the embodiments of the present application provide a data processing method, which includes: the first device determines the ciphertext modulus of homomorphic encryption; the ciphertext modulus is a composite number obtained by multiplying d different prime numbers, where each prime number is obtained by accumulating the product of n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5, and d is an integer greater than 1; then perform homomorphic processing based on the ciphertext modulus, and the homomorphic processing includes at least one of homomorphic encryption, homomorphic decryption, and homomorphic calculation. Generally, operations such as homomorphic encryption, homomorphic decryption, and homomorphic calculation all involve modulo operations or modulo arithmetic. Usually, the method of modulo operation or modulo arithmetic may be to directly perform vertical calculation to obtain the result. However, when the divisor and dividend of the modulo operation are relatively large, it is obviously difficult to use the vertical calculation of division to obtain the result. In this regard, the present application designs a modulus, which is a composite number obtained by multiplying d different prime numbers, and each prime number is obtained by accumulating the product of n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5. In application, the modulus of the composite number can be first decomposed to obtain the moduli of d different prime numbers, and then the modulo operation / arithmetic is performed based on the moduli of the d different prime numbers. Similarly to the above method, the modulo efficiency will be higher, so that the processing efficiency of homomorphic encryption, homomorphic decryption, and homomorphic calculation including modulo operation / modulo arithmetic can be improved.

[0403] V. Introduction to Specific Embodiments:

[0404] Based on the aboveFigure 6A and Figure 6B A data processing method as described above will be introduced in detail through several specific embodiments below.

[0405] Embodiment 1:

[0406] In this Embodiment 1, based on the above Figure 6A scheme, in homomorphic encryption, a prime modulus is used to implement encryption and other processes, and a modulo operation / modulo arithmetic is designed as follows:

[0407] In one possible implementation, the ciphertext modulus Q is set in the form of a Solinas prime: where k1 > k2 > 0, and k1 and k2 are integers.

[0408] In another possible implementation: the ciphertext modulus Q is set in the form of a Mersenne prime: k1 > 0, and k1 is an integer.

[0409] For example, referring to Figure 7A as shown, if in the process of fully homomorphic encryption, the modulus Q is set as a Solinas prime or the modulus is set to Based on this or the modulus Q of this form is used to perform homomorphic encryption processing on the information to be encrypted to obtain the ciphertext.

[0410] In this Embodiment 1, taking the modulus as an example, calculate the modulo r = a mod Q. The present application designs a modulo operation / modulo arithmetic, and this modulo operation / modulo arithmetic can be implemented through simple shift operations and logical operations.

[0411] Example 1, for the modulus design a modulo operation / modulo arithmetic, including the following steps:

[0412] 1: t is an integer; after shifting a to the right by k1 bits and then rounding down, the first quotient value of a relative to is obtained.

[0413] 2: u is an integer; determine the first remainder of a relative to .

[0414] 3: u = u - t; subtract the first quotient value in step 2 from the first remainder in step 2.

[0415] 4: Shift t to the left by k2, and then subtract it from u.

[0416] For example, Q = 37 = 100101 = 2 5 + 2 2 + 1, a = 40; r = a mod Q = 40 mod 37 = 3; The modulo operation designed by the embodiment of the present application is as follows:

[0417] 1:

[0418] 2: u = 40 mod 2 5 = 8;

[0419] 3: u = u - t = 8 - 1 = 7;

[0420] 4: r = 7 - 1·2 2 = 3.

[0421] Example 2, for the modulus A modulo operation / modulo operation designed includes the following steps:

[0422] Step 1: t is an integer; after shifting a to the right by k1 bits and then rounding down, the first quotient value of a relative to is obtained.

[0423] Step 2: u is an integer; determine the first remainder of a relative to is obtained.

[0424] Step 3: u = u - t; subtract the first quotient value in Step 1 from the first remainder in Step 2.

[0425] Step 4: Shift t to the left by k2 and then add it to u.

[0426] For example, Figure 7B shows an algorithm for a modulo operation when the ciphertext modulus Q = 2 29 - 2 18 + 1 = 536608769. Refer to Figure 7B shown, input a coefficient a, - 2 31 ≤ a ≤ 2 31 ; Refer to the modulo operation method in Example 2 above, and output the modulo result r, where r satisfies - 2 31 + 4Q ≤ r ≤ 2 31 - 3Q.

[0427] In the first embodiment, the ciphertext modulus Q is set to form or form. Based on such a special form of modulus, an efficient modulo operation / operation can be designed, that is, the modulo result can be obtained through simple shift operations and logical operations.

[0428] Example 2:

[0429] In this Example 2, in order to improve the efficiency of NTT processing in blind rotation, the ciphertext modulus and the modulo operation / modulo arithmetic designed in the above Example 1 are applied to NTT. That is, in blind rotation, the RLWE ciphertext modulus Q is set to a Solinas prime number in the form of, and the modulo operation / modulo arithmetic designed in the embodiment of the present application is used.

[0430] Exemplarily, when using a 29-bit prime number as the ciphertext modulus and performing blind rotation processing based on NTT, the following is included:

[0431] For example, if the ciphertext modulus is a prime number 536608769, this prime number can be written as 2 29 -2 18 +1 form.

[0432] In a possible implementation, the blind rotation processing based on NTT includes NTT calculation, and the NTT calculation includes M butterfly operations, where M is an integer greater than or equal to 3. When performing NTT calculation in the embodiment of the present application, it includes:

[0433] 1. After every three butterfly operations, the modulo operation / modulo arithmetic shown in the above Example 1 is used to perform a modulo operation on the result of the butterfly operation.

[0434] Since each butterfly operation includes one addition and subtraction, it is equivalent to performing the above-mentioned Figure 7B algorithm on the calculation result of these three additions and subtractions every three additions and subtractions. That is, by Figure 7B the modulo algorithm shown, the modulo reduction of the addition and subtraction is performed, and the calculation result of these three additions and subtractions is modulo-reduced with respect to a prime modulus in the form of . For example, r = a mod Q, where a is the calculation result of the addition and subtraction, and the modulus Q is a prime number in the form of.

[0435] 2. In each butterfly operation, for the result after each multiplication operation, the Montgomery algorithm is used for modulo operation, that is, after each multiplication of the unit root *x[n], the Montgomery algorithm is used to find the modulus. The Montgomery algorithm can specifically refer to the Montgomery algorithm process shown in the above-mentioned Prior Art 5.

[0436] According to the above Figure 7BThe output range of the algorithm is clearly visible. Before performing modulo reduction on the sum or difference of the addition and subtraction results, the output of this algorithm can continue to be added or subtracted from the output of the Montgomery algorithm for the three - stage butterfly operation.

[0437] In the embodiments of the present application, for a signed integer a within 32 bits, the Figure 7B algorithm shown is used to perform a modulo operation (a mod Q) on a, and the resulting modulo r satisfies - 2 31 + 4Q ≤ r < 2 31 - 3Q.

[0438] Next, verify that the result r of the modulo operation designed in the embodiments of the present application satisfies: - 2 31 + 4Q ≤ r < 2 31 - 3Q.

[0439] For a signed integer a with a 32 - bit word length, the integer t is the quotient, and the integer u is the remainder. There is t ∈ [- 4, 3] ∩ Z, and u ∈ [0, 2 29 - 1] ∩ Z. Therefore, a can be expressed in terms of t and u, that is, a = t·2 29 + u. Since Q = 2 29 - 2 18 + 1, 2 29 ≡ 2 18 - 1 mod Q. Therefore, the following relationship exists for the modulus Q:

[0440] a = t·2 29 + u = t·(2 18 - 1)+ u = r mod Q;

[0441] According to t ∈ [- 4, 3], u ∈ [0, 2 29 - 1], and the above formula, the range of r output by the algorithm shown in Figure 7B can be obtained as:

[0442] - 4·(2 18 - 1)+ 0 ≤ r ≤ 3·(2 18 - 1)+ 2 29 - 1; further:

[0443] - 2 31 + 4Q = - 4·(2 18 - 1)+ 0 ≤ r ≤ 3·(2 18 - 1)+ 2 29 - 1 < 2 31 - 3Q.

[0444] For 3·(2 18 - 1)+ 2 29-1 < 2 31 -3Q, the proof is as follows:

[0445] Since Q = 2 29 -2 18 +1, then 2 18 -1 = 2 29 -Q, furthermore:

[0446] 3(2 18 -1) + 2 29 -1 = 3(2 29 -Q) + 2 29 -1

[0447] = 3 * 2 29 -3Q + 2 29 -1

[0448] =(2 2 -1) * 2 29 -3Q + 2 29 -1

[0449] = 2 31 -3Q - 1;

[0450] Therefore, 3(2 18 -1) + 2 29 -1 < 2 31 -3Q.

[0451] In the second embodiment, in the NTT, the special reduction method (simple shift and logical operations) shown in Figure 7B and the Montgomery reduction with lazy reduction idea in the NTT (that is, after three butterfly calculations / butterfly operations, the method shown in the embodiment of the present application Figure 7B is used for one modular operation) are used to optimize the NTT processing in the blind rotation, so as to effectively reduce the execution time of the outer product in the blind rotation, and further improve the overall processing efficiency of the blind rotation or the bootstrap.

[0452] Embodiment Three:

[0453] In the third embodiment, based on the above Figure 6B described solution, in the process of the bootstrap of the homomorphic encryption, a composite number is used as the ciphertext modulus Q, that is where Q j can be a Solinas prime number of the form or different prime numbers of the form , and Q j are relatively prime to each other; j is an integer, and the value range is: 1 ≤ j ≤ d R .

[0454] In a possible implementation, referring to Figure 8A the process shown, if it is the bootstrapping process of fully homomorphic encryption, then set the modulus Q of the bootstrapped ciphertext RLWE to a composite number Q j is a prime number of the form or a prime number of the form

[0455] In a possible implementation, in the bootstrapping process of homomorphic encryption, the RNS decomposition technique and NTT can be applied to control the noise growth, thereby improving the processing efficiency of blind rotation in the bootstrapping process. For example, for a modulus directly represented within 64 bits, first use the RNS decomposition technique to decompose the modulus into several prime numbers not exceeding 32 bits, and then perform parallel NTT-based outer product calculations based on the modulus decomposed by RNS.

[0456] Exemplarily, in homomorphic encryption processing, a composite number satisfying is selected as the modulus (such as a modulus represented within 64 bits) to encrypt the information to be encrypted, where Q j is a Solinas prime number of the form within 32 bits or a prime number of the form prime number. Further, referring to Figure 8B the process shown, determine whether the current is the bootstrapping process of performing fully homomorphic encryption. If so, continue to determine whether the ciphertext modulus is greater than 32 bits. If the ciphertext modulus is a prime number greater than 32 bits, perform blind rotation processing based on the optimized NTT and RNS decomposition techniques.

[0457] The following is a corresponding introduction to the blind rotation processing based on the optimized NTT and RNS decomposition techniques:

[0458] The blind rotation processing based on the optimized NTT and RNS decomposition techniques includes the following steps:

[0459] Step 1: Decompose an RLWE ciphertext on the ring R Q into d R ciphertexts respectively in using the RNS decomposition technique.

[0460] That is, in Step 1, use the RNS decomposition technique to decompose the RLWE ciphertext with modulus Q into d R ciphertexts. The moduli of these d R ciphertexts are respectively: These d R ciphertexts all have moduli that are prime numbers within 32 bits.

[0461] Step 2: Respectively for dR Perform NTT processing on the ciphertexts.

[0462] Use optimized NTT execution in the outer product, so it is necessary to perform NTT transformation on d R ciphertexts.

[0463] In addition, in the optimized NTT processing, use the modulo operation / modulo arithmetic as described in Embodiment 1, that is, for a signed integer a within 32 bits, the modulo can be completed through simple shift and logical operations.

[0464] Step 3: Perform the outer product and accumulation between the RLWE ciphertext and the bootstrapping key (satisfying the form of the RGSW ciphertext) on each ring.

[0465] Step 4: Perform INTT processing on the result of the outer product and accumulation.

[0466] For example, if d R = 2, in each outer product calculation process, according to the cancellation principle of consecutive NTT and INTT transformations, and using a combined single function to implement two consecutive NTT or INTT conversions, 4 NTT calculations can be reduced.

[0467] Regarding the outer product operation involved in Step 3, taking d R = 2 as an example, introduce the outer product operation in the blind rotation based on RNS decomposition.

[0468] An RLWE ciphertext ct = (a, b) ∈ RLWE sk,Q (μ), define the 2 RLWE ciphertexts obtained by RNS decomposing the RLWE ciphertext ct as and and The results of the corresponding RNS decomposition and complement respectively can be expressed as:

[0469]

[0470]

[0471] For the RLWE ciphertext and which are the results of the complement of other moduli, and are the results of the RNS decomposition based on the modulus Q1. For the RLWE ciphertext and which are the results of the complement of other moduli, and Is the result of the RNS decomposition based on the modulus Q2.

[0472] The bootstrapping key commonly used in blind rotation is in the form of an RGSW ciphertext. The RGSW ciphertext is stored with moduli Q1 and Q2 as and is the gadget matrix. The RGSW ciphertext can be expressed as:

[0473]

[0474]

[0475] Define the RLWE ciphertext ct = (a, b) ∈ RLWE on each ring sk,Q (μ) and the RGSW ciphertext CT ∈ RGSW sk,Q (m) The RNS-based outer product between them is expressed as:

[0476] Furthermore, ICRT processing can be used on the outer product result to recover the outer product result on the original modulus Q:

[0477]

[0478] Based on the blind rotation processing scheme proposed above based on optimized NTT and RNS decomposition techniques, the GINX blind rotation based on RNS decomposition will be introduced in detail below.

[0479] See Figure 8C In the algorithm shown, the bootstrapping keys used for blind rotation are bsk1 ∈ {RGSW sk,Q (si) mod Q1} and bsk2 ∈ {RGSW sk,Q (s i ) mod Q2}, i = 0, ···, n - 1, and blind rotation is performed using RNS decomposition.

[0480] Input an LWE ciphertext c = (a, b), where and two sets of bootstrapping keys bsk1 and bsk2; output an RLWE ciphertext

[0481] See Figure 8C shown, Figure 8C The analysis of the algorithm shown is as follows:

[0482] Lines 1 - 2: Set two accumulators acc1 and acc2.

[0483] The forms of acc1 and acc2 are as follows:

[0484]

[0485]

[0486] Lines 3 - 4: Set the input ciphertexts ct1 and ct2 of the two outer products.

[0487] The forms of ct1 and ct2 are as follows:

[0488]

[0489]

[0490] Since the ciphertext includes n (N) components ai, n (N) outer product operations and update accumulator values need to be performed.

[0491] Lines 5 - 6: Perform the first outer product operation on accumulators acc1 and acc2 respectively and update the values of acc1 and acc2.

[0492] The outer product operations and update accumulator values respectively performed on acc1 and acc2 satisfy the following equations:

[0493] Update Formula 1

[0494] Update Formula 2

[0495] Lines 7 - 11: According to the values of the accumulators acc1 and acc2 updated by the above first outer product, continue to perform the remaining n - 1 outer product operations and update the accumulator values.

[0496] Specifically, the following steps are looped n - 1 times for accumulators acc1 and acc2 respectively:

[0497] Step 1: The accumulator acc1 obtains the value of ct1 through the decomposition operation shown in Formula 3 (as the input value of the outer product ct1 in Formula 1 of the following Step 2), and the accumulator acc2 obtains the value of ct2 through the decomposition operation shown in Formula 4 (as the input value of the outer product ct2 in Formula 2 of the following Step 2):

[0498] Update Formula 3

[0499] Update Formula 4

[0500] Step 2: acc1 performs an outer product operation through Formula 1 and updates the value of acc1, and acc2 performs an outer product operation through Formula 2 and updates the value of acc2.

[0501] Update Formula 1

[0502] Update Formula 2

[0503] The values of acc1 and acc2 obtained from each outer product operation and update are used in the next outer product operation and the process of updating the accumulator value. For example, the values of acc1 and acc2 obtained from the update in the current step 2 are used as the values of acc1 and acc2 in step 1 of the next outer product operation.

[0504] Exemplarily, by performing the outer product and update through the above step 1 to obtain acc1 and acc2, they are actually two RLWE ciphertexts stored in NTT form and Input and into the next outer product process. Usually in the next outer product process, first these two NTT-form and are transformed back to the coefficient representation through the INTT transform. Then, through the above Formulas 3 and 4, and ct2 Furthermore, the outer product results are obtained through Formulas 1 and 2 in step 2 and In the outer product operations of Formulas 1 and 2, both acc and ct are performed in NTT form.

[0505] Regarding the decomposition function in the above step 1 A corresponding introduction is as follows:

[0506] The embodiments of the present application define a new decomposition function for obtaining the ciphertext input in the outer product operation. This new decomposition function includes NTT, INTT, and RNS decomposition.

[0507] Exemplarily, taking the above step 1 as an example, the decomposition functions used to obtain ct1 and ct2 are expressed as and For use in decomposing the ciphertext (such as acc1 in Formulas 3 and 4) and (such as acc2 in Formulas 3 and 4). The decomposition function includes NTT, INTT, and RNS decomposition. For the NTT-form ciphertext and Its decomposition function can be specifically expressed as the following formula:

[0508]

[0509]

[0510] For the above decomposition operation when calculating the RNS decomposition and complement of the ciphertext modulus Q k it is only necessary to perform NTT and INTT on the ciphertexts of other moduli that are not Q k while the ciphertext with modulus Q k is directly stored. Therefore, compared with directly calculating the outer product on each RNS ring, this method can reduce the total number of NTT or INTT operations. In addition, the present application designs a new decomposition function, which is essentially a combined function including NTT and INTT processing. Therefore, for two ciphertexts, two consecutive INTT transforms and NTT transforms can be realized. That is, in the algorithm implementation or program implementation, by calling the new decomposition function of the embodiment of the present application, INTT and INTT can be realized at one time, and it is not necessary to call two functions (i.e., the function for realizing INTT and the function for realizing NTT), which can save the time for calling functions.

[0511] Next, two implementation methods based on RNN decomposition and blind rotation in the solution of the embodiment of the present application Figure 6B will be introduced in detail and compared.

[0512] Implementation method 1: Taking the first ciphertext as an RLWE ciphertext as an example Figure 8D shows a process of direct RNS decomposition and blind rotation processing, as Figure 8D shown, including the following steps:

[0513] Step 1: An RLWE ciphertext ct = (a, b), and the modulus of this RLWE ciphertext is Q = Q1 * Q2; this RLWE ciphertext is processed by RNS decomposition to obtain the RNS decomposition result and complement (RNS&complement), that is Figure 8D in and

[0514] It can be seen that it includes a ciphertext component with modulus Q1 and a ciphertext component related to the complementary modulus Q2 of Q1.

[0515] It can be seen that it includes a ciphertext component with modulus Q2 and a ciphertext component related to the complementary modulus Q1 of Q2.

[0516] Step 2: Perform NTT processing on and respectively to obtain and

[0517] The modulo operation (including shift processing and logical operations) in the embodiments of the present application is included in the NTT processing, that is In the modulo operation included in the NTT processing of, the number of bits shifted in the shift processing is related to the exponent of n powers of 2 in the corresponding modulus Q1, and the number of times of logical operation processing is related to the value of the number of terms n of the power of 2 in Q1; In the modulo operation included in the NTT processing of, the number of bits shifted in the shift processing is related to the exponent of n powers of 2 in the corresponding modulus Q2, and the number of times of logical operation processing is related to the value of the number of terms n of the power of 2 in Q2.

[0518] Step three: Based on and Perform corresponding outer product and accumulation and other processing respectively to obtain the results of the corresponding processing, that is and

[0519] Step four: Perform INTT processing on the results of the processing ( and ) respectively to obtain and

[0520] Step five: Take and As the new input, repeat the above steps one to four N - 1 times.

[0521] After performing INTT processing on the results obtained from the last (i = n - 1) outer product and accumulation processing respectively, and Based on and Perform the following step six.

[0522] Step six: Based on and Obtain the final result ct = ([a] Q ,[b]Q) through the ICRT method.

[0523] Implementation method two: Taking the first ciphertext as an RLWE ciphertext as an example, Figure 8E Shows a process that can save the RNS decomposition and blind rotation processing of NTT and INTT, as Figure 8E Shown, including the following steps:

[0524] Step one: An RLWE ciphertext ct = (a, b), the modulus of this RLWE ciphertext is Q = Q1 * Q2; this RLWE ciphertext is processed by RNS decomposition to obtain the RNS decomposition result and complement (RNS&complement), that is Figure 8D in and

[0525] It can be seen that includes a ciphertext component with a modulus of Q1 and a ciphertext component related to the complementary modulus Q2 of Q1.

[0526] It can be seen that includes a ciphertext component with a modulus of Q2 and a ciphertext component related to the complementary modulus Q1 of Q2.

[0527] Step 2: Perform NTT processing on and respectively to obtain and

[0528] The NTT processing includes the modular operation (including shift processing and logical operations) in the embodiments of the present application, that is In the NTT processing of, the number of bits shifted in the shift processing is related to the exponent of n powers of 2 in the corresponding modulus Q1, and the number of times of logical operation processing is related to the value of the number of terms n of the power of 2 of Q1; In the NTT processing of, the number of bits shifted in the shift processing is related to the exponent of n powers of 2 in the corresponding modulus Q2, and the number of times of logical operation processing is related to the value of the number of terms n of the power of 2 of Q2.

[0529] Step 3: Based on and perform the corresponding outer product and accumulation processing respectively to obtain the results of the corresponding processing, that is and

[0530]

[0531]

[0532] Step 4: Concatenate and combine and to obtain (It can also be implemented by the combined single function (see the process indicated by the bold black line in the upper left of Figure 8E ). And concatenate and combine and to obtain (It can also be implemented by the combined single function (see the process indicated by the bold dashed line in the upper right of Figure 8E ).

[0533] Among them, is obtained by performing processing and processing. is obtained by performing processing and processing.

[0534] Taking the and obtained in Step Four as the new input, repeat Steps Three and Four above N - 2 times. That is, in each iteration, the result obtained in the fourth step is used as the input for the third step in the next iteration. The i - th cycle is associated with or corresponds to the i - th term of the first ciphertext component of the initial input ciphertext and the i - th key component of the initial input ciphertext.

[0535] Step Five: After the above N - 2 times, based on the and obtained by splicing and combining in Step Four, perform the corresponding outer product and accumulation processing respectively to obtain the results and of the corresponding processing, that is, perform the last outer product and accumulation processing.

[0536] Step Six: For the results and after the last outer product and accumulation processing, perform the INTT processing respectively to obtain and

[0537] Step Seven: Based on and obtain the final result ct = ([a] Q ,[b] Q ) through the ICRT method.

[0538] Compared with Figure 8D the implementation method one shown, in implementation method two, instead of obtaining the input for the outer product and accumulation processing by performing a complete decomposition operation, a ciphertext with modulus Q1 is directly stored and concatenated with (that is, an example of the first ciphertext component in the above Figure 6B scheme) to obtain Therefore, 2 consecutive NTT or INTT calculation times can be saved. Similarly, a ciphertext with modulus Q2 is directly stored and concatenated with to obtain Therefore, 2 consecutive NTT or INTT can also be saved. Compared with Figure 8D the shown process, it can be seen that Figure 8EThe second implementation shown can save a total of 4 NTTs or INTTs.

[0539] Therefore, if d ciphertexts obtained by decomposing RLWE ciphertexts (the d sixth ciphertexts in the above Figure 6B described scheme) are executed using the second implementation described above, a total of d * 2 NTT or INTT calculation times can be saved.

[0540] In the third embodiment, during the RNS decomposition stage, the number of NTTs does not decrease. However, compared to the blind rotation using digital decomposition, the embodiment of the present application uses a smaller amount of data (smaller modulus), the degree of parallel execution is increased, and the operation efficiency can also be improved. In addition, a combined processing method or a new decomposition function is designed to save the NTT results, which can avoid performing INTT and NTT operations on all polynomials in each outer product loop.

[0541] Embodiment Four:

[0542] In this fourth embodiment, the keys, parameters, and performance analysis involved in the embodiment of the present application are introduced in detail.

[0543] Figure 9 A homomorphic computing scenario diagram to which the method of the embodiment of the present application can be applied is shown, as well as the interaction process of keys and parameters in this homomorphic computing scenario. The specific process may include the following:

[0544] Step 1: The homomorphic key generation party generates the homomorphic key and homomorphic scheme parameters for the homomorphic task.

[0545] The homomorphic scheme parameters may include: the dimension of LWE at each level, the ciphertext modulus Q, the basis of the gadget decomposition during the outer product operation in bootstrapping, the length of the gadget decomposition during the outer product operation, and the basis of the gadget decomposition during key switching, the length of the gadget decomposition during key switching, etc.

[0546] Among them, the ciphertext modulus Q may be the prime modulus obtained by accumulating the products of n different powers of 2 and coefficients, or the composite modulus obtained by multiplying d different prime numbers, where each prime number is obtained by accumulating the products of n different powers of 2 and coefficients.

[0547] The homomorphic key may include: the homomorphic encryption key, the homomorphic decryption key, the homomorphic computing key (including but not limited to the scheme switching key, the key switching key, the bootstrapping key, the automorphism key, the auxiliary key), etc.

[0548] Step 2: The homomorphic key generation party A broadcasts the homomorphic scheme parameters to the homomorphic encryption party B, the homomorphic computing party C, and the homomorphic decryption party D. Additionally, the homomorphic key generation party A also distributes the homomorphic encryption key to the homomorphic encryption party B, the homomorphic computing key to the homomorphic computing party C, and the homomorphic decryption key to the homomorphic decryption party D.

[0549] Step 3: After the homomorphic encryption party B performs homomorphic encryption on the plaintext data based on the homomorphic scheme parameters and the homomorphic encryption key to obtain the homomorphic ciphertext, it then sends the homomorphic ciphertext to the homomorphic computing party C.

[0550] Step 4: The homomorphic computing party C performs homomorphic computation on the homomorphic ciphertext according to the homomorphic scheme parameters, the homomorphic computing key, and the homomorphic ciphertext, and sends the ciphertext of the homomorphic computation result to the homomorphic decryption party D.

[0551] Step 5: The homomorphic decryption party D performs the homomorphic decryption algorithm on the ciphertext of the homomorphic computation result according to the homomorphic scheme parameters and the homomorphic decryption key to obtain the plaintext result.

[0552] Optionally, the homomorphic decryption party D may also directly obtain the homomorphic ciphertext from the homomorphic encryption party B, and then perform the homomorphic decryption algorithm on the homomorphic ciphertext according to the homomorphic decryption key to obtain the plaintext result.

[0553] The method provided by the embodiments of the present application can be applied to the homomorphic computing party. Based on the process of the homomorphic computing scenario shown above Figure 9 it can be seen that before the homomorphic computing party performs homomorphic computation, the homomorphic key generation party should send the homomorphic computing key to the homomorphic computing party; in addition, since the homomorphic computing key is generated by the homomorphic key generation party according to the corresponding parameters, the homomorphic key generation party also needs to transmit the parameters of these homomorphic computing keys to the homomorphic computing party so that the homomorphic computing party can set the values of the parameters of these homomorphic computing keys to be the same as those on the key generation party side.

[0554] In the present application, the solutions described in the above several embodiments can be executed independently respectively, and all or some of the solutions involved in the above several embodiments can also be used in combination with each other, without limitation thereto.

[0555] In the above embodiments provided by the present application, the method provided by the embodiments of the present application has been introduced from the perspective of the interaction between each device. To implement each function in the method provided by the above embodiments of the present application, the first device may include a hardware structure and / or a software module, and implement each of the above functions in the form of a hardware structure, a software module, or a combination of a hardware structure and a software module. Whether a certain function among the above functions is executed in the form of a hardware structure, a software module, or a combination of a hardware structure and a software module depends on the specific application and design constraint conditions of the technical solution.

[0556] In the embodiments of the present application, the division of modules is illustrative, merely a logical function division, and there may be other division methods in actual implementation. Additionally, in each embodiment of the present application, each functional module may be integrated in a processor, may exist independently physically, or two or more modules may be integrated in one module. The above integrated modules may be implemented in the form of hardware or in the form of software functional modules.

[0557] Similar to the above concept, as Figure 10 shown, the embodiments of the present application further provide a data processing device 1000 for implementing the functions of the homomorphic computing device (homomorphic computing party) in the above method. For example, the data processing device 1000 may be a software module or a chip system. In the embodiments of the present application, the chip system may be composed of chips or may include chips and other discrete devices. The data processing device 1000 may include: a communication unit 1001 and a processing unit 1002.

[0558] In the embodiments of the present application, the communication unit 1001 may also be referred to as a transceiver unit, and may include a sending unit and / or a receiving unit, which are respectively used to execute the sending and receiving steps of the network device or the terminal device in the above method embodiments. The processing unit 1002 may be used to read instructions and / or data in the storage module, so that the data processing device 1000 implements the foregoing method embodiments.

[0559] Optionally, the data processing device 1000 may further include a storage unit 1003, which is equivalent to the storage module and may be used to store instructions and / or data.

[0560] Hereinafter, in combination with Figures 10 to 11 the data processing device provided by the embodiments of the present application will be described in detail. It should be understood that the description of the device embodiments corresponds to the description of the method embodiments. Therefore, the content not described in detail may be referred to the above Figures 6A - 6B method embodiments. For the sake of brevity, it will not be repeated here.

[0561] The communication unit 1001 may also be referred to as a transceiver, a transceiver machine, a transceiver device, etc. The processing unit may also be referred to as a processor, a processing board, a processing module, a processing device, etc. Optionally, the device for implementing the receiving function in the communication unit 1001 may be regarded as the receiving unit, and the device for implementing the sending function in the communication unit 1001 may be regarded as the sending unit, that is, the communication unit 1001 includes a receiving unit and a sending unit. The communication unit may sometimes also be referred to as a transceiver machine, a transceiver, or a transceiver circuit, etc. The receiving unit may sometimes also be referred to as a receiver, a receiver, or a receiving circuit, etc. The sending unit may sometimes also be referred to as a transmitter, a transmitter, or a transmitting circuit, etc.

[0562] When the data processing device 1000 executes the first device in the process shown in the above embodiments Figure 6A : The communication unit 1001 is used for communicating with other devices. The processing unit 1002 is used for determining the ciphertext modulus of homomorphic encryption, which is a prime number obtained by accumulating the products of n different powers of 2 and coefficients, where n is an integer greater than or equal to 2 and less than or equal to 5; the processing unit 1002 is further used for performing homomorphic processing based on the ciphertext modulus; the homomorphic processing includes but is not limited to at least one of homomorphic encryption, homomorphic decryption, and homomorphic calculation.

[0563] When the data processing device 1000 executes the first device in the process shown in the above embodiments Figure 6B : The communication unit 1001 is used for communicating with other devices. The processing unit 1002 is used for determining the ciphertext modulus of homomorphic encryption; the ciphertext modulus is a composite number obtained by multiplying d different prime numbers, where each prime number is obtained by accumulating the products of n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5, and d is an integer greater than 1. The processing unit 1002 is further used for performing homomorphic processing based on the ciphertext modulus; the homomorphic processing includes but is not limited to at least one of homomorphic encryption, homomorphic decryption, and homomorphic calculation.

[0564] The above is only an example. The processing unit 1002 and the communication unit 1001 can also perform other functions. For a more detailed description, reference can be made to Figures 6A - 6B the relevant descriptions in the method embodiments described above, which will not be elaborated here.

[0565] As Figure 11 shown, the data processing device 1100 provided in the embodiment of the present application Figure 11 The data processing device shown can be Figure 11 a hardware circuit implementation of the data processing device shown. The data processing device 1100 can be applied to the flowchart shown above and execute the functions of the homomorphic calculation device (homomorphic calculation party) in the above method embodiments. For the sake of illustration, Figure 11 only the main components of the data processing device are shown.

[0566] As Figure 11 shown, the data processing device 1100 includes a communication interface 1101 and a processor 1102. The communication interface 1101 and the processor 1102 are coupled to each other. It can be understood that the communication interface 1101 can be a transceiver or an input / output interface, or can also be an interface circuit such as a transceiver circuit. Optionally, the data processing device 1100 may further include a memory 1103 for storing instructions executed by the processor 1102 or storing input data required for the processor 1102 to run instructions or storing data generated after the processor 1102 runs instructions.

[0567] When the data processing device 1100 is used to implement Figures 6A - 6B the method shown, the processor 1102 is used to implement the functions of the above-mentioned processing unit 1002, and the communication interface 1101 is used to implement the functions of the above-mentioned receiving unit and / or sending unit.

[0568] In the embodiments of the present application, the specific connection medium between the above-mentioned communication interface 1101, processor 1102, and memory 1103 is not limited. In the embodiments of the present application Figure 11 it is shown that the memory 1103, processor 1102, and communication interface 1101 are connected through a communication bus 1104. The communication bus 1104 is Figure 11 shown as a thick line. The connection manners between other components are only for illustrative purposes and are not limiting. The communication bus 1104 can be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience of representation, Figure 11 it is only shown as a thick line in the figure, but it does not mean that there is only one bus or one type of bus.

[0569] When the above-mentioned data processing device is a chip, Figure 12 FIG. shows a schematic structural diagram of a simplified chip device. The chip 1200 includes an interface circuit 1201 and one or more processors 1202. Optionally, the chip 1200 may further include a bus. Among them:

[0570] The processor 1202 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method may be completed by the integrated logic circuit in the hardware of the processor 1202 or by instructions in software form. The above-mentioned processor 1202 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. It can implement or execute the various methods and steps disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or the processor may also be any conventional processor, etc.

[0571] The interface circuit 1201 may be used for sending or receiving data, instructions, or information. The processor 1202 may use the data, instructions, or other information received by the interface circuit 1201 for processing, and may send the processed information through the interface circuit 1201.

[0572] Optionally, the chip further includes a memory 1203. The memory 1203 may include a read-only memory and a random access memory, and provide operation instructions and data to the processor. A part of the memory 1203 may further include a non-volatile random access memory (NVRAM).

[0573] Optionally, the memory stores executable software modules or data structures, and the processor can execute corresponding operations by calling the operation instructions stored in the memory (the operation instructions can be stored in the operating system).

[0574] Optionally, the chip can be used in the homomorphic computing device involved in the embodiments of the present application. Optionally, the interface circuit 1201 can be used to output the execution result of the processor 1202. For the data processing method provided by one or more embodiments of the present application, reference can be made to the foregoing embodiments, and details are not described herein again.

[0575] It should be noted that the respective functions of the interface circuit 1201 and the processor 1202 can be implemented by hardware design, software design, or a combination of software and hardware, and there is no limitation here.

[0576] The embodiments of the present application also provide a computer-readable storage medium, on which computer instructions for implementing the method executed by the first device in the above method embodiments are stored.

[0577] For example, when the computer program is executed by a computer, the computer can implement the method executed by the first device in the above method embodiments.

[0578] The embodiments of the present application also provide a computer program product including instructions, and when the instructions are executed by a computer, the computer implements the method executed by the first device in the above method embodiments.

[0579] The embodiments of the present application also provide a chip, including a processor, for calling the computer program or computer instructions stored in the memory, so that the processor executes the above Figures 6A - 6B data processing method shown in the embodiments.

[0580] In a possible implementation manner, the input of the chip corresponds to the receiving operation in the above Figures 6A - 6B shown embodiments, and the output of the chip corresponds to the sending operation in the above Figures 6A - 6B shown embodiments.

[0581] Optionally, the processor is coupled to the memory through an interface.

[0582] Optionally, the chip further includes a memory, and computer programs or computer instructions are stored in the memory.

[0583] Among them, the processor mentioned anywhere above can be a general-purpose central processing unit, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the program execution of a data processing method of the embodiment shown in Figures 6A - 6B The memory mentioned anywhere above can be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, a random access memory (RAM), etc.

[0584] It should be noted that for the convenience and conciseness of description, the explanations and beneficial effects of the relevant content in any of the above data processing devices can refer to the corresponding data processing method embodiments provided above, and will not be elaborated here.

[0585] In this application, the data processing devices may further include a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer. Among them, the hardware layer may include hardware such as a central processing unit (CPU), a memory management unit (MMU), and a memory (also called main memory). The operating system in the operating system layer can be any one or more computer operating systems that implement service processing through processes. For example, Linux operating system, Unix operating system, Android operating system, iOS operating system, or Windows operating system, etc. The application layer may include applications such as a browser, an address book, a word processing software, an instant messaging software, etc.

[0586] The division of modules in the embodiments of this application is illustrative, only a logical function division. In actual implementation, there may be other division methods. In addition, in each embodiment of this application, each functional module may be integrated in one processor, may also exist physically alone, or two or more modules may be integrated in one module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules.

[0587] Through the description of the above embodiments, those skilled in the art can clearly understand that the embodiments of the present application can be implemented by hardware, or by firmware, or by a combination thereof. When implemented in software, the above functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. The computer-readable medium includes computer storage media and communication media, where the communication media includes any medium that facilitates the transfer of a computer program from one place to another. The storage media can be any available medium that can be accessed by a computer. By way of example but not limitation: the computer-readable medium can include RAM, ROM, electrically erasable programmable read only memory (EEPROM), compact disc read-Only memory (CD-ROM), or other optical disc storage, magnetic disk storage media, or other magnetic storage devices, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and that can be accessed by a computer. In addition, any connection can suitably be a computer-readable medium. For example, if the software is transmitted using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave from a website, server, or other remote source, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, wireless, and microwave are included in the definition of the medium. As used in the embodiments of the present application, disk and disc include compact disc (CD), laser disc, optical disc, digital video disc (DVD), floppy disk, and Blu-ray disc, where disks generally reproduce data magnetically, while discs reproduce data optically with a laser. The above combinations should also be included within the scope of protection of the computer-readable medium.

[0588] In summary, the above description is only for the embodiments of the present application and is not intended to limit the protection scope of the present application. Any modifications, equivalent replacements, improvements, etc. made in accordance with the disclosure of the present application shall be included within the protection scope of the present application.

Claims

1. A data processing method, characterized in that The method includes: Determine the ciphertext modulus of homomorphic encryption; the ciphertext modulus is a prime number obtained by accumulating the products of n different powers of 2 and coefficients, where n is an integer greater than or equal to 2 and less than or equal to 5; Perform homomorphic processing based on the ciphertext modulus, and the homomorphic processing includes at least one of homomorphic encryption, homomorphic decryption, and homomorphic calculation.

2. The method according to claim 1, wherein The ciphertext modulus satisfies the following form: where Q is the ciphertext modulus, and the exponents k of the first n - 1 distinct powers of 2 i are integers greater than 0 and less than or equal to m (m ≥ k1 > … k i > k n-1 > 0), and the exponent k of the nth power of 2 n is equal to 0 (k n = 0), m is the bit width of the ciphertext modulus Q, and the coefficient a i takes values of +1 or -1, and i is an integer greater than or equal to 1 and less than or equal to n.

3. The method according to claim 2, wherein When n is 3, the form satisfied by the ciphertext modulus is where both k1 and k2 are integers greater than 0 and less than or equal to m.

4. The method according to claim 2, characterized in that, When n is 2, the form satisfied by the ciphertext modulus is where k1 is an integer greater than 0 and less than or equal to m.

5. The method according to any one of claims 1 to 4, characterized in that, Modulo operations are included in both the homomorphic encryption, the homomorphic decryption, and the homomorphic calculation; Performing homomorphic processing based on the ciphertext modulus includes: performing a modulo operation based on the ciphertext modulus, and the modulo operation includes shift processing and / or logical operation processing; wherein, the number of bits shifted in the shift processing is related to the exponents of the n powers of 2 in the ciphertext modulus, and the number of times of the logical operation processing is related to the value of n.

6. The method according to claim 5, wherein The method further includes: Performing at least one number-theoretic transform NTT based on the modulo operation.

7. The method according to claim 6, wherein One NTT includes M butterfly operations; M is an integer greater than or equal to 3; performing the number-theoretic transform NTT based on the modulo operation includes: performing the modulo operation after every three butterfly operations; performing modulo operation on each multiplication result using the power modulo operation algorithm in each butterfly operation.

8. A data processing method, characterized in that, The method includes: Determine the ciphertext modulus of homomorphic encryption; the ciphertext modulus is a composite number obtained by multiplying d different prime numbers, where each prime number is obtained by accumulating the products of n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5, and d is an integer greater than 1; Perform homomorphic processing based on the ciphertext modulus, and the homomorphic processing includes at least one of homomorphic encryption, homomorphic decryption, and homomorphic calculation.

9. The method according to claim 8, characterized in that The ciphertext modulus satisfies the following form: Where Q represents the ciphertext modulus, and d represents the number of prime numbers Q obtained by consecutive multiplication to obtain the ciphertext modulus j ; The prime number Q j satisfies the following form: Prime number Q j The exponent k of the power of 2 ji Is an integer greater than 0 and less than or equal to m j (m j ≥k j1 >…k ji >k j(n-1) >k jn =0), m j Is the bit width size of Q j The value of the coefficient a i Is +1 or -1.

10. The method according to claim 8 or 9, characterized in that When performing homomorphic encryption based on the ciphertext modulus, it includes: Based on the ciphertext modulus, perform homomorphic encryption on the second ciphertext component of the initial input ciphertext to obtain a first ciphertext; the first ciphertext is an RLWE ciphertext; the initial input ciphertext includes a first ciphertext component and the second ciphertext component, and the first ciphertext component includes N items, where N is a positive integer; Perform blind rotation processing on the first ciphertext based on an optimized number-theoretic transform NTT processing and decomposition method to obtain a second ciphertext.

11. The method according to claim 10, characterized in that, Performing blind rotation processing on the first ciphertext based on the optimized number-theoretic transform NTT processing and decomposition method to obtain a second ciphertext includes: Based on the optimized number-theoretic transform NTT processing and decomposition method and the first ciphertext, iteratively execute N blind rotation sub-operations to obtain the second ciphertext; N is an integer greater than 1; wherein, each blind rotation sub-operation is performed based on the output ciphertext of the previous blind rotation sub-operation; Wherein, for the i-th blind rotation sub-operation, i ∈ [1, N]; the i-th blind rotation sub-operation is associated with the i-th item of the first ciphertext component of the initial input ciphertext and the i-th key component of the initial input ciphertext, and includes the following: The current ciphertext is decomposed using a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts are in one-to-one correspondence and equal to the d different prime numbers; among them, the j-th third ciphertext contains ciphertext components obtained based on the modulus Q j and ciphertext components obtained based on other moduli Q k where Q k ≠Q j , j, k ∈ [1, d]; the current ciphertext is the first ciphertext or the output ciphertext of the previous blind rotation sub-operation; Use the d third ciphertexts as the initial values of the d accumulators; Perform number-theoretic transform (NTT) processing on the initial values of the d accumulators to obtain the transformed values of the d accumulators; the optimized NTT includes a modulo operation, and the modulo operation includes shift processing and / or logical operation processing; wherein, in the modulo operation included in the NTT processing of the initial value of the j-th accumulator, the number of bits shifted in the shift processing is related to the exponent of n powers of 2 in the corresponding j-th prime modulus Q j and the number of times of the logical operation processing is related to the value of the number of terms n of the powers of 2 in the j-th prime modulus Q j ; Based on the conversion values of the d accumulators, perform corresponding outer product and accumulation processing respectively to obtain the outer product values of the d accumulators; Perform INTT processing on the outer product values of the d accumulators respectively to obtain the updated values of the d accumulators; Process the updated values of the d accumulators by using the inverse transform of the decomposition method to obtain the output ciphertext; the output ciphertext is used for the next blind rotation sub-operation.

12. The method according to claim 10, wherein The blind rotation processing of the first ciphertext based on the optimized number theoretic transform NTT processing and decomposition method to obtain the second ciphertext includes: The current first ciphertext is decomposed by a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts are in one-to-one correspondence and equality with the d different prime numbers; wherein, the j-th third ciphertext contains ciphertext components decomposed based on the modulus Q j and ciphertext components decomposed based on other moduli Q k ; Q k ≠Q j , j, k ∈ [1, d]; Perform optimized NTT processing on the d third ciphertexts respectively to obtain d fourth ciphertexts; the optimized number-theoretic transform NTT processing includes a modulo operation, and the modulo operation includes a shift processing and / or a logical operation processing; wherein, in the modulo operation included in the NTT processing of the j-th third ciphertext, the number of bits shifted in the shift processing is related to the exponent of the n powers of 2 in the corresponding j-th prime modulus Q j and the number of times of the logical operation processing is related to the value of the number of terms n of the powers of 2 of the j-th prime modulus Q j ; Use the d fourth ciphertexts as the initial values of the d accumulators; Based on the initial values of the d accumulators, perform N - 1 times of CMUX gate processing and ciphertext combination processing to obtain the updated values of the d accumulators; N is an integer greater than 1; wherein each CMUX gate processing and ciphertext combination processing is performed based on the output ciphertext of the previous CMUX gate processing and ciphertext combination processing; Perform CMUX gate processing and inverse number theoretic transform INTT processing on the updated values of the d accumulators respectively to obtain d target ciphertexts; Based on the d target ciphertexts, obtain the second ciphertext through the inverse method of the decomposition method.

13. The method according to claim 12, wherein The performing N - 1 times of CMUX gate processing and ciphertext combination processing based on the initial values of the d accumulators to obtain the updated values of the d accumulators includes: Perform the i-th CMUX gate processing and ciphertext combination processing, where the i-th CMUX gate processing and ciphertext combination processing is associated with or corresponding to the i-th item of the first ciphertext component of the initial input ciphertext and the i-th key component of the initial input ciphertext, i ∈ [1, N - 1], and includes: Based on the current values of the d accumulators, perform corresponding outer product and accumulation processing respectively to obtain the outer product values of the d accumulators; Determine d combined ciphertexts based on the outer product values of the current d accumulators; the d combined ciphertexts are used for the next CMUX gate processing and ciphertext combination processing; wherein, determining the j-th combined ciphertext based on the outer product value of the j-th accumulator includes: rearranging and combining the outer product value of the j-th accumulator and the ciphertext component of the k-th accumulator to obtain the j-th combined ciphertext, where k≠j; the ciphertext component of the k-th accumulator is based on the outer product value of the k-th accumulator for modular Q k of INTT and modular Q j obtained after NTT processing of 14. The method according to any one of claims 10 to 13, characterized in that, The decomposition method is any one of the following: Residue number system RNS decomposition, digital decomposition, gadget decomposition.

15. A data processing device, characterized in that, Includes a module or unit for performing the method according to any one of claims 1 to 7, or a module or unit for performing the method according to any one of claims 8 to 14.

16. A data processing device, characterized in that, Includes a processor, the processor is coupled to a memory, and a computer program is stored in the memory; the processor is used to call the computer program in the memory, so that the device performs the method according to any one of claims 1 to 7, or so that the device performs the method according to any one of claims 8 to 14.

17. A data processing device, characterized in that, Includes a processor and an interface circuit, the interface circuit is used to receive signals from other communication devices outside the communication device and transmit them to the processor or send signals from the processor to other communication devices outside the communication device, and the processor is used to implement the method according to any one of claims 1 to 7 through logic circuits or by executing code instructions, or the processor is used to implement the method according to any one of claims 8 to 14 through logic circuits or by executing code instructions.

18. A computer-readable storage medium, characterized in that A computer program or instruction is stored in the storage medium, and when the computer program or instruction is executed by a computer, the method according to any one of claims 1 to 14 is implemented.

19. A computer program product, characterized in that, When the computer reads and executes the computer program product, the computer is caused to execute the method according to any one of claims 1 to 14.

20. A communication system, characterized in that, Comprising at least one of a homomorphic encryption party, a homomorphic computing party, and a homomorphic decryption party, any one of the homomorphic encryption party, the homomorphic computing party, and the homomorphic decryption party is configured to execute the method according to any one of claims 1 to 14.

Images