Ciphertext processing method and device under fully homomorphic encryption based on FPGA (Field Programmable Gate Array) and program product

Abstract

The invention provides a ciphertext processing method and device under full homomorphic encryption based on an FPGA and a program product, and the method comprises the steps: executing homomorphic gate operation according to a GLWE private key provided by a client and a to-be-processed ciphertext, and obtaining an intermediate processing ciphertext; the to-be-processed ciphertext is generated through encryption of an LWE private key; the LWE private key comprises at least one binary private key block; each private key block comprises L + 1 value combinations; performing ciphertext processing on the intermediate processing ciphertext by using a noise refreshing key and a private key switching key; the noise refreshing key comprises key groups in one-to-one correspondence with the private key blocks, and each key group corresponds to L + 1 types of blind rotation operation parameters; in the processing process, blind rotation operation parameters of each key group are executed in parallel, execution results are aggregated to obtain blind rotation output, outer product operation is performed on the blind rotation output and the intermediate processing ciphertext, and a noise refreshing ciphertext is obtained; and extracting and accumulating corresponding adjustment items from the private key switching key, and adjusting the noise refreshing ciphertext into a low-noise ciphertext compatible with the LWE private key. According to the invention, the ciphertext processing efficiency can be improved.

Description

Technical Field

[0001] The present invention relates to the field of homomorphic encryption technology, and in particular to a ciphertext processing method, device and program product under FPGA-based fully homomorphic encryption. Background Art

[0002] With the rapid development of cloud computing, big data, and artificial intelligence technologies, data has become a core resource driving social progress and business innovation. However, outsourcing data computing (such as relying on third-party servers to process sensitive data) poses a serious risk of privacy leakage. Traditional encryption technologies cannot support direct computation on encrypted data, but the emergence of fully homomorphic encryption (FHE) technology provides a breakthrough solution to this problem. FHE allows arbitrary computations to be performed on ciphertext without decryption, achieving "data available but invisible." However, its high computational complexity limits its practical application. Therefore, there is an urgent need to design efficient ciphertext processing methods under FHE that can improve computational efficiency while ensuring privacy.

[0003] In existing fully homomorphic encryption technologies, ciphertext processing involves ciphertext computation and ciphertext noise refreshing. The noise refreshing operation is typically divided into two phases: blind rotation and key switching. Blind rotation involves adjusting the ciphertext's phase through complex polynomial multiplication to eliminate noise interference on the calculation results. Key switching involves converting the ciphertext into a form under the target key through multiple layers of cyclic scalar multiplication, ensuring compatibility with subsequent computations and ensuring that the ciphertext can still be correctly decrypted after multiple computations.

[0004] However, in the traditional ciphertext processing process, the blind rotation operation involves high-order polynomial multiplication, resulting in extremely high computational complexity, which significantly increases the processing time; at the same time, the key switching operation also requires performing a large number of scalar multiplication operations. These operations are usually nested in multiple layers of loops, resulting in a large number of loops, further slowing down the speed of the entire ciphertext processing and ultimately resulting in low ciphertext processing efficiency. Summary of the Invention

[0005] In view of this, the embodiments of the present invention provide a method, device, and program product for ciphertext processing under fully homomorphic encryption based on FPGA to eliminate or improve one or more defects in the prior art, and to address the problem of low ciphertext processing efficiency in existing ciphertext processing methods.

[0006] One aspect of the present invention provides a ciphertext processing method under fully homomorphic encryption based on FPGA, which is used on a server, and the server includes a private key switching unit based on FPGA; the method includes the following steps:

[0007] Perform a homomorphic gate operation on the client-provided GLWE private key and the ciphertext to be processed to obtain an intermediate processed ciphertext. The ciphertext to be processed is generated by the client using the LWE private key. The LWE private key consists of at least one private key block. Each private key block is a binary vector of length L, containing at most one non-zero bit and L+1 possible value combinations, each corresponding to a blind rotation operation parameter.

[0008] The intermediate processed ciphertext is ciphered using the noise refresh key and private key switching key provided by the client to generate a low-noise ciphertext; the noise refresh key includes the GLWE ciphertext generated by encrypting each bit of the LWE private key with the GLWE private key, including a key group corresponding to a private key block, and each key group corresponds to L+1 blind rotation operation parameters; during the ciphertext processing, the blind rotation operation parameters corresponding to each key group are executed in parallel, and the execution results are aggregated to obtain a blind rotation output, which is subjected to an outer product operation with the intermediate processed ciphertext to obtain a noise refresh ciphertext; through the private key switching unit, the corresponding adjustment items are extracted and accumulated from the private key switching key, and the noise refresh ciphertext is adjusted to a low-noise ciphertext compatible with the LWE private key, so that the client can use the LWE private key for decryption.

[0009] In some embodiments of the present invention, the private key switching key includes an LWE ciphertext generated by encrypting each bit of a GLWE private key with an LWE private key; the GLWE private key includes k polynomials, each polynomial includes N polynomial coefficients, and each polynomial coefficient is decomposed into multiple levels of LWE ciphertext according to a preset decomposition level; each LWE ciphertext in the private key switching key includes a first dimension index and a second dimension index; wherein the first dimension index is used to identify the position of the polynomial coefficient corresponding to the LWE ciphertext in the GLWE private key; and the second dimension index is used to identify the decomposition level.

[0010] Extract and accumulate corresponding adjustment items from the private key switching key to adjust the noisy refresh ciphertext to low-noise ciphertext compatible with the LWE private key, including:

[0011] Recombining the ciphertext components in the noise refresh ciphertext to generate intermediate ciphertext components;

[0012] Construct the initial output ciphertext, place the constant term in the noise refresh ciphertext as the initial value in the last bit of the initial output ciphertext, and set the other bits to 0;

[0013] The index of the initial output ciphertext, the first dimension index, and the second dimension index are traversed in sequence through three layers of nested loops with fixed ranges. Based on the conditional judgment of the non-zero decomposition coefficients extracted from the intermediate ciphertext components, the corresponding adjustment items are extracted from the private key switching key and accumulated to the corresponding positions in the initial output ciphertext to generate a low-noise ciphertext compatible with the LWE private key.

[0014] In some implementations of the present invention, the LWE private key includes n key coefficients, and N is greater than n; among the k polynomials of the GLWE private key, when the first n polynomial coefficients in each polynomial are the same as the n key coefficients, in the loop traversing the first dimension index, the value range of the first dimension index is set to be from n to N-1.

[0015] In some implementations of the present invention, the server includes several independent computing units;

[0016] Execute the blind rotation parameters corresponding to each key group in parallel and aggregate the execution results to obtain the blind rotation output, including:

[0017] The key group is assigned to an independent computing unit. Each computing unit selects the corresponding blind rotation operation parameters according to the assigned key group and executes them to obtain the execution results of each computing unit.

[0018] The execution results corresponding to the same key group are accumulated in parallel through a multi-level addition tree structure to obtain at least one intermediate result and further aggregate it into a blind rotation output.

[0019] In some embodiments of the present invention, before ciphering the intermediate processed ciphertext using the noise refresh key and the private key switching key to generate the low-noise ciphertext, the method further includes:

[0020] Based on the number of key coefficients in each key group, L+1 blind rotation operation parameters are pre-generated;

[0021] Load L+1 blind rotation operation parameters into each computing unit.

[0022] In some embodiments of the present invention, the homomorphic gate operation includes at least one homomorphic gate evaluation; wherein the homomorphic gate evaluation includes a multiplication gate evaluation or an addition gate evaluation;

[0023] The intermediate processed ciphertext is ciphered using the noise refresh key and the private key switching key. Before generating the low-noise ciphertext, the following steps are also included:

[0024] When the current homomorphic gate evaluation is a multiplication gate evaluation, the ciphertext processing operation is performed;

[0025] When the current homomorphic gate evaluation is an addition gate evaluation, if the noise of the intermediate processed ciphertext exceeds the preset noise upper limit, the ciphertext processing operation is performed; otherwise, the subsequent homomorphic gate operation is performed.

[0026] In some implementations of the present invention, high-level synthesis tool instructions are integrated into the private key switching unit, and the high-level synthesis tool instructions include loop unrolling instructions, pipeline instructions, or memory allocation instructions.

[0027] Another aspect of the present invention provides an FPGA-based ciphertext processing device under fully homomorphic encryption, comprising a processor, a memory, and a computer program / instruction stored in the memory, wherein the processor is used to execute the computer program / instruction. When the computer program / instruction is executed, the device implements the steps of the FPGA-based ciphertext processing method under fully homomorphic encryption as described above.

[0028] Another aspect of the present invention provides a computer-readable storage medium having a computer program / instruction stored thereon, which, when executed by a processor, implements the steps of the ciphertext processing method under FPGA-based fully homomorphic encryption as described above.

[0029] Another aspect of the present invention provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the ciphertext processing method under FPGA-based fully homomorphic encryption as described above.

[0030] The ciphertext processing method and device under fully homomorphic encryption based on FPGA of the present invention can solve the problem of low ciphertext processing efficiency of existing ciphertext processing methods; the client's LWE private key is constructed using a sparse binary vector and divided into multiple independent private key blocks. The key coefficients in the same private key block are logically associated, while different private key blocks are independent of each other, and each private key block contains at most one non-zero element, thereby reducing the possible value combinations in each private key block from the original 2 L The number of blind rotations is reduced to L+1. In this way, in subsequent blind rotation operations, the blind rotation operations are performed in parallel according to the private key block groups. Each group only needs to execute the blind rotation operation parameters in L+1, which greatly reduces the computational complexity of the blind rotation operation, improves the efficiency of the blind rotation operation, and thus improves the efficiency of ciphertext processing. At the same time, the blind rotation operation results corresponding to each group are aggregated into one blind rotation output. In this way, in the outer product operation, multiple outer product operations originally performed sequentially will also be aggregated into one outer product operation, which greatly reduces the complexity of the outer product operation, thereby further improving the efficiency of ciphertext processing.

[0031] In some embodiments of the present invention, the traditional non-fixed-range loop structure in the private key switching process is reconstructed into a three-layer fixed-range nested loop structure to adapt to HLS tool optimization. While reducing the complexity of the private key switching calculation, it can adapt to FPGA hardware optimization and reduce the calculation time of the private key switching, thereby further improving the efficiency of ciphertext processing.

[0032] In some embodiments of the present invention, by leveraging the characteristics of binary block keys, n bits of the LWE private key are reused in each polynomial in the GLWE private key. This allows for eliminating redundant calculations of the first n bits during the private key switching process, reducing the computational time required for private key switching and further improving the efficiency of ciphertext processing.

[0033] Additional advantages, objects, and features of the present invention will be set forth in part in the following description and will become apparent to those skilled in the art upon examination of the following or may be learned from practice of the present invention. The objects and other advantages of the present invention may be realized and obtained by the structures particularly pointed out in the description and drawings.

[0034] Those skilled in the art will understand that the purposes and advantages that can be achieved by the present invention are not limited to the above specific descriptions, and the above and other purposes that can be achieved by the present invention will be more clearly understood based on the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The drawings described herein are used to provide a further understanding of the present invention, constitute a part of this application, and do not constitute a limitation of the present invention. In the drawings:

[0036] Figure 1 This is a flowchart of a ciphertext processing method under FPGA-based fully homomorphic encryption provided by one embodiment of the present invention.

[0037] Figure 2 A schematic diagram of generating an LWE private key based on a binary block according to an embodiment of the present invention.

[0038] Figure 3 A schematic diagram of the interaction between a server and a client provided in one embodiment of the present invention.

[0039] Figure 4 A schematic diagram of a noise refresh operation provided by an embodiment of the present invention.

[0040] Figure 5 A schematic diagram of a calculation unit performing noise refresh according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the embodiments and the accompanying drawings. Here, the exemplary embodiments of the present invention and their descriptions are used to explain the present invention, but are not intended to limit the present invention.

[0042] It should also be noted that, in order to avoid obscuring the present invention due to unnecessary details, the accompanying drawings only show structures and / or processing steps closely related to the solutions according to the present invention, while other details that are not closely related to the present invention are omitted.

[0043] It should be emphasized that the term "include / comprises" when used herein refers to the existence of features, elements, steps or components, but does not exclude the existence or addition of one or more other features, elements, steps or components.

[0044] It should also be noted that, unless otherwise specified, the term "connection" herein may refer not only to a direct connection but also to an indirect connection involving an intermediate.

[0045] Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the accompanying drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0046] The following is a detailed introduction to the ciphertext processing method under FPGA-based fully homomorphic encryption provided by this application.

[0047] like Figure 1 As shown, the embodiment of the present application provides a ciphertext processing method under fully homomorphic encryption based on FPGA. This embodiment is described by taking the method used in the server as an example. Among them, the server can be a mobile phone, a computer, a server or a server cluster. This embodiment does not limit the implementation method of the server. The method includes at least steps S101 to S102:

[0048] Step S101: Perform a homomorphic gate operation based on the GLWE private key provided by the client and the ciphertext to be processed to obtain an intermediate processed ciphertext.

[0049] Among them, the client is a terminal device configured to establish a communication connection with the server, suitable for sending the ciphertext to be processed and the corresponding key to the server, including but not limited to terminal devices such as mobile phones or computers.

[0050] In some embodiments of the present invention, the client generates local private keys, including LWE private keys (Learning With Errors private keys) and GLWE private keys (General Learning With Errors private keys), through binary blocks and a fully homomorphic encryption (FHE) scheme.

[0051] An LWE private key is a binary vector of length n, consisting of at least one private key block. Each private key block is a sparse binary vector of length L, containing at most one non-zero bit and L+1 possible value combinations. When the number of private key blocks is Z, n = Z * L.

[0052] For example: Reference Figure 2 Taking L=2 as an example, the client generates an LWE private key of length n based on a binary block. The number of private key blocks is Z=n / 2. Each private key block includes 2 elements and contains at most one non-zero element. Figure 2As shown, the first private key block generated includes 1 and 0, the second private key block includes 0 and 0, the third private key block includes 0 and 1, the Z-1th private key block includes 0 and 0, and the Zth private key block includes 0 and 1.

[0053] Specifically, the LWE private key s is expressed as follows:

[0054]

[0055] Where, represents the set {0,1}; s0 represents the first private key coefficient in the LWE private key; s1 represents the second private key coefficient in the LWE private key; s n-1 Represents the nth private key coefficient in the LWE private key; n represents the dimension of the LWE private key, that is, the number of coefficients in the LWE private key.

[0056] In some embodiments of the present invention, the LWE private key is used to encrypt private data and generate ciphertext to be processed. Encryption using the LWE private key s yields the ciphertext ct to be processed, which is expressed as follows:

[0057]

[0058] Where ct represents the ciphertext to be processed; LWE s (m) represents the encryption operation based on the Learning With Errors (LWE) problem using the LWE private key s on the plaintext information m; a = (a0, a1, ..., a n-1 ) represents the mask vector, and each component in the mask vector a belongs to the integer ring modulo q During the encryption process, these values are obtained through uniform random sampling and multiplied with the LWE private key s before participating in the calculation; b is a constant term in the ciphertext to be processed ct, which is determined by the mask vector a, the plaintext information m and the noise e.

[0059] The GLWE private key consists of k polynomials, each of which has N polynomial coefficients, used to encrypt polynomial information. Specifically, the GLWE private key can be expressed as follows:

[0060]

[0061] Where, S represents the GLWE private key; S k-1 (X) represents the kth polynomial in the GLWE private key, each polynomial is in the ring As defined above, d represents the dimension of the GLWE ciphertext, which is the ciphertext obtained by encrypting the plaintext using the GLWE key. The GLWE ciphertext encrypted using the GLWE key S is expressed as follows:

[0062]

[0063] Among them, CT represents GLWE ciphertext; GKWE s (M) represents the process of encrypting the polynomial plaintext M using the GLWE private key S; A=(A0(X),...,A k-1 (X)) represents the mask vector, which belongs to the polynomial ring modulo q During the encryption process, each component in the mask vector is randomly and uniformly sampled; represents a d-dimensional vector space where each component is The polynomial in ; B(X) represents a constant term; M(X) represents the plaintext polynomial; E(X) represents a small random noise polynomial.

[0064] After generating the local private key, the client continues to generate the keys required for the server to perform ciphertext processing, including the Boot Strapping Key (BSK) and the Key Switching Key (KSK).

[0065] In some embodiments of the present invention, the noise refresh key and the private key switching key are generated using the LWE key and the GLWE key.

[0066] The noise refresh key includes the GLWE ciphertext generated by encrypting each bit of the LWE private key with the GLWE private key. Specifically, each bit of the LWE private key s is encrypted with the GLWE private key S into a GGSW (Gentry Gorbunov Halevi SmartWare) ciphertext.

[0067] The GGSW ciphertext is an extension of the GWLE ciphertext. During the encryption process, the information to be encrypted is first decomposed, the decomposed content is encrypted, and the encrypted multiple GLWE ciphertexts are combined to obtain a GGSW ciphertext.

[0068] In some embodiments of the present invention, since the LWE private key includes n elements, the noise refresh key accordingly includes n GGSW ciphertexts, which can be expressed as follows:

[0069]

[0070] Where, BSK0 represents the first GGSW ciphertext; BSK1 represents the second GGSW ciphertext; BSK2 represents the second GGSW ciphertext; BSK n-1 Indicates the nth GGSW ciphertext; Represents a polynomial ring with a polynomial size of N and a modulus of q, defined as Simplified to x N +1; d represents the dimension of GLWE ciphertext; l b represents the decomposition level of the noise refresh key; n represents the total number of GGSW ciphertexts.

[0071] In some embodiments of the present invention, the private key switching key includes an LWE ciphertext generated by encrypting each bit of the GLWE private key with the LWE private key.

[0072] When encrypting a GLWE private key using an LWE private key, each polynomial coefficient in the GLWE private key will be decomposed into multiple levels of LWE ciphertext according to the preset decomposition level.

[0073] Specifically, each polynomial coefficient of the GLWE key S is encrypted into ksk l LWE ciphertext, so the private key switching key contains kN×ksk l LWE ciphertext. Among them, ksk l Indicates the decomposition level of the private key handover key.

[0074] Each LWE ciphertext in the private key switching key includes a first dimension index and a second dimension index; wherein the first dimension index is used to identify the position of the polynomial coefficient corresponding to the LWE ciphertext in the GLWE private key; and the second dimension index is used to identify the decomposition level.

[0075] Specifically, the private key switching key is expressed as follows:

[0076]

[0077] Where KSK represents the private key switching key; KSK (0，0) Indicates the first coefficient in the private key switching key; KSK (0，1) Represents the second coefficient in the private key switching key; Indicates the kN×ksk in the private key switching key l coefficients; d represents the dimension of the GLWE ciphertext obtained by encrypting the GLWE private key; the GLWE private key is a set of k polynomials, and N represents the number of coefficients of each polynomial in the GLWE private key; ksk l Indicates the decomposition level of the private key switching key; represents the polynomial ring modulo q; n+1 represents the dimension of the LWE ciphertext + 1. Since the LWE ciphertext usually consists of a vector of length n and an additional scalar, the total dimension is n+1.

[0078] After generating the noise refresh key and the private key switching key, the client uses the LWE private key in the local private key to encrypt the private data and generate the ciphertext to be processed c = (a0, a1, ..., a n-1 ,b).

[0079] After generating the ciphertext to be processed, such as Figure 3 As shown in the figure, the client uploads the ciphertext to be processed, the ciphertext noise refresh key, and the private key switching key to the server, and uses the computing power of the server to complete the complex computing task.

[0080] After receiving the noise refresh key, the private key switching key and the ciphertext to be processed, the server stores the ciphertext to be processed, the noise refresh key and the private key switching key in correspondence with each other.

[0081] When executing a computation task, the server first retrieves the ciphertext to be processed and initializes the accumulator. The accumulator (ACC) is a data structure used to store intermediate ciphertext during ciphertext processing.

[0082] In the process of initializing the accumulator, a preset polynomial v is first calculated. The polynomial is in the polynomial ring. Specifically, the polynomial v can be expressed as follows:

[0083]

[0084] Where N is the size of the polynomial ring and X is the variable, i.e. the basis of the polynomial.

[0085] After the polynomial v is calculated, the coefficients of the ciphertext to be processed are quantized to obtain the quantization results. Quantization is used to convert floating point numbers into integers to facilitate subsequent modular operations and hardware implementation. The quantization results include and i is greater than or equal to 0 and less than n.

[0086] After obtaining the quantization processing result, the polynomial v and the quantization processing result are used to calculate the Initialize the accumulator. Specifically, the initialization process can be expressed as follows:

[0087]

[0088] Where ACC represents the accumulator; represents the result of quantization processing; v represents the polynomial v; X represents the variable, that is, the basis of the polynomial; N represents the polynomial ring size.

[0089] After completing the initialization of the accumulator ACC, the server performs a homomorphic gate operation based on the GLWE private key and the ciphertext to be processed provided by the client to obtain the intermediate processed ciphertext.

[0090] Homomorphic gate operations refer to operations performed directly on the ciphertext being processed in homomorphic computations, including at least one gate circuit evaluation. A gate circuit refers to a computational unit consisting of an addition gate and a multiplication gate. Gate circuit evaluation refers to the execution of addition gate and multiplication gate calculations in an encrypted state, including both additive gate evaluation and multiplication gate evaluation.

[0091] In homomorphic encryption, the noise growth characteristics and ciphertext processing strategies evaluated by different gate circuits vary significantly, specifically in the following two cases:

[0092] The first one is that in the addition gate evaluation, the noise in the ciphertext is linearly superimposed. When the input ciphertext noise is η1 and η2, the output noise is η1+η2.

[0093] At this time, the ciphertext processing strategy includes: after the addition gate evaluation, if the noise of the intermediate ciphertext processing exceeds the preset noise upper limit (Noise Budget Threshold, Bmax), executing the ciphertext processing operation; otherwise, executing the subsequent homomorphic gate operation.

[0094] Second, in the multiplication gate evaluation, the noise in the ciphertext is quadratically expanded. When the input ciphertext noise is η1 and η2, the output noise is η1×η2.

[0095] At this time, the ciphertext processing strategy includes: performing the ciphertext processing operation after the multiplication gate evaluation.

[0096] Step S102 : Using the noise refresh key and the private key switching key provided by the client, the intermediate processed ciphertext is ciphered to generate a low-noise ciphertext.

[0097] like Figure 4 As shown, in some embodiments of the present invention, the ciphertext processing is a noise refresh (Bootstrapping) operation, including a blind rotation operation (Blind Rotation) and a private key switch (Key Switch) operation.

[0098] The intermediate processed ciphertext is used as the input ciphertext of the blind rotation operation, which is expressed as follows:

[0099]

[0100] For ciphertext C in The core of blind rotation operation lies in homomorphic computation:

[0101]

[0102] Where a=(a0,a1,...,a n-1 ) represents the ciphertext C in The n ciphertext coefficients in b0 represent the ciphertext C in The constant term in ; represents the polynomial ring modulo q; n+1 represents the dimension of the ciphertext + 1, because the LWE ciphertext usually consists of a vector of length n and a constant term, so the total dimension is n+1; s=(s0, s1, ..., s n-1 ) represents the LWE key,

[0103] To avoid the leakage of LWE key, GLWE key is used to encrypt LWE key into GGSW ciphertext. Therefore, in the blind rotation operation, s=(s0,s1,...,s n-1 ) is actually the noise refresh key.

[0104] Correspondingly, the essence of the blind rotation operation is the process of cyclically calculating the following formula:

[0105]

[0106] Where ACC represents the state of the accumulator; Indicates outer product operation; BSK i Represents the i-th key coefficient in the noise refresh key. In the cyclic calculation, the value of i ranges from 0 to n-1; middle Indicates the result of quantization processing X represents the variables, that is, the basis of the polynomial.

[0107] In some embodiments of the present invention, since the noise refresh key BSK is generated by encrypting each bit of the LWE private key with the GLWE private key, and the LWE private key is a binary block key generated based on a binary block and a fully homomorphic scheme, it includes at least one private key block whose key information is independent of each other but has a certain correlation, each private key block includes L elements, and includes at most one 1, and the rest are all 0s.

[0108] Based on this, according to the binary nature of the LWE private key and the nature of the elements in each private key block, the possible value combinations in each private key block will be from 2 L The number of values is reduced to L+1, and each value combination corresponds to a blind rotation operation parameter in the blind rotation operation.

[0109] For example: Take L=3 as an example. The original value combination will be changed from 2 3 The possible combinations are reduced to 4. The 4 possible combinations include (0,0,0), (1,0,0), (0,1,0) and (0,0,1).

[0110] At the same time, the key groups in the noise refresh key correspond to the private key blocks in the LWE private key one by one, so the blind rotation operation parameters corresponding to each key group will also be increased from 2 L The number of species is reduced to L+1.

[0111] For example, taking L=3, there are only four possible blind rotation parameters for each key group, as shown in Table 1:

[0112]

[0113] Table 1

[0114] Referring to Table 1, in the case where each private key block includes 3 elements, each private key block can be expressed as (s i ,s i+1 ,s i+2 ).

[0115] Based on this, the original homomorphic computing According to the binary property, it can be simplified to:

[0116] At the same time, in order to avoid the leakage of the LWE private key, the LWE private key is replaced with the noise refresh key, then the original homomorphic computation can be expressed as:

[0117] This approach allows for the parallel execution of L+1 blind rotation parameters for each key group. After obtaining the execution results for each key group, the results are aggregated to form the blind rotation output. This is then combined with the intermediate processed ciphertext for a single outer product operation to eliminate noise in the ciphertext, significantly reducing computational complexity.

[0118] Specifically, the execution results corresponding to each key group are aggregated into blind rotation outputs, and an outer product operation is performed with the intermediate processed ciphertext, which can be expressed as follows:

[0119]

[0120] Where ACC represents the state of the accumulator; Indicates outer product operation; BSK j represents the jth key coefficient in the noise refresh key; j∈I j Indicates the key subscripts belonging to the same group.

[0121] In some embodiments of the present invention, the server includes a key expansion unit, which includes a plurality of computing units for executing blind rotation operations on the intermediate processed ciphertext in parallel to refresh the noise of the intermediate processed ciphertext.

[0122] Alternatively, the server includes a key expansion unit and several computing units. The key expansion unit can call several computing units to implement the blind rotation operation of the intermediate processed ciphertext in parallel and refresh the noise of the intermediate processed ciphertext.

[0123] In some embodiments of the present invention, the computing unit is designed as an independent hardware module, including a dedicated circuit based on a field programmable gate array (FPGA) or a dedicated computing core based on a graphics processing unit (GPU) to support efficient parallel processing.

[0124] In the key aggregation operation, the blind rotation operation parameters corresponding to each key group are processed in parallel by the computing unit, and the execution results are aggregated to obtain the blind rotation output.

[0125] By computing all L+1 blind rotation operation parameters corresponding to the parallel key group of the computing units, each computing unit computes one blind rotation operation parameter (e.g. Among them, BSK i s in the LWE private key i The corresponding GGSW ciphertext), and then the addition tree is used to aggregate the results of the calculation unit output to obtain the blind rotation output.

[0126] For example: Reference Figure 5 Taking L=3 as an example, each key group corresponds to four blind rotation operation parameters. The four blind rotation operation parameters are executed in parallel by four computing units, and the execution results of the four computing units are aggregated step by step.

[0127] Specifically, the blind rotation operation parameters corresponding to each key group are executed in parallel, and the execution results are aggregated to obtain the blind rotation output, including: assigning the key group to an independent computing unit, each computing unit selecting the corresponding blind rotation operation parameters for execution based on the assigned key group, and obtaining the execution results of each computing unit; and accumulating the execution results corresponding to the same key group in parallel through a multi-level addition tree structure to obtain at least one intermediate result and further aggregating it into the blind rotation output.

[0128] During the outer product operation, the blind rotation output is recorded as KAR i , then the outer product operation can also be expressed as follows:

[0129]

[0130] Where, KAR i Indicates the blind rotation output; ACC indicates the state of the accumulator.

[0131] Furthermore, based on the pre-generated nature of the blind rotation operations in L+1, the server can pre-calculate L+1 different blind rotation parameters based on the number of key coefficients in each key group, L. The pre-generated L+1 parameters are stored by key group and dynamically loaded into each independent computation unit during initialization.

[0132] For example, each computational unit pre-stores a complete set of parameters corresponding to its assigned key group. When processing ciphertext, the computational unit directly calls upon these pre-stored blind rotation parameters to rapidly complete the operation. This pre-generated parameter structure, combined with a multi-level addition tree aggregation mechanism, ensures that intermediate results from each path are formatted uniformly, allowing for seamless accumulation and generation of the final blind rotation output.

[0133] Specifically, the intermediate processed ciphertext is ciphered using the noise refresh key and private key switching key provided by the client. Before generating the low-noise ciphertext, the method also includes: pre-generating L+1 blind rotation operation parameters based on the number of key coefficients of each key group; and loading the L+1 blind rotation operation parameters into each computing unit.

[0134] During the ciphertext processing process, although the intermediate processed ciphertext can refresh the noise in the ciphertext through the blind rotation operation, it will also cause the decryption private key corresponding to the ciphertext to change. Therefore, after the blind rotation operation, it is necessary to use the private key switching key to perform a private key switching operation, adjust the noise refreshed ciphertext, and switch the decryption private key of the noise refreshed ciphertext to the LWE private key, so that when the client receives the processed ciphertext returned by the server, it can use the LWE private key to correctly decrypt and obtain the calculation result.

[0135] In some embodiments of the present invention, the server further includes a private key switching unit. After refreshing the noise in the ciphertext through the blind rotation operation, the private key switching unit extracts and accumulates corresponding adjustment items from the private key switching key to adjust the noise-refreshed ciphertext to a low-noise ciphertext compatible with the LWE private key.

[0136] Among them, the private key switching unit is designed as an independent hardware module and is constructed based on a dedicated circuit of a Field Programmable Gate Array (FPGA).

[0137] In actual implementation, the private key switching unit can also be built based on a dedicated computing core of a graphics processing unit (GPU).

[0138] In addition, because directly using hardware programming languages for FPGA design is difficult and requires a long development cycle, in some embodiments of the present invention, a high-level synthesis tool (HLS) is used for FPGA design to obtain a private key switching unit. The private key switching unit integrates HLS instructions. Depending on the algorithm structure and the number of hardware resources, the HLS instructions may include loop unrolling instructions, pipeline instructions, or memory allocation instructions, thereby achieving the construction of an efficient private key switching unit.

[0139] However, the complex loop structure with unfixed boundaries in the traditional private key switching algorithm is not suitable for HLS tools. Directly using HLS tools cannot convert high-level language code into efficient hardware execution units.

[0140] Based on this, in some embodiments of the present invention, the loop structure in the private key switching unit is redesigned, and the complex loop structure with unfixed loop boundaries is changed to a three-layer loop structure with fixed loop boundaries that is more suitable for the HLS tool, including an outer loop, a middle loop and an inner loop, and all operations are concentrated in the inner loop to facilitate optimization using the HLS tool.

[0141] As shown in Table 2, Table 2 is the pseudo code implementation process of the private key switching operation.

[0142]

[0143] Table 1

[0144] As shown in Table 2, in the private key switching operation, the decomposition parameter decomposition mask decomp is first initialized mask , decomposition offset decomp offset , the decomposition level of the private key switching key ksk l The number of decomposition bits ksk of the private key switching key w Next, three auxiliary variables v1, v2, and v3 are calculated, where v1 represents the logarithm associated with the ciphertext dimension, v2 combines v1 with the decomposition level, and v3 combines v2 with the decomposition bit. Afterwards, the ciphertext components in the low-noise ciphertext are reassembled and decomp offset Perform offset adjustment to obtain the intermediate ciphertext component tlwe; create an initial output ciphertext C of length n+1 out , the constant term in the low-noise ciphertext is placed at the n+1th position as the initial value, which is in the form of (0,0,0,...,0,b0).

[0145] In the outer loop (OUTER_LOOP), traverse the initial output ciphertext C through i out The index of i, where the value range is 0 to n; by traversing the initial output ciphertext Cout The various components of , and finally generate each element in the initial output ciphertext vector.

[0146] In the middle loop (MIDDLE_LOOP), the first dimension index of the LWE ciphertext in the private key switching key is traversed through j, and the different dimensions of the low-noise ciphertext are mapped to the corresponding private key switching key data structure, and this information is accumulated to the initial output ciphertext during the private key switching process.

[0147] Since the GLWE private key consists of k polynomials, each polynomial includes N coefficients, and the private key switching key is generated by encrypting each bit of the GLWE private key with the LWE private key, the private key consists of kN×ksk l LWE ciphertexts, therefore, in some embodiments of the present invention, the value range of j is 0 to N-1; that is, in the middle-level loop traversing the first-dimensional index, the value range of the first-dimensional index is set to j from 0 to N-1.

[0148] However, since the LWE private key is a binary private key, based on the binary private key characteristics, when the client generates the GLWE private key, it can replace the first n bits of each polynomial in the GLWE private key with the LWE key. In this way, the switching operation of the first n bits can be omitted when switching the private key, thereby improving the efficiency of the private key switching operation.

[0149] Based on this, in some embodiments of the present invention, the value range of j is n to N-1; that is, in the k polynomials of the GLWE private key, when the first n polynomial coefficients in each polynomial are the same as the n-bit key coefficients in the LWE private key, in the middle-level loop traversing the first dimension index, the value range of the first dimension index is set to j from n to N-1.

[0150] In the inner loop (INNER_LOOP), the second dimension index of the LWE ciphertext in the private key is traversed by k. By right shifting and decomposing the mask decomp mask The operation extracts the decomposition coefficient val of the kth segment from the intermediate ciphertext component tlwe. When the decomposition coefficient val is non-zero, the adjustment item is located from the private key switching key through v1, v2 and v3, avoiding unnecessary operations and improving efficiency.

[0151] Due to the optimization of the loop structure, the three-layer tight loop of the private key switching unit meets the "perfect loop" requirement in HLS, and the outer loop is automatically flattened to form a large loop structure. Specifically, the three-layer loop structure of the key switching unit can be expressed as follows:

[0152]

[0153] Where C out[i] represents the i-th element in the output ciphertext after the private key switching operation; b0 represents the constant term in the low-noise ciphertext; δ i，n represents the Kronecker function, which is 1 when i=n and 0 otherwise; ksk l Indicates the decomposition level of the private key switching key; ksk w Indicates the number of decomposition bits of the private key switching key; KSK[i, j, k, val] represents the adjustment item in the private key switching key.

[0154] Specifically, a private key switching unit extracts and accumulates corresponding adjustment items from a private key switching key to complete the conversion of a low-noise ciphertext and generate a low-noise ciphertext compatible with an LWE private key, including: recombining ciphertext components in the low-noise ciphertext to generate an intermediate ciphertext component; constructing an initial output ciphertext, placing a constant item in the low-noise ciphertext as an initial value at the last bit of the initial output ciphertext, and setting other positions to 0; traversing the index, first dimension index, and second dimension index of the initial output ciphertext in sequence through three layers of nested loops with fixed ranges, and extracting corresponding adjustment items from the private key switching key based on the conditional judgment of the non-zero decomposition coefficients extracted from the intermediate ciphertext components, and accumulating them to the corresponding positions in the initial output ciphertext to generate a low-noise ciphertext compatible with an LWE private key.

[0155] After completing all homomorphic gate operations, the final low-noise ciphertext generated is returned to the client for decryption by the client using the LWE private key.

[0156] Specifically, the client receives the low-noise ciphertext returned by the service In the case of , the local private key LWE private key s is used for decryption to obtain the homomorphic calculation result. The decryption process is expressed as follows:

[0157]

[0158] Where m1 represents the result of homomorphic computation; b represents the constant term in the low-noise ciphertext returned by the server; s represents the client's local LWE private key; q represents the polynomial ring The modulus of .

[0159] In summary, the ciphertext processing method under fully homomorphic encryption based on FPGA provided in this embodiment can solve the problem of low ciphertext processing efficiency of existing ciphertext processing methods; the client's LWE private key is constructed using a sparse binary vector and divided into multiple independent private key blocks. The key coefficients in the same private key block are logically associated, while different private key blocks are independent of each other, and each private key block contains at most one non-zero element, thereby reducing the possible value combinations in each private key block from the original 2 LThe number of blind rotations is reduced to L+1. In this way, in subsequent blind rotation operations, the blind rotation operations are performed in parallel according to the private key block groups. Each group only needs to execute the blind rotation operation parameters in L+1, which greatly reduces the computational complexity of the blind rotation operation, improves the efficiency of the blind rotation operation, and thus improves the efficiency of ciphertext processing. At the same time, the blind rotation operation results corresponding to each group are aggregated into one blind rotation output. In this way, in the outer product operation, multiple outer product operations originally performed sequentially will also be aggregated into one outer product operation, which greatly reduces the complexity of the outer product operation, thereby further improving the efficiency of ciphertext processing.

[0160] In some embodiments of the present invention, the traditional non-fixed-range loop structure in the private key switching process is reconstructed into a three-layer fixed-range nested loop structure to adapt to HLS tool optimization. While reducing the complexity of the private key switching calculation, it can adapt to FPGA hardware optimization and reduce the calculation time of the private key switching, thereby further improving the efficiency of ciphertext processing.

[0161] In some embodiments of the present invention, by leveraging the characteristics of binary block keys, n bits of the LWE private key are reused in each polynomial in the GLWE private key. This allows for eliminating redundant calculations of the first n bits during the private key switching process, reducing the computational time required for private key switching and further improving the efficiency of ciphertext processing.

[0162] In one example, a simulation and comparative experiment was conducted on the noise refresh operation in ciphertext processing methods using FPGA-based fully homomorphic encryption. The experimental platform consisted of a field-programmable gate array (FPGA) development board and a personal computer (PC). The FPGA integrated four ARM cores and FPGA logic units. This experimental platform fully leveraged the advantages of the ARM cores and FPGA for efficient data processing and parallel computing.

[0163] The parameter settings for the ciphertext noise refresh operation in this embodiment are shown in Table 3.

[0164]

[0165] Table 3

[0166] In Table 3, L represents the number of elements in each private key block in the binary block private key LWE private key; n represents the dimension of the LWE private key, k represents the dimension of the GLWE private key, β and l b are parameters related to polynomial decomposition, representing the cardinality and decomposition level of the polynomial decomposition.

[0167] Parameter set (I) has a security strength of 80 bits, while parameter set (II) has larger parameters and a security strength of 128 bits. Parameter sets (III), (IV), and (V) have a 128-bit encryption strength. They use binary block key technology to generate keys that conform to special rules. To ensure encryption strength, the parameters in parameter sets (III), (IV), and (V) are larger than those in parameter sets (I) and (II).

[0168] For each parameter set, this embodiment conducts experiments with different parallel numbers γ of key expansion units to measure their delay time, throughput, and hardware resource consumption.

[0169] The comparison methods in this application include three categories: CPU-based methods, GPU-based methods, and FPGA-based methods. The different types of implementation platforms are shown in Table 4:

[0170]

[0171] Table 4

[0172] As shown in Table 4, CPU-based methods include the Concrete method and the Blockkey-TFHE method. The Concrete method is an implementation of the original TFHE scheme without using binary private key block technology. The Blockkey-TFHE method uses binary private key block technology to accelerate the original TFHE scheme.

[0173] GPU-based methods include the cuFHE method, which uses CUDA to implement TFHE ciphertext noise refresh operations and does not support key expansion operations.

[0174] FPGA-based methods include the SPSL method and the YKP method. The SPSL-based method implements vector machine operations based on TFHE, but does not optimize polynomial multiplication or consider parallel computing, resulting in low execution efficiency.

[0175] The YKP method is implemented using HLS high-level synthesis. A parameterized key expansion unit that supports parallelism is designed, which achieves good acceleration effects. However, as the expansion coefficient increases, the situations that the key expansion unit needs to handle increase exponentially, and the resources consumed also increase accordingly.

[0176] The evaluation indicators used in this embodiment include the following four categories:

[0177] The first category is equivalent resource consumption (ERC).

[0178] Equivalent resource consumption is used to measure the comprehensive resource consumption of a method. FPGAs have multiple types of resources, such as lookup tables (LUTs), flip-flops (FFs), and digital signal processing units (DSPs). It's difficult to evaluate a method's resource consumption using only one resource.

[0179] This embodiment combines the above-mentioned resource types and calculates equivalent resource consumption according to the method in Table 5, thereby more comprehensively reflecting the resource consumption of the hardware design.

[0180]

[0181] Table 5

[0182] The second category is Performance Resource Factor (PRF).

[0183] The performance resource balance factor is used to measure the balance between method latency and resource consumption. A larger value indicates a better balance between performance and resource consumption. It is calculated as follows:

[0184]

[0185] Where f is the clock frequency, Mem is the on-chip memory consumption, and latency is the method delay.

[0186] The third category is the number of ciphertext noise refresh operations per second (Bootstrapping Per Second, BPS).

[0187] The number of ciphertext noise refresh operations per second is used to measure the throughput of the method. A higher value of this indicator indicates a higher throughput of the method.

[0188] Table 6 shows the comparison results of different methods under different parameter sets and different key expansion unit parallelism numbers γ:

[0189]

[0190] Table 6

[0191] Table 6 shows that compared to other methods, the BKBM method based on the noise refresh operation proposed in this embodiment is limited by bandwidth and has lower throughput than cuFHE. However, this method achieves the best results in terms of latency, equivalent resource consumption, and resource-performance balance. As the number of parallel computations in the key expansion unit increases, the latency of this method gradually decreases. This fully demonstrates the effectiveness of this method.

[0192] Corresponding to the above method, the present invention also provides an FPGA-based ciphertext processing device under fully homomorphic encryption, which includes a computer device, the computer device includes a processor and a memory, the memory stores computer instructions, and the processor is used to execute the computer instructions stored in the memory. When the computer instructions are executed by the processor, the device implements the steps of the FPGA-based ciphertext processing method under fully homomorphic encryption in the above method embodiment.

[0193] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the ciphertext processing method under FPGA-based fully homomorphic encryption in the above-mentioned method embodiment. The computer-readable storage medium can be a tangible storage medium, such as a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the art.

[0194] An embodiment of the present invention also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the ciphertext processing method under FPGA-based fully homomorphic encryption in the above method embodiment.

[0195] It should be understood by those skilled in the art that the various exemplary components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software or a combination of the two. Whether it is specifically performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of the present invention. When implemented in hardware, it can be, for example, an electronic circuit, an application specific integrated circuit (ASIC), appropriate firmware, a plug-in, a function card, etc. When implemented in software, the elements of the present invention are programs or code segments that are used to perform the required tasks. The program or code segment can be stored in a machine-readable medium, or transmitted on a transmission medium or a communication link via a data signal carried in a carrier.

[0196] It should be understood that the present invention is not limited to the specific configurations and processes described above and illustrated in the figures. For the sake of brevity, a detailed description of known methods is omitted. In the above embodiments, several specific steps are described and illustrated as examples. However, the method of the present invention is not limited to the specific steps described and illustrated. Those skilled in the art may make various changes, modifications, and additions, or change the order of the steps after understanding the spirit of the present invention.

[0197] In the present invention, features described and / or illustrated for one embodiment may be used in the same or similar manner in one or more other embodiments, and / or combined with or replace features of other embodiments.

[0198] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations to the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A ciphertext processing method under fully homomorphic encryption based on FPGA, characterized in that: Used on a server, the server includes a private key switching unit based on FPGA; the method includes the following steps: Performing a homomorphic gate operation on a GLWE private key provided by a client and a ciphertext to be processed to obtain an intermediate processed ciphertext; wherein the ciphertext to be processed is generated by the client by encrypting the ciphertext using the LWE private key; the LWE private key includes at least one private key block; each private key block is a binary vector of length L, containing at most one non-zero bit and including L+1 value combinations, each value combination corresponding to a blind rotation operation parameter; The intermediate processed ciphertext is ciphered using the noise refresh key and private key switching key provided by the client to generate a low-noise ciphertext; the noise refresh key includes the GLWE ciphertext generated by encrypting each bit of the LWE private key with the GLWE private key, including a key group corresponding one-to-one to the private key block, and each key group corresponds to L+1 blind rotation operation parameters; during the ciphertext processing, the blind rotation operation parameters corresponding to each key group are executed in parallel, and the execution results are aggregated to obtain a blind rotation output, which is subjected to an outer product operation with the intermediate processed ciphertext to obtain a noise refresh ciphertext; through the private key switching unit, the corresponding adjustment items are extracted and accumulated from the private key switching key, and the noise refresh ciphertext is adjusted to a low-noise ciphertext compatible with the LWE private key, so that the client can use the LWE private key for decryption.

2. The method according to claim 1, characterized in that The private key switching key includes an LWE ciphertext generated by encrypting each bit of the GLWE private key with the LWE private key; the GLWE private key includes k polynomials, each polynomial includes N polynomial coefficients, and each polynomial coefficient is decomposed into multiple levels of LWE ciphertext according to a preset decomposition level; each LWE ciphertext in the private key switching key includes a first dimension index and a second dimension index; wherein the first dimension index is used to identify the position of the polynomial coefficient corresponding to the LWE ciphertext in the GLWE private key; and the second dimension index is used to identify the decomposition level; The extracting and accumulating corresponding adjustment items from the private key switching key to adjust the noise refresh ciphertext to a low-noise ciphertext compatible with the LWE private key includes: Recombining the ciphertext components in the noise refresh ciphertext to generate an intermediate ciphertext component; Constructing an initial output ciphertext, placing the constant term in the noise refresh ciphertext as the initial value in the last bit of the initial output ciphertext, and setting the other bits to 0; The index of the initial output ciphertext, the first dimension index, and the second dimension index are traversed in sequence through three layers of fixed-range nested loops, and based on the conditional judgment of the non-zero decomposition coefficients extracted from the intermediate ciphertext component, the corresponding adjustment item is extracted from the private key switching key and accumulated to the corresponding position in the initial output ciphertext to generate a low-noise ciphertext compatible with the LWE private key.

3. The method according to claim 2, characterized in that The LWE private key includes n key coefficients, and N is greater than n; among the k polynomials of the GLWE private key, when the first n polynomial coefficients in each polynomial are the same as the n key coefficients, in the loop of traversing the first dimension index, the value range of the first dimension index is set to be from n to N-1.

4. The method according to claim 1, wherein The server also includes several independent computing units; The step of executing the blind rotation operation parameters corresponding to each key group in parallel and aggregating the execution results to obtain a blind rotation output includes: Assigning the key group to independent computing units, each computing unit selecting corresponding blind rotation operation parameters to execute according to the assigned key group, and obtaining the execution results of each computing unit; The execution results corresponding to the same key group are accumulated in parallel through a multi-level addition tree structure to obtain at least one intermediate result and further aggregated into the blind rotation output.

5. The method according to claim 4, characterized in that Before ciphertext processing is performed on the intermediate processed ciphertext using the noise refresh key and the private key switching key to generate the low-noise ciphertext, the method further includes: Pre-generating the L+1 blind rotation operation parameters based on the number of key coefficients of each key group; The L+1 blind rotation operation parameters are loaded into each computing unit.

6. The method according to claim 1, characterized in that The homomorphic gate operation includes at least one homomorphic gate evaluation; wherein the homomorphic gate evaluation includes a multiplication gate evaluation or an addition gate evaluation; Before ciphertext processing is performed on the intermediate processed ciphertext using the noise refresh key and the private key switching key to generate the low-noise ciphertext, the method further includes: When the current homomorphic gate evaluation is a multiplication gate evaluation, the ciphertext processing operation is performed; In the case where the current homomorphic gate evaluation is an addition gate evaluation, if the noise of the intermediate processed ciphertext exceeds a preset noise upper limit, the ciphertext processing operation is performed; otherwise, a subsequent homomorphic gate operation is performed.

7. The method according to claim 1, characterized in that The private key switching unit is integrated with high-level synthesis tool instructions, and the high-level synthesis tool instructions include loop expansion instructions, pipeline instructions or memory allocation instructions.

8. A ciphertext processing device under fully homomorphic encryption based on FPGA, comprising a processor, a memory, and a computer program / instruction stored in the memory, characterized in that: The processor is configured to execute the computer program / instructions. When the computer program / instructions are executed, the device implements the steps of the method according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instruction stored thereon, characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images