Fpga-based ciphertext processing method, device and program product under full homomorphic encryption

Abstract

The application provides a ciphertext processing method, device and program product based on FPGA full homomorphic encryption, which comprises the following steps: performing homomorphic gate operation according to a GLWE private key provided by a client and a to-be-processed ciphertext to obtain intermediate processing ciphertext; the to-be-processed ciphertext is generated by encryption through an LWE private key; the LWE private key comprises at least one binary private key block; each private key block comprises L+1 value combinations; the intermediate processing ciphertext is processed through ciphertext processing by using a noise refreshing key and a private key switching key; the noise refreshing key comprises a key group corresponding to the private key block in one-to-one correspondence, and each key group corresponds to L+1 blind rotation operation parameters; during the processing, the blind rotation operation parameters of each key group are executed in parallel, the execution results are aggregated to obtain blind rotation output, and the blind rotation output is subjected to outer product operation with the intermediate processing ciphertext to obtain noise refreshing ciphertext; an adjustment item corresponding to the noise refreshing ciphertext is extracted from the private key switching key and accumulated, and the noise refreshing ciphertext is adjusted into low-noise ciphertext compatible with the LWE private key. The application can improve the efficiency of ciphertext processing.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of homomorphic encryption technology, and in particular to a ciphertext processing method, device and program product under full homomorphic encryption based on FPGA. BACKGROUND

[0002] With the rapid development of cloud computing, big data and artificial intelligence technology, data has become the core resource to promote social progress and business innovation. However, the outsourcing computing mode of data (such as relying on third-party servers to process sensitive data) brings serious privacy leakage risk. Traditional encryption technology cannot support direct calculation on encrypted data, while the emergence of fully homomorphic encryption (FHE) technology provides a breakthrough solution to this problem. Fully homomorphic encryption allows arbitrary computation on ciphertext without decryption, realizing "data available and invisible", but the high computational complexity limits its practical application. Therefore, it is urgent to design an efficient ciphertext processing method under full homomorphic encryption to ensure privacy security while improving computational efficiency.

[0003] In the existing full homomorphic encryption technology, ciphertext processing includes ciphertext calculation processing and ciphertext noise refreshing. Among them, the noise refreshing operation is usually divided into two stages: blind rotation operation and key switching operation. Blind rotation operation refers to adjusting the phase of ciphertext through complex polynomial multiplication to eliminate the interference of noise on the calculation result; key switching operation refers to converting ciphertext into the form under the target key through multiple layers of scalar multiplication, ensuring the compatibility of subsequent calculation, and ensuring that the ciphertext can be correctly decrypted after multiple calculations.

[0004] However, in the traditional ciphertext processing process, the blind rotation operation involves high-order polynomial multiplication, resulting in extremely high computational complexity, which significantly increases the processing time; at the same time, the key switching operation also needs to perform a large number of scalar multiplication operations, which are usually nested in multiple layers of loops, making the number of loops large, further slowing down the speed of the entire ciphertext processing, and finally leading to low ciphertext processing efficiency. SUMMARY

[0005] In view of this, the embodiments of the present application provide a ciphertext processing method, device and program product under full homomorphic encryption based on FPGA to eliminate or improve one or more defects in the prior art. To solve the problem of low ciphertext processing efficiency of the existing ciphertext processing method.

[0006] One aspect of the present application provides a ciphertext processing method under full homomorphic encryption based on FPGA, for a server, the server comprising a private key switching unit based on FPGA; the method comprises the following steps:

[0007] Performing homomorphic gate operation according to the GLWE private key provided by the client and the to-be-processed ciphertext to obtain intermediate processing ciphertext; wherein the to-be-processed ciphertext is generated by the client through LWE private key encryption; the LWE private key includes at least one private key block; each private key block is a binary vector with a length of L, and at most includes one non-zero bit, including L+1 value combinations, and each value combination corresponds to a blind rotation operation parameter;

[0008] Using the noise refresh key and the private key switching key provided by the client to perform ciphertext processing on the intermediate processing ciphertext to generate low-noise ciphertext; the noise refresh key includes GLWE ciphertext generated by encrypting each bit of the LWE private key, includes a key group corresponding to each private key block, and each key group corresponds to L+1 blind rotation operation parameters; in the ciphertext processing process, the blind rotation operation parameters corresponding to each key group are executed in parallel, the execution results are aggregated to obtain blind rotation output, and the blind rotation output is subjected to one-time outer product operation with the intermediate processing ciphertext to obtain noise refresh ciphertext; through the private key switching unit, corresponding adjustment items are extracted from the private key switching key and accumulated, and the noise refresh ciphertext is adjusted to low-noise ciphertext compatible with the LWE private key, so that the client uses the LWE private key to decrypt.

[0009] In some embodiments of the application, the private key switching key includes LWE ciphertext generated by encrypting each bit of the GLWE private key; the GLWE private key includes k polynomials, each polynomial includes N polynomial coefficients, and each polynomial coefficient is decomposed into LWE ciphertexts of multiple levels according to a preset decomposition level; each LWE ciphertext in the private key switching key includes a first dimension index and a second dimension index; wherein the first dimension index is used to identify the position of the LWE ciphertext corresponding to the polynomial coefficient in the GLWE private key; and the second dimension index is used to identify the decomposition level.

[0010] Extracting and accumulating corresponding adjustment items from the private key switching key to adjust the noise refresh ciphertext to low-noise ciphertext compatible with the LWE private key, including:

[0011] Reorganizing the ciphertext components in the noise refresh ciphertext to generate intermediate ciphertext components;

[0012] Constructing initial output ciphertext, placing the constant term in the noise refresh ciphertext as the initial value in the last bit of the initial output ciphertext, and 0 in other positions;

[0013] Iterating the indexes of the initial output ciphertext, the first dimension indexes and the second dimension indexes in turn through three layers of fixed-range nested loops, and according to the condition judgment of the non-zero decomposition coefficients extracted from the intermediate ciphertext components, extracting the corresponding adjustment items from the private key switching key and accumulating them in the corresponding positions of the initial output ciphertext to generate low-noise ciphertext compatible with the LWE private key.

[0014] In some embodiments of the present application, the LWE private key includes n key coefficients, and N is greater than n; in the k polynomials of the GLWE private key, in the case that the first n polynomial coefficients of each polynomial are the same as the n key coefficients, the value range of the first dimension index is set to from n to N-1 in the loop of traversing the first dimension index.

[0015] In some embodiments of the present application, the server includes several independent computing units.

[0016] The blind rotation operation parameters corresponding to each key group are executed in parallel, and the execution results are aggregated to obtain the blind rotation output, including:

[0017] The key groups are assigned to independent computing units, and each computing unit selects the corresponding blind rotation operation parameters for execution according to the assigned key group to obtain the execution results of each computing unit;

[0018] The execution results corresponding to the same key group are added in parallel through a multi-level addition tree structure to obtain at least one intermediate result and further aggregate it into a blind rotation output.

[0019] In some embodiments of the present application, before using the noise refreshing key and the private key switching key to perform ciphertext processing on the intermediate processing ciphertext to generate low-noise ciphertext, the following steps are further included:

[0020] Based on the number of key coefficients of each key group, L+1 blind rotation operation parameters are pre-generated;

[0021] The L+1 blind rotation operation parameters are loaded into each computing unit.

[0022] In some embodiments of the present application, the homomorphic gate operation includes at least one homomorphic gate evaluation; wherein the homomorphic gate evaluation includes a multiplication gate evaluation or an addition gate evaluation;

[0023] Before using the noise refreshing key and the private key switching key to perform ciphertext processing on the intermediate processing ciphertext to generate low-noise ciphertext, the following steps are further included:

[0024] In the case that the current homomorphic gate evaluation is a multiplication gate evaluation, the ciphertext processing operation is executed;

[0025] In the case that the current homomorphic gate evaluation is an addition gate evaluation, in the case that the noise of the intermediate processing ciphertext exceeds the preset upper limit of noise, the ciphertext processing operation is executed; otherwise, the subsequent homomorphic gate operation is executed.

[0026] In some embodiments of the present application, the private key switching unit is integrated with advanced synthesis tool instructions, and the advanced synthesis tool instructions include loop unrolling instructions, pipeline instructions or memory allocation instructions.

[0027] Another aspect of the present application provides a FPGA-based ciphertext processing device under full homomorphic encryption, comprising a processor, a memory and a computer program / instruction stored on the memory, the processor being configured to execute the computer program / instruction, and the computer program / instruction, when executed, causing the device to implement the steps of the FPGA-based ciphertext processing method under full homomorphic encryption as described above.

[0028] Another aspect of the present application provides a computer-readable storage medium having a computer program / instruction stored thereon, the computer program / instruction, when executed by a processor, implementing the steps of the FPGA-based ciphertext processing method under full homomorphic encryption as described above.

[0029] Another aspect of the present application provides a computer program product comprising a computer program / instruction, the computer program / instruction, when executed by a processor, implementing the steps of the FPGA-based ciphertext processing method under full homomorphic encryption as described above.

[0030] The FPGA-based ciphertext processing method and device under full homomorphic encryption of the present application can solve the problem of low ciphertext processing efficiency of the existing ciphertext processing method. The LWE private key of the client is constructed by using a sparse binary vector, and is divided into a plurality of independent private key blocks. The key coefficients in the same private key block are logically associated, while the private key blocks are independent of each other, and each private key block contains at most one non-zero element. Thus, the possible value combinations of each private key block are reduced from 2 L In the subsequent blind rotation operation, the blind rotation operation is performed in parallel according to the private key block grouping, and each group only needs to perform L+1 blind rotation operation parameters, which greatly reduces the calculation complexity of the blind rotation operation, improves the efficiency of the blind rotation operation, and further improves the ciphertext processing efficiency. Meanwhile, the blind rotation operation results corresponding to each group are aggregated into one blind rotation output. Thus, in the outer product operation, the original multiple sequentially executed outer product operations are also aggregated into one outer product operation, which greatly reduces the complexity of the outer product operation, thereby further improving the ciphertext processing efficiency.

[0031] In some embodiments of the present application, the traditional non-fixed range loop structure in the private key switching process is restructured into a three-layer fixed range nested loop structure to adapt to the HLS tool optimization. The calculation complexity of the private key switching can be reduced while adapting to the FPGA hardware optimization, reducing the calculation time of the private key switching, and further improving the ciphertext processing efficiency.

[0032] In some embodiments of the present application, the n-bit data of the LWE private key is multiplexed in each polynomial in the GLWE private key by using the characteristics of the binary block key. Thus, the redundant calculation steps of the first n bits can be omitted in the private key switching process, the calculation time of the private key switching is reduced, and the efficiency of the ciphertext processing is further improved.

[0033] Additional advantages, objects, and features of the application will be set forth in part by the description that follows, and will become apparent to those skilled in the art upon examination of the following detailed description and drawings in which

[0034] Those skilled in the art will appreciate that the objects and advantages of the application can be implemented in a variety of ways, and that the application can be implemented using other structures and processes in addition to those specifically described in this specification. BRIEF DESCRIPTION OF DRAWINGS

[0035] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments of the application and together with the description, serve to explain the principles of the application.

[0036] Figure 1 Flow chart of a ciphertext processing method based on FPGA homomorphic encryption provided by an embodiment of the application.

[0037] Figure 2 Schematic diagram of generating LWE private key based on binary block provided by an embodiment of the application.

[0038] Figure 3 Schematic diagram of interaction between server and client provided by an embodiment of the application.

[0039] Figure 4 Schematic diagram of noise refreshing operation provided by an embodiment of the application.

[0040] Figure 5 Schematic diagram of noise refreshing operation provided by an embodiment of the application. DETAILED DESCRIPTION

[0041] In order to make the objects, technical solutions and advantages of the application clearer, the following will further describe the application with reference to the embodiments and drawings. Herein, the illustrative embodiments of the application and their descriptions are used to explain the application, but not as a limitation to the application.

[0042] It should be noted that, in order to avoid the application being obscured by unnecessary details, only the structures and / or processing steps closely related to the solutions according to the application are shown in the drawings, and other details not closely related to the application are omitted.

[0043] It should be emphasized that the terms "comprise / comprising" when used in this specification are taken to specify the presence of stated features, elements, steps or components but do not preclude the presence or addition of one or more other features, elements, steps, components, or groups thereof.

[0044] It should also be noted herein that the term "connected" can mean not only direct connection, but also indirect connection with an intermediate object, if not otherwise specified.

[0045] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. In the drawings, the same reference numerals represent the same or similar components, or the same or similar steps.

[0046] The FPGA-based full homomorphic encryption ciphertext processing method provided in the present application will be described in detail below.

[0047] As shown in Figure 1 The embodiment of the present application provides a FPGA-based full homomorphic encryption ciphertext processing method. The embodiment takes the method used in the server as an example for illustration. The server can be a mobile phone, a computer, a server or a server cluster, and the embodiment does not limit the implementation of the server. The method comprises at least steps S101-S102:

[0048] Step S101: performing homomorphic gate operation according to the GLWE private key provided by the client and the ciphertext to be processed, to obtain intermediate processing ciphertext.

[0049] The client is a terminal device configured to establish a communication connection with the server, and is adapted to send the ciphertext to be processed and the corresponding key to the server, including but not limited to a mobile phone or a computer terminal device.

[0050] In some embodiments of the present application, the client generates a local private key through a binary block and a fully homomorphic encryption (FHE) scheme, including an LWE private key (Learning With Errors private key) and a GLWE private key (General Learning With Errors private key).

[0051] The LWE private key is a binary vector of length n, including at least one private key block, each private key block being a sparse binary vector of length L, each private key block containing at most one non-zero bit, including L+1 value combinations. In the case where the number of private key blocks is Z, it satisfies n=Z*L.

[0052] For example, referring to Figure 2 Take L=2 as an example; the client generates an LWE private key of length n based on a binary block, the number of private key blocks Z=n / 2, each private key block includes 2 elements, and at most one non-zero element; as Figure 2As shown, the first private key block includes 1 and 0, the second private key block includes 0 and 0, the third private key block includes 0 and 1, the Z-1th private key block includes 0 and 0, and the Zth private key block includes 0 and 1.

[0053] Specifically, the LWE private key s is represented by the following formula:

[0054]

[0055] In the formula, Let {0,1} represent the set; s0 represents the first private key coefficient in the LWE private key; s1 represents the second private key coefficient in the LWE private key; s n-1 This represents the nth private key coefficient in the LWE private key; n represents the dimension of the LWE private key, that is, the number of coefficients in the LWE private key.

[0056] In some embodiments of the present invention, the LWE private key is used to encrypt private data, generating ciphertext to be processed. For plaintext information... The ciphertext ct to be processed is obtained by encrypting using the LWE private key s, as expressed by the following formula:

[0057]

[0058] In the formula, ct represents the ciphertext to be processed; LWE s (m) represents the encryption operation of plaintext information m using LWE private key s based on the Learning With Errors (LWE) problem; a = (a0, a1, ..., a n-1 ) represents a mask vector, where each component of the mask vector a belongs to an integer ring modulo q. During the encryption process, these values ​​are obtained through uniform random sampling and multiplied with the LWE private key s before being used in the calculation; b is a constant term in the ciphertext ct to be processed, which is determined by the mask vector a, the plaintext information m and the noise e.

[0059] The GLWE private key consists of k polynomials, each containing N polynomial coefficients, used to encrypt polynomial information. Specifically, the GLWE private key can be represented by the following formula:

[0060]

[0061] In the formula, S represents the GLWE private key; S k-1 (X) represents the k-th polynomial in the GLWE private key. Each polynomial is in the ring. As defined above, belonging to d represents the dimension of the GLWE ciphertext, and the GLWE ciphertext is a ciphertext obtained by encrypting a plaintext using a GLWE key.

[0062]

[0063] wherein CT represents the GLWE ciphertext; GKWE s (M) represents a process of encrypting a polynomial plaintext M using a GLWE private key S; A=(A0(X),...,A k-1 (X) represents a mask vector, belonging to a polynomial ring of a modulus q In the encryption process, each component in the mask vector is obtained by random uniform sampling; represents a d-dimensional vector space, wherein each component is a polynomial in B(X) represents a constant term; M(X) represents a plaintext polynomial; and E(X) represents a small random noise polynomial.

[0064] After generating the local private key, the client continues to generate keys required for the server to perform ciphertext processing, including a noise refreshing key (Boot Strapping Key, BSK) and a private key switching key (Key Switching Key, KSK).

[0065] In some embodiments of the present application, the noise refreshing key and the private key switching key are generated using an LWE key and a GLWE key.

[0066] The noise refreshing key includes GLWE ciphertexts generated by encrypting each bit of the LWE private key using a GLWE private key. Specifically, each bit in the LWE private key s is encrypted into a GGSW (Gentry Gorbunov Halevi SmartWare) ciphertext by the GLWE private key S.

[0067] The GGSW ciphertext is an extension of the GWLE ciphertext. In the encryption process, the information to be encrypted is first decomposed, the decomposed content is encrypted, and the obtained multiple GLWE ciphertexts are combined to obtain a GGSW ciphertext.

[0068] In some embodiments of the present application, since the LWE private key includes n elements, the noise refreshing key includes n GGSW ciphertexts, which are represented by the following formula:

[0069]

[0070] wherein, BSK0 represents the first GGSW ciphertext; BSK1 represents the second GGSW ciphertext; BSK2 represents the second GGSW ciphertext; BSK n-1 represents the nth GGSW ciphertext; represents a polynomial ring, the polynomial size is N, the modulus is q, and is defined as is simplified as x N +1; d represents the dimension of the GLWE ciphertext; l b represents the decomposition level of the noise refresh key; n represents the total number of GGSW ciphertexts.

[0071] In some embodiments of the present application, the private key switching key includes an LWE private key encrypted for each bit of a GLWE private key to generate an LWE ciphertext.

[0072] In the process of encrypting the GLWE private key by the LWE private key, each polynomial coefficient in the GLWE private key is disassembled into multiple levels of LWE ciphertexts according to a preset decomposition level.

[0073] Specifically, each polynomial coefficient of the GLWE key S is encrypted into ksk l LWE ciphertexts, and therefore, the private key switching key includes kN×ksk l LWE ciphertexts. Wherein, ksk l represents the decomposition level of the private key switching key.

[0074] Each LWE ciphertext in the private key switching key includes a first dimension index and a second dimension index; wherein, the first dimension index is used to identify the position of the polynomial coefficient corresponding to the LWE ciphertext in the GLWE private key; and the second dimension index is used to identify the decomposition level.

[0075] Specifically, the private key switching key is represented by the following formula:

[0076]

[0077] wherein, KSK represents the private key switching key; KSK (0，0) represents the first coefficient in the private key switching key; KSK (0，1) represents the second coefficient in the private key switching key; represents the kN×ksk l coefficient in the private key switching key; d represents the dimension of the GLWE ciphertext obtained by encrypting the GLWE private key; the GLWE private key is a set of k polynomials, N represents the number of coefficients of each polynomial in the GLWE private key; ksk l represents the decomposition level of the private key switching key; a polynomial ring representing modulo q; n+1 represents the dimension +1 of the LWE ciphertext, since the LWE ciphertext is usually composed of a vector of length n and an additional scalar, so the total dimension is n+1.

[0078] After generating the noise refresh key and the private key switching key, the client encrypts the private data using the LWE private key in the local private key, to generate the to-be-processed ciphertext c=(a0, a1,..., an, b). n-1

[0079] After generating the to-be-processed ciphertext, as shown in Figure 3 , the client uploads the to-be-processed ciphertext, the ciphertext noise refresh key and the private key switching key to the server, and completes the complex computing task by means of the computing power of the server.

[0080] After receiving the noise refresh key, the private key switching key and the to-be-processed ciphertext, the server stores the to-be-processed ciphertext corresponding to the noise refresh key and the private key switching key.

[0081] In the process of executing the computing task, the server first takes out the to-be-processed ciphertext to initialize the accumulator. The accumulator (ACC) refers to a data structure used to store the intermediate processing ciphertext in the process of processing the ciphertext.

[0082] In the process of initializing the accumulator, a preset polynomial v is first calculated, which is defined in a polynomial ring . Specifically, the polynomial v can be represented by the following formula:

[0083]

[0084] In the formula, N represents the size of the polynomial ring, and X represents the variable, i.e. the base of the polynomial.

[0085] After calculating the polynomial v, the coefficients of the to-be-processed ciphertext are quantized to obtain the quantization result. The quantization is used to convert the floating-point number into an integer, so as to facilitate the subsequent modulo operation and hardware implementation. The quantization result includes and i is greater than or equal to 0 and less than n.

[0086] After obtaining the quantization result, the accumulator is initialized by the polynomial v and the in the quantization result. Specifically, the initialization process can be represented by the following formula:

[0087]

[0088] In the formula, ACC represents the accumulator; ​denotes the result of the quantization process; v denotes a polynomial v; X denotes a variable, i.e. the base of the polynomial; N denotes a polynomial ring .

[0089] After the initialization of the accumulator ACC is completed, the server performs a homomorphic gate operation according to the GLWE private key provided by the client and the to-be-processed ciphertext, to obtain intermediate processing ciphertext.

[0090] The homomorphic gate operation refers to an operation of directly performing calculation on the to-be-processed ciphertext in homomorphic calculation, and includes at least one gate circuit evaluation. The gate circuit refers to a calculation unit composed of an additive gate and a multiplicative gate; and the gate circuit evaluation refers to performing calculation of the additive gate and the multiplicative gate in an encrypted state, including additive gate (Additive Gate) evaluation and multiplicative gate (Multiplicative Gate) evaluation.

[0091] In homomorphic encryption calculation, the noise growth characteristics of different gate circuit evaluations and the ciphertext processing strategy have significant differences, specifically including the following two cases:

[0092] Firstly, in the additive gate evaluation, the noise in the ciphertext is linearly superimposed, and in the case that the input ciphertext noise is η1 and η2, the output noise is η1+η2.

[0093] At this time, the ciphertext processing strategy includes: performing a ciphertext processing operation in the case that the noise of the intermediate processing ciphertext exceeds a preset noise upper limit (Noise Budget Threshold, Bmax) after the additive gate evaluation; otherwise, performing subsequent homomorphic gate operation.

[0094] Secondly, in the multiplicative gate evaluation, the noise in the ciphertext is quadratic expansion, and in the case that the input ciphertext noise is η1 and η2, the output noise is η1×η2.

[0095] At this time, the ciphertext processing strategy includes: performing a ciphertext processing operation after the multiplicative gate evaluation.

[0096] In step S102, the intermediate processing ciphertext is subjected to a ciphertext processing operation using the noise refresh key and the private key switching key provided by the client, to generate low-noise ciphertext.

[0097] As shown in FIG. Figure 4 In some embodiments of the present application, the ciphertext processing is a bootstrapping operation, including a blind rotation operation and a key switching operation.

[0098] The intermediate processing ciphertext is taken as the input ciphertext of the blind rotation operation, and is represented by the following formula:

[0099]

[0100] For ciphertext C in The core of blind spin operations lies in homomorphic computation:

[0101]

[0102] In the formula, a = (a0, a1, ..., a n-1 ) represents ciphertext C in The n ciphertext coefficients; b0 represents the ciphertext C. in The constant term in; Let represent a polynomial ring modulo q; n+1 represents the dimension of the ciphertext plus 1, since LWE ciphertext typically consists of a vector of length n and a constant term, thus the total dimension is n+1; s = (s0, s1, ..., s2). n-1 ) represents the LWE key.

[0103] To prevent LWE key leakage, the LWE key is encrypted into GGSW ciphertext using the GLWE key. Therefore, in the blind spin operation, s = (s0, s1, ..., s...). n-1 The actual key is a noise refresh key.

[0104] Correspondingly, the blind spin operation is essentially a process of iteratively calculating the following formula:

[0105]

[0106] In the formula, ACC represents the state of the accumulator; Indicates the outer product operation; BSK i This represents the i-th key coefficient in the noise refresh key. In the iterative calculation, the value of i ranges from 0 to n-1. middle Indicates the quantification result X represents a variable, that is, the basis of the polynomial.

[0107] In some embodiments of the present invention, the noise refresh key BSK is generated by encrypting each bit of the LWE private key with the GLWE private key. The LWE private key is a binary block key generated based on binary blocks and a fully homomorphic scheme, including at least one private key block whose key information is independent of each other but has a certain correlation. Each private key block includes L elements, and at most one 1, with the rest being 0.

[0108] Based on this, and according to the binary properties of the LWE private key and the properties of the elements in each private key block, the possible combinations of values ​​within each private key block will be reduced from 2. L The number of possibilities is reduced to L+1, and each combination of values ​​corresponds to a blind spin operation parameter in the blind spin operation.

[0109] For example, taking L = 3 as an example. The original value combination will be reduced from 2 3 to 4 possible value combinations. The 4 possible value combinations include (0, 0, 0), (1, 0, 0), (0, 1, 0), and (0, 0, 1).

[0110] At the same time, the key group in the noise refresh key is one-to-one corresponding to the private key block in the LWE private key, so the blind rotation operation parameter corresponding to each key group will also be reduced from 2 L to L+1.

[0111] For example, taking L = 3 as an example. The blind rotation operation parameter corresponding to each key group can only have 4 cases. As shown in Table 1:

[0112]

[0113] Table 1

[0114] Referring to Table 1, in the case of including 3 elements in each private key block, each private key block can be represented as (s i ,s i+1 ,s i+2 ).

[0115] Based on this, the original homomorphic calculation can be simplified according to the binary property as:

[0116] At the same time, in order to avoid the leakage of the LWE private key, the LWE private key is replaced by the noise refresh key, and the original homomorphic calculation can be represented as:

[0117] In this way, L+1 blind rotation operation parameters corresponding to each key group can be executed in parallel. After obtaining the execution result corresponding to each key group, the execution result is aggregated to obtain the blind rotation output, and the noise in the intermediate processing ciphertext is refreshed by performing an outer product operation with the intermediate processing ciphertext, which can greatly reduce the complexity of the calculation.

[0118] Specifically, the execution result corresponding to each key group is aggregated as the blind rotation output, and an outer product operation is performed with the intermediate processing ciphertext, which can be represented by the following formula:

[0119]

[0120] In the formula, ACC represents the state of the accumulator; represents an outer product operation; BSK j represents the jth key coefficient in the noise refresh key; j∈I j represents the key index belonging to the same group.

[0121] In some embodiments of the present application, the server comprises a key expansion unit. The key expansion unit comprises a plurality of computing units for performing blind rotation operation on intermediate processed ciphertexts in parallel and refreshing the noise of the intermediate processed ciphertexts.

[0122] Alternatively, the server comprises a key expansion unit and a plurality of computing units, and the key expansion unit can call the plurality of computing units to perform blind rotation operation on intermediate processed ciphertexts in parallel and refresh the noise of the intermediate processed ciphertexts.

[0123] In some embodiments of the present application, the computing unit is designed as an independent hardware module, including a field programmable gate array (FPGA) based special circuit construction or a graphics processing unit (GPU) based special computing core construction to support efficient parallel processing.

[0124] In the key aggregation operation, the blind rotation operation parameters corresponding to each key group are processed in parallel by the computing units, and the execution results are aggregated to obtain the blind rotation output.

[0125] The computing units process all L+1 blind rotation operation parameters corresponding to each key group in parallel, and each computing unit calculates one blind rotation operation parameter (for example where BSK i is s i in the LWE private key, and the GGSW ciphertext corresponding to the blind rotation operation parameter), and then the results output by the computing units are aggregated using an addition tree to obtain the blind rotation output.

[0126] For example, refer to Figure 5 For example, when L=3, there are four blind rotation operation parameters corresponding to each key group. Four computing units are used to perform the four blind rotation operation parameters in parallel, and the execution results of the four computing units are aggregated level by level.

[0127] Specifically, the blind rotation operation parameters corresponding to each key group are executed in parallel, and the execution results are aggregated to obtain the blind rotation output, including: assigning the key groups to independent computing units, each computing unit selecting the corresponding blind rotation operation parameter for execution according to the assigned key group to obtain the execution results of each computing unit; the execution results corresponding to the same key group are added in parallel through a multi-level addition tree structure to obtain at least one intermediate result and further aggregate it into the blind rotation output.

[0128] In the outer product operation process, the blind rotation output is denoted as KAR i The outer product operation can also be represented by the following formula:

[0129]

[0130] In the formula, KAR i denotes the blind rotation output; and ACC denotes the state of the accumulator.

[0131] In addition, based on the pre-generated characteristics of the blind rotation operation in L+1, the server can pre-calculate L+1 different blind rotation operation parameters according to the number L of key coefficients of each key group. The pre-generated L+1 parameters are stored in the key group and dynamically loaded into each independent computing unit in the initialization stage.

[0132] For example, each computing unit pre-stores a complete parameter set corresponding to the key group assigned to it. When the computing unit processes the ciphertext, the pre-stored blind rotation operation parameters are directly called to quickly complete the blind rotation operation. Through the pre-generated parameters and the multi-level addition tree aggregation mechanism, the intermediate result format in each path is ensured to be uniform, thereby seamlessly accumulating and generating the final blind rotation output.

[0133] Specifically, before generating the low-noise ciphertext using the noise refresh key and the private key switching key provided by the client to process the intermediate processing ciphertext, it further includes: based on the number of key coefficients of each key group, pre-generate L+1 blind rotation operation parameters; load the L+1 blind rotation operation parameters into each computing unit.

[0134] During the process of processing the ciphertext, although the noise in the ciphertext can be refreshed by the blind rotation operation, the decryption private key corresponding to the ciphertext will also change, therefore, after the blind rotation operation, a private key switching operation needs to be performed using the private key switching key to adjust the noise refresh ciphertext, and switch the decryption private key of the noise refresh ciphertext to the LWE private key, so that the client can correctly decrypt the calculation result using the LWE private key under the condition of receiving the processed ciphertext returned by the server.

[0135] In some embodiments of the application, the server further includes a private key switching unit. After the noise in the ciphertext is refreshed by the blind rotation operation, the private key switching unit extracts and accumulates the corresponding adjustment item from the private key switching key, and adjusts the noise refresh ciphertext to low-noise ciphertext compatible with the LWE private key.

[0136] The private key switching unit is designed as an independent hardware module and is constructed based on a special circuit of a field programmable gate array (FPGA).

[0137] In actual implementation, the private key switching unit can also be constructed based on a special computing core of a graphics processing unit (GPU).

[0138] Furthermore, since FPGA design using hardware programming languages ​​is difficult and time-consuming, some embodiments of this invention employ High-Level Synthesis (HLS) tools for FPGA design to obtain the private key switching unit. The private key switching unit integrates HLS instructions, which, depending on the algorithm structure and the amount of hardware resources, include loop unrolling instructions, pipeline instructions, or memory allocation instructions, thereby enabling the construction of an efficient private key switching unit.

[0139] However, the complex loop structure with unfixed boundaries in traditional private key switching algorithms is not suitable for HLS tools. Directly using HLS tools cannot convert high-level language code into efficient hardware execution units.

[0140] Based on this, in some embodiments of the present invention, the loop structure in the private key switching unit is redesigned, and the complex loop structure with an indefinite loop boundary is changed to a three-layer loop structure with a fixed loop boundary that is more suitable for HLS tools, including an outer loop, a middle loop and an inner loop. All operations are concentrated in the inner loop so as to facilitate optimization using HLS tools.

[0141] As shown in Table 2, Table 2 is the pseudocode implementation process of the private key switching operation.

[0142]

[0143] Table 1

[0144] As shown in Table 2, in the private key switching operation, the decomposition parameter decomposition mask (decomp) is first initialized. mask Decomposition offset decomp offset Private key switching key decomposition hierarchy ksk l The number of bits (ksk) in the key to switch between private and private keys w Next, three auxiliary variables, v1, v2, and v3, are calculated, where v1 represents the logarithm related to the ciphertext dimension, v2 combines v1 with the decomposition level, and v3 combines v2 with the decomposition bit depth. Then, the ciphertext components in the low-noise ciphertext are reconstructed, and decomp is added. offset Perform offset adjustment to obtain the intermediate ciphertext component tlwe; create an initial output ciphertext C of length n+1. out The constant term in the low-noise ciphertext is placed as the initial value in the (n+1)th position, and its form is (0,0,0,...,0,b0).

[0145] In the outer loop (OUTER_LOOP), the initial output ciphertext C is traversed by i. out The index of is given, where i ranges from 0 to n; the initial output ciphertext C is traversed.out each element in the initial output ciphertext vector.

[0146] In the middle layer loop (MIDDLE_LOOP), the first dimension index of the LWE ciphertext in the private key switching key is traversed by j, different dimensions of the low-noise ciphertext are mapped to the corresponding private key switching key data structure, and the information is accumulated to the initial output ciphertext in the private key switching process.

[0147] Since the GLWE private key includes k polynomials, each polynomial includes N coefficients, and the private key switching key is generated by encrypting each bit of the GLWE private key by the LWE private key, the private key key includes kN×ksk l LWE ciphertexts, in some embodiments of the present application, the value range of j is 0 to N-1; that is, in the middle layer loop of traversing the first dimension index, the value range of the first dimension index is set to j from 0 to N-1.

[0148] However, since the LWE private key is a binary private key, based on the characteristics of the binary private key, the client can set the first n positions of each polynomial in the GLWE private key as the LWE key when generating the GLWE private key, so that the switching operation of the first n positions can be omitted when performing the private key switching, improving the efficiency of the private key switching operation.

[0149] Based on this, in some embodiments of the present application, the value range of j is n to N-1; that is, in the case that the first n polynomial coefficients in each polynomial in the k polynomials of the GLWE private key are the same as the n key coefficients in the LWE private key, in the middle layer loop of traversing the first dimension index, the value range of the first dimension index is set to j from n to N-1.

[0150] In the inner layer loop (INNER_LOOP), the second dimension index of the LWE ciphertext in the private key switching key is traversed by k. The decomposition coefficient val of the kth segment is extracted from the intermediate ciphertext component tlwe by right shift and decomposition mask decomp mask operation, and when the decomposition coefficient val is not zero, the v1, v2 and v3 positioning adjustment terms are located from the private key switching key, unnecessary operations are avoided, and efficiency is improved.

[0151] Due to the optimization of the loop structure, the three-layer tight loop of the private key switching meets the "perfect loop" requirement in HLS, and the outer loop is automatically flattened into a large loop structure. Specifically, the three-layer loop structure of the key switching unit can be represented by the following formula:

[0152]

[0153] In the formula, C out[i] represents the i-th element in the output ciphertext after the private key switching operation; b0represents the constant term in the low-noise ciphertext; δ i，n represents the Kronecker function, which is 1 when i = n, and 0 otherwise; ksk l represents the decomposition level of the private key switching key; ksk w represents the decomposition bit number of the private key switching key; KSK[i, j, k, val] represents the adjustment term in the private key switching key.

[0154] Specifically, the conversion of the low-noise ciphertext is completed by the private key switching unit extracting and accumulating the corresponding adjustment term from the private key switching key, and the low-noise ciphertext compatible with the LWE private key is generated, including: recombining the ciphertext components in the low-noise ciphertext to generate intermediate ciphertext components; constructing an initial output ciphertext, placing the constant term in the low-noise ciphertext as the initial value in the last bit of the initial output ciphertext, and 0 in other positions; traversing the index, the first dimension index and the second dimension index of the initial output ciphertext in turn through three layers of fixed range nested loops, and according to the condition judgment of the non-zero decomposition coefficient extracted from the intermediate ciphertext components, extracting the corresponding adjustment term from the private key switching key, and accumulating it to the corresponding position in the initial output ciphertext to generate the low-noise ciphertext compatible with the LWE private key.

[0155] After completing all homomorphic gate operations, the last generated low-noise ciphertext is returned to the client for the client to use the LWE private key for decryption.

[0156] Specifically, in the case that the client receives the low-noise ciphertext returned by the service , the local private key LWE private key s is used for decryption to obtain the homomorphic calculation result, and the decryption process is represented by the following formula:

[0157]

[0158] In the formula, m1represents the result of the homomorphic calculation; b represents the constant term in the low-noise ciphertext returned by the server; s represents the LWE private key of the client locally; and q represents the modulus of the polynomial ring.

[0159] In summary, the ciphertext processing method based on FPGA full homomorphic encryption provided in the embodiment can solve the problem of low ciphertext processing efficiency of the existing ciphertext processing method; the LWE private key of the client is constructed by a sparse binary vector, divided into multiple independent private key blocks, the key coefficients in the same private key block are logically associated, while the private key blocks are independent of each other, and each private key block contains at most one non-zero element, so that the possible value combination of each private key block is reduced from the original 2 L ​The number of blind spin operations is reduced to L+1. In subsequent blind spin operations, the blind spin operations are performed in parallel according to the private key blocks. Each group only needs to execute the blind spin operation parameters in L+1, which greatly reduces the computational complexity of the blind spin operation, improves the efficiency of the blind spin operation, and thus improves the efficiency of ciphertext processing. At the same time, the blind spin operation results corresponding to each group are aggregated into a single blind spin output. In this way, in the outer product operation, the original multiple sequentially executed outer product operations will also be aggregated into a single outer product operation, which greatly reduces the complexity of the outer product operation and further improves the efficiency of ciphertext processing.

[0160] In some embodiments of the present invention, the traditional non-fixed-range loop structure in the private key switching process is reconstructed into a three-layer fixed-range nested loop structure to adapt to HLS tool optimization. This can reduce the complexity of private key switching calculations while adapting to FPGA hardware optimizations, reducing the calculation time of private key switching, thereby further improving the efficiency of ciphertext processing.

[0161] In some embodiments of the present invention, the characteristics of binary block keys are utilized to reuse n bits of LWE private key data in each polynomial of GLWE private key. In this way, the redundant calculation steps of the first n bits can be eliminated during private key switching, reducing the calculation time of private key switching and further improving the efficiency of ciphertext processing.

[0162] In one example, a simulation comparison experiment was conducted on the noisy refresh operation in the ciphertext processing method under FPGA-based fully homomorphic encryption. The experimental platform consisted of a Field-Programmable Gate Array (FPGA) development board and a personal computer (PC). The FPGA integrated four ARM cores and FPGA logic units. This experimental platform fully leverages the advantages of ARM cores and FPGAs for efficient data processing and parallel computing.

[0163] The parameter settings for the encrypted noise refresh operation in this embodiment are shown in Table 3.

[0164]

[0165] Table 3

[0166] In Table 3, L represents the number of elements in each private key block of the LWE private key; n represents the dimension of the LWE private key; k represents the dimension of the GLWE private key; and β and l b These are parameters related to polynomial decomposition, representing the cardinality and decomposition level of the polynomial, respectively.

[0167] Parameter set (I) has a security strength of 80 bits, parameter set (II) has larger parameters, and the security strength is 128 bits. Parameter set (III), parameter set (IV), and parameter set (V) have an encryption strength of 128 bits, and they use binary block key technology to generate keys that meet special rules. To ensure encryption strength, the parameters in parameter set (III), (IV), and (V) are larger than those in parameter set (I) and (II).

[0168] For each parameter set, the present embodiment performs experiments on different key expansion units and parallel numbers γ to measure their delay time, throughput, and hardware resource consumption.

[0169] The comparison method of the present application includes three types, namely, a CPU platform-based method, a GPU platform-based method, and an FPGA platform-based method. Different types of implementation platforms are shown in Table 4:

[0170]

[0171] Table 4

[0172] As shown in Table 4, the CPU platform-based method includes the Concrete method and the blockkey-tfhe method. The Concrete method is an implementation of the original TFHE scheme without using binary private key block technology. The blockkey-tfhe method is an acceleration work using binary private key block technology on the original TFHE scheme.

[0173] The GPU platform-based method includes the cuFHE method. The cuFHE method is a method of using CUDA to implement the TFHE ciphertext noise refreshing operation, which does not support key expansion operations.

[0174] The FPGA platform-based method includes the SPSL method and the YKP method. The SPSL-based method is a method of implementing vector machine operations based on TFHE, which does not optimize polynomial multiplication or consider parallel computing, and has low execution efficiency.

[0175] The YKP method is a method of using HLS high-level synthesis to achieve a parameterized key expansion unit supporting parallel computing, which achieves good acceleration effect. However, as the number of expansion coefficients increases, the number of cases that the key expansion unit needs to handle increases exponentially, and the resource consumption also increases.

[0176] The evaluation indicators used in the present embodiment include the following four types:

[0177] The first type is equivalent resource consumption (ERC).

[0178] The equivalent resource consumption is used to measure the comprehensive resource consumption of the method. There are various types of resources in the FPGA, such as lookup table (LUT), flip-flop (FF) and digital signal processing unit (DSP), and it is difficult to evaluate the resource consumption level of the method by using a single resource.

[0179] The embodiment comprehensively considers the above-mentioned several types of resources, and calculates the equivalent resource consumption in the manner of Table 5, so as to more comprehensively reflect the resource consumption of the hardware design.

[0180]

[0181] Table 5

[0182] The second type is the performance resource balance factor (PRF).

[0183] The performance resource balance factor is used to measure the balance degree of the method delay and the resource consumption. The greater the value is, the better the balance between performance and resource consumption is achieved. The calculation manner is as follows:

[0184]

[0185] In the formula, f represents the clock frequency; Mem represents the on-chip memory consumption; and latency represents the method delay.

[0186] The third type is the bootstrapping per second (BPS).

[0187] The bootstrapping per second is used to measure the throughput of the method, and the higher the value is, the higher the throughput of the method is.

[0188] Table 6 shows the comparison results of different methods under different parameter sets and different key expansion unit parallel numbers γ.

[0189]

[0190] Table 6

[0191] It can be observed from Table 6 that, compared with other methods, the BKBM method based on the noise refreshing operation proposed in the embodiment is limited by the bandwidth, and the throughput is lower than that of cuFHE, but the method delay, the equivalent resource consumption and the resource performance balance are the best. With the increase of the number of parallel computations of the key expansion unit, the method delay gradually decreases. This fully proves the effectiveness of the method.

[0192] Corresponding to the above method, the application further provides a ciphertext processing device under full homomorphic encryption based on FPGA, which comprises a computer device, the computer device comprises a processor and a memory, the memory stores computer instructions, and the processor is used for executing the computer instructions stored in the memory, and the device realizes the steps of the ciphertext processing method under full homomorphic encryption based on FPGA in the above method embodiment when the computer instructions are executed by the processor.

[0193] The embodiment of the application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the steps of the ciphertext processing method under full homomorphic encryption based on FPGA in the above method embodiment. The computer readable storage medium can be a tangible storage medium, such as a random access memory (RAM), an internal memory, a read only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a floppy disk, a hard disk, a removable storage disk, a CD-ROM, or any other form of storage medium known in the art.

[0194] The embodiment of the application further provides a computer program product, which comprises a computer program / instruction, and the computer program / instruction is executed by a processor to realize the steps of the ciphertext processing method under full homomorphic encryption based on FPGA in the above method embodiment.

[0195] Those of ordinary skill in the art should understand that the example components, systems and methods described in conjunction with the embodiments disclosed herein can be implemented in hardware, software, or a combination of both. Whether the implementation is in hardware or software depends on the specific application and design constraints imposed on the overall system. Skilled artisans can employ different elements in different combinations to implement the described functions, without departing from the scope of the application. When implemented in hardware, the elements of the application can be implemented in, for example, electronic circuitry, an application-specific integrated circuit (ASIC), suitable firmware, a plug-in, a functional card, or the like. When implemented in software, the elements of the application are the program or code segments to perform the necessary tasks. The program or code segments can be stored in a machine-readable medium, or transmitted by a carrier wave in a transmission medium or communication link.

[0196] It should be understood that the application is not limited to the specific configurations and processes described above and illustrated in the drawings. For the sake of brevity, the detailed descriptions of known methods are omitted. In the above embodiments, several specific steps are described and illustrated as examples. However, the method processes of the application are not limited to the specific steps described and illustrated, and those skilled in the art can make various changes, modifications and additions, or change the order of the steps, after understanding the spirit of the application.

[0197] Features described and / or illustrated with respect to one implementation can be used in the same manner or in a similar manner in one or more other implementations and / or in combination with or in place of features of other implementations.

[0198] The preferred embodiments of the present application are described above with reference to the drawings, and it will be apparent that modifications and changes can be made thereto without departing from the spirit and scope of the application. Therefore, it is to be understood that the application is not to be limited to the particular embodiments disclosed, but it is intended to cover all modifications and changes that are within the scope and spirit of the application.

Claims

1. A ciphertext processing method based on FPGA under fully homomorphic encryption, characterized in that, For use on a server, the server includes an FPGA-based private key switching unit; the method includes the following steps: Homomorphic gate operations are performed based on the GLWE private key and the ciphertext to be processed provided by the client to obtain intermediate processed ciphertext; wherein, the ciphertext to be processed is generated by the client through encryption using the LWE private key; the LWE private key includes at least one private key block; each private key block is a binary vector of length L, which contains at most one non-zero bit and includes L+1 combinations of values, each combination of values ​​corresponding to a blind spin operation parameter; The intermediate ciphertext is processed using the noise refresh key and private key switching key provided by the client to generate low-noise ciphertext. The noise refresh key includes GLWE ciphertext generated by encrypting each bit of the LWE private key with the GLWE private key, and includes key groups corresponding one-to-one with the private key blocks. Each key group corresponds to L+1 blind spin operation parameters. During the ciphertext processing, the blind spin operation parameters corresponding to each key group are executed in parallel, and the execution results are aggregated to obtain the blind spin output. An outer product operation is performed with the intermediate ciphertext to obtain the noise refresh ciphertext. Through the private key switching unit, the corresponding adjustment terms are extracted and accumulated from the private key switching key to adjust the noise refresh ciphertext into low-noise ciphertext compatible with the LWE private key, so that the client can decrypt it using the LWE private key.

2. The method according to claim 1, characterized in that, The private key switching key includes LWE ciphertext generated by encrypting each bit of the GLWE private key using the LWE private key; the GLWE private key includes k polynomials, each polynomial including N polynomial coefficients, and each polynomial coefficient is decomposed into multiple levels of LWE ciphertext according to a preset decomposition level; each LWE ciphertext in the private key switching key includes a first dimension index and a second dimension index; wherein, the first dimension index is used to identify the position of the polynomial coefficient corresponding to the LWE ciphertext in the GLWE private key; and the second dimension index is used to identify the decomposition level; The step of extracting and accumulating corresponding adjustment terms from the private key switching key to adjust the noisy refresh ciphertext into low-noise ciphertext compatible with the LWE private key includes: The ciphertext components in the noise-refreshed ciphertext are reassembled to generate intermediate ciphertext components; Construct an initial output ciphertext by placing the constant term in the noise refresh ciphertext as the initial value in the last position of the initial output ciphertext, and setting all other positions to 0; By sequentially traversing the index of the initial output ciphertext, the first dimension index, and the second dimension index through three nested loops with fixed ranges, and based on the conditional judgment of the non-zero decomposition coefficients extracted from the intermediate ciphertext components, the corresponding adjustment terms are extracted from the private key switching key and accumulated to the corresponding positions in the initial output ciphertext to generate low-noise ciphertext compatible with the LWE private key.

3. The method according to claim 2, characterized in that, The LWE private key includes n key coefficients, where N is greater than n; in the k polynomials of the GLWE private key, if the first n polynomial coefficients in each polynomial are the same as the n key coefficients, the value range of the first dimension index is set to from n to N-1 during the loop traversing the first dimension index.

4. The method according to claim 1, characterized in that, The server also includes several independent computing units; The parallel execution of the blind spin operation parameters corresponding to each key group, and the aggregation of the execution results to obtain the blind spin output, includes: The key set is allocated to an independent computing unit. Each computing unit selects the corresponding blind spin operation parameters according to the allocated key set and performs the operation to obtain the execution result of each computing unit. The execution results corresponding to the same key group are accumulated in parallel through a multi-level addition tree structure to obtain at least one intermediate result, which is then further aggregated into the blind spin output.

5. The method according to claim 4, characterized in that, Before the step of ciphertext processing the intermediate ciphertext using the noise refresh key and the private key switching key to generate low-noise ciphertext, the method further includes: Based on the number of key coefficients in each key group, the L+1 kinds of blind spin operation parameters are pre-generated; The L+1 blind spin operation parameters are loaded into each computing unit.

6. The method according to claim 1, characterized in that, The homomorphic gate operation includes at least one homomorphic gate evaluation; wherein, the homomorphic gate evaluation includes a multiplication gate evaluation or an addition gate evaluation; Before the step of ciphertext processing the intermediate ciphertext using the noise refresh key and the private key switching key to generate low-noise ciphertext, the method further includes: Given that the current homomorphic gate evaluation is a multiplication gate evaluation, perform ciphertext processing operations; If the current homomorphic gate evaluation is an addition gate evaluation, and the noise of the intermediate ciphertext exceeds a preset noise limit, then the ciphertext processing operation is performed; otherwise, the subsequent homomorphic gate operation is performed.

7. The method according to claim 1, characterized in that, The private key switching unit integrates advanced synthesis tool instructions, including loop unrolling instructions, pipeline instructions, or memory allocation instructions.

8. A ciphertext processing device based on FPGA under fully homomorphic encryption, comprising a processor, a memory, and a computer program / instructions stored in the memory, characterized in that, The processor is configured to execute the computer program / instructions, and when the computer program / instructions are executed, the device implements the steps of the method as described in any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method as described in any one of claims 1 to 7.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instructions are executed by the processor, they implement the steps of the method according to any one of claims 1 to 7.

Images