Data processing method and device based on TFHE, storage medium and electronic equipment

Abstract

The embodiment of the invention discloses a data processing method based on TFHE, and the method comprises the steps: determining a first polynomial and a second polynomial of which the length is N based on TFHE according to first to-be-processed data and second to-be-processed data, and then selecting 2m as a preset modulus, therefore, embedding of plaintext messages and programmable bootstrap (PBS) can be more convenient, and particularly in most hardware environments based on binary systems, shifting and mask operation can be more conveniently carried out to efficiently achieve modular multiplication processing. In addition, according to the method, the preset modulus is decomposed into a plurality of auxiliary moduli under the RNS, modular multiplication processing is carried out on the first polynomial and the second polynomial under the preset modulus according to each auxiliary modulus, and the modular multiplication processing efficiency can be further improved.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of computer technology, and particularly relates to a TFHE-based data processing method and device, a storage medium and an electronic device. BACKGROUND

[0002] Privacy computing, an emerging technology, is a crucial issue in today's highly digitalized society. Its innovation lies in the ability to analyze and process data in an encrypted state, thus protecting the privacy and security of sensitive data while utilizing it. Fully Homomorphic Encryption (FHE) technology is a key technology in the field of privacy computing. It can perform complex computing tasks on encrypted data, ensuring the accuracy of the computing results while maintaining the privacy of the data. With the wide application of FHE in cloud computing, secure data sharing, and multi-party information collaboration platforms, this technology is gradually building a bridge between efficient data utilization and strict data protection needs, driving the security computing field into a new stage of development.

[0003] Torus Fully Homomorphic Encryption (TFHE) is a typical representative of the third generation of fully homomorphic encryption schemes. It supports arbitrary complex calculations on encrypted data without decrypting the data, thus achieving high-efficiency computing while protecting data privacy. It has significant advantages and development prospects in the current privacy computing field. Arbitrary complex calculations enable TFHE to implement the encryption of Boolean gate circuits, making it very suitable for logical operations in an encrypted state, which greatly increases the flexibility of TFHE in practical applications. In terms of security, TFHE also belongs to the fault-tolerant learning problem system, so it can resist future quantum computer attacks. Compared with other fully homomorphic encryption schemes, TFHE has a smaller noise growth after multiple operations, which means it can support more homomorphic operations without frequent re-encryption or bootstrapping. TFHE has been verified in multiple practical application scenarios, including privacy-protected data analysis and encrypted search, demonstrating its superior ability to protect data privacy.

[0004] Similar to the full homomorphic scheme such as BGV (Brakerski-Gentry-Vaikuntanathan), CKKS (Cheon-Kim-Kim-Song), and the like, the basic data type in TFHE is also a polynomial in the N-point modulus, and there are a large number of ring polynomial multiplication processing, that is, the modulus multiplication operation of the polynomial, in the process of real encryption, in the process of ciphertext operation, or in the process of decryption. How to efficiently perform polynomial operations is crucial to improving the efficiency of data processing based on TFHE. SUMMARY

[0005] The embodiments of the present specification provide a TFHE-based data processing method and device, a storage medium and an electronic device to partially solve the problems existing in the prior art.

[0006] The embodiments of the present specification adopt the following technical solutions:

[0007] The TFHE-based data processing method provided by the present specification comprises:

[0008] obtaining first to-be-processed data and second to-be-processed data;

[0009] determining a first polynomial corresponding to the first to-be-processed data and a second polynomial corresponding to the second to-be-processed data based on a ring surface full homomorphic encryption (TFHE) algorithm; the first polynomial and the second polynomial are both polynomials with a length of N;

[0010] decomposing the preset modulus into a plurality of auxiliary moduli in a residue number system (RNS) according to the length and the preset modulus; the preset modulus q is 2^m, and m is an integer;

[0011] performing modulus multiplication processing of the first polynomial and the second polynomial under the preset modulus according to each auxiliary modulus.

[0012] The TFHE-based data processing device provided by the present specification comprises:

[0013] an obtaining module configured to obtain first to-be-processed data and second to-be-processed data;

[0014] a determining module configured to determine a first polynomial corresponding to the first to-be-processed data and a second polynomial corresponding to the second to-be-processed data based on a ring surface full homomorphic encryption (TFHE) algorithm; the first polynomial and the second polynomial are both polynomials with a length of N;

[0015] a decomposing module configured to decompose the preset modulus into a plurality of auxiliary moduli in a residue number system (RNS) according to the length and the preset modulus; the preset modulus q is 2^m, and m is an integer;

[0016] a modulo multiplication module, configured to perform modulo multiplication processing on the first polynomial and the second polynomial under the preset modulus according to each auxiliary modulus.

[0017] The present specification provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the above-mentioned TFHE-based data processing method.

[0018] The present specification provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the above-mentioned TFHE-based data processing method when executing the program.

[0019] The above-mentioned at least one technical solution adopted by the embodiments of the present specification can achieve the following beneficial effects:

[0020] The embodiments of the present specification disclose a TFHE-based data processing method, which determines a first polynomial and a second polynomial with a length of N based on a first to-be-processed data and a second to-be-processed data based on TFHE, and selects 2^m as a preset modulus. Since the preset modulus is 2^m, it is more convenient to perform embedding of plaintext messages and programmable bootstrapping (PBS), especially in most binary-based hardware environments, and it is more convenient to perform shift and mask operation to efficiently implement modulo multiplication processing. The method further decomposes the preset modulus into a plurality of auxiliary moduli under RNS, and performs modulo multiplication processing on the first polynomial and the second polynomial under the preset modulus according to each auxiliary modulus, which can further improve the efficiency of the modulo multiplication processing. BRIEF DESCRIPTION OF DRAWINGS

[0021] The accompanying drawings, which are included to provide a further understanding of the present specification, constitute a part of the present specification, and the illustrative embodiments of the present specification and their description serve to explain the present specification, and do not constitute an improper limitation on the present specification. In the drawings:

[0022] Figure 1 A TFHE-based data processing method flowchart is provided for the embodiments of the present specification;

[0023] Figure 2 An exemplary modulo multiplication processing schematic diagram is provided for the embodiments of the present specification;

[0024] Figure 3 A TFHE-based data processing device schematic diagram is provided for the embodiments of the present specification;

[0025] Figure 4 A structural schematic diagram of an electronic device is provided for the embodiments of the present specification. DETAILED DESCRIPTION

[0026] To make the objectives, technical solutions, and advantages of this specification more clear, the following will clearly and completely describe the technical solutions of this specification in conjunction with the specific embodiments of this specification and the corresponding drawings. Obviously, the embodiments described are only part of the embodiments of this specification, not all of the embodiments. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this specification.

[0027] The technical solutions provided by the embodiments of this specification are described in detail below with reference to the accompanying drawings.

[0028] Figure 1 A flow chart of a data processing method based on TFHE provided in an embodiment of this specification specifically includes the following steps:

[0029] S100: Acquire first data to be processed and second data to be processed.

[0030] In the embodiments of this specification, the Figure 1 The device that performs modular multiplication on the first data to be processed and the second data to be processed in the illustrated method can be any electronic device, such as a computer, a mobile phone, or a server. Specifically, it can be a chip within an electronic device, such as a CPU or a homomorphic accelerator chip designed specifically for homomorphic encryption algorithms. For ease of description, these devices are collectively referred to as electronic devices below.

[0031] The electronic device may first obtain the first data to be processed and the second data to be processed. Figure 1 The method shown can be mainly applied to the following three scenarios of TFHE: encrypting plaintext data, performing secret operations on the first data to be processed and the second data to be processed, and decrypting the ciphertext data.

[0032] When encrypting plaintext data, the first data to be processed can be the plaintext data to be encrypted, and the second data to be processed can be the encryption key. Figure 1 After the method shown determines the modular multiplication results of the first polynomial corresponding to the first data to be processed and the second polynomial corresponding to the second data to be processed, the electronic device can also determine the ciphertext data corresponding to the plaintext data based on the modular multiplication results.

[0033] When performing a secret operation on the first data to be processed and the second data to be processed, the first data to be processed may be the ciphertext data corresponding to the first plaintext data, and the second data to be processed may be the ciphertext data corresponding to the second plaintext data. Figure 1After determining the modular multiplication processing result of the first polynomial corresponding to the first to-be-processed data and the second polynomial corresponding to the second to-be-processed data, the electronic device can further determine a ciphertext operation result on the first to-be-processed data and the second to-be-processed data according to the modular multiplication processing result, and if necessary, restore the ciphertext operation result to a plaintext operation result on the first plaintext data and the second plaintext data according to the ciphertext operation result and a preset encryption key.

[0034] When decrypting the ciphertext data, the first to-be-processed data can be the ciphertext data, and the second to-be-processed data can be the encryption key. The modular multiplication processing process shown in Figure 1 After determining the modular multiplication processing result of the first polynomial corresponding to the first to-be-processed data and the second polynomial corresponding to the second to-be-processed data, the electronic device can further determine the plaintext data corresponding to the ciphertext data according to the modular multiplication processing result.

[0035] The modular multiplication processing process shown in Figure 1

[0036] S102: Determine the first polynomial corresponding to the first to-be-processed data and the second polynomial corresponding to the second to-be-processed data based on the torus fully homomorphic encryption (TFHE) algorithm.

[0037] The first polynomial and the second polynomial are both polynomials of length N, and N is an integer power of 2.

[0038] After the electronic device obtains the first to-be-processed data and the second to-be-processed data, the electronic device can first encode the first to-be-processed data and the second to-be-processed data into polynomials based on the TFHE. The first polynomial obtained by encoding the first to-be-processed data is denoted as a(X) = a_0 + a_1 * X + a_2 * X^2 + … + a_(N-1) * X^(N-1), and the second polynomial obtained by encoding the second to-be-processed data is denoted as b(X) = b_0 + b_1 * X + b_2 * X^2 + … + b_(N-1) * X^(N-1). The lengths of the two polynomials are both N.

[0039] It should be noted that the first to-be-processed data (i.e., the plaintext data) is represented by the coefficients of the terms in the first polynomial, that is, the first to-be-processed data is actually represented by the array (a_0, a_1, …, a_(N-1)), and the second to-be-processed data (i.e., the encryption key) is also represented by the coefficients of the terms in the second polynomial, that is, the second to-be-processed data is actually represented by the array (b_0, b_1, …, b_(N-1)). X in the above two polynomials is only a variable, and the power of X is used to represent the order of the coefficients of the terms in the respective array, and X itself has no actual meaning.

[0040] ​S104: According to the length and the preset modulus, the preset modulus is decomposed into a plurality of auxiliary moduli in a residue number system (RNS).

[0041] Since in the modulo multiplication processing, both the coefficients of the polynomial are mod q (i.e., the preset modulus q) to make the coefficients after multiplication be reduced modulo q to prevent numerical explosion, and the polynomial itself is mod (X^N+1) to make the polynomial itself be reduced modulo (X^N+1) to ensure that the modulo multiplication result is still a polynomial with a degree not greater than N, therefore, the modulo multiplication processing can be realized through discrete Fourier transform (DFT), fast Fourier transform (FFT) or fast number theory transform (NTT). Since the time complexity of DFT is O(N 2 ), and the time complexity of FFT and NTT is O(N log N), therefore, using FFT or NTT can more efficiently perform the modulo multiplication processing.

[0042] Further, since in the actual application scenario, the definition domain of FFT is the complex number domain, which will introduce floating-point number operation, and the data type in TFHE in the field of cryptography is usually integer type data, and the homomorphic accelerator chip designed for the homomorphic encryption algorithm often only supports integer type operation, using FFT to realize the modulo multiplication processing will cause the accuracy to decrease, therefore, the modulo multiplication processing can be realized through NTT in the embodiments of the present specification.

[0043] No matter which way is used to realize the modulo multiplication processing, in order to ensure that the parameters meet the requirements of TFHE, N in the embodiments of the present specification is an integer power of 2, the preset modulus q is 2^m, m is an integer, and N<2^(m-1).

[0044] And in order to speed up the speed of the modulo multiplication processing, in the embodiments of the present specification, the preset modulus q can be decomposed into a plurality of auxiliary moduli in a residue number system (RNS) according to the length N of the polynomial and the preset modulus q.

[0045] Specifically, the electronic device can determine the number d of auxiliary moduli and an auxiliary expansion factor scale, the scale is 2 raised to the power of t, and the scale is greater than the number d of auxiliary moduli, and then determine d auxiliary moduli according to the number d of auxiliary moduli, each auxiliary modulus satisfies r_k mod 2N=1 and r_k mod scale=1, where r_k is the kth auxiliary modulus, k=0, 1,..., d-1, and each auxiliary modulus is relatively prime.

[0046] S106: According to each auxiliary modulus, the first polynomial and the second polynomial are subjected to modulo multiplication processing under the preset modulus.

[0047] After decomposition into the auxiliary moduli, the electronic device can, for each auxiliary modulus, scale the coefficients of the terms in the first polynomial by a scale factor, determine the first mapping polynomial of the first polynomial after scaling of the coefficients mapped to the auxiliary modulus, and determine the second mapping polynomial of the second polynomial mapped to the auxiliary modulus.

[0048] Specifically, for the first polynomial, scaling the coefficients of the terms in the first polynomial by the scale factor can be achieved by the formula a_i × scale, where a_i is the coefficient of the i th term in the first polynomial, and i is an integer from 0 to N-1. Then, the first mapping polynomial of the first polynomial after scaling of the coefficients mapped to the k th auxiliary modulus can be determined by the formula ra_i = (a_i × scale) mod r_k, where ra_i is the coefficient of the i th term in the first mapping polynomial, and the first polynomial ra_k (X) = ra_0 + ra_1 × X + ra_2 × X^2 + … + ra_(N-1) × X^(N-1) is recorded.

[0049] For the second polynomial, without scaling the coefficients, the second mapping polynomial of the second polynomial mapped to the k th auxiliary modulus can be determined directly by the formula rb_i = b_i mod r_k, where rb_i is the coefficient of the i th term in the second mapping polynomial, and the second polynomial rb_k (X) = rb_0 + rb_1 × X + rb_2 × X^2 + … + rb_(N-1) × X^(N-1) is recorded.

[0050] After obtaining the corresponding first mapping polynomials ra_0 (X), ra_1 (X), …, ra_k (X) and the second mapping polynomials rb_0 (X), rb_1 (X), …, rb_k (X) for each auxiliary modulus r_0, r_1, …, r_k, the electronic device can determine the result mapping polynomial of the result polynomial corresponding to the modular multiplication processing result mapped to each auxiliary modulus according to the first mapping polynomial and the second mapping polynomial.

[0051] Wherein, the electronic device can use NTT to achieve the result mapping polynomial of the result polynomial mapped to each auxiliary modulus. Specifically, each of the above auxiliary moduli is a prime number supporting NTT of length N, then for the k th auxiliary modulus r_k, the first mapping polynomial obtained for r_k can be subjected to NTT to obtain a first NTT sequence, the second mapping polynomial obtained for r_k can be subjected to NTT to obtain a second NTT sequence, the first NTT sequence and the second NTT sequence can be subjected to point multiplication to determine the third NTT sequence of the point multiplication result mapped to r_k, and finally the third NTT sequence can be subjected to inverse NTT transformation to obtain the result mapping polynomial of the result polynomial corresponding to the modular multiplication processing result mapped to r_k.

[0052] That is, first determine the first NTT sequence (rA_0, rA_1, rA_2, …, rA_(N-1)) = NTT(ra_k(X)), determine the second NTT sequence (rB_0, rB_1, rB_2, …, rB_(N-1)) = NTT(rb_k(X)).

[0053] Then determine the third NTT sequence rC_k = (rC_0, rC_1, rC_2, …, rC_(N-1)), where rC_i = (rA_i·rB_i)mod r_k.

[0054] Finally, perform inverse NTT transformation on rC_k to obtain (rc_k_0, rc_k_1, rc_k_2, …, rc_k_(N-1)) = inverse-NTT(rC_k), determine the result mapping polynomial rc_k(X) = rc_k_0 + rc_k_1×X + rc_k_2×X^2 + … + rc_k_(N-1)×X^(N-1) corresponding to the result polynomial mapped to r_k under the modulo multiplication processing result.

[0055] Since in the implementation of the modulo multiplication processing by using NTT, it is usually required that the preset modulus q is a prime number, and in the present specification, the preset modulus is 2^m, which is to facilitate the embedding of the plaintext message and the programmable bootstrapping (PBS), especially in most binary-based hardware environments, it is more convenient to perform shift and mask operations to efficiently implement the modulo multiplication processing. In order to ensure that even in the case of the preset modulus being 2^m, the NTT can still implement the modulo multiplication processing, in the embodiment of the present specification, the preset modulus 2^m is decomposed into d auxiliary moduli, each of which is a prime number supporting the fast number theory transformation NTT of length N, and is relatively prime. Therefore, the product results of the polynomials obtained by NTT / INTT on the auxiliary moduli can be integrated to obtain the product results on 2^m on the preset modulus.

[0056] Therefore, after determining the corresponding result mapping polynomials rc_0(X), rc_1(X), …, rc_k(X) for each auxiliary modulus r_0, r_1, …, r_k, the result mapping polynomials corresponding to each auxiliary modulus can be reconstructed and combined based on the Chinese remainder theorem (CRT).

[0057] Specifically, the electronic device can determine a cumulative product R of the auxiliary moduli, R = r_0 * r_1 *... * r_k, and an expanded modulus Q = q * scale, where R > N * scale * Bnd_A * Bnd_B, Bnd_A is the maximum value of the value range of each coefficient in the first polynomial, Bnd_B is the maximum value of the value range of each coefficient in the second polynomial, and Bnd_A and Bnd_B are both positive integers less than or equal to q. It should be noted that generally Bnd_A = Bnd_B = q, but in actual TFHE, due to different parameter selection, the actual value range of the coefficients of the first polynomial a(X) and the second polynomial b(X) may be smaller than q, and therefore, the two auxiliary variables Bnd_A and Bnd_B are introduced here to facilitate more accurate description. The electronic device then determines the RNS inverse transform constant M_k corresponding to each auxiliary modulus according to the cumulative product R and the expanded modulus Q, M_k = (R / r_k) mod Q, and the inverse element inv_M_k of M_k; where M_k is the RNS inverse transform constant corresponding to r_k, inv_M_k is the inverse element of M_k, inv_M_k < r_k, and inv_M_k * (R / r_k) mod r_k = 1. Finally, the electronic device determines the merging result of the coefficient of the i-th term in the result polynomial using the formula (∑ k (rc_k_i * inv_M_k mod r_k) mod Q) mod Q, where rc_k_i is the coefficient of the i-th term in the result mapping polynomial mapped to the k-th auxiliary modulus r_k.

[0058] That is, the coefficients of the i-th term mapped to each auxiliary modulus are subjected to RNS inverse transform on the expanded modulus Q = q * scale and merged, and the merging result of the coefficient of the i-th term is Raw_c_i = [(rc_0_i * inv_M_0 mod r_0) * M_0 mod Q + (rc_1_i * inv_M_1 mod r_1) * M_1 mod Q + (rc_2_i * inv_M_2 mod r_2) * M_2 mod Q +... + (rc_(d-1)_i * inv_M_(d-1) mod r_(d-1)) * M_(d-1) mod Q] mod Q.

[0059] After obtaining the combined result of the coefficients of each term in the result polynomial, the electronic device can determine the result polynomial as the result of the modular multiplication processing according to the combined result. Specifically, the electronic device can determine the normalizing constant RQ = R mod Q according to the cumulative product R and the expansion modulus Q, and determine the coefficient c_i of the i-th term in the result polynomial by using the formula [(Raw_c_i - (Raw_c_i mod scale) * RQ) mod Q] / scale, that is, correct the coefficients of each term to the modulus q, remove the expansion factor scale, and finally determine the result polynomial c(X) = c_0 + c_1 * X + c_2 * X^2 + … + c_(N-1) * X^(N-1) according to the coefficients of each term in the result polynomial.

[0060] The coefficients c_i of each term in the above result polynomial are coefficients under the preset modulus 2^m, and the result polynomial itself is also a polynomial under the modulus (X^N + 1), that is, the result polynomial c(X) is the result of the modular multiplication processing of the first polynomial a(X) and the second polynomial b(X) in the ring.

[0061] Since the homomorphic accelerator chip specially designed for the homomorphic encryption algorithm usually has an adder, a multiplier, and an NTT module for implementing NTT transformation and inverse NTT transformation, in the present specification, the above modular multiplication processing of the first polynomial and the second polynomial under the preset modulus 2^m is decomposed into modular multiplication implemented by NTT under the auxiliary modulus in multiple RNS, then combined by CRT, and finally the result is corrected back to the result under the preset modulus 2^m by the normalizing constant, so that the electronic device can directly input the first polynomial and the second polynomial into the homomorphic accelerator chip after determining all the above parameters (including the polynomial length N, the preset modulus q, the number d of auxiliary moduli, each auxiliary modulus r_k, the auxiliary expansion factor scale, the cumulative product R of each auxiliary modulus, the expansion modulus Q, Bnd_A, Bnd_B, the RNS inverse transformation constant M_k corresponding to each auxiliary modulus and its inverse inv_M_k), and the homomorphic accelerator chip can complete the modular multiplication processing of the two polynomials, without any modification or update of the hardware accelerator itself. Moreover, since the NTT module in the homomorphic accelerator chip can process NTT and inverse NTT under multiple different auxiliary moduli in parallel, the efficiency of the modular multiplication processing can be further improved.

[0062] Figure 2 An exemplary modular multiplication processing diagram is provided for the embodiments of the present specification, in which the following parameters are preset: Figure 2

[0063] N = 8;

[0064] m = 20;

[0065] ​q = Bnd_A = Bnd_B = 2^m = 0x100000;

[0066] d = 2;

[0067] r_0 = 0x1fc0001;

[0068] r_1 = 0x1f60001;

[0069] t = 4;

[0070] scale = 2^t = 16.

[0071] Other parameters can be directly obtained from the above-mentioned parameters that have been preset. From the above-mentioned parameters, the following parameters can be obtained: Figure 2 As can be seen, even if the NTT is used to implement the modular multiplication processing of the two polynomials under the condition of the non-prime modulus 2^20, the correct modular multiplication processing result, that is, the result polynomial c(X), can still be determined by using the above-mentioned method.

[0072] In addition, when the first to-be-processed data is plaintext data and the second to-be-processed data is an encryption key, the electronic device can also determine the ciphertext data corresponding to the plaintext data according to the obtained modular multiplication processing result. Specifically, the modular multiplication processing result can be further added with noise to obtain the ciphertext data corresponding to the plaintext data. Subsequently, the ciphertext data can be sent to other devices for a secret operation, and then the secret operation result returned by the other devices is received, and finally the secret operation result is decrypted by using the encryption key to obtain a plaintext result. For example, the ciphertext data corresponding to the plaintext data can be sent to other devices that deploy a large model capable of secret inference, so that the other devices input the ciphertext data into the large model to obtain a secret inference result. After receiving the secret inference result returned by the other devices, the secret inference result is decrypted by using the encryption key to obtain a plaintext inference result.

[0073] Similarly, in the secret operation process, the first to-be-processed data can be ciphertext data corresponding to first plaintext data, and the second to-be-processed data can be ciphertext data corresponding to second plaintext data. In the process of decrypting the ciphertext data, the first to-be-processed data can be ciphertext data, and the second to-be-processed data can be an encryption key. Regardless of the process, the modular multiplication processing involved can use the method shown in Figure 1 .

[0074] The above is a data processing method based on TFHE provided by an embodiment of the present specification. Based on the same idea, the present specification also provides a corresponding device, a storage medium, and an electronic device.

[0075] Figure 3 A data processing device based on TFHE provided by an embodiment of the present specification is shown in the schematic diagram. The device comprises:

[0076] The acquisition module 301 is configured to acquire first to-be-processed data and second to-be-processed data.

[0077] The determination module 302 is configured to determine, based on a torus fully homomorphic encryption (TFHE) algorithm, a first polynomial corresponding to the first to-be-processed data and a second polynomial corresponding to the second to-be-processed data; the first polynomial and the second polynomial are both polynomials of length N.

[0078] The decomposition module 303 is configured to decompose the preset modulus into a plurality of auxiliary moduli in a remainder number system (RNS) according to the length and the preset modulus; the preset modulus q is 2^m, and m is an integer.

[0079] The modulus multiplication module 304 is configured to perform modulus multiplication processing on the first polynomial and the second polynomial under the preset modulus according to each auxiliary modulus.

[0080] Optionally, the decomposition module 303 is specifically configured to determine an auxiliary modulus number d and an auxiliary expansion factor scale, the scale is 2^t, and the scale is greater than the auxiliary modulus number d; determine d auxiliary moduli according to the number d, each auxiliary modulus satisfies r_k mod 2N=1 and r_k mod scale=1, where r_k is the kth auxiliary modulus, and the auxiliary moduli are relatively prime.

[0081] Optionally, the modulus multiplication module 304 is specifically configured to, for each auxiliary modulus, magnify the coefficients of each term in the first polynomial by using the auxiliary expansion factor scale, determine a first mapping polynomial of the first polynomial after the coefficients are magnified and mapped to the auxiliary modulus, determine a second mapping polynomial of the second polynomial mapped to the auxiliary modulus, and determine a result mapping polynomial of a result polynomial corresponding to a modulus multiplication processing result mapped to the auxiliary modulus according to the first mapping polynomial and the second mapping polynomial; merge the result mapping polynomials corresponding to each auxiliary modulus; and determine the result polynomial as the modulus multiplication processing result according to the merging result.

[0082] Optionally, each auxiliary modulus is a prime number supporting fast number-theoretic transform (NTT) of length N.

[0083] The modular multiplication module 304 is specifically configured to perform NTT on the first mapping polynomial to obtain a first NTT sequence; perform NTT on the second mapping polynomial to obtain a second NTT sequence; perform point multiplication on the first NTT sequence and the second NTT sequence to determine a third NTT sequence to which a point multiplication result is mapped; and perform inverse NTT transformation on the third NTT sequence to obtain a result mapping polynomial to which a result polynomial corresponding to a modular multiplication processing result is mapped.

[0084] Optionally, the modular multiplication module 304 is specifically configured to determine a cumulative product R of the auxiliary moduli and an expansion modulus Q = q × scale, where R > N × scale × Bnd_A × Bnd_B, Bnd_A is a maximum value of a value range of each coefficient in the first polynomial, Bnd_B is a maximum value of a value range of each coefficient in the second polynomial, and Bnd_A and Bnd_B are both positive integers less than or equal to q; determine, according to the cumulative product R and the expansion modulus Q, an RNS inverse transformation constant M_k corresponding to each auxiliary modulus, where M_k = (R / r_k) mod Q, and an inverse element inv_M_k of M_k; where M_k is an RNS inverse transformation constant corresponding to r_k, inv_M_k is an inverse element of M_k, inv_M_k < r_k, and inv_M_k × (R / r_k) mod r_k = 1; and determine a combination result of a coefficient of an i-th term in the result polynomial by using a formula (∑ k (rc_k_i × inv_M_k mod r_k) mod Q) mod Q, where rc_k_i is a coefficient of an i-th term in the result mapping polynomial mapped to the k-th auxiliary modulus r_k.

[0085] Optionally, the modular multiplication module 304 is specifically configured to determine a correction constant RQ = R mod Q according to the cumulative product R and the expansion modulus Q; determine a coefficient of an i-th term in the result polynomial by using a formula [(Raw_c_i – (Raw_c_i mod scale) × RQ) mod Q] / scale, where Raw_c_i is a combination result of the coefficient of the i-th term in the result polynomial; and determine the result polynomial according to the coefficients of the terms in the result polynomial.

[0086] Optionally, the method is applied to encrypt plaintext data based on TFHE, the first to-be-processed data is plaintext data to be encrypted, and the second to-be-processed data is an encryption key. The method further comprises: determining ciphertext data corresponding to the plaintext data according to a result of the modulo multiplication of the first polynomial and the second polynomial under the modulus; and / or, the method is applied to perform a homomorphic operation on the first to-be-processed data and the second to-be-processed data based on TFHE, the first to-be-processed data is ciphertext data corresponding to first plaintext data, and the second to-be-processed data is ciphertext data corresponding to second plaintext data. The method further comprises: determining a result of the homomorphic operation on the first to-be-processed data and the second to-be-processed data according to a result of the modulo multiplication of the first polynomial and the second polynomial under the modulus; and restoring the result of the homomorphic operation to a result of plaintext operation on the first plaintext data and the second plaintext data according to the result of the homomorphic operation and a preset encryption key; and / or, the method is applied to decrypt ciphertext data based on TFHE, the first to-be-processed data is ciphertext data, and the second to-be-processed data is an encryption key. The method further comprises: determining plaintext data corresponding to the ciphertext data according to a result of the modulo multiplication of the first polynomial and the second polynomial under the modulus.

[0087] The present specification also provides a computer-readable storage medium, which stores a computer program. The computer program is executed by a processor to implement the above-mentioned TFHE-based data processing method.

[0088] Based on Figure 1 According to the above-mentioned TFHE-based data processing method, the present specification further provides an electronic device Figure 4 As shown in the structural diagram of the electronic device. As Figure 4 At the hardware level, the electronic device comprises a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and of course, it can also comprise other hardware required by the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs to implement the above-mentioned TFHE-based data processing method.

[0089] The above only describes the embodiments of the present specification and does not limit the present specification. The present specification can have various changes and modifications for those skilled in the art. Any modification, equivalent replacement, improvement, etc. within the spirit and principle of the present specification shall be included in the scope of claims of the present specification.

Claims

1. A data processing method based on TFHE, the method comprising: Obtaining first data to be processed and second data to be processed; Determine, based on a torus fully homomorphic encryption (TFHE) algorithm, a first polynomial corresponding to the first data to be processed and a second polynomial corresponding to the second data to be processed; the first polynomial and the second polynomial are both polynomials of length N; Decomposing the preset modulus into a plurality of auxiliary moduli under a residue number system RNS according to the length and the preset modulus; The preset modulus q is 2^m, where m is an integer; According to each auxiliary modulus, modular multiplication processing is performed on the first polynomial and the second polynomial under the preset modulus.

2. The method according to claim 1, further comprising: decomposing the preset modulus into a plurality of auxiliary moduli under a residue number system (RNS) according to the length and the preset modulus, comprising: Determine the number d of auxiliary modules and the auxiliary expansion factor scale, where scale is 2 raised to the power of t and scale is greater than the number d of auxiliary modules; According to the number d, d auxiliary moduli are determined, each of which satisfies r_k mod 2N=1 and r_k modscale=1, wherein r_k is the kth auxiliary modulus, and the auxiliary moduli are mutually prime.

3. The method according to claim 2, wherein, according to each auxiliary modulus, performing modular multiplication on the first polynomial and the second polynomial under the preset modulus, specifically comprising: For each auxiliary modulus, amplify the coefficients of each term in the first polynomial using the auxiliary expansion factor scale, determine how the first polynomial after the coefficient amplification is mapped to a first mapping polynomial under the auxiliary modulus, determine how the second polynomial is mapped to a second mapping polynomial under the auxiliary modulus, and determine, based on the first mapping polynomial and the second mapping polynomial, how a result polynomial corresponding to a modular multiplication result is mapped to a result mapping polynomial under the auxiliary modulus; Merge the result mapping polynomials corresponding to each auxiliary modulus; The result polynomial is determined according to the merging result as the modular multiplication result.

4. The method of claim 3, wherein each auxiliary modulus is a prime number that supports a fast number theoretic transform (NTT) of length N. Determining, according to the first mapping polynomial and the second mapping polynomial, that a result polynomial corresponding to a modular multiplication result is mapped to a result mapping polynomial under the auxiliary modulus specifically includes: Performing NTT on the first mapping polynomial to obtain a first NTT sequence; performing NTT on the second mapping polynomial to obtain a second NTT sequence; Performing a point product on the first NTT sequence and the second NTT sequence, and determining that the point product result is mapped to a third NTT sequence under the auxiliary modulus; An inverse NTT transformation is performed on the third NTT sequence to obtain a result polynomial corresponding to the modular multiplication result, and the result mapping polynomial is mapped to the result mapping polynomial under the auxiliary modulus.

5. The method according to claim 4, further comprising merging the result mapping polynomials corresponding to each auxiliary modulus, comprising: Determine the cumulative product R of each auxiliary modulus and the expansion modulus Q = q × scale, where R > N × scale × Bnd_A × Bnd_B, Bnd_A is the maximum value of the value range of the coefficients of each term in the first polynomial, Bnd_B is the maximum value of the value range of the coefficients of each term in the second polynomial, and both Bnd_A and Bnd_B are positive integers less than or equal to q; According to the cumulative product R and the expansion modulus Q, determine the RNS inverse transform constant M_k = (R / r_k) mod Q corresponding to each auxiliary modulus, and the inverse element inv_M_k of M_k; where M_k is the RNS inverse transform constant corresponding to r_k, inv_M_k is the inverse element of M_k, inv_M_k < r_k and inv_M_k × (R / r_k) mod r_k = 1; Using the formula (∑ k (rc_k_i×inv_M_k mod r_k) mod Q) mod q, determines the merging result of the coefficients of the i-th term in the result polynomial, where rc_k_i is the coefficient of the i-th term in the result mapping polynomial mapped to the k-th auxiliary modulus r_k.

6. The method according to claim 5, determining the result polynomial according to the merging result, specifically including: According to the cumulative product R and the expansion modulus Q, determine the correction constant RQ = R mod Q; Use the formula [(Raw_c_i – (Raw_c_i mod scale) × RQ) mod Q] / scale to determine the coefficient of the i-th term in the result polynomial, where Raw_c_i is the merging result of the coefficient of the i-th term in the result polynomial; Determine the result polynomial according to the coefficients of each term in the result polynomial.

7. The method according to any one of claims 1 to 6, wherein the method is applied to encrypt plaintext data based on TFHE, the first data to be processed is the plaintext data to be encrypted, the second data to be processed is the encryption key, and the method further comprises: Determine the ciphertext data corresponding to the plaintext data according to the result of the modular multiplication processing of the first polynomial and the second polynomial under the modulus; And / or, the method is applied to perform a ciphertext operation on the first data to be processed and the second data to be processed based on TFHE. The first data to be processed is the ciphertext data corresponding to the first plaintext data, and the second data to be processed is the ciphertext data corresponding to the second plaintext data. The method further includes: determining the ciphertext operation result of the first data to be processed and the second data to be processed according to the result of the modular multiplication processing of the first polynomial and the second polynomial under the modulus, and restoring the ciphertext operation result to the plaintext operation result of the first plaintext data and the second plaintext data according to the ciphertext operation result and the preset encryption key; And / or, the method is applied to decrypt ciphertext data. The first data to be processed is the ciphertext data, and the second data to be processed is the encryption key. The method further includes: determining the plaintext data corresponding to the ciphertext data according to the result of the modular multiplication processing of the first polynomial and the second polynomial under the modulus.

8. A data processing device based on TFHE, the device includes: An acquisition module, configured to acquire the first data to be processed and the second data to be processed; A determination module, configured to determine the first polynomial corresponding to the first data to be processed and the second polynomial corresponding to the second data to be processed based on the torus fully homomorphic encryption TFHE algorithm; both the first polynomial and the second polynomial are polynomials with a length of N; a decomposition module, configured to decompose the preset modulus into a plurality of auxiliary moduli under a residual number system RNS according to the length and the preset modulus; The preset modulus q is 2^m, where m is an integer; The modular multiplication module is used to perform modular multiplication processing on the first polynomial and the second polynomial under the preset modulus according to each auxiliary modulus.

9. A computer-readable storage medium storing a computer program, wherein the computer program implements the method according to any one of claims 1 to 7 when executed by a processor.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 7 when executing the program.

Images