Programmable bootstrap of homomorphic ciphertext

Abstract

Some embodiments relate to a method for reducing error terms in a ciphertext in a fully homomorphic cryptographic scheme. An error term is extracted from a first ciphertext, the first ciphertext including homomorphic encryption of a message item and having the error term. The error term is subtracted from a ciphertext that includes the message term, the error term, and possibly additional noise.

Description

Technical Field

[0001] The subject matter of this disclosure relates to a method for reducing error terms in ciphertext in a fully homomorphic cryptographic scheme, a system for reducing error terms in ciphertext, and a computer-readable medium. Background Technology

[0002] Fully homomorphic encryption (FHE) is a class of encryption schemes that allow computation to be performed on encrypted data. Homomorphic cryptography allows a party to execute a computer program on encrypted data, such as circuit evaluation or function evaluation, even if the other party cannot decrypt the data. For example, input data can be received in encrypted form, and computation results can be returned. Intermediate data (e.g., the internal state of the computation) can also be in encrypted form. Even if the output of the computer program is returned in encrypted form, the expected output upon decryption is the same or very close to the original, as if the operation were performed on unencrypted data. Homomorphic encryption can be used to protect privacy in outsourced storage and computation. This allows data to be encrypted and outsourced to a cloud environment for processing and / or storage, all while remaining encrypted. Specifically, existing homomorphic cryptographic techniques can, at least in principle, be used to compute any function on encrypted data. This technique is called "fully homomorphic encryption" (FHE).

[0003] The execution environment is provided by a variety of homomorphic encryption techniques. One such homomorphic encryption system is described in I. Chillotti et al.'s paper, "Programmable bootstrapping enables efficient homomorphic inference of deep neural networks." Cyber ​​Security Cryptography and Machine Learning (CSCML 2021) It is described in Lecture Notes in Computer Science, Volume 12716, pp. 1-19, Springer, 2021, DOI: 10.1007 / 978-3-030-78086-9_1 (included in this paper by reference).

[0004] Typically, FHE-type homomorphic encryption schemes can be based on lattice encryption, such as LWE or NTRU encryption. For example, encrypted data can be received as LWE-type ciphertext. Using techniques described in the paper above, computations can be performed on LWE-type ciphertext even if the homomorphic computing device does not know the key.

[0005] For security reasons, fully homomorphic encryption schemes use noisy ciphertext (e.g., ciphertext containing some degree of randomness). The noise grows after each homomorphic operation is performed. If the noise is not controlled, it can corrupt the message and cause the user to incorrectly decrypt the output ciphertext. A technique called bootstrapping (e.g., from

[13] ) allows noise to be reduced as it grows. By frequently using bootstrapping (and thus reducing noise when needed), homomorphic operations can be performed multiple times as needed.

[0006] In some fully homomorphic encryption schemes (such as TFHE), programmable bootstrapping is limited by its dependence on message space. This means that time and memory complexity deteriorate as the message space increases. This creates an upper limit on the size of the message space that can be bootstrapping. Bootstrapping is almost infeasible for ciphertexts with messages of 10 bits or more. Experiments show that bootstrapping is simply impossible for messages larger than 12 bits when performing polynomial multiplication using a 64-bit FFT. Even for smaller message sizes, bootstrapping becomes the dominant factor in the computational resource consumption of FHE.

[0007] Bootstrapping for TFHE-type schemes has been extensively studied. One of the main research directions is on scaling up bootstrapable messages. In

[14] , the authors proposed two methods to compute bootstrapping for large messages that have been pre-split into smaller parts. The general idea involves applying programmable bootstrapping with the same accumulator to all inputs at a given level and reducing the number of inputs with each iteration (hence the name TreePBS). This method cannot scale as the number of blocks increases and quickly becomes impractical.

[0008] Paper [9] introduces a new hierarchical multiplication along with a generalized version of PBS in the TFHE-class scheme. This improvement allows for bootstrapping of different frames of the message. By combining these two approaches, the authors propose a new version of PBS that does not require a known MSB value of the plaintext. This value is often referred to as the padding bit. By definition, this method improves bootstrap precision by one bit.

[0009] Similarly, the authors of

[17] proposed a new method for calculating the sign function using PBS in the TFHE-class scheme, which is then applied to calculate the floor function. Their method is further extended to the calculation of arbitrary functions. In short, their method performs PBS evaluation twice to eliminate the need for padding bits.

[0010] Recently, the authors of [1] proposed a new method for high-precision computation of PBS. Their method is based on a combination of circuit bootstrapping, CMux trees and blind rotation, and has the advantage of providing better performance than

[14] .

[0011] Bootstrapping remains an expensive technology in terms of execution time and memory usage. Summary of the Invention

[0012] There is a need for a novel method for bootstrapping. The appended claims describe a method for reducing noise in homomorphic ciphertext and a system configured for this purpose. Specific embodiments of the invention are set forth in the dependent claims.

[0013] In one implementation, an error term is extracted from a first ciphertext into a third ciphertext. The first ciphertext includes a homomorphic encryption of the message term. The first ciphertext also contains an error term. By subtracting the extracted error term from the third ciphertext, the resulting ciphertext contains the message term but with a reduced error term. Since the homomorphic operations involved themselves introduce noise, the output ciphertext may have some additional noise. For example, a programmable bootstrapping approach that might be used in the implementation may not require processing the full precision of the error term.

[0014] Several methods can be used to implement this. To extract the error term, message items can be removed from the first ciphertext, and then a programmable bootstrap can be applied. Message removal can be homomorphically performed (e.g., shifting the ciphertext left, or repeatedly adding the message to itself). The programmable bootstrap can be a regular bootstrap, such as one with superpolynomial (e.g., exponential) time and / or space complexity over the size of the message.

[0015] For example, the ciphertext could be LWE-type ciphertext. Using the techniques described in the paper in the background section, computation can be performed on LWE-type ciphertext even if the homomorphic computing device does not know the key. LWE-type ciphertext has the form... ,in It is a random vector, and It is a scalar; sometimes written as ,in Understanding as traversing vectors The length of the LWE-type ciphertext pair secret vector. Encrypted message scalar ,in ,information Encoded as , It is a noise term, and It is the inner product. For example, encoding. It can be ,in This represents the multiplier. An error term has been added for safety reasons.

[0016] Multiple implementation schemes offer various advantages. For example, preprocessing the ciphertext can increase the amount of noise reduction in a single iteration.

[0017] Multiple implementations can use TFHE encryption schemes, such as LWE and / or GLWE ciphertext. The general bootstrapping of the TFHE scheme is programmable. Bootstrapping, according to one implementation, does not need to be programmable. This eliminates large lookup tables whose size grows exponentially with the message space. More generally, multiple implementations can use fully homomorphic encryption schemes that include a programmable bootstrapping algorithm capable of taking ciphertext as input and outputting a less noisy ciphertext of the same message, for example, by simultaneously homomorphically decomposing the input ciphertext over a polynomial exponent.

[0018] Indeed, the computational complexity of bootstrapping according to one implementation does not depend exponentially on message precision. Even further, in one implementation, the computational complexity of bootstrapping is independent of message precision.

[0019] Therefore, bootstrapping ciphertext encrypted with large message precision is practically impossible, especially when using common TFHE-class scheme cryptographic parameters (e.g., for a 10-bit message, assuming common parameters such as...). and Therefore, using bootstrapping according to one implementation allows for more efficient bootstrapping of larger message precision. The ability to encode more messages in a single ciphertext means that input and intermediate data do not need to be distributed across so many ciphertexts. Therefore, fewer computational steps are required to perform the desired computation.

[0020] Note that this can be achieved using any encoding method, such as those described in [1]. For example, the message space does not need to be divisible by the ciphertext modulus. Any multi-ciphertext representation can be used, such as Radix or CRT decomposition. In particular, encodings that allow parallel execution of PBS can be used. If such a parallelizable bootstrapping method is used, the implementation also becomes parallelizable.

[0021] In one implementation, bootstrapping can be adapted to the desired amount of noise reduction. For example, an implementation can be iteratively invoked to reduce noise to a variable level. This provides greater flexibility and can reduce computation time based on use cases. For instance, more noise can be reduced where higher noise is expected in the algorithm, and less noise can be removed where lower noise is expected. In an iterative implementation, more iterations can be performed in the first case and fewer in the latter. As a result, the total execution time is reduced. If the noise level of the input ciphertext is very low, the output ciphertext may not have a reduced noise level, or may even have an increased noise level. However, the algorithms are efficient because they keep the noise below a certain level and maintain message integrity.

[0022] In TFHE-class protocols, conventional PBS (e.g., assuming...) and (for some) and Either use padding bits in the message space or evaluate the PBS multiple times. Bootstrapping according to one implementation does not require this.

[0023] Because noise reduction can now be separated from LUT evaluation, bootstrapping, depending on the implementation, allows users to manage homomorphic operations more efficiently. This will have significant implications for any use case requiring high precision, such as homomorphic neural network inference.

[0024] Systems for reducing errors in homomorphic ciphertext include one or more electronic devices, such as one or more computers. Methods for reducing error terms are typically implemented using computers.

[0025] Devices and / or systems used for homomorphic encryption, homomorphic computation, and / or bootstrapping are electronic devices. The methods described herein can be applied to a wide range of practical applications. Examples include processing private data (e.g., medical data, financial data, etc.) in a privacy-preserving manner.

[0026] One aspect is a method for reducing error terms. One embodiment of the method may be implemented on a computer as a computer-implemented method, or in dedicated hardware, or a combination of both. Executable code for one embodiment of the method may be stored on a computer program product. Embodiments of the computer program product include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transitory program code stored on a computer-readable medium, which, when executed on a computer, performs one embodiment of the method.

[0027] In one embodiment, the computer program includes computer program code that, when run on a computer, is adapted to perform all or part of the steps of one embodiment of the method. Preferably, the computer program is implemented on a computer-readable medium.

[0028] Another aspect of the subject of this disclosure is a method for making computer programs available for download.

[0029] The following references disclose homomorphic computing systems, which may include an implementation scheme. These references are incorporated herein by reference.

[0030]

[0031]

[0032]

[0033]

[0034] Attached Figure Description

[0035] Further details, aspects, and embodiments will be described by way of example only with reference to the accompanying drawings. Elements in the drawings are illustrated for simplicity and clarity and are not necessarily drawn to scale. In the drawings, elements corresponding to those already described may have the same reference numerals. In the drawings, Figure 1a An embodiment of one implementation of a homomorphic computing system is illustrated schematically. Figure 1b An embodiment of one implementation of a homomorphic computing system and its client is illustrated schematically. Figure 1c An embodiment of one implementation of LWE encryption is illustrated schematically. Figure 2a An embodiment of one implementation of a homomorphic bootstrapping system is illustrated schematically. Figure 2b An embodiment of one implementation of the ciphertext is illustrated schematically. Figure 3a An embodiment of one implementation of a homomorphic bootstrapping system is illustrated schematically. Figure 3b An embodiment of one implementation of the ciphertext is illustrated schematically. Figure 4 An embodiment of one implementation of a homomorphic bootstrapping system is illustrated schematically. Figure 5 An embodiment of one implementation of a homomorphic bootstrapping system is illustrated schematically. Figure 6 An embodiment of one implementation of a method for reducing error terms in ciphertext is schematically illustrated. Figure 7a A computer-readable medium having a writable portion, said writable portion comprising a computer program according to one embodiment, is schematically illustrated. Figure 7b The characterization of a processor system according to one implementation is illustrated schematically.

[0036] List of reference numerals The following list of reference numerals and abbreviations corresponds to Figure 1- Figure 5 , Figure 7a and Figure 7b The accompanying drawings are provided to facilitate understanding and should not be construed as limiting the claims.

[0037] 110 Homomorphic Computing System 120, 120.1, 120.2 Client devices 100, 102 Computing System Processor systems 111 and 121 112, 122 memory Communication interfaces 113 and 123 172 Data Network 131 padding bits 132 Messages 133 Padding bits between message and noise 134 Additional padding bits 135 Unused noise bits 136 noise bits already used 200, 300, 400, 500 bootstrap systems 201, 301, 401, 501 Enter ciphertext 202, 302, 402, 502 output ciphertext 211, 411 First ciphertext 212, 312, 412, 512 Second Ciphertext 213, 313, 413, 513 Third Ciphertext 214, 414 Fourth Cipher Message item removed (220) Homomorphic processing 271-274 281 Most significant bit 282 padding bits Message item 283 284 Error Terms 285 Additional Noise Shift left at 320, 420, 521 522 Move right 330, 530 Key Switching 431 First Key Switch 432 Second Key Switching 440 rounded 250, 350, 450, 550 Programmable Bootstrap Subtraction of 260, 360, and 460 561 First Subtraction 562 Second Subtraction 1000, 1001 Computer-readable media 1010 writable portion 1020 Computer Program 1110 Integrated Circuits 1120 Processing Unit 1122 Memory 1124 Application-Specific Integrated Circuit 1126 Communication Components 1130 Interconnect 1140 Processor System Detailed Implementation

[0038] Although the subject matter of this disclosure allows for many different forms of implementation, one or more particular embodiments are shown in the accompanying drawings and will be described in detail herein. It should be understood that this disclosure should be regarded as an example of the principles of the subject matter of this disclosure and is not intended to limit it to the particular embodiments shown and described.

[0039] In the following text, for ease of understanding, several elements of the implementation scheme are described in operation. However, it will be clear that the corresponding elements are arranged to perform the functions described herein.

[0040] Furthermore, the subject matter of this disclosure is not limited to these embodiments, but includes every other combination of features described herein or recited in mutually different dependent claims.

[0041] Fully homomorphic encryption (FHE) Fully homomorphic encryption (FHE) is a class of encryption schemes that allow computation to be performed on encrypted data. For security reasons, FHE schemes use noisy ciphertext, such as ciphertext containing some degree of randomness. This noise increases after each homomorphic operation and, if left uncontrolled, can corrupt the message and prevent the user from decrypting it correctly. A technique called bootstrapping (e.g. from

[13] ) allows the noise to be reduced as it increases using a public key called a bootstrap key. By frequently using bootstrapping (and thus reducing noise when needed), the user can perform as many homomorphic operations as they want, but this remains an expensive technique, both in terms of execution time and memory usage.

[0042] The noise in the newly encrypted ciphertext comes from passing through a certain parameter. Parameterized given distribution A small random value is extracted from the ciphertext and added to the message during the encryption process. Whenever a operation is performed on the ciphertext, the randomness in the ciphertext is modified as a side effect.

[0043] The relationship between the input noise and the output noise of an operation is modeled by a so-called noise formula (e.g., a formula that describes the evolution of noise during the computation of this operation).

[0044] For GLWE ciphertext, the distribution It can be a centered discrete normal distribution, where It is the standard deviation. During the processing of the ciphertext, the distribution of noise within the ciphertext changes. Generally, when one sample is said to contain more noise than another, it means that the noise within the ciphertext is drawn from a normal distribution with a larger standard deviation. However, in many implementations, the noise may be drawn from a different type of distribution.

[0045] The scheme TFHE[6, 7] differs from other FHE schemes by supporting efficient bootstrapping techniques. TFHE was initially proposed as an improvement on scheme FHEW

[10] , a construct based on GSW

[12] , which proposes a fast bootstrapping for Boolean gate evaluation. In addition to improving the bootstrapping of FHEW, TFHE also implements additional techniques, thus supporting more functions than those proposed by FHEW and improving homomorphic evaluation of complex circuits. TFHE is further described in ([6, 7, 8, 4]).

[0046] In addition to being highly efficient, TFHE's bootstrapping is also programmable, meaning that univariate functions can be evaluated while reducing noise. This is often referred to as programmable bootstrapping and is labeled PBS.

[0047] PBS may include analog-to-digital switching (MS), blind rotation (BR), and sample extraction (SE). In some implementations, analog-to-digital switching can be removed from PBS and incorporated into other parts of the bootstrapping process.

[0048] For some well-generated parameters, the TFHE PBS output noise level is independent of the input ciphertext noise. The algorithm described below requires setting some parameters. Technicians will be able to determine these parameters empirically. Experiments have been conducted, with LWE dimensions... A wide range of values ​​was used: from 400 (small precision) to 2048 (large precision). (20 bits). Polynomial size Take 2 8 With 2 17 The powers of 2 between them. GLWE dimensions. Between 1 and 6. Decompose the logarithmic base. with hierarchy The value of is between 1 and 64, or more generally, the logarithm of the ciphertext modulus. Parameters outside these ranges are possible.

[0049] In paper [2], the authors define an alternative method for computing PBS based on the NTRU encryption scheme (see, for example,

[15] ). All operations in the original TFHE scheme have been redefined to support PBS. In the following text, this alternative PBS can be used in place of / in combination with the PBS used for TFHE-class schemes.

[0050] Some of the algorithms in this article can use rounding operations. Although different rounding operations can be used, the following Round algorithm can be applied.

[0051]

[0052] Probability and Distribution make , Let be the error probability, and for CDF. Definition The standard score is: .

[0053] get: .

[0054] For a centered normal distribution, confidence intervals can be calculated. Let... and and .make for The standard score is obtained as follows:

[0055] Figure 1a An embodiment of a homomorphic computing system 110 and an embodiment of a client device 120 are schematically illustrated. The homomorphic computing system 110 and the client device 120 may be part of the computing system 100.

[0056] Client device 120 is configured to encrypt data according to a cryptographic homomorphic encryption scheme. The encrypted data is sent to homomorphic computing system 110. Computing system 110 is configured to perform homomorphic computation on the encrypted data, for example, a series of computational steps, including, for example, one or more multiplications, additions, etc. Homomorphic computing system 110 is configured to perform this operation homomorphically without decrypting the data or otherwise obtaining knowledge about the plaintext input or output.

[0057] For example, one or more client devices 120 encrypt data (e.g., numerical data) and send the resulting encrypted data to computing system 110. Computing system 110 performs computations (e.g., algorithms), such as neural network evaluation of the encrypted data. Note that computing system 110 is not provided with a decryption key to decrypt the encrypted data. However, computing system 110 may be provided with a so-called public evaluation key; including bootstrapping keys or key transformation keys. Computing system 110 can use such auxiliary key material to perform its computations. However, the auxiliary key material does not allow computing system 110 to decrypt the ciphertext. The result of the computation can be provided to, for example, client device 120, and decrypted there. Homomorphic computation can use systems such as those described in the background section.

[0058] Client device 120 computes one or more encrypted messages. Each encrypted message includes a message portion and an error portion. Homomorphic computation system 110 performs computations on the encrypted messages. This increases the size of the error portion in the encrypted messages. A bootstrap operation reduces the size of the error portion without revealing the message portion. If the bootstrap operation is programmable, the message portion can be modified.

[0059] The homomorphic computing system 110 uses a fully homomorphic cryptographic scheme. This scheme supports at least homomorphic addition and programmable bootstrapping. The ciphertext in this system includes a message item. The error term prevents the message term from being recovered through linear algebra-based attacks. Since performing homomorphic computations typically leads to increased error, an operation is desired to reduce the error term; this is called bootstrapping. A typical bootstrapping operation is called programmable bootstrapping. Programmable bootstrapping will include the message term. With error term The ciphertext is used as input, and a message item is generated. With error term The encrypted text. Function It can be selected arbitrarily, hence the name programmable bootstrapping. Error term. Less than the predetermined limit, usually less than the input error term. Errors in homomorphic ciphertext are also referred to as noise.

[0060] The bootstrapping operation in one implementation uses conventional programmable bootstrapping, but cleverly improves its efficiency, thereby significantly increasing the size of the message items that can be supported.

[0061] For example, the homomorphic computing system 110 can perform one or more computations, then apply a bootstrap operation when the noise is in danger of becoming too large, followed by one or more further computations, and so on. Some of the bootstraps may be conventional programmable bootstraps, but at least one bootstrap operation, preferably most of the bootstrap operations, and more preferably all of the bootstrap operations, are bootstrap operations according to an embodiment.

[0062] Homomorphic computing system 110 may include processor system 111, memory 112, and communication interface 113. Client device 120 may include processor system 121, memory 122, and communication interface 123. Memory 112 and 122 may be, for example, electronic memory, magnetic memory, etc. Memory may include local memory, such as local hard disk drive or electronic memory. Memory 112 and 122 may include non-local memory, such as cloud storage. In the latter case, memory 112 and 122 may include a storage interface leading to non-local memory. Memory may include multiple discrete sub-memories, which together constitute memory 112 and 122. Memory may include volatile writable portions, such as RAM; non-volatile writable portions, such as flash memory; and non-volatile non-writable portions, such as ROM.

[0063] In various implementations of communication interfaces 113 and / or 123, the communication interface can be selected from a number of alternatives. For example, the interface can be a network interface leading to a local area network or a wide area network (e.g., the Internet), a storage interface leading to an internal or external data storage device, an application programming interface (API), etc.

[0064] Memory 112 and 122 can be non-transitory memory. For example, memory 112 and 122 can store data when power is available, such as volatile memory devices (e.g., random access memory (RAM)). For example, memory 112 and 122 can store data both when power is available and when power is not available, such as non-volatile memory devices (e.g., flash memory).

[0065] Devices 110 and 120 can communicate internally with each other and with other devices, external storage, input devices, output devices, and / or one or more sensors via a computer network. The computer network can be the Internet, an intranet, a LAN, a WLAN, etc. Devices 110 and 120 include connection interfaces arranged to communicate either within or outside the computing system 100 as needed. For example, the connection interface may include connectors, such as wired connectors (e.g., Ethernet connectors, fiber optic connectors, etc.) or wireless connectors (e.g., antennas (e.g., Wi-Fi, 4G, or 5G antennas)).

[0066] Communication interface 123 can be used to send or receive digital data, such as encrypted sensor data, image data, audio data, etc. Communication interface 113 can be used to send or receive digital data, such as calculation results (e.g., classification data, technical control data, etc.).

[0067] Computing system 110 can be implemented in a single device, such as a server or computer. Computing system 110 can also be implemented across multiple collaborating devices, such as a cloud computing system. Communication interface 113 can be used to communicate with other computing devices (e.g., computing devices within the same system). Homomorphic computing is extremely resource-intensive, therefore it is advantageous to distribute the load across multiple devices as needed.

[0068] Client device 120 may have a user interface, which may include known elements such as one or more buttons, a keyboard, a display, a touchscreen, etc. The user interface may be configured to accommodate user interaction. For example, the user interaction may be initiating homomorphic computation on client device 120 for execution on computing system 110.

[0069] The execution of devices 110 and 120 can be implemented in a processor system. Devices 110 and 120 may include functional units for implementing multiple aspects of various embodiments. These functional units may be part of a processor system. For example, the functional units shown herein may be implemented wholly or partially as computer instructions stored in the device's memory and executable by the processor system.

[0070] The processor system may include one or more processor circuits, such as a microprocessor, CPU, GPU, etc. Devices 110 and 120 may include multiple processors. The processor circuits may be implemented in a distributed manner, for example, as multiple sub-processor circuits. For example, devices 110 and 120 may use cloud computing.

[0071] Typically, the homomorphic computing system 110 and the client device 120 each include a microprocessor that executes appropriate software stored on the device; for example, the software may have been downloaded and / or stored in corresponding memory, such as volatile memory (e.g., RAM) or non-volatile memory (e.g., flash memory).

[0072] Instead of using software to implement a function, devices 110 and / or 120 can be implemented wholly or partially as programmable logic (e.g., as a field-programmable gate array (FPGA)). The devices can be implemented wholly or partially as so-called application-specific integrated circuits (ASICs), such as integrated circuits (ICs) customized for their specific applications. For example, the circuitry can be implemented in CMOS, using hardware description languages ​​such as Verilog, VHDL, etc. Specifically, homomorphic computing system 110 and client device 120 may include circuitry, such as circuitry for cryptographic processing and / or arithmetic processing.

[0073] In hybrid implementations, the functional unit is implemented in part in hardware, such as as a coprocessor (e.g., a cryptographic coprocessor), and in part in software stored on and executed on the device.

[0074] Figure 1b An embodiment of one implementation of computing system 102 is schematically illustrated. Computing system 102 may include multiple client devices; client devices 120.1 and 120.2 are shown. Computing system 102 may include multiple computing devices; one computing device 110 is shown. These devices are connected via computer network 172 (e.g., the Internet). Client devices and homomorphic computing devices may be client devices and homomorphic computing devices according to one embodiment.

[0075] Ciphertext can represent various types of data. Below is a list of embodiments using homomorphic computing systems. In these embodiments, client device 120 is used to encrypt data before sending it to a homomorphic calculator (such as homomorphic computing system 110). Encryption can be used in one of the following scenarios, for example: Healthcare Applications: Patient data can be encrypted via one implementation of client device 120. Homomorphic computation can be used to perform medical research on encrypted data without compromising patient privacy. This can include analyzing genomic data or conducting clinical trials. For example, homomorphic computation can be performed on medical data, such as medical sensor data, like medical images. Medical data may include genomic data.

[0076] Cloud computing: Encryption can be used to securely outsource computing to untrusted cloud providers. Computation can be performed on encrypted data stored in the cloud, requiring complete decryption of the data.

[0077] Machine Learning: Encryption can be used to perform machine learning computations on encrypted data. This can include training a model on encrypted data or making predictions on encrypted data without needing to decrypt the data at all. For example, neural networks can be trained and / or evaluated on encrypted data.

[0078] Blockchain: Encryption can be used to hide data appearing on public blockchains. This can include private data, such as a user's account balance. Using encryption, a remittance can be made by checking the encrypted data to ensure the user's balance is sufficient for the transfer. This hides the user's exact balance.

[0079] Internet of Things (IoT) Applications: Encryption can be used to securely process sensor data in real time without exposing it to third parties. For example, smart cities can use homomorphic encryption to perform computations on encrypted sensor data, thereby improving traffic flow or reducing energy consumption.

[0080] This section provides an example of how to calculate the noise limit based on precision, a given code, and a certain error probability. The noise limit is referred to as the threshold associated with noise within the ciphertext. It is written as... And it is usually parameterized by probability, but note that it can be something else. For security reasons, the exact noise value must be secret, but the variance of its distribution is publicly known. The noise bound represents the limit that is not desired to be exceeded in terms of the variance of the error in the ciphertext. This noise bound is related to several metadata, such as the number of bits representing the message or the probability of correctness.

[0081] For example, in one implementation, given a number of bits News It can be encrypted in the most significant bit of a ciphertext. LWE ciphertext is a tuple. ,in , so that: It is the key, where the coefficients are sampled from a uniform binary distribution, a uniform ternary distribution, or a Gaussian distribution. From Sampled from a uniform distribution Integers in From a centralized Gaussian distribution The sampling error in the sample, It is a message that has been rescaled in the most significant bit.

[0082] Noise item Since the data is sampled from a Gaussian distribution, we want to find a threshold for its variance such that if the noise remains below this threshold, the computation will proceed with a given probability. Proceeding correctly.

[0083] Figure 1c Given A schematic visual representation of the binary representation (MSB on the left; LSB on the right).

[0084] The diagram shows 32 bits in rectangular form, corresponding to the ciphertext modulus. (In this embodiment). Another commonly used value in TFHE is Other moduli are also possible.

[0085] For the standard score, we use here ,For example, This corresponds to the two shaded rectangles 134.

[0086] In this embodiment, the precision of the message (For example, for integer messages) The number of bits used for encoding is .

[0087] Therefore, we can calculate the noise boundary as follows:

[0088] In this embodiment, it is equal to In the index In the text, the first 1 refers to MSB padding bit 131; The first 1 refers to the number of bits required for message 132; the second 1 refers to the padding bits 133 between the message and noise, so that noise does not contaminate the message during rounding during decryption. The final exponent with base 2 in the second score refers to the standard score for a given failure probability. These are the additional padding bits 134.

[0089] Noise may be present in noise bits 135 and 136. In this embodiment, the noise is shown in bit 136. In this embodiment, four more bits 135 may be provided for noise growth. Performing a bootstrap will increase the number of bits 135 and decrease the number of bits 136.

[0090] In this scenario, due to the limitations of TFHE's PBS, the MSB is conventionally set to a known value. The known value can be 0 or 1, as long as it is known. Note that the bootstrapping implementation, according to one embodiment, is not limited to this. This means that additional bits can be used to represent the message without increasing the modulus size.

[0091] As seen above, the security of fully homomorphic encryption schemes, including TFHE-class schemes, relies on noise. The ciphertext contains a small amount of noise, which acts as a small amount of randomness added during the encryption process. This noise grows throughout the entire computation. If it becomes too large, it can overwrite parts of the message and jeopardize the correctness of the scheme. To avoid this, the idea is to use bootstrapping, for example, operators specifically designed to reduce noise. For correct computation, this relies on a public material called a bootstrap key. The main idea behind bootstrapping is to homomorphically apply decryption circuitry to the input ciphertext. This allows for error reduction without publicly revealing the key. TFHE-class schemes have fast bootstrap computations, which allow this to be done quite efficiently. An interesting aspect of the TFHE family of schemes is the possibility of computing functions while reducing errors without increasing the cost of noise reduction. Therefore, this bootstrapping is called programmable bootstrapping, abbreviated as PBS.

[0092] However, this method has a significant drawback: the computational complexity increases exponentially with the number of bits representing the message (called message precision). As shown in [1], there is no method that guarantees 128-bit security with an error probability less than [missing information]. TFHE - a set of parameters used to calculate PBS with a message precision greater than 11 bits.

[0093] As originally defined in [8], another constraint of the PBS for TFHE-class schemes is the need to use padding bits in the message space. In other words, only half of the theoretically available messages can actually be used to correctly compute the PBS. There are some existing solutions (e.g., [1, 9, 17]) to overcome this problem, but these methods involve computing the PBS multiple times. Furthermore, such solutions cannot be used to extend the message space beyond one bit.

[0094] In several implementations, a novel bootstrapping mechanism is proposed whose bootstrapping cost is independent of message precision. Instead, the computational cost depends on noise precision, such as the selected number of bits of noise to be removed from the input ciphertext. Therefore, by using a bootstrapping mechanism according to one implementation, this offers the possibility of reducing noise in high-precision (e.g., at least 8, 16, or 25-bit) messages at a fraction of the cost of bootstrapping with TFHE. Note that the new bootstrapping is dedicated to noise reduction and is not programmable. However, it is compatible with classic PBS. Ultimately, this new bootstrapping proposes a new strategy for more efficient computation of homomorphic circuits because it is independent of message precision and function computation.

[0095] Several implementations have proposed a completely different approach to managing noise in fully homomorphic encryption (such as in the TFHE context).

[0096] In one implementation, the bootstrap extracts error terms from the ciphertext and then removes the error terms from the ciphertext. Compared to conventional methods, this allows the use of smaller polynomials in the PBS, especially if the message precision is higher than 4 bits, such as 5 bits or more.

[0097] Traditionally, in the context of TFHE, to refresh the noise, homomorphic decryption of the ciphertext is computed to obtain another encryption of the original message with less noise. Instead, in this invention, there are two steps: generating a noisy encryption of the original ciphertext (step 1, called error extraction), but with less noise; and homomorphically removing it from the original ciphertext (step 2, subtraction), thereby reducing the amount of noise while maintaining the same message.

[0098] If the parameters are selected correctly, this method will reduce noise within the input ciphertext, thus making it a true bootstrap operation because it uses only publicly available material to reduce noise.

[0099] The greater the precision of the message in the ciphertext, the better our method scales compared to the original bootstrapping of TFHE. Indeed, the cost of this new bootstrapping is no longer exponentially dependent on the message size. Empirically, as long as the message space is greater than the rounding error, this method is more efficient than the traditional PBS using TFHE.

[0100] Figure 2a An embodiment of one implementation of a homomorphic bootstrapping system 200 is illustrated schematically. This bootstrapping can be included in a homomorphic computing system (such as computing system 110). The bootstrapping can be used in fully homomorphic cryptographic schemes that at least support homomorphic addition and programmable bootstrapping. Examples of these schemes include TFHE-class schemes, such as LWE and GLWE encryption, NTRU encryption, etc.

[0101] Generally, homomorphic encryption of messages (e.g., data) can include encrypting the message... Encoding to message item The message item is then combined with noise (e.g., an error term), typically by adding noise. The result can be encrypted using lattice-based encryption; for example, lattice elements can be added to the combination of the message item and the error term to encrypt that combination.

[0102] There are several ways to encode a message, for example, by combining functions that enable the encoded message to be recovered from noise. One possible function is multiplication with a scalar representing the message. As the message moves to a higher position relative to the noise, rounding can remove most or all of the noise. Instead of multiplication with a multiplier, the encoding could be the application of a function that also moves the message scalar to a higher position, although it doesn't necessarily have to be linear. Preferably, the function is invertible, at least for the set of message scalars used. Another possibility is to encode the message along with an error correction function. For example, the encoding could have the form... , and error term The combination can be For example, encoding can have the form ,in These are error correction encoders, such as BCH, Reed-Solomon, Hamming, etc. It is The domain is mapped to an increasing function at a higher position. For example, the function It can include multipliers Multiplication is allowed. For example, the function can be a polynomial, but it is not necessarily limited to polynomials.

[0103] For simplicity, we will use pairs and multipliers. The encoding performed by multiplication, therefore However, multiple implementations can be adapted to perform other types of encoding on the messages in the message item.

[0104] Figure 2a A general implementation scheme for reducing noise in homomorphic systems as described above is shown. Figure 2a The input ciphertext 201 is shown in the image. The input ciphertext includes a message item. The homomorphic encryption and error term. Typically, the input ciphertext is obtained by performing a homomorphic computation on ciphertext received from an external source (e.g., from a client device).

[0105] For example, homomorphic cryptographic schemes can at least support homomorphic addition and programmable bootstrapping. Addition, and implicit subtraction, can typically be performed directly on elements of the ciphertext. Programmable bootstrapping allows for noise reduction and evaluation of arbitrary functions. These elements can be used to create other computations. Homomorphic cryptographic schemes can support further operations.

[0106] As a result of homomorphic computation, the error term typically increases. This is a problem because if the error term becomes larger than the message term, unique decryption may become impossible. Therefore, bootstrapping is required from time to time to reduce the error term. Bootstrapping is resource-intensive and significantly reduces the message value in the ciphertext in conventional systems. The maximum size.

[0107] Generally, system 200 homomorphically extracts the error term from the first ciphertext 211 into the third ciphertext 213. By subtracting the third ciphertext 213 from the first ciphertext 211, most of the error term is removed, while the message term remains unchanged.

[0108] In fact, by bootstrapping the error space instead of the message space, regular bootstrapping operations can be used more efficiently. This bypasses many of the previous constraints while still reducing noise in the ciphertext.

[0109] This is illustrated in Figure 2b The image illustrates an embodiment of one implementation of the ciphertext. Figure 2b The diagram shows a combination of message and error items, but no encryption is applied. For example, for items with a key... LWE encryption , Figure 2b What is shown is .

[0110] Figure 2b The first ciphertext 211 is shown. The first ciphertext can be equal to the input ciphertext 201, but the input ciphertext 201 can be preprocessed to help further increase the degree of error reduction.

[0111] Message item 283 is shown in ciphertext 211. In this case, the message item is located in the most significant portion of ciphertext 211. Note that the most significant bit 281 of ciphertext 211 is used to encode the message. Conventional programmable bootstrap operations require this bit to be known, for example, 0 or 1, but this is not required in one embodiment. Error item 284 is shown in the least significant portion of the ciphertext. The error item and the message item can be separated by one or more padding bits. Such a padding bit 282 is shown. Compared to the error item, the message item is located in the more significant portion, which has the advantage that the message item can be removed by left shifting, a supported homomorphic operation. However, in one embodiment, the encoding of the message and its combination with noise can be organized in a different way.

[0112] System 200 creates a third ciphertext 213, which contains the error term of the first ciphertext 211 but does not contain the message term 283. Note that some additional noise may be introduced in the processing performed to achieve this. This is shown as additional noise 285.

[0113] By subtracting the third ciphertext 213 from the ciphertext 211, the output ciphertext 202 is obtained. In the output, the error term has been reduced, or at least the output error term is below a predetermined error level, expressed in terms of bit count, standard deviation, noise upper limit, etc. As shown, only the additional noise introduced by the homomorphic processing remains. Note that it is not necessary to completely remove the error term 284, or even to the point where only additional noise remains. The reduction in the error term in the output 202 compared to the input 201 is sufficient to make the bootstrap useful. Note that if further reduction is required, the bootstrap can be repeated.

[0114] System 200 obtains first ciphertext 211 from input ciphertext 201. These ciphertexts can be the same. Alternatively, an additional process 271 can be performed to derive the first ciphertext 211. For example, Figure 4 a illustrates an implementation in which such preprocessing is performed to gain an advantage. The first ciphertext 211 shares the same message (e.g., the same message items) as the input ciphertext 201, and may or may not have the same error terms.

[0115] Remove the message item from the first ciphertext 211 and extract the error item. This can be done by removing the message item in operation 220. There are several ways to do this, such as removing the message or setting the message to zero. This produces the second ciphertext 212. The second ciphertext 212 does not contain a message, but may not yet be suitable for further processing.

[0116] A conventional ciphertext, such as a third ciphertext 213, is obtained from the second ciphertext 212 using a conventional programmable bootstrap 250 (PBS). For example, the third ciphertext 213 may be an encryption of zero, which uses the extracted error term or an approximation thereof (e.g., the extracted error term with added noise) as the error. The extracted error term 213 with added noise is subtracted from the error term in the first ciphertext 211, and the result is less than a predetermined noise level, and preferably less than the error term in the first ciphertext 211.

[0117] PBS 250 is likely to be TFHE bootstrapping, but this is not necessarily the case. For example, NTRU bootstrapping could be used.

[0118] For example, after removing the message by left shifting, a right shift can be performed in PBS 250. Note that left shifting is a homomorphic operation because it can be viewed as repeated addition, while right shifting is not necessarily a homomorphic operation but can also be performed by PBS. In this case, the error term in the second ciphertext 212 extends further to the left, i.e., further towards the MSB, compared to the error term in the first ciphertext 211. For example, the error term can extend to the part of the ciphertext that is normally the message portion. The resulting third ciphertext 213 can be viewed as encryption of zero, with the extracted error term located at the expected position in the ciphertext.

[0119] Another option for removing the message is to zero out the message item, which is possible but may introduce additional noise into the message portion. In this case, the error term in the second ciphertext 212 is located at the expected position in the ciphertext, but the message portion may contain some random bits. The PBS 250 can remove these random bits. Similarly, the resulting third ciphertext 213 is an encryption of zeros with the error term from the first ciphertext.

[0120] Depending on, for example, the type of preprocessing or message removal performed, there may be a postprocessing 273, which is performed to obtain a third ciphertext 213 from the PBS output.

[0121] The PBS 250 can be, for example, a TFHE programmable bootstrap or an NTRU bootstrap. Other implementations of the PBS can be used. If the PBS has a superpolynomial time or space complexity over the length of the message portion, the implementation will show an improvement over using the PBS directly on the input.

[0122] After extracting the error term from the first ciphertext 211, the error term can be extracted from the message term. Error Term And homomorphically subtract the error term 260 from the fourth ciphertext 214, which may contain additional noise. The fourth ciphertext 214 may be equal to the first ciphertext 211, but may require further processing 274.

[0123] One reason for using further processing is to account for key switching. In homomorphic encryption schemes, multiple keys can be used. For example, a larger first key (which could be a GLWE key) and a smaller second key (which could be an LWE key). For example, a fourth ciphertext could be the first ciphertext, or a processed ciphertext (e.g., rounded ciphertext), possibly with one or more key switching applied.

[0124] In the detailed implementation scheme provided herein, the first key may have a size Where N = polynomial size and k = GLWE dimension, and the second key can have size ,in =LWE dimension. But more generally, key switching can be achieved from... up to n (and here) The output of the PBS operation can be a large first key size. PBS can output ciphertext encrypted using a flattened GLWE key. For example, the GLWE key can have... A polynomial with N coefficients produces a polynomial with A flattened GLWE key with multiple coefficients. Typically, bootstrapping in PBS is performed on ciphertext encrypted with a smaller second key, while the result of the bootstrapping is usually in a larger first key. Key switching to the appropriate key can be incorporated into the PBS procedure, although the detailed implementation described herein usually explicitly outlines the key switching. There may be more than two keys (possibly two or more keys of various sizes).

[0125] If we assume that the input ciphertext 201 is encrypted with a first key of a larger size (e.g., size kN), for example because it is obtained as the output of PBS, then at some point in the bootstrap, a key switch can be performed to switch from a larger key size to a smaller key size. This can be done at multiple points, such as at processing 271 or 272. Depending on where the key switch occurs, a key switch in the other direction can be performed at 274. Multiple implementations are included to illustrate multiple locations of key switching.

[0126] In one implementation, the key Take binary, ternary, and / or Gaussian values. In one implementation of PBS, the input to PBS is based on a second key, while the output is based on a first key, where the first key is larger than the second key, for example, having more elements.

[0127] One implementation is suitable for message items comprising a large number of bits. For example, in one implementation, the message item comprises at least 5 message bits, preferably at least 6 message bits, preferably at least 8 message bits, and preferably at least 10 message bits. The advantage of a larger message size is that processing can be performed on larger message words, thus resulting in faster processing. Bootstrapping according to one implementation can be applied to smaller message items, such as those with 4 or 5 bits. This has the advantage that bootstrapping according to one implementation, as well as conventional PBS, can be applied to the ciphertext.

[0128] Interestingly, the regular bootstrapping operation, including PBS 250, fails when the number of message bits is too large. By removing messages from the second ciphertext 212, the PBS's dependence on the input is reduced, or at least significantly reduced. Therefore, the bottleneck that PBS 250 might have does not apply to the entire bootstrapping operation.

[0129] Bootstrapping, according to one implementation, can offer several advantages. Conventional bootstrapping has computational complexity that is exponentially dependent on message precision. In one implementation, the computational complexity is independent of message precision. Therefore, it is assumed that... , and Bootstrapping is practically impossible for ciphertexts with large message precision (e.g., using common TFHE-class scheme cryptographic parameters (e.g., 10 bits)). One implementation allows for more efficient bootstrapping for larger plaintext precisions. Note that one implementation of bootstrapping can be performed in parallel using any suitable encoding method (e.g., those described in [1]). The message space is not necessarily divisible by the ciphertext modulus, which also applies to any multi-ciphertext representation, such as Radix or CRT decomposition, as detailed in [1].

[0130] An implementation can be iteratively invoked to reduce noise to a variable value. This provides greater flexibility and can reduce computation time depending on the use case.

[0131] In the TFHE-class scheme, it is assumed that and (For some) and Either padding bits in the message space are required, or the PBS should be computed multiple times to avoid this constraint. In one implementation, this assumption about the message space is removed, and multiple PBS computations are not required.

[0132] The new bootstrapping can be viewed as a more efficient way to apply conventional bootstrapping. For example, in one implementation, a method is provided for applying programmable bootstrapping in a fully homomorphic cryptographic scheme that at least supports homomorphic addition and programmable bootstrapping. The method includes: - Obtain the input ciphertext, which includes message items. Homomorphic encryption.

[0133] - Homomorphically extract error terms from a first ciphertext derived from the input ciphertext, the first ciphertext including message terms. Homomorphic encryption with an error term This yields a third ciphertext, which is a noisy homomorphic encryption with error terms and possible added noise. The extraction includes: - Obtain the second ciphertext by removing message items from the first ciphertext. - Apply the programmable bootstrapping to the second ciphertext to obtain the third ciphertext.

[0134] - From the message item The error term And in the ciphertext that may contain additional noise, the third ciphertext is homomorphically subtracted.

[0135] The following provides many detailed implementation schemes, illustrating some of the multiple options that can be taken.

[0136] Figure 3a An embodiment of one implementation of the homomorphic bootstrap system 300 is illustrated schematically. Figure 3a The input ciphertext 301 is shown. To remove a message from the ciphertext, a left shift of 320 is performed, shifting the message from the most significant part of the input ciphertext. The output is the second ciphertext 312. Note that the left shift operation (i.e., multiplying by a power of 2) is a natively homomorphic operation. For example, to shift left by 1 bit, you can add the number to itself.

[0137] For example, given LWE ciphertext Assuming the underlying module If it is a power of 2, then shift it to the left. Bit can be implemented as .if It is another integer If the power is 0, then the left shift can be implemented as follows: .

[0138] Figure 3b This operation is illustrated. Figure 3b The input ciphertext 311 is shown, with message item 283 and error item 284. After shifting left to remove message item 283, the second ciphertext 312 is obtained. Although Figure 3b These ciphertexts are shown without encryption (e.g., without applying a mask), but during the bootstrapping process, all values ​​associated with the message are encrypted because the processing is homomorphic.

[0139] A left shift produces ciphertext with an error term that extends unusually far into the most significant portion of the ciphertext. A PBS 350 is applied to move the error term back to its original position in the input ciphertext. For example, the PBS 350 can shift its input right by the same number of bits as a left shift message removal 320. Interestingly, the second ciphertext does not include the message term, so the PBS 350 does not bottleneck due to its dependence on the message input size. The PBS 350 can be designed for higher or lower accuracy, adding more or less additional noise. A lower-accuracy PBS will reduce the error by a smaller amount, but will also be smaller and faster, and will require less public material to perform the operation.

[0140] Assuming the input ciphertext 301 is encrypted with a large first key, a key switch 330 can be performed at this point (exactly after message removal 320 and exactly before PBS 350). Key switch 330 will encrypt the data from the large first key (e.g., a key of size 301). Switch to a smaller second key (e.g., size 10 ... The result of PBS 350 is the third ciphertext, 313. This is in Figure 3bAs shown in the diagram. The third ciphertext 313 no longer contains a message item, but still has an error term 284. Note that the right shift of PBS 350 does not need to be perfect and can introduce additional noise 285. This is not a problem.

[0141] Finally, the third ciphertext 313 (360) can be subtracted from the input ciphertext 301; note that the input ciphertext here is the same as the first ciphertext. Figure 3b The result of this subtraction is shown, which outputs the ciphertext 302. Figure 3b In the output 302, the additional noise 285 shown does not need to be the same as the noise shown for the third ciphertext 313.

[0142] In this scenario, a left shift of 320 bits on the input ciphertext causes the upper limit of the error term to start from the most significant bit. Generally, the error term can be shifted relative to the most significant bit to any desired position, but the closer to the most significant bit, the larger the allowed noise term. For example, in one implementation, the error term can be shifted to the most significant bit, the second most significant bit, or the third most significant bit. However, further removal from the most significant bit is also possible. Note that shifting to the most significant bit or the second most significant bit is not necessary. The error term can also be shifted to start from a later bit (e.g., the 3rd or 4th bit).

[0143] according to Figure 3a The implementation scheme's bootstrapping is more efficient than conventional PBS. When using traditional programmable bootstrapping, message precision (e.g., bits) limits the size of the polynomial used internally by the PBS. To add another bit of precision, i.e., to allow an additional message bit, the size of N needs to be doubled. Therefore, processing larger messages (e.g., messages of 5 bits or more) becomes very expensive. Figure 3a The algorithm in this paper can be scaled very well as the accuracy increases.

[0144] Figure 3b This demonstrates a significant reduction in the error term in the output ciphertext 302, although in practice, Figure 3a The system may produce a small reduction in error. It can be repeated multiple times. Figure 3a The bootstrapping mechanism removes more noise from the ciphertext. The second or subsequent iterations of the bootstrapping can differ from the first or previous iterations. This is because, after the first iteration, the error term is smaller. Therefore, the left shift is performed over more bits to bring the error term to the same position as in previous iterations, such as at the MSB bit. Similarly, the PBS can be adapted to shift the error term further to the right.

[0145] Below and Figure 3aA detailed implementation scheme is described consistently. It begins with ciphertext encrypted with a large key that requires noisy refresh. If this ciphertext happens to have already been encrypted with a small key, the algorithm can be adapted accordingly. We will subtract a ciphertext encrypted with an approximation of its most significant error bit: Figure 3a The process is illustrated below. To do this, we left-shift the ciphertext to remove the message and place the error in the most significant portion, switch its key to a smaller key, and compute an approximate PBS on the most significant portion of the error, where the identity lookup table (LUT) is rescaled to where the error was before the left shift. This PBS output can now be subtracted from the original ciphertext, and this operation is repeated if further noise reduction is needed. In the next iteration, the left shift will be further to the left because the amount of error in the ciphertext is smaller.

[0146] algorithm:

[0147]

[0148]

[0149]

[0150]

[0151] This algorithm assumes the noise originates from a normal distribution, but it can be easily adapted to handle other noise distributions, such as uniform and bivariate distributions. The algorithm is described using powers of 2, but it can be easily modified to handle ciphertext moduli other than powers of 2. GGSW and GLev further define this, for example, in the paper “Improved Programmable Bootstrapping with Larger Precision and Efficient Arithmetic Circuits for TFHE”, IIaria Chillotti, Damien Ligier, Jean-Baptiste Orfila, Samuel Tap, see paper 2021 / 729 in the CryptologyePrint archive, specifically page 7.

[0152] The following section presents a noise analysis of the algorithm.

[0153] get:

[0154] For decryptable Classical requirements for noise levels, for example,

[0155] Based on the assumption, we get

[0156] make Make ,in .make and as well as .Research Then we get

[0157] Calculate each ciphertext ( and phase Then we get

[0158] and

[0159] but

[0160] After approximate bootstrapping, we obtain:

[0161] Notice and Then we get

[0162] Finally, we get

[0163] Therefore, using facts And using assumptions The boundary can be found:

[0164] This bound can be used to reapply the algorithm to remove more noise. If you want to track the variance of the noise instead of the bound, you can do the following: Let In order to be in The uniform distribution of values ​​in the matrix makes:

[0165] Therefore, we get:

[0166] Research The distribution has a characteristic of being determined by... The bounded value, therefore we know, Less than makes the variance in the interval The variance of the distribution that maximizes the variance. We know that this variance is a two-point distribution: with The probability value For example, if the variance is 1. Therefore, we get

[0167] in It is the variance of the noise at the output of blind rotation, and This is the noise variance added by analog-to-digital switching.

[0168] The following presents an iterative version of the above bootstrapping algorithm.

[0169] algorithm

[0170]

[0171]

[0172]

[0173]

[0174] Figure 4 An embodiment of one implementation of homomorphic bootstrapping is illustrated schematically. Figure 4 self-initiation and Figure 3a The bootstrapping mechanism is similar. The error term is extracted from a first ciphertext containing message items and error terms, and then subtracted from the first ciphertext. However, by performing preprocessing and adapting the subtraction portion to account for this preprocessing, more efficient noise reduction is achieved.

[0175] Figure 4 The diagram shows input ciphertext 401. Assume input ciphertext 401 is encrypted using a first large key. This ciphertext is switched to a second small key during the first key switch 431. This may introduce noise. After the key switch, rounding operation 440 is performed. The first ciphertext 411 is obtained in this way.

[0176] Rounding reduces the number of bits used to represent the message and error terms. For example, it reduces the number of bits used to represent LWE encrypted ciphertext with a modulus of 2. Rounding can be implemented as .in Perform rounding operations, such as rounding to the nearest integer. If the modulus... For example If the power is 0, then rounding can be implemented as follows: .

[0177] Rounding to mask Middle and main body The lowest valid position in the PBS is zero, which prevents the analog-to-digital switching of the PBS from adding noise.

[0178] From the first ciphertext 411, messages are removed by left shift 420; this produces the second ciphertext 412. The second ciphertext 412 is followed by a programmable bootstrap 450. The programmable bootstrap 450 shifts the error term of the first ciphertext 411 back to the right. In this way, a third ciphertext 413 with an isolated error term is obtained. Note that in this embodiment, the input to the programmable bootstrap is rounded before the programmable bootstrap.

[0179] Since the programmable bootstrap 450 typically produces an output encrypted with a first large key, while the first ciphertext 411 is encrypted with a second small key, a further key switch is performed. The first ciphertext 411 is key-switched in the second key switch 432 to produce a fourth ciphertext 414. In subtraction 460, the third ciphertext 413 is subtracted from the fourth ciphertext 414 to obtain the output ciphertext 402.

[0180] Therefore, the third ciphertext can be obtained by switching the input ciphertext from the first key to the second key, rounding it, shifting the ciphertext left, and then applying a programmable bootstrap.

[0181] According to Figure 3a In this implementation, the polynomial size N is constrained by the size of the noise to be removed—unlike the classic PBS, where N is constrained by the message size. According to... Figure 4 In the implementation scheme, the magnitude of the noise removed does not affect the choice of N, thus making it a better alternative for removing large noise terms.

[0182] In this bootstrap implementation, all noise reduction is performed in a single PBS. Iterations to further reduce noise are unnecessary. This makes this implementation significantly faster for noise reduction. This is achieved by converting the input ciphertext into a ciphertext containing a large amount of error while also having a small amount of non-zero data. This can be done by rounding the ciphertext, preferably to the most significant possible bit that will not compromise the message; rounding to a lower level will also work, albeit less efficiently. To prevent subsequent key switching from invalidating the rounding result, a key switching operation to the smaller key is performed before the rounding operation.

[0183] From here, the algorithm is split into two paths. In one path, the key is switched back to the large key; in the other, a left shift is performed to remove the message portion and the PBS is computed over the error. Interestingly, since the PBS has already been rounded, there will be no further rounding during the modulus switch of this PBS, thus adding no new noise. This means that a lookup table (LUT) can be used without redundancy to compute the identity function rescaled to the correct position. No approximate LUT evaluation is required. This allows for a smaller polynomial for this bootstrapping because redundancy is eliminated. The final step is the computation of subtraction to obtain the desired output.

[0184] The following password parameters must be considered: Key:

[0185] Minimize key switching:

[0186] Expanded key switching:

[0187] Rounding:

[0188] Blind rotation:

[0189] algorithm

[0190]

[0191]

[0192]

[0193]

[0194] In homomorphic computations (where noise reduction is needed when it may become excessive, such as after several operations), this bootstrapping algorithm can be used to reduce errors, for example, as an alternative to conventional PBS. The algorithm can perform bootstrapping operations under a variety of conditions. For example, the following equations define the conditions for noise reduction and reliability enhancement of the algorithm. These equations serve as optimization conditions or guidelines but are not to be interpreted as mandatory requirements for algorithm operation. By following these guidelines, users can reduce the chance of failures or suboptimal results. For example, the above algorithm reduces noise and maintains correctness if the following conditions are met: 1. Sufficiently low input noise:

[0195] 2. Expand the precise decomposition of key switching:

[0196] 3. A sufficiently large polynomial:

[0197] 4. Sufficiently low output noise: If item 2 above is present, then expanding KS has no rounding error.

[0198] 5. Retain padding bits before the error reaches BR.

[0199] In this algorithm, It is the standard score used to construct confidence intervals. It is the input variance. It is the variance added during key switching. It is the variance added during rounding. It is a scaling factor, for example ,in It is the ciphertext modulus and It's about precision. and It is the decomposition level and decomposition basis of key switching. Indicates the position for rounding.

[0200] This algorithm is proposed for normally noise distributions because it uses... This is used to construct confidence intervals. Technicians can adapt this to handle other noise distributions, such as uniform distributions and bounded distributions. For example, Equation 1 above can be transformed into... The algorithm can be further improved by sharing a randomness key. For example, for all ,set up As a result, the first key switch was faster and added noise. Fewer, and the second key switch is free and does not add noise. More information about shared randomness keys can be found in the paper “Faster Secret Keys for (T)FHE”, Loris Bergerat, IIaria Chillotti, Damien Ligier, Jean-Baptiste Orfila, Adeline Roux-Langlois, Samuel Tap, available in the Cryptology Archive, paper 2023 / 979.

[0201] Figure 5 An embodiment of one implementation of the homomorphic bootstrapping 500 is schematically illustrated. (See reference...) Figures 2a to 4 Similar to the implementation scheme discussed, this scheme also isolates the error term and subtracts the isolated error term from the ciphertext that includes both the error term and the message term. In this way, the error is removed, but the resulting ciphertext still contains noise due to factors such as noise added during the isolation process, although this noise is reduced compared to the original ciphertext. Figure 5 The difference between this implementation scheme and the previous implementation scheme lies in the way error terms are isolated.

[0202] Figure 5 The diagram shows the input ciphertext 501. To obtain the second ciphertext 512, the message items in ciphertext 501 are zeroed out. For example, ciphertext 501 can be shifted left by 521 and then right by 522. Although right shift is directly supported by the underlying homomorphic cryptography, the right shift operation is not. Interestingly, the inventors found that while the right shift operation approximates the right shift operation, it comes at the cost of introducing additional noise into the message portion.

[0203] For example, given LWE ciphertext Message items can be removed in the following ways: .

[0204] Multiplication terms Remove the highest-order valid part (including the message) from the ciphertext and place the noise in the higher-order valid part of the ciphertext; this is a left shift operation. (Division term) The noise is rescaled to the same location as in the input ciphertext 501, but this also introduces new errors into the most valid part of the plaintext.

[0205] Therefore, the second ciphertext 512 has an isolated error term, but there is also additional noise in the message portion of the ciphertext. The second ciphertext 512 can be viewed as encryption of a small but random message. A PBS 550 is then performed to isolate this new noise in the message portion. Before the PBS, a key switch 530 is performed to switch to the smaller key. The result of the PBS 550 is then subtracted from the second ciphertext 512 in the first subtraction 561 to obtain the third ciphertext. Finally, the third ciphertext 513 is subtracted from the input ciphertext 501 in the second subtraction 562 to produce the output ciphertext 502.

[0206] The PBS 550 can implement the identity function. This is feasible because the noise introduced by right-shifting by 522 is typically small, especially smaller than the message. A PBS that bootstraps over this noise value (in this case, reducing noise while performing the identity function) is far more resource-efficient than, for example, performing the PBS directly on the input ciphertext 501. The latter's PBS must work over the entire message space, while the PBS 550 only needs to work over a much smaller message space.

[0207] as Figure 4 In this implementation scheme, all noise reduction is also accomplished in a single PBS cycle. Figure 5 One advantage of this implementation scheme is that it requires only a single key switch, replacing methods such as... Figure 4 The required key switching involves two key shifts. The idea is to left-shift the input ciphertext, assumed to be encrypted with the first large LWE key, to place noise in the most significant bit, and then right-shift the ciphertext. This right shift adds bounded random noise to the MSB of the plaintext. If the right shift is large enough, there will be padding bits in the MSB of the plaintext. Then, a key switch and exact bootstrapping with an identity LUT are performed. The resulting ciphertext can be subtracted from the right-shifted ciphertext, which removes the noise introduced into the MSB of the plaintext by this right shift. Finally, the ciphertext obtained from the input ciphertext is subtracted, which reduces the noise.

[0208] algorithm

[0209]

[0210]

[0211]

[0212]

[0213] If desired, the padding bits after noise reduction can be guaranteed. This is convenient, for example, if regular PBS can be applied to the ciphertext later. Based on the assumptions, we get: .

[0214] make ,in .make Make It can be seen The phase. Based on the construction, we know... .get:

[0215] To perform PBS, at least one padding bit is required, for example, it needs to have at least one padding bit. First, try to find a condition to ensure ,For example Therefore, research is needed. The distribution of .

[0216] make ,For example .Research The distribution of . We obtain:

[0217] Using the central limit theorem, where Is inputting ciphertext The noise variance is:

[0218] Assumption It is negligible. For example, it can be removed from... Subtract from the middle to center the distribution. Now, note:

[0219] A confidence interval can be constructed using the previous distribution, where

[0220]

[0221] In order to make With a probability of success They need to have the same probability. That is, it is necessary to:

[0222] And know Therefore, we get:

[0223] get This will satisfy the conditions required to guarantee the fill position. .really:

[0224] For example, for and It can be used This is feasible here because in this embodiment, only... At this point, the message precision is 8. Because... Then there is .

[0225] Figure 6 An embodiment of a method 600 for reducing error terms in ciphertext is illustrated schematically. Method 600 may be computer-implemented and includes: - Obtain (610) the input ciphertext, which includes message items. Homomorphic encryption, - Homomorphically extract error terms (620) from a first ciphertext derived from the input ciphertext, the first ciphertext including message terms. Homomorphic encryption with an error term The extraction process involves obtaining a third ciphertext, which is a noisy homomorphic encryption with error terms and possible added noise. - Obtain the second ciphertext (621) by removing message items from the first ciphertext. - Apply (622) programmable bootstrapping to the second ciphertext to obtain the third ciphertext.

[0226] - From including message items Error Term And homomorphically subtract the third ciphertext described in (630) from the ciphertext that may contain additional noise.

[0227] For example, the method can be a computer-implemented method. For example, obtaining the input ciphertext can be accomplished using a communication interface (e.g., an electronic interface, a network interface, a memory interface, etc.). For example, storing or retrieving data using a computer-implemented method can be accomplished using electronic storage (e.g., memory, a hard disk, etc.). For example, extracting and subtracting error terms can be accomplished using an electronic computing device (e.g., a computer).

[0228] Many different ways of performing the method are possible, as will be apparent to those skilled in the art. For example, the steps may be performed in the order shown, but the order may be changed, or some steps may be performed in parallel. Furthermore, other method steps may be inserted between steps. The inserted steps may represent an improvement to the method described herein, or may be unrelated to the method. For example, some steps may be performed at least partially in parallel. Moreover, a given step may not be fully completed before the next step begins.

[0229] Implementations of the method may be executed using software, which includes instructions for causing a processor system to execute one implementation of method 600. The software may only include those steps taken by a specific sub-entity of the system. The software may be stored on a suitable storage medium (e.g., hard disk, floppy disk, memory, optical disk, etc.). The software may be transmitted as a signal via wired or wireless means or using a data network (e.g., the Internet). The software may be available on a server for download and / or for remote use. Implementations of the method may be executed using a bitstream configured to configure programmable logic (e.g., a field-programmable gate array (FPGA)) to execute one implementation of the method.

[0230] It will be understood that the subject matter of this disclosure is also extended to computer programs suitable for implementing the subject matter of this disclosure, specifically computer programs on or in a carrier. Programs may be in the form of source code, object code, intermediate source code, and object code such as partially compiled form, or any other form suitable for implementing the methods. Embodiments relating to a computer program product include computer-executable instructions corresponding to each processing step of at least one of the stated methods. These instructions may be subdivided into subroutines and / or stored in one or more files that can be statically or dynamically linked. Another embodiment relating to a computer program product includes computer-executable instructions corresponding to each device, unit, and / or portion of at least one of the stated systems and / or products.

[0231] Figure 7a A computer-readable medium 1000 having a writable portion 1010 and a computer-readable medium 1001 also having a writable portion are shown. The computer-readable medium 1000 is shown in the form of an optically readable medium. The computer-readable medium 1001 is shown in the form of electronic memory, in this example, a memory card. Both computer-readable media 1000 and 1001 can store data 1020, wherein the data can instruct instructions, when executed by a processor system, to cause the processor system to perform an embodiment of a method for reducing error terms according to one embodiment. The computer program 1020 may be implemented on the computer-readable medium 1000 as a physical marker or by magnetization of the computer-readable medium 1000. However, any other suitable implementation is contemplated. Furthermore, it will be understood that although the computer-readable medium 1000 is shown herein as an optical disc, the computer-readable medium 1000 can be any suitable computer-readable medium, such as a hard disk, solid-state memory, flash memory, etc., and can be non-recordable or recordable. The computer program 1020 includes instructions for causing a processor system to perform an embodiment of the method for reducing error terms.

[0232] Figure 7b A schematic representation of a processor system 1140 according to one embodiment of a system for reducing error terms is shown. The processor system includes one or more integrated circuits 1110. The architecture of the one or more integrated circuits 1110 is schematically shown in... Figure 7bThe circuit 1110 includes a processing unit 1120 (e.g., a CPU) for running computer program components to execute methods according to one embodiment and / or implement modules or units thereof. The circuit 1110 includes memory 1122 for storing programming code, data, etc. A portion of memory 1122 may be read-only. The circuit 1110 may include a communication element 1126, such as an antenna, a connector, or both. The circuit 1110 may include an application-specific integrated circuit 1124 for performing some or all of the processing defined in the method. The processor 1120, memory 1122, application-specific integrated circuit 1124, and communication element 1126 may be connected to each other via interconnect 1130 (e.g., a bus). The processor system 1110 may be arranged to perform contact communication and / or contactless communication using antennas and / or connectors, respectively.

[0233] For example, in one embodiment, the processor system 1140 (e.g., an error term reduction device) may include processor circuitry and memory circuitry, the processor being configured to execute software stored in the memory circuitry. For example, the processor circuitry may be an Intel Core i7 processor, an ARM Cortex-R8, etc. The memory circuitry may be ROM circuitry or non-volatile memory (e.g., flash memory). Alternatively, the memory circuitry may be volatile memory (e.g., SRAM memory). In the latter case, the device may include a non-volatile software interface (e.g., a hard disk, a network interface, etc.) configured to provide the software.

[0234] Although system 1140 is shown as including one of each described component, multiple components may be repeated in multiple embodiments. For example, processing unit 1120 may include multiple microprocessors configured to independently execute the methods described herein, or configured to execute elements or subroutines of the methods described herein, such that multiple processors cooperate to perform the functions described herein. Additionally, when system 1140 is implemented in a cloud computing system, multiple hardware components may belong to separate physical systems. For example, processor 1120 may include a first processor in a first server and a second processor in a second server.

[0235] It should be noted that the embodiments mentioned above are illustrative and not limiting of the subject matter of this disclosure, and those skilled in the art will be able to devise many alternative embodiments.

[0236] In the claims, any reference numerals enclosed in parentheses shall not be construed as limiting the claims. The use of the verb 'comprise' and variations thereof does not exclude the presence of elements or steps other than those recited in the claims. The article 'a' or 'an' preceding an element does not exclude the presence of a plurality of such elements. When an expression such as 'at least one' precedes a list of elements, it indicates the selection of all elements or any subset thereof from the list. For example, the expression 'at least one of A, B, and C' should be understood to include only A, only B, only C, both A and B, both A and C, both B and C, or all of A, B, and C. The subject matter of this disclosure can be implemented by hardware comprising several different elements, as well as by a suitably programmed computer. In device claims enumerating several parts, several of these parts can be implemented by the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to exert an advantage.

[0237] In the claims, the reference numerals enclosed in parentheses refer to reference numerals in the drawings illustrating the embodiments or formulas of the embodiments, thereby improving the comprehensibility of the claims. These reference numerals should not be construed as limiting the claims.

Claims

1. A method (600) for reducing an error term in ciphertext in a fully homomorphic encryption scheme supporting at least homomorphic addition and programmable bootstrapping, the method comprising: - obtaining (610) input ciphertext, the input ciphertext comprising a message item homomorphically encrypted; - homomorphically extracting the error term (620) from a first ciphertext, the first ciphertext being derived from the input ciphertext, the first ciphertext comprising a message term homomorphically encrypted and having an error term ; obtaining a third ciphertext, the third ciphertext being a noisy homomorphic encryption of the error term with possible additional noise; the extracting comprising: - obtaining (621) a second ciphertext by removing the message term from the first ciphertext; - applying (622) a programmable bootstrapping to the second ciphertext from which the third ciphertext is obtained; - homomorphically subtracting (630) said third ciphertext from a ciphertext comprising said message item , said error item and possibly additional noise.

2. The method for reducing an error term as claimed in claim 1, wherein removing the message term comprises left-shifting a ciphertext comprising the message term, the error term and possible additional noise to remove the message term but preserve the error term.

3. The method for reducing an error term as claimed in claim 2, wherein the programmable bootstrapping implements a right-shift by the same number of bits as the left-shift.

4. The method for reducing an error term as claimed in any of claims 2-3, wherein left-shifting the ciphertext results in the error term being upper bounded from the most significant bit or the next most significant bit.

5. The method for reducing an error term as claimed in any of the preceding claims, wherein the input ciphertext is encrypted under a first key, the key-switching operation is defined from the first key to a second, smaller key, the second key being smaller than the first key, the input to the programmable bootstrapping having been key-switched to the second key.

6. The method for reducing an error term as claimed in claim 5, comprising left-shifting the first ciphertext, key-switching from the first key to the second key, and applying the programmable bootstrapping, thereby obtaining the third ciphertext.

7. The method for reducing an error term as claimed in any of the preceding claims, wherein the input to the programmable bootstrapping has been rounded prior to the programmable bootstrapping.

8. The method for reducing error terms as claimed in claim 7, comprising: key-switching the input ciphertext from the first key to the second key, rounding, left-shifting the ciphertext, and applying the programmable bootstrapping, thereby obtaining the third ciphertext.

9. The method for reducing an error term as claimed in claim 7 or 8, wherein homomorphically subtracting the third ciphertext comprises key-switching the rounded ciphertext from the second key to the first key and subtracting the third ciphertext therefrom.

10. The method for reducing an error term as claimed in claim 5, wherein obtaining a second ciphertext comprises zeroing at least a most significant portion of the message term in the ciphertext, key-switching from the first key to the second key, and applying a programmable bootstrapping, wherein the programmable bootstrapping implements an identity function.

11. The method for reducing an error term as claimed in claim 10, wherein the output of the programmable bootstrapping is subtracted from the zeroed ciphertext to obtain the third ciphertext.

12. The method for reducing an error term as claimed in any of the preceding claims, wherein the method for reducing an error term is repeated to further reduce the error term.

13. The method for reducing error terms according to any of the preceding claims, wherein the message term comprises at least 6 message bits, preferably at least 8 message bits, preferably at least 10 message bits, preferably at least 12 message bits.

14. The method for reducing error terms according to any of the preceding claims, wherein the ciphertext is an LWE or GLWE ciphertext.

15. The method for reducing error terms according to any of the preceding claims, wherein the message term is a plurality of messages.

16. The method for reducing error terms according to any of the preceding claims, wherein the most significant bits of the input ciphertext are used for the message term.

17. The method for reducing error terms according to any of the preceding claims, comprising: - obtaining a desired error reduction level, - iteratively performing the method for reducing error terms to reach the desired error reduction level.

18. A system comprising: one or more processors; and one or more memory devices storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations for the method according to any of the preceding claims.

19. A non-transitory computer storage medium encoded with instructions that, when executed by one or more computers, cause the one or more computers to perform the operations of any of claims 1-17.

Images