Electronic device and control method thereof

Abstract

The invention discloses an electronic device and a control method thereof. In particular, the electronic device includes a memory storing instructions and a processor configured to execute the instructions, the processor configured to obtain a first plaintext matrix and a second plaintext matrix, encrypt the first plaintext matrix based on a lattice password encryption manner to obtain a first ciphertext matrix; encrypting the second plaintext matrix based on a structure comprising two ciphertext pairs to obtain a second ciphertext matrix, wherein each of the two ciphertext pairs comprises a first type matrix and a second type matrix; decomposing elements of the first ciphertext matrix according to a predefined tool vector to obtain a plurality of decomposition components; and obtaining an output ciphertext corresponding to a product result of the first plaintext matrix and the second plaintext matrix based on an inner product operation between the plurality of decomposition components and elements of the second ciphertext matrix.

Description

Technical Field

[0001] This disclosure relates to an electronic device and its control method, specifically, to an electronic device and its control method capable of performing matrix multiplication in encrypted state. Background Technology

[0002] In recent years, with the application of homomorphic encryption in various data processing environments, the demand for matrix operations in encrypted states has been increasing. Homomorphic encryption can perform operations without decrypting plaintext, but due to its high computational complexity and the accumulation of error terms, it still faces significant technical challenges in efficient implementation. In particular, in homomorphic encryption, when processing matrix operations containing large amounts of data in ciphertext states, the computational load and memory usage increase exponentially.

[0003] In this context, ciphertext-ciphertext matrix multiplication (CCMM), which involves multiplying matrices in ciphertext, has become one of the most fundamental and important problems. However, existing techniques typically do not directly perform CCMM. Instead, they use a method that reduces the process to plaintext-plaintext matrix multiplication (PPMM) and then repeatedly performs rotation and key switching. However, this method has been shown to have significant limitations in terms of computational efficiency.

[0004] In particular, the key switching process involves mathematically complex number-theoretic transformations (NTTs), which significantly increase computational load and processing latency. Furthermore, the need to prepare additional keys for key exchange in advance increases system memory usage and management burden. Therefore, existing technologies have limitations in terms of computational efficiency, resource consumption, and stability. Summary of the Invention

[0005] Problem Solving Methods The aspects described in this disclosure are intended to at least solve the above-mentioned problems and to provide an electronic device and a control method thereof that can efficiently perform matrix multiplication in encrypted state while eliminating complex computational processes such as key switching.

[0006] Other aspects will be set forth in part in the description which follows, and will be apparent in part from the description, or may be learned by practicing the presented embodiments.

[0007] According to one aspect of this disclosure, an electronic device includes a memory storing instructions and a processor configured to execute the instructions, the processor being configured to: obtain a first plaintext matrix and a second plaintext matrix; encrypt the first plaintext matrix using a lattice cipher to obtain a first ciphertext matrix; encrypt the second plaintext matrix using a structure comprising two ciphertext pairs, each of the two ciphertext pairs comprising a first type matrix and a second type matrix, to obtain a second ciphertext matrix; decompose the elements of the first ciphertext matrix according to a predefined gadget vector to obtain multiple decomposed components; and obtain an output ciphertext corresponding to the product of the first plaintext matrix and the second plaintext matrix based on the inner product operation between the multiple decomposed components and the elements of the second ciphertext matrix.

[0008] The processor can obtain the first ciphertext matrix by combining each row or column of the first plaintext matrix with the value of the secret key corresponding to the lattice-based encryption method, thereby converting it into a ciphertext pair containing the first type matrix and the second type matrix.

[0009] The processor can convert the secret key based on lattice cipher encryption into a Toeplitz matrix, and multiply each row or column of the first plaintext matrix with the Toeplitz matrix to generate a second type matrix. By combining the second type matrix with the first type matrix to form a ciphertext pair, the first ciphertext matrix can be obtained.

[0010] The processor can make the first ciphertext pair of the two ciphertext pairs correspond to the second plaintext matrix, and make the second ciphertext pair of the two ciphertext pairs correspond to the product of an auxiliary secret key different from the secret key of the lattice-based encryption method and the second plaintext matrix, thereby obtaining the second ciphertext matrix.

[0011] The processor can make the first type matrix contained in each of the two ciphertext pairs correspond to the second plaintext matrix or the product of the auxiliary secret key and the second plaintext matrix, and make the second type matrix contained in each of the two ciphertext pairs correspond to the secret key based on the lattice cipher encryption method, thereby obtaining the second ciphertext matrix.

[0012] The processor can multiply each element of the second plaintext matrix with the Toplitz matrix to generate a second type matrix, and combine the generated second type matrix with the first type matrix to obtain the first ciphertext pair; multiply each element of the second plaintext matrix with the auxiliary secret key and the Toplitz matrix to generate a second type matrix, and combine the generated second type matrix with the first type matrix to obtain the second ciphertext pair, thereby obtaining a second ciphertext matrix containing the first ciphertext pair and the second ciphertext pair.

[0013] The processor can decompose the elements of the first ciphertext matrix according to the digital components of the tool vector to obtain the plurality of decomposed components, and for each of the plurality of decomposed components, perform an inner product operation with the first type matrix and the second type matrix contained in the second ciphertext matrix respectively, thereby forming an ordered pair containing two inner product results. By combining the ordered pair, the output ciphertext can be obtained.

[0014] Before encrypting the second plaintext matrix, the processor can perform a packing process on the elements of the second plaintext matrix to combine them into a single plaintext, based on a common modulus applied to the elements of the second plaintext matrix and multiple independent moduli corresponding to multiple blocks that distinguish the elements of the second plaintext matrix, and encrypt the packed second plaintext matrix, thereby obtaining the second ciphertext matrix.

[0015] The processor can perform a packing process on the second plaintext matrix such that the elements of the second plaintext matrix are represented as 0 relative to the common modulus, and that the elements of the second plaintext matrix are represented as element values ​​multiplied by the common modulus relative to each of the plurality of independent moduli.

[0016] The multiple independent moduli can be set to have a coprime relationship.

[0017] After obtaining the output ciphertext, the processor performs a modulo operation on the output ciphertext to extract the value corresponding to the common modulus and the value corresponding to each of the plurality of independent moduli. Based on the extracted values, the product of the first plaintext matrix and the second plaintext matrix is ​​separated into blocks corresponding to each of the plurality of blocks.

[0018] According to one aspect of this disclosure, a method for controlling an electronic device may include the following steps: obtaining a first plaintext matrix and a second plaintext matrix; encrypting the first plaintext matrix using a lattice cipher to obtain a first ciphertext matrix; encrypting the second plaintext matrix using a structure comprising two ciphertext pairs, each of the two ciphertext pairs comprising a first type matrix and a second type matrix to obtain a second ciphertext matrix; decomposing the elements of the first ciphertext matrix according to a predefined tool vector to obtain multiple decomposed components; and obtaining an output ciphertext corresponding to the product of the first plaintext matrix and the second plaintext matrix based on the inner product operation between the multiple decomposed components and the elements of the second ciphertext matrix.

[0019] According to one aspect of this disclosure, for a non-transitory computer-readable storage medium including a program for performing a method of controlling an electronic device, the method of the control electronic device may include the following steps: obtaining a first plaintext matrix and a second plaintext matrix; encrypting the first plaintext matrix based on a lattice cipher encryption method to obtain a first ciphertext matrix; encrypting the second plaintext matrix based on a structure containing two ciphertext pairs, wherein each of the two ciphertext pairs contains a first type matrix and a second type matrix to obtain a second ciphertext matrix; decomposing the elements of the first ciphertext matrix according to a predefined tool vector to obtain a plurality of decomposed components; and obtaining an output ciphertext corresponding to the product result of the first plaintext matrix and the second plaintext matrix based on an inner product operation between the plurality of decomposed components and the elements of the second ciphertext matrix. Attached Figure Description

[0020] The foregoing and other aspects, features and advantages of this disclosure will become more apparent from the accompanying drawings in conjunction with the following detailed description.

[0021] Figure 1 This is a schematic diagram illustrating the structure of an electronic device according to an embodiment of the present disclosure.

[0022] Figure 2 This is an operational diagram illustrating in detail the process of obtaining the first ciphertext, the process of obtaining the second ciphertext, and the process of obtaining the output ciphertext according to an embodiment of the present disclosure.

[0023] Figure 3 This is a schematic diagram illustrating the packaging of a plaintext matrix according to an embodiment of the present disclosure.

[0024] Figure 4 This is a flowchart illustrating a control method for an electronic device according to an embodiment of the present disclosure. Detailed Implementation

[0025] This embodiment can be modified and has various embodiments, and is intended to illustrate and describe a specific embodiment in conjunction with the accompanying drawings. However, it should be understood that this is not intended to limit the scope of a particular implementation, but rather to include various modifications, equivalents, and / or alternatives to the embodiments of this disclosure. Regarding the description of the drawings, the same reference numerals may be used for similar constituent elements.

[0026] In describing this disclosure, detailed descriptions of relevant well-known functions or configurations are omitted if it is believed that such descriptions would unnecessarily obscure the gist of this disclosure.

[0027] Furthermore, the following embodiments can be modified in many other forms, and the scope of the technical concept of this disclosure is not limited to the following embodiments. Rather, these embodiments are intended to illustrate the disclosure more fully and completely, and to fully convey the technical concept of the disclosure to those skilled in the art.

[0028] The terminology used in this disclosure is for illustrative purposes only and is not intended to limit the scope of the claims. Unless the context clearly indicates otherwise, singular expressions include plural expressions.

[0029] In this disclosure, expressions such as “having,” “may have,” “include,” or “may include” indicate the presence of a corresponding feature (such as a numerical value, function, operation, or component) and do not exclude the presence of additional features.

[0030] In this disclosure, expressions such as “A or B”, “at least one of A and / or B”, or “one or more of A and / or B” can include all possible combinations of parallel items. For example, “A or B”, “at least one of A and B”, or “at least one of A or B” can refer to: (1) containing at least one A; (2) containing at least one B; or (3) containing at least one A and at least one B.

[0031] The expressions “first,” “second,” “first,” “second,” etc., used in this disclosure may be used to modify various constituent elements, regardless of their order and / or importance, and are only used to distinguish one constituent element from another, without limiting these constituent elements.

[0032] When it is mentioned that a component (e.g., a first component) is "functionally or communicatively coupled with / to" or "connected to" another component (e.g., a second component), it should be understood that the component can be directly connected to the other component or can be connected through another component (e.g., a third component).

[0033] On the other hand, when it is mentioned that a certain component (e.g., the first component) is "directly coupled" or "directly connected" to another component (e.g., the second component), it can be understood that there are no other components (e.g., the third component) between the said component and the other component.

[0034] The expression “configured to” as used in this disclosure may be used interchangeably with expressions such as “suitable for”, “having the capacity to”, “designed to”, “adapted to”, “made to”, or “capable of”, depending on the context. The term “configured to” does not necessarily refer only to situations where the hardware is “specifically designed to”.

[0035] Conversely, in some cases, the expression "a device configured as..." can indicate that the device is capable of cooperating with other devices or components to "perform". For example, the phrase "a processor configured (or set to) perform A, B, and C" can mean: a dedicated processor (e.g., an embedded processor) for performing the corresponding operations, or a generic-purpose processor (e.g., a CPU or application processor) that can perform these operations by executing one or more software programs stored in a storage device.

[0036] The “module” or “component” in the embodiments performs at least one function or operation and can be implemented by hardware, software, or a combination of hardware and software. Additionally, apart from “modules” or “components” that require implementation by specific hardware, multiple “modules” or multiple “components” can be integrated into at least one module and implemented by at least one processor.

[0037] Furthermore, all elements and regions in the figures are drawn schematically. Therefore, the technical concept of the present invention is not limited by the relative dimensions or spacing shown in the figures.

[0038] The embodiments described herein will now be described in detail with reference to the accompanying drawings, so that those skilled in the art to which this disclosure pertains can readily implement this disclosure.

[0039] Figure 1 This is a schematic diagram illustrating the structure of an electronic device (100) according to an embodiment of the present disclosure. Figure 1 As shown, the electronic device (100) may include a memory (110) and a processor (120). However, Figure 1 The configuration shown is merely exemplary; in implementing this disclosure, in addition to Figure 1 In addition to the configuration shown, new configurations can of course be added or some configurations can be omitted. For example, the electronic device (100) may also include: a communication interface capable of communicating with external devices (such as a WiFi module, Bluetooth module, wireless communication module, NFC module, and UWB [Ultra-Wideband] module); an input interface capable of receiving user input (such as a microphone, touch screen, etc.); and an output interface capable of outputting various information (such as a display, speaker, etc.).

[0040] The memory (110) may store at least one instruction related to the electronic device (100). Furthermore, the memory (110) may also store an operating system (O / S) for driving the electronic device (100). In addition, the memory (110) may store various software programs or applications for operating the electronic device (100) of various embodiments of this disclosure. Moreover, the memory (110) may include semiconductor memory such as flash memory or magnetic storage media such as hard disk.

[0041] Specifically, various software modules for operating the electronic device (100) of various embodiments of the present disclosure can be stored in a memory (110), and the processor (120) can control the operation of the electronic device (100) by executing the various software modules stored in the memory (110). That is, the memory (110) is accessed by the processor (120), and the processor (120) can read / write / modify / delete / update data.

[0042] Additionally, in this disclosure, the term memory (110) may be used to refer to a memory (110), a ROM or RAM within a processor (120), or a memory card (e.g., a micro SD card, memory stick) installed in an electronic device (100).

[0043] In one embodiment, the memory (110) may store information regarding the input ciphertext, output ciphertext, encryption method (e.g., CKKS) described herein. The memory (110) may also store various algorithms for performing the operations described herein. Furthermore, various information required to achieve the objectives of this disclosure may be stored in the memory (110), and the information stored in the memory (110) may be updated based on information received from an external device or information input by a user.

[0044] The processor (120) controls the overall operation of the electronic device (100). Specifically, the processor (120) may be connected to a configuration of the electronic device (100) including a memory (110). The processor (120) may include a processing circuit and may be implemented using at least one processor (120). That is, the processor (120) may be implemented using one or more processors (120). The processor (120) can control the operation of the electronic device (100) by executing instructions stored in the memory (110) individually or collectively.

[0045] The processor (120) can be implemented in a variety of ways. For example, the processor (120) can be implemented in at least one of the following forms: application-specific integrated circuit (ASIC), embedded processor, microprocessor, hardware control logic, hardware finite state machine (FSM), or digital signal processor (DSP). In addition, in this disclosure, the term "processor (120)" can be used to refer to units including a central processing unit (CPU), a graphics processing unit (GPU), and a microprocessor unit (MPU).

[0046] In one embodiment, the processor (120) can convert plaintext into ciphertext and perform matrix multiplication between ciphertexts to obtain output ciphertext corresponding to the plaintext product. Various embodiments executed by the processor (120) will be described in detail below.

[0047] The term "encryption" as used in this disclosure can refer to the result of encrypting plaintext using a homomorphic encryption scheme. For example, the encryption described in this disclosure can include the "CKKS (Cheong-Kim-Kim-Song) encryption" scheme, a homomorphic encryption scheme used for complex number approximation operations. However, the encryption described in this disclosure is not limited to the CKKS scheme and can be applied to various other encryption schemes, such as Fast Fully Homomorphic Encryption over the Torus (TFHE), BGV (Brakerski-Gentry-Vaikuntanathan scheme), and BFV (Brakerski-Fan-Vercauteren scheme).

[0048] The processor (120) can obtain a first plaintext matrix and a second plaintext matrix. Specifically, the processor (120) can obtain the first plaintext matrix and the second plaintext matrix based on data stored in the memory (110) of the electronic device (100). Alternatively, the processor (120) can obtain the first plaintext matrix and the second plaintext matrix based on data received from an external device. Here, the plaintext matrix can refer to unencrypted data organized in a matrix structure.

[0049] For example, a plaintext matrix might be a structure of multiple data arranged along rows and columns, rather than a single data point. Furthermore, a plaintext matrix can contain different types of data, such as integer data, real number data, or complex number data. A first plaintext matrix could correspond to data obtained by the electronic device (100), i.e., a so-called query, while a second plaintext matrix could correspond to data obtained by an external server, i.e., a so-called database.

[0050] The processor (120) can obtain the first ciphertext matrix by encrypting the first plaintext matrix using a lattice-based cipher. Here, the lattice-based cipher can refer to a cryptographic technique that utilizes the difficulty of a lattice-based problem to ensure security. Specifically, the lattice-based cipher may include various variations based on the Learning With Errors (LWE) problem. LWE can refer to the form of adding a small error term to a linear equation, or the problem of difficulty in efficiently estimating the original secret vector in the presence of an error term.

[0051] For example, the first ciphertext matrix may include structures based on RLWE (Ring Learning With Errors), MLWE (Module Learning With Errors), MSRLWE (Multi-RLWE, or shared-a RLWE), and MSMLWE (Multi-MLWE, or shared-a MLWE). These structures can provide computational efficiency and data structure flexibility while maintaining the basic difficulty of LWE. However, the type of the first ciphertext matrix described in this disclosure is not limited to the examples above.

[0052] The processor (120) can use a single secret structure such as RLWE or MLWE, or multiple secret structures such as MSRLWE or MSMLWE, depending on the environment. The former can have the advantage of simplified computational efficiency, while the latter can enhance security in multi-user or shared-key-based environments.

[0053] In one embodiment, the processor (120) can obtain the first ciphertext matrix by combining each row or column of the first plaintext matrix with the value of a secret key corresponding to a lattice-based encryption method, thereby converting it into a ciphertext pair containing a first type matrix and a second type matrix.

[0054] The processor (120) can select each row of the first plaintext matrix and perform multiplication and addition operations with the secret key to obtain a first type matrix. Furthermore, the processor (120) can generate a second type matrix by repeating the same operations column by column. The processor (120) can convert the entire plaintext matrix into ciphertext pairs by repeatedly applying this process.

[0055] Type I matrices can refer to structures containing the results of linear transformations of input plaintext data, and can be composed of components that directly reflect the plaintext matrix. Type II matrices can refer to structures containing components generated through operations with a secret key, and can provide security based on the secret key. Therefore, ciphertext pairs can form structures that reflect both the plaintext data and the secret key elements. Type I matrices can be called B components, and Type II matrices can be called A components; these symbols are... Figure 2 It is used in all of the descriptions.

[0056] By accumulating these ciphertext pairs, the processor (120) can complete a first ciphertext matrix containing multiple plaintext matrices instead of a single plaintext.

[0057] In one embodiment, the processor (120) can convert a secret key based on lattice cipher encryption into a Toeplitz matrix. The processor (120) can generate a second type matrix by multiplying each row or column of the first plaintext matrix with the Toeplitz matrix. The processor (120) can obtain a first ciphertext matrix by combining the second type matrix and the first type matrix to form a ciphertext pair.

[0058] A Toplitz matrix can refer to a special matrix structure where diagonal elements have the same value, and it can be used to represent polynomials defined in RLWE or RGSW as matrix operations. Utilizing the characteristic of identical diagonal elements, the Toplitz matrix simplifies repetitive operations and improves computational efficiency. The processor (120) can use this to effectively transform the rows or columns of the first plaintext matrix, resulting in a second type matrix that reduces computational resource consumption while maintaining security.

[0059] The processor (120) can obtain the second ciphertext matrix by encrypting the second plaintext matrix based on a structure containing two ciphertext pairs, each of the two ciphertext pairs containing a first-type matrix and a second-type matrix.

[0060] Specifically, the processor (120) can divide the second plaintext matrix into multiple rows or columns, and then generate a first-type matrix corresponding to each cell. Simultaneously, the processor (120) can generate a second-type matrix by multiplying it with a Toplitz matrix, such that the secret key is reflected in the corresponding cell data. The generated first-type and second-type matrices can be paired to form ciphertext pairs, and accumulating two such pairs can form a second ciphertext matrix.

[0061] In one embodiment, the processor (120) can make the first ciphertext pair of the two ciphertext pairs correspond to the second plaintext matrix, and make the second ciphertext pair of the two ciphertext pairs correspond to the product of an auxiliary secret key different from the secret key of the lattice-based encryption method and the second plaintext matrix, thereby being able to obtain the second ciphertext matrix.

[0062] For example, the processor (120) can receive each row of the second plaintext matrix as input, directly generate a first-type matrix, and then combine it with operations based on the secret key to form a first ciphertext pair. Subsequently, the processor (120) can generate a second ciphertext pair by multiplying each row of the same second plaintext matrix by an auxiliary secret key and combining the result with a Toplitz matrix to derive another first-type and second-type matrix. The two ciphertext pairs may contain different components because they share the same secret key structure but have different inputs.

[0063] In one embodiment, the processor (120) can make the first type matrix contained in each of the two ciphertext pairs correspond to the second plaintext matrix or the product of the auxiliary secret key and the second plaintext matrix, and make the second type matrix contained in each of the two ciphertext pairs correspond to the secret key based on lattice cipher encryption, thereby obtaining the second ciphertext matrix.

[0064] In other words, the processor (120) can first form a first-type matrix by directly reflecting the elements of the second plaintext matrix, and then form another first-type matrix by reflecting the value of the auxiliary secret key multiplied on the same plaintext matrix. In both cases, the second-type matrices can be generated in parallel by multiplying the second-type matrices with the Topletz matrix, and each forms a pair. Therefore, the second ciphertext matrix can be structured to contain both plaintext reflection components and auxiliary secret key reflection components.

[0065] In one embodiment, the processor (120) can generate a second type matrix by multiplying each element of the second plaintext matrix by a Toplitz matrix. The processor (120) can obtain a first ciphertext pair by combining the generated second type matrix and the first type matrix. The processor (120) can generate a second type matrix by multiplying the product of each element of the second plaintext matrix and an auxiliary secret key by a Toplitz matrix. The processor (120) can obtain a second ciphertext pair by combining the generated second type matrix and the first type matrix. The processor (120) can obtain a second ciphertext matrix containing the first and second ciphertext pairs.

[0066] The processor (120) can first select elements of the second plaintext matrix and perform multiplication operations on the corresponding rows or columns of the Toplitz matrix to generate a second-type matrix. Simultaneously, another second-type matrix can be derived by combining identical elements with an auxiliary secret key and then multiplying it with the same Toplitz matrix. The resulting second-type matrix can then be combined with the corresponding first-type matrix to form ciphertext pairs, and the two ciphertext pairs are then combined to finally form the second ciphertext matrix.

[0067] The processor (120) can decompose the elements of the first ciphertext matrix according to a predefined gadget vector to obtain multiple decomposed components. Furthermore, the processor (120) can obtain an output ciphertext corresponding to the product of the first plaintext matrix and the second plaintext matrix based on the inner product operation between the multiple decomposed components and the elements of the second ciphertext matrix.

[0068] Specifically, the processor (120) can select each element of the first ciphertext matrix and separate the corresponding elements into several small unit components according to the digital components of the predefined tool vector. These decomposed components serve as the smallest units capable of reconstructing the original ciphertext elements, thereby improving the efficiency of subsequent operations. The processor (120) can sequentially input each decomposed component into the corresponding element of the second ciphertext matrix to perform an inner product operation, and accumulate the inner product results to finally form the output ciphertext corresponding to the product of the first plaintext matrix and the second plaintext matrix.

[0069] In one embodiment, the processor (120) can decompose the elements of the first ciphertext matrix according to the digital components of the tool vector to obtain multiple decomposed components. For each of the multiple decomposed components, the processor (120) performs an inner product operation with the first type matrix and the second type matrix contained in the second ciphertext matrix to form an ordered pair containing the results of the two inner products, and combines the formed ordered pairs to obtain the output ciphertext.

[0070] For example, the processor (120) can select a component to be decomposed and multiply it by elements of the first type of matrix contained in the second ciphertext matrix to obtain a first inner product result. The same component can then be multiplied by elements of the second type of matrix to obtain a second inner product result. The processor (120) can store the two results obtained in this way as ordered pairs and repeat the same process for the other components. Once ordered pairs of all components have been generated, the processor (120) can synthesize and combine them to complete a single output ciphertext. Therefore, the output ciphertext can have an encrypted structure that reflects the product of the first plaintext matrix and the second plaintext matrix.

[0071] According to the above embodiment, the electronic device (100) can perform a key switching operation without performing a key switching operation when performing multiplication between the first ciphertext matrix and the second ciphertext matrix. Therefore, the key switching process based on Number Theoretic Transform (NTT), which is essential in the prior art, can be eliminated, thereby reducing computational latency and memory (110) usage. This helps improve computational efficiency and minimize system resource consumption during the CCMM process.

[0072] Furthermore, when encrypting the second plaintext matrix, two ciphertext pairs are generated. By performing an inner product operation between the components obtained after decomposing the elements of the first ciphertext matrix according to the tool vector and the second ciphertext matrix, the processor (120) can stably obtain the output ciphertext corresponding to the product of the first and second plaintext matrices. This minimizes the accumulation of errors during the operation process and allows for efficient and stable large-scale matrix operations in the ciphertext state by directly utilizing high-speed matrix operation libraries (OpenBLAS, cuBLAS, etc.).

[0073] The implementation of each embodiment will be referred to Figure 2 To provide a more specific description. Figure 2 The description may use the same as Figure 1 Different terms are used to describe the mathematical implementation in detail, however, Figure 1 The embodiments described herein should not be construed as being subject to Figure 2 Similarly, the limitations, Figure 2 The embodiments described herein should not be construed as being subject to Figure 1 Restrictions.

[0074] Figure 2 This is an operational diagram illustrating in detail the process of obtaining the first ciphertext, the process of obtaining the second ciphertext, and the process of obtaining the output ciphertext according to an embodiment of the present disclosure.

[0075] like Figure 2 As shown, the processor (120) can implement various embodiments of the present disclosure by utilizing multiple modules including a first encryption module (210), a second encryption module (220), and a matrix multiplication operation module (230). The multiple modules can be implemented as software modules or hardware modules, and some of the multiple modules can be implemented as neural network models. Two or more of the multiple modules can be implemented as a single integrated module. Various embodiments of the processor (120) that can be implemented using multiple modules will be described below.

[0076] First, we will organize the terms and symbols related to this disclosure.

[0077] RLWE (Ring-LWE), MLWE (Module-LWE), MSRLWE (Multi-Secret RLWE or shared-aRLWE), and MSMLWE (Multi-Secret MLWE or shared-a MLWE) are all encryption methods based on variant learning problems of lattice ciphers. RLWE is based on a ring structure, MLWE is based on a module structure, and MSRLWE and MSMLWE can be extended structures using multiple secret keys.

[0078] When integers q and r are positive, the function h maps from R(q,N) to R(r,N), which can be called gadget decomposition. Here, r can be called the gadget rank. Gadget decomposition satisfies the following conditions: a predefined gadget vector g = (g0, g1, ..., g(r-1)) exists, and for all a, the inner product of h(a) and g is equivalent to a(mod q), and the size of h(a) can be less than a certain upper bound.

[0079] R(q,N) can refer to a set of polynomials whose coefficients are restricted by the modulus q, while R(N) can refer to a set of polynomials whose coefficients are defined in the set of integers. The symbol a b can represent two values ​​that are almost equal with a small error.

[0080] For representative homomorphic encryption methods such as CKKS, TFHE, BGV, and BFV, their plaintext encoding methods can be defined respectively. The matrix multiplication algorithm and encryption process described below can be applied equally regardless of the encoding method used, except for the encoding process itself.

[0081] When using a real number plaintext space, CKKS or TFHE can be applied. The scaling factor for the plaintext real number matrix. After multiplication and rounding, an integer matrix M can be created. During encryption, a small integer error e can be added to M. In other words, it may have the property of encrypting real data after approximating it in integer form.

[0082] When using a finite field plaintext space, BFV can be applied. The plaintext finite field matrix can be multiplied by a scaling factor. To obtain an integer matrix M. It can be the quotient of the ciphertext modulus q divided by the finite field size t. During encryption, a small integer error e may be added to M. That is, it may have the property of encrypting finite field data after expanding it to a larger integer space.

[0083] When using a finite field plaintext space, BGV can be applied. The plaintext finite field matrix can be used directly, and during encryption, the product of a small integer error e and the finite field size t can be added. In other words, it may have the characteristic of directly using finite field data and adding the error term and the finite field size together.

[0084] The first encryption module (210) can obtain the first ciphertext matrix based on the first plaintext matrix. Specifically, the first encryption module (210) can obtain the first ciphertext matrix by encrypting the first plaintext matrix using a lattice cipher encryption method. Figure 2 As shown, in Figure 2 In the description, the first plaintext matrix can be represented as U, and the first ciphertext matrix can be represented as (BU, AU). In addition, symbols suitable for various processes such as encryption and matrix multiplication can be used. At this time, (BU, AU) can be defined as satisfying the relationship BU + AU * SU ~ U (mod q) when combined with the secret key SU.

[0085] The second encryption module (220) can obtain the second ciphertext matrix based on the second plaintext matrix. Specifically, the second encryption module (220) can obtain the second ciphertext matrix by encrypting the second plaintext matrix based on a structure containing two ciphertext pairs, where each of the two ciphertext pairs contains a first-type matrix and a second-type matrix. Figure 2 As shown, in Figure 2 In the description, the second plaintext matrix can be represented as M, and the second ciphertext matrix can be represented as ((BM(0), AM(0)), (BM(1), AM(1))). In addition, symbols suitable for various processes such as encryption and matrix multiplication can be used. Among them, (BM(0), AM(0)) can be set to satisfy the relationship BM(0) + AM(0) * SM ~ p * M (mod p * q) when combined with the key SM, and (BM(1), AM(1)) can be set to satisfy the relationship BM(1) + AM(1) * SM ~ p * S' * M (mod p * q) when combined with the secret key SM.

[0086] The encryption process performed by the first encryption module (210) and the second encryption module (220) will be described below. Specifically, the first encryption module (210) and the second encryption module (220) can perform the conversion to a Toplitz matrix, row encryption, or column encryption process.

[0087] First, the Toplitz matrix and matrix encryption will be described.

[0088] The elements of a polynomial ring R(q,N) or R(N) can be given in the form s(X) = s0 + s1·X + ... + s(N-1)X(N-1). For such a polynomial s(X), its matrix expression Toep(s) in the form of a Toeplitz matrix can be defined. The Toeplitz matrix Toep(s) can have the following structure: Specifically, the first row can be [s0, -s(N-1), ..., -s1], the second row can be [s1, s0, ...,s2]. Subsequent rows follow the same rule, and the last row can be [s(N-1), s(N-2), ..., s0]. In other words, Toep(s) can be constructed as follows: based on the coefficients of the polynomial, each row is a cyclic shift of the previous row one position to the right. In this case, the signs of the terms corresponding to the upper triangle (the right part of the first row) can be reversed.

[0089] Toep(s) defined in this way can be used as a basic unit to express the secret key matrix or plaintext matrix in subsequent encryption processes.

[0090] The following will describe row-wise encryption.

[0091] The encryption methods used include Ring-LWE (RLWE), Module-LWE (MLWE), Multi-Secret Ring-LWE (MSRLWE), RGSW, MGSW, and MSRGSW, with a ring order of N. Integers q and p can be moduli, function h can be the instrumental decomposition of q, and g can be an instrumental vector.

[0092] Ciphertext can consist of multiple components, each of which can be composed of two matrices (let's call them B and A). B and A can then be combined with the secret key matrix S to represent a hidden plaintext matrix M. In other words, the combination of B and A with the secret key can have values ​​similar to the plaintext matrix. Ciphertext with this structure is called tool-decrypted ciphertext.

[0093] If represented in vector form, the ciphertext can be represented as (B, A). In this case, the combination of B and A with the secret key yields a value similar to the plaintext matrix. Specifically, the ciphertext (B, A) combined with the secret key S satisfies the relationship B + A * S ~ M (mod q). That is, since the value of A * S plus B approximately matches the plaintext matrix M, the ciphertext can securely contain the plaintext information. (* indicates multiplication, ~ indicates approximate equivalence).

[0094] Furthermore, for polynomial a and its tool factor h(a), the operation with the tool factor decomposition decryption ( The operation () can be defined by two values, one of which is the result of combining h(a) with B, and the other is the result of combining h(a) with A. In other words, the operation () This produces a result that combines the input polynomial and the ciphertext. These operations ( It is independent of the structure of a specific ring, and therefore can be naturally defined and applied to matrix structures.

[0095] If the column size d2 of the plaintext matrix is ​​less than the ring order N, then only the case where d2 is a divisor of N needs to be considered; otherwise, the remaining coefficients can be filled with 0. Even if d2 is greater than N, only the case where N is a divisor of d2 can be considered.

[0096] The Toplitz matrix representation of the secret key can be extended as follows.

[0097] For RLWE, the secret key is an element of the ring R(N), whose matrix representation can be defined as Toep(sk).

[0098] For MLWE, the secret key consists of several components (sk0, ..., sk(N / k-1)), and each component sk(j) can be an element of the ring R(k). Its matrix representation can be defined as the matrix obtained by converting each component into a Topplitz matrix and then concatenating them vertically.

[0099] For MSRLWE, the secret key consists of several components (sk0, ..., sk(k-1)), and each component can be an element of a ring R(N). Its matrix representation can be defined as the matrix obtained by converting each component into a Topplitz matrix and then horizontally concatenating them.

[0100] Furthermore, given an integer When k1, k2, and k3 are given, the block matrices A and B can be split into several smaller matrix blocks. Among them, A... B can refer to the operation of multiplying corresponding blocks of block matrices A and B, and then concatenating the results to form a single matrix. For example, when A = [A1|A2|...|An], B = [B1;B2;...;Bn], A B = [A1*B1|A2*B2|...|An*Bn].

[0101] With this structure, an integer matrix M of size d1×d2 can be represented by row encryption as follows.

[0102] If the column size d2 is less than or equal to N, it can be represented as RLWE ciphertext. In this case, the ciphertext is represented as (B, A), and the secret key is defined as Toep(sk).

[0103] If the column size d2 is less than N, it can be represented as MLWE ciphertext. In this case, the ciphertext is represented as (B, A), and the secret key is defined according to the MLWE secret key structure.

[0104] If the column size d2 is greater than N, it can be represented as MSRLWE ciphertext. In this case, the ciphertext is represented as (B, A), and the secret key can be expanded into multiple blocks side by side.

[0105] In summary, the ciphertext can be represented as (B, A), and the result of combining B and A with the secret key can have values ​​similar to the plaintext matrix M.

[0106] Furthermore, row encryption using RGSW ciphertext can be defined. In this case, the ciphertext can consist of two parts, each of which can be represented as a set of vectors B and A. The two parts of the ciphertext can be designed to be combined with different secret keys, such that the first part of the ciphertext, when combined with the secret key S, produces a value similar to the plaintext matrix M, while the second part of the ciphertext, when combined with another key S', produces a value similar to the plaintext matrix multiplied by the secret key.

[0107] If the column size d2 is less than or equal to N, then the combination of the first part of the ciphertext and the secret key S corresponds to the plaintext M, and the combination of the second part of the ciphertext and the secret key S corresponds to the plaintext M multiplied by the secret key S'. In this case, the type of the secret key S' can vary depending on the size of d1, and if d1 is greater than N, it can be set to MSRLWE; if d1 is equal to N, it can be set to RLWE; and if d1 is less than N, it can be set to MLWE.

[0108] When the column size d2 is greater than N, the same method can be used. In this case, the secret key S can be expanded into multiple blocks arranged side by side. The combination of the two ciphertext parts can be achieved using A. B operation. At this point, based on the size of d1, the secret key S' can be chosen as one of MSRLWE, RLWE, or MLWE. The value can be selected by the user.

[0109] In summary, row encryption based on RGSW can be configured as follows: the first part of the ciphertext, combined with the secret key S, generates a plaintext matrix M; the second part of the ciphertext, combined with the secret key S again, generates a plaintext matrix multiplied by the secret key S'. Even if d2 is greater than N, through the parallel structure of the secret keys and... The same effect can be achieved through computation.

[0110] The following will describe column-wise encryption.

[0111] Column encryption can be understood as a simple transpose of row encryption. That is, it directly uses the structure defined by row encryption, applying it by interchanged rows and columns. Therefore, the operations used in row encryption can also be applied in the same transpose form.

[0112] In this method, the ciphertext of RLWE, MLWE, and MSRLWE can be represented as (B, A). Combining the transposed B and A with the secret key matrix S yields a result similar to the plaintext matrix M. In other words, the ciphertext (B, A) can generate a result similar to the plaintext matrix through operations on its transpose.

[0113] Furthermore, RGSW ciphertext can also be represented as columnar encryption. In this case, the ciphertext can consist of two parts (ct(0), ct(1)), each of which can be represented as a set of vectors B and A. If the transposed B and A are combined with the secret key, one can generate a value similar to the plaintext matrix M, and the other can generate a value similar to the plaintext matrix multiplied by the secret key.

[0114] In summary, column encryption is the transpose of row encryption, and therefore does not require a separate new structure. Thus, column encryption can be considered essentially the same as row encryption, but applied by swapping the positions of rows and columns.

[0115] The matrix multiplication module can obtain the output ciphertext corresponding to the product of the first plaintext matrix and the second plaintext matrix based on the operations between the first ciphertext and the second ciphertext. Specifically, the matrix multiplication module can perform so-called ciphertext-ciphertext matrix multiplication (CCMM). The matrix multiplication module can decompose the elements of the first ciphertext matrix according to a predefined gadget vector to obtain multiple decomposed components. Furthermore, the processor (120) can obtain the output ciphertext corresponding to the product of the first plaintext matrix and the second plaintext matrix based on the inner product operation between the multiple decomposed components and the elements of the second ciphertext matrix.

[0116] Operations performed during matrix multiplication ( This can serve as the core operational unit in the ciphertext-ciphertext multiplication (CCMM) process, operating between the tool factorization of the input polynomial and the ciphertext components resulting from the tool factorization, thereby obtaining two matrix components. (The operation...) Let ) represent the combination of the input polynomial or matrix a with the tool decomposition decomposition ct=(B,A), which can be defined as follows. First, the tool decomposition of a can be called h(a) and can be expressed as follows, ct=(B0,B1,...,Br-1;A0,A1,...,Ar-1). At this time, h(a) ct=(h(a)·B,h(a)·A), where h(a)B is the inner product of the corresponding components of h(a) and (B0,...,Br-1), and h(a)·A is the inner product of the corresponding components of h(a) and (A0,...,Ar-1). That is to say, the operation ( It can be said that the operation of decomposing the polynomial into a tool and the outer product between the ciphertext components, and outputting two new components (B', A'), can be used as the core operation unit in the ciphertext-ciphertext multiplication (CCMM) process.

[0117] The following section describes ciphertext-ciphertext matrix multiplication (CCMM) performed by the matrix multiplication module.

[0118] Although this explanation focuses on row-encrypted ciphertext, the same approach can be applied to column-encrypted ciphertext by performing a transpose operation. The method proposed in this disclosure employs RLWE, MLWE, and RGSW type ciphertexts, combines them, and ultimately performs matrix multiplication in the ciphertext state.

[0119] As a configuration, the secret key matrix SU can be a secret key defined in RLWE, MLWE, or MSRLWE schemes. The plaintext matrices U and M are integer matrices of size d1×d2 and d2×d3, respectively. Integers q and p can be moduli, the function h can be the instrument decomposition of q, and g can be the instrument vector.

[0120] The input ciphertext can be defined as follows. The ciphertext ctU consists of (BU, AU), and the ciphertext ctM consists of (ctM(0), ctM(1)). At this time, ctM(0) can be represented as (BM(0), AM(0)), and ctM(1) can be represented as (BM(1), AM(1)).

[0121] The conditions are as follows: When BU and AU are combined with the secret key SU, a result similar to that of the plaintext matrix U can be produced. When BM(0) and AM(0) are combined with the secret key SM, a result similar to that of the plaintext matrix M multiplied by p can be produced. When BM(1) and AM(1) are combined with the secret key SM, a result similar to that of the secret key SM multiplied by p and the matrix M can be produced.

[0122] The output ciphertext ctRes is defined as (Bres, Ares). When Bres and Ares are combined with the secret key SM, a result similar to matrix multiplication U·M can be produced. Bres can be obtained by operating on h(BU) and BM(0). The result obtained is compared with the operation of h(AU) and BM(1). The results are added together to calculate Ares. Ares can be calculated by performing operations on h(BU) and AM(0). The result obtained is compared with the operation of h(AU) and AM(1). The results are added together for calculation.

[0123] In summary, CCMM receives input ciphertexts (BU,AU) and (BM(0),AM(0)), (BM(1),AM(1)) and generates output ciphertext (Bres,Ares). When this output ciphertext is combined with the secret key, the result corresponding to the product of the plaintext matrices U and M can be obtained in the ciphertext state.

[0124] In addition, the processor (120) can not only convert the second plaintext matrix into the second ciphertext matrix, but also convert the ciphertext matrix encrypted using lattice-based encryption, such as the first ciphertext matrix, into the second ciphertext matrix, and perform operations between the converted second ciphertext matrix and the first ciphertext matrix.

[0125] For example, when performing encrypted matrix multiplication on first data obtained from a first external device and second data obtained from a second external device, if both the first and second data are plaintext data, the processor (120) can obtain a first ciphertext matrix based on the first plaintext matrix corresponding to the first data, and can obtain a second ciphertext matrix based on the second plaintext matrix corresponding to the second data. Conversely, if the first data is plaintext data and the second data is a ciphertext matrix encrypted using a lattice-based encryption method, the processor (120) can apply this disclosure after converting the ciphertext matrix encrypted using the lattice-based encryption method into the form of a second ciphertext matrix.

[0126] The following examples illustrate the conversion from RLWE to RGSW when a ciphertext matrix, encrypted using a lattice-based encryption method, is replaced with a ciphertext matrix in the form of the second ciphertext matrix. However, this disclosure is not limited to these example conversions.

[0127] As a setup, S and S' are RLWE secret keys, M can be the plaintext matrix to be encrypted. Integers q and p can be moduli, h can be the instrument factorization of q, and g can be the instrument vector.

[0128] The input can be given as ciphertext ct = (B, A). Then, if B and A are combined with the secret key S, a value similar to the plaintext matrix M multiplied by p can be obtained. Furthermore, for the secret key S', there exists an exchange process that converts (S')T·S to S·(S')T.

[0129] The output can be defined as ciphertext ct'(B',A'), which, when combined with the secret key S', can have a value similar to matrix S'M multiplied by p.

[0130] The calculation process is as follows: First, auxiliary ciphertexts ct0=(B0,A0) and ct1=(B1,A1) can be generated. Then, if B0 and A0 are combined with the secret key (S)T, a result similar to S'B (mod qp) can be obtained, and if B1 and A1 are combined with the secret key (S)T, a result similar to S'A (mod qp) can be obtained.

[0131] Second, A0(S')T and B1+A1(S')T can be calculated through key exchange. Among them, A0(S')T and B1+A1(S')T can be used as a new combination result of the secret key S'.

[0132] Third, the new auxiliary ciphertexts ct2=(B2,A2) and ct3=(B3,A3) can be calculated.

[0133] Fourth, finally, B' and A' can be calculated. B' can be defined as the sum of B0 + B2 + B3, and A' can be defined as the sum of A2 + A3.

[0134] In summary, by receiving ciphertext in the form of RLWE and undergoing a key exchange process, ciphertext (B', A'') in the form of RGSW can be generated. At this point, (B', A'') can be combined with the secret key S' to represent the result of multiplying S' by the plaintext matrix M in the ciphertext state.

[0135] Figure 3 This is a schematic diagram illustrating the packaging of a plaintext matrix according to an embodiment of the present disclosure.

[0136] The encryption process described above for the second plaintext matrix may involve multiplication between the first and second ciphertext matrices. For example, the first ciphertext matrix can be defined based on a modulus q, while the second ciphertext matrix can be defined by multiplying the modulus pq by a temporary modulus p. In this structure, when multiplying the first and second ciphertext matrices, the product of the first and second plaintext matrices can be reflected in the modulus q, thereby generating the ciphertext.

[0137] The reason the second ciphertext matrix is ​​defined on the modulus pq in this process is likely to reduce error terms in subsequent calculations by introducing a temporary modulus p, thus ensuring the stability of the result. However, since the introduction of the temporary modulus increases the size of the ciphertext, it is difficult to guarantee efficiency simply by encrypting the second plaintext matrix.

[0138] For example, in a concrete implementation, the first ciphertext matrix can be represented in RLWE form, and the second ciphertext matrix can be represented in RGSW form. In this case, packing the second plaintext matrix can alleviate the problem of increased size caused by introducing a temporary modulus, and support the stable separation and recovery of results in blocks through modulo operations.

[0139] In this case, since the second ciphertext matrix is ​​defined on the pq modulus containing the temporary modulus p, the problem of unnecessarily increasing the ciphertext size may also occur.

[0140] Therefore, it is best to pack the second plaintext matrix before encrypting it. An example related to packing the first plaintext matrix will be described below.

[0141] First, packing can refer to the process of combining multiple elements of the second plaintext matrix into a single plaintext to improve encryption efficiency. Specifically, packing can refer to the process of combining multiple blocks into a single plaintext structure, and the packing described in this disclosure can be specifically performed based on a common modulus and independent moduli.

[0142] A block can refer to an independent region set up to distinguish the elements of a second plaintext matrix. Each block can correspond to a specific independent modulus and store the value converted according to that modulus. (See reference) Figure 3 The elements of the second plaintext matrix can be split and arranged into two blocks, q1 and q2. Since the values ​​divided into blocks in this way are managed simultaneously within a single plaintext structure, the entire structure can be processed efficiently in subsequent encryption and decryption processes while maintaining the independence of each block.

[0143] The common modulus, a single modulus value uniformly applied to all elements of the second plaintext matrix, serves as a benchmark for inter-block operations. As the value multiplied in each block within the packed plaintext structure, the common modulus provides a consistent benchmark for subsequent modulo operations.

[0144] An independent modulus is a modulus value used to distinguish the elements of the second plaintext matrix and applied independently to each block, thus preventing conflicts between multiple blocks. The independent modulus can be set to have a coprime relationship, allowing the values ​​stored in each block to be interpreted independently without confusion.

[0145] Unpacking refers to the process of separating the blocks that were bound together during the encryption or decryption process and restoring them to their original individual data units. Through unpacking, common modulus components and independent modulus components can be independently extracted from the packed plaintext or ciphertext.

[0146] In one embodiment, before encrypting the second plaintext matrix, the processor (120) performs a packing process on the elements of the second plaintext matrix, combining them into a single plaintext, based on a common modulus applied to the elements of the second plaintext matrix and multiple independent moduli corresponding to the multiple blocks that distinguish the elements of the second plaintext matrix. Furthermore, the processor (120) can encrypt the packed second plaintext matrix to obtain a second ciphertext matrix.

[0147] refer to Figure 3The elements of the second plaintext matrix can be combined into a single plaintext based on a common modulus p and multiple independent moduli q1 and q2. The number of independent moduli is not necessarily limited to two. Specifically, for example... Figure 3 As shown, the plaintext can be divided into three regions. The first region consists of the block corresponding to q1, the second region consists of the block corresponding to q2, and the third region consists of the block corresponding to the common modulus p. Accordingly, the block corresponding to q1 records the pM1 value multiplied by the common modulus p, the block corresponding to q2 records the pM2 value multiplied by p, and the block corresponding to p can be set to 0.

[0148] The processor (120) can divide the elements of the second plaintext matrix into blocks corresponding to q1 and blocks corresponding to q2, and then combine them by multiplying each block by a common modulus p. The plaintext thus constructed contains both the value multiplied by the common modulus p and the value separated according to the independent moduli q1 and q2. Therefore, the processor (120) can compress and combine the elements of the second plaintext matrix into a single structure by considering both the independent and common moduli. Such a packed plaintext can be interpreted in modulus parsing as pM1 for q1, pM2 for q2, and 0 for p.

[0149] This method, after packaging and encrypting the second plaintext matrix, allows for convenient separation based on common and independent moduli through decryption or modular arithmetic. In other words, as... Figure 3 As shown, the packaging structure described in this disclosure can provide a basis for independently referencing or separating each block in subsequent operations.

[0150] In one embodiment, the processor (120) may perform a packing process on the second plaintext matrix such that the elements of the second plaintext matrix are represented as 0 with respect to a common modulus, and that the elements of the second plaintext matrix are represented as element values ​​multiplied by the common modulus with respect to each of a plurality of independent moduli.

[0151] refer to Figure 3 In the blocks corresponding to the elements of the second plaintext matrix and the common modulus p, all values ​​can be padded with 0. This is to ensure that the common modulus portion only acts as a separator and does not reflect the actual data values. Conversely, in the blocks corresponding to the elements of the second plaintext matrix and the independent moduli q1 and q2, the values ​​can be arranged by multiplying each element value by the common modulus p. Therefore, the values ​​arranged in block q1 can be represented as pM1, and the values ​​arranged in block q2 can be represented as pM2.

[0152] For example, if the second plaintext matrix contains an element with a specific value m, then that value can be... Figure 3In the block corresponding to q1, the values ​​are stored in the form p*m, and the same p*m form can be recorded in the block corresponding to q2. In this way, when each element value is combined with an independent modulus, it is represented as multiplying with a common modulus, thus ensuring the independence between blocks when performing modulo operations in the future, while maintaining the consistency of operations based on the common modulus.

[0153] therefore, Figure 3 The structure shown consists of a single block of a common modulus padded with zeros and multiple blocks recording the element values ​​of individual moduli multiplied by the common modulus. Such a structure can be used to efficiently reconstruct or separate the elements of the second plaintext matrix during subsequent encryption and decryption processes.

[0154] In one embodiment, multiple independent moduli can be set to have a coprime relationship.

[0155] Coprime relation refers to the property that two numbers have no common divisors other than 1. When multiple independent moduli are set to coprime relation, the residual operation results corresponding to each moduli can be maintained independently, thus allowing for conflict-free separation and representation of the elements of the plaintext matrix.

[0156] For example, when the second plaintext matrix is ​​divided into multiple blocks, since the elements of each block can be represented by independent moduli with coprime relations, the values ​​of different blocks can be precisely encoded without repetition or confusion. Therefore, the processor (120) can ensure that the operation results obtained based on the packed plaintext can still be completely restored even after modulo operations by setting multiple independent moduli with coprime relations.

[0157] In one embodiment, after obtaining the output ciphertext, the processor (120) can perform a modulo operation on the output ciphertext to extract the value corresponding to the common modulus and the value corresponding to each of the plurality of independent moduli. Furthermore, the processor (120) can, based on the extracted values, separate the product result between the first plaintext matrix and the second plaintext matrix into multiple blocks corresponding to each block.

[0158] Specifically, modular arithmetic may be the key procedure for interpreting the common modulus and multiple independent modulus structures applied in the packing step. The processor (120) can extract the common components that form the basis of the entire operation result by performing operations on the output ciphertext according to the common modulus, and can independently distinguish and obtain the unique components of each block by performing operations on the independent modulus. For example, even if the product of the first plaintext matrix and the second plaintext matrix is ​​represented as a single matrix, the processor (120) can still reconstruct the block by block using the results separated by the independent modulus. In this process, the component corresponding to q1 is derived as pM1, the component corresponding to q2 is derived as pM2, and the component corresponding to p remains 0, which can be used to identify block boundaries.

[0159] refer to Figure 3 This illustrates the process of separating common and independent modulo components by performing modulo operations on the output ciphertext. For example... Figure 3 As shown, the processor (120) can use the extracted components to separate and recover the product results, making them correspond to multiple blocks, thereby maintaining the consistency of the overall operation while maintaining the accuracy of each block unit.

[0160] In one embodiment, the processor (120) may determine the number of blocks to be divided into before combining the elements of the second plaintext matrix into a plaintext structure. The determined number of blocks may correspond to the number of independent moduli to be applied to the elements of the second plaintext matrix, and the processor (120) may perform packing by arranging the elements in the corresponding blocks according to the number.

[0161] For example, if the processor (120) decides to divide the elements of the second plaintext matrix into two blocks, it can perform packing as follows: the first block stores the element values ​​converted according to the first independent modulus, and the second block stores the element values ​​converted according to the second independent modulus. In another embodiment, if more than three blocks are determined, the processor (120) can perform packing by setting each block to correspond to a different independent modulus and following the same process.

[0162] According to this embodiment, the electronic device (100) can ensure the consistency of the encryption process by pre-determining the number of blocks into which the elements of the second plaintext matrix are divided, and then packaging them according to the determined number. Since the number of blocks and the corresponding independent moduli are explicitly defined, the distinction between block units can be stably maintained even after the ciphertext is generated, and elements can be separated and recovered without confusion during the decryption process.

[0163] Furthermore, the balance between computational efficiency and parameter size can vary depending on the number of blocks. As the number of blocks increases, the elements of the second plaintext matrix can be packed more compactly, thus reducing the size of the ciphertext, but this requires a larger modulus and parameters, increasing computational complexity and resource consumption. Conversely, setting the number of blocks to a smaller number can reduce computational resource consumption, but may lead to an increase in the size of the ciphertext. Therefore, the electronic device (100) provides a basis for selecting an appropriate number of blocks by considering the trade-off between storage / transmission efficiency and computational efficiency under a given environment. On the other hand, the packing structure described in this disclosure can be implemented not only based on the Chinese Remainder Theorem (CRT) but also applied to various methods such as the Residue Number System (RNS).

[0164] Based on the above reference Figure 3In the described embodiment, the electronic device (100) can mitigate the problem of unnecessarily increasing the ciphertext size due to the introduction of temporary moduli by combining elements into a structure based on multiple independent moduli before encrypting the second plaintext matrix. Furthermore, since this structure allows for direct extraction and use of each block during decryption and unpacking even after ciphertext generation, stable block-by-block separation or reconstruction of computation results can be achieved without performing additional complex calculations. Therefore, the electronic device (100) described in this disclosure can provide the following effects: improving the efficiency of the encryption process while ensuring the stability and consistency of the computation and decryption processes.

[0165] Figure 4 This is a flowchart illustrating a control method for an electronic device (100) according to an embodiment of the present disclosure.

[0166] The electronic device (100) can obtain a first plaintext matrix and a second plaintext matrix (S410). Specifically, the electronic device (100) can obtain the first plaintext matrix and the second plaintext matrix based on the data stored in the memory (110) of the electronic device (100).

[0167] The electronic device (100) can obtain the first ciphertext matrix by encrypting the first plaintext matrix using a lattice-based encryption method (S420).

[0168] In one embodiment, the electronic device (100) can obtain the first ciphertext matrix by converting each row or column of the first plaintext matrix into a ciphertext pair containing a first type matrix and a second type matrix by combining each row or column of the first plaintext matrix with a value corresponding to a secret key of a lattice-based encryption method.

[0169] In one embodiment, the electronic device (100) can convert a secret key based on lattice cipher encryption into a Toeplitz matrix. The electronic device (100) can generate a second type matrix by multiplying each row or column of the first plaintext matrix with the Toeplitz matrix. The electronic device (100) can obtain a first ciphertext matrix by combining the second type matrix and the first type matrix to form a ciphertext pair.

[0170] The electronic device (100) can obtain the second ciphertext matrix by encrypting the second plaintext matrix based on a structure containing two ciphertext pairs, each of the two ciphertext pairs containing a first type matrix and a second type matrix (S430).

[0171] In one embodiment, the electronic device (100) can make the first ciphertext pair of the two ciphertext pairs correspond to the second plaintext matrix, and make the second ciphertext pair of the two ciphertext pairs correspond to the product of an auxiliary secret key different from the secret key of the lattice-based encryption method and the second plaintext matrix, thereby being able to obtain the second ciphertext matrix.

[0172] In one embodiment, the electronic device (100) can make the first type matrix contained in each of the two ciphertext pairs correspond to the second plaintext matrix or the product of the auxiliary secret key and the second plaintext matrix, and make the second type matrix contained in each of the two ciphertext pairs correspond to the secret key based on the lattice cipher encryption method, thereby enabling the acquisition of the second ciphertext matrix.

[0173] In one embodiment, the electronic device (100) can generate a second type matrix by multiplying each element of the second plaintext matrix by a Toplitz matrix. The electronic device (100) can obtain a first ciphertext pair by combining the generated second type matrix and a first type matrix. The electronic device (100) can generate a second type matrix by multiplying the product of each element of the second plaintext matrix and an auxiliary secret key by a Toplitz matrix. The electronic device (100) can obtain a second ciphertext pair by combining the generated second type matrix and a first type matrix. The electronic device (100) can obtain a second ciphertext matrix containing both the first and second ciphertext pairs.

[0174] The electronic device (100) can decompose the elements of the first ciphertext matrix according to a predefined tool vector to obtain multiple decomposed components (S440). Furthermore, the electronic device (100) can obtain an output ciphertext corresponding to the product of the first plaintext matrix and the second plaintext matrix based on the inner product operation between the multiple decomposed components and the elements of the second ciphertext matrix (S450).

[0175] In one embodiment, the electronic device (100) can decompose the elements of the first ciphertext matrix according to the digital components of the tool vector to obtain multiple decomposed components. For each of the multiple decomposed components, the electronic device (100) performs an inner product operation with the first type matrix and the second type matrix contained in the second ciphertext matrix to form an ordered pair containing the results of the two inner products, and combines the formed ordered pairs to obtain the output ciphertext.

[0176] Furthermore, the control method of the electronic device (100) described in the above embodiments can be implemented by a program and provided to the electronic device (100). In particular, the program containing the control method of the electronic device (100) can be stored in a non-transitory computer-readable medium for use.

[0177] Specifically, for a non-transitory computer-readable storage medium including a program for executing a method of control electronics (100), the method of control electronics (100) may include the following steps: obtaining a first plaintext matrix and a second plaintext matrix; encrypting the first plaintext matrix based on a lattice cipher encryption method to obtain a first ciphertext matrix; encrypting the second plaintext matrix based on a structure containing two ciphertext pairs, wherein each of the two ciphertext pairs contains a first type matrix and a second type matrix to obtain a second ciphertext matrix; decomposing the elements of the first ciphertext matrix according to a predefined tool vector to obtain multiple decomposed components; and obtaining an output ciphertext corresponding to the product result of the first plaintext matrix and the second plaintext matrix based on the inner product operation between the multiple decomposed components and the elements of the second ciphertext matrix.

[0178] The above briefly describes the method of controlling the electronic device (100) and the computer-readable storage medium including the program for executing the method of controlling the electronic device (100), only to avoid repeating the description. Of course, various embodiments of the electronic device (100) can also be applied to the method of controlling the electronic device (100) and the computer-readable storage medium including the program for executing the method of controlling the electronic device (100).

[0179] Machine-readable storage media may be provided in the form of non-transitory storage media. Here, "non-transitory storage media" simply means that it is a tangible device and does not contain signals (e.g., electromagnetic waves), and the term does not distinguish between cases where data is stored semi-permanently and temporarily on the storage medium. For example, "non-transitory storage media" may include buffers for temporarily storing data.

[0180] According to one embodiment, the methods described in the various embodiments disclosed in this document can be provided as included in a computer program product. The computer program product can be traded as a commodity between a seller and a buyer. The computer program product can be distributed in the form of a machine-readable storage medium (e.g., a compact disc read-only memory, CD-ROM), or distributed directly or online (e.g., by downloading or uploading) between two user devices (e.g., smartphones) through an application store (e.g., the Play Store™). In the case of online distribution, at least a portion of the computer program product (e.g., a downloadable app) can be temporarily stored or temporarily created on a machine-readable storage medium, such as the memory of a manufacturer's server, an application store's server, or a relay server (110).

[0181] The constituent elements (e.g., modules or programs) of the various embodiments of this disclosure as described above may consist of a single or multiple entities, and some of the sub-constituent elements described above may be omitted, or other sub-constituent elements may be further included in the various embodiments. Alternatively or further, some constituent elements (e.g., modules or programs) may be integrated into an entity that is capable of performing the same or similar functions as the individual constituent elements performed before integration.

[0182] According to various embodiments, the operations performed by modules, programs or other components may be performed sequentially, in parallel, repeatedly or heuristically, or at least some operations may be performed in a different order, omitted or additional operations may be added.

[0183] Furthermore, the terms "part" or "module" as used in this disclosure include units comprised of hardware, software, or firmware, and are used interchangeably with terms such as logic, logic block, component, or circuit. A "part" or "module" can be a monolithically formed component or a minimum unit or component that performs one or more functions. For example, a module may consist of an application-specific integrated circuit (ASIC).

[0184] Various embodiments of this disclosure can be implemented as software including instructions stored on a machine-readable storage medium (e.g., a computer). The machine is an apparatus capable of invoking stored commands from the storage medium and performing operations according to the invoked commands, and may include electronic devices (e.g., electronic device (100)) according to the disclosed embodiments.

[0185] When the processor executes the command, it can perform the function corresponding to the command directly or through other components controlled by the processor. The command may contain code generated or executed by a compiler or interpreter.

[0186] While preferred embodiments of the present disclosure have been illustrated and described above, the present disclosure is not limited to the specific embodiments described above, and those skilled in the art to which the present disclosure pertains can make various modifications without departing from the spirit of the present disclosure as claimed in the claims. These modifications should not be understood separately from the technical concept or prospect of the present disclosure.

Claims

1. An electronic device, characterized in that, include: Memory that stores instructions; as well as A processor configured to execute the instructions; The processor is configured as follows: Obtain the first plaintext matrix and the second plaintext matrix; The first plaintext matrix is ​​encrypted using a lattice cipher to obtain the first ciphertext matrix; The second plaintext matrix is ​​encrypted based on a structure containing two ciphertext pairs, each of which contains a first type matrix and a second type matrix to obtain the second ciphertext matrix; The elements of the first ciphertext matrix are decomposed according to a predefined tool vector to obtain multiple decomposed components; and Based on the inner product operation between the multiple decomposed components and the elements of the second ciphertext matrix, the output ciphertext corresponding to the product result of the first plaintext matrix and the second plaintext matrix is ​​obtained.

2. The electronic device according to claim 1, characterized in that, in, The processor is configured to: Each row or column of the first plaintext matrix is ​​combined with the value of the secret key corresponding to the lattice-based encryption method to transform it into a ciphertext pair containing the first type matrix and the second type matrix, thereby obtaining the first ciphertext matrix.

3. The electronic device according to claim 2, Its features are, in, The processor is configured to: The secret key based on the lattice cipher encryption method is converted into a Toplitz matrix; Multiply each row or column of the first plaintext matrix by the Toplitz matrix to generate a second type matrix; The first ciphertext matrix is ​​obtained by combining the second type matrix and the first type matrix to form a ciphertext pair.

4. The electronic device according to claim 1, characterized in that, in, The processor is configured to: Obtain the second ciphertext matrix such that the first ciphertext pair of the two ciphertext pairs corresponds to the second plaintext matrix, and the second ciphertext pair of the two ciphertext pairs corresponds to the product of an auxiliary secret key different from the secret key of the lattice-based encryption method and the second plaintext matrix.

5. The electronic device according to claim 1, characterized in that, in, The processor is configured to: Obtain the second ciphertext matrix such that the first type matrix contained in each of the two ciphertext pairs corresponds to the second plaintext matrix or the product of the auxiliary secret key and the second plaintext matrix, and such that the second type matrix contained in each of the two ciphertext pairs corresponds to the secret key based on the lattice cipher encryption method.

6. The electronic device according to claim 5, Its features are, The processor is configured as follows: Multiply each element of the second plaintext matrix by the Toplitz matrix to generate the second type of matrix; The first ciphertext pair is obtained by combining the generated second type matrix with the first type matrix; The product of each element of the second plaintext matrix and the auxiliary secret key is multiplied by the Toplitz matrix to generate the second type of matrix; The second type matrix is ​​combined with the first type matrix to obtain the second ciphertext pair; Obtain the second ciphertext matrix containing the first ciphertext pair and the second ciphertext pair.

7. The electronic device according to claim 1, characterized in that, in, The processor is configured to: The elements of the first ciphertext matrix are decomposed according to the digital components of the tool vector to obtain the plurality of decomposed components; For each of the plurality of decomposed components, an inner product operation is performed with the first type matrix and the second type matrix contained in the second ciphertext matrix, respectively, to form an ordered pair containing two inner product results; The output ciphertext is obtained by combining the ordered pairs.

8. The electronic device according to claim 1, Its features are, in, The processor is configured to: Before encrypting the second plaintext matrix, the elements of the second plaintext matrix are combined into a single plaintext by a packing process based on a common modulus that is commonly applied to the elements of the second plaintext matrix and multiple independent modulus that correspond to multiple blocks that distinguish the elements of the second plaintext matrix. The packaged second plaintext matrix is ​​then encrypted to obtain the second ciphertext matrix.

9. The electronic device according to claim 8, characterized in that, in, The processor is configured to: The second plaintext matrix is ​​packaged such that the elements of the second plaintext matrix are represented as 0 with respect to the common modulus, and the elements of the second plaintext matrix are represented as the element value multiplied by the common modulus with respect to each of the plurality of independent moduli.

10. The electronic device according to claim 8, characterized in that, The multiple independent moduli are set to have a coprime relationship.

11. The electronic device according to claim 8, Its features are, in, The processor is configured to: After obtaining the output ciphertext, a modulo operation is performed on the output ciphertext to extract the value corresponding to the common modulus and the value corresponding to each of the plurality of independent moduli; Based on the extracted values, the product of the first plaintext matrix and the second plaintext matrix is ​​separated into blocks corresponding to each block.

12. A method for controlling an electronic device, characterized in that, Includes the following steps: Obtain the first plaintext matrix and the second plaintext matrix; The first plaintext matrix is ​​encrypted using a lattice cipher to obtain the first ciphertext matrix; The second plaintext matrix is ​​encrypted based on a structure containing two ciphertext pairs, each of which contains a first type matrix and a second type matrix to obtain the second ciphertext matrix; The elements of the first ciphertext matrix are decomposed according to a predefined tool vector to obtain multiple decomposed components; as well as Based on the inner product operation between the multiple decomposed components and the elements of the second ciphertext matrix, the output ciphertext corresponding to the product result of the first plaintext matrix and the second plaintext matrix is ​​obtained.

13. A non-transitory computer-readable storage medium comprising a program for executing a method of controlling electronic devices, characterized in that, The method for controlling the electronic device includes: Obtain the first plaintext matrix and the second plaintext matrix; The first plaintext matrix is ​​encrypted using a lattice cipher to obtain the first ciphertext matrix; The second plaintext matrix is ​​encrypted based on a structure containing two ciphertext pairs, each of which contains a first type matrix and a second type matrix to obtain the second ciphertext matrix; The elements of the first ciphertext matrix are decomposed according to a predefined tool vector to obtain multiple decomposed components; and Based on the inner product operation between the multiple decomposed components and the elements of the second ciphertext matrix, the output ciphertext corresponding to the product result of the first plaintext matrix and the second plaintext matrix is ​​obtained.

Images