A method of performing homomorphic computation and a computing device

Abstract

A method for performing homomorphic computation and a computing device, involving obtaining intermediate product ciphertext by encrypting plaintext to be encrypted by using an intermediate product public key, the intermediate product public key being constructed based on an intermediate product fault-tolerant learning problem, the method comprising at least a conversion key generation step, the conversion key generation step specifically comprising: obtaining a first private key and a second public key, wherein the first public key and the second public key are the intermediate product public key, the first private key is a private key vector required for decrypting the first ciphertext, the first ciphertext is the intermediate product ciphertext, and the first ciphertext is obtained by encrypting plaintext to be encrypted by the first public key; arranging the second public key according to the initial dimension of the intermediate product ciphertext and the dimension of the tensor product of the intermediate product ciphertext, determining an updated key matrix; and arranging the first private key to determine an original key vector; and fusing the updated key matrix and the original key vector to determine a conversion key from the first private key to a second private key, thereby providing a method for performing homomorphic computation with high security and low computational overhead.

Description

Technical Field

[0001] The embodiments in this specification pertain to the field of privacy computing, and particularly relate to a method and computing device for performing homomorphic computation. Background Technology

[0002] Homomorphic encryption is a special encryption technique that allows computations to be performed on ciphertext, and the result of the computation on the ciphertext is identical to the result of the computation directly on the plaintext after decryption. Fully homomorphic encryption (FHE), in particular, supports an unlimited number of arbitrary operations (including addition and multiplication) on the ciphertext. This means that a third party can perform arbitrary data processing on the encrypted data without knowing the original data content. This characteristic makes FHE a core tool for privacy-preserving computing and is widely used in fields such as secure cloud computing and privacy-preserving machine learning.

[0003] FHE schemes are often built upon various difficult problems—if a problem is intractable, then the ciphertext built using that problem will also be intractable. The security of a further developed FHE scheme can be measured based on the difficulty of the problem it relies on. Among these, building FHE schemes based on the Learning With Errors (LWE) problem is one of the most representative technical approaches. The LWE problem can be described as follows: given a random matrix, multiply the random matrix by a secret vector, add a small amount of noise to obtain the computational result, and then recover the secret vector from the random matrix and the computational result. The LWE problem has been proven to be resistant to quantum computing attacks; even adversaries with quantum computing capabilities find it difficult to solve the LWE problem. Therefore, FHE schemes based on the LWE problem also possess provable security.

[0004] The Brakerski-Gentry-Vaikuntanathan 2012 (BGV12) scheme is a classic FHE scheme based on the LWE problem. The following is a brief introduction to the standard implementation of the BGV12 scheme based on the LWE problem.

[0005] The deployment of the BGV12 solution first requires determining a set of system parameters, based on which the specific implementation method of the BGV solution is determined. This set of system parameters includes the security parameter λ (representing the required security level of the solution – the computational complexity required for an attacker to successfully crack the solution is...). The system parameters are defined as follows: vector dimension n (representing the length of the secret vector), ciphertext modulus q (representing the number of LWE instances disclosed in the public key), and random distribution χ (representing the distribution function used when sampling random numbers; the upper limit of the output elements of χ is denoted as B, where B is much smaller than q). The security parameter λ can be set by the deployer of the scheme, while other system parameters are further determined based on the security parameter λ using a specific calculation method.

[0006] For the BGV12 scheme, the encryption process is as follows: Based on the vector dimension n, a secret vector s of length n is obtained by sampling from a random distribution χ:

[0007]

[0008] Encode the secret vector into a private key sk:

[0009]

[0010] To provide sufficient randomness so that an attacker cannot recover the private key sk from the public key pk, an N*n dimensional transformation matrix B modulo q is randomly generated:

[0011]

[0012] And a vector e of length N is obtained by sampling from the random distribution χ:

[0013]

[0014] By processing the private key sk using vector e and transformation matrix B, we obtain a vector b of length N:

[0015]

[0016] This yields the public key pk, which can be represented as an N*(n+1) dimensional matrix:

[0017]

[0018] After generating the public key pk, it can be used to encrypt any plaintext. For example, for plaintext m, m is first arranged into an n+1 dimensional vector. :

[0019]

[0020] Random sampling noise r

[0021]

[0022] Process the vector using the public key pk and the noise r. This will give you the ciphertext c corresponding to plaintext m:

[0023]

[0024] When homomorphic operations (homomorphic addition and homomorphic multiplication) are performed on ciphertext encrypted with the same public key, the result of the homomorphic operation, after decryption, is equivalent to performing the same arithmetic operation on the plaintext corresponding to the ciphertext.

[0025] Specifically, the computing power holding the private key sk can decrypt the ciphertext encrypted using the BGV12 scheme to obtain the corresponding plaintext. The decryption process is as follows: multiply the ciphertext c by the private key, and then perform modulo q and modulo 2 operations on the result in turn.

[0026]

[0027] Observing the encryption process of the BGV12 scheme, it can be seen that if the BGV12 scheme is deployed for privacy-preserving computation, each participant in the privacy-preserving computation must hold the same public key to encrypt their own plaintext data. Therefore, on the one hand, the holder of the private key must send the public key to each participant, and each participant must also store the public key in easily readable storage space during the privacy-preserving computation process. According to the security constraints and decryption correctness constraints of the BGV12 scheme, the number of public samples N (i.e., one dimension of the public key matrix) can be represented using the vector dimension n— In other words, the overall dimension of the public key can reach Correspondingly, the transmission and storage overhead of the public key are also both... .

[0028] The enormous transmission and storage overhead of public keys makes the BGV12 scheme, based on the LWE problem, unsuitable as the preferred solution for privacy computing problems in current applications. Therefore, the industry has also attempted to build FHE schemes based on difficult problems that rely on specific algebraic structures, in order to reduce the dimensionality of public keys.

[0029] The Ring Learning With Errors (RLWE) problem is derived from the LWE problem and can be described as follows: Given a random polynomial in a polynomial quotient ring, perform ring multiplication on this random polynomial and a secret polynomial (in the same polynomial quotient ring), add a small amount of noise to obtain the computational result, and recover the secret polynomial from the random polynomial and the computational result. FHE schemes built based on the RLWE problem can include the Cheon-Kim-Kim-Song (CKKS) scheme, the Brakerski-Frederik-Vaikuntanathan (BFV) scheme, and RLWE versions of the BGV12 scheme, etc.

[0030] Based on the characteristics of polynomial quotient rings, performing a cyclic shift on a polynomial within the quotient ring yields N corresponding derivative results. That is, in the FHE scheme built upon the RLWE problem, a random polynomial of dimension n can achieve the same effect as a transformation matrix of dimension N*n (in the LWE version of the BGV12 scheme). Therefore, in the FHE scheme built upon the RLWE problem, the public key transmission and storage overhead can be as low as... .

[0031] However, it should be noted that because of the explicitly defined algebraic structure (both the random polynomial and the secret polynomial are defined in the polynomial quotient ring), adversaries can construct targeted attack algorithms based on this algebraic structure, breaking the RLWE problem in a much shorter time (compared to the LWE problem). Therefore, compared to the completely unrestricted LWE problem, the RLWE problem is less secure.

[0032] Therefore, taking into account both security factors and operational overhead, this specification provides a scheme for performing homomorphic computation. Summary of the Invention

[0033] This specification provides an embodiment of a method and computing device for performing homomorphic computation, including:

[0034] The first aspect of this specification provides a method for performing homomorphic computation, the method relating to intermediate product ciphertext, the intermediate product ciphertext being obtained by encrypting plaintext to be encrypted using an intermediate product public key, the intermediate product public key being constructed based on an intermediate product fault-tolerant learning problem, the method including at least a transformation key generation step;

[0035] The conversion key generation step is performed by the generator and specifically includes:

[0036] Obtain a first private key and a second public key, wherein the first public key and the second public key are intermediate product public keys, the first private key is the private key vector required to decrypt the first ciphertext, and the first ciphertext is intermediate product ciphertext, which is obtained by encrypting the plaintext to be encrypted using the first public key;

[0037] Based on the initial dimension of the intermediate product ciphertext and the dimension of the tensor product of the intermediate product ciphertext, the second public key is arranged to determine the updated key matrix; and the first private key is arranged to determine the original key vector.

[0038] By combining the updated key matrix and the original key vector, a conversion key from the first private key to the second private key is determined.

[0039] A second aspect of this specification provides a computer-readable storage medium having a computer program stored thereon that, when executed in a computer, causes the computer to perform the method described in the first aspect.

[0040] A third aspect of this specification provides a computing device including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in the first aspect.

[0041] The public key size of the scheme for performing homomorphic computation provided in this embodiment can be limited to... Compared to the BGV12 scheme The public key size is specified in this scheme, which is only for its... Furthermore, since this scheme is based on the MP-LWE problem, its security can be reduced to the LWE problem by referring to the MP-LWE problem. That is, this scheme has the same security as various homomorphic encryption schemes based on the LWE problem, and the security of this scheme is higher than that of various homomorphic encryption schemes based on the RLWE problem. Attached Figure Description

[0042] To more clearly illustrate the technical solutions of the embodiments in this specification, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 This is a schematic diagram of the intermediate product operation process in one embodiment of this specification;

[0044] Figure 2 This is a schematic diagram illustrating the transformation relationship between a polynomial and a Topelitz matrix in one embodiment of this specification;

[0045] Figure 3 This is a schematic diagram illustrating the relationships between the participating parties in one embodiment of this specification;

[0046] Figure 4 This is a flowchart illustrating the key generation steps in one embodiment of this specification;

[0047] Figure 5 This is a flowchart illustrating the encryption steps in one embodiment of this specification;

[0048] Figure 6 This is a flowchart illustrating the decryption steps in one embodiment of this specification;

[0049] Figure 7 This is a flowchart illustrating the key generation steps in one embodiment of this specification;

[0050] Figure 8 This is a schematic diagram of the structure of the updated key matrix in one embodiment of this specification;

[0051] Figure 9 This is a flowchart illustrating the homomorphic multiplication steps in one embodiment of this specification;

[0052] Figure 10 This is a flowchart illustrating the homomorphic addition steps in one embodiment of this specification;

[0053] Figure 11 This is a flowchart illustrating the execution of homomorphic computation in one embodiment of this specification. Detailed Implementation

[0054] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0055] The Middle-Product Learning With Errors (MP-LWE) problem is the security foundation of the homomorphic encryption scheme in this embodiment. To clearly illustrate the application of this problem in this embodiment, we first introduce the specific definition of the problem, and then introduce two key lemmas that can be derived from it.

[0056] Let q be a positive integer modulus. Let represent the ring of integers modulo q. For any positive integer d, let . For the coefficient in The set of polynomials in the set of polynomials whose degree is strictly less than d. For two polynomials... And integers d and k satisfy the intermediate product dimension relationship. Define the intermediate product operation of length d. :

[0057]

[0058] Where a·b represents ordinary multiplication of a polynomial. This represents the coefficient of the lower-degree k+d+1 term in the polynomial product, divided by... Rounding down indicates discarding the coefficient of the lower-degree k+1 term among the retained k+d+1 terms. For example... Figure 1As shown, intuitively, the intermediate product operation extracts the d coefficients from the "middle" part of the product of two polynomials to form a d-1 dimensional polynomial as the result of the intermediate product operation. When da=db=n and k=0, the intermediate product degenerates into ordinary polynomial multiplication truncated to the first n terms; when k>0, this operation has the property of resisting structured attacks and is suitable for building more efficient lattice cryptography schemes.

[0059] Based on the aforementioned intermediate product operation, the MP-LWE problem can be formally defined as follows: Let the security parameter be n, the modulus be q, and the noise distribution be χ (usually a discrete Gaussian distribution or uniformly distributed on a small set of integers). Let da, db, d, and k be integers that satisfy the dimensional relationship of the intermediate product. Random sampling... Secret polynomial Error polynomial .calculate Output sample pair (a, b).

[0060] The MP-LWE hypothesis states that for any probabilistic multinomial-time adversary A, the sample pair (a, b) from the MP-LWE distribution can be distinguished from those from the uniform distribution. The advantage of a random sample pair (a, u) is negligible:

[0061]

[0062] In other words, adversary A has difficulty distinguishing between sample pairs (a,b) and random samples, and therefore has difficulty obtaining enough information from sample pairs (a,b) to crack the secret polynomial.

[0063] In this embodiment, the construction of the public key is based on the MP-LWE problem, making it impossible for attackers to obtain the public key. The secret polynomial s is recovered in the middle.

[0064] Furthermore, two key lemmas can be derived from the MP-LWE problem: Lemma 1 is key to constructing the encryption and decryption steps, and Lemma 2 is key to constructing the transformation key generation step.

[0065] Lemma 1 (Associative Property): Let d, k, n > 0 be integers. For any polynomial... , and If the intermediate product dimension relationship is satisfied, then the following equation holds:

[0066]

[0067] Here, r·a represents the ordinary product of polynomials r and a. The proof of the correctness of this lemma is based on the associative law of polynomial multiplication and the linear truncation property of the intermediate product definition.

[0068] Lemma 2 (Linearized Representation): Let d and k > 0 be integers. For any polynomial... , ,make Then there exists a Topplitz matrix determined by the coefficients of a. Make

[0069]

[0070] in, It is the coefficient vector of the polynomial r. Let represent a Toplitz matrix with d effective diagonals and d+k-1 columns, where all elements on the same diagonal are identical. Figure 2 This diagram illustrates the process of transforming a polynomial with 5 terms into a 5x5 Toplitz matrix in one embodiment of this specification. Another polynomial... The corresponding coefficient vector Performing matrix multiplication with this Toplitz matrix is ​​equivalent to calculating .

[0071] Based on the MP-LWE problem, this embodiment provides a method for performing homomorphic computation. This method covers the entire process of a homomorphic encryption scheme, including key generation, key transformation, encryption, homomorphic computation, and decryption. In practical scenarios, this method can be executed jointly by several participants with different identities. These participants may include a generator, an encryptor, a computer, and a decryptor. Figure 3 A schematic diagram illustrating the relationships between the participating parties in one embodiment of this specification is shown.

[0072] The generator is responsible for initializing system parameters, generating keys, and generating conversion keys, providing fundamental support for the construction of the homomorphic encryption scheme. The encryptor is responsible for encrypting plaintext data into ciphertext, ensuring the confidentiality of the data during transmission and processing. The computer is responsible for performing specified homomorphic operations on the ciphertext without knowing the plaintext data or possessing the private key. The decryptor possesses the private key and can restore the final ciphertext after homomorphic operations to its plaintext form.

[0073] In this embodiment, the computing party cannot simultaneously act as both the generator and the decryptor, while the identities of other participating parties can overlap. This ensures that, even if the computing party and the encryptor are not the same party, and even if the computing party is in an untrusted computing environment, the core private key and plaintext data will not be leaked.

[0074] First, the key generation steps will be introduced. Figure 4 This specification shows a flowchart illustrating a key generation step in one embodiment. The key generation step includes actions performed by the generator, including:

[0075] Step S401: Determine several security parameters, including the maximum modulus of the ciphertext, noise distribution, and multiplication depth.

[0076] In the key generation step, the generator first determines several security parameters, including but not limited to the security level λ, the private key vector length n, the maximum modulus q of the ciphertext, the noise distribution χ, and the multiplication depth L. The security level indicates the approximate execution time required by the most efficient known attack algorithm. Only after several basic operations can the plaintext or private key be recovered with a non-negligible probability; the maximum modulus determines the range of the ciphertext spatial coefficients; the noise distribution controls the magnitude of errors introduced during encryption, while the multiplication depth limits the number of consecutive homomorphic multiplication operations the scheme can support. Typical noise distributions can be discrete Gaussian or uniformly distributed across a small set of integers. The private key vector length *n* is strongly correlated with the maximum modulus *q* of the ciphertext and can be determined synchronously by the generator based on the security level *λ* and the security constraints of the MP-LWE problem. The remaining security parameters (noise distribution *χ* and multiplication depth *L*) can be set by the generator according to execution requirements. Generally, the variance of the noise distribution is small, meaning that the coefficients of the noise polynomial sampled from the noise distribution are usually much smaller than the maximum modulus of the ciphertext (differences of several orders of magnitude).

[0077] Step S403: Based on the multiplication depth, perform multiple samplings in the noise distribution to determine multiple secret polynomials, wherein the secret polynomials are represented in the modulus space indicated by the maximum modulus.

[0078] After determining the security parameters, the generator can perform L independent sampling operations in a preset uniform distribution based on the determined multiplication depth L, thereby determining L secret polynomials. The number of terms in these secret polynomials can be determined based on the preset private key vector length, and the coefficients are set in the modulus space defined by the maximum modulus q.

[0079] Step S405: Generate the private key vector and intermediate product public key for each secret polynomial.

[0080] Subsequently, the generator constructs intermediate product public and private key vectors for each secret polynomial based on the MP-LWE problem. Specifically, a set of intermediate product public keys consists of t public key components, each component denoted as . ,in Each public key component is fragmented from the first public key. Second public key sharding Composition. The generator selects the coefficient vector of a random polynomial as the first public key shard. Next, the generator uses the secret polynomial With random polynomial Perform an intermediate product operation, and combine the result with the noise term obtained by χ sampling in the noise distribution. Combination:

[0081]

[0082] Therefore, the second public key fragment can be determined. ,in, Indicates the retention length is The intermediate product operation. The size of t can also be determined based on the security constraints of the MP-LWE problem and the length of the private key vector n. Typically, the size of t is set to... That is, t and The magnitudes are the same. Combining the lengths of the first and second public key fragments in the public key component, it can be seen that the dimension of a set of intermediate product public keys in this embodiment is... In contrast, the BGV12 scheme has a public key matrix with dimensions reaching [missing information]. In other words, in this embodiment, under the same security parameter settings, the public key dimension is only that of the BGV12 scheme. .

[0083] Meanwhile, the generator determines the corresponding private key vector based on the secret polynomial. Let the secret polynomial be denoted as 's'. The private key vector can be constructed as a combination of the transpose of the coefficient vector containing -s and the identity element. The position of the identity element in the private key vector corresponds to the plaintext data. For example, let the secret polynomial be denoted as... Therefore, the target coefficient vector can be denoted as: Private key vector .

[0084] In summary, in the key generation step, L sets of intermediate product public keys and the private key corresponding to each set of intermediate product public keys can be determined according to the preset multiplication depth L. Each set of intermediate product public keys includes t sets of public key components.

[0085] This embodiment utilizes the structural characteristics of intermediate product operations (Lemma 1 mentioned earlier) to optimize the public key size while ensuring security, based on the MP-LWE problem. Since computational complexity is typically polynomial in relation to dimensionality, smaller dimensions mean faster response times and lower computational latency. This embodiment significantly improves the speed of key generation, encryption, and decryption. The public key size can be reduced from hundreds of MB to tens of MB, significantly reducing storage and memory usage, making it more suitable for resource-constrained terminal devices. Furthermore, in scenarios requiring frequent exchange of public keys and ciphertext, such as distributed systems or federated learning, network transmission overhead is also greatly reduced.

[0086] Based on the public key determined in the key generation step, the encrypting party can encrypt its own sensitive data. Figure 5 This specification shows a flowchart illustrating an encryption step in one embodiment, which is performed by the encrypting party and includes:

[0087] Step S501: For any set of public key components of the third public key, randomly sample to obtain the length corresponding to that set of public key components. The mask polynomial; wherein the third public key is the intermediate product public key.

[0088] The encryptor first obtains a third public key, which is an intermediate product public key constructed based on the Middle-Product Learning With Errors (MP-LWE) problem, containing several sets of public key components. For any set of public key components of the third public key, the encryptor randomly samples the mask polynomial corresponding to that set of public key components from a pre-defined uniform distribution. The mask polynomial The length of the coefficient vector is set to n divided by 2, where n still represents the total length of the private key vector.

[0089] Step S503: Determine the first ciphertext sub-segment based on the product of the mask polynomial and the polynomial corresponding to the first public key segment in the group of public key components; determine the second ciphertext sub-segment by performing an intermediate product operation of length 1 based on the mask polynomial and the polynomial corresponding to the second public key segment in the group of public key components.

[0090] The encryption method is based on the mask polynomial. The polynomial corresponding to the first public key fragment in this set of public key components The algebraic product determines the first ciphertext sub-segment. :

[0091]

[0092] At the same time, the encryptor will use the mask polynomial. The polynomial corresponding to the second public key fragment in this set of public key components The execution retention length is The intermediate product operation determines the second ciphertext sub-segment. :

[0093]

[0094] Step S505: Add all the first ciphertext sub-fragments together to obtain a first ciphertext fragment; add all the second ciphertext sub-fragments together with the third plaintext to obtain a second ciphertext fragment; use the first ciphertext fragment and the second ciphertext fragment as the third ciphertext obtained by encrypting the third plaintext with the third public key.

[0095] Subsequently, the encryptor performs polynomial addition on the first ciphertext sub-segments of each group to obtain the first ciphertext sub-segment. :

[0096]

[0097] And fragment each group of second ciphertexts Summation is performed, and the summation result is added to the third plaintext m to be encrypted using coefficient addition to obtain the second ciphertext fragment. :

[0098]

[0099] Finally, the encrypting party fragments the first ciphertext. With the second ciphertext fragment Perform vector concatenation and output the third ciphertext C obtained by encrypting the third plaintext with the third public key. .

[0100] In practical application deployment scenarios, the third public key is independently generated by the generator (usually the data owner, trusted key management center, or independent cryptographic service provider) during the system initialization phase using a key generation algorithm. In actual deployment, after completing parameter sampling and matrix construction using a local secure computing environment, the generator distributes the third public key through a public network or a Public Key Infrastructure (PKI) directory. For example, in a cross-institutional medical data collaborative analysis scenario, a regional medical consortium, acting as the generator, generates the third public key on an isolated server and publishes it to the consortium blockchain for download by participating hospitals and research institutions. Obtaining the third public key does not depend on authorization from the encryptor or the computing party; any entity that obtains the public key can perform encryption operations, but its design ensures that only the entity holding the corresponding private key can restore the data. The third plaintext is directly provided by the encryptor (data provider or business initiator) and represents the highly sensitive original data to be homomorphically encrypted. Its content can cover structured business records, semi-structured logs, or unstructured feature vectors. In smart financial risk control scenarios, the third plaintext may include the customer's credit score, historical repayment records, net asset value vector, and anti-fraud feature identifiers. In industrial IoT monitoring scenarios, the third plaintext may include equipment vibration spectrum data, temperature and pressure sensor sampling sequences, and operating status codes. It should be noted that, to ensure the correctness of encryption and decryption in this embodiment, the third plaintext must be composed of binary scalars. After obtaining the original business data at the local terminal or edge gateway, the encrypting party can encode the original business data into binary data to obtain the third plaintext, and then call the encryption algorithm to convert the third plaintext into ciphertext. The third plaintext is always generated within the encrypting party's secure domain, ensuring that the original business data does not enter the external network.

[0101] Based on the encryption steps described above, Figure 6 This specification shows a flowchart illustrating a decryption step in one embodiment, which can be performed by the decryptor and includes:

[0102] Step S601: Obtain the fourth ciphertext and determine the private key vector corresponding to the fourth ciphertext as the fourth private key.

[0103] The decryptor first obtains the fourth ciphertext to be decrypted. And determine the fourth ciphertext The corresponding private key vector serves as the fourth private key. The fourth ciphertext From the first ciphertext component With the second ciphertext component Composition, fourth private key The construction form can be found in the introduction to the key generation stage.

[0104] Step S603: Calculate the inner product of the fourth ciphertext and the fourth private key to determine the noisy plaintext.

[0105] Subsequently, the decryptor calculates the fourth ciphertext. With the fourth private key Standard inner product to determine noisy plaintext :

[0106]

[0107] Since plaintext data is scalar Combining the generation process of the first and second ciphertext sub-shards during the encryption phase, and the generation process of the intermediate product public key:

[0108]

[0109]

[0110] Further combining with Lemma 1 corresponding to MP-LWE:

[0111]

[0112] thus

[0113]

[0114] Referring to the public-key structure, this inner product operation precisely cancels out the intermediate product mapping terms introduced by the public-key components in terms of algebraic structure. This makes noisy plaintext Contains only the original plaintext information With tiny error terms accumulated during the encryption process .

[0115] Step S605: Perform a modulo operation on the noisy plaintext based on the maximum modulus to determine the plaintext result corresponding to the fourth ciphertext.

[0116] Next, the decryptor processes the noisy plaintext according to the maximum modulus q preset in the scheme. Perform modulo and rounding operations to determine the plaintext result corresponding to the fourth ciphertext. :

[0117]

[0118] in This represents the nearest integer rounding operation under the modulo-q integer ring, and mod 2 represents the modulo-2 remainder operation (to eliminate noise terms in the public key). This decryption process fully utilizes the linear orthogonality between ciphertext fragments and the private key vector, achieving high-precision restoration of plaintext information while strictly suppressing noise overflow.

[0119] In practical deployment scenarios, the fourth ciphertext is output by the computing party (cloud server, edge computing cluster, or privacy computing platform node) after the homomorphic computation process is completed. After receiving multiple initial ciphertexts encrypted with the third public key, the computing party performs homomorphic addition and multiplication operations according to a pre-defined computation graph, without knowing the plaintext content. For example, in credit scoring model inference under ciphertext, the computing party performs homomorphic matrix multiplication on the encrypted customer feature vector and the encrypted model weight parameters, and homomorphically accumulates the approximate polynomial expansion results of the multi-layer nonlinear activation functions. Finally, the output data containing the encrypted representation of the computation results is returned as the fourth ciphertext. The source of the fourth ciphertext is strictly limited to the computing party's computation log and the execution trajectory of the homomorphic circuit; its content does not carry any directly reproducible plaintext information. The fourth private key is generated synchronously with the third public key during the key generation phase and is independently stored by the decryption party (data owner, authorized auditing agency, or business result user) through physical isolation or hardware security mechanisms. In practical applications, the fourth private key is never transmitted to the network environment of the encrypting or computing party. Instead, it is stored within the decrypting party's Hardware Security Module (HSM), smart cryptographic key, or Trusted Execution Environment (TEE). For example, in scenarios involving cross-border flow of government data review, the data provider imports the fourth private key into a local offline decryption terminal. Only after receiving the fourth ciphertext returned by the overseas computing node, the provider invokes the decryption algorithm to perform inner product restoration in an offline environment. The acquisition and use of the fourth private key are subject to strict access control policies and cryptographic audit logs, ensuring absolute centralization of data sovereignty and decryption authority.

[0120] Based on the above flow path, all elements form a closed-loop data chain within the privacy computing architecture. After initialization, the generator publishes a third public key, and the encryptor uploads encrypted third plaintext (such as corporate financial statements or clinical test results). The computing party performs homomorphic aggregation and model inference in the ciphertext domain to generate a fourth ciphertext (such as encrypted annual profit or encrypted disease risk prediction). The decryptor uses a locally stored, strictly isolated fourth private key to perform the final decryption of the fourth ciphertext, obtaining a readable plaintext business result. This architecture, through the open distribution of public keys and the localized management of private keys, achieves the physical separation of computing power and data privacy, strictly adhering to the principle of least privilege and the paradigm of data usability without visibility. It provides a feasible cryptographic engineering implementation path for high-security scenarios such as financial compliance auditing, collaborative medical research, and government data sharing.

[0121] However, it's important to note that the main difference between homomorphic encryption schemes and ordinary encryption schemes lies in the fact that homomorphic encryption schemes allow computation on the ciphertext (i.e., support homomorphic operation steps). In existing homomorphic encryption schemes based on lattice ciphers (such as the LWE or RLWE problems), when two ciphertexts are homomorphically multiplied, the dimensionality of the resulting ciphertext expands. For example, if two ciphertext vectors of length n are multiplied, the result is often a ciphertext with dimension n. Or even higher-dimensional tensors or polynomials. Without addressing this expansion, the consistency of the ciphertext format cannot be guaranteed (ciphertext with and without homomorphic multiplication differs in dimensionality). This means, on the one hand, the ciphertext cannot support circuit computations of arbitrary depth; on the other hand, a dedicated decryption step needs to be constructed for ciphertext with homomorphic multiplication.

[0122] Therefore, the homomorphic encryption scheme in this embodiment also includes a conversion key generation step, which generates a conversion key that can be used to "switch" the high-dimensional multiplication result ciphertext to a standard low-dimensional ciphertext space. Figure 7 This document shows a flowchart illustrating the key generation steps in this specification. The key generation steps are performed by the generator and include:

[0123] Step S701: Obtain the first private key and the second public key, wherein the first public key and the second public key are intermediate product public keys, the first private key is the private key vector required to decrypt the first ciphertext, and the first ciphertext is intermediate product ciphertext, which is obtained by encrypting the plaintext to be encrypted using the first public key.

[0124] The generator first obtains a first private key sk1 and a second public key pk2. Both the first and second public keys are intermediate product public keys constructed based on the intermediate product fault-tolerant learning problem. The first private key sk1 is the private key vector required to decrypt the first ciphertext generated by encrypting the plaintext to be encrypted by the first public key pk1.

[0125] Step S703: Arrange the second public key according to the initial dimension of the intermediate product ciphertext and the dimension of the tensor product of the intermediate product ciphertext to determine the update key matrix; and arrange the first private key to determine the original key vector.

[0126] Subsequently, the generator uses the initial dimension n of the intermediate product ciphertext and the tensor product dimension generated after homomorphic multiplication of the intermediate product ciphertext. The second public key is linearly arranged to determine the update key matrix B. Specifically, the number of rows in the update key matrix B is determined by the tensor product dimension. The number of columns is determined by the initial dimension n.

[0127] Specifically, the generator first obtains a first private key vector sk1 and a second public key pk2, where k1 represents the original private key vector used to decrypt the first ciphertext, and pk2 represents the target public key containing t public key components. The generator then uses the initial dimension n of the intermediate product ciphertext and the tensor product dimension... The second public key pk2 is arranged to determine the update key matrix B. The number of rows N of the update key matrix B is determined by the total number of columns of the second public key components. The number of columns is directly equal to the initial dimension n, and their dimensional relationship satisfies... Simultaneously, the first private key vector sk1 is arranged to determine the original key vector. This operation ensures compatibility between the vector dimension and subsequent matrix multiplication.

[0128] Specifically, to ensure the proper functioning of the transformed key—the arrangement of the updated key matrix can refer to the following process. As discussed earlier regarding the encryption and decryption steps, the key to ensuring decryption correctness lies in canceling the intermediate product mapping terms introduced by the public key components during the decryption process. Correspondingly, to ensure the ciphertext processed by the transformed key also has decryption correctness, it is also necessary to ensure that when decrypting the (transformed key processed) ciphertext using the second private key, the intermediate product mapping terms introduced by the second public key can be canceled during the decryption process. Furthermore, according to security requirements, all public key components of the second public key must be used during the arrangement process.

[0129] Therefore, for each public key component of the second public key pk2, the generator can determine the first public key fragment corresponding to each public key component. The corresponding convolution matrices The convolution matrix In essence The Toplitz matrix composed of polynomial coefficients Each row of elements is composed of The coefficients are generated by shifting and arranging them with a fixed step size, which can equivalently characterize the algebraic transformation process of the intermediate product operation of the polynomial. Furthermore, based on each convolution matrix... and each fragment of the second public key. Arrange to obtain the updated key matrix .in From each convolution matrix Vertical concatenation yields each convolution matrix. spliced ​​together The specific method is not limited in this instruction manual, but it is only necessary to ensure that, according to security requirements, the convolutional matrices corresponding to the t fragments of the first public key are all used in the splicing process. Then it is fragmented by each second public key. All concatenated keys must have the same index in the updated key matrix B. and Located in the same industry.

[0130] Accordingly, the tensor product of the first private key sk1 Arranged into the original key vector Therefore, the original key vector can be fused with the updated key matrix to obtain the transformation key.

[0131] In some implementations, to meet security requirements without excessive redundancy, N can be set to... Consequently, such as Figure 8 As shown, for any convolution matrix y repeated convolution matrices By performing vertical concatenation, we obtain the extended matrix corresponding to the convolution matrix. And for any second public key fragment, y duplicate fragments of that second public key. Perform vertical concatenation to obtain the extended vector corresponding to the second public key fragment. ;in, q is the maximum modulus of the ciphertext, therefore... , The t extended matrices corresponding to the second public key are vertically concatenated to obtain the concatenated matrix. Then, following the concatenation order of the extended matrix, the t extended vectors corresponding to the second public key are vertically concatenated to obtain the concatenated vector. The concatenation matrix and the concatenation vector are horizontally concatenated to obtain the updated key matrix, the dimension of which is... .

[0132] Therefore, based on this updated key matrix, a conversion key that meets the preset security requirements can be obtained.

[0133] Step S705: Combine the updated key matrix and the original key vector to determine the conversion key from the first private key to the second private key.

[0134] The generator will update the key matrix. With the original key vector By concatenating and merging the two private keys, the conversion key from the first private key to the second private key can be determined. :

[0135]

[0136] in This represents a zero matrix with dimensions N rows and n-1 columns.

[0137] Furthermore, to match the dimension of the transformation key, the generator concatenates the product results of the private key to be compressed and each expansion exponent to obtain an initial key vector, wherein each expansion exponent includes base 2 numbers from 0 to 2. Power of 1.

[0138] Let the product of the vector s and the k expansion exponents be denoted as... ,

[0139]

[0140] The bit expansion of vector c with a bit width of k is denoted as: ,

[0141]

[0142] in,

[0143]

[0144] The above operations have the following characteristics:

[0145]

[0146] The aforementioned matching relationship ensures the closure of subsequent matrix and vector multiplication operations in the algebraic space. Based on these characteristics, if an initial key vector is constructed using the expansion exponent, when processing the ciphertext using the corresponding conversion key, it is only necessary to perform the corresponding bit expansion on the ciphertext according to the size of k. Processing the bit-expanded ciphertext with the conversion key will achieve the same processing effect as a normal conversion key.

[0147] For the two ciphertexts obtained using the first public key—the first ciphertext and the second ciphertext—the tensor product of the first ciphertext and the second ciphertext is denoted as the initial product ciphertext. Processing the initial product ciphertext with the transformation key yields a third ciphertext, the third ciphertext having the same dimension as the first ciphertext. The third ciphertext is equivalent to encrypting the product of the first plaintext and the second plaintext using the second public key, where the first plaintext is the plaintext to be encrypted corresponding to the first ciphertext, and the second plaintext is the plaintext to be encrypted corresponding to the second ciphertext.

[0148] The third ciphertext is recorded as Record both the first and second ciphertexts as , Decrypting the third ciphertext using the second private key yields:

[0149]

[0150] According to the process of determining the conversion key :

[0151]

[0152]

[0153]

[0154]

[0155] This characteristic is derived from the fact that the private key vector is obtained by concatenating a secret polynomial with an identity element.

[0156]

[0157]

[0158]

[0159] This is the noise term used when the second public key is generated. It can be separated by a modulo 2 operation during decryption. Based on the above arguments, it can be concluded that the third ciphertext can be correctly decrypted to obtain the product of the first and second plaintexts.

[0160] Based on the transformation key constructed through the above steps, this embodiment can solve the problem of ciphertext dimensionality expansion during homomorphic multiplication. Therefore, based on the encryption and decryption steps constructed according to the MP-LWE problem described above, this embodiment further constructs corresponding homomorphic multiplication steps and homomorphic addition steps, obtaining a homomorphic encryption scheme based on the MP-LWE problem. Here, the homomorphic multiplication steps of this embodiment are first introduced. Figure 9 This specification shows a flowchart illustrating a homomorphic multiplication step in one embodiment. This homomorphic multiplication step can be performed by the computer and includes:

[0161] Step S901: Obtain the first ciphertext and the second ciphertext, wherein the first ciphertext and the second ciphertext correspond to the first public key.

[0162] It should be noted that in some implementations, the first ciphertext and the second ciphertext can also be obtained by directly encrypting plaintext with the first public key; in other implementations, the first ciphertext or the second ciphertext can be the result of homomorphic addition of the first target ciphertext, which is obtained by directly encrypting plaintext with the first public key; in still other implementations, the first ciphertext and the second ciphertext can also be obtained by transforming the second target ciphertext, which is the initial product ciphertext of homomorphic multiplication of two ciphertexts directly encrypted with other public keys (other than the first public key).

[0163] Step S903: Calculate the tensor product of the first ciphertext and the second ciphertext to obtain the initial product ciphertext of the first ciphertext and the second ciphertext.

[0164] Step S905: Process the initial product ciphertext using the conversion key to obtain a third ciphertext. The dimension of the third ciphertext is the same as that of the first ciphertext. The third ciphertext is equivalent to encrypting the product of the first plaintext and the second plaintext using the second public key. The first plaintext is the plaintext to be encrypted corresponding to the first ciphertext, and the second plaintext is the plaintext to be encrypted corresponding to the second ciphertext.

[0165] As described above regarding the specific construction method of the transformation key, for transformation keys not constructed using the expansion exponent, matrix multiplication can be directly performed between the initial product ciphertext and the transformation key to determine the third ciphertext. For transformation keys constructed using the expansion exponent, the initial product ciphertext can be multiplied by a matrix with a bit width of [missing information]. The bits are expanded, and the expanded bits are concatenated to obtain the extended ciphertext; the extended ciphertext is multiplied by the transformation key to determine the third ciphertext.

[0166] Furthermore, without bit expansion of the ciphertext, the noise increase is proportional to the modulus q, with an order of magnitude of O(q⋅∥e∥). After bit expansion of the ciphertext, all terms in the expanded ciphertext are represented in binary, much smaller than the original initial product ciphertext, and the noise increase is proportional to O(logq⋅∥e∥). Multiplying the expanded ciphertext by the transformation key can control the noise increase of the third ciphertext to that of the original. To avoid noise exceeding the preset modulus q, which could cause decryption failure.

[0167] In summary, in this embodiment, after the homomorphic multiplication step, the result of the homomorphic multiplication step can be decrypted using a unified decryption method to obtain the correct plaintext result. In this embodiment, without bootstrapping, the number of consecutive homomorphic multiplications that can be performed is the preset multiplication depth L. Considering the bootstrapping step, the required bootstrapping depth L needs to be reserved, and the number of consecutive homomorphic multiplications that can be performed is Ll. The specific bootstrapping method can refer to common bootstrapping methods in BGV schemes, such as homomorphically encrypting the ciphertext to refresh the multiplication depth, etc., and this specification does not impose specific limitations here.

[0168] Figure 10 A flowchart illustrating a homomorphic addition step in one embodiment of this specification is shown. This homomorphic addition step can be performed by the computer and includes:

[0169] Step S1001: Obtain the fifth ciphertext and the sixth ciphertext, wherein the fifth ciphertext and the sixth ciphertext correspond to the fifth public key, and the fifth public key is the intermediate product public key.

[0170] Specifically, the specific forms of the fifth and sixth ciphertexts can be found in the description corresponding to step S901 above.

[0171] Step S1003: Add the fifth ciphertext and the sixth ciphertext to determine the seventh ciphertext. The seventh ciphertext is equivalent to encrypting the sum of the fifth ciphertext and the sixth ciphertext using the fifth public key. The fifth plaintext is the plaintext to be encrypted corresponding to the fifth ciphertext, and the sixth plaintext is the plaintext to be encrypted corresponding to the sixth ciphertext.

[0172] The specific operation of homomorphic addition in this embodiment is similar to addition in arithmetic operations, and will not be described in detail here.

[0173] It should be noted that both homomorphic multiplication and homomorphic addition introduce more noise into the ciphertext as the result of the operation. To ensure that the noise in the ciphertext does not affect the correctness of decryption after homomorphic operations (including homomorphic multiplication and homomorphic addition), an analog-to-digital conversion can be performed on the noisy ciphertext (i.e., the third or sixth ciphertext) after each homomorphic multiplication step (resulting in the third ciphertext) or multiple consecutive homomorphic addition steps (resulting in the sixth ciphertext).

[0174] Specifically, in the key generation step, multiple modulus chain levels can be determined based on the multiplication depth, where each modulus chain level corresponds to a sub-modulus, and the product of the sub-modulus corresponding to the multiple modulus chain levels is equal to the maximum modulus.

[0175]

[0176] in, Indicates the maximum modulus. That is, the sub-modules corresponding to each module chain level.

[0177] After executing step S905 or step S1003, an analog-to-digital conversion step can be performed. This analog-to-digital conversion step specifically includes: determining the current modulus chain level of the high-noise ciphertext, wherein the high-noise ciphertext is the sixth ciphertext or the third ciphertext; scaling the high-noise ciphertext according to the sub-modulus corresponding to the current modulus chain level to determine the low-noise ciphertext corresponding to the high-noise ciphertext, wherein the low-noise ciphertext supports the execution of homomorphic multiplication operations.

[0178] If the current modular chain level is p, then the scaling steps are...

[0179]

[0180] in, Indicates high-noise encrypted text. Indicates low-noise encrypted text. The closest The vector, and Since r is much smaller than q, it is usually taken as 2. Therefore, the scaled low-noise ciphertext and the unscaled high-noise ciphertext are equivalent to encrypting the same plaintext using the same public key, except that the noise in the low-noise ciphertext is less than that in the high-noise ciphertext.

[0181] It should be noted that, upon determining During the process, Noise passing through The calculations were also correspondingly compressed into the original... Therefore, even after multiple rounds of consecutive homomorphic multiplication steps, with the support of the analog-to-digital conversion step, the ciphertext as the calculation result will not cause errors in decryption due to noise overflow.

[0182] In summary, Figure 10 The diagram illustrates a flowchart of homomorphic computation in one embodiment of this specification. First, the generator generates a public key, a private key, and a transformation key. The public key is transmitted to the encryptor, the private key to the decryptor, and the transformation key to the computer. Then, the encryptor uses the public key to encrypt its plaintext data and transmits the ciphertext to the computer. The computer then uses the transformation key to perform multiple rounds of homomorphic computation on the ciphertext and transmits the final result to the decryptor. The decryptor uses the private key to decrypt the final result to obtain the computation result in the plaintext state.

[0183] It should be noted that in this embodiment, the construction of the keys (public key, private key, transformation key, etc.) satisfies the difficulty assumption of the MP-LWE problem, meaning that the security of this scheme is comparable to that of the MP-LWE problem. Compared to the RLWE problem, which relies on polynomial ring structures, the MP-LWE problem is closer to the fundamental LWE problem, exposing fewer exploitable algorithmic structures to attackers. Under existing proof structures, MP-LWE can be reduced to the LWE problem. Therefore, compared to various homomorphic encryption schemes based on the RLWE problem (RLWE versions using the BGV12 scheme), this embodiment offers higher security under the same security parameters.

[0184] Furthermore, the public key size of this embodiment has been compared with that of the LWE scheme in the preceding text. The conclusion is that the computational complexity and transmission overhead of this embodiment are significantly lower than those of various existing LWE schemes. In summary, compared with existing homomorphic encryption schemes based on the LWE problem, this embodiment provides a method for performing homomorphic computation with the same security and lower computational overhead.

[0185] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0186] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0187] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0188] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes said elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0189] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0190] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0191] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0192] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0193] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0194] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0195] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0196] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0197] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0198] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0199] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A method for performing homomorphic computation, the method involving intermediate product ciphertext, the intermediate product ciphertext being obtained by encrypting plaintext to be encrypted using an intermediate product public key, the intermediate product public key being constructed based on an intermediate product fault-tolerant learning problem, the method including at least a transformation key generation step; The conversion key generation step is performed by the generator and specifically includes: Obtain a first private key and a second public key, wherein the first public key and the second public key are intermediate product public keys, the first private key is the private key vector required to decrypt the first ciphertext, and the first ciphertext is intermediate product ciphertext, which is obtained by encrypting the plaintext to be encrypted using the first public key; Based on the initial dimension of the intermediate product ciphertext and the dimension of the tensor product of the intermediate product ciphertext, the second public key is arranged to determine the updated key matrix; and the first private key is arranged to determine the original key vector. By combining the updated key matrix and the original key vector, a conversion key from the first private key to the second private key is determined, wherein the second private key is the private key corresponding to the second public key.

2. The method as described in claim 1, wherein, The intermediate product public key includes t groups of public key components. Each group of public key components includes a first public key fragment and a second public key fragment. The first public key fragment is a coefficient vector of a random polynomial. The second public key fragment is determined based on the result of performing an intermediate product operation between the secret polynomial and the random polynomial. The private key vector corresponding to the intermediate product public key is determined by the secret polynomial corresponding to the intermediate product public key. Arrange the second public key based on the initial dimension of the intermediate product ciphertext and the dimension of the tensor product of the intermediate product ciphertext, and determine the update key matrix; And arrange the first private key to determine the original key vector, specifically including: Based on the intermediate product operation required to generate the second public key fragment, determine the convolution matrix corresponding to each first public key fragment of the first public key; Based on the initial dimension of the intermediate product ciphertext and the dimension of the tensor product of the intermediate product ciphertext, an updated key matrix is ​​obtained by arranging each convolution matrix corresponding to the second public key and each second public key fragment; and based on the dimension of the updated key matrix, the first private key is arranged to obtain the original key vector.

3. The method as described in claim 1, wherein, The method also includes a homomorphic multiplication step; The homomorphic multiplication step is performed by the computer and specifically includes: Obtain the first ciphertext and the second ciphertext, wherein the first ciphertext and the second ciphertext correspond to the first public key; Calculate the tensor product of the first ciphertext and the second ciphertext to obtain the initial product ciphertext of the first ciphertext and the second ciphertext; The initial product ciphertext is processed using the transformation key to obtain a third ciphertext. The third ciphertext has the same dimension as the first ciphertext. The third ciphertext is equivalent to encrypting the product of the first plaintext and the second plaintext using the second public key. The first plaintext is the plaintext to be encrypted corresponding to the first ciphertext, and the second plaintext is the plaintext to be encrypted corresponding to the second ciphertext.

4. The method of claim 2, wherein, Let n be the length of the private key vector, and let n be the length to be retained during the intermediate product operation in the process of generating the second public key sharding. ; Based on the intermediate product operations required to generate the second public key shard, the convolution matrix corresponding to each first public key shard of the second public key is determined, specifically including: Determine the convolution matrix corresponding to each first public key fragment of the second public key, wherein the dimension of the convolution matrix is... .

5. The method as described in claim 4, wherein the updated key matrix is ​​obtained by arranging the convolutional matrices corresponding to the second public key and the shards of the second public key, specifically includes: For any convolution matrix, vertically concatenate y repeated convolution matrices to obtain the corresponding extended matrix. For any given second public key fragment, vertically concatenate y repeated fragments of that second public key fragment to obtain the extended vector corresponding to that second public key fragment; where, q is the maximum modulus of the ciphertext; The t extended matrices corresponding to the second public key are vertically concatenated to obtain a concatenated matrix; and the t extended vectors corresponding to the second public key are vertically concatenated according to the concatenation order of the extended matrices to obtain a concatenated vector. The concatenation matrix and the concatenation vector are horizontally concatenated to obtain the updated key matrix, the dimension of which is... .

6. The method of claim 5, wherein, For any intermediate product public key, the private key vector corresponding to the intermediate product public key is obtained by concatenating the target coefficient vector with the unit element, wherein the target coefficient vector is the negative vector of the coefficient vector of the secret polynomial corresponding to the intermediate product public key; Based on the dimensions of the updated key matrix, the first private key is arranged to obtain an initial key vector, specifically including: The private key to be compressed is determined based on the tensor product of the second private key and itself. Determine the product of the private key to be compressed and each expansion exponent, and concatenate the product results to obtain the initial key vector. Each expansion exponent includes numbers from 0 to 2 in base 2. Power; By combining the updated key matrix and the original key vector, the conversion key from the first private key to the second private key is determined, specifically including: The original key vector is added to the target column of the updated key matrix to determine the conversion key from the first private key to the second private key. The position of the target column is determined according to the position of the unit element in the private key vector. The initial product ciphertext is processed using the transformation key to obtain the third ciphertext, specifically including: The initial product ciphertext is processed with a bit width of The bit expansion is performed, and the results of the bit expansion are concatenated to obtain the extended ciphertext; Multiply the extended ciphertext with the transformation key to determine the third ciphertext.

7. The method of claim 2, wherein, The method further includes a key generation step; The key generation step is performed by the generating party and specifically includes: Several security parameters are determined, including the maximum modulus of the ciphertext, noise distribution, and multiplication depth. Based on the multiplication depth, multiple samples are taken in the noise distribution to determine multiple secret polynomials, wherein the secret polynomials are represented in the modulus space indicated by the maximum modulus; Generate the private key vector and the intermediate product public key for each secret polynomial.

8. The method of claim 7, wherein, Let n be the length of the private key vector, and let n be the length to be retained during the intermediate product operation in the process of generating the second public key sharding. The length of the first public key component is ; The method also includes an encryption step; The encryption steps are performed by the encrypting party and specifically include: For any set of public key components of the third public key, a random sample is taken to obtain the length of the corresponding public key component. The mask polynomial; wherein the third public key is the intermediate product public key; The first ciphertext sub-segment is determined by multiplying the mask polynomial with the polynomial corresponding to the first public key segment in the group of public key components; the second ciphertext sub-segment is determined by performing an intermediate product operation of length 1 with the mask polynomial and the polynomial corresponding to the second public key segment in the group of public key components. Add all the first ciphertext sub-fragments together to obtain the first ciphertext fragment; add all the second ciphertext sub-fragments together with the third plaintext to obtain the second ciphertext fragment; use the first ciphertext fragment and the second ciphertext fragment as the third ciphertext obtained by encrypting the third plaintext using the third public key; The method also includes a decryption step; The decryption step is performed by the decryptor and specifically includes: Obtain the fourth ciphertext and determine the private key vector corresponding to the fourth ciphertext as the fourth private key; Calculate the inner product of the fourth ciphertext and the fourth private key to determine the noisy plaintext; The noisy plaintext is moduloed based on the maximum modulus to determine the plaintext result corresponding to the fourth ciphertext.

9. The method of claim 1, wherein, The method further includes a homomorphic addition step; The homomorphic addition step is performed by the computer and specifically includes: Obtain the fifth ciphertext and the sixth ciphertext, wherein the fifth ciphertext and the sixth ciphertext correspond to the fifth public key, and the fifth public key is the intermediate product public key; The fifth ciphertext and the sixth ciphertext are added together to determine the seventh ciphertext. The seventh ciphertext is equivalent to encrypting the sum of the fifth ciphertext and the sixth ciphertext using the fifth public key. The fifth plaintext is the plaintext to be encrypted corresponding to the fifth ciphertext, and the sixth plaintext is the plaintext to be encrypted corresponding to the sixth ciphertext.

10. The method of claim 3 or 9, wherein, The key generation step further includes: Multiple modular chain levels are determined based on the multiplication depth, wherein each modular chain level corresponds to a sub-modulus, and the product of the sub-modulus corresponding to the multiple modular chain levels is equal to the maximum modulus; The method further includes an analog-to-digital conversion step; The analog-to-digital conversion step is performed by the computing party and specifically includes: Determine the current modular chain level of the high-noise ciphertext, wherein the high-noise ciphertext is either the sixth ciphertext or the third ciphertext; The high-noise ciphertext is scaled according to the sub-modulus corresponding to the current modulus chain level to determine the low-noise ciphertext corresponding to the high-noise ciphertext, and the low-noise ciphertext supports the execution of homomorphic multiplication operations.

11. A computing device comprising a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method as claimed in any one of claims 1-10.

Images