A ciphertext transformation method in ciphertext bootstrap, a storage medium and a computing device

Abstract

A ciphertext transformation method in ciphertext bootstrap, a storage medium and a computing device are applied to a CKKS encryption scheme, a target ciphertext is obtained, the target ciphertext is a sparse filling ciphertext; a next homomorphism rotation of the target ciphertext is performed on the effective slot to obtain a first rotation result; the effective slot is a ciphertext slot storing plaintext information; a polynomial shift of different orders is performed on the first rotation result to obtain a shift result; wherein the positions of the effective slots in the shift result do not overlap with each other, the shift results are added to determine an aggregated ciphertext; a first target processing based on rotation accumulation is performed on the aggregated ciphertext to determine the multiplication result of the target ciphertext and a transformation matrix, the transformation matrix is used for coefficient-to-slot transformation or slot-to-coefficient transformation, through an additional packing step for the sparse filling ciphertext, the rotation number in the prior art can be reduced from the order of magnitude to the order of magnitude, and the calculation power consumption and time consumption in the ciphertext bootstrap process are reduced.

Description

Technical Field

[0001] The embodiments in this specification belong to the field of privacy computing, and particularly relate to a ciphertext transformation method, storage medium, and computing device in ciphertext bootstrapping. Background Technology

[0002] Fully Homomorphic Encryption (FHE) is a cryptographic technique that allows arbitrary computations to be performed directly on ciphertext without decryption. In FHE schemes, the Homomorphic Encryption for Arithmetic of Approximate Numbers (CKKS) proposed by Cheon-Kim-Kim-Song sets up plaintext and ciphertext in polynomial form. Each solution of the corresponding root of unity of the plaintext polynomial can be used to store an independent message. Therefore, after encrypting the plaintext polynomial into a ciphertext polynomial, one ciphertext can store multiple plaintext messages (also known as one ciphertext having multiple slots). Performing a homomorphic operation on the ciphertext is equivalent to simultaneously processing multiple plaintext messages. This efficient parallel processing capability also brings broad application prospects to the CKKS scheme in fields such as privacy-preserving machine learning and secure data analysis.

[0003] However, in the CKKS scheme, homomorphic operations on the ciphertext lead to the continuous accumulation of noise in the solution result. If the accumulated noise exceeds a threshold, the ciphertext will fail to be decrypted correctly. Therefore, in the CKKS scheme, after the ciphertext undergoes a series of homomorphic operations, the noise in the calculation result needs to be reset. This noise reset operation is also known as bootstrapping the ciphertext.

[0004] The ciphertext bootstrapping in the CKKS scheme involves a series of complex homomorphic operations; the general process can be found in [reference needed]. Figure 1 The bootstrapping process includes steps such as ModRaise, Coefficients-to-Slots (CtS), EvalMod, and Slots-to-Coefficients (StC). In this process, the CtS and StC steps involve numerous homomorphic linear transformations, which result in significant time and computational costs. Therefore, optimizing the bootstrapping process is crucial for improving the efficiency of the CKKS encryption system.

[0005] Due to the limitations of the ciphertext structure in the CKKS scheme, the direct multiplication operation supported by the CKKS scheme is vector multiplication (multiplying vector A of length n with vector B in digits to obtain vector C of length n). For some computational tasks that require matrix multiplication (such as CtS and StC), the CKKS scheme must be implemented through more complex rotation-accumulation operations.

[0006] In short, the method for multiplying the ciphertext and plaintext matrices can be found in [reference needed]. Figure 2 In the diagram, A is the transformation matrix, B is the ciphertext vector, and the expected result of the matrix multiplication is C.

[0007]

[0008] In expected result C,

[0009]

[0010] It can be observed that the element in the i-th row of the transformation matrix A, after accumulation, is located in the i-th position of the expected result C, and the element in the j-th column of the transformation matrix A must be in the same position as the element in the ciphertext vector B. Multiply. Therefore, the transformation matrix A can be arranged to obtain N vectors. :

[0011]

[0012]

[0013] By referring to the elements of the transformation matrix A, we can see that That is, the main diagonal vector of the transformation matrix A. That is, the (i+1)th diagonal vector of the transformation matrix A, and correspondingly rotating the ciphertext vector B, to obtain N vectors. :

[0014]

[0015]

[0016] Will and After multiplying by each element, the results of each multiplication are added together to obtain the desired result C. Thus, matrix multiplication can be achieved through the operations supported in the encrypted state (vector multiplication and addition of vectors by each element).

[0017] To achieve more efficient matrix multiplication, existing technologies often use the Baby-Step Giant-Step (BSGS) method to optimize the aforementioned rotation-accumulation operation. In short, the BSGS method utilizes the associative law of ciphertext rotation processing to reduce the number of rotation operations performed during matrix multiplication, thereby reducing the overall computational cost.

[0018] This specification proposes a ciphertext transformation scheme in ciphertext bootstrapping, based on the existing BSGS method. Summary of the Invention

[0019] This specification provides an embodiment of a ciphertext transformation method, storage medium, and computing device for ciphertext bootstrapping, including:

[0020] This specification provides a ciphertext transformation method in ciphertext bootstrapping, the method being applied to the CKKS encryption scheme, the method comprising:

[0021] Obtain the target ciphertext, wherein the target ciphertext is sparse-padded ciphertext;

[0022] Perform targeted processing on the target ciphertext for the valid slots. Next homomorphic rotation, to obtain The first rotation result; the effective slot is the ciphertext slot storing plaintext information;

[0023] right Each of the first rotation results is subjected to polynomial shifts of different orders to obtain... Each shift result; wherein, the The positions of the valid slots in each shift result do not overlap.

[0024] The The shift results are added together to determine the aggregated ciphertext;

[0025] Perform a first target processing based on rotation accumulation on the aggregated ciphertext to determine the result of multiplying the target ciphertext with a transformation matrix, wherein the transformation matrix is ​​used for coefficient-to-slot transformation or slot-to-coefficient transformation.

[0026] A second aspect of this specification provides a computer-readable storage medium having a computer program stored thereon that, when executed in a computer, causes the computer to perform the method described in the first aspect.

[0027] A third aspect of this specification provides a computing device including a memory and a processor, wherein the memory stores executable code, and the processor, when executing the executable code, implements the method described in the first aspect.

[0028] The ciphertext transformation scheme in ciphertext bootstrapping provided in this embodiment reduces the number of rotations required in the prior art by adding an extra packing step for sparsely filled ciphertexts. The magnitude was reduced to This reduces the computational and time consumption during the ciphertext bootstrapping process. Attached Figure Description

[0029] To more clearly illustrate the technical solutions of the embodiments in this specification, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0030] Figure 1 This is a schematic diagram of the encrypted bootstrapping process in the CKKS scheme of one embodiment of this specification;

[0031] Figure 2 This is a schematic diagram illustrating the process of multiplying a ciphertext and a plaintext matrix in one embodiment of this specification;

[0032] Figure 3 This is a flowchart illustrating a ciphertext transformation method in a ciphertext bootstrapping embodiment of this specification.

[0033] Figure 4 This is a schematic diagram illustrating the specific execution process of homomorphic rotation in one embodiment of this specification;

[0034] Figure 5 This is one embodiment of the present specification. A schematic diagram of the slot information for the encrypted text before and after processing;

[0035] Figure 6 This is a schematic diagram illustrating the specific execution process of polynomial shifting in one embodiment of this specification;

[0036] Figure 7 This is a schematic diagram of a ciphertext transformation system according to one embodiment of this specification. Detailed Implementation

[0037] To enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this specification, and not all embodiments. Based on the embodiments in this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of this specification.

[0038] As mentioned earlier, in the CKKS scheme, after encrypting a plaintext polynomial into a ciphertext polynomial, a single ciphertext can store multiple plaintext messages, also known as a ciphertext having multiple slots. Performing a homomorphic operation on the ciphertext is equivalent to simultaneously processing multiple plaintext messages. In practical applications, the length of the ciphertext (i.e., the number of slots in the ciphertext) needs to be determined based on preset security requirements and cannot be dynamically adjusted according to the number of plaintext messages to be processed in parallel. Therefore, when facing computational tasks with low parallel processing support (machine learning inference tasks on small images, sorting tasks with a small number of values, etc.), the length of a plaintext vector (composed of plaintext information) may be much smaller than the number of slots in the ciphertext. Consequently, in the ciphertext obtained by encoding the plaintext vector into a plaintext polynomial and then encrypting it, only some slots store plaintext information, while the remaining slots are filled with empty values. This type of ciphertext is called sparse-padded ciphertext.

[0039] Specifically, in the CKKS scheme, the plaintext polynomial is defined on a circular ring of degree N, and the plaintext space corresponding to this circular ring contains... Each slot. Fully filled ciphertext refers to all... Each slot stores the ciphertext of the plaintext information. When the plaintext polynomial corresponding to the sparse-padded ciphertext comes from a polynomial of degree 1... The sub-ring (generally speaking, , In the process of encrypting the plaintext polynomial, the plaintext polynomial is first embedded into a large ring of degree N. After embedding, the polynomial is located at index N. The coefficients of the polynomial carry the valid information of the sub-ring, while the coefficients at other positions are all zero. After encrypting the embedded polynomial, only the slots corresponding to the original sub-ring slots store plaintext information. These ciphertext slots storing plaintext information are the valid slots, and the number of valid slots is equal to the number of slots in the sub-ring. The number of slots is much smaller than that of a fully filled ciphertext. .

[0040] The following is combined Figure 3 This embodiment provides a detailed description of a ciphertext transformation method in ciphertext bootstrapping. For example... Figure 3 As shown, the method includes:

[0041] Step S300: Obtain the target ciphertext, which is a sparse-filled ciphertext.

[0042] First, it's important to note that sparse-filled ciphertexts face unique technical challenges during the bootstrapping process—the modulus boosting step increases the modulus of the ciphertext from a smaller to a larger one to support further homomorphic operations. However, this step introduces an error polynomial into the ciphertext, whose coefficients are distributed across the entire coefficient domain. For sparse-filled ciphertexts, a sub-step is needed to remove noise (introduced by the error polynomial) from each slot. This sub-step incorporates modulus boosting into the noise removal process, retaining only the valid information in the valid slots corresponding to the sub-loops. Therefore, the number of re-convergences of the noise-removed ciphertext is... The sub-ring structure, in addition to storing plaintext information Beyond the available slots All slots are available and can support the ciphertext transformation method in this embodiment.

[0043] This sub-step, which clears errors from each slot, is called SubSum and can be performed between the modulus lifting step and the CtS step. Specifically, the SubSum operation logic utilizes the property of ring homomorphism. Through a series of rotations on the ciphertext, the error polynomials in each rotation result are added together and cancel each other out, while the coefficients of the plaintext information contained in specific positions of the ciphertext are preserved after addition.

[0044] The following describes the specific method for obtaining the target ciphertext in this embodiment, in conjunction with the bootstrapping process.

[0045] Specifically, this embodiment can be applied to the CtS step or the StC step in the CKKS scheme.

[0046] If this embodiment is applied to the CtS step, refer to the following: Figure 1 The bootstrapping process shown includes two sub-steps for obtaining the target ciphertext:

[0047] First sub-step: Obtain the modulo-enhanced ciphertext, which is obtained by modulo-enhancing the ciphertext to be bootstrapping.

[0048] It should be noted that in this embodiment, the ciphertext to be bootstrapping needs to be sparsely padded ciphertext to ensure that there are enough available slots in the target ciphertext after the second processing. However, due to the influence of the error polynomial, the ciphertext structure of the modulus-lifting ciphertext is in the form of non-conforming coefficient padded ciphertext. Therefore, the modulus-lifting ciphertext needs to undergo a second processing.

[0049] The second sub-step involves performing a second processing based on rotation accumulation on the modulus-lifted ciphertext, thereby reducing the number of valid slots in the modulus-lifted ciphertext to obtain the target ciphertext.

[0050] In this embodiment, the second process is the SubSum process. Therefore, the target ciphertext conforms to the structure of sparsely padded ciphertext, supporting the execution of the ciphertext transformation method in this embodiment.

[0051] If this embodiment is applied to the StC step, please refer to the following: Figure 1 The bootstrapping process shown records the object to be bootstrapped as the target ciphertext. Obtaining the target ciphertext includes four sub-steps:

[0052] First sub-step: Obtain the modulo-enhanced ciphertext, which is obtained by modulo-enhancing the ciphertext to be bootstrapping.

[0053] The second sub-step involves performing a second rotation-accumulation-based processing on the modulus-lifted ciphertext to reduce the number of valid slots in the modulus-lifted ciphertext, thereby obtaining a sparse modulus-lifted ciphertext.

[0054] The third sub-step: Perform coefficient-to-slot conversion processing on the sparse modulus-lifted ciphertext to determine the slot representation ciphertext corresponding to the sparse modulus-lifted ciphertext;

[0055] Fourth sub-step: Perform a modulo evaluation on the slot-represented ciphertext to determine the target ciphertext.

[0056] It should be noted that in some implementations, the order of SubSum processing and coefficient-to-slot conversion processing can be interchanged. Therefore, if this embodiment is applied to the StC step, the acquisition of the target ciphertext can also follow these steps:

[0057] First sub-step: Obtain the modulo-enhanced ciphertext, which is obtained by modulo-enhancing the ciphertext to be bootstrapping.

[0058] The second sub-step is to perform CtS processing on the modulus-lifted ciphertext to determine the slot representation ciphertext corresponding to the modulus-lifted ciphertext.

[0059] The third sub-step is to perform a second processing based on rotation accumulation on the slot representation ciphertext, thereby reducing the number of valid slots in the slot representation ciphertext and obtaining the sparse slot representation ciphertext corresponding to the slot representation ciphertext.

[0060] Fourth sub-step: Perform a model evaluation on the sparse slot representation ciphertext to determine the target ciphertext.

[0061] In some implementations, the number of available slots in the target ciphertext is less than the total number of slots in the target ciphertext.

[0062] Generally, SubSum processing can remove noise from all slots of the ciphertext. However, the rotation of the ciphertext in SubSum processing also incurs certain computational and time costs. On the other hand, regarding the ciphertext transformation method in this embodiment (such as...) Figure 3The subsequent steps of the method shown may not require all slots of the ciphertext to be converted into usable slots. Therefore, only partial subsum can be performed on the ciphertext to remove noise from only some slots of the ciphertext, ensuring that the usable slots can meet the needs of subsequent steps.

[0063] The specific implementation method for processing is as follows:

[0064] (9)

[0065] First, the input ciphertext is multiplied by a constant factor. This constant is a parameter related to the target dimension. The multiplicative inverse of the ciphertext at the current modulus can cancel out the multiplication effect produced in subsequent accumulation operations.

[0066]

[0067] (10)

[0068] Then, iterative rotation and accumulation are performed: the number of loops is... times (for example, each iteration can be denoted as 0 to 1). -1), In each iteration, perform a homomorphic rotation on the current ciphertext, and add the rotated ciphertext result to the current ciphertext. The rotation distance is... (in, (This is the dimension of the sub-ring).

[0069] Therefore, after completing After the next iteration, the ring ciphertext can be converted to the ring ciphertext. In the middle, Figure 5 It shows =2, When =1, N=8 A diagram illustrating the slot information before and after ciphertext processing, as shown below. Figure 5 As shown, After processing, in addition to storing plaintext information ( Figure 5 a and b) shown In addition to the slots, extra Clear all slots that do not store plaintext information (e.g., clear the slots that do not store plaintext information). Figure 5 The slots shown are neither filled with letters nor marked with an asterisk (*). (Process the available slots obtained after zeroing).

[0070] Therefore, combined If this embodiment is applied to the CtS step, the acquisition of the target ciphertext can also be based on the following steps:

[0071] First sub-step: Obtain modulo-lifted ciphertext, which is obtained by modulo-lifting the ciphertext to be bootstrapping, and the ciphertext to be bootstrapping is sparse-filled ciphertext.

[0072] The second sub-step involves using the sparse diagonal matrices other than the transformation matrix to perform partial coefficient-to-slot processing on the modulus-lifted ciphertext, thereby determining the intermediate ciphertext corresponding to the modulus-lifted ciphertext.

[0073] Wherein, the transformation matrix is ​​any sparse diagonal matrix corresponding to the discrete Fourier transform matrix, the discrete Fourier transform matrix is ​​the product of multiple sparse diagonal matrices, and the discrete Fourier transform matrix is ​​used to realize the transformation of coefficients to slots.

[0074] The third sub-step involves performing a rotation-accumulation-based third process on the intermediate ciphertext to remove noise from each slot of the intermediate ciphertext, thereby increasing the available slots in the intermediate ciphertext and obtaining the target ciphertext corresponding to the intermediate ciphertext.

[0075] This third process is... deal with. Number of loops to process Less than The number of processing loops k (generally, the target ciphertext and the ciphertext to be bootstrapped have the same length and the same number of slots; the number of valid slots in the target ciphertext is equal to the total number of slots). ).

[0076] After obtaining the target ciphertext, it can be transformed to achieve the corresponding matrix multiplication. Before introducing the specific ciphertext transformation method, the inventive concept of this embodiment will be briefly introduced first.

[0077] Among methods for optimizing matrix multiplication, the Baby-Step Giant-Step (BSGS) approach is a commonly used and efficient method. (Reference) Figure 2 As the corresponding description indicates, in conventional matrix multiplication, the ciphertext vector B needs to be rotated N times (including in-situ rotations, the result of which is the same as the original ciphertext vector B). The results of these N rotations are then multiplied by each diagonal of the transformation matrix A, and finally, the multiplication results are summed. The number of rotation bits in these N rotations is 0, 1, ..., N-1.

[0078] The large-step-small-step method breaks down the number of rotations in each rotation, dividing each rotation into a large-step stage and a small-step stage. Then, for a set of rotations with the same number of rotations in the large-step stage, their small-step rotations are calculated first. The results of these small-step rotations are then used to calculate the product (with the corresponding diagonal), and the multiplication results are summed. Thus, only one large-step rotation is needed on the summed result to complete the rotation accumulation process for a set of rotations. This reduces the number of rotations performed on the ciphertext vector during the overall matrix multiplication process.

[0079] (1)

[0080] (2)

[0081] Among them, the shape is like The formula represents the expression for vectors. right-handed After performing the corresponding key conversion, the expected result C can also be obtained by expanding the above formula (2), where Therefore, by using the large-step, small-step method, the number of rotations of the ciphertext can be reduced to [number missing]. Next (according to formula (1)) Specifically, this includes the processing of the ciphertext vector B. Number of rotations (number of rotations per rotation) Or, it can also be called the step size of each rotation. ), and the result of multiplication Number of rotations (number of rotations per rotation) ).in, The number of steps in the small-step phase can be referred to as the number of steps in the small-step phase. This can be referred to as the number of steps in the big step phase.

[0082] For example, if N=9 (meaning a total of 9 rotations are required), then it can be set = =3, therefore the number of bits in each rotation can be expressed as (j=0, 1, 2; i=0, 1, 2), meaning that each required rotation can be broken down into a combination of small-step rotations of 0-2 steps and large-step rotations of 0-2 steps. Therefore, only 3+3 rotations (including in-situ rotations) are needed to obtain the rotation results that would normally require 9 rotations.

[0083] It should be noted that, typically, in formula (2) That is, the number of bits rotated in each step of the ciphertext is 1. The corresponding transformation matrix is ​​based on Arrangement is then performed. However, when the parameter size of the transformation matrix is ​​large, the transformation matrix can be further divided into... The corresponding number of bits for each rotation of the ciphertext is [number]. .

[0084] In existing technologies, the packing process in the small-step stage utilizes the rotation-accumulation operation in matrix multiplication. The multiplication and accumulation of the ciphertext with the diagonal is performed before the large-step stage. This pre-executed accumulation operation enables the packing of ciphertexts with different rotation degrees, reducing the number of rotations from N to [the order of magnitude of rotation]. .

[0085] Compared to existing technologies, this embodiment utilizes the sparsity of coefficient-filled ciphertext to further reduce the number of rotations to the order of magnitude. .

[0086] Specifically, the target ciphertext contains multiple slots that are not filled with plaintext information. After processing, all slots in the target ciphertext become available slots, and the number of available slots is k times the number of valid slots (if the target ciphertext has undergone...). If processed, the number of available slots is equal to the number of effective slots. The following description uses k times as an example only. It should be understood that each step in this embodiment is relevant to the process... The target ciphertext is also effective. Based on the above features, the inventive concept of this embodiment is to package the micro-step rotation results with different rotation bits into different slots of the same ciphertext. Then, performing one rotation on the packaged ciphertext is equivalent to simultaneously rotating up to k micro-step rotation results. Combining the existing large-step / small-step method, the number of rotation results packaged in a ciphertext is denoted as... The number of rotations in the small step phase is denoted as The number of rotations in the large step phase is denoted as , This allows the number of rotations to be further reduced to the order of magnitude of the number of rotations. Level. Among them, This represents the number of non-zero diagonal lines in the transformation matrix corresponding to the target ciphertext. No greater than N.

[0087] Specifically, this embodiment includes a microstep stage, a small step stage, and a large step stage. The specific implementation methods for the small step stage and the large step stage can refer to the large step-small step method. The microstep stage includes steps S320-S360. After introducing the microstep stage, the ciphertext transformation method in this embodiment can be performed with reference to the following formula:

[0088] (3)

[0089] in, This indicates a homomorphic rotation operation (including key conversion) with an offset of #. This represents a simple homomorphic rotation operation (without key conversion). for inverse transform, The first element of the transformation matrix is... The diagonal line represents the final output, where C is the result of multiplying the target ciphertext with the transformation matrix.

[0090] In formula (3), This illustrates the process of encoding to obtain each plaintext polynomial. As can be seen from the formula, each plaintext polynomial is obtained by the transformation matrix. The plaintext polynomials are obtained by diagonal aggregation encoding. It should be noted that the process of encoding the plaintext polynomials can be performed at any time before the execution of this embodiment, without needing to be synchronized with the ciphertext transformation method in this embodiment.

[0091] The microstepping stage in this embodiment will be described below.

[0092] Step S320: Perform processing on the target ciphertext targeting the valid slots. Next homomorphic rotation, to obtain The first rotation result.

[0093] Once the target ciphertext is determined, it can be processed. The homomorphic rotation in step S320 corresponds to the rotation in formula (3). Part, the number of its homomorphic rotations Limited by the number of available slots in the target. If the number of available slots (including valid slots) in the target is n times the number of valid slots. If the number of rotations is 1.5 times, then a maximum of n homomorphic rotations can be performed in step S320.

[0094] It should be noted that the embodiments referred to in this example are... Homomorphic rotations include in-situ rotations, meaning that the first rotation result corresponding to the in-situ rotation is the same as the target ciphertext.

[0095] The specific execution process of sub-homomorphic rotation is as follows: Figure 4 As shown, a homomorphic rotation operation is performed on the target ciphertext, and each rotation cyclically moves the effective slots of the ciphertext by a different offset. Figure 4 In the diagram, arrows indicate the direction of data transformation, and different grayscale areas represent different segments occupied by the effective slots after shifting. (Complete) After the first homomorphic rotation, we get Each first rotation result is still a sparsely filled ciphertext, where the position of the valid slots remains unchanged compared to the original target ciphertext, but the plaintext information in each valid slot has been replaced.

[0096] Step S340: For Each of the first rotation results is subjected to polynomial shifts of different orders to obtain... One shift result.

[0097] Polynomial shifting is a variable substitution operation performed on a ciphertext polynomial. For a ciphertext polynomial c(X), the order polynomial shift is calculated by: Implementation. The polynomial shift operation alters the distribution of the coefficients of the ciphertext polynomial within the coefficient domain. In the slot domain, the polynomial shift manifests as a rearrangement of the ciphertext slots, moving the valid slots from their original positions to new ones.

[0098] The process of polynomial shifting is as follows Figure 6 As shown, different grayscale areas represent the effective slots in each shift result. Each of the first rotation results is subjected to a polynomial shift of different orders, ensuring that the positions of the valid slots in each ciphertext do not overlap after the shift. Specifically, the shift order h only needs to be a non-multiple of n to guarantee that the valid slots in the shift result do not overlap with the valid slots in the first rotation result.

[0099] It should be noted that the embodiments referred to in this example are... Polynomial shifts include zero-order shifts, meaning that the shift result corresponding to a zero-order shift is the same as the result of the first rotation before the shift.

[0100] Step S360: The... The shift results are added together to determine the aggregated ciphertext.

[0101] Still referencing Figure 6 ,Will The shift results are added together, and these slots are aggregated to form the aggregated ciphertext. The valid slot corresponding to each shift result occupies a different position in the aggregated ciphertext.

[0102] Through the above steps S320-S360, this embodiment achieves the following: The first rotation results are aggregated into an aggregated ciphertext, while ensuring that the valid slots of each first rotation result do not affect each other, which can support subsequent rotation accumulation operations.

[0103] According to formula (3), steps S340-S360 complete the process described in the formula. Partial calculations.

[0104] Step S380: Perform a first target processing based on rotation accumulation on the aggregated ciphertext to determine the result of multiplying the target ciphertext with the transformation matrix, wherein the transformation matrix is ​​used for coefficient-to-slot transformation or slot-to-coefficient transformation.

[0105] The first objective is a homomorphic matrix multiplication operation between the ciphertext and the transformation matrix. The content of the transformation matrix is ​​determined based on the specific application scenario. When the transformation matrix is ​​used for slot-to-coefficient transformation, it is the inverse discrete Fourier transform matrix. When the transformation matrix is ​​used for coefficient-to-slot transformation, it is the discrete Fourier transform matrix. Therefore, after performing the first objective, the multiplication result is the result of either coefficient-to-slot or slot-to-coefficient transformation.

[0106] Treating the aggregated ciphertext as fully filled ciphertext, the specific execution method for the first target processing can be found in the previous introduction to the big-step-small-step method.

[0107] Specifically, in the first target processing, the small step phase is executed first, based on the preset small step packaging quantity. The aggregated ciphertext is processed. The next homomorphic rotation determines the second rotation result corresponding to each homomorphic rotation. The next step is the large-step phase, which packages the data according to the preset large-step quantity. ,use Each plaintext polynomial set is multiplied element-wise with the rotated result set and summed to determine the block multiplication result corresponding to each plaintext polynomial set; the block multiplication results are rotated and accumulated to determine the multiplication result of the target ciphertext and the transformation matrix.

[0108] Each plaintext polynomial set includes A plaintext polynomial, the rotated result set includes The second rotation result, wherein the plaintext polynomial is determined based on the diagonal of the transformation matrix, That is, the number of diagonals in the transformation matrix.

[0109] Specifically, for any set of plaintext polynomials, the process of element-wise multiplication and summation includes: for any plaintext polynomial in the set of plaintext polynomials, determining the target multiplication object corresponding to the plaintext polynomial in the rotated result set according to the positional correspondence of matrix multiplication; multiplying each plaintext polynomial in the set of plaintext polynomials with its respective target multiplication object to determine the single-line multiplication result corresponding to each plaintext polynomial; and adding the single-line multiplication results to determine the block multiplication result corresponding to the set of plaintext polynomials.

[0110] As shown in formula (3), Indicates the results of each second rotation. For each plaintext polynomial corresponding to the second rotation result, This represents the result of multiplying the individual lines. This represents the result of multiplying the individual blocks. As discussed earlier regarding the micro-step stage, in this embodiment, the target ciphertext is... Subhomomorphic rotation was performed on the aggregated ciphertext. Sub-homomorphic rotation was performed on the block multiplication results. Nine homomorphic rotations were performed in total. Subhomomorphic rotation. Combined It can be seen that when In this embodiment, the number of homomorphic rotations is at its minimum. .

[0111] Typically, in the CKKS scheme, the length of the ciphertext can reach [amount missing]. Under the above conditions, the ciphertext conversion required in this embodiment is as follows: Subhomomorphic rotation, much smaller than that in existing technologies. Second-rate.

[0112] like Figure 3 The ciphertext transformation method shown in the ciphertext bootstrapping technique reduces the number of rotations required in the prior art by an additional packing step for sparsely padded ciphertexts. The magnitude was reduced to This reduces the computational and time consumption during the ciphertext bootstrapping process.

[0113] In conjunction with the preceding text, The process is described in the following section: [Details on the process, including execution, are needed for a complete translation.] Figure 3 Before the method shown, the number of non-zero diagonals in the transformation matrix can be used as a reference. Determine the option that minimizes the total number of rotations. If determined from this Less than Therefore, it is not necessary to clear all slots to make them usable; only the slots need to be cleared. The value is set to The method for obtaining the target ciphertext using the third processing described above can then be executed. This further reduces the cost of obtaining the target ciphertext in this embodiment.

[0114] Figure 7 A schematic diagram of a ciphertext transformation system according to an embodiment of this specification is shown. This system is applied to the CKKS encryption scheme and is used to perform transformation operations on sparsely padded ciphertext to complete the coefficient-to-slot or slot-to-coefficient transformation during the bootstrapping process. The system includes:

[0115] The ciphertext acquisition module 700 is used to acquire the target ciphertext, which is a sparsely padded ciphertext.

[0116] The specific functions of the ciphertext acquisition module 700 can be found in the previous section on... Figure 3 The following is a description of step S300.

[0117] The homomorphic rotation module 720 is used to perform rotation on the target ciphertext targeting the valid slots. Next homomorphic rotation, to obtain The first rotation result.

[0118] The specific functions of the homomorphic rotation module 720 can be found in the previous section on... Figure 3 The following is a description of step S320.

[0119] Polynomial shift module 740, used for polynomial shifting module Each of the first rotation results is subjected to polynomial shifts of different orders to obtain ⌈ One shift result.

[0120] The specific functions of the polynomial shift module 740 can be found in the previous text, such as... Figure 3 The following is a description of step S340.

[0121] Aggregation module 760, used to aggregate The shift results are added together to determine the aggregated ciphertext.

[0122] For details on the specific functions of the aggregation module 760, please refer to the previous section on... Figure 3 The following is a description of step S360.

[0123] The target processing module 780 is used to perform a first target processing based on rotation accumulation on the aggregated ciphertext to determine the result of multiplying the target ciphertext with the transformation matrix.

[0124] The specific functions of the target processing module 780 can be found in the previous section on... Figure 3 The following is a description of step S380.

[0125] In the 1990s, improvements to a technology could be clearly distinguished as either hardware improvements (e.g., improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the methodology). However, with technological advancements, many methodological improvements today can be considered direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved methodology into the hardware circuit. Therefore, it cannot be said that a methodological improvement cannot be implemented using hardware physical modules. For example, a Programmable Logic Device (PLD) (such as a Field Programmable Gate Array (FPGA)) is such an integrated circuit whose logic function is determined by the user programming the device. Designers can program and "integrate" a digital system onto a PLD themselves, without needing chip manufacturers to design and manufacture dedicated integrated circuit chips. Furthermore, nowadays, instead of manually manufacturing integrated circuit chips, this programming is mostly implemented using "logic compiler" software. Similar to the software compiler used in program development, the original code before compilation must also be written in a specific programming language, called a Hardware Description Language (HDL). There are many HDLs, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, and RHDL (Ruby Hardware Description Language). Currently, the most commonly used are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also understand that by simply performing some logic programming on the method flow using one of these hardware description languages ​​and programming it into an integrated circuit, the hardware circuit implementing the logical method flow can be easily obtained.

[0126] The controller can be implemented in any suitable manner. For example, it can take the form of a microprocessor or processor and a computer-readable medium storing computer-readable program code (e.g., software or firmware) executable by the (micro)processor, logic gates, switches, application-specific integrated circuits (ASICs), programmable logic controllers, and embedded microcontrollers. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicon Labs C8051F320. A memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also recognize that, in addition to implementing the controller in purely computer-readable program code form, the same functionality can be achieved by logically programming the method steps to make the controller take the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers. Therefore, such a controller can be considered a hardware component, and the means included therein for implementing various functions can also be considered as structures within the hardware component. Alternatively, the means for implementing various functions can be considered as both software modules implementing the method and structures within the hardware component.

[0127] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or physical entities, or by products with certain functions. A typical implementation device is a server system. Of course, this application does not exclude the possibility that, with the future development of computer technology, the computer implementing the functions of the above embodiments can be, for example, a personal computer, a laptop computer, an in-vehicle human-machine interaction device, a cellular phone, a camera phone, a smartphone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or any combination of these devices.

[0128] While one or more embodiments of this specification provide the operational steps of the methods described in the embodiments or flowcharts, more or fewer operational steps may be included based on conventional or non-inventive means. The order of steps listed in the embodiments is merely one possible order of execution among many steps and does not represent the only possible order. In actual device or end product execution, the methods shown in the embodiments or drawings may be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment, or even a distributed data processing environment). The terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, product, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, product, or apparatus. Without further limitations, the presence of other identical or equivalent elements in the process, method, product, or apparatus that includes said elements is not excluded. For example, the use of terms such as "first," "second," etc., is to denote names and does not indicate any particular order.

[0129] For ease of description, the above devices are described in terms of function, divided into various modules. Of course, when implementing one or more of these specifications, the functions of each module can be implemented in one or more software and / or hardware components, or a module that performs the same function can be implemented by a combination of multiple sub-modules or sub-units. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between devices or units, and may be electrical, mechanical, or other forms.

[0130] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0131] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0132] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0133] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0134] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0135] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic disk storage, graphene storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0136] Those skilled in the art will understand that one or more embodiments of this specification can be provided as a method, system, or computer program product. Therefore, one or more embodiments of this specification may take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, one or more embodiments of this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0137] One or more embodiments of this specification can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a particular task or implement a particular abstract data type. One or more embodiments of this specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0138] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, system embodiments are basically similar to method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. In the description of this specification, the terms "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of this specification. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described can be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0139] The above description is merely an embodiment of one or more embodiments of this specification and is not intended to limit the scope of these embodiments. Various modifications and variations can be made to these embodiments by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this specification should be included within the scope of the claims.

Claims

1. A ciphertext transformation method in ciphertext bootstrapping, the method being applied to the CKKS encryption scheme, the method comprising: Obtain the target ciphertext, wherein the target ciphertext is sparse-padded ciphertext; Perform targeted processing on the target ciphertext for the valid slots. Next homomorphic rotation, to obtain The first rotation result; the effective slot is the ciphertext slot storing plaintext information; right Each of the first rotation results is subjected to polynomial shifts of different orders to obtain... Each shift result; wherein, the The positions of the valid slots in each shift result do not overlap. The The shift results are added together to determine the aggregated ciphertext; Perform a first target processing based on rotation accumulation on the aggregated ciphertext to determine the result of multiplying the target ciphertext with a transformation matrix, wherein the transformation matrix is ​​used for coefficient-to-slot transformation or slot-to-coefficient transformation.

2. The method as described in claim 1, wherein, The Homomorphic rotations include in-situ rotations, and polynomial shifts of different orders include zero-order shifts.

3. The method as described in claim 1, wherein, Not greater than n is the number of valid slots in the sparse-filled ciphertext, and N is the number of valid slots in the fully-filled ciphertext with the same length as the sparse-filled ciphertext.

4. The method as described in claim 3, wherein performing a first target processing based on rotation accumulation on the aggregated ciphertext to determine the result of multiplying the target ciphertext with the transformation matrix specifically includes: Based on the preset small-step packaging quantity The aggregated ciphertext is processed. Each homomorphic rotation determines the second rotation result corresponding to each homomorphic rotation. Based on the preset large-step packaging quantity ,use Each plaintext polynomial set is element-wise multiplied and summed with the rotated result set to determine the block multiplication result corresponding to each plaintext polynomial set. Each plaintext polynomial set includes... A plaintext polynomial, the rotated result set includes The second rotation result, wherein the plaintext polynomial is determined based on the diagonal of the transformation matrix, , , Determined based on the number of diagonals in the transformation matrix; The results of multiplying each block are rotated and accumulated to determine the result of multiplying the target ciphertext with the transformation matrix.

5. The method of claim 4, wherein, For any system of plaintext polynomials, the process of element-wise multiplication and summation specifically includes: For any plaintext polynomial in the set of plaintext polynomials, the target multiplication object corresponding to the plaintext polynomial is determined in the rotated result set according to the positional correspondence of matrix multiplication. Multiply each plaintext polynomial in the plaintext polynomial group with its respective target multiplication object to determine the single-line multiplication result corresponding to each plaintext polynomial; Add the results of multiplying each single line together to determine the block multiplication result corresponding to the plaintext polynomial group.

6. The method of claim 4, wherein, Each plaintext polynomial is derived from the transformation matrix. The diagonal lines are obtained by inverse transform encoding corresponding to polynomial shifts of different orders.

7. The method of claim 1, wherein, The transformation matrix is ​​a discrete inverse Fourier transform matrix, which is used to realize the transformation of slot position to coefficient. Obtaining the target ciphertext specifically includes: Obtain modulo-lifted ciphertext, which is obtained by modulo-lifting the ciphertext to be bootstrapping, wherein the ciphertext to be bootstrapping is sparse-filled ciphertext; The modulus-lifted ciphertext is subjected to coefficient-to-slot conversion to determine the slot representation ciphertext corresponding to the modulus-lifted ciphertext; A second processing based on rotation accumulation is performed on the slot representation ciphertext to remove noise in each slot of the slot representation ciphertext, thereby increasing the available slots in the slot representation ciphertext and obtaining the sparse slot representation ciphertext corresponding to the slot representation ciphertext. The sparse slot representation ciphertext is subjected to a modulus evaluation to determine the target ciphertext.

8. The method of claim 1, wherein, The transformation matrix is ​​any sparse diagonal matrix corresponding to the discrete Fourier transform matrix. The discrete Fourier transform matrix is ​​the product of multiple sparse diagonal matrices. The discrete Fourier transform matrix is ​​used to realize the transformation of coefficients to slots. Obtaining the target ciphertext specifically includes: Obtain modulo-lifted ciphertext, which is obtained by modulo-lifting the ciphertext to be bootstrapping, wherein the ciphertext to be bootstrapping is sparse-filled ciphertext; Using the sparse diagonal matrices other than the transformation matrix, partial coefficient-to-slot processing is performed on the modulus-lifted ciphertext to determine the intermediate ciphertext corresponding to the modulus-lifted ciphertext; A third process based on rotation accumulation is performed on the intermediate ciphertext to remove noise in each slot of the intermediate ciphertext, thereby increasing the available slots in the intermediate ciphertext and obtaining the target ciphertext corresponding to the intermediate ciphertext.

9. The method of claim 7 or 8, wherein, The number of available slots in the target ciphertext is less than the total number of slots in the target ciphertext.

10. A computing device comprising a memory and a processor, the memory storing executable code, wherein the processor, when executing the executable code, implements the method as claimed in any one of claims 1-9.

Images