A CKKS ciphertext state nonlinear function calculation method for internet of things physical variable privacy protection processing
By pre-establishing a slot-sub-interval mapping dictionary and shared power chain reuse on the plaintext side, and combining piecewise Taylor approximation, the problem of low nonlinear function computation efficiency of the CKKS homomorphic encryption scheme in the Internet of Things is solved, and efficient computation of multi-slot and multi-sub-interval dense nonlinear functions is realized.
Patent Information
- Application Number
- CN202610924497.9
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2026-06-25
- Publication Date
- 2026-11-03
AI Technical Summary
The existing CKKS homomorphic encryption scheme suffers from low computational efficiency, rapid noise growth, and high computational overhead when performing nonlinear function calculations in the Internet of Things. Especially in SIMD batch processing mode, it requires ciphertext rotation, slot masking, and conditional selection operations, which reduces throughput advantage.
By pre-establishing a dictionary of static mapping relationships between slots and sub-intervals on the plaintext side, and combining piecewise Taylor approximation with the CKKS slot batch processing structure, efficient dense-state nonlinear function calculation for multiple slots and sub-intervals is achieved by using coefficient space rearrangement and shared power chain reuse.
Without decrypting the input ciphertext, parallel nonlinear function ciphertext computation of sampled values of physical variables from multiple sensors was achieved, reducing the complexity of homomorphic computation, improving the batch processing efficiency of CKKS SIMD, and reducing the number of homomorphic multiplications and ciphertext storage overhead.
Smart Images
Figure CN123034963A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the fields of computing and cryptography, specifically to a CKKS encrypted nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things. Background Technology
[0002] With the development of applications such as the Industrial Internet of Things (IIoT), smart manufacturing, energy monitoring, environmental sensing, and equipment health management, a large number of sensor nodes are deployed in target equipment, production sites, or environmental objects to continuously collect physical variable data such as temperature, humidity, pressure, current, voltage, vibration, flow rate, rotational speed, displacement, and gas concentration. This physical variable data typically needs to be uploaded to cloud or edge computing platforms for data normalization, error correction, anomaly detection, risk scoring, equipment condition assessment, or multi-source data fusion.
[0003] In practical applications, IoT physical variable data may reflect device operating status, production process parameters, energy consumption behavior, failure modes, or sensitive user-side information. Directly uploading plaintext data for processing poses risks of data leakage, unauthorized access, and privacy compliance. Therefore, homomorphic encryption technology is used to perform computations on data in encrypted form, enabling cloud or edge computing devices to complete data processing tasks without decrypting the original data.
[0004] The CKKS approximate homomorphic encryption scheme supports encrypted computation of approximate real or complex numbers and features single-instruction, multiple-data parallel batch processing. Through CKKS encoding, multiple physical variable sample values can be packaged into multiple slots of the same ciphertext vector, enabling cloud-based or edge-based homomorphic encryption computing devices to process multiple sensor sample values in parallel within a single ciphertext. Therefore, the CKKS scheme is suitable for batch encrypted computation of IoT physical variable data.
[0005] However, IoT data processing often involves nonlinear functions, such as data normalization functions, sensor error correction functions, anomaly risk scoring functions, device status assessment functions, or nonlinear characteristic transformation functions. The CKKS scheme primarily supports homomorphic addition and multiplication operations; for general nonlinear functions, it is usually necessary to approximate them as polynomials before performing dense-state calculations.
[0006] In existing technologies, a common approach is to approximate nonlinear functions using Taylor polynomials, Chebyshev polynomials, or other polynomial approximation methods. However, a single global polynomial often requires a high order to achieve sufficient approximation accuracy over a large input interval. Higher-order polynomials increase the homomorphic multiplication depth, leading to faster consumption of the modular multiplication chain, increased noise, and reduced computational efficiency. While piecewise polynomial approximation can reduce the approximation order within a single subinterval, it requires determining which interval the ciphertext data belongs to and selecting the polynomial coefficients for the corresponding subinterval in a dense environment. Since ciphertext data cannot be directly compared or branched, traditional piecewise approximation in homomorphic encryption scenarios typically requires dense comparison, homomorphic masking, slot rotation, or polynomial result selection operations. These operations are computationally expensive and cause increased ciphertext noise and rapid consumption of the modular multiplication chain. Especially in CKKS's SIMD batch processing mode, different slots within a ciphertext vector may correspond to different sensor nodes or different physical quantity sampling values. If the required nonlinear approximation interval is different for each slot, conventional solutions often need to use methods such as ciphertext rotation, slot masking, conditional selection, or repeated construction of local power chains to match different slots with different piecewise coefficients. This significantly reduces the throughput advantage of CKKS batch processing. Summary of the Invention
[0007] The purpose of this invention is to provide a CKKS-based method for calculating the encrypted nonlinear function of physical variables in the Internet of Things (IoT) for privacy protection. This method combines piecewise Taylor approximation with the CKKS slot batch processing structure without decrypting the input ciphertext. By rearranging the coefficient space on the plaintext side and reusing the shared power chain on the encrypted side, it achieves efficient calculation of the encrypted nonlinear function of physical variable data in multiple slots and multiple sub-intervals.
[0008] To achieve the above objectives, this invention provides a CKKS dense-state nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things, comprising the following steps:
[0009] S1. Collect raw physical variable data of the target device in real time through IoT sensor node devices to obtain the raw physical variable sampling sequence. ,in, Indicates the first The original sampled values of each sensor;
[0010] S2. The edge acquisition terminal preprocesses the original physical variable sampling sequence to obtain a physical variable sampling sequence with a uniform range or uniform unit. ,in, Indicates the first After the physical variable sampling values of a sensor are preprocessed, the nonlinear function f(x), input interval [a,b], number of segments n, and Taylor expansion order k to be calculated are determined based on the engineering range of the physical variable data, the sensor measurement range, or the business processing threshold. Among them, the nonlinear function f(x) is a data normalization function, sensor error correction function, abnormal risk scoring function, equipment status assessment function, or nonlinear characteristic transformation function for the physical variable data.
[0011] S3. Divide the input interval [a,b] evenly into n sub-intervals and determine the midpoint of each sub-interval. On the plaintext side, based on the static physical range or prior valid attributes of the sensor node devices bound to each concurrent slot, pre-statically allocate the corresponding approximation sub-interval for each slot, generate a globally fixed slot-sub-interval static mapping relationship dictionary, and determine the slot index of each physical variable sample value in the CKKS plaintext slot. The static mapping relationship dictionary is independent of the real-time dynamic sample values of each node.
[0012] S4. The edge acquisition terminal uses CKKS encoding to package multiple physical variable sample values into plaintext slots and generates input ciphertext through CKKS encryption. The input ciphertext is a ciphertext vector containing multiple SIMD encryption slots, with each slot corresponding to a physical variable sample value.
[0013] S5. For each subinterval, take the corresponding midpoint as the expansion point and perform a k-th order Taylor expansion on the nonlinear function f(x) to obtain the local Taylor polynomial of the corresponding subinterval.
[0014] S6. Convert each local Taylor polynomial from the form of local variables to the form of power basis polynomials of global input variable x, and obtain the local coefficients of each subinterval under different powers, where the global input variable x corresponds to the numerical representation of the physical variable sampling value under a uniform range or uniform unit.
[0015] S7. Classify and organize the terms of the same power in multiple power basis polynomials across subintervals to obtain a global piecewise coefficient set composed of the local coefficients of each subinterval.
[0016] S8. On the plaintext side, based on the slot-sub-interval mapping relationship generated in step S3 and the slot index of the input ciphertext, the global segmented coefficient set is spatially rearranged to generate a global plaintext coefficient vector set that is aligned with the slot distribution of the input ciphertext.
[0017] S9. In a homomorphic encrypted computing device at the cloud or edge, a shared power chain is constructed only once based on the input ciphertext. The power ciphertexts of each order of the global input variable x corresponding to the sampled value of the physical variable are generated through CKKS homomorphic ciphertext-ciphertext multiplication and rescaling operations, thus obtaining the shared power chain.
[0018] S10. Perform slot-level point-to-point ciphertext-plaintext multiplication on each power ciphertext in the shared power chain and the global plaintext coefficient vector of the corresponding power, and accumulate the ciphertext addition of the multiplication results corresponding to each power to obtain the output ciphertext. Each slot of the output ciphertext corresponds to the ciphertext result after the physical variable sample value is transformed by the nonlinear function f(x).
[0019] S11. Return the output ciphertext to the client or edge acquisition terminal for decryption.
[0020] In a preferred embodiment, in step S3, the input interval [a,b] is uniformly divided into n sub-intervals with a step size of... for: ;
[0021] No. Segmentation points for: ;
[0022] No. Sub-intervals midpoint for: .
[0023] In a preferred embodiment, in step S5, the midpoint is used as the reference point. Taking the point of expansion as the k-th Taylor expansion of the nonlinear function f(x), we obtain the local Taylor polynomial corresponding to the n-th subinterval:
[0024] ...(1);
[0025] in, Indicates the first The corresponding sub-intervals are the first Taylor coefficients of order 1, satisfying:
[0026] ...(2);
[0027] For the physical variable sampled value that falls within the corresponding static range sub-interval of the device after preprocessing, the corresponding global input variable value is located at the [missing value]. Within each subinterval, and with local variables defined as: ;
[0028] when local variables satisfy:
[0029] ... (3).
[0030] In a preferred embodiment, in step S6, the local Taylor polynomials are transformed from those with respect to local variables. Converting the form of to a power basis polynomial form with respect to the global input variable x includes:
[0031] Using binomial expansion:
[0032] ... (4);
[0033] Substituting formula (4) into formula (1), we can convert it into a power basis polynomial form with respect to the global input variable x:
[0034] ……(5),
[0035] in, For the first The corresponding sub-interval within the first Local coefficients of powers:
[0036] ... (6).
[0037] In a preferred embodiment, step S7 involves classifying and organizing the terms of the same power in multiple power basis polynomials across subintervals to obtain a global piecewise coefficient set composed of the local coefficients of each subinterval. This includes: classifying the power basis polynomials corresponding to each subinterval according to their powers. The data is categorized and organized to form a system based on local coefficients. The global piecewise coefficient set constituted:
[0038] ……(7),
[0039] For each power Collect the local coefficients corresponding to n sub-intervals to form the nth... Power-order subinterval coefficient sequence:
[0040] ... (8);
[0041] The coefficient sequence across sub-intervals is used for subsequent spatial rearrangement on the plaintext side based on the CKKS ciphertext slot distribution.
[0042] In a preferred embodiment, in step S8, on the plaintext side, based on the slot-sub-interval static mapping relationship dictionary generated in step S3 and the slot index of the input ciphertext, the global segmented coefficient set is spatially rearranged to generate a global plaintext coefficient vector set that is aligned with the slot distribution of the input ciphertext. This includes: obtaining the polynomial ring dimension under the current cryptographic parameter configuration. Determine the maximum number of valid plaintext slots for a single CKKS ciphertext vector. For a batch of input ciphertext, based on the slot index of each physical variable sample value determined before encryption in step S3 in the CKKS plaintext slot, and the slot-sub-interval static mapping relationship dictionary, determine the segmented sub-interval corresponding to each valid slot; for each power after local Taylor polynomial transformation The plaintext side initializes a string of length 1. Global plaintext coefficient vector This makes each global plaintext coefficient vector This corresponds to a power term of the global input variable x.
[0043] Among them, the slot-sub-interval static mapping relationship dictionary is pre-established by the offline configuration parameter or confidence coefficient generation module, independent of the real-time dynamic sampling values of the sensor node device. Spatial rearrangement does not include the operation of performing encrypted state comparison, encrypted state condition judgment or homomorphic mask filtering on the input ciphertext in the cloud or edge homomorphic encryption computing device.
[0044] In a preferred embodiment, step S8 further includes: processing the global plaintext coefficient vector. During the filling process, the slot indices of the CKKS ciphertext vector are traversed. ,in And determine the first slot-sub-interval static mapping relationship dictionary generated in step S3. The segmented sub-intervals corresponding to the slot, if the static mapping dictionary indicates the first... The nth slot corresponds to the nth sub-interval, then the nth slot will be... The corresponding sub-intervals are the first Power Local Coefficients Fill in the global plaintext coefficient vector The The position; if the first position If slot number 1 is an empty slot, then slot number 2 is an empty slot. Each position is filled with a constant 0, thus generating the plaintext side in one go. A global plaintext coefficient vector aligned with the input ciphertext slot space is generated, and the global plaintext coefficient vector is... Encode the CKKS plaintext object according to the scaling factor and modulus chain hierarchy that match the corresponding power-law ciphertext. .
[0045] In a preferred embodiment, in step S9, the shared power chain is represented as:
[0046] ... (9).
[0047] Among them, input ciphertext As a first-order power cipher In the dense domain, higher-order power ciphertexts are generated sequentially through homomorphic ciphertext-ciphertext multiplication and rescaling operations in an iterative cascading manner, or higher-order power ciphertexts are generated by combining lower-order power ciphertexts in a binary tree exponentiation manner. The shared power chain is constructed only once and is used by all segment intervals. Furthermore, the power ciphertexts of each order in the shared power chain maintain the same slot arrangement relationship as the input ciphertext.
[0048] In a preferred embodiment, the first in the shared power chain ciphertext object The first generated in step S8 Plaintext object corresponding to the power-order global plaintext coefficient vector They correspond to each other in the power order dimension for any valid slot index. If the slot-sub-interval static mapping relationship dictionary generated in step S3 indicates that the first The slot corresponds to the first The global plaintext coefficient vector is then calculated from the given sub-intervals. The The location stores the first The corresponding sub-intervals are the first Power Local Coefficients And the first ciphertext object The Each slot carries the sampled values of physical variables in that slot. The secret state data corresponding to the power of 1 makes the CKKS plaintext object With the ciphertext object Maintain the positional correspondence along the slot index dimension.
[0049] In a preferred embodiment, in step S10, each power-order ciphertext in the shared power-order chain is multiplied by the corresponding global plaintext coefficient vector at the slot level using point-to-point ciphertext-plaintext multiplication, and the multiplication results corresponding to each power-order are accumulated using ciphertext addition to obtain the output ciphertext, including:
[0050] For each power Step S9 will generate the first ciphertext object The first one generated in step S8 and encoded by CKKS Power CKKS plaintext object Perform slot-level point-to-point ciphertext-plaintext multiplication CPMult to obtain the first... The ciphertext multiplication results corresponding to each power are then aligned by scaling factor and modular chain hierarchy. Ciphertext addition is then performed on the ciphertext multiplication results corresponding to each power, and the global plaintext coefficient vector corresponding to the 0th power is then calculated. Plaintext object obtained by CKKS encoding By adding the plaintext to the ciphertext, we obtain the output ciphertext:
[0051] ... (10);
[0052] Among them, output ciphertext Each effective slot corresponds to a physical variable sample value and is the dense state result after piecewise Taylor approximation transformation by the nonlinear function f(x).
[0053] Compared with the prior art, the beneficial effects of the present invention are:
[0054] 1. This invention combines the nonlinear function calculation of IoT physical variable data with the CKKS homomorphic encryption batch processing structure, enabling cloud or edge homomorphic encryption computing devices to perform parallel nonlinear function encrypted calculations on the sampled values of multiple sensor physical variables without decrypting the input ciphertext.
[0055] 2. On the plaintext side, this invention pre-establishes a dictionary of static mapping relationships between slots and sub-intervals based on the static physical range or prior valid attributes of sensor node devices, and uses this dictionary to spatially rearrange the piecewise Taylor local coefficients. This mapping relationship is independent of real-time dynamic sampling values, and does not require performing dense-state comparisons or conditional branches on the input ciphertext on the dense-state side, thus reducing the computational complexity of homomorphic computation.
[0056] 3. This invention employs a spatial alignment strategy of "no rotation of ciphertext data, plaintext coefficients finding ciphertext data," organizing the local coefficients corresponding to each power into a global plaintext coefficient vector consistent with the input ciphertext slot arrangement. Therefore, when performing ciphertext-plaintext multiplication on the encrypted side, each slot can automatically obtain the Taylor coefficients of its corresponding sub-interval, avoiding cross-slot ciphertext rotation and homomorphic mask filtering operations. Furthermore, this invention improves the efficiency of CKKS SIMD batch processing by performing slot-level point-to-point ciphertext-plaintext multiplication on each power of ciphertext and its corresponding CKKS plaintext object, and then accumulating the multiplication results using ciphertext addition. This achieves unified homomorphic arithmetic circuit evaluation of physical variable data across multiple slots and sub-intervals.
[0057] 4. In this invention, a shared exponential chain is constructed only once on the encrypted side based on the input ciphertext, and this shared exponential chain is used by all segment sub-intervals for common access. This avoids constructing exponential ciphertexts separately for different sub-intervals or repeatedly generating local exponential chains, thereby reducing the number of homomorphic multiplications and ciphertext storage overhead. Attached Figure Description
[0058] Figure 1 This is a schematic diagram of the overall process of the method of the present invention. Detailed Implementation
[0059] The technical solutions in the embodiments of the present invention will be clearly and completely described below. All other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of the present invention.
[0060] Example 1:
[0061] Traditional piecewise Taylor methods typically construct and compute polynomials independently for each segment, then sum the results of all segments. However, dense-state implementations of traditional piecewise Taylor methods often require constructing and computeing polynomials separately within each segment. The high-order power chain causes ciphertext × ciphertext multiplication and rescaling operations to be repeatedly executed on different segments. At the same time, since each segment generates a corresponding set of high-noise intermediate ciphertext results, the upper bound of noise will increase approximately linearly with the number of segments when accumulating across segments. This significantly accelerates the overall noise accumulation speed and reaches the noise threshold earlier under the same security parameters and modulus chain configuration, thus triggering bootstrapping operations more frequently.
[0062] like Figure 1 As shown, the CKKS encrypted nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things (IoT) of the present invention is applied to a data processing system including IoT sensor nodes, edge acquisition terminals, and homomorphic encrypted computing devices in the cloud or at the edge. It is used to perform encrypted nonlinear function transformation on the physical variable data collected by the IoT sensors without decrypting the original physical variable data. The method includes the following steps:
[0063] Step S1: Collect raw physical variable data of the target device in real time through IoT sensor node devices to obtain raw physical variable sampling sequences. ,in, No. The original sampled values from each sensor. The physical variable data includes at least one of temperature, humidity, pressure, current, voltage, vibration, flow rate, rotational speed, displacement, and gas concentration.
[0064] Step S2: The edge acquisition terminal preprocesses the original physical variable sampling sequence to obtain a physical variable sampling sequence with a uniform range or uniform unit. ,in, Indicates the first For each sensor, after preprocessing the sampled physical variables, the nonlinear function f(x), input interval [a, b], number of segments n, and Taylor expansion order k are determined based on the engineering range of the physical variable data, the sensor measurement range, or the business processing threshold. The nonlinear function f(x) can vary depending on the application scenario. For example, in sensor error correction, f(x) can be a correction function obtained by fitting a calibration curve; in anomaly risk scoring, f(x) can be a nonlinear scoring function that maps physical variable values to risk scores; in equipment condition assessment, f(x) can be a condition assessment function reflecting the health status of the equipment; and in data normalization, f(x) can be a nonlinear normalization function that maps physical variable values to a standard interval.
[0065] Step S3: Divide the input interval [a, b] evenly into n subintervals and determine the midpoint of each subinterval. Divide the input interval [a, b] evenly into n subintervals, with a step size of... for: ;
[0066] No. Segmentation points for: ;
[0067] No. Sub-intervals midpoint for: .
[0068] On the plaintext side, based on the static physical range or prior valid attributes of the sensor node devices bound to each concurrent slot, a corresponding approximation sub-interval is pre-statically assigned to each slot, generating a globally fixed slot-sub-interval static mapping relationship dictionary, and determining the slot index of each physical variable sample value in the CKKS plaintext slot. The static mapping relationship dictionary is independent of the real-time dynamic sample values of each node, therefore, it does not require the cloud or edge homomorphic encryption computing device to determine which sub-interval a real-time sample value belongs to from the ciphertext. Among them, multiple physical variable sample values packaged in the same input ciphertext are physical variable data of the same type, or physical variable data that, after preprocessing, apply the same nonlinear function f(x), the same input interval [a,b], the same number of segments n, and the same Taylor expansion order k.
[0069] Step S4: The edge acquisition terminal uses CKKS encoding to package multiple physical variable sample values into plaintext slots, and generates input ciphertext through CKKS encryption. The input ciphertext is a ciphertext vector containing multiple SIMD encryption slots, with each slot corresponding to a physical variable sample value. When the length L of the physical variable sampling sequence is greater than the maximum total number of valid plaintext slots for a single CKKS ciphertext vector, the physical variable sampling sequence is divided into multiple batches, and corresponding input ciphertexts are generated for each batch. When there are empty slots in the last batch, the empty slots are filled with a constant 0.
[0070] Step S5: For each sub-interval, take the midpoint... Taking the point of expansion as the k-th Taylor expansion of the nonlinear function f(x), we obtain the k-th Taylor expansion. The local Taylor polynomials corresponding to each subinterval:
[0071] ...(1);
[0072] in, Indicates the first The corresponding sub-intervals are the first Taylor coefficients of order 1, satisfying:
[0073] ...(2);
[0074] For the physical variable sampled value that falls within the corresponding static range sub-interval of the device after preprocessing, the corresponding global input variable value is located at the [missing value]. Within each subinterval, and with local variables defined as: ;
[0075] when local variables satisfy:
[0076] ... (3).
[0077] For falling into the first Physical variable sample values of each sub-interval, local variables The absolute value of the polynomial does not exceed half a piecewise step size, thus achieving good local approximation results at a relatively low Taylor order. Compared to using a single high-order polynomial across the entire input interval, this embodiment can reduce the polynomial order and the depth of homomorphic multiplication.
[0078] Step S6: Convert the local Taylor polynomials from their form with respect to local variables into their power basis polynomial form with respect to the global input variable x, obtaining the local coefficients of each subinterval at different powers. Here, the global input variable x corresponds to the numerical representation of the sampled physical variable within a uniform range or unit. Specifically, this includes:
[0079] Using binomial expansion:
[0080] ... (4);
[0081] Substituting formula (4) into formula (1), we can convert it into a power basis polynomial form with respect to the global input variable x:
[0082] ……(5),
[0083] in, For the first The corresponding sub-interval within the first Local coefficients of powers:
[0084] ... (6).
[0085] Step S7: Classify and organize the terms of the same power in multiple power basis polynomials across subintervals to obtain a global piecewise coefficient set composed of the local coefficients of each subinterval. Specifically, this includes: classifying the power basis polynomials corresponding to each subinterval according to their powers. The data is categorized and organized to form a system based on local coefficients. The global piecewise coefficient set constituted:
[0086] ……(7),
[0087] For each power Collect the local coefficients corresponding to n sub-intervals to form the nth... Power-order subinterval coefficient sequence:
[0088] ... (8);
[0089] The coefficient sequence across sub-intervals is used for subsequent spatial rearrangement on the plaintext side based on the CKKS ciphertext slot distribution.
[0090] Step S8: On the plaintext side, based on the slot-sub-interval static mapping relationship dictionary generated in step S3 and the slot index of the input ciphertext, spatially rearrange the global segmented coefficient set to generate a global plaintext coefficient vector set that is aligned with the slot distribution of the input ciphertext. This includes: obtaining the polynomial ring dimension under the current cryptographic parameter configuration. Determine the maximum number of valid plaintext slots for a single CKKS ciphertext vector. For a batch of input ciphertext, based on the slot index of each physical variable sample value determined before encryption in step S3 in the CKKS plaintext slot, and the slot-sub-interval static mapping relationship dictionary, determine the segmented sub-interval corresponding to each valid slot; for each power after local Taylor polynomial transformation The plaintext side initializes a string of length 1. Global plaintext coefficient vector This makes each global plaintext coefficient vector This corresponds to a power term of the global input variable x. The slot-sub-interval static mapping dictionary is pre-established by the offline configuration parameters or the confidence coefficient generation module, independent of the real-time dynamic sampling values of the sensor node devices. Spatial rearrangement is not included in the cloud or edge homomorphic encryption computing devices performing encrypted state comparison, encrypted state condition judgment, or homomorphic mask filtering operations on the input ciphertext.
[0091] Step S8 also includes: processing the global plaintext coefficient vector During the filling process, the slot indices of the CKKS ciphertext vector are traversed. ,in And determine the first slot-sub-interval static mapping relationship dictionary generated in step S3. The segmented sub-intervals corresponding to the slot, if the static mapping dictionary indicates the first... The slot corresponds to the first The number of sub-intervals will then be the first... The corresponding sub-intervals are the first Power Local Coefficients Fill in the global plaintext coefficient vector The The position; if the first position If slot number 1 is an empty slot, then slot number 2 is an empty slot. Each position is filled with a constant 0, thus generating the plaintext side in one go. A global plaintext coefficient vector aligned with the input ciphertext slot space is generated, and the global plaintext coefficient vector is... Encode the CKKS plaintext object according to the scaling factor and modulus chain hierarchy that match the corresponding power-law ciphertext. .
[0092] therefore, The slot layout is strictly consistent with the slot layout of the input ciphertext. That is, for any slot... , The The element is the first element required for this slot. Power-order piecewise Taylor coefficients. This approach shifts the piecewise selection logic from the encrypted side to the coefficient organization stage on the plaintext side, achieving a computational strategy of "ciphertext data not moving, plaintext coefficients actively aligning with ciphertext slots".
[0093] Then the global plaintext coefficient vector Pr Encodes a CKKS plaintext object according to the scaling factor and modulus chain hierarchy that match the corresponding power ciphertext, so that ciphertext-plaintext multiplication can be performed on the encrypted side with the corresponding power ciphertext.
[0094] Step S9: In the homomorphic encryption computing device at the cloud or edge, a shared power chain is constructed only once based on the input ciphertext. This is achieved by generating the power ciphertexts of the global input variable x corresponding to the sampled values of the physical variables through CKKS homomorphic ciphertext-ciphertext multiplication and rescaling operations, thus obtaining the shared power chain.
[0095] The shared power chain is represented as:
[0096] ... (9);
[0097] Among them, input ciphertext As a first-order power cipher In the dense domain, higher-order power ciphertexts are generated sequentially through homomorphic ciphertext-ciphertext multiplication and rescaling operations in an iterative cascading manner, or higher-order power ciphertexts are generated by combining lower-order power ciphertexts in a binary tree exponentiation manner. The shared power chain is constructed only once and is used by all segment intervals. Furthermore, the power ciphertexts of each order in the shared power chain maintain the same slot arrangement relationship as the input ciphertext.
[0098] The first in a shared power chain ciphertext object The first generated in step S8 Plaintext object corresponding to the power-order global plaintext coefficient vector They correspond to each other in the power order dimension for any valid slot index. If the slot-sub-interval static mapping relationship dictionary generated in step S3 indicates that the first The slot corresponds to the first The global plaintext coefficient vector is then calculated from the given sub-intervals. The The location stores the first The corresponding sub-intervals are the first Power Local Coefficients And the first ciphertext object The Each slot carries the sampled values of physical variables in that slot. The secret state data corresponding to the power of 1 makes the CKKS plaintext object With the ciphertext object Maintain the positional correspondence along the slot index dimension.
[0099] Step S10: Perform slot-level point-to-point ciphertext-plaintext multiplication on each power-order ciphertext in the shared power-order chain and the corresponding global plaintext coefficient vector, and accumulate the multiplication results corresponding to each power-order by ciphertext addition to obtain the output ciphertext. Each slot of the output ciphertext corresponds to the encrypted state result of a physical variable sample value transformed by the nonlinear function f(x). Specifically, this includes:
[0100] For each power Step S9 generates the r-th order ciphertext object. The first one generated in step S8 and encoded by CKKS Power CKKS plaintext object Perform slot-level point-to-point ciphertext-plaintext multiplication CPMult to obtain the first... The ciphertext multiplication result corresponding to the exponentiation.
[0101] After aligning the ciphertext multiplication results for each power by scaling factor and module chain hierarchy, ciphertext addition is performed, and the global plaintext coefficient vector corresponding to the 0th power is then added. Plaintext object obtained by CKKS encoding By adding the plaintext to the ciphertext, we obtain the output ciphertext:
[0102] ... (10);
[0103] Among them, output ciphertext Each effective slot corresponds to a physical variable sample value and is the dense state result after piecewise Taylor approximation transformation by the nonlinear function f(x).
[0104] Throughout the entire computation process, the cloud or edge homomorphic encryption computing device does not need to perform ciphertext comparison on the input ciphertext, construct interval masks, perform rotation alignment on the ciphertext slots, or repeatedly construct local power chains for different segmented sub-intervals.
[0105] Step S11: Return the output ciphertext to the client or edge acquisition terminal for decryption. Specifically: After completing the encrypted nonlinear function calculation, the cloud or edge homomorphic encryption computing device returns the output ciphertext to the client or edge acquisition terminal. The client or edge acquisition terminal uses the corresponding private key to decrypt the ciphertext, obtaining the approximate result of the sampled values of each physical variable after nonlinear function transformation.
[0106] Example 2:
[0107] In this embodiment, taking industrial motor temperature monitoring as an example, multiple temperature sensor nodes collect the temperatures of the motor windings, bearings, and housing in real time to obtain the original temperature sampling sequence. The edge acquisition terminal unifies the units and normalizes the range of the sampled values to obtain a temperature sampling sequence within a unified input range.
[0108] Let f(x) be the nonlinear function to be calculated, which is a temperature anomaly risk scoring function used to map temperature values to equipment anomaly risk scores. This function is divided into n sub-intervals within the input interval [a, b], and a k-th order Taylor expansion is performed at the midpoint of each sub-interval.
[0109] Since different temperature sensor nodes are attached to different parts of the motor, their long-term effective temperature ranges vary significantly. Therefore, based on the static physical range of each sensor node, its corresponding slot can be pre-assigned to different approximation sub-ranges. For example, the winding temperature sensor corresponds to the higher temperature sub-range, and the housing temperature sensor corresponds to the medium and low temperature sub-range.
[0110] The edge acquisition terminal generates a global plaintext coefficient vector based on the static mapping relationship and packages and encrypts the temperature sampling value CKKS into input ciphertext. The cloud-based homomorphic encryption computing device constructs a shared power chain based on the input ciphertext and performs ciphertext-plaintext multiplication and accumulation with the CKKS plaintext objects corresponding to each power to obtain the encrypted risk score result.
[0111] Since the entire risk scoring calculation process does not require decrypting temperature sampling values, nor does it require cloud-based judgment of closed-state intervals or slot rotation, it can improve the efficiency of closed-state risk scoring calculation while protecting the privacy of equipment operation data.
[0112] The above embodiments use IoT physical variable data as an example for illustration, but the present invention is not limited thereto. This invention is applicable to any data that has continuous numerical characteristics, can be collected by sensor nodes, edge acquisition terminals, or data acquisition devices, and requires nonlinear function transformation in a dense state.
[0113] The nonlinear function f(x) can be any function with the required order derivative in the input interval [a,b], or it can be a nonlinear function fitted by an empirical model, calibration model, equipment state model or machine learning model.
[0114] The slot-sub-interval static mapping dictionary can be pre-configured based on equipment type, sensor installation location, long-term operating range, engineering experience thresholds, offline statistical distribution, or business rules. This static mapping dictionary can also be updated periodically, but each update can be completed before encryption or in a trusted environment, without requiring encrypted comparison of the input ciphertext during homomorphic computation.
[0115] The CKKS cryptographic parameters in this invention include polynomial ring dimension, modular chain, scaling factor, and relinearization key, which can be configured according to the target security level, computational precision, number of segments, Taylor order, and application scenario. This invention is not limited to a specific CKKS library or implementation platform.
[0116] Example 3:
[0117] This embodiment also provides a CKKS encrypted nonlinear function calculation system for privacy protection processing of physical variables in the Internet of Things (IoT). The system includes IoT sensor node devices, edge acquisition terminals, and homomorphic encrypted computing devices in the cloud or at the edge. The IoT sensor node devices are used to collect raw physical variable data of target devices. Target devices can be industrial motors, pumps, compressors, transformers, energy storage devices, production line equipment, environmental monitoring equipment, or other physical objects requiring status monitoring. Raw physical variable data can include temperature, humidity, pressure, current, voltage, vibration, flow rate, rotational speed, displacement, gas concentration, etc.
[0118] The edge acquisition terminal is used to receive raw physical variable sampling sequences uploaded by IoT sensor node devices, and to preprocess, plan slots, encode, and encrypt them using CKKS. The edge acquisition terminal can also establish a slot-sub-interval static mapping relationship dictionary based on the static physical range or prior valid attributes of the sensor node devices.
[0119] Homomorphic cryptographic computing devices in the cloud or at the edge are used to receive input ciphertext and encoded CKKS plaintext objects, construct a shared power chain and perform cryptomorphic nonlinear function calculations without decrypting the input ciphertext to obtain the output ciphertext.
[0120] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.
Claims
1. A CKKS dense-state nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things, characterized in that: Includes the following steps: S1. Collect raw physical variable data of the target device in real time through IoT sensor node devices to obtain the raw physical variable sampling sequence. ,in, Indicates the first The original sampled values of each sensor; S2. The edge acquisition terminal preprocesses the original physical variable sampling sequence to obtain a physical variable sampling sequence with a uniform range or uniform unit. ,in, Indicates the first After preprocessing the physical variable sampling values of a sensor, based on the engineering range of the physical variable data, the sensor measurement range, or the business processing threshold, the nonlinear function f(x), the input interval [a,b], the number of segments n, and the Taylor expansion order k to be calculated are determined. The nonlinear function f(x) is a data normalization function, sensor error correction function, anomaly risk scoring function, equipment status assessment function, or nonlinear characteristic transformation function for the physical variable data. S3. Divide the input interval [a,b] evenly into n sub-intervals and determine the midpoint of each sub-interval. On the plaintext side, based on the static physical range or prior valid attributes of the sensor node devices bound to each concurrent slot, pre-statically allocate a corresponding approximation sub-interval for each slot, generate a globally fixed slot-sub-interval static mapping relationship dictionary, and determine the slot index of each physical variable sampling value in the CKKS plaintext slot. The static mapping relationship dictionary is independent of the real-time dynamic sampling values of each node. S4. The edge acquisition terminal uses CKKS encoding to package multiple physical variable sample values into plaintext slots and generates input ciphertext through CKKS encryption. The input ciphertext is a ciphertext vector containing multiple SIMD encryption slots, with each slot corresponding to a physical variable sample value. S5. For each subinterval, take the corresponding midpoint as the expansion point and perform a k-th order Taylor expansion on the nonlinear function f(x) to obtain the local Taylor polynomial of the corresponding subinterval. S6. Convert each local Taylor polynomial from the form of local variables to the form of power basis polynomials of global input variable x, and obtain the local coefficients of each subinterval under different powers, wherein the global input variable x corresponds to the numerical representation of the sampled value of the physical variable under a uniform range or uniform unit. S7. Classify and organize the terms of the same power in the multiple power basis polynomials across subintervals to obtain a global piecewise coefficient set composed of the local coefficients of each subinterval. S8. On the plaintext side, based on the slot-sub-interval mapping relationship generated in step S3 and the slot index of the input ciphertext, the global segmented coefficient set is spatially rearranged to generate a global plaintext coefficient vector set that is aligned with the slot distribution of the input ciphertext. S9. In the homomorphic encryption computing device at the cloud or edge, a shared power chain is constructed only once based on the input ciphertext. The power ciphertexts of each order of the global input variable x corresponding to the sampled value of the physical variable are generated by CKKS homomorphic ciphertext-ciphertext multiplication and rescaling operation to obtain the shared power chain. S10. Perform slot-level point-to-point ciphertext-plaintext multiplication on each power ciphertext in the shared power chain and the global plaintext coefficient vector of the corresponding power, and accumulate the ciphertext addition of the multiplication results corresponding to each power to obtain the output ciphertext. Each slot of the output ciphertext corresponds to the ciphertext result after the physical variable sample value is transformed by the nonlinear function f(x). S11. Return the output ciphertext to the client or edge acquisition terminal for decryption.
2. The CKKS dense-state nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things according to claim 1, characterized in that: In step S3, the input interval [a, b] is uniformly divided into n sub-intervals, with a step size of... for: ; No. Segmentation points for: ; No. Sub-intervals midpoint for: .
3. The CKKS dense-state nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things according to claim 1, characterized in that: In step S5, the midpoint Taking the point of expansion as the k-th Taylor expansion of the nonlinear function f(x), we obtain the k-th Taylor expansion. The local Taylor polynomials corresponding to each subinterval: ……（1）； in, Indicates the first The j-th order Taylor coefficients corresponding to each subinterval satisfy: ……（2）； For the physical variable sampled value that falls within the corresponding static range sub-interval of the device after preprocessing, the corresponding global input variable value is located in the first... Within each subinterval, and with local variables defined as: ; when At that time, the local variable y satisfies: ……（3）。 4. The CKKS dense-state nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things according to claim 3, characterized in that: In step S6, the local Taylor polynomials are transformed from those with respect to local variables. Converting the form of to a power basis polynomial form with respect to the global input variable x includes: Using binomial expansion: ……（4）； Substituting formula (4) into formula (1), we can convert it into a power basis polynomial form with respect to the global input variable x: ……（5）， in, For the first The corresponding sub-interval within the first Local coefficients of powers: ……（6）。 5. The CKKS dense-state nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things according to claim 4, characterized in that: In step S7, the terms of the same power in the multiple power basis polynomials are classified and organized across sub-intervals to obtain a global piecewise coefficient set composed of the local coefficients of each sub-interval. This includes: classifying the power basis polynomials corresponding to each sub-interval according to their powers. The data is categorized and organized to form a system based on local coefficients. The global piecewise coefficient set constituted: ……（7）， For each power Collect the local coefficients corresponding to n sub-intervals to form the nth... Power-order subinterval coefficient sequence: ……（8）； The cross-interval coefficient sequence is used for subsequent spatial rearrangement on the plaintext side based on the CKKS ciphertext slot distribution.
6. The CKKS dense-state nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things according to claim 5, characterized in that: In step S8, on the plaintext side, based on the slot-sub-interval static mapping relationship dictionary generated in step S3 and the slot index of the input ciphertext, the global segmented coefficient set is spatially rearranged to generate a global plaintext coefficient vector set that is aligned with the slot distribution of the input ciphertext. This includes: obtaining the polynomial ring dimension under the current cryptographic parameter configuration. Determine the maximum number of valid plaintext slots for a single CKKS ciphertext vector. For a batch of input ciphertext, based on the slot index of each physical variable sample value determined before encryption in step S3 in the CKKS plaintext slot, and the slot-sub-interval static mapping relationship dictionary, determine the segmented sub-interval corresponding to each valid slot; for each power after local Taylor polynomial transformation The plaintext side initializes a string of length. Global plaintext coefficient vector This makes each global plaintext coefficient vector This corresponds to a power term of the global input variable x. The slot-sub-interval static mapping relationship dictionary is pre-established by an offline configuration parameter or credibility coefficient generation module, independent of the real-time dynamic sampling values of the sensor node device. The spatial rearrangement does not include performing encrypted state comparison, encrypted state condition judgment or homomorphic mask filtering operations on the input ciphertext in the cloud or edge homomorphic encryption computing device.
7. The CKKS dense-state nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things according to claim 6, characterized in that: Step S8 further includes: processing the global plaintext coefficient vector During the filling process, the slot indices of the CKKS ciphertext vector are traversed. ,in And determine the first slot-sub-interval static mapping relationship dictionary generated in step S3. The segmented sub-intervals corresponding to the slot, if the static mapping dictionary indicates the first... The slot corresponds to the first The number of sub-intervals will then be the first... The corresponding sub-intervals are the first Power Local Coefficients Fill in the global plaintext coefficient vector The The position; if the first position If the first slot is an empty slot, then in the... Each position is filled with a constant 0, thus generating the plaintext side in one go. A global plaintext coefficient vector aligned with the input ciphertext slot space, and the global plaintext coefficient vector... Encode the CKKS plaintext object according to the scaling factor and modulus chain hierarchy that match the corresponding power-law ciphertext. .
8. The CKKS dense-state nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things according to claim 7, characterized in that: In step S9, the shared power chain is represented as: ……（9）； Among them, input ciphertext As a first-order power cipher In the dense domain, higher-order power ciphertexts are generated sequentially through homomorphic ciphertext-ciphertext multiplication and rescaling operations in an iterative cascading manner, or higher-order power ciphertexts are generated by combining lower-order power ciphertexts in a binary tree exponentiation manner. The shared power chain is constructed only once and is used by all segment intervals. Furthermore, each power ciphertext in the shared power chain maintains the same slot arrangement relationship as the input ciphertext.
9. The CKKS dense-state nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things according to claim 8, characterized in that: The first in the shared power chain ciphertext object The first generated in step S8 Plaintext objects corresponding to the power-order global plaintext coefficient vector They correspond to each other in the power order dimension for any valid slot index. If the slot-sub-interval static mapping relationship dictionary generated in step S3 indicates that the first The slot corresponds to the first The global plaintext coefficient vector is then calculated from the given sub-intervals. The The location stores the first The corresponding sub-intervals are the first Power Local Coefficients And the first ciphertext object The Each slot carries the sampled values of physical variables in that slot. The secret state data corresponding to the power of 1 makes the CKKS plaintext object With the first ciphertext object Maintain the positional correspondence in the slot index dimension.
10. The CKKS dense-state nonlinear function calculation method for privacy protection processing of physical variables in the Internet of Things according to claim 9, characterized in that: In step S10, slot-level point-to-point ciphertext-plaintext multiplication is performed between the ciphertext of each power in the shared power chain and the global plaintext coefficient vector of the corresponding power. The multiplication results for each power are then accumulated using ciphertext addition to obtain the output ciphertext, including: For each power Step S9 will generate the first ciphertext object The first one generated in step S8 and encoded by CKKS Power CKKS plaintext object Perform slot-level point-to-point ciphertext-plaintext multiplication CPMult to obtain the first... The ciphertext multiplication results corresponding to each power are then aligned by scaling factor and modular chain hierarchy. Ciphertext addition is then performed on the ciphertext multiplication results corresponding to each power, and the global plaintext coefficient vector corresponding to the 0th power is then calculated. Plaintext object obtained by CKKS encoding By adding the ciphertext summation result to the plaintext-ciphertext summation, the output ciphertext is obtained: ……（10）； Wherein, the output ciphertext Each effective slot corresponds to a physical variable sample value and is the dense state result after piecewise Taylor approximation transformation by the nonlinear function f(x).