Secure key provision for fully homomorphic encryption
Patent Information
- Application Number
- FR2022004682
- Authority / Receiving Office
- FR · FR
- Patent Type
- Patents
- Current Assignee / Owner
- Filing Date
- 2022-05-17
- Publication Date
- 2025-01-03
- Estimated Expiration
- 2042-05-17
Smart Images
Figure 00000024_0000 
Figure 00000025_0000 
Figure 00000026_0000
Abstract
Description
Title of the invention: Secure provision of keys for fully homomorphic encryption Technical field
[0001] The present description relates generally to the field of encryption and, in particular, to the field of fully homomorphic data encryption. Prior art
[0002] Fully homomorphic encryption is a form of encryption that allows operations to be correctly implemented on encrypted data without first decrypting the data. This allows, in particular, the operations to be implemented in an insecure environment, such as when using a server belonging to a third party, without the confidentiality of the data being compromised. The data is stored by an electronic device and is encrypted by this electronic device before being provided to the server. The resulting data from the calculations by the server on the encrypted data is returned to the electronic device as encrypted data. Once decrypted, the resulting data is the same as if it had been obtained by applying the calculation operations directly to the unencrypted data.
[0003] Fully homomorphic encryption can be used for privacy-preserving outsourced storage and computing. This allows data to be encrypted and outsourced to other environments for processing, while remaining encrypted.
[0004] Fully homomorphic encryption algorithms have the advantage of returning the result with relatively low noise, which is not the case with other homomorphic encryption algorithms. This advantage is achieved through the use of a seed key in performing operations on the encrypted data. However, there are technical problems in implementing fully homomorphic encryption algorithms. Summary of the invention
[0005] There is a need in the field for a method and device for implementing fully homomorphic algorithms that overcome one or more problems of the prior art.
[0006] One embodiment provides a method comprising: - the generation, by a computer device, of a first key and a boot key; - the provision of the first key and a seed key identifier to a electronic device and the provision of the boot key and identifier to a server - the fully homomorphic encryption, by the electronic device, of a first data value, stored in the electronic device, using the first key; - the provision, by the electronic device, of the first encrypted data value and the identifier, to the server.
[0007] According to one embodiment, the preceding method further comprises the implementation, by the server, of the first operation on the second data value in accordance with a fully homomorphic processing algorithm based on the encrypted first data value and the seed key.
[0008] According to one embodiment, the preceding method further comprises: - the reception, by the electronic device, of a second data value from the server; and - the generation of a third data value by a fully homomorphic decryption of the second data value using the first key, the third data value corresponding to the result of a first operation applied to the first data value.
[0009] According to one embodiment, the electronic device comprises a secure circuit, the method further comprising, after providing the first key, storing the first key in the secure circuit.
[0010] According to one embodiment, the electronic device comprises a cryptographic processor and in which the fully homomorphic encryption of the first data value comprises: - the generation, by the cryptographic processor, of a first intermediate data value by encoding the first data value; and - applying a fully homomorphic encryption algorithm to the first intermediate data value, by the cryptographic processor and using the first key, the encryption resulting in the first encrypted data value.
[0011] According to one embodiment, the fully homomorphic decryption of the second value comprises: - applying a fully homomorphic decryption algorithm to the second data value by the cryptographic processor and using the first key, the decryption resulting in a third intermediate data value; and - the decoding of the third intermediate data value, by the cryptographic processor, resulting in the third data value.
[0012] According to one embodiment, the fully homomorphic processing of the first encrypted data value is performed by a neural network implemented in the server.
[0013] According to one embodiment, one or more neurons of the neural network are configured to perform a priming operation using the priming key.
[0014] According to one embodiment, the first key is a sequence of N bit words, each of the N words comprising a number M of bits, and in which the encryption algorithm comprises: a) the generation of J+l random numbers, where J+l is equal to N*M; (b) calculating the sum of the product of the bits of the secret key with corresponding random numbers; and c) adding the data value to be encrypted to the sum.
[0015] According to one embodiment, the order of the additions in step b) is chosen randomly by the cryptographic processor.
[0016] According to one embodiment, the first key is stored in a memory of the electronic device masked with a random mask, the unmasking being carried out during the execution of the encryption algorithm.
[0017] According to one embodiment, step b) further comprises calculating an additional sum of the random numbers for which the corresponding bit of the secret key is 0.
[0018] One embodiment provides a system comprising: - a computing device configured to generate a first key, and a boot key, to provide the first key and an identifier of the boot key to an electronic device and to provide the boot key and the identifier to a server; and - the electronic device being configured to: encrypting in accordance with a fully homomorphic encryption algorithm a first data value, using the first key; and provide the first encrypted data value and identifier to the server.
[0019] According to one embodiment, the preceding system further comprises the server configured to: calculating, in accordance with a fully homomorphic processing based on the first encrypted data value and the seed key, a second data value; and provide the second data value to the electronic device, the electronic device being further configured to generate a third data value by applying, to the second data value, a fully homomorphic decryption algorithm which uses the first key, the third data value corresponding to the result of a first operation applied to the first data value. Brief description of the drawings
[0020] These characteristics and advantages, as well as others, will be explained in detail in the following description of particular embodiments given without limitation in relation to the attached figures among which:
[0021] [Fig.l] schematically represents an example of a system implementing a totally homomorphic cryptographic algorithm;
[0022] [Fig.2] represents examples of fully homomorphic encryption operations and illustrates the properties of fully homomorphic cryptography;
[0023] [Fig.3A] represents a network used in a totally homomorphic cryptography;
[0024] [Fig.3B] represents a network and represents a resolution of a closest vector problem;
[0025] [Fig.3C] represents a network and represents a noise error induced by the processing of data encrypted by partially homomorphic cryptographic algorithms;
[0026] [Fig.4] schematically represents a system configured to implement a fully homomorphic cryptographic algorithm according to an embodiment of the present description;
[0027] [Fig.5] schematically represents an electronic device configured to implement fully homomorphic encryption and decryption algorithms according to an exemplary embodiment of the present description;
[0028] [Fig.6] is a flowchart representing operations performed by the system to implement and execute a fully homomorphic cryptographic algorithm according to an embodiment of the present disclosure;
[0029] [Fig.7] is a flowchart representing operations performed by the electronic device to encrypt and / or decrypt data according to an exemplary embodiment of the present disclosure;
[0030] [Fig.8] is a flowchart representing operations performed by the electronic device to encrypt and / or decrypt data according to another exemplary embodiment of the present disclosure;
[0031] [Fig.9] is a flowchart showing operations performed by the electronic device to encrypt and / or decrypt data according to another exemplary embodiment of the present disclosure; and
[0032] [Fig. 10] is a flowchart showing operations performed by the electronic device to encrypt and / or decrypt data according to yet another exemplary embodiment of the present disclosure. Description of the embodiments
[0033] The same elements have been designated by the same references in the different figures. In particular, the structural and / or functional elements common to the different embodiments may have the same references and may have identical structural, dimensional and material properties.
[0034] For the sake of clarity, only the steps and elements useful for understanding the described embodiments have been shown and are detailed.
[0035] Unless otherwise specified, when referring to two elements connected to each other, this means directly connected without intermediate elements other than conductors, and when referring to two elements connected (in English "coupled") to each other, this means that these two elements can be connected or be connected by means of one or more other elements.
[0036] In the following description, when reference is made to absolute position qualifiers, such as the terms "front", "back", "top", "bottom", "left", "right", etc., or relative position qualifiers, such as the terms "above", "below", "upper", "lower", etc., or to orientation qualifiers, such as the terms "horizontal", "vertical", etc., reference is made unless otherwise specified to the orientation of the figures.
[0037] Unless otherwise specified, the expressions "about", "approximately", "substantially", and "of the order of" mean to within 10%, preferably to within 5%.
[0038] [Fig.l] schematically represents an example of a system implementing a fully homomorphic encryption algorithm.
[0039] For example, an electronic device 100 contains data, such as medical data, that must be processed by an external server 102 in order to, for example, establish a diagnosis. For example, the electronic device 100 does not have sufficient memory and / or processing resources to be able to perform the processing of the data. In the example of [Fig.l], the server 102 comprises a neural network configured to process the data.
[0040] The processing, by the server 102, is for example to be carried out without endangering the confidentiality of the data. For this, the data is sent to the server 102 in an encrypted form, in a communication 104. In particular, this encrypted form results from the fact that data processed by the server 102 is not decrypted before processing by the server 102 and therefore the result of the processing is also in encrypted form, without any new encryption operation being necessary. For example, the neural network implemented by the server 102 is configured to perform operations on the encrypted data and to provide an encrypted result which is returned to the electronic device 100 in a communication 106.
[0041] The electronic device 100 is then configured to decrypt the received encrypted result. This decryption results in an unencrypted result, corresponding to that which would have been obtained if the original unencrypted data had been provided to the server 102.
[0042] According to one embodiment, the encryption of the data, by the electronic device 100, their processing, by the server 102, resulting in encrypted output data and the decryption of the encrypted output data by the electronic device 100 is carried out in accordance with a fully homomorphic cryptography.
[0043] The encryption and decryption algorithms applied by the electronic device 100 are for example based on the use of a secret key K.
[0044] For example, the secret key K is a symmetric key and the encryption of the data, by the electronic device 100, and the decryption of the encrypted output data, also by the electronic device 100, is based on symmetric cryptography, using the secret key K.
[0045] In order to reduce the noise that may be present at the output of the operations, which generally comprises additions and / or multiplications, one or more bootstrapping operations are generally performed during the processing of the encrypted data. Thus, the server 102 is for example configured to perform one or more bootstrapping operations using a / ¾ bootstrapping key. For example, the bootstrapping operation is applied by at least one of the neurons of the neural network, and in certain cases by all or part of the neurons of the neural network. The bootstrapping technique is known to those skilled in the art and is, for example, described in detail in the publication "Improved Programmable Bootstrapping with Larger Precision and Efficient Arithmetic Circuits for TFHE" published in Advances in Cryptology - ASIACRYPT 2021.
[0046] The boot key bk is for example generated on the basis of the secret key K. The size of such a boot key is generally large, for example, between 10 and 20 megabytes, which in some cases may be larger than the storage capacity of the electronic device 100. Furthermore or alternatively, the calculation of such a boot key involves a relatively high computing power, which in some cases is beyond the capabilities of the electronic device 100. Since the secret key K does not have to be communicated to the server 102, the generation of the boot key bk does not have to be performed by the server 102.
[0047] Although [Fig.l] depicts an example in which the data is medical data and in which the processing of the encrypted medical data is performed by a neural network, in alternative embodiments, the data could be another type of confidential or sensitive data, and the processing of this data by the server 102 could involve other means in addition to, or instead of, the neural network.
[0048] [Fig.2] represents examples of fully homomorphic encryption operations and illustrates the properties of fully homomorphic cryptography.
[0049] As represented by blocks 200 and 202 in Figure 2, a fully homomorphic encryption algorithm (ENCRYPT) using the secret key K and applied to plaintext data mi and m2 results in encrypted data ci and O respectively. We write: Encrypt K) = cr and Encrypt (m2, K) = c2, where Encrypt is the encryption function resulting from the application of the fully homomorphic encryption algorithm homomorphic.
[0050] Furthermore, decrypting the encrypted data ci results in the plaintext data mt. We write Decrypt^K) = where Decrypt is the decryption function that inverts the encryption function Encrypt. Similarly, decrypting the encrypted data c2 results in the plaintext data We write Decrypt(c2K ) = m2-
[0051] The principle of fully homomorphic encryption algorithms is to be homomorphic in addition and multiplication, as represented by blocks 204 and 206 in [Fig.2].
[0052] Block 204 represents the property of homomorphism in addition: the encryption of the addition of the plaintext data mi and m2 is equal to the addition of the encrypted data ci and L, that is: Encrypt (mA + m2, K) -c\ + c2-
[0053] Similarly, block 206 represents the property of homomorphism in multiplication: the encryption of the product of the plaintext data mï and m2 is equal to the product of the encrypted data ci and c2, that is: Encrypt {m}*m2, K) — C\*C2-
[0054] In practice, the server 102 is configured to receive a number N of encrypted data ct' - cn, where for each z belonging to the set {1 ■ ■ ■, A^}, Cj — Encrypt[mp K) corresponds to the encryption, by the electronic device 100, of a clear data item mi. The server 102 is further configured to apply an Eval operation, corresponding to a combination of additions and multiplications, to the encrypted data £ i to cn. In other words, the server 102 is configured to generate the encrypted data c = EvalÇc^, ..., CN) ■ Fully homomorphic encryption algorithms are such that the decryption, by the electronic device 100, of the encrypted data c is equal to a plain text data m which is identical to the data which would have been obtained by applying the Eval operation to the plain text data mi to mw. In other words:
[0055] [Math.l] m = Decrypt(Eval(c^, ..., cN), K) = Eval(.... mN)
[0056] However, the properties of homomorphic stability by applying a plurality of additions and multiplications are still verified by fully homomorphic encryption algorithms. Indeed, the accumulation of additions and more particularly of multiplications in only partially homomorphic algorithms leads to noise in intermediate values handled by the server 102. This results in the fact that the decrypted data m does not correspond exactly to the value of Eval(mb
[0057] Figure 3A shows a network 300 used in fully homomorphic encryption algorithms. The network 300 is completely described by a base consisting of two vectors bY and b2. The network 300 includes all vectors that could be written as + a2b2, where and ^2 belong to the set of integers 9^.
[0058] In the example represented by the network 300, b} — (0,1) ^b-,— (1,0) and the network is a Euclidean network equivalent to the set <y2. Un vecteur B du réseau 300 est par exemple égal au vecteur 2b k + b2 et le vecteur B est ensuite désigné par les coordonnées (2,1).
[0059] In practice, the networks used in fully homomorphic cryptography are described by a basis comprising thousands of dimensions, for example between 6000 and 7000 dimensions. Furthermore, in practice, the vectors b} and b2 are not necessarily orthogonal.
[0060] [Fig.3B] represents a network and represents a resolution of a closest vector problem.
[0061] In fully homomorphic and partially homomorphic cryptography, lattices are used to create NP (nondeterministic polynomial time) problems, such as the nearest vector problem. For example, a prerequisite for making the lattice problem NP is to consider a lattice basis comprising non-orthogonal vectors.
[0062] For example, an encrypted data is represented by a vector c. The vector c does not belong to the network 300, that is, the vector c cannot be written as a linear combination of b} and b2 with integer coefficients.
[0063] The decryption of the vector c consists for example in solving the problem of the closest vector, that is to say in finding the vector of the network 300 for which a distance, for example the Euclidean norm, with respect to the vector 6 is minimal. In the example represented in figure 3B, this closest vector is a vector m = 2b} + 2b2.
[0064] The closest vector problem is an example of an approach that can be applied to perform lattice-based cryptography. Additionally, or alternatively, other problems, such as the closest point problem, or the shortest vector problem, can be used to encrypt and / or decrypt data.
[0065] [Fig.3C] represents a noise error induced by the processing of data encrypted by partially homomorphic encryption algorithms.
[0066] For example, the vector c is an encrypted data calculated by the server 102 by performing several additions and / or multiplications on input data provided by the electronic device 100. In the example illustrated by FIG. 3C, the expected unencrypted result is the vector value m. However, the algorithm used in this example is only partially homomorphic. Therefore, the encrypted result c may include noise and / or errors. Noise is, for example, due to the mathematical problems on which the encryption and / or decryption scheme is based, for example, the nearest vector problem. As operations are performed on the data, the noise increases, with increases being particularly high when the operations are multiplications.
[0067] In the example of Figure 3C, a vector fh solves the problem of the closest vector for the encrypted value c. The decryption by the electronic device 100 of the encrypted result c thus leads to a bad decrypted data, in other words, in this case, with the notations introduced in relation to [Fig.2],
[0068] [Math.2] Decrypt(m,K)Eval(m15...mN)
[0069] To avoid the accumulation of errors, fully homomorphic algorithms involve the use of a bootstrapping step, performed by the server 102, during processing, to eliminate errors in the operations performed. This step is based on the use of a bootstrap key bk. The bootstrap key bk is for example generated from the secret key K.
[0070] In one example, the secret key K is a LWE (Learning With Errors) secret key and the seed key bk is a public key calculated from the LWE secret key K and from a GLWE (General Learning With Errors) secret key S. The GLWE secret key S is for example generated by the device 100, in order to generate the seed key bk. The seed key bk then consists, for example, of a list of a number J of GGSW (General Gentry, Sahai and Walter) ciphertexts, the number 7 being for example equal to 630. Each GGSW ciphertext encrypts, using the GLWE secret key S, one bit of the LWE secret key K.
[0071] The generation of a bootstrap key is known to those skilled in the art and is for example described in more detail in the publication "Programmable Bootstrapping Enables Efficient Homomorphic Inference of Deep Neuronal Networks" by Ilaria Chillotti, Marc Joyce published in Cyber Security Cryptography and Machine Learning, 2021.
[0072] The priming step is for example performed, by the server 102, after each addition and / or multiplication, or after a given number of additions and / or multiplications. More particularly, the priming step is for example performed by the neural network, by each neuron or at different phases of the processing.
[0073] The priming step consists for example of an application of a de encryption using the seed key hk. This decryption is for example applied to a GLWE EncryptR encryption, under the GLWE secret key S, of the LWE ciphertext (Eval(EncryptK), ..., Encrypt(mN, K) ). Then, the decryption using the seed key bk is such that
[0074] [Math.3] DecryptH[Encrypt^Eval{Encrypt{mb K), Encrypt(mN, K) ), S), bk} = Encrypt^Evaltny Sj
[0075] However, in practice, this decryption is obtained by the server 102 through operations known as blind rotation or sample extraction, also described in the aforementioned publication. For this reason, the device 100 also sends, for example, to the server 102 the GLWE encryption, using the secret key S, of a suitably constructed polynomial V(X). For example, the polynomial V(X) is a polynomial with the following coefficients ( 0, ..., 0,1, ..., L ..., r -1, ..., r - 1,0, ..., 0 ), where each non-0 value is repeated 2” times, while the 0s are repeated 2"-1 times and where {0,1, ..., r] is the set of all possible messages, while n is the maximum number of least significant bits that can store noise in a plaintext.In other words, it is possible to recover the original plaintext as long as the noise is less than 2n- .
[0076] Finally, the priming step includes a key permutation operation in order to return to encryption under the initial key K, where bk = Encrypt(K, S)-
[0077] However, the generation of the boot key bk, by the electronic device 100, may not be possible due to its high cost in terms of capacity and computing power and in terms of time. In addition, the large size of a boot key does not always allow it to be stored on the electronic device 100 before being sent to the server 102.
[0078] Furthermore, it makes no sense to provide the secret key K to the server 102 in order to let it generate the boot key bk itself.
[0079] According to an embodiment which will now be described in relation to FIG. 4, the secret key K is for example generated by a computer device during the manufacture of the electronic device 100. According to this embodiment, the computer device is further configured to generate the boot key b^ for example from the secret key K and to provide it directly to the server 102.
[0080] Figure 4 schematically represents a system 402 configured to implement a fully homomorphic encryption algorithm according to one embodiment. The system 402 comprises the computing device, referenced 400 in Figure 4, used to generate the boot key, the electronic device 100 and the server 102.
[0081] According to one embodiment, the computing device 400 is configured to generate the secret key K and to provide it, in a secure manner, to the electronic device 100. The computing device 400 is further configured to generate the boot key bk and to provide the boot key bk to the server 102.
[0082] According to one embodiment, the computing device 400 is further configured to provide the secret key K to the electronic device 100 in association with an identifier id. This identifier id is also provided to the server 102 in association with the boot key bk. The server 102 stores for example the boot key bk in association with the identifier id.
[0083] According to one embodiment, the electronic device 100 is configured to encrypt plaintext data using the secret key K in order to generate encrypted data 6i to cn and to provide this encrypted data, in association with the identifier id, to the server 102. The server 102 is for example configured to identify, on the basis of the identifier id, the boot key bk associated with the secret key K and which can be used during the processing of the encrypted data coming from the electronic device 100. For example, the server 102 also stores other identifiers in association with other boot keys, which are for example used to process encrypted data coming from other devices, similar to the electronic device 100.
[0084] The server 102 comprises for example a neural network 404 configured to apply a fully homomorphic processing, using the seed key bk, to the encrypted data ci to cn. The server 102 is for example further configured for example to provide the seed key bk which is stored in association with the identifier id, to the neural network 404. The neural network 404 is for example configured to then execute operations, for example by applying the Eval function, on the encrypted data 6i to cn and to carry out seeding steps using the seed key bk, for example by applying the decryption function DecryptH to the result of the Eval function. The neural network 404 provides as output an encrypted result c ' and provides it to the electronic device 100. For example, the encrypted data c ' is such that:
[0085] [Math.4] c = EncryptR(Eval(mN ) ) = DecryptH(EncryptR(Eval( q, ■ ■ ■, cN), S), bk)
[0086] The electronic device 100 is configured for example to then apply the decryption algorithm, for example the Decrypt function, to the encrypted output data c' to generate a clear result m'. In other words, the clear result m' is equal to Decrypt{ c', K ).
[0087] [Fig.5] schematically represents the electronic device 100 comprising an integrated circuit 500 configured to implement a fully homomorphic encryption algorithm according to an embodiment of the present description.
[0088] The electronic device 100 is for example an IC card (from the English "integrated circuit"), a smartphone, a microprocessor circuit, etc.
[0089] The integrated circuit 500 of the electronic device 100 comprises, for example, a volatile memory 502 (RAM), for example a random access memory, and a non-volatile memory 504 (NV MEM), such as a flash memory. The non-volatile memory 504 stores, for example, data 506 (DATA). The data 506 are, for example, sensitive or confidential data, such as personal data (medical data, banking data, electronic voting data, etc.). For example, the data 506 comprise the data in clear text at mN,
[0090] The integrated circuit 500 further comprises, for example, a non-secure processor 514 (CPU), an interface 516 (INTERFACE) and a random number generator 518 (RN GENERATOR) connected to the volatile memory 502 and to the non-volatile memory 504 via a bus 512. In certain embodiments, the random number generator 518 is a pseudo-random number generator (PRNG).
[0091] According to one embodiment, the integrated circuit 500 further comprises, for example, a secure circuit 520 (SEC CIRCUIT), sometimes also referred to as a secure element, connected to the bus 512. The secure circuit 520 is, for example, configured to store a secret key 522 (SECRET KEY) in a non-volatile manner. The secret key 522 has, for example, been previously generated by the computing device 400 and is stored by the secure circuit 520 in association with the identifier id. The storage of the secret key 522 and the identifier id in a memory of the secure circuit 520 is, for example, carried out during a manufacturing step of the electronic device 100 and in a secure environment. The secure circuit 520 is, for example, further configured to store instructions of the fully homomorphic algorithms 510 (FHE ALGO).For example, fully homomorphic algorithms include the encryption function Encrypt and the decryption function Decrypt.
[0092] According to one embodiment, when the processor 514 triggers processing of the data 506 by the server 102, the data 506 are provided to a volatile memory of the secure circuit 520 and the secret key 522 is also, for example, loaded from a non-volatile memory of the secure circuit 520 into the volatile memory of the secure circuit. The secure circuit 520 then performs, for example, the encryption algorithm on the data. For example, the plaintext data at mN and the secret key K are stored in the volatile memory of the secure circuit 520 and the processor of the secure circuit 520 is configured to apply the encryption function Encrypt to each clear data value mi to mN using secret key K, in order to generate N encrypted data values ci to cn, such that for all i belonging to the set {1, N), q = Encrypt(K).
[0093] The interface 516 is for example configured to provide the encrypted data ci to cn to the server 102. The provision of the encrypted data to the server 102 is for example carried out at least partially via wireless communications and in certain embodiments via one or more intermediate networks, such as the Internet.
[0094] [Fig. 6] is a flowchart representing operations performed by the system 402 of [Fig. 4] in order to implement and execute a fully homomorphic encryption algorithm according to one embodiment. These operations are performed in particular by the computing device 400, by the secure circuit 520, by the electronic device 100, and in particular circuits of the electronic device 100 other than the secure circuit, and by the server 102.
[0095] the computing device 400 generates for example the secret key K and the boot key bk in a step 600 (GENERATE KEYS). The generation takes place for example in a secure environment, for example during the manufacture of the electronic device 100.
[0096] The computing device 400 then provides, for example, the secret key K to the secure circuit 520 of the electronic device 100 in a step 602 (PROVIDE SECRET KEY). The provision of the secret key K is, for example, carried out in the secure environment and by means of secure communication. The computing device 400 further provides, in step 602 or in a separate step, the identifier id to the secure circuit 520 of the electronic device 100. The identifier id is, for example, stored in the non-volatile memory 504 of the electronic device 100. In another example, the identifier id is stored, in association with the secret key K, in a non-volatile memory element of the secure circuit 520. In some embodiments, the identifier id is a serial number, or another unique identifier, of the electronic device 100.
[0097] The computing device 400 further provides the boot key bk, in association with the identifier id, to the server 102 and / or to the neural network 404 in a step 604 (PROVIDE BOOTSTRAPPING KEY).
[0098] During use of the electronic device 100, the electronic device 100 triggers, for example, a request for data processing by the server 102. For example, the electronic device 100 includes one or more software applications configured to record the data and to determine when the data should be transmitted to the server 102 for further data processing. For example, the data processing is too expensive in terms of power requirements or computing resources to be performed by the electronic device 100 itself.
[0099] Before being encrypted using the fully homomorphic algorithm, the clear data are for example first converted, in a step 606 (ENCODE DATA), into a representation which allows their encryption.
[0100] For example, the encryption uses a torus-based fully homomorphic encryption algorithm. The plaintext data is converted, in step 606, into values, each belonging to the real torus, where the real torus is equivalent to the set of real numbers modulo 1.
[0101] The encoded data is then encrypted in a step 608 (ENCRYPT DATA) by the secure circuit 520 in accordance with a fully homomorphic encryption algorithm, using the secret key K. For example, the encryption algorithm used in step 608 is a torus-based fully homomorphic encryption algorithm and is included in the algorithms 510.
[0102] The encrypted data and the identifier id are then, for example, provided, for example by the interface 516, to the server 102.
[0103] In a step 610 (COMPUTE AND BOOTSTRAPPING), the server 102 retrieves the bootstrapping key bk using the identifier id. The encrypted data and the bootstrapping key bk are then, for example, applied as input data to the neural network 404. The neural network 404 is, for example, configured to perform one or more operations, for example, a combination of homomorphic additions and / or homomorphic multiplications, on the input data by a succession of layers of neurons of the neural network. The bootstrapping key bk is, for example, used on the output data values of each layer in order to eliminate the noise resulting from the application of homomorphic additions and multiplications to the encrypted data. In another example, the bootstrapping key bk is used by each neuron after the data processing operations applied by the neuron.The neural network 404 provides an encrypted output, corresponding to the processing of the encrypted data. The server 102 then provides the encrypted result to the electronic device 100.
[0104] The secret key K is for example loaded into the volatile memory of the secure circuit 520 with the encrypted result. The secure circuit 520 is for example configured to perform, in a step 612 (DECRYPT RESULT), the decryption of the encrypted result. The decryption is performed using the fully homomorphic decryption algorithm Decrypt based on the secret key K. The decryption results in the decrypted data.
[0105] The decrypted data is then decoded by the electronic device 102 in a step 614 (DECODE DATA) in accordance with a decoding algorithm, which is for example the inverse of the coding scheme used in step 606. The data resulting from this decoding operation correspond for example to the result of the processing of the original clear data. In particular, the decoded data correspond for example to the data which would have been obtained if the processing had been carried out directly on the clear data.
[0106] Furthermore, since the electronic device 100 does not manipulate the boot key bk, the duration of the data processing involving this boot key bk depends only on the computing capacity of the server 102.
[0107] Figure 7 is a flowchart showing operations performed by the electronic device 100, for example by the secure circuit 520 and the random number generator 518 of the electronic device 100, to encrypt a plaintext data value mn and / or to decrypt an encrypted data according to an exemplary embodiment. Figure 7 is based on an example in which the plaintext data value fn>ia 8 bytes, however, the person skilled in the art will understand how the method could be adapted to plaintext data values of other lengths.
[0108] For example, the secret key K comprises 10 words each of 64 bits. Other formats are of course possible. Indeed, the number of 10 words forming the secret key K and the number of 64 bits in each word are presented as an example and are not limiting.
[0109] In a step 700 (GENERATION OF randçp ..., rand629), a number 630 of random numbers randQ to rand^ are generated, for example by the random number generator 518. The number 630 of random numbers is given as an example and is, of course, not limiting. Furthermore, the plain text data mN to be encrypted has, for example, 8 bytes
[0110] In a step 701 (INITIALIZATION sum\ a variable sum is initialized, for example to the value 0.
[0111] In a step 702, an iterative variable ? is initialized for example to the value 0.
[0112] In a step 703, an iterative variable j is initialized for example to the value 0.
[0113] In a step 704 [j] = 1?), it is determined, by the secure circuit 520, whether the jiènK ju -léme mol $. je |a cjef secret K is equal to 1. If the jlth bit of the ith word Sj of the secret key K is equal to 1 (branch Y), the process continues with a step 705 ( sum = sum + rand^j+p. In step 705, the variable sum is incremented by the ( 64* / + j ) ikme random number randf,^+j.
[0114] In the case where it is determined in step 704 that the jth bit of the ith word Sj of the secret key K is not equal to 1 (branch N), or after the completion of step 705, the process continues with a step 706 ((j<63) && (64*i+j<629)?).
[0115] In step 706, it is for example determined, by the secure circuit 520, whether the iterative variable j is less than 63 and if the value 64 / + j is less than 629. If so (branch Y), the iterative variable j is incremented to the value J: + 1 in a step 707 (j — J + 1) and the process resumes at step 704.
[0116] If, in step 706, it is determined that the iterative variable j is equal to 63 or that the value 64 / + J is greater than 629 (branch N), it is then determined, in a step 708 ( / < 9?) whether the iterative variable i is less than 9. If so (branch Y), the process continues with a step 709 ( / = / + 1) in which the iterative variable i is incremented to the value / + 1. After step 709, the process resumes at step 703.
[0117] If, in step 708, it is determined that the iterative variable i is equal to 9 (branch N), the plaintext data mn is then added to the variable sum to generate a value Slimn in a step 710 (sum„ - + sum^ The encryption process ends then for example in a step 711 (END) and the encrypted output data value cn is for example equal to the sequence composed by the 630 random numbers of 8 bytes and a last number of 8 bytes (rand^ ..., rand^^
[0118] To decrypt an encrypted data value c' generated by the server 102, the process involves, for example, the reuse, by the secure circuit 520, of the 630 random numbers randn to rand^. The encrypted data value c' is, for example, a sequence comprising, as its first 630 values, the 630 random numbers rand^ to and, as its last value, a sum' value resulting operations applied by the server 102 to one or more sumn values. The secure circuit 520 is for example configured to carry out steps 701 to 709 until, in step 708, the iterative value i = 9. Then, operation 710 is replaced by an operation in which the decrypted data value m ' is obtained by subtracting the new sum variable from the last sum ' value of the encrypted data c '.
[0119] Figure 8 is a flowchart showing operations performed by the electronic device 100 to encrypt and / or decrypt data according to another exemplary embodiment. In particular, Figure 8 shows a variant of the method of Figure 7 in which a countermeasure is implemented against attacks against the electronic device 100 in which an attacker may attempt to obtain the value of the secret key. The countermeasure of Figure 8 involves scrambling the order of the words S processed in the encryption process described in relation to [Fig. 7]. This countermeasure is for example performed in order to thwart side channel attacks or power analysis attacks. Some steps of [Fig. 8] are identical to steps of [Fig. 7] and have been designated with the same reference numerals.
[0120] In a step 800 (GENERATION OF rand^ ...,rand629, xorindex\ 630 random numbers randQ to rand^ are generated, as in an embodiment of step 700. Further, in step 800, a random number xorindex is generated. For example, the random number xorindex is generated with the condition that it belongs to a set of integers of the form |() , 2 / j|, where is an integer. In the example illustrated by figure 8, b = 4 but other values are of course possible for the integer b.
[0121] After step 800, steps 701 and 702 consisting of initializing the variable sum and the iterative variable i, described in relation to [Fig.7], are executed by the cryptographic processor 508.
[0122] Then, in a step 801 (i^xorindex < 9) it is determined whether the result of the operation i XOR xorindex is less than 9.
[0123] If so (branch Y), the iterative variable j is initialized to 0 in step 703.
[0124] In a step 804 [ / ] = 1?), similar to step 704 except for the index of the word (S, is replaced by $r xorindex), it is determined whether the jth bit of the ( i XOR xorindex)th word S^xorindex is equal to 1. If this is the case (Y branch), the process continues with a step 805 (SUfn = $wn +randfâ*^^^ in which the variable sum is incremented with the ^54*^- XOR xorindex) + random data randM^iXoR xorindex^ j-
[0125] If, in step 804, it is determined that the jth bit of the (j XOR xorindex)>th m°t xorindex of the secret key is not equal to 1, or after step 805, the process continues with a step 806 ((j<63) && (64*(iAxorindex)+j<629)?).
[0126] Step 806 is similar to step 706, except that it is determined, for example, whether the iterative variable j is less than 63 and whether the value 64(z XOR xorindex) + j is less than 629.
[0127] If, in step 806, it is determined that the iterative variable j is less than 63 and that the value 64(ï XOR xorindex) + j is less than 629 (Y branch), the process continues with step 707 and then returns to step 804.
[0128] If, in step 806, it is determined that the iterative variable j is equal to 63 or that the value 64(i XOR xorindex) + j is greater than 629 (branch N), the process continues with step 808 (i < 16?). Step 808 is similar to step 708, except that the threshold value for the iterative variable i is 16 and greater than 9. Indeed, if i = 16, this means that all the words of the secret key have been processed in the succession of steps 703, 804, 805 and 706.
[0129] If the iterative variable i is less than 16 (Y branch) or if, in step 801, it is determined that the value i XOR xorindex is equal to 9, the process continues by step 709. After step 709, in which the iterative variable i is incremented, the process returns to step 801.
[0130] If, in step 808, it is determined that the iterative variable i is equal to 16 (branch N), then the plaintext data is added to the variable sum in step 710 (sumn - m„+sumy The encryption process then ends for example with a step 711 (END) and the output encrypted data value 0; is for example equal to the sequence (rondo, • • • * rand^^ xorindex, sun-id).
[0131] The decryption of encrypted data is then similar to that described in relation to [Fig.7].
[0132] Figure 9 is a flowchart representing operations performed by the electronic device 100 to encrypt and / or decrypt data according to another exemplary embodiment. In particular, Figure 9 represents the implementation of an additional countermeasure, by masking the S words processed in the encryption process described in relation to [Fig. 8]. It would also be possible to apply the masking technique of [Fig. 8] to the method of [Fig. 7], in other words to implement the masking without scrambling the order.
[0133] According to one embodiment, the secret key K is stored masked in the secure element 520. For example, each word S, of the secret key K. with i G {0, ..., 9}, is masked with a mask Maskt, The secure circuit 520 stores for example 10 masked words 50 to Sg ■ For example, the masks Mask} to Maskg are generated randomly by the random number generator 518.
[0134] After performing steps 800, 701, 702 and 801, which are identical to those of FIG. 8 and, if the value i XOR xorindex is less than 9 (branch Y of step 801), the masked word 5 a , of the index i XOR xorindex is for example loaded into the T- ^i^xorindex rro volatile memory of the secure circuit 520, and is unmasked in a step 900 (KeyElement = S^xorindex A Mask^xorinde])- In step 900, the unmasked word is for example obtained by applying an XOR operation to the masked word ^i^wrindex ct au masclue ^as^iXxorindex- The value of the unmasked word S^xorindex XOR Mask^xorindex is then for example assigned to a KeyElement variable.
[0135] After step 900, the iterative variable j is for example initialized in step 703. Then, in a step 901, it is for example determined whether the bit of the variable KeyElement is equal to 1.
[0136] After step 901, the method continues for example in accordance with the sequence of steps 805, 806, 707, 808, 709, 710 and 711, as described in relation to [Fig.8].
[0137] The output encrypted data value is for example equal to the sequence ( rand^ rand62^ xorindex, sumn) and the decryption of an encrypted data is then similar to that described in relation to [Fig.7].
[0138] Figure 10 is a flowchart showing operations performed by the electronic device to encrypt and / or decrypt data according to yet another exemplary embodiment. In particular, Figure 10 shows the implementation of an additional countermeasure that is applied with respect to the method of Figure 9. This countermeasure involves performing a dummy operation when the jth secret key K is not equal to 1 (steps 704, 804 and 901 of [Fig. 9]). This countermeasure counters power analysis attacks. It would also be possible to apply the dummy operation technique of [Fig. 10] to the method of [Fig. 7] or 8, in other words to implement dummy operations without scrambling the order and / or without hiding the key.
[0139] After step 800, the method of Figure 10 comprises for example a step 1000 (INITIALIZATION sum, wasie^ which replaces step 701 of Figure 9. In step 1000, the variable sum is initialized, for example to the value 0, and a dummy variable waste is also initialized, for example to 0.
[0140] The process then continues like the process described in relation to Figure 9, until step 901 is performed. Step 901 of Figure 10 is identical to that of Figure 9, except that, if the jth bit is not equal to 1, a step 1001 (waste = waste + is implemented before step 706. In step 1001, the dummy variable is incremented with the value of the (64*(i XOR xorindex) + j)'th random number rand64^ol.i^ Indeed, in order to make it indistinguishable whether the bit checked in step 901 is equal to 1 or not, similar additions are performed both in steps 805 and 1001 after the output branches Y and N respectively of step 804. In this way, if a consumption analysis attack occurs, it will be difficult to deduce the values of the bits considered in step 901 (or similarly in step 704 or 804 of [Fig.7] or 8).
[0141] According to one embodiment, to avoid model attacks, all operations are performed bit by bit at 32 bits or 64 bits, depending on the architecture of the integrated circuit 500.
[0142] An advantage of the described embodiments is that the boot key bk is directly provided to the server 102 without being generated by the electronic device 100.
[0143] Another advantage of at least some of the described embodiments is that the secret key K is stored securely, in the secure circuit 520.
[0144] Another advantage of at least some of the described embodiments is that the secret key is further protected by the implementation of countermeasures during its use. lization during fully homomorphic encryption and decryption of data values.
[0145] Various embodiments and variations have been described. Those skilled in the art will understand that certain features of these various embodiments and variations could be combined, and other variations will occur to those skilled in the art. In particular, the countermeasures described in connection with Figures 7 to 10 may be dissociated. In addition, the secret K is presented as a sequence of 10 words of 64 bits each, but other representations are possible. In particular, the number of words and the numbers of bits may be modified.
[0146] Finally, the practical implementation of the embodiments and variants described is within the reach of the person skilled in the art from the functional indications given above. For example, the implementation of the secure circuit 500 will be within the reach of the person skilled in the art.
Claims
Claims
1. A method of providing keys for fully homomorphic encryption comprising: - generating, by a computing device (400), a first key (K) and a seed key (¾); - providing the first key and an identifier (id) of the seed key to an electronic device (100) and providing the seed key and the identifier to a server (102); - fully homomorphic encryption, by the electronic device, of a first data value (mi' ■ stored in the electronic device, using the first key; and - providing, by the electronic device, the first encrypted data value (ci' - • ■ ' cn) of the identifier, to the server.
2. The method of claim 1, further comprising: - receiving, by the electronic device (100), a second data value (c ') from the server (102); and - generating a third data value (w') by fully homomorphic decryption of the second data value using the first key (K), the third data value corresponding to the result of a first operation (Eval) applied to the first data value ---,^^),
3. The method of claim 2, further comprising performing, by the server (102), the first operation on the second data value (c ') according to a fully homomorphic processing algorithm based on the encrypted first data value (ci' • • • ' ca7) and the seed key (¾).
4. The method of claim 2 or 3, wherein the electronic device (100) comprises a secure circuit (520), the method further comprising, after providing the first key (K), storing the first key in the secure circuit.
5. A method according to any one of claims 2 to 4, wherein the electronic device (100) comprises a cryptographic processor (508) and wherein the fully homomorphic encryption of the first data value (mi' • ■ • ' mN) comprises: - generating, by the cryptographic processor, a first intermediate data value by encoding the first data value; and - applying a fully homomorphic encryption algorithm to the first intermediate data value, by the cryptographic processor and using the first key (K), the encryption resulting in the first encrypted data value (ci' • • • ' ^v).
6. The method of claim 5, wherein the fully homomorphic decryption of the second value (c ') comprises: - applying a fully homomorphic decryption algorithm to the second data value by the cryptographic processor (508) and using the first key (K), the decryption resulting in a third intermediate data value; and - decoding the third intermediate data value, by the cryptographic processor, resulting in the third data value (
7. A method according to any one of claims 3 to 6, wherein the fully homomorphic processing of the first encrypted data value (ci' • • • ' cn) is performed by a neural network (404) implemented in the server (102).
8. The method of claim 7, wherein one or more neurons of the neural network (404) are configured to perform a priming operation using the priming key (¾).
9. A method according to any one of claims 3 to 8, wherein the first key is a sequence of N words (s0,..., sN) of bits, each of the N words comprising a number M of bits, and wherein the encryption algorithm comprises: a) generating J+l random numbers (rand0,..., rand629), where J+l is equal to N*M; b) calculating the sum of the product of the bits of the secret key with corresponding random numbers; and c) adding the data value to be encrypted to the sum.
10. The method of claim 9, wherein the order of additions in step b) is chosen randomly by the cryptographic processor.
11. A method according to any one of claims 1 to 10, wherein the first key is stored in a memory of the electronic device masked with a random mask, the unmasking being performed during the execution of the encryption algorithm.
12. A method according to any one of claims 9 to 11, wherein step b) further comprises calculating an additional sum of the random numbers for which the corresponding bit of the secret key is 0.
13. System comprising: - a computing device (400) configured to generate a first key (K), and a seed key (^), to provide the first key and an identifier (id) of the seed key to an electronic device (100) and to provide the seed key and the identifier to a server (102); and - the electronic device being configured to: encrypt in accordance with a fully homomorphic encryption algorithm a first data value • • • ' mN\ using the first key; and provide the first encrypted data value (ci' • • • ' c*) and the identifier to the server.
14. The system of claim 13, further comprising the server (102) configured to: calculate, in accordance with a fully homomorphic processing based on the first encrypted data value (ci' • * • ' and the seed key (bk\ a second data value (c); and provide the second data value to the electronic device (100), the electronic device being further configured to generate a third data value (m) by applying, to the second data value, a fully homomorphic decryption algorithm that uses the first key (K), the third data value corresponding to the result of a first operation (Eval) applied to the first data value.