Method for detecting the presence of a homomorphic ciphertext element in a homomorphic ciphertext set

Abstract

Method for detecting the presence of a homomorphic ciphertext in a homomorphic ciphertext set. Method (100) for detecting the presence of a homomorphic ciphertext in a homomorphic ciphertext set, said method comprising the following steps: Totally homomorphic encryption (101), by a client and using a key, of a plaintext element µ to obtain the homomorphic ciphertext; Reception (102) of the homomorphic ciphertext by the server; Application of an extraction operator (103a) to the homomorphic ciphertext set so as to extract a hash of the homomorphic ciphertext set; Homomorphic comparison (103b) of the hash extracted from the homomorphic ciphertext set and a function of the homomorphic ciphertext element to obtain a presence indicator, said presence indicator being in homomorphic ciphertext form; Emission (104) of the indicator of presence. Figure to be published with the abbreviation: Figure 1

Description

Title of the invention: Method for detecting the presence of a homomorphic ciphertext element in a homomorphic ciphertext set technical field

[0001] The technical field is that of homomorphic cryptography methods, devices and systems. More particularly, the field of the invention is that of the manipulation of homomorphic cipher sets. technological BACKGROUND

[0002] Homomorphic cryptography, which allows calculations or data processing to be carried out on encrypted data without decrypting it beforehand, has attracted a lot of attention lately.

[0003] Indeed, the digital processing of personal data has become ubiquitous in our daily lives. Protecting the confidentiality of this data, and the privacy of the individuals concerned, has therefore become critical, as this personal data tends to circulate more and more in the digital systems and environments we use every day.

[0004] In this context, homomorphic encryption and processing techniques appear as a very promising solution, because they allow data to be processed while preserving the anonymity and privacy of this data in a particularly secure way, since the latter is not decrypted during its processing.

[0005] Homomorphic cryptography can be based on the so-called "learning with errors" (LWE) encryption scheme, in which the encrypted message c( a, b) = îp( is derived from the unencrypted message q according to the following formula: b = q + e + as, where:

[0006] s is a secret key,

[0007] a is a vector chosen at random, to project the secret key s, and

[0008] e is a random noise component, added to q+as

[0009] To decrypt the message, a person possessing the secret key s can calculate the quantity ba.s (equal to q+e), then round the result to remove the noise component e and recover the message q. Of course, the noise term e must be and remain sufficiently small if one wants to be able to recover the message q.

[0010] Homomorphic cryptography methods therefore address, among other things, the technical challenge of: • to allow an external, usually remote, service and processing server to perform "blind" operations on encrypted data, without decrypting it, this server not even possessing the necessary key to decipher the data, • receive encrypted data provided by another, separate entity (a client, in the IT sense), which has the encryption key.

[0011] These data processing operations may consist of performing individual operations, data by data, to format or filter them, for example. They may also involve data comparison, sorting, or grouping operations.

[0012] The manipulation of homomorphic ciphertexts can be complex and requires the development of methods to perform mathematical operations in the ciphertext space.

[0013] Among the known methods, also called cryptographic primitives, we can cite the homomorphic sum and subtraction of elements belonging to a torus T, the sum and subtraction of homomorphic cipher polynomials belonging to the ring of polynomials of degree N, ^[X] = jT[X] / (XA + Q or the homomorphic modular product between two elements belonging to T^fX].

[0014] These cryptographic primitives therefore make it possible to carry out several mathematical operations in the space of homomorphic ciphertexts, by reproducing the standard mathematical operations carried out in the space of plaintext messages.

[0015] However, homomorphic cryptography has been applied very little to the manipulation of ciphered lists or sets. Some methods for homomorphic encryption of list elements have recently been proposed, for example in the article "Faster Amortized FHEW bootstrapping using Ring" by G. De Micheli et al., https: / / eprint.iacr.org / 2023 / 112, 2023. However, these techniques deal with the homomorphic encryption of individual list elements, without providing guidance on, for example, the complete manipulation of homomorphic sets.

[0016] Certain data processing applications require the detection of the presence of an element in a set, for example the presence of a user identifier in a list of users authorized to access a certain good or service, while protecting the personal data of users.

[0017] Another example of an application requiring the detection of a user's presence within a user group is the auctioning of online advertisements. Indeed, online advertising has used targeting for over 10 years and seeks to show an advertisement only to users likely to purchase the advertised good or service. To do this, advertisers collect users' personal data and use it to better target potential buyers.

[0018] However, the collection of personal data often represents an infringement of users' privacy and is increasingly regulated by public authorities around the world.

[0019] In this context, the detection of the presence of a homomorphic ciphertext in a homomorphic ciphertext set without prior decryption of the ciphertext set and element is particularly interesting because it would allow advertisers to target users effectively without having access to personal data in plaintext.

[0020] Some prior art documents deal with the problem of detecting the presence of a homomorphic ciphertext in a set of homomorphic ciphertexts.

[0021] For example, document EP4111635Al “Method for testing membership of a "Data element to a list of reference data elements," a European patent application filed on October 2, 2021, in the name of Thales, discloses a technique for detecting the presence of a homomorphic ciphered candidate element in a list of elements. However, the method disclosed in this document requires a comparison operation for each element belonging to the list, which excessively increases the time required to detect the presence of the candidate element in the set.

[0022] The document US10015007B2 "Performing efficient comparison operations on encrypted data", US patent filed on 25 / 11 / 2015 in the name of IBM, discloses a method of comparison between homomorphic encrypted elements but does not deal with the problem of detecting the presence of a candidate element in a set of homomorphic encrypted elements.

[0023] There is therefore a need to develop techniques for detecting the presence of a homomorphic ciphertext within a set of homomorphic ciphertexts. Furthermore, it is necessary to develop detection methods that are fully homomorphic, reliable, fast, and computationally inexpensive. Summary of the invention

[0024] To at least partially resolve the problems mentioned above, a first aspect of the invention relates to a method for detecting the presence of a homomorphic ciphertext element <c>in a homomorphic cipher set <l>, the homomorphic cipher set <l>being encrypted using a key $ and being stored on a server, said process comprising the following steps: • Totally homomorphic encryption, by a client and using the key s, of a plaintext element p to obtain the homomorphic ciphertext element <c>; • Reception of the homomorphic ciphertext <c>by the server; • Application of an extraction operator to the homomorphic cipher set <l>so as to extract a fingerprint from the homomorphic cipher set; • Homomorphic comparison of the hash extracted from the homomorphic cipher set and a function of the homomorphic cipher element <c>to obtain a presence indicator of the homomorphic ciphered element <c>in the homomorphic cipher set <l>said comparison being carried out without deciphering the homomorphic ciphertext <c>and without deciphering the homomorphic cipher set <l>said presence indicator being in homomorphic cipher form; • Issuance of the attendance indicator .

[0025] The chevrons <...> indicate a homomorphic cipher for a quantity. For example, the symbol indicates a homomorphic cipher of the integer L

[0026] By "fingerprint of the homomorphic cipherset," we mean the result of applying the extraction operator to the homomorphic cipherset. For example, the fingerprint of the homomorphic cipherset may be a portion of the homomorphic cipherset or a function of a portion of the homomorphic cipherset. The portion of the homomorphic cipherset corresponding to the extracted fingerprint may include one or more elements of the homomorphic cipherset.

[0027] By fully homomorphic cipher, it is understood that an encrypted element is obtained using a fully homomorphic encryption technique or FHE according to the English terminology "Fully Homorphic Encryption".

[0028] By extraction operator, we mean a sequence of operations for extracting a hash from the homomorphic cipherset. The steps of applying the extraction and homomorphic comparison operator can be repeated so as to cover the entire homomorphic cipherset. In another approach, the steps of applying the extraction and homomorphic comparison operator can be repeated so as to implement a binary search of the cipherset element. <c>homomorphic in the homomorphic cipher set.

[0029] The method according to the first aspect of the invention makes it possible to detect the presence of a homomorphic ciphertext within a homomorphic ciphertext while preventing access to the plaintext message p. For example, the message p could be a user ID, a phone number, a cookie, or any information concerning the user. Thanks to fully homomorphic encryption, the message p, and therefore the user's personal data, is protected. In other words, the server and other entities involved in the method cannot distinguish the homomorphic encrypted information of random noise.

[0030] For each implementation of the process, a new encryption of the message is performed during the first step of the process, which makes correlation attacks less likely.

[0031] The server receives the homomorphic ciphertext <c>and calculates a presence indicator in a homomorphic way of the homomorphic ciphered element <c>in the homomorphic cipher set <l>.

[0032] During the presence indicator emission step The presence indicator can, for example, be issued to a user possessing the key or to another user to continue calculations, can be stored in a database, or issued to an entity configured to decrypt said presence indicator. .

[0033] The presence indicator This method can then be used, for example, to assess whether a user is among those with access to a specific service within a system or to certain areas within a building. Furthermore, the method according to the first aspect of the invention finds application in problems concerning the computation of the intersection of two sets, for example, in fields such as the storage of artificial languages, genomics, and databases that may utilize B-trees. Moreover, the method according to the first aspect of the invention can be used for all problems employing hash tables.

[0034] In another example, the presence indicator can be used by an ad buyer server or buying platform (Demand Side Platform or DSP) to assess whether the user is a target audience for a given advertisement. In this case, the entire <l>can be an audience provided by a Customer Relationship Management (CRM) system or a segment of a Data Management Platform (DMP) or Customer Data Platform (CDP).

[0035] It is important to note that the server, for example the DSP purchasing platform, does not decipher the presence indicator This indicator can be sent to another entity, for example a transactional black box (“Hardware Security Module” or HSM according to English terminology), which is the only entity involved in the process according to the first aspect of the invention that is capable of deciphering the result of the detection.

[0036] If the homomorphic ciphertext <c>is part of the homomorphic cipher set <l>The server can allow the user to access a certain good or service or, in the case of a DSP, send an offer to display an advertisement that may be of interest to the customer.

[0037] It is important to note that, in all cases, the server has no access to the message In plain English, p does not know the user's personal data.

[0038] In other words, thanks to the fact that the entity configured to decipher the presence indicator is the only entity capable of deciphering the result of the search for the homomorphic ciphertext element <c>in the homomorphic cipher set , the personal data of the customer or user is protected and inaccessible during the implementation of the process according to the first aspect of the invention.

[0039] In one or more embodiments, the presence indicator is of type boolean. This type of presence indicator allows for the direct encryption of the result of the search for the homomorphic encrypted element. <c>in the homomorphic cipher set.

[0040] In one or more embodiments, the message p is an identifier of a user, the client being associated with said user.

[0041] In one or more embodiments, the server is a purchasing platform or DSP.

[0042] In one or more embodiments, the presence indicator is sent to an entity configured to decipher the presence indicator Since said entity is a transactional black box, the method according to the first aspect of the invention further comprises a step of receiving the presence indicator by a transactional black box entity and a homomorphic decryption step of the indicator by the transactional black box type entity.

[0043] In one or more embodiments, the fingerprint of the homomorphic ciphertext is an element <L{> of the homomorphic ciphertext, <L(> being associated with an index i, i being between 0 and Nl, the elements of the list L belonging to a torus T, the list L and the index i being encrypted using the same key, the step of applying an extraction operator comprising the following steps: • Obtaining a homomorphic ciphertext <Q(X)> of a polynomial Q(X), Q(X) being an aggregation of the elements Lj of the list L, j being between 0 and Nl, each coefficient of the polynomial Q(X) being a linear combination of elements of the list L, Q(X) belonging to a quotient space T[X] / ( X), T[X] being a space of polynomials of degree Nl with coefficients with values ​​in the torus T and (pM ( X) being a cyclotomic polynomial of order M; • Obtain a homomorphic cipher<P(X)> of a monomial P(X) — X', where X' is a function of the index i associated with the element to be obtained,<P(X)> belonging to a quotient space Z[X] / (X), Z[X] being a set of polynomials with coefficients in integers; • Determine a homomorphic encrypted polynomial <C(X)> as a product homomorphic modular between < P(X) > and < Q(X) >; • Extract the coefficient k of the homomorphic cipher polynomial < C(X) > , k being determined on the basis of the polynomial Q(X) and the function Y used in the monomial P(X), the coefficient k of the homomorphic cipher polynomial < C(X) > corresponding to the homomorphic cipher element to be obtained.

[0044] By homomorphic modular product, also indicated by the symbol □, is meant an operation between two homomorphic ciphers, and , such that H = <ab>In other words, the homomorphic modular product S reproduces, in the cipherspace, the result of a product of two plaintext elements.

[0045] By homomorphic cipher of Xy, it is understood that a homomorphic cipher of the quantity X& m), y mod xi being between 0 and Ml.

[0046] By cyclotomic polynomial of order M, it is understood, in a known way, to be the monic polynomial whose complex roots are exactly the primitive M-th roots of unity. The order M is defined by M = t" with t any prime and a any integer.

[0047] By aggregation, or "packing" according to English terminology, is understood a representation of the list L in the form of a polynomial. In the case of the method according to one aspect of the invention, each coefficient of the polynomial Q(X) representing the list L comprises a linear combination of elements of the list L. Each linear combination may comprise one or more elements of the list L.

[0048] This embodiment of the step of applying an extraction operator to the homomorphic ciphertext list is a general method for extracting a homomorphic ciphertext element from a homomorphic ciphertext list from the homomorphic ciphertext <P(X)> of index i corresponding to the element of interest <lj>The extraction of the homomorphic ciphertext is carried out in a completely homomorphic way, i.e. without needing to decipher the elements of the list or the index.

[0049] This embodiment of the step of applying an extraction operator to the homomorphic ciphered list is a general method that can be implemented for any list of elements belonging to the torus T and indexed according to an integer i.

[0050] This embodiment of the step of applying an extraction operator to the homomorphic ciphertext list thus makes it possible to extract a homomorphic ciphertext element from a homomorphic ciphertext list without needing to decrypt the element or the list. This is possible thanks to the prior preparation of the polynomial Q(x) as an aggregation of elements of the list L and the monomial P(X) representing the index i corresponding to the element to be extracted. In other words, the ciphertext polynomial <Q(X)> is a ciphertext representation of the list L and the ciphertext monomial <P(X)> is a ciphertext representation of the index i.

[0051] It is important to note that <Q(X)> and <P(X)> can be obtained homomorphically from the ciphertext elements of the list <l>and the encrypted index without prior decryption. Indeed, one of the advantages of this method of implementing the step of applying an extraction operator is the ability to extract an encrypted element from the encrypted list without needing to decrypt the list or the index associated with the element to be extracted.

[0052] The polynomial produces<C(X)> The index then contains the ciphertext element—namely, the hash of the homomorphic ciphertext—to be extracted in the form of its kth coefficient. The coefficient k is determined from the aggregation used to obtain the polynomial Q and the function y used in the monomial P(X). In other words, the prior construction of P(X) and Q(X) uniquely identifies the coefficient k of <C(X)> containing the element of the homomorphic ciphertext to be extracted. The inventors have thus developed a technique for extracting an element from a homomorphic ciphertext that is both simple and quick to implement and relies on the prior preparation of the aggregation Q(X) and the monomial P(X), representing respectively the list L and the index i associated with the homomorphic ciphertext element to be extracted from the list.

[0053] In one or more embodiments: • Each coefficient of the polynomial Q(X) is a linear combination obtained according to the following formula: Xp t with 0 ≤ p < t- 2 0 < Z < ^ - 1, and • the coefficient of the polynomial < C(X) > corresponding to the homomorphic numerical element The element to be extracted is the coefficient k = 0, where y is equal to Af - i.

[0054] This construction of the polynomial Q(X) allows the element of the list to be extracted to be positioned corresponding to the coefficient k = 0 of the product polynomial <C(X)>. Furthermore, this choice of coefficients for the polynomial Q(X) allows the homomorphic cipher of the desired list element to be efficiently extracted for a wide range of values ​​of the parameters t, M, and y. Indeed, the inventors have succeeded in finding constructions of the polynomial Q(X) and the monomial P(X) that are particularly well-suited for extracting the element <lj>Such constructions are not obvious to a person skilled in the art, especially since if the aggregation Q(X) and the polynomial P(X) are not chosen appropriately, there is a high probability of finding a linear combination of elements from the list <L> and not the element of interest <.

[0055] In one or more embodiments, the step of applying an extraction operator to the homomorphic ciphertext list may further include a step of receiving the index <Z> and the list <l>, < Q(X) > and < P(X) > being obtained from ciphers < z > and < L > .

[0056] In one or more embodiments: • The homomorphic cipher polynomial <Q> is obtained from the list L containing the elements Lj, where j is an integer between 0 and N - 1, the homomorphic cipher polynomial <q>being in the form of a homomorphic cipher of yAM, a(j) being a function with values ​​in the set of integers between 0 and Nl and M = 2"; • The homomorphic cipher monomial is obtained from the index i, being in the form of a homomorphic cipher of , AO being a function with values ​​in the set of integers between 0 and Nl • The homomorphic encrypted polynomial <C(X)> is obtained according to the formula<c(x)> =<p(x^> □<q(x)> = ; • The coefficient k of the polynomial <GX)> to be extracted is given by k = a(z)-Az).

[0057] By homomorphic cipher of X^'1'', it is understood that a homomorphic cipher of the quantity .x^^K is

[0058] This embodiment illustrates an example of cooperation between the aggregation of list elements in the form of a polynomial Q(X) and the encryption of the monomial P(X). This is possible because the list elements are encrypted as coefficients of a polynomial of degree Nl, the list being a homomorphic cipher of xaG-. In this case, the coefficients of the polynomial Q(X) are simply the elements of list L (linear combinations each include a single element).

[0059] The function a(j) is a function of the integer j with values ​​in the integers between 0 and NL. The function a is, for example, a function of the form a(j) = (j + rr) mod N, where j is an integer. Another example of a function is a(j) — (cr* / ) mod N, where G is odd.

[0060] Moreover, the index i is the homomorphic ciphertext of ■ The function AO is a function of the integer i with values ​​in the integers between 0 and NL. The function fi is, for example, a function of the type AO = (j + o-) mod N, with G an integer. Another example of a function is P = O') = (^j) mod N with G odd. By combining these two homomorphic encryption techniques, the inventors discovered that it is possible to extract the desired element by calculating the homomorphic modular product □ < L> = < X^L > •

[0061] Advantageously, this homomorphic modular product results in a rotation of the co efficient of the original polynomial Q(X). The coefficient of interest, namely the element of the list to be extracted, then becomes the coefficient of order a(i) - of the polynomial determined using the homomorphic modular product. It is therefore possible to extract the element of the homomorphic encrypted list by calculating the coefficient of order a(Û_ / X0 of the polynomial co.

[0062] According to one or more embodiments, the functions a(i) and are chosen as the identity function, namely a(i) = i and - i- The coefficient to be extracted is then simply the zeroth coefficient of the polynomial < C(X) > .

[0063] Extracting a coefficient of a given order from a ciphertext polynomial is a known primitive in homomorphic cryptography. Moreover, extracting the zero coefficient of a homomorphic ciphertext of a polynomial is particularly simple to implement.

[0064] Combining the encryption of the list elements as coefficients of a polynomial of degree Nl with the encryption of the exponent i as the exponent of a monomial is far from obvious. This combination of features has never been used in homomorphic cryptography and provides a general method for extracting a homomorphic ciphertext from a homomorphic ciphertext.

[0065] Advantageously, the use of these two different homomorphic ciphers for the list elements and the index simplifies the extraction of the desired element, which can be performed by calculating the zero coefficient of a polynomial obtained by homomorphic modular multiplication. Extracting an element from a homomorphic ciphered list using the method according to the first aspect of the invention is therefore general, reliable, and fast.

[0066] According to one embodiment of the extraction operator application step: • The homomorphic cipher polynomial < Q(X) > is obtained according to the following formula < g > = TRLWE^'^X^] ' = o * y • The homomorphic ciphered monomial is determined according to the following formula < z > = TRGSW(X^ .

[0067] In one or more embodiments of the process according to the first aspect of the invention: • The homomorphic cipher set <L> has a Bloom filter type structure of size m, m being an integer greater than 1, the Bloom filter comprising h arrays, h being an integer greater than or equal to 1, each array being associated with a hash function; • The totally homomorphic encryption step of the element p to obtain the homomorphic ciphertext <c>is performed using the following formula <c> = TRGSW(üj), C] comprising h components, each component being obtained by applying one of the h hash functions to a quantity p mod m, the quantity p mod m being the remainder of the division of P by m; • The step of applying an extraction operator includes extracting h pluralities of homomorphic ciphertexts from the homomorphic ciphertext set <l>, each plurality of extracted homomorphic encrypted elements corresponding to one of the h arrays of the Bloom filter; • The homomorphic comparison step includes the calculation of h homomorphic modular products between pluralities of extracted homomorphic ciphertexts and components of the homomorphic ciphertext <c>; • The attendance indicator is determined from a function applied to the results of the h homomorphic modular products.

[0068] In one or more embodiments, the function applied to the results of the h homomorphic modular products is the sum of the h homomorphic modular products.

[0069] By Bloom filter we mean a data structure known in the prior art and defined by an array of m bits and h hash functions, each hash function associating an element of the database to be represented in the Bloom filter with one of the m bits.

[0070] A Bloom filter is a probabilistic data structure suitable for testing the presence of an element in a set. A Bloom filter-type data structure is particularly advantageous because the size of the array is fixed, even if the dataset in which the search is performed varies.

[0071] In the case of the method according to the first aspect of the invention, the choice of a Bloom filter to represent the set of homomorphic encrypted elements <l>is particularly effective at reducing the time required to search for a homomorphic ciphertext <c>Furthermore, it is possible to fix the size m of the arrays by considering it as an initial parameter, the total number n of elements that can be stored in the Bloom filter being determined by m and the number h of hash functions.

[0072] By homomorphic modular product S, it is understood that an operation between two homomorphic ciphertexts, and , is such that El = < AB >. In other words, the homomorphic modular product B reproduces, in the ciphertext space, the result of a product of two plaintext elements.

[0073] TLWE encryption definition

[0074] By TLWE encryption, "Torus Learning with Errors" according to English terminology, we mean a known method of homomorphic encryption of an element t belonging to the torus T.

[0075] The TLWE(f) cipher is determined according to the following formula:

[0076] TLWE (t) = (ap a2..ah b) [OO?71 + e +

[0078] The vector s is the decryption key, the vector a is a projection vector of the key s and the quantity e is random noise.

[0079] TRLWE encryption definition

[0080] By TRLWE encryption, "Torus Ring Learning With Errors" according to English terminology, we mean a known method of homomorphic encryption of a polynomial belonging to the ring of polynomials = T[X] / C(X) where C is a cyclotomic polynomial and for example C(X) = XN + 1, with N being a power of 2. Here, the ring of polynomials means the space of polynomials of degree N with coefficients in the torus T. The encryption key s and its projection vector a are vectors belonging to the set )*' where is the size of the message to be encrypted.

[0081] The ciphertext TRLWE(jj) is determined according to the following formula:

[0082] TRLWE(v) = (a^X), a2(X)^ik(X), b(X))

[0083] With / ?(X) = ; / (y) + e(x) + Si(X)

[0084] The polynomial X) is a polynomial of the same degree as / . / (X) whose coefficients represent the random noise added to the ciphertext of the message / / (X) • For example the coefficients of e(X) may have a Gaussian distribution centered around zero with a variance o2.

[0085] TRGSW encryption definition

[0086] By TRGSW encryption, "Gentry, Sahai, Waters Torus Ring encryption" according to English terminology, we mean a known method of homomorphic encryption of a polynomial m(X) belonging to the ring of polynomials Z^^X] with a key s, s being a vector belonging to the set ( 5^ y J j*, k being the size of the polynomial to be encrypted.

[0087] The TRGSW cipher of m is then determined as follows:

[0088] TRGSW ( m )=Z + mH with

[0089] h \, where zj, j=l...l(K+l), are 1(K+1) encrypted versions of 0, the value Z = : \Z1(K+1G null, 0 being encrypted with s', 1 being a given positive integer; and

[0090] Hs is a matrix whose dimension is (X + 1) X (X +1) x / and whose coefficients ficients belong to the torus T, HlB being equal to:

[0091] / A Û *,A with k -j MjJ

[0092] B being an integer greater than or equal to 2.

[0093] Definition of homomorphic modular product □ between a TGRSW and a TRLWE

[0094] A homomorphic modular product □ is understood to be an operation between two homomorphic ciphertexts, A > and B >, such that A > O = AB >. In other words, the homomorphic modular product 0 reproduces, in the ciphertext space, the result of a product between plaintext elements.

[0095] The method for calculating the homomorphic modular product depends on the properties of the encrypted elements to be multiplied. For example, in the case of a product between C = TRGSW(m) and c = TRGSW(^), we obtain:

[0096] C □ c = TRLWE (m ■ y)

[0097] In one or more embodiments: • The homomorphic cipher set <l>is a sorted encrypted homomorphic list; • The hash of the homomorphic ciphertext extracted when applying an extraction operator includes only one element of the homomorphic ciphertext; • The step of applying an extraction operator and the homomorphic comparison step are repeated to form a sequence of homomorphic comparisons between the elements extracted from the homomorphic sorted list and the homomorphic encrypted element <c>in order to perform a dichotomous search for the homomorphic encrypted element <c>in the sorted encrypted homomorphic list; • The attendance indicator is determined from the last homomorphic comparison in the sequence of homomorphic comparisons.

[0098] By sorted list is meant a set whose elements are associated with an index and ordered according to said index.

[0099] A second aspect of the invention relates to a client configured for: • perform a homomorphic encryption step on a plaintext element p in order to obtain a homomorphic ciphertext element <c>in accordance with the method according to any one of the preceding claims; • To transmit, via a communication channel, the homomorphic encrypted element <c>to a server;

[0100] A third aspect of the invention is a server configured to: • Memorize the homomorphic cipher list <l>; • Apply an extraction operator to extract a fingerprint of the homomorphic encrypted set according to the method according to one of the preceding claims; • Perform the homomorphic comparison of the function of the homomorphic encrypted element <c>and the imprint of the homomorphic cipher set <l>in accordance with the method according to one of the preceding claims and determine an indicator of the presence of the homomorphic ciphertext element c in the homomorphic ciphertext set <l> , being in the form of a homomorphic cipher; • Issue the attendance indicator .

[0101] A fourth aspect of the invention relates to a cryptographic system comprising a client according to the second aspect of the invention, a server according to the third aspect of the invention, and an entity configured to decrypt the presence indicator issued by the server.

[0102] In one or more embodiments, the entity configured to decipher the presence indicator is a transactional black box.

[0103] In one or more embodiments, the entity configured to decipher the presence indicator is also configured to transmit the result of the decryption of the presence indicator to the server.

[0104] A fifth aspect of the invention relates to a computer program product comprising instructions executable by a computer and designed for the implementation of the process according to the first aspect of the invention when these instructions are executed by the processor.

[0105] The present technology and its various applications will be better understood upon reading the following description and examining the accompanying figures. BRIEF DESCRIPTION OF THE FIGURES

[0106] The figures are presented for illustrative purposes only and are not exhaustive.

[0107] [Fig. 1] illustrates a flowchart of one embodiment of the detection method of the presence of a homomorphic ciphered element in a homomorphic ciphered set according to the first aspect of the invention.

[0108] [Fig.2] illustrates the use of a Bloom filter-type data structure in the implementation of the process according to the first aspect of the invention.

[0109] [Fig.3] illustrates a flowchart of an embodiment of an application step of an extraction operator for a homomorphic ciphertext element from a homomorphic ciphertext set.

[0110] [Fig.4a] schematically illustrates an example of homomorphic encryption of a set of elements.

[0111] [Fig.4b] schematically illustrates the extraction of a homomorphic ciphertext from the homomorphic cipher set illustrated in [Fig.4a].

[0112] [Fig.5] illustrates one embodiment of a cryptographic system according to the fourth aspect of the invention. DETAILED DESCRIPTION

[0113] Fig. 1 schematically illustrates one embodiment of the process 100 according to the first aspect of the invention.

[0114] According to the embodiment shown in [Fig. 1], the process 100 according to the first aspect of the invention comprises: • A totally homomorphic encryption step 101 of a plaintext element p to obtain the homomorphic ciphertext c, the encryption being carried out using the key s; • A 102 reception step, by a server hosting the homomorphic encrypted set <l>, of the homomorphic ciphered element <c>, the homomorphic cipher set <l>being encrypted using the key s; • A step 103a of applying a hash extraction operator to the homomorphic cipher set <l>. • A homomorphic comparison step 103b of the extracted fingerprint from the homomorphic cipher set and the homomorphic cipher element <c>to obtain an indicator of the presence of the homomorphic encrypted element <c>in the homomorphic cipher set <l>said comparison being carried out without deciphering the homomorphic ciphertext <c>and without deciphering the homomorphic cipher set <l>said presence indicator being in homomorphic cipher form; • Step 104 of issuing the presence indicator ; • A step 105a of receiving the presence indicator by a transactional black box type entity; • A step 105b of homomorphic decryption of the presence indicator I by the transactional black box.

[0115] Thanks to the totally homomorphic encryption of the message p, the detection of the presence of the element <c>The homomorphic cipher suite is implemented without decryption. The various elements involved in the implementation of method 100 according to the first aspect of the invention have no access to the plaintext message p, which protects the user's personal data.

[0116] The only decryption operation is performed during step 105b by the transactional black box, the aim being to decrypt the presence indicator so that the server can know the result of the search for the homomorphic ciphertext element <c>in the homomorphic cipher set <l>.

[0117] In an embodiment of the method 100 according to the first aspect of the invention, the homomorphic encrypted set <l>has a Bloom filter type structure. A Bloom filter data structure is defined by an array of size m bits and h hash functions. The h hash functions allow us to fill h arrays of size m by associating each element of a set to be represented in the Bloom filter with one of the m bits of the array. The structure of a Bloom filter is described in more detail with reference to [Fig. 2].

[0118] According to this embodiment, step 101 of totally homomorphic encryption of the element p to obtain the homomorphic ciphertext <c>is carried out using the following formula ( c ) — TRGSW( Cj) • Cj results from the application of h hash functions to the message p, h being an integer greater than or equal to 1.

[0119] For example, ci is obtained by concatenation of h components, each component being obtained by applying one of the h hash functions to the quantity / J mod m, the quantity fJ mod m being the remainder of the division of the element by the integer m.

[0120] In this embodiment, the step of applying an extraction operator 103a includes extracting the h arrays included in the Bloom filter, each array corresponding to one of the h hash functions. The comparison step 103b includes calculating h homomorphic modular products between, respectively, one of the arrays extracted from the Bloom filter and the component of <c>corresponding. By extracted array and corresponding component we mean here the array and the component associated with the same hash function.

[0121] The presence indicator <1> can be determined from the sum of the results of h homomorphic modular products. Each homomorphic modular product is most often equal to a 0 cipher if the element does not belong to the homomorphic cipher set, and it is always a 1 cipher if the element is included in the set. It follows that if the sum of the results of the homomorphic modular products is equal to h, the homomorphic cipher element is considered <c>belongs to the homomorphic cipher set represented as a Bloom filter.

[0122] Figure 2 schematically illustrates an embodiment of the method 100 according to the first aspect of the invention. In this example, the set of homomorphic encrypted elements is represented by a Bloom filter 502b. In the case illustrated in Figure 2, the server is a DSP purchasing platform that must evaluate whether a 501 customer belongs to the set of encrypted elements 502b. For example, the DSP server must evaluate whether the customer is likely to be interested in a given advertisement.

[0123] In the example illustrated in [Fig. 2], the 501 client is a user whose unique ID is calculated from personal information. The unique identifier can be a cookie, an identifier of the type "identifier for advertising" or IFA, a telephone number, an email address, or a combination of these elements.

[0124] A totally homomorphic ciphertext RID of the unique identifier ID is calculated by the user's terminal. This protects the user's personal information because neither Neither the DSP server nor the transactional black box has access to the information in plain text.

[0125] In this example, the totally homomorphic cipher RID is calculated as a totally homomorphic cipher of the quantity cl, cl being obtained by applying h hash functions to the identifier ID. The results of applying the h hash functions are juxtaposed to obtain the quantity cl.

[0126] In one embodiment, the homomorphic cipher of the unique identifier is obtained using the following formula .RID— T RG SW ( Cj ).

[0127] In one embodiment of the method 100 according to the invention, each time the homomorphic ciphertext RID is transmitted, a homomorphic calculation is performed by the entity receiving RID, for example by adding a homomorphic ciphertext of 0. This makes it possible to have a different RID at each step, so as to reduce the risk of correlation attacks.

[0128] During homomorphic comparison step 103b, the DSP server calculates h homomorphic modular products between h arrays or fingerprints of the register represented in the Bloom filter and the h components of the homomorphic encrypted identifier RID. The sum of the results of the h homomorphic modular products allows the determination of an indicator <1> of the presence of the homomorphic ciphertext element in the homomorphic ciphertext set <l>represented in the form of a Bloom filter.

[0129] In this example, the homomorphic cipher set <l>It could be a retargeting list, an audience obtained from a CRM customer management system, or a segment provided by a data management platform.

[0130] The indicator can be a boolean variable encrypting information about the presence of the RID element in the homomorphic cipher set <l>In other words, the presence indicator includes the encrypted response to the question "Does the DSP server want to show an advertisement to this user?"

[0131] The numerical indicator is then sent to an entity configured to decrypt the presence indicator such as a transactional black box – not shown in [Fig. 2] – which is the only entity capable of decrypting it and sending the response in plain text to the DSP server. In the event of a positive response, i.e., a Boolean value of "true", the DSP server can send an offer to a sales platform or "Supply-Side platform" (SSP). If accepted, this offer allows the SSP to purchase advertising space to display its advertisement.

[0132] It is important to note that the only information retained by the DSP server relates to the display of an advertisement to the user associated with the RID identifier.

[0133] According to another embodiment, the homomorphic cipher set is in the form of a sorted list. In this case, the homomorphic comparison step includes implementing a binary search in the sorted homomorphic cipher list. The binary search comprises a sequence of homomorphic comparisons between the items extracted from the list and the item being searched for <c>, each homomorphic comparison comprising at least one homomorphic modular product between the element of the homomorphic cipher list and the element being sought.

[0134] Binary search is a known method for searching for an element in a sorted list in which the first comparison is performed between the searched element and a central element of the list. If the searched element is the central element, the search ends. If the two elements are different, only half of the list containing the searched element is used, and the algorithm continues recursively on this half of the list.

[0135] The presence indicator is therefore determined on the basis of the result of the last homomorphic comparison in the sequence of homomorphic comparisons.

[0136] The method 100 according to the first aspect of the invention comprises a step 103a comprising the extraction of a homomorphic ciphertext element from a homomorphic ciphertext set. An example of such a homomorphic extraction method developed by the applicant is given in the following paragraphs.

[0137] Embodiments of step 103a of applying an operator for extracting a fingerprint from a homomorphic cipher set.

[0138] Fig. 3 illustrates an embodiment of the application step 103a of an operator for extracting a fingerprint from a homomorphic cipher set.

[0139] As illustrated in Figure 3, the application step 103a of an extraction operator allows the extraction of a hash from the homomorphic ciphertext list comprising a homomorphic ciphertext element <L(>). The homomorphic ciphertext element <> is associated with an index i, i being between 0 and Nl, the elements of the list L belonging to a torus T, the list L and the index " are encrypted using the same key.

[0140] Step 103a according to the embodiment illustrated in Figure 3 includes a step 103a.1 of obtaining a homomorphic cipher <Q(X)> of a polynomial Q(X). The polynomial Q(X) belongs to the set T[X] / X). T[X] is a space of polynomials of degree Nl with coefficients taking values ​​in the torus T. (pM(X) is a cyclotomic polynomial of order M and degree N. Each coefficient of the polynomial Q(X) is a linear combination of elements from the list L.

[0141] Step 103a as illustrated in Figure 1 further comprises a step 103a.2 of obtaining a homomorphic cipher<P(X)> of a monomial P(X) — X!, being a function of the index ? associated with the element<L{> to obtain. The monomial P(X) belongs to Z[X] / (X), Z[X] being a set of polynomials with coefficients in whole numbers.

[0142] During step 103a.3, the homomorphic cipher polynomial<C(X)> is determined as a homomorphic modular product between <P(X)> and <Q(X)>.

[0143] The extraction step 103a.4 of the coefficient k of < C(X) > allows us to obtain the fingerprint of the homomorphic cipher list, in this case the element < to be extracted from the list < L >.

[0144] The homomorphic cipher monomial<P(X)> is obtained from a plaintext index i, where i is an integer between 0 and N - 1. According to one embodiment, the homomorphic ciphertext monomial <P(X)> is obtained as the homomorphic ciphertext of the quantity ■

[0145] According to one embodiment, the homomorphic cipher polynomial <q>is obtained from the plaintext list L comprising the elements Lj, where j is an integer between 0 and N-1. The elements Lj belong to the torus T. In this embodiment, the homomorphic cipher polynomial <Q> is obtained as the homomorphic cipher of the quantity yAM vdj. In other words, the elements of the plaintext list are j = encoded as coefficients of a polynomial which is then encrypted homomorphically.

[0146] In this embodiment, the homomorphic modular product calculated in step 103a.3 is calculated according to the following formula C(X) =< / q> < / c> < / l> < / l> < / l> < / c> < / c> < / c> < / l> < / l> < / c> < / c> < / l> < / c> < / l> < / c> < / c> < / l> < / l> < / c> < / l> < / l> < / l> < / c> < / l> < / c> < / c> < / c> < / c> < / l> < / c> < / l> < / c> < / l> < / c> El < Q > . The quantity C(X) is a polynomial of degree N with coefficients taking values ​​in the torus T.

[0147] It is therefore possible to obtain a homomorphic cipher of the element 4, namely , during a step 103a.4 of extraction of the order coefficient a(i) - P(i) of the polynomial C(X).

[0148] Figures 4a and 4b illustrate in more detail an example of an embodiment of step 103 a.

[0149] According to the embodiment illustrated in Figure 4a, the plaintext list k is a sorted set of elements Lj, j being between 0 and Nl. In this case, the boxed element L corresponds to the element that we want to extract from the list. The homomorphic cipher polynomial <Q> is obtained as:

[0150] pppwE(j = TRLWE (Lo + Lix + L2X2 + ... + LjX'+ ■ ■ • )

[0151] The homomorphic cipher monomial of the index is obtained according to the formula — TRGSW(X~y). In this case, the function a(i) is the identity function, a(i) = i. The function / 7(0) is also chosen as being equal to the identity function, 0(i) = i.

[0152] Choosing a TRLWE cipher for the polynomial Q encoding the elements of the list and a TRGSW cipher for the monomial P encoding the index allows the homomorphic modular product □<Q> to be calculated as:

[0153] TRLWE= TRLWE M'4 LDCI+! + ... + L}X"i+1+• • ■ LN4XN4)= TRLWE^qX^+^x^1 + ...

[0154] As illustrated in Figure 4b, the term of interest becomes, in the product polynomial C, the zero coefficient. It is therefore possible to extract a homomorphic cipher of the element of interest as the zero coefficient of the polynomial resulting from the homomorphic modular product.

[0155] Fig. 5 illustrates an embodiment of a cryptographic system 500 for detecting the presence of a homomorphic ciphertext in a homomorphic ciphertext according to the fourth aspect of the invention.

[0156] The cryptographic system 500 comprises a client 501 according to the second aspect of the invention, a server 502 according to the third aspect of the invention, and an entity 503 configured to decrypt the presence indicator .

[0157] The client is, for example, a user whose presence we want to detect in an encrypted set <l>.

[0158] The client is configured to perform a totally homomorphic encryption step on a plaintext element p. The result of the encryption is a totally homomorphic ciphertext. <c>which is then transmitted by the 501 client to a 502 server. The p message is, for example, a unique user identifier. The unique user identifier can include the user's personal data as described in relation to the ID identifier and its homomorphic ciphertext RID.

[0159] Server 502 is configured to receive homomorphic ciphertext <c>and to memorize the homomorphic cipher set <l>.

[0160] Server 502 is configured to implement a step of applying a 103a extraction operator to a hash of the homomorphic cipherset <l>The 502 server can also perform a comparison step 103b between the extracted hash of the homomorphic cipher set <l>and the homomorphic ciphered element <c>in order to detect its presence throughout <l>.

[0161] Following the implementation of comparison step 103b of process 100 according to the first aspect of the invention, the server 502 obtains a presence indicator of the homomorphic ciphertext element in the homomorphic ciphertext set <l>The attendance indicator is then passed to a 503 entity configured for decryption such as a transactional black box.

[0162] The transactional black box is the only element of the 500 cryptographic system capable of decrypting the presence indicator and communicating to the server if the element <c>is part of the set <l>.

[0163] Advantageously, the only plaintext information to which the 502 server has access is the boolean variable I indicating the presence of the homomorphic ciphertext element in the homomorphic ciphertext set <l>.

[0164] In other words, server 502 has no access to any clear text information about client or user 501.

[0165] Description of the procedure for refreshing a homomorphic cipher

[0166] When two encrypted messages are added together, an encrypted message is obtained, which is an encrypted version of the sum of the two initial unencrypted messages, whose noise component is higher than for the two initial encrypted messages.

[0167] Thus, to prevent the noise term from increasing and growing during data processing, a refresh procedure, generally called "bootstrapping", is executed repeatedly. This procedure produces a refreshed version of <c>that is to say, an encrypted message<c’> which is also decrypted as p (when decrypted using s), but whose noise component is smaller than that of <c>.

[0168] The bootstrapping procedure usually includes a homomorphic evaluation of the quantity Xa.v(X) with:

[0169] v(X) is a functional refresh polynomial of degree less than or equal to Nl whose coefficients are chosen according to the characteristics of the message space and a target function;

[0170] and a is the integer closest to 2N(ba.s):

[0171] [ 2Æ0-as)]

[0172] Herein, homomorphic evaluation means a calculation performed using encrypted quantities, without prior decryption (without knowing the key s). Herein, the target function means a mathematical function applied to the encrypted message at the same time as the refresh. In the case of a simple refresh, the target function is the identity function.

[0173] For a suitably chosen polynomial v(X), the constant term of Xa.v(X) mod(XN + 1), namely coe fQ(X"\y(X)), is a refreshed version of <c>, that is, an encrypted version of p with a limited noise component e' (generally smaller than the noise component of <c>, when <c>is the result of previous homomorphic data processing operations; in any case, e' is small enough to allow decryption of<c’> (with a low error rate).

[0174] In a known way, the homomorphic calculation of the quantity coef ( Xa.v ( X ) ) = Xa.v ( X ) mod( XN + 1 ) can be decomposed into a calculation of a sequence of modular products given by: rxz) ... (x^(xS(x) ))...)

[0175] Or âksk«I = l 2Nb\ et^ = [ 2^¾].

[0176]

[0177] Where the sk are the n components of the vector s. In the equation above, when calculated homomorphically, each product is a modular product: the left-hand term, for example, or X~a,s\ belongs to [ X ] = Z [ X ] I ( XN + 1 ) ' the right-hand term, for example, v(X) or ^X^v(X ) j ' belongs to TN[X]. Here we defines TN[X] = T[X] / (XN+1). Such a product is similar to the product yp;, y being an integer and p belonging to T (except that we are working on fields of polynomials, instead of fields of numbers). The homomorphic calculation of coef (X^r^X) ) is not immediate because of the presence of the secret key s, which is not known. However, it is known that a product modular such as yp; or Xj.v(X) can be computed homomorphically in de finishing the exterior product quantity^ J - r is the version L i the encrypted message p. The quantity Z(z) is the "TRGSW" encryption of z (The acronym TRGSW comes from the English "Gentry, Sahai, Waters Torus Ring en-cryption", adapted from an encryption method that was proposed in the article "Homomorphic encryption from learning with errors: Conceptually-simpler, asymp-totically-faster, attribute-based", by C. Gentry, A. Sahai, and B. Waters, InCrypto' 13, 2013).

[0178]

[0179] Furthermore, in a known way, it is possible to calculate the product without knowing the components sk, k = 1.. .n of the secret key and therefore without knowing the secret key s.

[0180] Indeed, since the components sk, k = 1.. .n each belong to B={0,l} (i.e., are each binary), the quantity is equal to i, which is encrypted as It follows that an encrypted version of Xax\X)mod(XN + 1) can be computed without access to the secret key s by using the encrypted (¾) version of the components sk. These encrypted versions of the components of s are sometimes called Bootstrap keys (BKk = xs (¾) Bootstrap key in English). Bootstrap keys (generally public) are encrypted versions of the components sk of the secret key s encrypted using another key s'.

[0181]

[0182] (y) is defined as being equal to Z + y HB with: \, where Zj, j=l.. .1(K+1), are 1(K+1) encrypted versions of 0, the value null 0 being encrypted with s' : = (p ,( 0), 1 being a given positive integer; and

[0183] HB is a matrix whose dimension is (f + 1) X (Æ+ 1) x Z and whose coefficients belong to the torus T, H1 being equal to:

[0184]

[0185] B being an integer greater than or equal to 2.

[0186] The external product C El c, between: • An encrypted message c = (pce Tn+l, corresponding to a message p ap- parting at the TN[X] torus and The numerical version C = / •(>') of a polynomial with integer coefficients y, CeM [^+1)AÆ+1( ^7v[^] )'

[0187]

[0188] is calculated according to the method detailed below. The K+l components Cj, j=l..K+l of the encrypted message c= ïp are in some sort decomposed using a base-B system (like the one used to calculate the 9s)

[0189] |c7| <B-1

[0190] Next, it is possible to calculate

[0191]

[0192] in which ^Bl( c ) C is the row-column matrix product and is a matrix of dimension (n+l)xl whose form is as follows: [°1931 ™

[0194] With

[0195] The result C □ c belongs to Tn+l and is an encrypted version of yp. In other words, by decrypting this quantity with the key s' we recover yp. This calculation method can be applied to any message belonging to the torus T.

[0196] Using the keys BK; introduced above, we obtain the following equation for the homomorphic calculation of coefo(X".v(X)), namely:

[0197] s

[0198] The above equation therefore allows for the refreshing or bootstrapping of the encrypted message without needing to know the encryption key.< / c> < / c> < / c> < / c> < / c> < / l> < / l> < / c> < / l> < / l> < / c> < / l> < / l> < / l> < / c> < / c> < / l> < / q> < / l> < / lj> < / l> < / lj> < / ab> < / c> < / c> < / l> < / c> < / l> < / l> < / c> < / c> < / c> < / l> < / c> < / l> < / c> < / c> < / l> < / c> < / c> < / l> < / l> < / c>

Claims

Claims

1. Method (100) for detecting the presence of a homomorphic encrypted element <c>in a homomorphic encrypted set <l>, the homomorphic encrypted set <l>being encrypted using a key s and being stored in a server (502), said method (100) comprising the following steps: • Fully homomorphic encryption (101), by a client (501) and using the key s, of a plaintext element p to obtain the homomorphic encrypted element <c>; • Reception (102) of the homomorphic encrypted element <c>by the server (502); • Application of an extraction operator (103a) to the homomorphic encrypted set <l>so as to extract a fingerprint from the homomorphic encrypted set; • Homomorphic comparison (103b) of the fingerprint extracted from the homomorphic encrypted set and a function of the homomorphic encrypted element <c>to obtain a presence indicator of the homomorphic encrypted element <c>in the homomorphic encrypted set <l>, said comparison being carried out without decryption of the homomorphic encrypted element <c>and without decryption of the homomorphic cipher set <l>, said presence indicator being in homomorphic encrypted form; • Emission (104) of the presence indicator .

2. Method (100) according to the preceding claim in which the presence indicator is of type boolean.

3. Method (100) according to one of the preceding claims in which the homomorphic encrypted element <c>is an identifier of a user, the client (501) being associated with said user.

4. Method (100) according to the preceding claim in which the server (502) is a purchasing platform (DSP).

5. Method (100) according to one of the preceding claims in which the presence indicator is transmitted to an entity (503) configured to decrypt the presence indicator , said entity (503) being a transactional black box (HSM), said method (100) comprising in in addition to a step (105a) of receiving the presence indicator by the transactional black box (HSM) and a step (105b) of homomorphic decryption of the presence indicator by the transactional black box (HSM).

6. Method (100) according to one of the preceding claims in which the fingerprint of the homomorphic encrypted list is an element < Lj > of the homomorphic encrypted list, < > being associated with an index i, i being between 0 and Nl, the elements of the list L belonging to a torus T, the list L and the index i being encrypted using the same key and in which the step of applying an extraction operator (103a) of a fingerprint of the homomorphic encrypted list comprises: - Obtain a homomorphic cipher<Q(X)> (103a. 1) of a polynomial Q(X), Q(X) being an aggregation of the elements Lj of the list L , j being between 0 and Nl, each coefficient of the polynomial Q(X) being a linear combination of elements of the list i, Q(X) belonging to a quotient space T [X ] j (pM ( X), X ] being a space of polynomials of degree Nl with coefficients with values ​​in the torus T and <PM(X) étant un polynôme cyclotomique d’ordre M ; - Obtain a homomorphic cipher < P(X) > (103a.2) of a monomial P(X) = Xr, being a function of the index i associated with the element < > to be obtained, P(X) belonging to a quotient space Z [ X ] / ( X ), Z [ X ] being a set of polynomials with coefficients in the integers; - Determine a homomorphic encrypted polynomial < C(X) > (103 a. 3) as a homomorphic modular product between<P(X)> And<Q(X)> ; - Extract the coefficient k (103a.4) from the homomorphic encrypted polynomial < C(X) > , k being determined on the basis of the polynomial Q(X) and the function T used in the monomial P(X), the coefficient k of the homomorphic encrypted polynomial<C(X)> corresponding to the fingerprint of the homomorphic encrypted list to be extracted.

7. Method (100) according to one of the preceding claims in which: • The homomorphic encrypted set <l>has a structure of Bloom filter type (502b) of size m, m being an integer greater than 1, the Bloom filter comprising h arrays, h being an integer greater than or equal to 1, each array being associated with a hash function; The fully homomorphic encryption step (101) of the element p to obtain the homomorphic encrypted element <c>is performed using the following formula < c > = TRGSW ( Cj ), 61 comprising h components, each component being obtained by applying one of the h hash functions to a quantity p mod m , the quantity 7 / mod m being the remainder of the division of by m ; The step of applying an extraction operator (103a) comprises extracting h pluralities of homomorphic encrypted elements from the homomorphic encrypted set <l>, each plurality of extracted homomorphic encrypted elements corresponding to one of the h tables of the Bloom filter; The homomorphic comparison step (103b) comprises calculating h homomorphic modular products between pluralities of extracted homomorphic cipher elements and components of the homomorphic cipher element <c>; The presence indicator is determined from a function applied to the results of h homomorphic modular products.

8. Method (100) according to one of claims 1 to 6 in which: The homomorphic encrypted set <l>is a homomorphic encrypted sorted list; The fingerprint of the homomorphic encrypted list extracted when applying an extraction operator (103a) comprises a single element of the homomorphic encrypted list; The step of applying an extraction operator (103a) and the step of homomorphic comparison (103b) are repeated to form a sequence of homomorphic comparisons between elements extracted from the homomorphic sorted list and the homomorphic encrypted element <c>so as to carry out a dichotomous search for the homomorphic encrypted element <c>in the homomorphic encrypted sorted list; • The presence indicator is determined from the last homomorphic comparison in the sequence of homomorphic comparisons.

9. Client (501) configured to: • perform a fully homomorphic encryption step of a plaintext element p so as to obtain a homomorphic encrypted element <c>in accordance with the method according to any one of the preceding claims; • Transmitting, by means of a communication channel (501c), the homomorphic encrypted element <c>to a server (502);

10. Server (502) configured to: • Store the homomorphic encrypted list <l>; • Apply an extraction operator (103a) so as to extract a fingerprint from the homomorphic encrypted set in accordance with the method according to one of claims 1 to 8 • Carry out the homomorphic comparison (103b) of the function of the homomorphic encrypted element <c>and the fingerprint extracted from the homomorphic encrypted set <l>in accordance with the method according to one of claims 1 to 8 and determining an indicator of presence of the homomorphic encrypted element < c > in the homomorphic encrypted set <l> , being in the form of a homomorphic cipher; • Emit the presence indicator .

11. A cryptographic system (500) comprising a client (501) according to claim 9, a server (502) according to claim 10 and an entity (503) configured to decrypt the presence indicator issued by the server.

12. Cryptographic system (500) according to the preceding claim wherein the entity configured to decrypt the presence indicator is a transactional black box (HSM).

13. A cryptographic system (500) according to claim 11 or claim 12 wherein the entity (503) configured to decrypt the presence indicator is further configured to transmit the result of the decryption of the presence indicator to the server (502).

14. Computer program product comprising instructions executable by a computer and designed for implementing the method according to one of claims 1 to 8 when these instructions are executed by the processor. < / l> < / l> < / c> < / l> < / c> < / c> < / c> < / c> < / l> < / c> < / l> < / c> < / l> < / c> < / l> < / c> < / l> < / c> < / c> < / l> < / c> < / c> < / l> < / l> < / c>

Images