Cryptographic methods, systems and services for evaluating real-valued functions on encrypted data

Abstract

To provide cryptographic methods, systems and services for evaluating real-valued functions on encrypted data.SOLUTION: The invention relates to a cryptographic method based on homomorphic encryption enabling the evaluation of univariate or multivariate real-valued functions on encrypted data, in order to make it possible to carry out homomorphic processing on encrypted data more broadly and efficiently. The method is implemented in a digital form by at least one information processing system specially programmed to effectively and publicly transform a set of ciphertexts (corresponding to cleartexts x1, ..., xp) into a set of ciphertexts corresponding to a plurality of functions f1, ..., fq of the cleartexts.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates to improving homomorphic evaluation of one or more functions applied to pre-encrypted data. This technical field builds on recent cryptography research and may have numerous applications in all fields of activity where confidentiality constraints exist, such as, but not limited to, privacy protection, trade secrets, or medical data.

[0002] More particularly, the present invention relates to a method for enabling the calculations required for the homomorphic evaluation of one or more functions to be completed automatically by one or more specially programmed computer systems, taking into account therefore the limited storage and computation time capacities or, in the case of remote processing of the cloud computing type, transmission capacities that may be known by the information processing systems that need to perform this type of evaluation.

[0003] As explained below, the development of homomorphic encryption methods has been largely hindered so far by technical constraints inherent in most of the schemes proposed in the literature, particularly related to computer processing capacity, in terms of the machine resources implemented to perform the various computational steps and the computation time supported. [Background technology]

[0004] In a fully homomorphic encryption scheme (FHE for short), any participant can encrypt a set of ciphertexts (plaintext x1,…,x p ) for a given function f(x1,…,x p ) can be publicly converted into the corresponding ciphertext. It is well known that such schemes can be used to build privacy-compliant protocols: a user can store encrypted data on a server and allow third parties to perform operations on the encrypted data without having to reveal the data itself to the server.

[0005] The first fully homomorphic encryption scheme was first proposed in 2009 by Gentry (who was granted U.S. Patent No. 8,630,422 in 2014 based on his first application in 2009); see also Craig Gentry, "Fully homomorphic encryption using ideal lattices," 41st Annual ACM Symposium on Theory of Computing, pp. 169–178, ACM Press, 2009. While Gentry's construction is no longer in use, one of the features it introduced, "bootstrapping," and in particular one of its implementations, has been widely used in subsequently proposed schemes. Bootstrapping is a technique used to reduce noise in ciphertext: in fact, in all known FHE schemes, the ciphertext contains a small amount of random noise, which is necessary for security reasons. Performing operations on noisy ciphertext increases the noise. After evaluating a given number of operations, this noise can become so high that it can compromise the computational results. Therefore, although bootstrapping is fundamental to the construction of homomorphic encryption schemes, this technique is very expensive in terms of memory usage or computation time.

[0006] Research following Gentry's publication aims to provide new methods and improve bootstrapping to make homomorphic encryption practically viable. The most famous constructions are DGHV [Marten van Dijk, Craig Gentry, Shai Halevi, and Vinod Vaikuntanathan, "Fully homomorphic encryption over the integers," Advances in Cryptology-EUROCRYPT2010, Lecture Notes in Computer Science, vol. 6110, pp. 24-43, Springer, 2010], BGV [Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan, "(Levelled) fully homomorphic encryption without bootstrapping," ITCS2012; 3rd Innovations in Theoretical Computer Science, pp. 309-325, ACM Press, 2012], and GSW [Craig Gentry, Eds., Amit Sahai, Brent Waters, "Homomorphic encryption from learning with errors: Conceptually simpler, asymptotically faster, attribute-based," Advances in Cryptology-CRYPTO2013, Part I, Lecture Notes in Computer Science, Vol. 8042, pp. 75-92, Springer, 2013] and its variants. While Gentry's original bootstrapping implementation was not practically feasible (one lifetime was insufficient to complete the computation), subsequent constructions made this operation feasible, although less practical (each bootstrapping lasted several minutes).In 2015, Ducas and Micciancio proposed a faster bootstrapping method, performed in a GSW-type manner [Leo Ducas and Daniele Micciancio, "FHEW: Bootstrapping homomorphic encryption in less than a second", Advances in Cryptology-EUROCRYPT2015, Part I, Lecture Notes in Computer Science, Volume 9056, pp. 617-640, Springer, 2015]: the bootstrapping operation runs in just over half a second. In 2016, Chillotti, Gama, Georgieva, and Izabachene proposed a new variant of the FHE scheme called TFHE [IIaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene, "Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds," Advances in Cryptology-ASIACRYPT2016, Part I, Lecture Notes in Computer Science, Volume 10031, pp. 3-33, Springer, 2016]. Their bootstrapping technique has become the basis for subsequent work.Reference can be made to the works of Bourse et al. [Florian Bourse, Micheles Minelli, Matthias Minihold, and Pascal Paillier, "Fast homomorphic evaluation of deep discretized neural networks," Advances in Cryptology-CRYPTO2018, Part III, Lecture Notes in Computer Science, Vol. 10993, pp. 483-512, Springer, 2018], Carpov et al. [Sergiu Carpov, Malika Izabachene, and Victor Mollimard, "New techniques for multi-value input homomorphic evaluation and applications," Topics in Cryptology-CT-RSA2019, Lecture Notes in Computer Science, Vol. 11405, pp. 106-126, Springer, 2019], and Boura et al. [Christina Boura, Nicolas Gama, Mariya Georgieva, and Dimitar Jetchev, "Simulating homomorphic evaluation of deep learning"]. "Fast fully homomorphic encryption over the torus," Journal of Cryptology, 31(1), pp. 34-91, 2020. The performance of TFHE is remarkable. They have contributed to the advancement of research in this field and to the practical application of homomorphic encryption.The proposed new technique allows bootstrapping to be calculated in a few milliseconds. [Prior art documents] [Patent documents]

[0007] [Patent Document 1] U.S. Patent No. 8,630,422 [Non-patent literature]

[0008] [Non-Patent Document 1] Craig Gentry, "Fully homomorphic encryption using ideal lattices," 41st Annual ACM Symposium on Theory of Computing, pp. 169-178, ACM Press, 2009. [Non-patent document 2] Marten van Dijk, Craig Gentry, Shai Halevi, and Vinod Vaikuntanathan, "Fully homomorphic encryption over the integers", Advances in Cryptology-EUROCRYPT2010, Lecture Notes in Computer Science, volume 6110, pp. 24-43, Springer, 2010. [Non-patent document 3] Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan, "(Leveled) fully homomorphic encryption without bootstrapping", ITCS2012;3rd Innovations in Theoretical Computer Science, pp. 309-325, ACM Press, 2012. [Non-patent document 4] Craig Gentry, Eds., Amit Sahai, and Brent Waters, "Homomorphic encryption from learning with errors: Conceptually simpler, asymptotically faster, attribute-based," Advances in Cryptology-CRYPTO2013, Part I, Lecture Notes in Computer Science, volume 8042, pp. 75-92, Springer, 2013. [Non-Patent Document 5] Leo Ducas and Daniele Micciancio, "FHEW: Bootstrapping homomorphic encryption in less than a second," Advances in Cryptology-EUROCRYPT2015, Part I, Lecture Notes in Computer Science, volume 9056, pp. 617-640, Springer, 2015. [Non-patent document 6] IIaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene, "Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds," Advances in Cryptology-ASIACRYPT2016, Part I, Lecture Notes in Computer Science, volume 10031, pp. 3-33, Springer, 2016. [Non-Patent Document 7] Florian Bourse, Micheles Minelli, Matthias Minihold, and Pascal Paillier, "Fast homomorphic evaluation of deep discretized neural networks," Advances in Cryptology-CRYPTO2018, Part III, Lecture Notes in Computer Science, Volume 10993, pp. 483-512, Springer, 2018. [Non-patent document 8] Sergiu Carpov, Malika Izabachene, and Victor Mollimard, "New techniques for multi-value input homomorphic evaluation and applications," Topics in Cryptology-CT-RSA2019, Lecture Notes in Computer Science, volume 11405, pp. 106-126, Springer, 2019 [Non-Patent Document 9] Christina Boura, Nicolas Gama, Mariya Georgieva, and Dimitar Jetchev, "Simulating homomorphic evaluation of deep learning predictions," Cyber ​​Security Cryptography and Machine Learning (CSCML2019), Lecture Notes in Computer Science, volume 11527, pp. 212-230, Springer, 2019 [Non-Patent Document 10] Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene, "TFHE: Fast fully homomorphic encryption over the torus," Journal of Cryptology, 31(1), pp. 34-91, 2020. [Non-Patent Document 11] Arey N. Kolmogorov, "On the representation of continuous functions of dynamic variables by superposition of continuous functions of one variable and addition", Dokl. Akad. Nauk SSSR, 114, pp. 953-956, 1957. [Non-Patent Document 12] David A. Sprecher, "On the structure of continuous functions of several variables," Transactions of the American Mathematical Society, 115, pp. 340-355, 1965. [Non-Patent Document 13] Pierre-Emmanuel Leni, Yohan Fougerolle, and Frédéric Truchetet, "Komogorov superposition theory and its application to the decomposition of multivariate functions," MajecSTIC'08, October 29-31, 2008, Marseille, France, 2008 [Non-Patent Document 14] B.F. Logan and L.A. Shepp, "Optimal reconstruction of a function from its projections," Duke Mathematical Journal, 42(4), pp. 645-659, 1975. [Non-Patent Document 15] Allan Pinkus, "Approximating by ridge functions," in A. Le Mehaute, C. Rabut, and L.L. Schumaker (Eds.), Surface Fitting and Multiresolution Methods, pp. 279-292, Vanderbilt University Press, 1997. [Non-Patent Document 16] Jerome H. Friedman and Werner Stuetzle, "Projection pursuit regression," Journal of the American Statistical Association, 76(376), pp. 817-823, 1981. [Non-Patent Document 17] DS Broomhead and David Lowe, "Multivariable functional interpolation and adaptive networks," Complex Systems, 2, pp. 321-355, 1988. [Non-Patent Document 18] Oded Regev, “On lattices, learning with errors, random linear codes, and cryptography,” 37th Annual ACM Symposium on Theory of Computing, pp. 84-93, ACM Press, 2005. [Non-Patent Document 19] Damien Stehle, Ron Steinfeld, Keisuke Tanaka, and Keita Xagawa, "Efficient public key encryption based on ideal lattices," Advances in Cryptology-ASIACRYPT2009, Lecture Notes in Computer Science, volume 5912, pp. 617-635, Springer, 2009. [Non-Patent Document 20] Vadim Lyubashevsky, Chris Peikert, and Oded Regev, "On ideal lattices and learning with errors over rings," Advances in Cryptology-EUROCRYPT2010, Lecture Notes in Computer Science, volume 6110, pp. 1-23, Springer, 2010. [Non-Patent Document 21] Ron Rothblum, "Homomorphic encryption: From private-key to public-key," Theory of Cryptography (TCC2011), Lecture Notes in Computer Science, volume 6597, pp. 219-234, Springer, 2011 [Non-Patent Document 22] David A. Sprecher, "A implementation numerical of Kolmogorov's superpositions," Neural Networks, 9(5), pp. 765-772, 1996. [Non-Patent Document 23] David A. Sprecher, "A implementation numerical of Kolmogorov's superpositions II," Neural Networks, 10(3), pp. 447-457, 1997. [Non-Patent Document 24] Juergen Braun and Michael Griebel, "On a constructive proof of Kolmogorov's superposition theorem," Constructive Approximation, 30(3), pp. 653-675, 2007. Summary of the Invention [Problem to be solved by the invention]

[0009] Despite the progress made, the set of ciphertexts (plaintexts x1,…,x p ) to a given function f(x1,…,x p Known computational procedures capable of publicly converting f into the corresponding ciphertext are limited to a few examples or remain impractical. In fact, the current main common approach is to represent this function in the form of a Boolean circuit composed of AND, NOT, OR, or XOR logic gates, and then homomorphically evaluate this circuit with the ciphertext of bits representing the input (plaintext) of the function f. A measure of the complexity of a Boolean circuit is its multiplication depth, defined as the maximum number of consecutive AND gates that need to be computed to obtain the result. To keep noise under control during this computation, regular bootstrapping operations must be performed along the way. As shown above, even with state-of-the-art techniques, these bootstrapping operations involve complex computations, and the large multiplication depth further slows down the overall computation. This approach is only feasible for functions that operate on binary inputs and have simple Boolean circuits.

[0010] In general, the function to be evaluated takes as input one or more real variables x1,…,x p Take some functions f1,…,f evaluated on a set of real variables. q Therefore, given a set of ciphertexts (plaintexts x1,...,x p ) into multiple real-valued functions f1,…,f q There is great technical and economic interest in finding a way to perform the aforementioned operation of publicly converting a set of ciphertexts corresponding to a given set of ciphertexts into a set of ciphertexts corresponding to a given set of ciphertexts quickly and without mobilizing excessively large computational resources. Indeed, the theoretical advances made by Gentry in 2009 have not found practical implementations to date due to the lack of an effective solution to this technical problem. It is to this problem that the present invention provides a response. [Means for solving the problem]

[0011] This application considers a set of ciphertexts (plaintexts x1,...,x p) into multiple functions f1,…,f q We describe a set of methods intended to be performed digitally by at least one specially programmed information processing system to efficiently and publicly convert a set of multivariate functions f1,...,f q into a form that combines sums and compositions of functions of multiple variables. Preferably, functions f1,...,f q are reused in the evaluation. Finally, each of the single variable functions is preferably represented in tabular form rather than by the usual representation in the form of a Boolean circuit.

[0012] Of note, any multivariate function defined on real numbers and with real values ​​is supported. The entries undergo a pre-encoding to ensure compatibility with the native space of messages of the underlying encryption algorithm. Decryption can also be applied at the output to the image of the function under consideration after decryption.

[0013] The present invention implements a technique for generating a set of multiple functions f1,...,f2 applied to encrypted data, considered independently or in combination, with a significant reduction in complexity and required computation time. q The technical effect of the present invention is significant, since it allows the evaluation of the result of As will be explained below, this weight saving arises, inter alia, from the fact that (i) the multivariable functions to be evaluated are transformed into univariable functions rather than acting directly on functions of several variables, (ii) these functions can be decomposed to share the results of intermediate calculations rather than performing separate evaluations, and (iii) the resulting univariable functions are represented by tables rather than Boolean circuits.

[0014] A function f is a function of several variables x1,…,x p, the method according to the invention is to transform the function f as a combination of summation and composition of functions of a single variable. It should be noted that these two operations, summation and composition of functions of a single variable, allow the expression of an affine transformation or a linear combination. By analogy with neural networks, the expression "network of functions of a single variable" is used to refer to the representation when the transformation from multivariable to univariable is completed, combining summation and composition of functions of a single variable, and this network is evaluated homomorphically with multiple encrypted values. The transformation can be exact or approximate; nevertheless, it should be noted that an exact transformation is an approximate transformation without errors. In practice, the network thus obtained is characterized by a shallow depth compared to a Boolean circuit implementing the same function. This new representation of the function f is then used to generate the encrypted inputs E(encode(x1)), ..., E(encode(x p )) where E is the encryption algorithm and encode is the encoding function, which generates a function of type E(encode(z k Starting from the inputs of some univariate function g j The type of E(encode(g j (z k ))) can be calculated, where z k are intermediate results. These calculations exploit the homomorphic properties of encryption algorithms.

[0015] It is interesting that when reusing the same network of univariate functions several times, it is not necessary to redo all the calculation steps. Thus, according to the invention, the first step consists in precomputing said network of univariate functions; it is then homomorphically evaluated on the encrypted data in subsequent steps.

[0016] The fact that any continuous multivariate function can be written as a sum and composition of univariate functions was demonstrated by Kolmogorov in 1957 [Arey N. Kolmogorov, "On the representation of continuous functions of dynamic variables by superposition of continuous functions of one variable and addition", Dokl. Akad. Nauk SSSR, 114, pp. 953-956, 1957].

[0017] This result remained theoretical for a long time, but algorithmic versions were discovered, notably by Sprecher, who proposed an algorithm explicitly describing how to construct functions of one variable [David A. Sprecher, "On the structure of continuous functions of several variables," Transactions of the American Mathematical Society, 115, pp. 340-355, 1965]. A detailed description can be found, for example, in the following article [Pierre-Emmanuel Leni, Yohan Fougerolle, and Frédéric Truchetet, "Komogorov superposition theory and its application to the decomposition of multivariate functions," MajecSTIC'08, October 29-31, 2008, Marseille, France, 2008]. Furthermore, it should be noted that the assumption of continuity of the decomposed functions can be relaxed by considering the latter's approximation.

[0018] Another possible approach consists in approximating a multivariate function by a sum of certain multivariate functions called, in English terminology, ridge functions [B.F. Logan and L.A. Shepp, "Optimal reconstruction of a function from its projections", Duke Mathematical Journal, 42(4), pp. 645-659, 1975]. Given a vector of real-valued variables x=(x1,…,x p ) is a real parameter vector a=(a1,…,a p ), that is, functions of type g a A function of (x) = g(a·x), where g is univariate. As mentioned above, scalar products or equivalent linear combinations are particular cases of summation and composition of univariate functions; decomposition of a multivariate function in the form of a summation of ridge functions forms an embodiment of the multivariate-to-univariate transformation according to the present invention. It is known that any multivariate function can be approximated with as much accuracy as necessary by a summation of ridge functions, provided the number of ridge functions can be increased [Allan Pinkus, "Approximating by ridge functions," in A. Le Mehaute, C. Rabut, and L.L. Schumaker (Eds.), Surface Fitting and Multiresolution Methods, pp. 279-292, Vanderbilt University Press, 1997]. These mathematical results gave rise to a statistical optimization method known as projection pursuit [Jerome H. Friedman and Werner Stuetzle, "Projection pursuit regression," Journal of the American Statistical Association, 76(376), pp. 817-823, 1981].

[0019] Instead of the ridge function, g aIt is also possible to use so-called radial functions of the type (x)=g(||xa||) [D.S. Broomhead and David Lowe, "Multivariable functional interpolation and adaptive networks", Complex Systems, 2, pp. 321-355, 1988], and other families of basis functions can be used with similar approximation quality (convergence rate).

[0020] In some cases, a formal decomposition is possible without going through Kolmogorov's theorem or one of its algorithmic versions (such as Sprecher's), or through ridge functions, radial functions, or their variants. For example, the function g(z1,z2)=max(z1,z2) (which serves, among other things, as the so-called "max pooling" layer used in neural networks) can thus be decomposed as: max(z1,z2)=z2+(z1-z2). + , where:

number

number

[0021] Functions f,…,f q Given a set of data, each of which is intended to be represented by a network of univariate functions and then homomorphically evaluated on the encrypted data, this evaluation can be performed in an optimized manner if all or part of one or more of these univariate functions are reused. Thus, for each redundancy observed in the set of univariate functions of the network, some of the steps of homomorphic evaluation of the univariate functions on the encrypted values ​​need only be performed once. Knowing that this function homomorphic evaluation is usually done on the fly and places a heavy burden on processing speed, sharing intermediate values ​​can result in significant performance gains.

[0022] Three types of optimizations can be considered:

[0023] Same function, same arguments In the case of an equal number of univariate functions, this optimization consists in prioritizing networks of univariate functions that repeat the same univariate function applied to the same arguments the maximum number of times. Indeed, whenever a univariate function and the input on which it is evaluated are the same, there is no need to recompute the homomorphic evaluation of this univariate function for this input.

[0024] Different functions, same arguments This optimization applies when homomorphic evaluations of two or more single-variable functions on the same input can be performed essentially at the expense of a single homomorphic evaluation, resulting in an embodiment that allows for the sharing of a large portion of the computation. The aforementioned CT-RSA 2019 article considers a similar situation under the name of the multi-output version. An example of such an embodiment is given in the section "Description of the Invention." In the multivariate case, this situation can be seen, for example, in the decomposition coefficients (a ik ) is fixed, it appears in the decomposition of some multivariate functions in the form of a sum of ridge or radial functions.

[0025] Same function, arguments differing by a non-zero additive constant Another situation in which computations can be sped up is when the same univariate function is evaluated for arguments whose difference is known. This occurs, for example, when Kolmogorov-type decompositions, particularly versions of Sprecher's approximation algorithm, are used. In this situation, the decomposition involves so-called "inner" univariate functions; see especially the application to inner functions Ψ in the "Description of Embodiments" section. The additional cost in the latter case is minimal.

[0026] These optimizations are performed on several functions f1,…,f qThey apply when a single function needs to be evaluated (q=1), but they also apply when there is a single function to be evaluated (q=1). In all cases, it is interesting to prefer different functions for the same arguments, or to prefer the same function for arguments that differ by an additive constant, in order to not only create a reduced number of univariate functions, but also to reduce the cost of their evaluation. This property is inherent in networks of univariate functions when they are evaluated homomorphically on encrypted inputs.

[0027] Whether the functions to be evaluated according to the invention are multivariate and formed via the first step described above, or whether it is intended to process original univariate functions, the invention provides for carrying out homomorphic evaluations of these univariate functions, and in an advantageous variant uses a tabular representation for this purpose.

[0028] Homomorphic evaluation of functions of one variable, or more generally of combinations of functions of one variable, is based on homomorphic encryption methods.

[0029] The Learning With Errors (LWE) problem, introduced by Regev in 2005 [Oded Regev, "On lattices, learning with errors, random linear codes, and cryptography," 37th Annual ACM Symposium on Theory of Computing, pp. 84-93, ACM Press, 2005], allows the construction of homomorphic encryption schemes for a large number of algebraic structures. Typically, an encryption scheme includes an encryption algorithm E and a decryption algorithm D, such that if c = E(μ) encrypts a plaintext μ, then D(c) returns the plaintext μ. Encryption algorithms derived from the LWE problem and its variants have the peculiarity of introducing noise into the ciphertext. This is called the native space of plaintexts, which refers to the space of plaintexts over which an encryption algorithm is defined and over which the decryption of the ciphertext results in the original plaintext. This takes noise into account. Recall that for an encryption algorithm E with M as the native space of plaintexts, the encoding function encode is a function that brings the elements of any set into the set M or a subset thereof; preferably, this function is injective.

[0030] As detailed in the aforementioned article by Chillotti et al. (ASIACRYPT2016), the torus of the real numbers modulo 1

number

number

number

number

number

number

number

number

[0031] In the same article, the author

number

number

number

number

number

number

number

number

number

[0032]

number

number

number

number

number

number

number

number

number

number

[0033] Finally, this same article from ASIACRYPT2016 introduces the outer product between RLWE-type ciphertexts and RGSW-type ciphertexts (short for Gentry-Sahai-Waters, where "R" stands for ring). Recall that an RLWE-type encryption algorithm gives rise to an RGSW-type encryption algorithm. The notation from the previous paragraph is used. For integers l ≥ 1, Z is

number

[0034]

number

number

number

number

number

number

number

number

number

number

number

[0035] As shown, the above schemes are so-called symmetric or secret-key encryption schemes. This is by no means a limitation, since any additively homomorphic secret-key encryption scheme can be converted into a public-key encryption scheme, as shown by Rothblum [Ron Rothblum, "Homomorphic encryption: From private-key to public-key", Theory of Cryptography (TCC2011), Lecture Notes in Computer Science, Vol. 6597, pp. 219-234, Springer, 2011].

[0036] As we recalled above, bootstrapping refers to a method that allows reducing noise that may be present in a ciphertext. In his aforementioned STOC2009 inaugural article, Gentry implemented bootstrapping using the technique he introduced, now commonly referred to as "re-encryption." Re-encryption consists in homomorphically evaluating a decryption algorithm in the encrypted domain. In the plaintext domain, the decryption algorithm takes as input a ciphertext C and a secret key K and returns the corresponding plaintext x. In the encrypted domain, using a homomorphic encryption algorithm E and an encoding function encode, the evaluation of said decryption algorithm takes as input the ciphertext of the encryption of C and the ciphertext of the encryption of K, E(encode(C)) and E(encode(K)), respectively, and thus yields a new ciphertext, E(encode(x)), of the encryption of the same plaintext under the encryption key of algorithm E. Therefore, assuming a ciphertext as the output of homomorphic encryption algorithm E does not constitute a restriction, as the re-encryption technique allows this case to be resolved.

[0037] The homomorphic nature of LWE-type encryption schemes and their variants allows us to compute plaintexts by operating on the corresponding ciphertexts. The domain of definition of the univariate function f to be evaluated is discretized into several intervals that cover the domain of definition. Each interval is a function of the value x i and the function f(x i ) corresponding values. Therefore, the function f is expressed as (x i ,f(x i )) which are actually used to homomorphically compute the ciphertext of f(x), or an approximation starting from the ciphertext of x, for any value of x in the domain of the function's definition.

[0038] In the present invention, at the core of this homomorphic computation is a new general technique that combines bootstrapping and encoding. Some embodiments are described in the Detailed Description section.

[0039] The homomorphic assessment techniques described in the aforementioned ASIACRYPT2016 article and those introduced in the aforementioned subsequent work are unable to perform homomorphic evaluation of arbitrary functions over arbitrary domains. First, they are strictly limited to functions of univariate type. The prior art is unaware of any equivalents for the multivariate case. Furthermore, in the univariate case, the prior art assumes conditions on the input values ​​or the function being evaluated. Among these limitations, note, for example, the inputs restricted to binary values ​​(bits) and the required negative cyclic nature of the function being evaluated (as verified, for example, by the "sign" function on a torus). No general processing of input or output values ​​that allows for these specific cases to be achieved has been described in the prior art for functions with arbitrary real values.

[0040] Conversely, our implementation allows homomorphic evaluation of functions with real-valued variables in the input, which are real-valued LWE-type ciphertexts, regardless of the form of the function or the domain of definition, while allowing for control of noise in the output (boosting). [Brief explanation of the drawings]

[0041] [Figure 1] FIG. 1 is a schematic reproduction of the first two steps. [Figure 2] As an example, the case where p=2 is shown in the figure. [Figure 3] 1 is a diagram illustrating a single variable function f of a real-valued variable with arbitrary precision in the domain of definition D and real values ​​in image I. DETAILED DESCRIPTION OF THE INVENTION

[0042] The present invention involves applying, to the encrypted data, by at least one specially programmed information processing system, one or more functions f1,...,f2 using one or more real-valued variables. q allows the evaluation of each function to be performed digitally, with the real variables x1,…,x p It takes multiple real variables from

[0043] When at least one of said functions takes at least two variables as input, the method according to the invention generally comprises three steps: 1. A so-called pre-computation step, which consists in transforming each of the multivariable functions into a network of univariable functions composed of sums and compositions of univariable real-valued functions; 2. A so-called pre-selection step, which consists in identifying different types of redundancies in the pre-computed univariate function network and selecting all or some of them; 3. A step of so-called homomorphic evaluation of each of the precomputed networks of univariate functions, in which the redundancies selected in the preselection step are evaluated in an optimized way.

[0044] Regarding the second step (pre-selection), the choice of all or part of the redundancy is not primarily guided by the objective of optimizing the digital processing of the homomorphic evaluation, whether it be for gains in terms of computation time or for reasons of availability of memory resources for storing intermediate computation values, etc.

[0045] FIG. 1 reproduces the first two steps diagrammatically as they are implemented according to the invention by a computer system programmed for this purpose.

[0046] Thus, in one embodiment of the present invention, one or more multivariate real-valued functions f1,...,f q where each function is evaluated using variables x1,...,x p and at least one of the functions takes at least two variables as inputs, and the input x i , E(encode(x i )) as inputs, and apply f1,…,f to each of those inputs, for 1 ≤ i ≤ p. q where E is a homomorphic encryption algorithm, and encode returns the elements of the native space of the plaintext of E as real numbers x ione or more multivariate real-valued functions f1,…,f q Rating: 1. A pre-computation step consisting in transforming each of said multivariable functions into a network of univariable functions composed of sums and compositions of univariable real-valued functions; 2. In the network of precomputed univariate functions, three types a. The same univariate function applied to the same arguments, b. Different univariate functions applied to the same arguments, c. The same univariate function applied to arguments differing by a non-zero additive constant, a pre-selection step, which consists in identifying redundancies in one of the 3. A step of homomorphic evaluation of each of the precomputed networks of univariate functions, where the redundancies selected in the preselection step are evaluated in an optimized way. There may be such a feature.

[0047] Regarding the precomputation step, an explicit version of Kolmogorov's superposition theorem allows us to find the identity hypercube Ip=[0,1] of dimension p. p Any continuous function defined by

number

number

number

number

[0048] As an example, Figure 2 shows the case where p=2.

[0049] The functions Ψ and ξ are so-called "interior" functions, independent of f of a given arity. The function Ψ is p real vector (x1,…,x p ) any component x i The function ξ associates the values ​​[0,1] with each vector (x1,…,x p )∈I p to a number in the interval [0,1]

number

[0050] Sprecher proposed algorithms for determining the intrinsic and extrinsic functions in [David A. Sprecher, "A numerical implementation of Kolmogorov's superpositions", Neural Networks, 9(5), pp. 765-772, 1996] and [David A. Sprecher, "A numerical implementation of Kolmogorov's superpositions II", Neural Networks, 10(3), pp. 447-457, 1997], respectively.

[0051] Instead of the function Ψ originally defined by Sprecher to construct ξ (which is discontinuous for some input values), we can use the function Ψ defined in [Jurgen Braun and Michael Griebel, "On a constructive proof of Kolmogorov's superposition theorem", Constructive Approximation, 30(3), pp. 653-675, 2007].

[0052] Once the inner functions Ψ and ξ are fixed, the outer function g k (which depends on the function f). For this purpose, Sprecher considers the summation to be a function of the external function g k r function that converges towards

number

number

number

number

number

[0053] Thus, in one embodiment of the present invention, the pre-computation stage includes: q At least one function f from jFor , the transformation of the precomputation step is

number

number

[0054] Multivariate function f(x1,…,x p Another technique for decomposing

number

[0055] So, decomposition is an approximation in the general case, aiming to identify the best approximation, or an approximation of sufficient quality. This approximation appears in the literature dedicated to statistical optimization as projection pursuit. As mentioned above, a remarkable result is that any function f can be approximated in this way with arbitrarily high accuracy. In practice, however, f typically admits exact decomposition, i.e., it is analytically expressed in the form of a sum of ridge functions over all or some of its inputs.

[0056] Function f jBut for t ≤ p, {x1,…,x p} as input, these variables are j1,…,j t ∈{1,…,p}

number

number

number

[0057] Therefore, in one embodiment of the present invention, the pre-computation stage is performed on f1,...,f q At least one function f from j For , the transformation of the precomputation step is

number

[0058] A similar decomposition technique using the same statistical optimization tools would yield a ridge function rather than a

number

[0059] Function f j is the input, and for t ≤ p, {x1,…,x p}, j1,…,j t ∈{1,…,p} to define these variables as

number

number

number

[0060] Therefore, in one embodiment of the present invention, the pre-computation stage is performed on f1, ..., f q At least one function f j For , the transformation of the precomputation step is

number

number

[0061] As shown in the aforementioned Pinkus article, another important class of decompositions of functions is i , k When is fixed, the function g k is a variable. This class applies to both ridge and radial decompositions. Several methods are known to solve this problem: the von Neumann algorithm, the cyclic coordinate algorithm, the Schwarz domain decomposition, the Diliberto-Strauss algorithm, and variations that can be found in the specialized literature on tomography; see this same Pinkus article and the references therein.

[0062] Therefore, in one particular embodiment of the present invention, this pre-calculation step involves the coefficient a i , k is fixed.

[0063] In some cases, the transformation of the pre-computation step can be done exactly by an equivalent formal representation of the multivariate function.

[0064] Consider a multivariate function g. If this function g computes the maximum of z1 and z2, g(z1,z2)=max(z1,z2), then there is a formal equivalent, max(z1,z2)=z2+(z1-z2). + You can use

number

number

number

number

number

[0065] In general, three or more variables z1,…,z m If max(z1,…,z i ,z i+1 ,…,z m )=max(max(z1,…,z i ),max(z i+1 ,…,z m )), then max(z1,…,z m ) is therefore a function of summation and function |·| (absolute value) or (·) + is repeatedly obtained as a combination of

[0066] Therefore, in one embodiment of the present invention, the pre-computation step is transformed into the formal equivalent max(z1,z2)=z2+(z1-z2). + Use the function

number

[0067] In a particular embodiment of the invention, this pre-calculation stage is further characterized in that, when the multivariate function contains three or more variables, a formal equivalence is obtained for said function from an iteration of the formal equivalence for two variables.

[0068] Similarly, for the "minimum" function g(z1,z2) = min(z1,z2), there is a formal equivalent min(z1,z2) = z2 + (z1 - z2). - You can use

number

number

[0069] Therefore, in one embodiment of the present invention, the pre-computation stage is performed by transforming the formal equivalent min(z1,z2)=z2+(z1-z2) - Use the function

number

[0070] In a particular embodiment of the invention, this pre-computation stage is further characterized in that for said function, when the latter contains three or more variables, a formal equivalence is obtained from a repetition of the formal equivalence for two variables.

[0071] Another very useful function of multiple variables that can be easily formally decomposed into a combination of sums and compositions of functions of single variables is multiplication. A first embodiment is given by: for g(z1,z2)=z1×z2, the formal equivalent z1×z2=(z1+z2) 2 / 4-(z1-z2) 2 / 4 is a univariate function

number

number

[0072] Therefore, in one embodiment of the present invention, the pre-computation stage is performed such that the transformations in this pre-computation step are formally equivalent z1 × z2 = (z1 + z2) 2 / 4-(z1-z2) 2 Using the / 4 function

number

[0073] These embodiments are z1×...×z for 1≦i≦m−1. i ×z i+1 ×…×z m =(z1×…×z i )×(z i+1 ×…×z m ) generalizes to m-variable functions for m ≥ 3 by observing

[0074] In a particular embodiment of the invention, this pre-computation stage is further characterized in that for said function, when the latter contains three or more variables, a formal equivalence is obtained from a repetition of the formal equivalence for two variables.

[0075] The second embodiment is a single variable function

number

number

number

number

number

number

[0076] Therefore, in one embodiment of the present invention, the pre-computation stage is such that the transformation of this pre-computation step uses the formal equivalent |z1 × z2| = exp(ln|z1| + ln|z2|) and computes the function as a combination of sums and compositions of functions of a single variable.

number

[0077] In a particular embodiment of the invention, this pre-computation stage is further characterized in that for said function, when the latter contains three or more variables, a formal equivalence is obtained from a repetition of the formal equivalence for two variables.

[0078] As mentioned above, a function of many variables given as input is transformed into a network of functions of many variables, and such a network is not necessarily unique, even if the transformation is exact.

[0079] For example, as mentioned above, the multivariate function max(x1,x2) i.e. max(x1,x2)=x2+(x1-x2) + and max(x1,x2) = (x1 + x2 + |x1 - x2|) / 2. Specifically, each of these transformations can proceed in detail as follows:

[0080] 1. max(x1,x2)=x2+(x1-x2) + Suppose z1=x1-x2, then g1(z)=z + Define Write max(x1,x2)=x2+g1(z1).

[0081] 2.max(x1,x2)=(x1+x2+|x1-x2|) / 2 Assume z1=x1-x2 and z2=x1+x2. Define g1(z) = |z| and g2(z) = z / 2. Write z3 = z2 + g1(z1) and max(x1, x2) = g2(z3).

[0082] In general, two types of operations are observed in networks of univariate functions: summation and evaluation of univariate functions. When the evaluation of the network is performed homomorphically on encrypted values, the most expensive operation is the evaluation of univariate functions, since this usually involves a bootstrapping step. Therefore, it is interesting to create networks of univariate functions that minimize these univariate function evaluation operations.

[0083] So in the previous example, the first transformation of the "max" function [max(x1,x2)=x2+(x1-x2) + ] is the evaluation of one univariate function, i.e., the function g1(z)=z + It can be seen that this seems more advantageous, since only the evaluation of |x1 - x2| is required. In practice, the difference is not noticeable, since the second univariate function of the second transformation does not actually need to be evaluated; all that is required is to return 2max(x1,x2) = x1 + x2 + |x1 - x2|, or to integrate this factor into the output decoding function. In general, univariate functions that are multiplications by constants can be ignored by (i) computing a multiple of the starting function, or (ii) "absorbing" the constant by composition, if these functions are at the input of another univariate function. For example, the multivariate function sin(max(x1,x2)) can be written as

[0084] 1.sin(max(x1,x2))=sin(x2+(x1-x2) + ) Suppose z1=x1-x2, then g1(z)=z + Define Define g2(z)=sin(z).

[0085] 2.Write sin(max(x1,x2))=g2(z2) with z2=x2+g1(z1). sin(max(x1,x2))=sin((x1+x2+|x1-x2|) / 2) Assume z1=x1-x2 and z2=x1+x2. Define g1(z) = |z| and g2(z) = sin(z / 2).

[0086] 3. Write sin(max(x1,x2))=g2(z3) with z3=z2+g1(z1). (In the second case, the function g2(z)=sin(z / 2)

number

[0087] Apart from univariate functions of the type g(z) = z + a (addition of a constant a) or g(z) = az (multiplication by a constant a), evaluation of univariate functions can be faster in other situations.

[0088]

number

number

[0089] Three types of optimizations are considered:

[0090] 1) Same function, same arguments: g k = g k’ and

Number

Number

Number

Number

[0091] 2) Different functions, same arguments: g k ≠ g k’ and

Number

Number

[0092] a. max(x1,x2)+|x1×x2| = x2+(x1 - x2) a. max(x1,x2)+|x1×x2| = x2+(x1 - x2)+ +exp(ln|x1|+ln|x2|) Suppose z1=x1-x2, then g1(z)=z + Define Define g2(z) = ln|z| and g3(z) = exp(z). Using z2 = g2(x1) + g2(x2), write max(x1, x2) + |x1 × x2| = x2 + g1(z1) + g3(z2). b.max(x1,x2)+|x1×x2|=x2+(x1-x2) + +|(x1+x2) 2 / 4-(x1-x2) 2 / 4| Suppose z1=x1-x2, then g1(z)=z + Define Suppose z2=x1+x2, then g2(z)=z 2 / 4 and define g3(z) = |z| Using z3 = g2(z2) - g2(z1), write max(x1, x2) + |x1 × x2| = x2 + g1(z1) + g3(z3).

[0093] The above two embodiments involve four univariate function evaluations, but the second embodiment involves two univariate functions in the same argument, namely g1(z1) and g2(z1).

[0094] The sharing of univariate functions of the same arguments is not limited to transformations performed by equivalent formal representations: it also applies to digital transformations.

number

number

number

[0095] In this construction, the so-called "internal" functions Ψ and ξ are independent of f for a given domain of definition. Hence, several multivariate functions f,…,f defined in the same domain q If is homomorphically evaluated, then the homomorphic evaluations of the functions Ψ and ξ do not need to be recomputed when they are applied to the same input. This situation is seen, for example, in the coefficients (a ik ) is fixed, it also appears in the decomposition of some multivariate functions using ridge or radial functions.

[0096] 3) Same function, arguments differing by an additive constant: Known constant a k For ≠0, g k =g k’ and

number

[0097] For example, still in Sprecher's construction, the homomorphic evaluation of f above requires variables that differ additively by a constant value, i.e., x where 1 ≤ i ≤ p and ka are known. i +ka, where Ψ(x for 1 ≤ k ≤ K) is included. i +ka) is the encrypted value of Ψ(x i ), one embodiment of which is detailed below.

[0098] Formally, their respective arguments,

number

Number

Number

Number

Number

[0099] As shown in "Figure 3", in the case of a univariate function f of any real-valued variable with arbitrary precision in the domain of definition D and having real values in the image I,

Number

number

number

number

number

number

number

number

number

number

number

number

[0100] Thus, in one of its embodiments, the invention covers the approximate homomorphic evaluation of a univariate function f of a real-valued variable x with arbitrary precision in a domain of definition D and real values ​​in image I, performed digitally by a specially programmed information processing system, taking as input the ciphertext of the encryption of x, E(encode(x)), and returning an encrypted ciphertext, E'(encode'(y)), of an approximation of f(x), where y ≈ f(x), E and E' are homomorphic encryption algorithms whose respective native spaces of the plaintext are M and M', and the evaluation is: an integer N ≥ 1 that quantifies the actual precision of the representation of the variables in the inputs of the function f being evaluated, An encoding function encode that takes as input an element of domain D and associates it with an element of M, an encoding function encode' that takes as input an element of image I and associates it with an element of M', A discretization function, discretise, that takes as input the elements of M and associates them with integer indices. Encryption algorithm E H and the native space M H is a homomorphic encryption scheme with cardinality of at least N, Takes an integer as input and H An encoding function that returns the elements of H and the image of the domain D is then parameterized by encoding followed by discretization,

number

[0101] Using these parameters, said approximate homomorphic evaluation of a univariate function f requires the implementation of the following two successive steps by a specially programmed information processing computer system:

[0102] 1. Pre-calculating a table corresponding to the single-variable function f, a. Divide the domain D into N selected subintervals R0,…,R N-1 the union of which is D, For each index i in bS={0,…,N-1}, the subinterval R i determining a representative x(i) of the equations and calculating the value y(i)=f(x(i)); c. Return a table T consisting of N elements T[0], …, T[N-1], with T[i] = y(i) for 0 ≤ i ≤ N-1. This is the step.

[0103] 2. A step of homomorphic evaluation of a table, ax∈R i , the index in the set S={0,…,N-1}

number

number

number

number

number

number

number

number

[0104] The domain of the definition D of the function f to be evaluated is the real interval [x min ,x max ), then there are N subintervals R that cover D. i (for 0≦i≦N-1) can be chosen as the half-open interval

number

number

[0105] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a single variable function f is The domain of the definition of the function f to be evaluated is the real interval D=[x min ,x max ) is given by N intervals R covering the region D i (for 0≦i≦N-1) is a half-open subinterval

number

[0106] Encoding function encode H Algorithm E H The choice of E(encode(x))

number

number

number

[0107] Therefore, in one embodiment of the present invention, approximate homomorphic evaluation of a single-variable function f is performed when the set S is an additive group for integers M≧N.

number

[0108] group

number

number

[0109] The modular multiplication operation (X M - 1) induces a group isomorphism between the additive group [Number] and the set of M-th roots of unity {1, X,..., X M-1}}. When M is even, the relation X M = 1 means X M / 2 = - 1. Thus, [Number] for X i+j = X i · X j (mod(X M / 2 + 1)) is obtained, and the set of M-th roots of unity is {±1, ±X,..., ±X (M / 2)-1}}. [[ID=​​​​​​​​​​

number

number

[0111] Homomorphic encryption algorithm E is a torus

number

number

number

number

number

number

[0112] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a single variable function f is performed by a homomorphic encryption algorithm E on a torus

number

number

[0113] The discretization function discretise is then parameterized for integers M ≥ N as a function relating to an element t of the torus an integer rounding of a product M × t modulo M, where M × t is

number

number

number

[0114] This discretization function extends naturally to vectors in a torus.

number

number

number

number

number

number

number

number

number

number

[0115]

number

number

number

number

number

number

number

number

number

number

number

number

[0116] Thus, in one embodiment of the present invention, approximate homomorphic evaluation of a single variable function f is The encoding function encode is a subinterval of a torus.

number

number

number

number

[0117] The domain of the definition of the function f to be evaluated is the real interval D=[x min ,x max ), and the native space of plaintext M is a torus

number

number

number

number

[0118] Therefore, in one embodiment of the present invention, approximate homomorphic evaluation of a single variable function f is performed when the domain of definition of function f is the real interval D=[x min ,x max ), the encoding function encode is

number

[0119] construction

number

number

number

number

number

number

number

number

number

number

number

number

[0120] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a single variable function f is performed using a homomorphic encryption algorithm E His an LWE type encryption algorithm, and the encoding function encode H is further characterized as being the identity function.

[0121] From E(encode(x))

number

number

number

number

number

number

number

[0122]

number

number

number

number

number

number

number

number

[0123] In this case, E H teeth

number

number

number

number

number

[0124] Therefore, RLWE(m) is the key (s'1,...,s' k ) under

number

number

number

[0125] Therefore, in one embodiment of the present invention, approximate homomorphic evaluation of a univariate function f parameterized by an even integer M is performed using the homomorphic encryption algorithm E H is an RLWE type encryption algorithm,

number

number

number

[0126] According to any one of the previous two embodiments,

number

[0127] 1. The first case is the encoding function encode H but

number

number

number

number

number

number

number

number

number

[0128] 2. The second case is any polynomial

number

number

number

number

number

number

number

number

number

number

number

[0129] In particular, for integers L>1,

number

number

number

number

number

number

[0130] In both cases, the return of this first substep of the homomorphic evaluation of table T is the expected polynomial

number

number

number

number

number

[0131] The second substep of the homomorphic evaluation of table T (common to both cases) is to

number

number

number

number

number

number

number

number

number

number

[0132] For each 1≦j≦k, the polynomial

number

number

number

number

number

number

number

number

[0133] Once this calculation is complete, the ciphertext

number

[0134] Therefore, in one embodiment of the present invention, approximately homomorphic evaluation of a univariate function f parameterized by an even integer M equal to 2N yields an LWE-type ciphertext on a torus.

number

number

number

number

[0135] The image I of the function f to be evaluated is in the real interval [y min ,y max) and the native space of the plaintext M' of the LWE encryption is a torus

number

number

number

[0136] Thus, in one embodiment of the present invention, approximate homomorphic evaluation of a single-variable function f is performed by determining whether the image of the function f lies in the real interval I=[y min ,y max ), then The homomorphic encryption algorithm E' is a torus

number

number

number

number

[0137] When adding ciphertexts, we need to take the encoding into account. If we denote the encoding function of a homomorphic encoding algorithm E as encode, then we obtain E(μ1 + μ2) = E(μ1) + E(μ2) with μ1 = encode(x1) and μ2 = encode(x2). If the encoding function is homomorphic, then we indeed obtain E(encode(x1 + x2)) = E(encode(x1)) + E(encode(x2)). Otherwise, if the encoding function is not additive, we need to apply a correction ε to the encoding: ε = encode(x1 + x2) - encode(x1) - encode(x2), so that E(encode(x1 + x2)) = E(encode(x1)) + E(encode(x2)) + E(ε). In particular, if the encoding is

number

number

[0138] Of course, the previous considerations are also valid for images. For a homomorphic encryption algorithm E' with encoding function encode', we obtain E'(encode'(f(x1)+f(x2)))=E'(encode'(f(x1)))+E'(encode'(f(x2)))+E'(ε') for correction ε'=encode'(f(x1)+f(x2))-encode'(f(x1))-encode'(f(x2)). In particular, if the encoding encode' conforms to addition, then the correction ε' is zero. The correction ε' is given by

number

number

[0139] Another important particular case is when we need to homomorphically evaluate the same univariate function f on inputs x1 and x2 = x1 + A for a given constant A. A typical example of this application is the inner function Ψ in the aforementioned Sprecher application. For a homomorphic encryption algorithm E with an encoding function encode, given the fact that E(encode(x1)), we can deduce E(encode(x2)) = E(encode(x1 + A)), and then obtain E'(encode'(f(x1))) and E'(encode'(f(x2))) as described above. However, all steps must be repeated. In the particular case where E is an LWE-type algorithm on a torus and M = 2N, the expected polynomial,

number

number

number

number

number

number

number

number

[0140] The present invention also covers an information processing system specially programmed to implement a homomorphic encryption evaluation method according to any one of the above alternatives.

[0141] It also covers a computer program product that implements any one of the above alternative methods and that is specially designed to be loaded and implemented by an information processing system programmed for this purpose.

[0142] Application examples of the present invention The above invention can be used to great advantage to maintain the confidentiality of some data, such as, but not limited to, personal, health, or confidential information data, or more generally, any data whose owner wishes to keep secret but which he wishes to allow third parties to perform digital processing. Delocalizing processing to one or more third-party service providers is interesting for several reasons; it allows for operations that require costly or unavailable resources to be performed, and it also allows for private operations. Second, the third party responsible for performing the digital processing operations may not actually want to disclose the actual content of the operations and the digital functions implemented thereby.

[0143] In such use, the present invention particularly covers the implementation of remote digital services such as cloud computing services, and a third-party service provider responsible for applying digital processing to encrypted data in cloud computing services, on its side, executes the above first pre-computation step, which is to use functions f1,…,f q among each multivariate function f j to pre-compute a network of univariate functions. For all the obtained univariate functions (for a given

Number

Number

Number

Number

Number

Number

[0144] Next, the secret data (x1,…,x p) owner performs encryption using homomorphic encryption algorithm E and transmits type data E(μ1),…,E(μ p ), where μ i is the x encoded by the encoding function i is the value of . Usually, the choice of algorithm E is imposed by a third-party provider of the service. Alternatively, the data owner can use an encryption algorithm of his choice, not necessarily homomorphic, in which case the steps before re-encryption are performed by a third party (or another service provider) to obtain the encrypted data in the desired format.

[0145] Therefore, in one embodiment of the present invention, the aforementioned homomorphic evaluation encryption method is characterized in that the input encrypted data is derived from a previous re-encryption step, set in the form of a ciphertext of encryption of said homomorphic encryption algorithm E.

[0146] A third party encrypts the data E(μ i ), then in the step of homomorphic evaluation of the network of univariate functions, based on these ciphertexts, each of the networks of univariate functions is homomorphically evaluated in a series of successive steps, and f applied to those inputs (for 1 ≤ j ≤ q) under the encryption algorithm E' is obtained. j Get the ciphertext of the encryption of .

[0147] The different functions f considered j Upon obtaining the encrypted results of the encryption on those input values ​​for , the involved third party sends all these results back to the owner of the sensitive data.

[0148] The owner of the secret data then decrypts the homomorphically encrypted input data (x1,...,x p ) to one or more functions (f1,…,f q) and the third party has not performed any digital processing on said data that is the implementation of one or more functions, and therefore has no way of knowing the specific content of the data, nor, conversely, has the owner of the data had any need to know the details of the functions implemented.

[0149] Such sharing of tasks between the data owner and a third party acting as a digital processing service provider can advantageously be performed remotely, especially across cloud computing-type services, without affecting the security of the data and the associated processing. Furthermore, different steps of the digital processing can be the responsibility of different service providers.

[0150] Thus, in one embodiment of the present invention, a cloud computing-based remote service implements one or more of the aforementioned homomorphic evaluation encryption methods, where the task is shared between the data owner and a third party acting as a digital processing service provider.

[0151] In a particular embodiment of the present invention, data x1,...,x that are desired to be kept secret are p This remote service involves the owner of and one or more third parties responsible for the application of digital processing of said data, 1. A third party concerned performs a first step of pre-calculating a network of single-variable functions and a second pre-selection step in accordance with the present invention. 2. The data owner encrypts x1,…,x using homomorphic encryption algorithm E. p , and the type data E(μ1),…,E(μ p ), where μ i is the encoded x by the encoding function i is the value of 3. The third party involved sends the encrypted data E(μ i), an interested third party evaluates each of said networks of univariate functions homomorphically in a series of successive steps based on these ciphertexts, and computes f applied to those inputs (for 1 ≤ j ≤ q) under an encryption algorithm E'. j Get the ciphertext of the encryption 4. Different functions f considered j , and obtains the encrypted results of the encryption on those input values, the third party involved sends all these results back to the data owner. 5. The owner of the data, after decryption, can use one or more functions (f1,...,f q ) to get the resulting value It is further characterized by the fact that

[0152] A variation of this embodiment is to add, in the second step (2.) above: The data owner encrypts x1,…,x using an encryption algorithm different from E. p and transmit said data thus encrypted. The received encrypted data is re-encrypted by a related third party under the homomorphic encryption algorithm E to generate ciphertexts E(μ1), ..., E(μ p ) where μ i is the x encoded by the encoding function i is the value of It is characterized by:

[0153] In particular, different applications of the remote digital services according to the present invention can be mentioned. For example, as mentioned in the aforementioned MajecSTIC'08 article, it is already known that a Kolmogorov-type decomposition applied to a gray-level image—which can be considered as a two-variable function f(x,y) = I(x,y), where I(x,y) gives the gray intensity of the pixel at coordinate (x,y)—allows the reconstruction of an approximation of the original image. Therefore, with knowledge of the coordinates (x1,y1) and (x2,y2) defining the bounding box, cropping operations can be performed in a simple manner. A similar process is applied to color images, taking into account that the two-variable functions f1(x,y) = R(x,y), f2(x,y) = G(x,y), and f3(x,y) = B(x,y) give the red, green, and blue levels, respectively. This type of processing is known for unencrypted data, but can now be performed in the present invention using homomorphic encryption. Thus, according to the present invention, if a user transmits in an encrypted manner his GPS coordinates recorded at regular intervals (e.g., every 10 seconds) during a sports activity and the coordinates of the farthest movements (defining a bounding box), a service provider owning an image of the cartographic plan can obtain, by cropping, the ciphertext of the portion of the plan relevant to the activity; furthermore, it can represent the movements within the still-encrypted area, for example using a color code to indicate the local speed, calculated homomorphically based on the encrypted image of the received GPS coordinates. Advantageously, the (third-party) service provider knows nothing about the exact location of the activity (unless it is according to the service provider's plan) or the user's performance. Furthermore, the third party does not disclose the entire map.

[0154] The present invention can also be advantageously used to enable artificial intelligence processes, in particular machine learning type processes, to be carried out on input data, which remains encrypted, and on which a service provider, in particular implementing a neural network, applies one or more activation functions to values ​​derived from said encrypted data. As an example of this use of the invention in relation to the implementation of a neural network, reference can be made to the decomposition of the function g(z1,z2)=max(z1,z2), which acts as the aforementioned "max pooling" used in particular in neural networks, giving z2+(z1-z2). + and here

number

number

number

number

number

[0155] Thus, in one embodiment of the present invention, a remote service implementing one or more of the aforementioned cryptographically homomorphic evaluation methods contemplates a digital process implementing a neural network.

[0156] Disclosure of the invention as a feature The present invention allows the evaluation of one or more functions on encrypted data through the implementation of the data calculation and processing capabilities of one or more digital information processing systems. Depending on the case, this or these functions may be univariate or multivariate. Thus, in its different variants, the method according to the present invention allows the evaluation of both types of functions to proceed.

[0157] If the functions to be evaluated are of univariate type, the invention, in one of its implementations, provides for the implementation at the input and output of each of the two homomorphic encryption algorithms and a step of precomputing a table for each considered function followed by a step of homomorphic evaluation of the tables obtained, as claimed in claim 1.

[0158] If the function to be evaluated is of the multivariate type, the invention further provides for carrying out two preliminary steps: a first pre-calculation step followed by a second pre-selection step, after which a third step of homomorphic evaluation of a network of functions of a single variable is applied to the network of functions of a single variable obtained upon completion of the execution of these two preliminary steps, according to any known method for homomorphic evaluation of functions of a single variable. This is the object of claim 12.

Claims

1. 1. A cryptographic method digitally executed by at least one information processing system specially programmed to perform approximate homomorphic evaluation of a univariate function f of a real-valued variable x having arbitrary precision in a domain of definition D and real values ​​in image I, the method taking as input a ciphertext of an encoding of x, E(encode(x)), and returning a ciphertext of an encoding of an approximation of f(x), E'(encode'(y)), where y ≈ f(x), E and E' are homomorphic encryption algorithms whose respective native spaces of plaintexts are M and M'; an integer N≧1 that quantifies the actual precision of the representation of the variables at the input of the function f to be evaluated, an encoding function encode that takes as input an element of domain D and associates it with an element of M; an encoding function encode' that takes as input an element of the image I and associates to it an element of M', a discretization function discretize that takes as input an element of M and associates it with an index expressed as an integer; - the native space M of the plaintext Ｈ an encryption algorithm E Ｈ a homomorphic encryption scheme having - Takes an integer as input and M Ｈ An encoding function encode that returns the elements of Ｈ is parameterized by As a result, the image of domain D by encoding encode followed by discretization discretise [Equation 1] is a set of at most N indices selected from S={0,...,N-1}, a. Pre-calculating a table corresponding to said single variable function f, A domain D is divided into N selected subintervals R whose union constitutes D. ０ , ..., R Ｎ－１ Decomposing into For each index i in S={0,...,N-1}, the subinterval R ｉ determining a representative x(i) of the vectors and calculating the value y(i)=f(x(i)); Step 3: Returning a table T consisting of N elements T[0], ..., T[N-1], where T[i] = y(i), for 0≦i≦N-1. b. A step of homomorphic evaluation of tables, ○x∈R ｉ If , the index in the set S = {0, ..., N-1} [Equation 2] An integer with expected value [Equation 3] For the ciphertext E(encode(x)), [Equation 4] Converting it into ○Ciphertext [Equation 5] Based on Table T, the expected value is [Equation 6] An element with [Equation 7] For the ciphertext [Equation 8] To obtain ○ [Equation 9] The step is to return and homomorphic encryption algorithm E is a torus [Equation 10] is given by the LWE type encryption algorithm applied to [0011] 1. A cryptographic method comprising:

2. The domain of definition of the function f to be evaluated is the real interval D = [x ｍｉｎ , x ｍａｘ ) and N intervals R covering the region D ｉ (for 0≦i≦N-1) is a half-open subinterval [0012] 2. The encryption method according to claim 1, wherein D is divided in a regular manner.

3. A set S is an additive group for integers M≧N [0013] 2. The cryptographic method of claim 1, wherein the .intg.

4. group [0014] is expressed multiplicatively as the power of a primitive root of the unit represented by X to the Mth power, [Equation 15] Element i of element X ｉ are related to all the M-th roots of unity {1, X, ..., X Ｍ－１ } is (X Ｍ About multiplication modulo -1 [0016] 4. The cryptographic method according to claim 3, wherein the group is homomorphic to

5. parameterized by integers M≧N, The encoding function encode is a subinterval of the torus [Equation 17] and has its image contained in The discretization function discretize applies the element t of the torus to the rounded integer of the product M×t modulo M, where M×t is [Equation 18] It is calculated in mathematical form as: [Equation 19] , [Equation 20] 5. The cryptographic method according to claim 1, wherein:

6. The domain of the definition of the function f is the real number interval D = [x ｍｉｎ , x ｍａｘ ), the encoding function encode is [0000] ， [Equation 22] 6. The encryption method according to claim 5, wherein:

7. Homomorphic encryption algorithm E Ｈ is the LWE type encryption algorithm, and the encoding function encode Ｈ 5. The cryptographic method according to claim 1, wherein is an identity function.

8. A homomorphic encryption algorithm E is parameterized by an even integer M. Ｈ is an RLWE type encryption algorithm, and the encoding function encode Ｈ but, [Equation 23] For any polynomial p in [0000] ， [Equation 25] 5. The cryptographic method according to claim 1, wherein:

9. LWE-type ciphertext on a torus, parameterized by an even number M equal to 2N [Equation 26] but, [0000] of [0000] T'[j]=encode'(T[j]), 0≦j≦N-1, [0000] 9. The cryptographic method according to claim 7, wherein the RLWE ciphertext is extracted from a RLWE ciphertext that approximates

10. The image of the function f is in the real interval I = [y ｍｉｎ , y ｍａｘ ) when - The homomorphic encryption algorithm E' is a torus [Equation 30] is given by the LWE type encryption algorithm applied to [Equation 31] and - The encoding function encode' [Equation 32] ， [Equation 33] 5. The cryptographic method according to claim 1, wherein:

11. The at least one function of a single variable that is subjected to the approximate homomorphic evaluation is obtained by the following preceding steps: a pre-computation step consisting in transforming each of said multivariate functions into a network of univariate functions consisting of compositions and sums of univariate real-valued functions; b. In said network of precomputed univariate functions, three types: - the same univariate function applied to the same arguments, - different univariate functions applied to the same arguments, - the same univariate function applied to arguments differing by a non-zero additive constant, selecting all or some of them a pre-selection step which consists in identifying redundancy in one of c) a step of homomorphic evaluation of each of the networks of precomputed univariate functions, in which, if all or part of one or more of these univariate functions are reused, the redundancies selected in the preselection step are evaluated in a shared manner; 11. The cryptographic method according to claim 1, wherein the method is derived from a prior processing of at least one multivariate function by implementing:

12. 11. The encryption method according to claim 1, wherein the input encrypted data is derived from a previous re-encryption step so as to be set in the form of a ciphertext for encryption of the homomorphic encryption algorithm E.

13. 13. An information processing system, characterized in that it is programmed to implement the homomorphic evaluation encryption method according to any one or more of claims 1 to 12.

14. A computer program intended to be loaded and implemented in an information processing system according to claim 13.

15. A cloud computing-based remote service implementing the cryptographic method of any one or more of claims 1 to 14, in which the task is shared between the data owner and one or more third parties acting as digital processing service providers.

Images