Apparatus and method for performing reboot operations on homomorphic ciphertexts

Abstract

A ciphertext processing method is disclosed, which includes the steps of performing an operation on a homomorphic ciphertext for an erroneous approximate message, and expanding a plaintext space of the operation result ciphertext when the approximate message weight in the operation result ciphertext obtained by the operation exceeds a threshold, and the step of expanding the plaintext space includes the steps of applying a preset reboot operation to the operation result ciphertext to generate a first intermediate ciphertext, applying a preset reboot operation to a subtraction operation result between the operation result ciphertext and the first intermediate ciphertext to generate a second intermediate ciphertext, and performing a subtraction operation of the second intermediate ciphertext on the first intermediate ciphertext to generate a homomorphic ciphertext with an expanded plaintext space.

Description

[Technical field]

[0001] The present invention relates to an apparatus and method for efficiently performing the reboot method for homomorphic ciphertext. [Background technology]

[0002] As communication technology advances and electronic devices become more prevalent, efforts to secure communications between electronic devices continue to be made, leading to the use of encryption / decryption techniques in many communication environments.

[0003] When a message encrypted by encryption technology is sent to a recipient, the recipient must decrypt the message in order to use it. In this case, the recipient will incur wasted resources and time in the process of decrypting the encrypted data.

[0004] Furthermore, if a third party hacks into a message while the other party has temporarily decrypted the message for calculation purposes, there is a problem that the message could easily be leaked to the third party.

[0005] In order to solve these problems, homomorphic encryption methods have been researched. With homomorphic encryption, even if operations are performed on the ciphertext itself without decrypting the encrypted information, the same result as the encrypted value can be obtained after operations are performed on the plaintext. Therefore, various operations can be performed on the ciphertext without decrypting it.

[0006] However, when homomorphic operations such as homomorphic multiplication are performed, the plaintext space in the homomorphic ciphertext is reduced, and when the plaintext space falls below a certain size, no further operations can be performed. In this regard, the reboot method, which can expand the plaintext space of the homomorphic ciphertext, has been used in recent years.

[0007] However, the conventional reboot method had a problem that the scaling factor was simultaneously amplified as an error during the reflection process, which could change the accuracy of the calculation. Therefore, a reboot method with high calculation accuracy is required. Summary of the Invention [Problem to be solved by the invention]

[0008] Therefore, the present invention has been made in consideration of the above problems, and an object of the present invention is to provide an apparatus and method for efficiently performing a reboot operation on a homomorphic ciphertext. [Means for solving the problem]

[0009] In order to achieve the above object, a method for processing a homomorphic ciphertext according to an embodiment of the present invention includes the steps of: performing an operation on a homomorphic ciphertext for an approximate message including an error; and, when a weight of the approximate message in a resultant ciphertext obtained by the operation exceeds a threshold, expanding a plaintext space of the resultant ciphertext, wherein the step of expanding the plaintext space includes the steps of: applying a preset reboot operation to the resultant ciphertext to generate a first intermediate ciphertext; applying the preset reboot operation to a result of a subtraction operation between the resultant ciphertext and the first intermediate ciphertext to generate a second intermediate ciphertext; and performing a subtraction operation of the second intermediate ciphertext on the first intermediate ciphertext to generate a homomorphic ciphertext with an expanded plaintext space.

[0010] In this case, the step of generating the first intermediate ciphertext may include reflecting a scaling factor so that the operation result ciphertext has a predetermined range, applying a predetermined reboot operation to the operation result ciphertext reflecting the scaling factor, reflecting the scaling factor on the result to which the predetermined reboot operation has been applied, and generating the first intermediate ciphertext.

[0011] In this case, the preset range may be [-1, 1].

[0012] On the other hand, the preset range is:

number

[0013] Meanwhile, the preset reboot operation may include a step of extending a modulus of a homomorphic ciphertext, a step of linearly converting the homomorphic ciphertext with the modulus extended into a polynomial form, a step of performing an approximate modulus operation on the homomorphic ciphertext converted into the polynomial form using a higher-order equation set so that an input value within a preset range approximates an integer point, and a step of linearly converting a result of the approximate modulus operation into the form of a homomorphic ciphertext.

[0014] Meanwhile, the preset reboot operation may include a step of linearly transforming the homomorphic ciphertext into a polynomial form, a step of extending a modulus of the homomorphic ciphertext linearly transformed into the polynomial form, a step of performing an approximate modulus operation on a result of the extension of the modulus, and a step of linearly transforming a result of the approximate modulus operation into the form of the homomorphic ciphertext.

[0015] Meanwhile, an arithmetic device according to an embodiment of the present invention includes a memory that stores a homomorphic ciphertext for an approximate message including an error, and a processor that performs an operation on the homomorphic ciphertext, in which the processor applies a preset reboot operation to the homomorphic ciphertext to generate a first intermediate ciphertext, applies the preset reboot operation to a result of a subtraction operation between the operation result ciphertext and the first intermediate ciphertext to generate a second intermediate ciphertext, and performs a subtraction operation of the second intermediate ciphertext on the first intermediate ciphertext to generate a homomorphic ciphertext with an expanded plaintext space.

[0016] In this case, the processor may reflect a scaling factor so that the operation result ciphertext has a predetermined range, apply a predetermined reboot operation to the operation result ciphertext reflecting the scaling factor, reflect the scaling factor to the result to which the predetermined reboot operation has been applied, and generate the first intermediate ciphertext.

[0017] In this case, the preset range may be [-1, 1].

[0018] On the other hand, the preset range is:

number

[0019] Meanwhile, the processor may extend a modulus of a homomorphic ciphertext, linearly convert the homomorphic ciphertext with the modulus extended into a polynomial form, perform an approximate modulus operation on the homomorphic ciphertext converted into the polynomial form using a higher-order equation set so that an input value within a preset range approximates an integer point, linearly convert a result of the approximate modulus operation into the form of a homomorphic ciphertext, and perform the preset reboot operation.

[0020] Meanwhile, the processor may linearly transform the homomorphic ciphertext into a polynomial form, extend a modulus of the homomorphic ciphertext linearly transformed into the polynomial form, perform an approximate modulus operation on the extended result of the modulus, linearly transform the result of the approximate modulus operation into the homomorphic ciphertext form, and perform the preset reboot operation. Effect of the Invention

[0021] As described above, according to the present invention, it is possible to perform a reboot operation while maintaining a higher degree of accuracy than before. [Brief description of the drawings]

[0022] [Figure 1] 1 is a diagram for explaining the structure of a network system according to an embodiment of the present invention; [Diagram 2] 1 is a block diagram showing a configuration of a calculation device according to an embodiment of the present invention. [Diagram 3] FIG. 13 is a diagram for explaining the reboot operation of the present invention. [Figure 4] FIG. 13 is a diagram for explaining the reboot operation of the present invention. [Diagram 5] 1 is a flowchart illustrating a method for processing a homomorphic ciphertext according to the present invention. [Figure 6] 11 is a flowchart for explaining a reboot operation of the present invention. [Figure 7] 1 is a flowchart for explaining an operation of expanding a plaintext space according to the present invention. [Figure 8] FIG. 4 is a diagram showing an algorithm of a reboot operation according to the first embodiment of the present invention. [Figure 9] FIG. 11 is a diagram showing an algorithm of a reboot operation according to the second embodiment of the present invention. [Figure 10] 11 is a diagram for explaining a change in accuracy due to a reboot operation. FIG. [Figure 11] 11 is a diagram for explaining a change in accuracy due to a reboot operation. FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0023] Hereinafter, the present invention will be described in detail with reference to the accompanying drawings. In the present invention, the information (data) transmission process processed may be encrypted / decrypted as necessary, and expressions describing the information (data) transmission process in the present invention and claims should be interpreted as including the case of encryption / decryption, even if not specifically mentioned. In the present invention, expressions such as "transmitting (communicating) from A to B" or "A receiving from B" include transmission (communication) or reception involving other intermediates, and do not necessarily represent only direct transmission (communication) or reception from A to B.

[0024] In the description of the present invention, the order of each step should be understood as non-restrictive unless the preceding step must be performed logically and chronologically before the following step. In other words, except for the exceptional cases as described above, even if a process described as a following step is performed before a process described as a preceding step, the essence of the disclosure is not affected, and the scope of the rights should be defined regardless of the order of the steps. In this specification, the expression "A or B" is defined not only to refer to either A or B selectively, but also to include both A and B. In addition, the term "comprise" in the present invention has a meaning that includes the inclusion of further components in addition to the elements listed as included.

[0025] In the present invention, only essential components necessary for the description of the present invention will be described, and components unrelated to the essence of the present invention will not be mentioned. Furthermore, the description should not be interpreted as an exclusive meaning including only the components mentioned, but as a non-exclusive meaning that may include other components.

[0026] In the present invention, a "value" is defined as a concept including not only a scalar value but also a vector. In the present invention, expressions such as "calculate" and "calculate" may be replaced with expressions of generating the result of the calculation or computation. Unless otherwise specified, operations on ciphertexts described below refer to homomorphic operations. For example, addition on homomorphic ciphertexts refers to homomorphic addition on two homomorphic ciphertexts.

[0027] The mathematical operations and calculations of each step of the present invention described below may be realized by computer calculations using known coding methods and / or coding methods suitably devised for the present invention to perform the operations or calculations.

[0028] The specific formulas described below are described as examples among multiple alternatives, wherever possible, and the scope of the present invention should not be interpreted as being limited to the formulas mentioned in the present invention.

[0029] For convenience of explanation, the following notations will be defined in this specification. a←D: Select element (a) according to distribution (D). s1, s2∈R: S1, S2: S1, S2 are elements belonging to the R set mod(q): Modular operation with q elements

number

[0030] FIG. 1 is a diagram for explaining the structure of a network system according to an embodiment of the present invention.

[0031] Referring to FIG. 1, the network system may include a plurality of electronic devices 100-1 to 100-n, a first server device 200, and a second server device 300, and each component may be interconnected via a network 10.

[0032] The network 10 may be realized by various types of wired / wireless communication networks, broadcast communication networks, optical communication networks, cloud networks, etc., and each device may be connected by a method such as Wi-Fi, Bluetooth, NFC (Near Field Communication), etc. without a separate medium.

[0033] 1, multiple electronic devices 100-1 to 100-n are shown, but multiple electronic devices do not necessarily have to be used, and one device may be used. As an example, the electronic devices 100-1 to 100-n may be realized as various devices such as a smartphone, a tablet, a game player, a personal computer, a laptop, a home server, a kiosk terminal, etc., or may be realized as a home appliance with an IoT function.

[0034] A user may input various information via the electronic devices 100-1 to 100-n that the user uses. The input information may be stored in the electronic devices 100-1 to 100-n themselves, or may be transmitted to and stored in an external device for reasons of storage capacity, security, etc. In FIG. 1, the first server device 200 may play a role in storing such information, and the second server device 300 may play a role in using a part or all of the information stored in the first server device 200.

[0035] Each of the electronic devices 100-1 to 100-n may perform homomorphic encryption on the input information and transmit the homomorphic ciphertext to the first server device 200.

[0036] Each of the electronic devices 100-1 to 100-n may include encryption noise, i.e., errors, calculated in the process of performing homomorphic encryption in the ciphertext. Specifically, the homomorphic ciphertext generated by each of the electronic devices 100-1 to 100-n may be generated in such a way that a result value including a message and an error value is restored when the homomorphic ciphertext is subsequently decrypted using a private key.

[0037] As an example, the homomorphic ciphertext generated by electronic devices 100-1 to 100-n may be generated in a form that satisfies the following properties when decrypted using a private key. [Formula 1]

number

[0038] If the size of the message is too small or too large, the size can be adjusted using a scaling factor. By using a scaling factor, not only integer messages but also real number messages can be encrypted, which greatly increases the versatility of the method. By adjusting the size of the message using a scaling factor, the size of the area in which the message exists in the ciphertext after the operation, i.e., the size of the valid area, can also be adjusted.

[0039] According to the embodiment, the modulus q of the ciphertext may be set in various forms and used. For example, the modulus q of the ciphertext may be set to a power of the scaling factor Δ.

number

number

[0040] Although the homomorphic ciphertext according to the present invention will be described assuming the use of fixed-point numbers, it may also be applied to the case where floating-point numbers are used.

[0041] The first server device 200 may store the received homomorphic ciphertext in the form of ciphertext without decrypting it.

[0042] The second server device 300 may request a specific processing result for the homomorphic ciphertext from the first server device 200. The first server device 200 may perform a specific operation in response to the request from the second server device 300, and then transmit the result to the second server device 300.

[0043] As an example, when the ciphertexts ct1 and ct2 transmitted by the two electronic devices 100-1 and 100-2 are stored in the first server device 200, the second server device 300 may request a value obtained by adding up the information provided by both electronic devices 100-1 and 100-2 to the first server device 200. In response to the request, the first server device 200 may perform an operation to add up the two ciphertexts, and then transmit the resulting value (ct1+ct2) to the second server device 300.

[0044] Due to the nature of homomorphic ciphertext, the first server device 200 may perform the operation without performing decryption, and the resultant value may also be in the form of ciphertext. In the present invention, the resultant value obtained by the operation is called the operation result ciphertext.

[0045] The first server device 200 may transmit the operation result ciphertext to the second server device 300. The second server device 300 may decrypt the received operation result ciphertext to obtain operation result values ​​of data included in each homomorphic ciphertext.

[0046] The first server device 200 may perform a calculation multiple times in response to a user request. In this case, the approximate message weight in the calculation result ciphertext obtained for each calculation is different. The first server device 200 may perform a rebooting operation when the approximate message weight exceeds a threshold. In this way, the first server device 200 may be called a calculation device because it can perform a calculation operation.

[0047] Specifically, in the above Equation 1, if q is smaller than M, M+e(mod q) has a value different from M+e, and therefore decryption is not possible. Therefore, the value of q must always be maintained greater than M. However, as the calculation proceeds, the value of q gradually decreases. Therefore, an operation is required to change the value of q so that it is always greater than M, and this operation is called a reboot operation. By performing this reboot operation, the ciphertext can be brought into a state in which it can be calculated again. Specific operations related to rebooting will be described later with reference to FIGS. 3 and 4.

[0048] On the other hand, while FIG. 1 shows a case where encryption is performed by the first electronic device and the second electronic device, and decryption is performed by the second server device, the present invention is not necessarily limited to this.

[0049] FIG. 2 is a block diagram showing a configuration of an electronic device according to an embodiment of the present invention.

[0050] 1, devices that perform homomorphic ciphertext, such as a first electronic device and a second electronic device, devices that calculate homomorphic ciphertext, such as a first server device, devices that decrypt homomorphic ciphertext, such as a second server device, etc. may be referred to as arithmetic devices. Such arithmetic devices may be various devices, such as a PC (Personal Computer), a notebook computer, a smartphone, a tablet, a server, etc.

[0051] Referring to FIG. 2, the computing device 400 may include a communication device 410 , a memory 420 , a display 430 , an operation input device 440 , and a processor 450 .

[0052] The communication device 410 is formed to connect the computing device 400 to an external device (not shown), and may be connected to the external device via a local area network (LAN) or the Internet, or may be connected via a Universal Serial Bus (USB) port or a wireless communication (e.g., WiFi 802.11a / b / g / n, NFC, Bluetooth) port. Such a communication device 410 may be referred to as a transceiver.

[0053] The communication device 410 may receive a public key from an external device and may transmit a public key generated by the computing device 400 itself to an external device.

[0054] The communication device 410 may then receive messages from external devices and transmit the generated homomorphic ciphertext to the external devices.

[0055] The communication device 410 may receive various parameters necessary for generating a ciphertext from an external device. On the other hand, in actual implementation, the various parameters may be directly input by a user via an operation input device 440, which will be described later.

[0056] In addition, the communication device 410 may receive a request from an external device to perform an operation on a homomorphic ciphertext, and may transmit the calculated result to the external device.

[0057] The memory 420 is a component for storing an O / S for driving the arithmetic device 400, various software, data, etc. The memory 420 may be realized in various forms such as a RAM, a ROM, a flash memory, a HDD, an external memory, a memory card, etc., and is not limited to any of them.

[0058] The memory 420 stores a message to be encrypted. Here, the message may be various credit information, personal information, etc. cited by the user, or may be information related to the usage history, such as location information, internet usage time information, etc., used by the computing device 400.

[0059] The memory 420 may store a public key, and if the computing device 400 is the device that directly generates the public key, may store not only the private key but also various parameters required for generating the public key and the private key.

[0060] The memory 420 may store a homomorphic ciphertext generated in a process described below. The memory 420 may store a homomorphic ciphertext transmitted from an external device. The memory 420 may store a computation result ciphertext that is a result of a computation process described below.

[0061] The display 430 displays a user interface window for selecting a function supported by the arithmetic device 400. Specifically, the display 430 may display a user interface window for selecting various functions provided by the arithmetic device 400. The display 430 may be a monitor such as a liquid crystal display (LCD) or an organic light emitting diode (OLED), and may be realized as a touch screen that can simultaneously perform the functions of the operation input device 440 described below.

[0062] Display 430 may display a message requesting input of parameters required for generating a private key and a public key. Display 430 may then display a message for selecting a message to be encrypted. Meanwhile, in implementation, the encryption target may be directly selected by the user or may be automatically selected. In other words, personal information that needs to be encrypted may be automatically set without the user having to directly select a message.

[0063] The operation input device 440 may receive a selection of a function of the arithmetic device 400 and a control command for the function from the user. Specifically, the operation input device 440 may receive parameters required for generating a private key and a public key from the user. Note that the operation input device 440 may receive a message to be encrypted from the user.

[0064] The processor 450 controls each component in the arithmetic device 400. The processor 450 may be configured as a single device such as a central processing unit (CPU) and an application-specific integrated circuit (ASIC), or may be configured as a plurality of devices such as a CPU and a graphics processing unit (GPU).

[0065] When a message to be transmitted is input, the processor 450 stores the message in the memory 420. The processor 450 then homogeneously encrypts the message using various setting values ​​and programs stored in the memory 420. In this case, a public key may be used.

[0066] The processor 450 may generate and use the public key required for encryption by itself, or may receive and use the public key from an external device. As an example, the second server device 300 that performs decryption may distribute the public key to another device.

[0067] When generating a key by itself, the processor 450 may generate a public key using the Ring-LWE technique. Specifically, the processor 450 may first set various parameters and rings and store them in the memory 420. Examples of parameters may include the length of a plaintext message bit, the size of the public key and the private key, etc.

[0068] The ring may be expressed mathematically as follows: [Formula 2]

number

[0069] A ring is a set of polynomials with preset coefficients, in which addition and multiplication are defined between elements and which is closed with respect to addition and multiplication. Such a ring may be called an annulus.

[0070] As an example, a ring refers to a set of n-th degree polynomials whose coefficients are Zq. Specifically, when n is Φ(N), it may refer to an N-th degree cyclotomic polynomial. (f(x)) denotes the ideal of Zq[x] generated as f(x). The Euler totient function Φ(N) refers to the number of natural numbers that are relatively prime to N and smaller than N. Φ N If (x) is defined as an Nth degree cyclotomic polynomial, the ring can also be expressed as Equation 3 below. [Formula 3]

number

[0071] The private key (sk) may be expressed as:

[0072] Meanwhile, the ring of the above-mentioned Equation 3 has complex numbers in the plaintext space. Meanwhile, in order to improve the speed of the operation on the homomorphic ciphertext, among the above-mentioned sets of rings, only the sets in which the plaintext space is real numbers may be used.

[0073] Once such a ring is established, processor 450 may compute a secret key (sk) from the ring.

[0074] [Formula 4]

number

[0075] The processor 450 then calculates a first random polynomial (a(x)) from the ring. The first random polynomial may be expressed as:

[0076] [Formula 5]

number

[0077] The processor 450 may calculate the error. Specifically, the processor 450 may extract the error from a discrete Gaussian distribution or a distribution that is statistically close to the discrete Gaussian distribution. Such an error may be expressed as follows:

[0078] [Formula 6]

number

[0079] Once the error has been calculated, the processor 450 may calculate a second random polynomial by modularly calculating the error on the first random polynomial and the secret key. The second random polynomial may be expressed as follows:

[0080] [Formula 7]

number

[0081] Finally, the public key (pk) is set in a form including the first random polynomial and the second random polynomial as follows:

[0082] [Formula 8]

number

[0083] The above-mentioned key generation method is merely an example, and is not necessarily limited to this, and it goes without saying that the public key and the private key may be generated by other methods.

[0084] Meanwhile, the processor 450 may control the communication device 410 so that once the public key is generated, it is transmitted to another device.

[0085] Then, the processor 450 may generate a homomorphic ciphertext for the message. Specifically, the processor 450 may generate a homomorphic ciphertext for the message by applying the public key previously generated. At this time, the processor 450 may generate the ciphertext so that the length of the ciphertext corresponds to the magnitude of the scaling factor.

[0086] Then, once the homomorphic ciphertext is generated, the processor 450 may store it in the memory 420 or control the communication device 410 to transmit the homomorphic ciphertext to another device in response to a user request or a pre-defined default command.

[0087] Meanwhile, according to an embodiment of the present invention, packing may be performed. When packing is used in homomorphic encryption, it becomes possible to encrypt multiple messages with one ciphertext. In this case, when the electronic device 100 performs operations between each ciphertext, the operations are processed in parallel for multiple messages, which significantly reduces the computational burden.

[0088] Specifically, when a message is composed of multiple message vectors, the processor 450 may convert the multiple message vectors into polynomials in a form that can be encrypted in parallel, and then multiply the polynomials by a scaling factor and perform homomorphic encryption using a public key, thereby generating a ciphertext in which the multiple message vectors are packed.

[0089] Then, when decryption of the homomorphic ciphertext is required, the processor 450 may apply the secret key to the homomorphic ciphertext to generate a decrypted text in the form of a polynomial, and may decode the decrypted text in the form of a polynomial to generate a message. At this time, the generated message may include an error as mentioned in the above Equation 1.

[0090] Then, the processor 450 may perform an operation on the ciphertext. Specifically, the processor 450 may perform an operation such as addition or multiplication on the homomorphic ciphertext while maintaining the encrypted state. Specifically, the processor 450 may perform a first function process on each of the homomorphic ciphertexts used in the operation, perform an operation such as addition or multiplication between the homomorphic ciphertexts that have been subjected to the first function process, and perform a second function process, which is an inverse function of the first function, on the homomorphic ciphertexts on which the operation has been performed. Such a first function process and a second function process may utilize a linear transformation technique in a reboot process described later.

[0091] Meanwhile, the calculation device 400 may detect data in the valid area from the calculation result data when the calculation is completed. Specifically, the calculation device 400 may detect data in the valid area by performing a rounding process on the calculation result data. The rounding process refers to rounding off a message in an encrypted state, and may also be called rescaling. Specifically, the calculation device 400 applies a reciprocal of a scaling factor,

number

[0092] In addition, the arithmetic device 400 may perform a reboot operation on the ciphertext when the weight of the approximate messages in the ciphertext as a result of the calculation exceeds a threshold value. At this time, the arithmetic device 400 may perform a reboot operation in a normal manner or a reboot operation in a meta-bootstrap method according to the present invention. Specifically, the arithmetic device 400 may determine the reboot method in consideration of the calculation speed and / or accuracy of the homomorphic ciphertext. For example, if the arithmetic device 400 needs a fast reboot, it may perform the reboot in the normal manner, and if high accuracy is required or a large difference in values ​​between the homomorphic ciphertexts is predicted, it may determine to perform the reboot using the meta-bootstrap method.

[0093] When using the normal reboot method, the arithmetic device 400 may perform a reboot operation by performing a preset reboot operation. Specifically, the arithmetic device 400 may extend the modulus of a homomorphic ciphertext, linearly convert the homomorphic ciphertext with the modulus extended into a polynomial form, perform an approximate modulus operation on the homomorphic ciphertext converted into the polynomial form using a higher-order equation set so that an input value within a preset range approximates an integer point, and linearly convert the result of the approximate modulus operation into the form of a homomorphic ciphertext, thereby performing the above-mentioned reboot operation. At this time, the arithmetic device 400 may perform the above-mentioned modulus extension operation and linear conversion operation in a reverse order.

[0094] Meanwhile, when using the meta-bootstrap method, the computing device 400 may apply a preset reboot operation to the homomorphic ciphertext to generate a first intermediate ciphertext, apply a preset reboot operation to a subtraction operation result between the operation result ciphertext and the first intermediate ciphertext to generate a second intermediate ciphertext, and perform a subtraction operation of the second intermediate ciphertext on the first intermediate ciphertext to generate a homomorphic ciphertext with an expanded plaintext space. The meta-bootstrap method according to the present invention will be described in detail with reference to FIG. 3.

[0095] As described above, the arithmetic device 400 according to an embodiment of the present invention performs a reboot operation on a homomorphic ciphertext, thereby enabling more efficient homomorphic arithmetic. In addition, by using the meta-bootstrap method according to an embodiment of the present invention, it is possible to prevent a decrease in accuracy that may occur during the bootstrap process.

[0096] 3 is a diagram for explaining the reboot operation. Specifically, FIG. 3 shows an operation and reboot process for two homomorphic ciphertexts 10 and 20. The term reboot may be expressed as bootstrap or plaintext space expansion.

[0097] Each of the homomorphic ciphertexts 10, 20 may include an approximate message region 11, 21, respectively. The approximate message region 11, 21 includes both a message and an error (m1+e1, m2+e2).

[0098] The arithmetic device 400 may perform a specific calculation using two homomorphic ciphertexts 10 and 20 as input values.

[0099] The operation result ciphertext 30 may include an approximate message area 31 that includes the operation result (m3+e3) between each approximate message. As the operation result becomes larger than the input value, the approximate message area also becomes larger, thereby reducing the remaining plaintext space 32. If such an operation is performed multiple times, eventually the remaining plaintext space 32 will disappear or become smaller than a limit value, making it impossible to perform the operation. If such a state is determined, the operation device 400 may perform a reboot operation.

[0100] It can be seen that for the rebooted ciphertext 40, the approximate message area 41 remains constant, while the plaintext space 42 expands.

[0101] In this way, the reboot method enables continuous computation of homomorphic ciphertexts by expanding the plaintext space. However, in the conventional reboot method, there is a risk of loss of accuracy (or amplification of errors) during the process. This will be described in detail with reference to FIG. 10.

[0102] There are two methods for expressing numbers: fixed-point and floating-point. The floating-point method is advantageous in terms of compensating for significant digits, but many homomorphic ciphertexts use the fixed-point method to prevent the possibility of data leakage within the ciphertext.

[0103] However, when using a fixed-point method and the range of data used is wide, the following problems arise. In the following, for ease of explanation, we will assume that 30-bit precision is supported for homomorphic ciphertext, and that two slots (slot[0], slot[1]) are used.

number

[0104] If the floating-point method (or the ideal method) requires a precision of 30, then slot[0] 1010 guarantees 20 digits before the decimal point and 10 digits after the decimal point, for a total of 30 digits, and slot[1] 1020 guarantees 30 digits after the decimal point.

[0105] However, in the fixed-point method, 30-bit precision means that the 30 digits from the highest digit are counted and stored together. Therefore, slot [0] is guaranteed 30 digits, 20 digits before the decimal point and 10 digits after the decimal point, just like the floating-point method described above. However, slot [1] needs to have the same number of digits as slot [0], so it has 20 digits before the decimal point and 10 digits after the decimal point. Thus, for slot [0], the fixed-point method only guarantees 10 digits after the decimal point, so the effective precision for that slot is 10 bits.

[0106] In terms of error amplification, given data

number

number

number

[0107] In other words, if the maximum absolute value of the data slots normally handled is bounded to 2^M and the minimum absolute value is bounded to 2^N, then at the time of reboot, the difference between the reboot precision and the floating-point precision will be (MN) bits.

[0108] Reflecting this, we will explain the normal reboot operation. A normal reboot involves the following steps: 1) changing the range of the homomorphic ciphertext to the range to which the approximation algorithm is applied, 2) applying the approximation algorithm, and 3) restoring the range. For example, when rebooting for CT3 = m3 + e3 using an approximation algorithm with an approximation range of [-1, 1], the degree (or scaling factor) is reflected to adjust the range.

number

number

number

[0109] Thus, when performing a normal reboot operation, a problem occurs in that an error becomes large during the scaling process for applying the approximation algorithm.

[0110] Therefore, in order to solve such problems in the conventional rebooting process, the present invention aims to make the bootstrap result have only errors within the error range allowed by the approximation algorithm.

[0111] To achieve this goal, it is necessary to: i) identify errors contained in the bootstrap results that are greater than the error range tolerated by the approximation algorithm; and ii) take action to remove the identified errors.

[0112] In the following, one basic method for achieving the above object will be described with reference to FIG. 4, however, the above method can be modified in various ways in practice.

[0113] FIG. 4 is a diagram for explaining the reboot operation of the present invention.

[0114] The new reboot operation according to the present invention utilizes the conventional reboot operation. It is possible to modify the conventional reboot operation during use, or to use a modified version of the conventional reboot operation. First, for ease of explanation, the normal reboot operation previously used in the present invention is referred to as a preset reboot operation, and the new reboot operation according to the present invention is referred to as Meta Bootstrapping. (Hereinafter,

number

[0115] Referring to FIG. 4, when meta-bootstrap is performed, a preset reboot operation is performed on a first homomorphic ciphertext 50. Here, the preset reboot operation may be a commonly known conventional reboot operation as described above, or may be a method that partially modifies the conventional reboot operation described later in the present invention. When such a reboot operation is performed, a first intermediate ciphertext (or rebooted homomorphic ciphertext) 60 may be generated. For example, if the first homomorphic ciphertext is

number

number

number

number

number

[0116] Then, in order to check for "errors that are equal to or greater than the error range permitted by the approximation algorithm" among the errors contained after the reboot, i.e., to check for error values ​​other than the message, a subtractive homomorphic operation is performed on both the homomorphic ciphertexts before and after a preset bootstrap (or reboot). This may generate a second intermediate ciphertext 70. For example, the second intermediate ciphertext is

number

[0117] Then, a preset reboot operation is performed on the second intermediate ciphertext. Such a preset reboot operation may be a conventional reboot operation that is generally known, or may be a modified conventional reboot operation that will be described later in the present invention. Here, the reboot process is performed on the first homomorphic ciphertext.

number

number

[0118] Such a third intermediate ciphertext is an error that has passed the approximation algorithm, and can therefore be considered to be the above-mentioned "error that is equal to or greater than the error range tolerated by the approximation algorithm." Thus, by subtracting the third intermediate ciphertext from the first intermediate ciphertext, it becomes possible to generate a homomorphic ciphertext that has only errors that are equal to or less than the error range tolerated by the approximation algorithm. That is,

number

[0119] In this way, through the meta-bootstrap process, the rebooted homomorphic ciphertext will only have errors within the error range allowed by the approximation algorithm.

[0120] In addition to the accuracy described above, the meta-bootstrap process according to the present invention has the following advantages.

[0121] specifically,

number

[0122] To increase that total amount, the degree of the ring must be increased. If the precision of each reboot step is increased, the amount of modulus wasted at each step necessarily increases. The amount of modulus available after a reboot (or the number of possible multiplications) is the total modulus minus the amount of modulus wasted in the reboot, so the more modulus is wasted in a reboot, the less modulus available after the reboot, and the less efficient the reboot becomes. Increasing n to raise the modulus limit introduces yet another inefficiency, as any operation becomes slower in proportion to n.

[0123] In this respect, when the meta-reboot according to the present disclosure is used, the amount of modulus consumed in rebooting is kept low because the low-precision rebooting is repeated multiple times. Therefore, there are two advantages as follows.

[0124] First, at low n, it is possible to achieve accuracies that are unattainable with conventional methods.

[0125] Secondly, when the precision is fixed, it means that the order can be lowered, so that a high precision reboot can be efficiently designed.

[0126] FIG. 5 is a flowchart for explaining a method for processing a homomorphic ciphertext according to the present invention.

[0127] 5, first, an operation is performed on a homomorphic ciphertext for an approximate message including an error (S510). As an example, the operation may be set to a basic operation such as multiplication, division, addition, subtraction, etc., but is not necessarily limited thereto. Specifically, if the encrypted message is a complex number, a conjugate operation may be performed, and other operations such as statistics and sorting may also be performed.

[0128] Then, it is determined whether the approximate message weight in the ciphertext obtained by the operation exceeds a threshold (S520). In FIG. 5, it is shown that the approximate message weight exceeds the threshold after the operation, but it is not necessarily limited thereto. That is, it is also possible to determine before the operation.

[0129] If the approximate message weight exceeds a threshold, the plaintext space of the ciphertext is expanded. That is, the meta-bootstrap according to the present invention may be performed. The detailed operation of the meta-bootstrap according to the present invention will be described below with reference to FIG.

[0130] FIG. 6 is a flowchart for explaining the reboot operation of the present invention.

[0131] First, a first intermediate ciphertext is generated by applying a preset reboot operation to the ciphertext (S610). Specifically, a scaling factor is applied to the ciphertext reflecting the scaling factor so that the ciphertext reflects a preset range, and the first intermediate ciphertext is generated by applying the preset reboot operation to the result of applying the preset reboot operation. Here, the preset range may be [-1, 1] or

number

[0132] Then, a preset reboot operation is applied to the subtraction result between the operation result ciphertext and the first intermediate ciphertext to generate a second intermediate ciphertext (S620). Specifically, the subtraction result between the operation result ciphertext and the first intermediate ciphertext indicates an error change difference before and after the bootstrap, and the reboot result for the ciphertext indicates an error value that is equal to or greater than the error range of the approximation algorithm in the error.

[0133] Then, a subtraction operation of the second intermediate ciphertext is performed on the first intermediate ciphertext to generate a homomorphic ciphertext with an expanded plaintext space (S630). Specifically, when a subtraction homomorphic operation of subtracting the second intermediate ciphertext from the first intermediate ciphertext is performed, the errors in the first intermediate ciphertext that are equal to or larger than the error range of the approximation algorithm are removed, that is, the final ciphertext has an error value that is within the error range of the message and the approximation algorithm.

[0134] Meanwhile, although the reboot operation has been shown and described as being performed in one operation, in implementation, the above operation may be performed multiple times depending on the implementation method.

[0135] FIG. 7 is a flowchart for explaining the operation of expanding the plaintext space according to the present invention.

[0136] First, the modulus of the homomorphic ciphertext is expanded. Specifically, the modulus can be expanded to expand the plaintext (S710).

[0137] Then, the homomorphic ciphertext with the modulus extended is linearly transformed into a polynomial (S720). Specifically, the approximate modulus operation is performed using a polynomial. Thus, a linear transformation may be performed to transform the ciphertext into a polynomial. Such a linear transformation may be called SlotToCoeff. Specifically, since the polynomial of the homomorphic ciphertext is composed of complex numbers, a linear transformation may be performed using a predefined matrix to transform each coefficient of the polynomial into a form contained in a slot. Here, the predefined matrix may be a DFT (discrete Fourier transform) matrix. Meanwhile, in the present application, a preset reboot operation is performed twice in the meta-bootstrap process, and linear transformation may be performed in different manners in the first reboot operation and the second reboot operation. For example, since the first reboot operation is performed on the original message, a linear transformation may be performed in a manner having high accuracy, and since the second reboot operation is performed on an error in the ciphertext, a linear transformation may be performed in a manner having lower accuracy than the linear transformation performed previously.

[0138] The homomorphic ciphertext transformed into the polynomial form is subjected to an approximate modulus operation using a high-order equation set so that an input value within a preset range approximates an integer point (S730). Specifically, the homomorphic ciphertext transformed into the polynomial form may be subjected to an approximate modulus operation using a high-order equation set so that an input value within a preset range approximates an integer point.

[0139] Then, the result of the approximate modulus operation is linearly transformed into the form of a homomorphic ciphertext (S740). Specifically, the homomorphic ciphertext after the approximate modulus operation may be transformed into the form of a polynomial using an inverse matrix corresponding to the matrix used in the linear transformation of the homomorphic ciphertext, and the transformed polynomial may be transformed into the form of a ciphertext.

[0140] 7 shows that the linear transformation to the polynomial is performed after the modulus extension, but in practice, the linear transformation can be performed first, and then the modulus extension can be performed. In this case, the number of calculations in the reboot process can be reduced by performing calculations reflecting the value for modulus extension during the process of processing the DFT matrix used in the linear transformation.

[0141] In addition, although the conversion operation to a polynomial is shown and described in FIG. 7, in actual implementation, the ciphertext may be in the form of a polynomial. In such a case, the above-mentioned operation of linear conversion to a polynomial may be omitted. That is, the linear conversion operation 720 in FIG. 7 may be implemented in an omitted form.

[0142] 8 is a diagram showing an algorithm of a reboot operation according to a first embodiment of the present invention. The reboot operation algorithm according to the first embodiment assumes an input range of [-1, 1] and n-bit precision. In the table shown, x means a homomorphic ciphertext, and p means a modulus larger than q.

[0143] Referring to FIG. 8, first, the input range is converted to reflect the precision of the homomorphic ciphertext.

number

number

[0144] If only this is done, it is the same as a general reboot process, so a description of the specific algorithm of each process will be omitted.

[0145] Then, the difference between the homomorphic ciphertext before the reboot and the ciphertext resulting from the first reboot is calculated (tmp-op), and the second reboot is performed on the calculated result (BTS(temp2)).

[0146] Finally, the second reboot result (specifically, the reboot result relative to the difference between the reboot result and the error before the reboot) may be reflected on the first reboot result to generate a final homomorphic ciphertext.

[0147] 9 is a diagram showing an algorithm of a reboot operation according to the second embodiment of the present invention. The reboot operation algorithm according to the second embodiment includes the following steps:

number

[0148] Referring to FIG. 9, first, the input range is converted to reflect the precision of the homomorphic ciphertext.

number

number

number

[0149] Then, the difference between the homomorphic ciphertext before the reboot and the ciphertext of the first reboot result is calculated (temp-op), and the second reboot is performed on the calculated result (BTS(temp2)).

[0150] And finally, the second reboot result (specifically, the reboot result for the difference between the reboot result and the error before the reboot) may be reflected on the first reboot result to generate a final homomorphic ciphertext.

[0151] In the following, a case where the meta-bootstrap according to the present invention is applied to a homomorphic ciphertext of the fixed-point system will be described. First, assume that x=(slot[0], slot[1]) and the level of x is 4.

[0152]

number

[0153]

number

[0154]

number

[0155]

number

[0156]

number

[0157] Thus, the final result, the homomorphic ciphertext, contains e' as an error, but e' is a reboot error, so it is less than or equal to 2^(-30). In other words, it can be seen that both slot[0] and slot[1] have a precision of 30 or more digits. This can be represented graphically as shown in Figure 11.

[0158] Referring to Figure 11, we can see that even when using the fixed-point method, 30-bit precision is achieved. In fact, we can see that slot [0] achieves 50-bit precision instead of 30-bit precision.

[0159] In this way, the meta-bootstrap method according to the present invention makes it possible to expand the plaintext space without loss of precision, even for homomorphic ciphertexts in a fixed-point system.

[0160] Meanwhile, the ciphertext processing methods according to the various embodiments described above may be implemented in the form of program codes for performing each step, and may be stored in a recording medium and distributed. In this case, a device equipped with the recording medium may perform the above-mentioned encryption or encryption process.

[0161] Such recording media may be various computer readable media such as a ROM, a RAM, a memory chip, a memory card, an external hard drive, a hard drive, a CD, a DVD, a magnetic disk, or a magnetic tape.

[0162] Although the preferred embodiment of the present invention has been described in detail above with reference to the accompanying drawings, the present invention is not limited to the above embodiment. It is clear that a person having ordinary knowledge in the technical field to which the present invention pertains can conceive of various modified or altered examples within the scope of the technical intent described in the claims, and it is understood that these also naturally belong to the technical scope of the present invention.

Claims

1. performing a homomorphic ciphertext operation on the erroneous approximate message; expanding a plaintext space of the computation result ciphertext when a weight of the approximate message in the computation result ciphertext obtained by the computation exceeds a threshold; Including, The step of expanding the plaintext space comprises: applying a preset reboot operation to the operation result ciphertext to generate a first intermediate ciphertext; applying the preset reboot operation to a result of a subtraction operation between the operation result ciphertext and the first intermediate ciphertext to generate a second intermediate ciphertext; performing a subtraction operation of the second intermediate ciphertext on the first intermediate ciphertext to generate a homomorphic ciphertext that is expanded in a plaintext space; A method for processing homomorphic ciphertext including

2. The step of generating the first intermediate ciphertext comprises:

2. The method for processing a homomorphic ciphertext according to claim 1, further comprising: reflecting a scaling factor so that the operation result ciphertext has a predetermined range; applying a predetermined reboot operation to the operation result ciphertext reflecting the scaling factor; reflecting the scaling factor on a result to which the predetermined reboot operation has been applied; and generating the first intermediate ciphertext.

3. The preset range is: The method for processing a homomorphic ciphertext according to claim 2, wherein the ciphertext is [-1, 1].

4. The preset range is: [0010] 3. The method for processing homomorphic ciphertext according to claim 2, wherein k is the number of times the step of expanding the plaintext space is repeated, and n is the precision.

5. The preset reboot operation is: expanding the modulus of the homomorphic ciphertext; linearly transforming the modulus extended homomorphic ciphertext into a polynomial form; performing an approximate modulus operation on the homomorphic ciphertext converted into the polynomial form using a high-order equation set so that an input value within a preset range approximates an integer point; a step of linearly converting the result of the approximate modulus operation into a homomorphic ciphertext; The method of claim 1 , further comprising:

6. The preset reboot operation is: linearly transforming the homomorphic ciphertext into a polynomial form; expanding a modulus of the homomorphic ciphertext linearly transformed into the polynomial form; performing an approximate modulus operation on the modulus extended result; a step of linearly converting the result of the approximate modulus operation into a homomorphic ciphertext; The method of claim 1 , further comprising:

7. a memory for storing a homomorphic ciphertext for the erroneous approximate message; a processor for performing an operation on the homomorphic ciphertext; The processor, an arithmetic device that applies a predetermined reboot operation to the homomorphic ciphertext to generate a first intermediate ciphertext, applies the predetermined reboot operation to a result of a subtraction operation between the operation result ciphertext and the first intermediate ciphertext to generate a second intermediate ciphertext, and performs a subtraction operation of the second intermediate ciphertext on the first intermediate ciphertext to generate a homomorphic ciphertext with an expanded plaintext space.

8. The processor, 8. The computing device according to claim 7, further comprising: a scaling factor is applied to the computation result ciphertext so that the computation result ciphertext has a predetermined range; a preset reboot operation is applied to the computation result ciphertext to which the scaling factor has been applied; and the scaling factor is applied to a result to which the preset reboot operation has been applied, thereby generating the first intermediate ciphertext.

9. The preset range is: The arithmetic device according to claim 8, wherein the value is [-1, 1].

10. The preset range is: [0025] 9. The arithmetic device according to claim 8, wherein k is the number of iterations of the step of expanding the plaintext space, and n is the precision.

11. The processor, 8. The arithmetic device according to claim 7, further comprising: extending a modulus of a homomorphic ciphertext; linearly converting the homomorphic ciphertext with the modulus extended into a polynomial form; performing an approximate modulus operation on the homomorphic ciphertext converted into the polynomial form using a higher-order equation set so that an input value within a preset range approximates an integer point; linearly converting a result of the approximate modulus operation into the form of a homomorphic ciphertext; and performing the preset reboot operation.

12. The processor, 8. The arithmetic device according to claim 7, further comprising: a linear transform of the homomorphic ciphertext into a polynomial form; an extension of a modulus of the homomorphic ciphertext linearly transformed into the polynomial form; an approximate modulus operation being performed on a result of the extension of the modulus; a linear transform of a result of the approximate modulus operation being performed into the homomorphic ciphertext form; and a predetermined reboot operation being performed.

Images