Encryption method and device using homomorphic encryption

Abstract

To provide an encryption method and an encryption device using homomorphic encryption allowing customers to receive much service while keeping privacy.SOLUTION: An encryption method using homomorphic encryption includes the steps of: generating a cryptogram by encrypting data; and bootstrapping a cryptogram by performing modular reduction based on selection of at least one target point for a modulus corresponding to the cryptogram.SELECTED DRAWING: Figure 5

Description

[Technical field]

[0001] The following embodiments relate to an encryption method and device using homomorphic encryption. [Background technology]

[0002] Fully homomorphic encryption is an encryption method that allows any logical or mathematical operation to be performed on the encrypted data. Fully homomorphic encryption allows security to be maintained in data processing.

[0003] However, conventional encryption methods are insufficient in protecting customer privacy because it is difficult to process the encrypted data.

[0004] Fully homomorphic encryption allows customers to enjoy a wide range of services while still maintaining their privacy. Summary of the Invention [Problem to be solved by the invention]

[0005] An object of the present invention is to provide an encryption method and device using homomorphic encryption. [Means for solving the problem]

[0006] In one embodiment of a processor-implemented encryption method using homomorphic encryption, the encryption method includes the steps of encrypting data to generate a ciphertext, and bootstrapping the ciphertext by performing a modular reduction on a modulus corresponding to the ciphertext based on a selection of one or more target points.

[0007] The performing step may include performing the bootstrap by approximating a function that corresponds to the modular reduction.

[0008] The step of bootstrapping by approximating a function corresponding to the modular reduction may include generating a target approximation polynomial that approximates a function corresponding to the modular reduction.

[0009] The step of generating a target approximation polynomial that approximates a function corresponding to the modular reduction may include the steps of determining one or more reference points based on a degree of the target approximation polynomial, determining one or more reference points based on the degree of the target approximation polynomial, and generating the target approximation polynomial based on one or more extreme points selected from the arbitrary polynomial.

[0010] The determining step may include determining a piecewise continuous function that passes through the one or more reference points, and determining the arbitrary polynomial by generating a polynomial whose absolute value of an error between the piecewise continuous function and the one or more reference points is a predetermined value.

[0011] The step of determining the arbitrary polynomial by generating a polynomial in which the absolute value of the error with the piecewise continuous function is a predetermined value may include a step of determining the arbitrary polynomial by generating a polynomial in which the sign of the error at a first reference point included in the one or more reference points and the sign of the error at a second reference point adjacent to the first reference point are different, and the absolute value of the polynomial is the predetermined value.

[0012] The step of generating the target approximation polynomial based on one or more extreme points selected from the arbitrary polynomial may include the steps of determining candidate points, among extreme points of an error between the arbitrary polynomial and a piecewise continuous function passing through the one or more reference points, whose absolute value is greater than or equal to a predetermined value; selecting a number of target points from the candidate points based on the degree; and generating the target approximation polynomial based on the target points.

[0013] The step of selecting the target points may include selecting the target points such that local maxima and minima are alternately represented among the candidate points.

[0014] The step of selecting the target point may include selecting the target point such that a sum of absolute values ​​of the errors is maximized.

[0015] The step of generating the target approximation polynomial based on one or more extreme points selected from the arbitrary polynomial may include a step of generating a polynomial in the target approximation polynomial such that a relative error between a maximum value and a minimum value of the absolute values ​​of the one or more extreme points is smaller than a threshold value.

[0016] The basis of the target approximation polynomial may be a basis of Chebyshev polynomials.

[0017] The encryption device using homomorphic encryption includes one or more processors that encrypt data to generate a ciphertext, and bootstrap the ciphertext by performing a modular reduction on a modulus corresponding to the ciphertext based on the selection of one or more target points.

[0018] The encryption device further includes a memory storing instructions executed by the one or more processors, wherein the one or more processors are capable of executing the instructions to encrypt the data to generate a ciphertext and bootstrap the ciphertext by performing a modular reduction on a modulus corresponding to the ciphertext based on a selection of one or more target points.

[0019] The one or more processors may perform the bootstrap by approximating a function that corresponds to the modular reduction.

[0020] The one or more processors may generate a target approximation polynomial that approximates a function corresponding to the modular reduction.

[0021] The one or more processors may determine one or more reference points based on a degree of the target approximation polynomial, obtain an arbitrary polynomial based on the one or more reference points, and generate the target approximation polynomial based on one or more extreme points selected from the arbitrary polynomial.

[0022] The one or more processors can determine the arbitrary polynomial by determining a piecewise continuous function that passes through the one or more reference points, and generating a polynomial whose absolute value of an error between the piecewise continuous function and the one or more reference points is a predetermined value.

[0023] The one or more processors can determine the arbitrary polynomial by generating a polynomial in which an error at a first reference point included in the one or more reference points and an error at a second reference point adjacent to the first reference point have different signs and an absolute value that is the predetermined value.

[0024] The one or more processors can determine candidate points, among extreme points of an error between the arbitrary polynomial and a piecewise continuous function passing through the one or more reference points, whose absolute value is greater than or equal to a predetermined value, select a number of target points from the candidate points based on the degree, and generate the target approximation polynomial based on the target points.

[0025] The one or more processors may select the target points among the candidate points such that local maxima and minima are alternately represented.

[0026] The one or more processors may select the target point such that a sum of the absolute values ​​of the errors is maximized.

[0027] The one or more processors may generate a polynomial in which a relative error between a maximum value and a minimum value of the absolute values ​​of the one or more extreme points is smaller than a threshold value, using the target approximation polynomial.

[0028] The basis of the target approximation polynomial may be a basis of Chebyshev polynomials.

[0029] An apparatus for performing homomorphic encryption includes one or more processors that bootstrap a ciphertext of the encrypted data by approximating a function corresponding to a modular reduction based on the selection of one or more target points for a modulus corresponding to the ciphertext of the encrypted data, and generate a target approximation polynomial that approximates the function corresponding to the modular reduction.

[0030] The approximation polynomial can be generated using the Chebyshev alternation theorem.

[0031] The one or more processors may determine one or more reference points based on a degree of the target approximation polynomial, determine an arbitrary polynomial based on the one or more reference points, and generate the target approximation polynomial based on one or more extreme points selected from the arbitrary polynomial. Effect of the Invention

[0032] According to the present invention, it is possible to provide an encryption method and device using homomorphic encryption. [Brief description of the drawings]

[0033] [Figure 1] FIG. 1 shows a schematic block diagram of an encryption device according to an embodiment. [Figure 2A] An example of an algorithm for generating a target approximation polynomial by the encryption device shown in FIG. 1 is shown below. [Figure 2B] 2 shows another example of an algorithm for generating a target approximation polynomial by the encryption device shown in FIG. [Figure 2C] 2 shows a flowchart of an operation of the encryption device shown in FIG. 1 for generating a target approximation polynomial. [Diagram 3] 2 shows a flowchart of an operation of the encryption device shown in FIG. 1 for searching for a pole. [Figure 4A] 2 shows an example of an algorithm for the encryption device shown in FIG. 1 to select a target point. [Figure 4B] 2 shows a flowchart of an operation of the encryption device shown in FIG. 1 in selecting a target point. [Diagram 5] 2 shows the overall operation sequence of the encryption device shown in FIG. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0034] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings. However, various modifications can be made to the embodiments, and the scope of the patent application is not limited or restricted by the embodiments. All modifications, equivalents, or alternatives to the embodiments should be understood as being included in the scope of the patent.

[0035] The terms used in this specification are merely used to describe certain embodiments and are not intended to limit the present invention. A singular expression includes a plural expression unless the context clearly indicates otherwise. In this specification, the terms "include" or "have" indicate the presence of a feature, number, step, operation, component, part, or combination thereof described in the specification, and should be understood as not precluding the presence or addition of one or more other features, numbers, steps, operations, components, parts, or combinations thereof.

[0036] Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the art to which the present invention belongs. Commonly used predefined terms should be interpreted as having a meaning consistent with the meaning they have in the context of the relevant art, and should not be interpreted as ideal or overly formal unless expressly defined in this specification.

[0037] In addition, when describing the present invention with reference to the drawings, the same components are denoted by the same reference numerals regardless of the reference numerals, and duplicate descriptions thereof will be omitted. In the description of the embodiments, if a detailed description of related known technology is determined to unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted.

[0038] In addition, in describing components of the embodiments, terms such as first, second, A, B, (a), (b) and the like may be used. Such terms are used to distinguish the components from other components, and do not limit the nature, order, or sequence of the components. When a component is described as being "coupled", "coupled" or "connected" to another component, it should be understood that the component may be directly coupled or connected to the other component, but additional components may be "coupled", "coupled" or "connected" between each component.

[0039] Components included in any one embodiment and components having a common function will be described in other embodiments using the same names. Unless otherwise stated, the description of any one embodiment may be applied to other embodiments, and detailed description will be omitted to the extent that they overlap.

[0040] FIG. 1 shows a schematic block diagram of an encryption device according to an embodiment.

[0041] 1, an encryption device 10 encrypts data. The encryption device 10 generates encrypted data through the encryption of data. Hereinafter, the encrypted data is referred to as a ciphertext.

[0042] The encryption device 10 can provide an encryption technique that can perform an operation on data encrypted using homomorphic encryption without decrypting the data. For example, the encryption device 10 can derive a result that is the same as a result of an operation on data in a plain text state by decrypting a result of an operation on data encrypted using homomorphic encryption. The encryption device 10 can provide a homomorphic encryption operation for any real or complex number.

[0043] The encryption device 10 may perform bootstrap necessary for homomorphic encryption. The encryption device 10 generates a target approximation polynomial to approximate a function corresponding to modular reduction required for homomorphic encryption.

[0044] The encryption device 10 can calculate a minimax approximation error for each degree of the optimal minimax approximate polynomial.

[0045] The encryption device 10 can provide excellent performance in terms of the minimum and maximum approximation errors of homomorphic encryption schemes by searching for the optimal approximation polynomial using the target approximation polynomial.

[0046] The encryption device 10 generates a target approximation polynomial that approximates the modular reduction function, using approximation domain information for approximating the modular reduction function.

[0047] The encryption device 10 includes a processor 100 and a memory 200 .

[0048] The processor 100 processes data stored in the memory 200. The processor 100 executes computer readable code (e.g., software) stored in the memory 200 and instructions triggered by the processor 100.

[0049] "Processor 100" is a data processing device implemented in hardware having circuitry with a physical structure for performing intended operations. For example, the intended operations may include code or instructions contained in a program.

[0050] For example, a data processing device implemented in hardware may include a microprocessor, a central processing unit, a processor core, a multi-core processor, a multiprocessor, an application-specific integrated circuit (ASIC), or a field programmable gate array (FPGA).

[0051] The processor 100 generates ciphertext by encrypting data, and may bootstrap the ciphertext by performing a modular reduction on a modulus corresponding to the generated ciphertext.

[0052] The processor 100 performs bootstrap by approximating a function corresponding to a modular reduction. The processor 100 generates a target approximation polynomial that approximates a function corresponding to a modular reduction.

[0053] The processor 100 may determine one or more reference points based on the degree of the target approximation polynomial.

[0054] The processor 100 determines an arbitrary polynomial based on the determined one or more reference points. The processor 100 determines a piecewise continuous function that passes through the one or more reference points. The processor 100 can determine an arbitrary polynomial by generating a polynomial that has a predetermined absolute value of an error with the piecewise continuous function at the one or more reference points.

[0055] The processor 100 can determine any polynomial by generating a polynomial in which the signs of the error at a first reference point included in one or more reference points and the error at a second reference point adjacent to the first reference point are different and the absolute value is a predetermined value.

[0056] The processor 100 generates a target approximation polynomial based on one or more extremum points selected from the arbitrary polynomial. Specifically, the processor 100 may determine a candidate point whose absolute value is greater than or equal to a predetermined value among extremum points of an error between the arbitrary polynomial and a piecewise continuous function passing through one or more reference points.

[0057] The processor 100 selects a number of target points based on the degree of the target approximation polynomial from among the determined candidate points. The processor 100 may select the target points such that the candidate points alternate between local maxima and local minima. The processor 100 selects the target points such that the sum of absolute values ​​of errors between an arbitrary polynomial and a piecewise continuous function passing through one or more reference points is maximized.

[0058] The processor 100 generates a target approximation polynomial based on the selected target points. The processor 100 can generate a polynomial in the target approximation polynomial where a relative error between a maximum value and a minimum value of the absolute values ​​of one or more extreme points is less than a threshold value.

[0059] Here, the basis of the target approximation polynomial may be a basis of a Chebyshev polynomial.

[0060] The memory 200 stores instructions (or programs) executable by the processor. For example, the instructions may include instructions for performing operations of the processor and / or each component of the processor.

[0061] The memory 200 may be embodied in a volatile memory device or a non-volatile memory device.

[0062] The volatile memory device may be implemented as a dynamic random access memory (DRAM), a static random access memory (SRAM), a thyristor RAM (T-RAM), a zero capacitor RAM (Z-RAM), or a twin transistor RAM (TTRAM).

[0063] The non-volatile memory device may be embodied as an Electrically Erasable Programmable Read-Only Memory (EEPROM), a flash memory, a Magnetic RAM (MRAM), a Spin-Transfer Torque (STT)-MRAM, a Conductive Bridging RAM (CBRAM), a Ferroelectric RAM (FeRAM), a Phase change RAM (PRAM), a Resistive RAM (RRAM), a Nanotube RRAM, a Polymer RAM (PoRAM), a Nano Floating Gate Memory (NFGM), a holographic memory, a Molecular Electronic Memory Device, or an Insulator Resistance Change Memory.

[0064] 2A to 2C, a process of encryption and bootstrap performed by the encryption device 10 will be described in detail. After the description of the encryption operation performed by the encryption device 10, the bootstrap process will be described in more detail.

[0065] 2A and 2B show an example of an algorithm by which the encryption device shown in FIG. 1 generates a target approximation polynomial, and FIG. 2C shows a flowchart of the operation of the encryption device shown in FIG. 1 to generate a target approximation polynomial.

[0066] Referring to FIGS. 2A to 2C, the processor 100 may perform encryption on the data.

[0067] Below, notation for explaining the encryption operation of the processor 100 will be explained.

[0068]

number

[0069] The processor 100 supports several operations on real or complex encrypted data. Since the encryption device 10 mainly works with real numbers, noise that ensures the security of the encryption method may be introduced outside the critical elements of the data.

[0070] Several independent messages are encoded into one polynomial by canonical embedding before encryption.

[0071]

number

[0072] Fresh ciphertext means encrypted data upon which no operations have been performed or data that has been encrypted for the first time.

[0073] The processor 100 can set a public key (pk) and a secret key (sk) as shown in Equation (2).

[0074]

number

[0075]

number

[0076]

number

[0077]

number

[0078]

number

[0079] Additionally, the processor 100 may perform the complex conjugation and rotation operations used in the homomorphic linear transformation in bootstrap.

[0080] The bootstrap operation performed by the encryption device 10 will now be described.

[0081] The purpose of bootstrapping is to refresh the level 0 ciphertext, where no more multiplications can be performed, to generate the level L ciphertext with the same message.

[0082] Ciphertext means the encrypted data. The level of the ciphertext means the number of multiplications possible without bootstrapping.

[0083] Bootstrapping may include four operations: first, bootstrap includes a modulus increase operation, second, bootstrap includes an isomorphic linear transformation operation, third, bootstrap includes an isomorphic modular reduction operation, and fourth, bootstrap includes an isomorphic linear transformation operation.

[0084] The processor 100 may perform modulus increase. To explain the modulus increase operation, R 2 q0 Instead of R 2 Q Level 0 ciphertext may be used as an element of

[0085] The level 0 ciphertext is 〈ct,sk〉≒m mod q 0 Here, ct denotes a ciphertext and sk denotes a secret key. When the processor 100 decrypts the ciphertext, 〈ct,sk〉≒m+q for any I∈R. 0 It may have the form I mod Q.

[0086] Here, since the coefficients of sk have small numbers, the absolute values ​​of the coefficients of I have small numbers. For example, the absolute value of the coefficients of I has a value smaller than 12.

[0087] Processor 100 bootstraps the ciphertext of level 0 to find that 〈ct',sk〉≒m mod q L Therefore, the processor 100 can perform isomorphic calculations of isomorphic linear transformations and modular reduction functions.

[0088] The homomorphic linear transformation operation of the processor 100 is described below. After the modulus increase is performed, the ciphertext ct is m+q 0 It may be viewed as the ciphertext that encrypts I. The processor 100 performs a modular reduction homomorphically on the coefficients of the message polynomial.

[0089] Since the operations are on slots and not on the coefficients of the message polynomial, to perform meaningful operations on the coefficients, the processor 100 converts ct to m+q 0 We can convert the coefficients of I into a ciphertext that encrypts into that slot.

[0090] The processor 100 inversely transforms the ciphertext transformed after the calculation of the isomorphic modular reduction function into another ciphertext ct' that encrypts the slots of the previous ciphertext with the coefficients of the message. In the following, such transformation and inverse transformation operations are respectively denoted as C OEFF ToS LOT and S LOT ToC OEFF It is called.

[0091] The above two transformation operations can be regarded as isomorphic computations of message encoding and decoding, and Φ M It may be a linear transformation of some variable of the Vandermonte matrix for the roots of (x), and the transformation operation may be performed by a general homomorphic matrix multiplication or a fast Fourier transform-like operation.

[0092] The processor 100 may perform an isomorphic modular reduction (or modular reduction) operation. Specifically, the processor 100 may perform the modular reduction operation using an isomorphic modular reduction function.

[0093] C OEFF ToS LOT After the conversion is performed, the processor 100 calculates the modulus q 0We can perform a modular reduction on each slot in an isomorphic manner. In the following, such a process is called E VAL It is called MOD.

[0094] The processor 100 determines the range of messages as m / q 0 By restricting to be sufficiently small, we can make the approximation region q 0 Such a range restriction allows processor 100 to perform modular reduction more efficiently.

[0095] The algorithm shown in FIG. 2A will now be described in detail.

[0096] The processor 100 can generate a target approximation polynomial by searching for a minimum-maximum approximation polynomial for any continuous function on the interval [a, b] using Algorithm 1 shown in Fig. 2A. The processor 100 can generate a target approximation polynomial for which the equioscillation condition is satisfied using the Chebyshev alternation theorem.

[0097] The processor 100 selects basis functions {g 1 ,...,g n To generate a target approximation polynomial with degree d, the processor 100 uses basis functions {g 1 ,...,g n} into a power basis {1,x,...,x d}, where n=d+1 may be chosen.

[0098] The processor 100 can initialize a set of reference points that converge to the poles of the min-max approximation polynomial. The processor 100 obtains a min-max polynomial for the set of reference points. Since the set of reference points is a finite set of points in [a, b], it may be a closed subset of [a, b], and the Chebyshev alternating theorem is satisfied for the set of reference points.

[0099] If f(x) is a continuous function on [a,b], then the min-max approximation polynomial on the set of reference points is a function of the basis {g 1 ,...,g n}, which satisfies the condition of Equation (8) for any E value.

[0100]

number

[0101] The processor 100 is 0 =a,z n+1 =b i = 1, 2, ..., n, when x i and x i+1 Between p(x) and f(x), there are n zeros z i and obtain each [z i-1 ,z i ], where p(x)-f(x) is the n+1 extreme point of y 1 ,...,y n+1 can be obtained.

[0102] The processor 100 calculates p(x i )-f(x i )<0, then [z i-1 ,z i ], select the minimum point of p(x)-f(x), and i )-f(x i )>0, then [z i-1 ,z i ] can be used to select the maximum point of p(x)-f(x).

[0103] Through this, the processor 100 generates a new set of extreme points y 1 ,...,y n+1 can be selected as candidate points. If such candidate points satisfy the equioscillation condition, the processor 100 can generate the target approximation polynomial by returning the min-max approximation polynomial from the Chebyshev alternating theorem.

[0104] Also, the processor 100 converts the set of reference points into a new set of pole points, y 1 ,...,y n+1 and repeats the above-described process of generating polynomials.

[0105] Algorithm 1 shown in Fig. 2A may be extended to multiple sub-intervals of an interval. When applied to multiple sub-intervals, steps 3 and 4 of Fig. 2A are modified.

[0106] At each iteration, the processor 100 obtains all the regional extremes of the error function pf, the absolute error value of such regional extremes may be greater than the absolute error value at the current reference point.

[0107] Then, the processor 100 can select n+1 new extreme points among all the obtained regional extreme points such that the following two conditions are satisfied:

[0108] 1. Error values ​​are displayed with alternating signs.

[0109] 2. The new set of extreme points includes the global extreme points.

[0110] The above two conditions guarantee the convergence of the min-max generalized polynomial.

[0111] Figures 2B and 2C show a method of generating polynomials which is a modification of the algorithm shown in Figure 2A The processor 100 may change the method of selecting a new extreme point among all the regional extreme points.

[0112] The algorithm shown in Fig. 2B is shown in a flowchart in Fig. 2C. The processor 100 sets d+2 points in the approximation region (S210). The d+2 points refer to one or more reference points described above.

[0113] The processor 100 can obtain an arbitrary polynomial based on d+2 reference points. For example, the processor 100 searches for a polynomial p(x) and an E value that satisfy the formula (8) (S220).

[0114] The processor 100 acquires the local maximum points and the local minimum points of p(x)-f(x) whose absolute value is equal to or greater than E (S230). Here, the E value means the above-mentioned predetermined value, and the acquired local maximum points and local minimum points mean the candidate points described above.

[0115] The processor 100 selects d+2 points from the acquired points so that maximum and minimum are alternately displayed, and selects d+2 points so that the sum of the absolute values ​​of p(x)-f(x) is maximized (S240). The d+2 points whose sum of absolute values ​​is maximized refer to the target points described above. The process of selecting d+2 points so that the sum of absolute values ​​is maximized will be described in detail with reference to Figures 4A and 4B.

[0116] The processor 100 determines whether the relative error between the maximum and minimum absolute values ​​of the selected d+2 target points is smaller than δ (S250), where δ is the threshold value described above.

[0117] If the relative error between the maximum and minimum values ​​of the absolute values ​​corresponding to the target point is smaller than δ, the processor 100 outputs the arbitrary polynomial p(x) as the target approximation polynomial (S260). If not, the processor 100 repeats the steps of S220 to S250.

[0118] The operation of FIGS. 2B and 2C will now be described in more detail.

[0119] The function that the processor 100 attempts to approximate is a normalized modular reduction function that is defined only in the integer neighborhood of a finite number of numbers expressed in equation (9).

[0120]

number

[0121] To perform homomorphic evaluation efficiently, the processor 100 may approximate the cosine function using the double-angle formula to approximate normod(x).

[0122] By using the double angle formula l times, the cosine function in equation (10) must be approximated.

[0123]

number

[0124]

number

[0125] The processor 100 can set a criterion for selecting new d+2 reference points from multiple extreme points to approximate a piecewise continuous function given by a polynomial having a degree less than or equal to d on D in equation (11).

[0126] The processor 100 finds {g 1 ,...,g n} as a basis for the polynomials to generate the target approximation polynomial. The processor 100 can obtain the min-max approximation polynomial by the set of reference points in each iteration, and can select a new set of reference points in the next iteration.

[0127] The number of cases where n+1 points are selected from the extreme points of the error function calculated using an arbitrary polynomial obtained by the processor 100 using a set of reference points may be very large. Since many intervals may be considered in the encryption process performed by the processor 100, the number of candidate extreme points may be very large.

[0128] The processor 100 may select n+1 target points from among the multiple candidate points in each iteration to minimize the number of iterations, so that the processor 100 can generate a minimum-maximum approximation polynomial by converging the approximation polynomial generated in each iteration.

[0129] To set the criteria for selecting the n+1 target points, the processor 100 defines the function of equation (12).

[0130]

number

[0131] The processor 100 obtains all extreme points of p(x)-f(x) to generate a set B. B is a finite set, and B={x 1 ,x 2 ,...,x m} The processor 100 may select a point in an interval that belongs to B.

[0132] B is x 1 <x 2 <... <x m Assuming that the n-th powers are ordered in ascending order, the value of μ may be 1 or −1. The number of extreme points satisfies m≧n+1.

[0133] The processor 100 defines a set S of functions as shown in equation (13).

[0134]

number

[0135] The processor 100 can set three kinds of criteria for selecting the n+1 extreme points.

[0136] As a first condition, the processor 100 sets a local extreme value condition. If E is the absolute error at the set reference point, the condition of Equation (14) may be set.

[0137]

number

[0138] Secondly, the processor 100 sets an alternating condition. In other words, the condition of Equation (15) may be set. In other words, if one of two adjacent extreme points is a regional maximum, the other extreme point may be a regional minimum.

[0139]

number

[0140]

number

[0141] Also, the absolute error value of the current reference point is x 1 ,x n+1 may be a weighted average of the absolute error values ​​of the approximation polynomial in previous iterations.

[0142] The processor 100 uses the maximum absolute sum condition to make the absolute error value of the current reference point converge quickly as the minimum maximum approximation error.

[0143] The local extreme condition and the alternating condition are applied to all of the algorithms shown in Figures 2A and 2B, and the maximum absolute sum condition is applied to Algorithm 2 shown in Figure 2B. The processor 100 can accelerate the convergence of the minimum-maximum approximation polynomial by applying the maximum absolute sum condition.

[0144]

number

[0145] In other words, the processor 100 calculates the coefficient c j The values ​​may be obtained to generate the target approximation polynomial.

[0146]

number

[0147] Therefore, the processor 100 can efficiently solve the accuracy problem by using the basis of the Chebyshev polynomial as the basis of the target approximation polynomial. Since the coefficients of the polynomials using the Chebyshev basis have almost the same order, the processor 100 can generate the target approximation polynomial using the Chebyshev basis instead of the power basis.

[0148] The Chebyshev polynomials satisfy the Haar condition described above, and the processor 100 solves the system of d+2 linear equations of Equation (18) using d+2 reference points to obtain c j By calculating and E, the target approximation polynomial can be obtained.

[0149]

number

[0150] 3, the processor 100 can obtain an arbitrary polynomial based on a reference point and search for an extreme point of an error between the arbitrary polynomial and a piecewise continuous function passing through the reference point. The processor 100 can obtain a candidate point whose absolute value is greater than or equal to a predetermined value among the extreme points of an error between the arbitrary polynomial and a piecewise continuous function passing through the reference point. Hereinafter, a process in which the processor 100 searches for an extreme point and obtains a candidate point will be described.

[0151] The processor 100 can scan p(x)-f(x), which is the error between an arbitrary polynomial and a piecewise continuous function, in small steps to obtain the extreme points where the increase and decrease change.

[0152] In general, a smaller step increases the accuracy of the pole search, but may increase the scan time. Specifically, to obtain a pole with l-bit accuracy, 2 l time is spent proportional to

[0153] However, the processor 100 performs a search operation, which will be described later. l Instead of time, we can search for the extreme points in linear time of l.

[0154] The processor 100 can reduce the time required to search for the extreme point where the increase and decrease change by using a binary search method.

[0155] In what follows, we denote the error for any polynomial and piecewise continuous function as r(x) = p(x) - f(x), where sc denotes the scan step.

[0156]

number

[0157] The process of obtaining candidate points through the above-mentioned extreme point search will be described in detail below. The processor 100 obtains the smallest point x in the approximation region (S310). If x is a maximum value, the processor 100 determines whether r(x) is greater than or equal to the absolute value of E, and if x is a minimum value, whether r(x) is less than the absolute value of E multiplied by -1 (S320).

[0158] If the condition of step S320 is met, the processor 100 0 to array B (S321). If the condition of step S320 is not satisfied, the processor 100 assigns x+sc to x (S330).

[0159] Then, the processor 100 determines whether x is included in the approximation region (S340). If x is included in the approximation region, the processor 100 determines whether r(x)-r(x-sc) and r(x+sc)-r(x) have different signs (S350).

[0160] If x is not included in the approximation region, the processor 100 assigns the maximum value in the corresponding section to x (S341). Here, the processor 100 determines whether r(x) is greater than or equal to the absolute value of E if x is a maximum value, or whether r(x) is less than the absolute value of E multiplied by -1 if x is a minimum value (S342).

[0161] If the condition of step S342 is satisfied, the processor 100 0 to array B (S343), and if the condition of step S342 is not satisfied, it is determined whether x is the maximum value of the approximation region (S344). If x is the maximum value of the approximation region, the processor 100 ends the operation, and if x is not the maximum value of the approximation region, it assigns x to the smallest value of the next interval (S345).

[0162] If the signs of r(x)-r(x-sc) and r(x+sc)-r(x) are the same, the processor 100 executes the operation of step S330 again, and if the signs of r(x)-r(x-sc) and r(x+sc)-r(x) are different, it assigns 0 to l and sc / 2 to t (S360).

[0163] The processor 100 judges whether the value of r(x)-r(x-sc) is greater than 0 (S370). If the condition of step S370 is satisfied, the processor 100 selects the one with the greater r(x) value from among xt, x, and x+t, and assigns it to x (S371). After that, the processor 100 assigns l+1 to l, and assigns t / 2 to t (S372).

[0164] The processor 100 compares whether l is an accuracy value (S373, S374). If l is not an accuracy value, the processor 100 may perform the process of step S371 again. If l is an accuracy value, the processor 100 selects the one with the smaller r(x) value from among xt, x, and x+t, and assigns it to x (S375). After that, the processor 100 assigns l+1 to l and t / 2 to t (S376).

[0165] If the conditions of S373 and S374 are satisfied, the processor 100 may perform the operation of step S320 again. Finally, the processor 100 can obtain the extreme points belonging to the array B as the candidate points.

[0166] If the value of sc is small enough, then |r(x)| is a>0 and x * For b near a(xx * ) 2 Through such operations, the processor 100 can operate in a similar manner to x + b. * Near |x 1 -x * |<|x 2 -x * If |r(x 1 )|>|r(x 2 )|, and vice versa.

[0167] By obtaining the candidate points through the above-mentioned pole search, the processor 100 can obtain poles with l bit accuracy in 2 l Instead of time, we can search in linear time of l to obtain candidate points.

[0168] FIG. 4A shows an example of an algorithm by which the encryption device shown in FIG. 1 selects a target point, and FIG. 4B shows a flowchart of the operation of the encryption device shown in FIG. 1 in selecting a target point.

[0169] 4A and 4B, the processor 100 selects target points, the number of which is based on the degree of the target approximation polynomial, from among the candidate points found by the search operation shown in FIG.

[0170] The processor 100 selects a target point such that the candidate points alternate between maximum and minimum, and selects a target point such that the sum of the absolute values ​​of the errors is maximized. The target point can be a new reference point in the next iteration.

[0171] The process of obtaining the target point will be described in detail below. The processor 100 can naively select a point that satisfies the above-described regional extreme condition, alternation condition, and maximum absolute sum condition to search for the target point (or new reference point).

[0172] A naive selection method may calculate the absolute sum for all n+1 points for which the alternation condition is satisfied, and select the n+1 points with the maximum absolute sum. In the case of a naive selection method, if the number of regional extremes is m, ( m n+1 ) points must be examined.

[0173] 4A and 4B, the processor 100 can reduce the time required to select a target point compared to a naive method. The operation of efficiently selecting a target point will be described below.

[0174] The processor 100 can finally obtain n+1 target points by removing some elements from among the candidate points for each iteration. If m>n+1, there may be at least one point that is not included in the target points.

[0175] 4A, the processor 100 selects a target point in O(mlogm) time, or in other words, the processor 100 can select a target point in quasi-linear time.

[0176] Each time an element is removed from the ordered set B, the remaining elements may be sorted and relabeled in ascending index order.

[0177] When processor 100 compares values ​​to remove some extreme points in algorithm 4a, if there are one or more elements whose compared values ​​are the same or have the smallest value, it may randomly remove such elements.

[0178] The flowchart shown in Fig. 4B shows the order of operations of the algorithm shown in Fig. 4A. Through the operations of Fig. 4A and Fig. 4B, the processor 100 can obtain an array B having the target point as an element.

[0179] The processor 100 assigns 1 to i (S410). i and x i+1 It is determined whether both are maximum or minimum (S420).

[0180] If the condition of step S420 is satisfied, the processor 100 i and x i+1Among them, values ​​with a small |r(x)| value are removed from the array, and the elements of the array are rearranged (S421). The |r(x)| value means an error value of any polynomial and piecewise continuous function described above. If the condition of step S420 is not satisfied, the processor 100 assigns i+1 to i (S422).

[0181] After rearrangement, processor 100 will i It is determined whether x is the largest point in array B (S430). i If is not the largest point, the processor 100 performs operation 420 again.

[0182] The operations in steps S410 to S430 correspond to the operations in steps 1 to 7 of algorithm 3 shown in FIG. 4A.

[0183] x i is the largest point, the processor 100 judges whether the number of elements of B is d+2 (S440). If the number of elements of B is d+2, the processor 100 ends the selection operation of the target point.

[0184] If the number of elements in B is not d+2, the processor 100 sorts all the sums of the |r(x)| values ​​of two adjacent points into the array T (S450). In other words, |r(x 1 )|+|r(x 2 )|,|r(x 2 )|+|r(x 3 )|,|r(x 3 )|+|r(x 4 )|,··· can be put into T for sorting.

[0185] The operations in steps S440 to S450 correspond to the operations in steps S9 to S10 of the algorithm shown in FIG. 4A.

[0186] The processor 100 judges whether the number of elements in B is d+3 (S460). If the number of elements in B is d+3, the processor 100 1 , x d+3The values ​​with the smallest |r(x)| value are discarded from the array, the array is rearranged, and the operation is terminated (S461).

[0187] The processor 100 judges whether the number of elements in B is d+4 (S470). If the number of elements in B is d+4, the processor 100 adds |r x1 |+|r xd+4 Then, the processor 100 removes the two points corresponding to the smallest value in T from B, rearranges them, and ends the operation (S472).

[0188] If the number of elements in B is not d+4, the processor 100 judges whether one of the two points at both ends is included among the two points corresponding to the smallest value in T (S480). If the condition in step S480 is satisfied, the processor 100 discards one of the two points at both ends from B and rearranges it (S481). If the condition in step S480 is not satisfied, the processor 100 discards all of the two points corresponding to the smallest value in T from B and rearranges it (S482).

[0189] Then, processor 100 discards values ​​including the discarded elements from T, adds the sum of the |r(x)| values ​​of the two newly adjacent points, and realigns them, and then performs the operation of step S460 again (S490). The operations of steps S460 to S490 correspond to the operations of steps S11 to S23 shown in FIG. 4A.

[0190] Regarding the case where the extreme point X2 is removed in the final part of the algorithm shown in FIG. 4A, T = {|r(x 1 )|+|r(x 2 )|,|r(x 2 )|+|r(x 3 )|,|r(x 3 )|+|r(x 4 )|,···} teeth, T = {|r(x 1 )|+|r(x 3 )|,|r(x 3)|+|r(x 4 )|,···} is changed to:

[0191] The target point selection operations shown in FIGS. 4A and 4B allow the processor 100 to select a target point from the candidate points in quasi-linear time.

[0192] The processor 100 can generate a target approximation polynomial that best approximates the modular reduction function based on the selected target point. In other words, the processor 100 can generate a d-th degree polynomial that passes through the selected target point by the target approximation polynomial.

[0193] FIG. 5 shows the overall sequence of operations of the encryption device shown in FIG.

[0194] The processor 100 encrypts the data using homomorphic encryption. The processor 100 generates a ciphertext by encrypting the data (S510).

[0195] The processor 100 bootstraps the generated ciphertext by performing a modular reduction on a modulus corresponding to the generated ciphertext based on the selection of one or more target points (S530).

[0196] The processor 100 may perform bootstrap by approximating a function corresponding to a modular reduction. The processor 100 generates a target approximation polynomial that approximates a function corresponding to a modular reduction.

[0197] The processor 100 determines one or more reference points based on the degree of the target approximation polynomial. The processor 100 obtains an arbitrary polynomial based on the determined one or more reference points.

[0198] Specifically, the processor 100 can obtain any polynomial by obtaining a piecewise continuous function that passes through one or more reference points, and generating a polynomial whose absolute value of the error with the piecewise continuous function at one or more reference points is a predetermined value.

[0199] The processor 100 can obtain any polynomial by generating a polynomial in which the signs of the error at a first reference point included in one or more reference points and the error at a second reference point adjacent to the first reference point are different and the absolute value is a predetermined value.

[0200] The processor 100 generates a target approximation polynomial based on one or more extreme points selected from the acquired arbitrary polynomial. The processor 100 can acquire candidate points whose absolute value is greater than or equal to a predetermined value from among extreme points of an error between the arbitrary polynomial and a piecewise continuous function passing through one or more reference points.

[0201] The processor 100 selects the target points from the obtained candidate points, the number of which is based on the degree of the target approximation polynomial. Specifically, the processor 100 may select the target points from the candidate points such that local maxima and minima are alternately shown. The processor 100 may select the target points such that the sum of the absolute values ​​of errors of any polynomial of the piecewise continuous function is maximized.

[0202] The processor 100 generates a target approximation polynomial based on the selected target points. The processor 100 can generate a polynomial using the target approximation polynomial when a relative error between a maximum value and a minimum value of the absolute values ​​of one or more extreme points is smaller than a threshold value.

[0203] Here, the basis of the target approximation polynomial may be that of the Chebyshev polynomial.

[0204] The method according to the embodiment may be embodied in the form of program instructions to be executed by various computer means and recorded on a computer readable recording medium. The recording medium may include program instructions, data files, data structures, and the like, alone or in combination. The recording medium and the program instructions may be specially designed and constructed for the purposes of the present invention, or may be well known and available to those skilled in the art of computer software. Examples of computer readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code, such as produced by a compiler, but also high-level language code executed by a computer using an interpreter, and the like. The hardware devices may be configured to operate as one or more software modules to perform the operations shown in the present invention, and vice versa.

[0205] The software may include computer programs, codes, instructions, or any combination of one or more thereof, capable of configuring or instructing a processing device to operate as desired, either independently or in combination. The software and / or data may be embodied in any type of machine, component, physical device, virtual device, computer storage medium or device, or transmitted signal wave, either permanently or temporarily, to be interpreted by the processing device or to provide instructions or data to the processing device. The software may be distributed across computer systems coupled to a network, and may be stored and executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

[0206] Although the embodiments have been described above with reference to limited drawings, those skilled in the art may apply various technical modifications and variations based on the above description. For example, the described techniques may be performed in a different order than described, and / or the components of the described systems, structures, devices, circuits, etc. may be combined or combined in a different manner than described, or may be replaced or substituted with other components or equivalents to achieve appropriate results.

[0207] Accordingly, other implementations, other embodiments, and equivalents of the claims are within the scope of the following claims.

Claims

1. 1. A processor-implemented method for encryption using homomorphic encryption, comprising: encrypting the data to generate a ciphertext; bootstrap the ciphertext by performing a modular reduction on a modulus corresponding to the ciphertext based on a selection of one or more target points; wherein the performing step includes a step of performing the bootstrap by performing a step of generating a target approximation polynomial that approximates a function corresponding to the modular reduction; The step of generating a target approximation polynomial that approximates a function corresponding to the modular reduction includes: determining one or more reference points based on a degree of the target approximation polynomial; obtaining an arbitrary polynomial based on the one or more reference points; generating the target approximation polynomial based on the target points determined based on one or more extreme points selected from the arbitrary polynomial; An encryption method, including

2. the determining step includes determining a piecewise continuous function that passes through the one or more reference points; determining the arbitrary polynomial by generating a polynomial whose absolute value of an error with the piecewise continuous function at the one or more reference points is a predetermined value; The encryption method of claim 1 , comprising:

3. 3. The encryption method of claim 2, wherein the step of determining the arbitrary polynomial by generating a polynomial in which the absolute value of an error with the piecewise continuous function is a predetermined value includes a step of determining the arbitrary polynomial by generating a polynomial in which an error at a first reference point included in the one or more reference points and an error at a second reference point adjacent to the first reference point have different signs and the absolute value is the predetermined value.

4. The step of generating the target approximation polynomial based on one or more extreme points selected from the arbitrary polynomial includes: determining a candidate point, among extreme points of an error between the arbitrary polynomial and a piecewise continuous function passing through the one or more reference points, whose absolute value is greater than or equal to a predetermined value; selecting a number of target points from the candidate points based on the order; generating the target approximation polynomial based on the target points; The encryption method of claim 1 , comprising:

5. The encryption method according to claim 4 , wherein the step of selecting the target points includes the step of selecting the target points such that local maxima and minima are alternately represented among the candidate points.

6. 5. The encryption method of claim 4, wherein the step of selecting the target point includes the step of selecting the target point such that a sum of absolute values ​​of the errors is maximized.

7. 2. The encryption method according to claim 1, wherein the step of generating the target approximation polynomial based on one or more extreme points selected from the arbitrary polynomial includes a step of generating a polynomial from the target approximation polynomial when a relative error between a maximum value and a minimum value of the absolute values ​​of the one or more extreme points is smaller than a threshold value.

8. The encryption method of claim 1 , wherein the basis of the target approximation polynomial is a basis of a Chebyshev polynomial.

9. A computer program that causes the processor to execute the encryption method described in any one of claims 1 to 8.

10. In an encryption device using homogeneous encryption, one or more processors for encrypting data to generate a ciphertext and for bootstrapping the ciphertext by performing a modular reduction on a modulus corresponding to the ciphertext based on a selection of one or more target points; the one or more processors perform the bootstrap by generating a target approximation polynomial that approximates a function corresponding to the modular reduction; When the one or more processors generate a target approximation polynomial that approximates a function corresponding to the modular reduction, determining one or more reference points based on a degree of the target approximation polynomial; Obtaining an arbitrary polynomial based on the one or more reference points; An encryption device that generates the target approximation polynomial based on the target point that is determined based on one or more extreme points selected from the arbitrary polynomial.

11. further comprising a memory for storing instructions to be executed by the one or more processors; 11. The encryption device of claim 10, wherein the one or more processors execute the instructions to encrypt the data to generate ciphertext and bootstrap the ciphertext by performing a modular reduction on a modulus corresponding to the ciphertext based on a selection of one or more target points.

12. The one or more processors: determining a piecewise continuous function that passes through the one or more reference points; The encryption device according to claim 10, wherein the arbitrary polynomial is determined by generating a polynomial whose absolute value of an error between the piecewise continuous function and the one or more reference points is a predetermined value.

13. The encryption device of claim 12, wherein the one or more processors determine the arbitrary polynomial by generating a polynomial in which an error at a first reference point included in the one or more reference points has a different sign from an error at a second reference point adjacent to the first reference point, and whose absolute value becomes the predetermined value.

14. The one or more processors: determining a candidate point whose absolute value is greater than or equal to a predetermined value among extreme points of an error between the arbitrary polynomial and a piecewise continuous function passing through the one or more reference points; Selecting a number of target points based on the order from among the candidate points; The encryption device of claim 10 , further comprising: a step of generating the target approximation polynomial based on the target points.

15. The encryption device of claim 14 , wherein the one or more processors select the target points such that local maxima and minima are alternately represented among the candidate points.

16. The encryption device of claim 14 , wherein the one or more processors select the target point such that a sum of absolute values ​​of the errors is maximized.

17. The encryption device according to claim 10 , wherein the one or more processors generate a polynomial in which a relative error between a maximum value and a minimum value of the absolute values ​​of the one or more extreme points is smaller than a threshold value, using the target approximation polynomial.

18. The encryption device according to claim 10 , wherein a basis of the target approximation polynomial is a basis of a Chebyshev polynomial.

19. In a device for performing homogeneous encryption, bootstrap a ciphertext of the encrypted data by approximating a function corresponding to a modular reduction based on a selection of one or more target points to a modulus corresponding to the ciphertext of the encrypted data; one or more processors for generating a target approximation polynomial that approximates the function corresponding to the modular reduction; the one or more processors perform the bootstrap by generating a target approximation polynomial that approximates a function corresponding to the modular reduction; When the one or more processors generate a target approximation polynomial that approximates a function corresponding to the modular reduction, determining one or more reference points based on a degree of the target approximation polynomial; determining an arbitrary polynomial based on the one or more reference points; An apparatus for generating the target approximation polynomial based on the target points determined based on one or more extreme points selected from the arbitrary polynomial.

20. 20. The apparatus of claim 19, wherein the target approximation polynomial is generated using Chebyshev alternation theorem.

Images