Fully homomorphic encryption with improved data item representation

Abstract

Some embodiments are directed to a fully homomorphic encryption (FHE) cryptography method in which some encrypted data items are clipped to reduce the bit size of the encrypted data items and increase the associated noise level of the encrypted data items, and an FHE operation or decryption operation operating on the clipped encrypted data items as input has a noise tolerance that exceeds the noise level associated with the clipped encrypted data items.

Description

[Technical field]

[0001] The subject matter of the present disclosure relates to methods for performing a computation using fully homomorphic encryption, methods for configuring a set of FHE operations to perform a computation, methods for reducing the size of encrypted data items for use in a computation using fully homomorphic encryption, systems for performing a computation using fully homomorphic encryption, systems for configuring a set of FHE operations to perform a computation, systems for reducing the size of encrypted data items, and computer-readable media. [Background technology]

[0002] Since Craig Gentry's landmark paper "Fully Homomorphic Encryption Using Ideal Lattices" (Commun. ACM53(3):97-105, full version in 2010), there have been ongoing efforts to make Fully Homomorphic Encryption (FHE) efficient enough for real-world applications. FHE allows computations, such as circuit evaluation, to be performed on encrypted data without being able to decrypt it. For example, input data and computation results may be received and returned in encrypted form. Intermediate data, such as the internal state of a computation, may also be in encrypted form.

[0003] The results of a computation are returned in encrypted form, but when decrypted, the output is the same as if the operation had been performed on the unencrypted data. Homomorphic encryption can be used for privacy-preserving outsourced storage and computation, whereby data can be encrypted and outsourced to a cloud environment for processing and / or storage, all in encrypted form.

[0004] For example, homomorphic encryption may be applied in fields such as medicine, where privacy regulations make sharing plain data difficult, but computation of encrypted medical data may be acceptable. For example, a medical model developed to classify medical data may be configured to receive medical data in encrypted form from a third party, such as a hospital. The medical model may, for example, classify the medical data as, for example, normal or abnormal, or having some particular medical syndrome, disease, or other disorder. Homomorphic encryption may be used to apply the medical model to the medical data received in encrypted form. This means that the party providing the medical model does not have access to the plain medical data corresponding to the encrypted medical data. A user of the service may decrypt the results of the application of the medical model.

[0005] Medical images may include multidimensional image data, e.g., two-dimensional (2D), three-dimensional (3D), or four-dimensional (4D) images, acquired by various acquisition modalities, such as, but not limited to, standard X-ray imaging, computed tomography (CT), magnetic resonance imaging (MRI), ultrasound (US), positron emission tomography (PET), single photon emission computed tomography (SPECT), and nuclear medicine (NM).

[0006] Cryptosystems that support arbitrary computations on ciphertexts are known as fully homomorphic encryption (FHE). Such schemes allow the evaluation of a wide range of functions that can be performed on encrypted inputs to produce encrypted results. For example, when a combination of and and or gates becomes available, so-called functional completeness can be obtained, since this allows the realization of arbitrary Boolean circuits. Such can be executed by untrusted parties without revealing their inputs and internal state. Fully homomorphic encryption can be leveled, in which case the number of certain operations cannot exceed a given threshold. A level fully homomorphic scheme can be converted to a non-level FHE scheme by performing a bootstrap operation. A bootstrap operation increases the number of operations that can be performed on encrypted data items.

[0007] Fully homomorphic encryption may support computations that are expressed in some special form, such as Boolean or arithmetic circuits. For example, level-fully homomorphic encryption may support the evaluation of arbitrary circuits, but of a limited predefined depth. Non-level-fully homomorphic encryption (FHE) allows the evaluation of arbitrary circuits of unlimited depth. Level-FHE schemes can be converted to non-level-FHE by periodically performing bootstrap operations on the data. It is known how to compile computations, such as functions, in the form of circuits.

[0008] Since Gentry's paper, many FHE schemes have been developed, reducing the computation time by orders of magnitude. Many FHE schemes are currently known. A more recent example of an FHE scheme is described in the paper "Fast Fully Homomorphic Encryption over the Torus" by Ilaria Chillotti et al. (J. Cryptology 33(1): 34-91, 2020). Nevertheless, there remains a need to further improve the efficiency of FHE schemes. [Prior art documents] [Non-patent literature]

[0009] [Non-Patent Document 1] Craig Gentry, "Fully Homomorphic Encryption Using Ideal Lattices", Commun. ACM 53(3): 97-105, 2010. [Non-Patent Document 2] Ilaria Chillotti et al., “TFHE:Fast Fully Homomorphic Encryption over the Torus”, J.Cryptology33(1):34-91, 2020 [Non-Patent Document 3] Rothblum, Ron. 2011. "Homomorphic Encryption: From Private-Key to Public-Key", Theory of Cryptography (Tcc2011), edited by Y. Ishai, pp. 6597:219-34. Lecture Notes in Computer Science. Springer. https: / / doi.org / 10.1007 / 978-3-642-19571-6_14. [Non-Patent Document 4] https: / / bitbucket.org / malb / lwe-estimator / [Non-Patent Document 5] Jacob Alperin-Sheriff, Chris Peikert, “Faster Bootstrapping with Polynomial Error”, Advances in Cryptology-CRYPTO2014, Lecture Notes in Computer Science, volume 8616, pp. 297-314. Springer, 2014 Summary of the Invention [Means for solving the problem]

[0010] Improved FHE encryption methods would be advantageous. Current systems suffer from issues such as long latency and high storage needs. To address these and / or other issues, methods are provided for performing computations using fully homomorphic encryption methods. A clipping operation is introduced; clipping an FHE encrypted data item reduces the bit size of the encrypted data item. This increases the associated noise level of the encrypted data item, but keeps it below the noise tolerance of the subsequent FHE or decryption operations. This advantageously reduces the size of the encrypted data item without affecting security. Clipping can often be performed because modern FHE schemes can have a relatively high noise threshold. In practice, the noise level is typically selected as a system parameter that can be set to a chosen threshold depending on other FHE parameters, so that the overall security meets the expected level. Interestingly, the clipping operation can also define a set of FHE parameters that lead to insecure instantiations. For example, a secure encryption can be clipped to a shorter value to maintain a secure system, but encryption without clipping that has the same length as the clipped item may not be secure. Further examples are discussed herein.

[0011] Experiments have shown that the encrypted data items can be reduced by about half, and in some cases even more, while only slightly increasing the noise, thus improving the efficiency of the system. The use of clipping operations can reduce the delay significantly.

[0012] For example, storing clipped encrypted data items requires less storage space. For example, transmitting clipped encrypted data items has a shorter delay. This allows distributed computation. For example, computations on clipped encrypted data items require fewer computer instructions, gates, etc., because the inputs are smaller. Clipping does not compromise security; on the contrary, by inserting clipping operations, more of the computations are done at a higher noise level, which is a disadvantage to attacking the system.

[0013] For example, a first operation at a first computing device may produce a first encrypted output, while a second operation at a second computing device requires the first encrypted output as an input. The first encrypted data item may be clipped at the first device before transmitting it to the second device to reduce delay. In particular, if the second operation is or includes a bootstrap operation or is a decryption operation, a relatively large number of the encrypted data items may be clipped.

[0014] In one embodiment, encrypted data items, and in particular clipped data items, may be represented as tuples of values ​​in signed digit representation.

[0015] An aspect of the invention is to configure a set of FHE operations to include a clipping operation. An aspect of the invention is to reduce the size of stored encrypted data items. An aspect of the invention is a system for performing the calculation, configuration and / or size reduction. These systems are electronic systems or devices. For example, these systems may be configured to receive input over a computer network.

[0016] One aspect is computer program code, such as software, configured to perform the calculations, configuration, and / or size reduction when the computer program code is executed on a computer. One aspect of the invention is a computer readable medium including computer program code. One aspect of the invention is a computer readable medium including calculations implemented in FHE operations, including one or more clipping operations, resulting from, for example, a configuration method.

[0017] Embodiments may be applied in a wide range of applications, eg, neural networks, eg, image classifiers, eg, medical image classifiers, eg, control systems, eg, privacy preserving computing, etc.

[0018] The method according to an embodiment can be implemented on a computer as a computer-implemented method or on dedicated hardware, or a combination of both. The executable code of the method embodiment can be stored in a computer program product. Examples of computer program products include memory devices, optical storage devices, integrated circuits, servers, online software, etc. Preferably, the computer program product includes non-transitory program code stored in a computer-readable medium for executing the method embodiment when executed on a computer.

[0019] In one embodiment, the computer program includes computer program code configured to perform all or part of the steps of an embodiment of the method when the computer program is run on a computer. Preferably, the computer program is embodied on a computer readable medium. Another aspect of the subject matter of the present disclosure is a method of making a computer program available for downloading.

[0020] Further details, aspects and embodiments are described, by way of example only, with reference to the drawings, in which elements are illustrated for simplicity and clarity and are not necessarily drawn to scale, and in which elements corresponding to elements already described may have the same reference numerals. [Brief description of the drawings]

[0021] [Figure 1a] FIG. 1 illustrates a schematic diagram of an example embodiment of a system for performing computations using fully homomorphic encryption (FHE). [Figure 1b] FIG. 1 illustrates a schematic diagram of an example embodiment of a system for performing computations using FHE. [Figure 1c] FIG. 1 illustrates a schematic diagram of an example embodiment of a system for performing computations using FHE. [Figure 1d] FIG. 1 illustrates a schematic diagram of an example embodiment of a system for performing computations using FHE. [Figure 1e] FIG. 1 illustrates a schematic diagram of an example embodiment of a system for performing computations using FHE. [Diagram 2] FIG. 1 illustrates a schematic diagram of an example embodiment of a system for performing computations using FHE. [Figure 3a] FIG. 1 illustrates a schematic diagram of an example embodiment of clipping and one or more FHE operations. [Figure 3b] FIG. 1 illustrates a schematic diagram of an example embodiment of clipping and one or more FHE operations. [Figure 3c] FIG. 1 illustrates a schematic diagram of an example embodiment of clipping and one or more FHE operations. [Figure 3d] FIG. 1 illustrates a schematic diagram of an example embodiment of clipping and one or more FHE operations. [Figure 4a] FIG. 1 illustrates a schematic diagram of an example embodiment of a system for performing neural network computations using FHE. [Figure 4b]FIG. 1 illustrates a schematic diagram of an example embodiment of a system for performing neural network computations using FHE. [Figure 4c] FIG. 1 illustrates a schematic diagram of an example embodiment of a multi-sum calculation using FHE. [Figure 5a] FIG. 1 illustrates a schematic diagram of an example embodiment of a method for performing calculations using FHE. [Figure 5b] FIG. 1 illustrates a schematic diagram of an example embodiment of a method for configuring a set of FHE operations to perform a calculation. [Figure 5c] FIG. 1 illustrates a schematic diagram of an example embodiment of a method for reducing the size of encrypted data items for use in computations using fully homomorphic encryption (FHE) cryptography; [Figure 6a] 1 is a schematic diagram of a computer readable medium containing a computer program according to one embodiment and having a writable portion; [Figure 6b] FIG. 1 is a schematic diagram illustrating a representation of a processor system according to one embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0022] List of reference numbers for Figures 1a-4c, 6a, 6b: The following list of references and abbreviations is provided to facilitate interpretation of the drawings and should not be construed as limiting the scope of the claims. 110 FHE Computing System 111-115 FHE Computing System 130 Processor System 140 Storage 141 Storage 150 Communication Interface 160 Data Provider Systems 161 Encrypted Data Items 170 Data Size Reduction System 180 FHE configuration system 181 Calculation expression 200 FHE system 210 Multiple Encrypted Data Items 211-212 Encrypted Data Items 220 Pool of multiple encrypted data items 221-223 Encrypted Data Items 230 Computational Networks 231-234 FHE Calculation 240 Cryptographic Components 241 Encryption Key 250 Decoding Components 321-323 Encrypted Data Items 331-333 FHE Calculation 341-342 Clipping operations 351-352 Bootstrap calculation 361 Transfer 401 First FHE Device 402 Second FHE Device 431 FHE multiple sum operation 432, 433 Combined FHE Bootstrap and Activation Function Computation 434, 436 FHE multiple sum operation 435 Bootstrap calculation 441 Clipping Operations 461 Transfer 1000, 1001 Computer-readable medium 1010 Writable area 1020 Computer Programs 1110 Integrated circuits 1120 Processing Device 1122 Memory 1124 Special Purpose Integrated Circuit 1126 Communication Elements 1130 Interconnect 1140 Processor System

[0023] While the presently disclosed subject matter can be embodied in many different forms, which are illustrated in the drawings and described in detail herein with respect to one or more specific embodiments, it is to be understood that the present disclosure is to be considered as an exemplification of the principles of the presently disclosed subject matter and is not intended to be limited to the specific embodiments shown and described.

[0024] In the following, elements of the embodiments are described in terms of operations for ease of understanding, however, it will be apparent that each element is configured to perform the functions described as being performed by it.

[0025] Furthermore, the presently disclosed subject matter is not limited to only the embodiments, but also includes all other combinations of features described herein or recited in mutually different dependent claims.

[0026] 1a illustrates generally an example of an embodiment of an FHE computation system 110, e.g., a system for performing computations using fully homomorphic encryption (FHE) cryptography. For example, the system 110 of FIG. 1a may be used to perform computations on data, even if the data is received in encrypted form, e.g., from a data provider. The system illustrated in FIG. 1a may additionally or alternatively be configured as a system for configuring a set of FHE operations to perform a computation and / or as a system for reducing the size of encrypted data items for use in computations using fully homomorphic encryption (FHE) cryptography.

[0027] The system 110 may comprise a processor system 130, a storage 140, and a communication interface 150. The storage 140 may comprise a local storage, e.g., a local hard drive or electronic memory. The storage 140 may comprise a non-local storage, e.g., a cloud storage. In the latter case, the storage 140 may comprise a storage interface to the non-local storage. For example, the storage 140 may store encrypted data items, e.g., received from one or more data providers, or generated as intermediate or final results of a computation, e.g., output. Typically, most or all data items on which the computations of the system 110 are performed are encrypted with a key that is not known to the system 110—that is, the system 110 may not be configured to obtain plain data items corresponding to the encrypted data items, e.g., as stored in the storage 140. The encryption / decryption keys may be available in encrypted form, although the decryption keys in plain form are secret to the system 110. For example, a processor system can be configured to perform a series of FHE operations and apply clipping to, for example, improve efficiency, reduce latency, reduce storage size, etc.

[0028] The system 110 can communicate internally with other systems, external storage, input devices, output devices, and / or one or more sensors over a computer network. The computer network can be the Internet, an intranet, a LAN, a WLAN, etc. The computer network can be the Internet. The system comprises a connection interface configured to communicate within the system or outside the system as needed. For example, the connection interface can comprise a connector, such as an Ethernet connector, a wired connector, such as an optical connector, or a wireless connector, such as an antenna, such as a Wi-Fi, 4G or 5G antenna. Communications, e.g., internal communications, can use other communication protocols or media, e.g., an internal data bus.

[0029] System 110 may use communications interface 150 to send or receive digital data. For example, system 110 may be configured to receive encrypted data items from an external computer, such as a data provider computer. For example, system 110 may be configured to transmit computation results, typically in an encrypted format, to the external computer. For example, communications interface 150 may be used for internal communication within system 110, to distribute computations of multiple computing entities, such as computing devices, and the like.

[0030] Execution of system 110 may be implemented in a processor system, e.g., one or more processor circuits, such as microprocessors, examples of which are provided herein. System 110 may include multiple processors, which may be distributed in different locations. For example, system 110 may use cloud computing.

[0031] Some of the diagrams show functional units that may be functional units of a processor system. For example, the diagrams can be used as blueprints for possible functional configurations of a processor system. In most diagrams, the processor circuitry is not shown separated from the units. For example, the functional units shown in FIG. 2 (see below) may be implemented in whole or in part in computer instructions stored in a system such as system 110, for example in an electronic memory of system 110, and executable by a microprocessor of system 110. In hybrid embodiments, the functional units are implemented in part in hardware, for example in a coprocessor, such as an arithmetic and / or cryptographic coprocessor, and in part in software stored and executed on system 110.

[0032] FIG 1b illustrates a schematic of an example embodiment of a system for performing computations using FHE. FIG 1b illustrates the FHE system of FIG 1a in the context of a data provider system 160. The FHE system 110 is configured to perform computations using fully homomorphic encryption (FHE) cryptography.

[0033] For example, the system 110 may be configured to receive encrypted data items from the data provider 160. At least some of the data items may be received in encrypted form. Some of the data items may be received in plain format. Computations are performed on the received data items, and possibly also on the stored data items. Interestingly, computations may be performed on the encrypted data without decrypting the data, e.g., without converting the encrypted data items into data in plain format.

[0034] System 110 may be configured with several FHE operations, sometimes called gates. For example, an FHE system may be configured with so-called NAND gates. For example, an FHE system may have addition and multiplication operations, for example, in finite fields or finite rings. The operations of the FHE operations are in principle sufficient to perform a wide range of calculations, except that the size of the calculations may be limited if, for example, the FHE system is a level system without bootstrap operations or where bootstrap operations are not employed.

[0035] Typically, data encrypted in an FHE system contains some noise: for example, encryption of a data item can involve mapping the data item to a point in a key-dependent lattice to which some noise is added.

[0036] When a data item has just been encrypted, the noise is low and the encryption is fresh. For example, the amount of noise is so low that when the data item is decrypted, at some point in the decryption process, the noise can be removed, for example by rounding. On the other hand, the noise needs to be large enough to make attacks on the system difficult enough. For example, in the hypothetical absence of noise, many FHE schemes can be attacked with linear algebra or other efficient algorithms, for example lattice-based algorithms. When a data item is encrypted, noise is added that is chosen to make attacks difficult while still allowing FHE operations to be performed. Most FHE operations increase the noise inherent in the encrypted FHE data item. When many such operations are performed, the noise reaches a level where a unique decryption is no longer possible. At that point the scheme breaks down. In general, two approaches have been developed in the art to address this phenomenon. The first is Level FHE. Level FHE allows several operations to be performed one after the other. Level FHE is designed so that at the end of several such operations, the worst-case noise is below the limit required for decryption. Another approach is the so-called bootstrapping operation. The bootstrapping operation reduces noise in the encrypted data item. If FHE is strong enough to perform the decryption operation in the encrypted domain, then the bootstrapping operation is possible (sometimes called bootstrap-able FHE). For example, the bootstrapping operation receives helper data associated with the encryption key that can remove noise without allowing the decryption of the encrypted data item. Typically, the helper data is an encrypted version of the key used to decrypt the data item. Note that the decryption key may be the same as the encryption key, as in the case of symmetric encryption, or it may be different from the encryption key, such as in the case of public-key-based FHE.

[0037] The bootstrap operation performs decryption of the encrypted data items, but counterintuitively the decryption does not actually reveal anything about the plain data items, since it is performed in the encrypted domain. The bootstrap operation then performs noise removal, usually by rounding. The result is an encrypted data item with a lower, fixed noise level. Any noise that is normally present in the ciphertext due to bootstrapping is due to the bootstrap operation.

[0038] After bootstrapping, a series of new FHE operations can be performed until the noise level becomes so high that a new bootstrap operation is required.

[0039] Interestingly, even if a bootstrap operation is available for a particular FHE scheme, it may not be employed. For example, when the depth of the calculation is low, e.g., calculating the average of several numbers or comparing two numbers, which fits within the limits of a level FHE scheme, the entire calculation, which may include the application of several FHE operations, may be performed without bootstrapping. The noise level of the result of the calculation, e.g., the average, will be higher than the noise in the input, but the FHE parameters of the FHE scheme can be chosen such that the operation is performed without bootstrapping. For example, a given FHE scheme may be configured to evaluate a circuit, e.g., a circuit of arithmetic or Boolean gates. The FHE scheme may be leveled, e.g., limited to circuits of a certain depth. When more complex calculations are required, e.g., for the evaluation of larger medical models, e.g., for the evaluation of neural networks, e.g., for the evaluation of image classifiers, bootstrap operations may be interspersed with other FHE operations. Bootstrap operations have the advantage of reducing noise and thus increasing the number of operations that can be performed one after the other, but the disadvantage of being relatively resource-heavy operations. The number of bootstrap operations required depends on the FHE scheme. For example, a relatively low-level FHE scheme may require a bootstrap operation after each gate evaluation. Another configuration, for example, may be able to perform a relatively large number of FHE operations before a new bootstrap is required.

[0040] Determining when bootstrapping is necessary can be done, for example, by tracking what the noise level is, assuming a worst case scenario. An average case can be assumed instead of the worst case, but this can increase the risk that the computation result is not decodable. As will be further described herein, this analysis can be done in advance, but can also be done dynamically. The noise increase can depend on the particular computation. For example, in FHE multiplication, the noise increases by an amount that depends on the multiplicand.

[0041] It was the inventor's insight that in some parts of the computation the noise of the encrypted data items may be lower than is acceptable. For example, the noise level may be designed based on worst case assumptions and the worst part of the computation. In other parts of the computation, such as just before a decryption operation, or before a bootstrap operation, the level of noise may be lower than is necessary to successfully perform these operations. Clipping the encrypted data items, for example artificially reducing the size of the encrypted data items, will increase their noise level, but if this occurs in places where such low noise is not required, the benefits associated with a smaller bit size are obtained without the downside of a significantly higher risk of decryption failure.

[0042] For example, a set of encrypted data items may be received encrypted according to a certain standard noise level. If the computational complexity is low, e.g., a linear operation such as computing an average easily fits the level of the FHE scheme, the received encrypted data items or some intermediate values ​​may be clipped to shorten their size. Although clipping increases the noise level, this is fine as long as the computational complexity is such that the computations can be performed on the encrypted data items with increased noise.

[0043] Similarly, where the computation is more complex and involves bootstrapping, it is generally necessary for the input noise level to be below a noise limit so that the bootstrap can be performed. However, if the operations preceding the bootstrap have increased the noise to a level below the limit, the noise level can be artificially increased by clipping the encrypted data items. The increase in noise is undone by the bootstrap, after which the encrypted data items have a fixed amount of noise. Clipping can occur before the bootstrap operation, but can also occur earlier, such that one or more operations are performed on the clipped encrypted data before the bootstrap is performed.

[0044] The FHE scheme can be applied in many settings. For example, the FHE system 110 can be operated by a cloud provider. The cloud provider can provide computational and storage services to clients. By employing FHE encryption, the data provider 160, e.g., a client of the cloud provider, can send data in encrypted form. The cloud provider can still perform the necessary computations and / or the necessary storage, but cannot know what corresponds to the plain data. For example, the data provider 160 can encrypt a data item using an encryption key of a type that corresponds to the particular FHE system used. Once the computation results are received by the data provider 160 from the FHE system 110, the corresponding decryption key can be used to decrypt the encrypted data item. The encryption key and the decryption key can be—and usually are—the same.

[0045] For example, the system 110 may be configured to train a machine learning model, e.g., an image classifier, e.g., a medical model, without access to the plain data items. For example, linear regression may be performed on the input data, possibly without bootstrapping. For example, backpropagation may be performed on the input data, possibly with bootstrapping. The resulting model parameters may be returned to the entity in possession of the decryption key. This allows multiple providers of medical data to pool data by sending the data to a cloud provider, which then returns the model parameters without accessing the plain data.

[0046] After the model is trained, the FHE system 110 can be used to provide the model for use with medical data. This can be done using plain model parameters or encrypted model parameters - in both cases using encrypted data, such as encrypted input, intermediate, and output data. Typically, using plain model parameters is much more efficient because noise levels can be better determined and more aggressive clipping can be employed, such as clipping more digits of the encrypted data items. In both cases, the effect of the system is that computations such as image classification, such as medical image classification, are performed without the computer knowing the plain data items. For example, mammograms can be evaluated for cancer without the image always being plain in the system 110 and without the system 110 knowing what the results of the cancer evaluation are. From a privacy perspective, it may be acceptable to operate a plain model on encrypted privacy-sensitive data, but not on plain privacy-sensitive data.

[0047] Other uses include database services, for example, searching encrypted data in an encrypted database; for example, the computation can be a comparison of an input item to a database item. For example, multiple computations can be combined to produce a database index that matches the index. For example, the database can be a genomic database, and the input is a gene sequence. For example, the system 110 can be used for secured control of a device. For example, the device, even a large device such as a power plant, can send sensor values ​​to the system 110 and receive an encrypted control signal in return. The control signal is computed from the sensor signal. An attacker of the system may be able to determine the content of the data going to or from the system 110, or to access intermediate data in the system 110, but the attacker is not aided by this because the data is encrypted. Even if the system 110 is completely broken, the data will not be revealed because the system 110 does not know the decryption key. Computing the control signal can include mathematical operations such as linear algebra, averaging, matrix multiplication, polynomial evaluation, etc., all of which may be performed with FHE operations.

[0048] FIG. 2 illustrates generally an example of an embodiment of a system 200 for performing computations using FHE. For example, the system of FIG. 2 may be implemented in an FHE system such as system 110. Shown in FIG. 2 are one or more encrypted data items 210. Shown are encrypted data items 211 and 212. For example, a data provider system such as data provider system 160 may, for example, use encryption component 240 to encrypt a corresponding plain data item with encryption key 241.

[0049] The encrypted data items may be used by the FHE system to perform computations. For example, a pool 220 of encrypted data items may be maintained in the FHE system. For example, the FHE system may be configured to apply an FHE operation to one, two, or more encrypted data items in the pool 220. The result is a new encrypted data item that may be stored in the pool. The pool 220 may be stored in the storage of the FHE system, which may be local storage or distributed storage. In the latter case, one or more encrypted data items may be represented multiple times in the pool. The encrypted data items may be sent from one computing device to another computing device if their values ​​are needed elsewhere. The pool 220 may be realized in various ways, for example, as a register file, an array, various data structures, etc.

[0050] For example, in an FHE scheme based on the Learning With Errors (LWE) problem, such as the Torus FHE system mentioned in the Background Art, the encryption key is a string of n numbers, e.g., bits, s i and the ciphertext is a tuple (a1,…,a n ,b), where

number

[0051] Thus, an encrypted data item, such as encrypted data item 210 or 220, may include a tuple of numbers, e.g., an integer modulo a modulus. An encrypted data item, such as encrypted data item 210 or 220, may include a tuple of polynomials, e.g., an integer modulo an integer modulo a modulus and an integer modulo a polynomial modulus. For example, the polynomial modulus may be a cyclotomic polynomial, or the like.

[0052] The tuple s can be considered as an encryption key for the encrypted item. In this case, the decryption key can be taken to be identical to the encryption key. Thus, the decryption key corresponding to an encrypted data item can include weights for a linear combination of elements in the tuples representing the encrypted data item. In this above example, the weight of s is combined with the weight of b -1 to create a combination of the plain data item and the decrypted noise (value μ+e in this case). Rounding the latter gives the plain data μ. In one embodiment, the encrypted data item includes tuples; the decryption key corresponding to the encrypted data item includes weights for a linear combination, said linear combination of tuples creating a combination of the plain data item and the noise.

[0053] More generally, a lattice may be defined and encryption may consist in mapping the plaintext to the lattice and adding noise e. FHE operations may be defined on such elements. Decryption may involve rounding to the nearest lattice point and decrypting the lattice point back to the plain data. Typically, a level of noise is associated with a data item encrypted with an FHE scheme. The underlying FHE scheme used defines one or more operations that can be performed on the encrypted data item. Typically, the noise associated with an encrypted data item increases as operations are performed on it. An exception is a bootstrap operation, which may reduce the noise associated with an encrypted data item.

[0054] The encrypted data items 210 can represent any kind of data. For example, the encrypted data items 210 can represent numbers that need to be averaged, or numbers used for linear regression, etc. For example, the encrypted data items can represent an image. For example, each pixel of the image can correspond to one or more encrypted data items. For example, a grayscale pixel can be represented by a gray level, which can then be represented by a single encrypted data item. For example, 256 gray levels can be encoded into a single encrypted data item. For example, a color pixel can be represented by multiple color levels, e.g., RGB levels, which can then be represented by a tuple of encrypted data items. For example, three 256 levels of color can be encoded into three encrypted data items. The number of encrypted data items used to represent a certain type of data depends on the capabilities of the FHE scheme. For example, a more restrictive FHE scheme may only be able to encode one bit per encrypted data item. In that case, 24 encrypted data items may be required for one color pixel.

[0055] Without access to the decryption key it may not be possible to say exactly how much noise there is, but it can usually be bounded, e.g. because the initial noise level of a fresh encryption is known, and because the noise increase for various operations is known. The noise increase may depend on the type of operation, e.g. addition vs. multiplication, and other parameters, if any. For example, an FHE operation may be a multiplication with a known, e.g. plain value, e.g. multiplication by 2, multiplication with a known polynomial, etc. For example, a multiplication of a large value may increase noise more than a multiplication of a small number. Exactly how much noise is increased by a performed operation can be mathematically calculated or empirically estimated. Some operations add a significant amount of noise, while others do not, e.g. addition with a plain constant.

[0056] A set of FHE operations can be defined for a computation. For example, from the FHE operations, a network or circuit of operations that together perform the computation can be constructed. For example, computation network 230 or computation circuit is shown in FIG. 2. Network 230 includes multiple FHE operations 231-234. For example, some may be additions and others may be multiplications. For example, the operations may be Boolean operations. For example, the operations may all be NAND operations. The way in which the FHE operations are combined, e.g., which operations are applied to which operands in pool 220, determines the computation that is performed. For example, computation network 230 can be represented as a list of FHE operations to be performed together with an indication of which FHE encrypted data items they should be performed on. For example, network 230 can be represented as a graph. For example, a representation of network 230 can indicate which operators depend on which other operators, e.g., using edges in the graph. For example, the representation can indicate the order in which the operations are performed.

[0057] As operations are performed, the noise associated with the newly computed stale encrypted data items may become large. This is not a problem as long as the noise is within the limits required for decryption. If further operations are to be performed, a bootstrapping operation can be performed.

[0058] The size of data items encrypted with FHE schemes can be very large. Furthermore, the more operations an FHE scheme performs without a bootstrapping operation, the larger the size of the encrypted data items typically becomes. Similarly, using larger FHE parameters, and therefore larger encrypted data items, provides greater resistance to attacks. For example, a data item may be mapped to an FHE system featuring larger FHE parameters, thus adding more noise while still successfully performing the operations. The larger size of the encrypted data items may cause problems.

[0059] Typically, the level of noise is designed such that, in the worst part of the computation, with the worst computation parameters, and / or with the worst input values, the computation is likely to complete successfully, and thus the final decoding when the computation is complete is likely to be successful. Even if average conditions are assumed instead of the worst case, in some places the noise level that is accepted may be over-designed, i.e., the computation is configured for a higher noise level in one or more places in the computation than will actually be encountered. Clipping operations can take advantage of these situations.

[0060] Clipping the encrypted data reduces its storage size, e.g., the number of bits required to store or transmit the encrypted data item. On the other hand, clipping increases the noise level of the encrypted data level. Reducing the size of the encrypted data item by clipping has several advantages. A particularly important advantage is that the delay when the encrypted data item is transmitted is reduced. The transmission of the encrypted data item may be a frequently performed operation, for example, when the computation is distributed across multiple computing devices. Reducing the size of the encrypted data item reduces the delay and enables distributed computation. This is particularly advantageous because modern FHE operations have become very fast and the scale of computations that can be performed in FHE is becoming increasingly large. For such large computations, it is particularly advantageous if they can be performed on multiple computers. Computing on multiple computers has the advantage of load balancing. Computing on multiple computers also has the advantage of using parallel processing to increase the computation speed.

[0061] Clipping is performed at a point in the calculation where the noise level remains within a range of tractable noise levels for one or more subsequent operations even after the artificial increase in noise level, where artificial noise increase refers to the increase in noise caused by the clipping operation, as opposed to the natural noise present in fresh ciphertext or the noise caused by operations on the ciphertext.

[0062] Two operations are particularly important in this respect: bootstrapping and decryption. If clipped encryption is relied upon and all operations, including the bootstrap or decryption operations, can handle the increased noise level, the effect of clipping is eliminated. This is because the bootstrap operation resets the noise level to that relative to a given value, whereas decryption removes the noise completely. These two operations therefore remove the artificially increased noise level, assuming they themselves can be successfully performed.

[0063] In this regard, it should be noted that the decryption operation is typically not performed in the FHE system 200, but rather in a client computer, e.g., the data provider that sent the encrypted data item 210. The decryption component 250 may be configured to decrypt the output of the system 200, e.g., using a decryption key. For example, in the case of symmetric encryption, the decryption key may be the same as the encryption key 241. For example, the decryption key is a decryption key that corresponds to the encryption key 241, but is a different decryption key, e.g., in the case of asymmetric encryption. The decryption component 250 may be included in or connected to the data provider 160.

[0064] It should be noted that although the bootstrap operation is computed on the system 200, the computation may not include, e.g., not require, bootstrap. If the computation fits the level of the FHE scheme, e.g., if the computation is fairly simple, bootstrapping is not required. With modern FHE schemes, more computations can be done without bootstrapping, and this trend is expected to continue.

[0065] There are different ways to perform the clipping operation. For example, if the encrypted data item contains a tuple of numbers, the clipping operation can be performed on the numbers in the tuple individually. If the tuple contains multiple polynomials, clipping can be performed on the coefficients of the polynomials. Note that even when polynomials are used, the encrypted data item is usually also represented as a tuple of numbers, e.g. as a vector of polynomial coefficients.

[0066] For example, an encrypted data item may be clipped by discarding one or more digits. For example, the least significant digits of a number representing the encrypted data item may be discarded. Discarding digits may include discarding corresponding bits used to represent the digits. Discarding one or more digits may also directly correspond to discarding bits, for example when the numbers are represented in a ring or field with a number of elements that is a power of 2, e.g., a ring / field of characteristic 2. For example, in a field / ring of characteristic 3, a clipping operation may discard base 3 digits. Base 3 digits may be represented internally as 2-bit numbers, so clipping one base 3 digit results in a reduction of 2 bits. Base 3 numbers may also be represented entirely in bits, rather than digit-wise. In that case, digits may still be discarded; for example, a number stored as bits may be converted to a base 3 representation, one or more digits may be discarded, and the number then converted back to a bit representation. The end result is still increased noise and reduced bit size.

[0067] The discarding can be done by removing digits and possibly freeing up storage space, alternatively the discarded digits can be replaced with zeros etc. Note that in addition to discarding digits, the remaining digits can be modified. For example, discarding digits is preferably done by rounding the numbers - i.e. rounding to the nearest number. Another way to clip is to scale the numbers, e.g. towards a smaller range of numbers. A rounding operation can be performed after scaling. Instead of rounding, a floor or ceiling operation can be performed. The discarding can be done by truncation. Rounding is preferred over a floor or ceiling operation because rounding introduces less noise but still achieves the same reduction in storage size. Note that rounding can propagate due to carries.

[0068] For example, the tuple (x1,…,x n+1 ), in the above example, this is represented as a tuple (a1, ,…,a n, b). The elements of the tuple can be, for example, values ​​of a ring, a field, or another mathematical structure. Clipping can be implemented as a function that can be applied component-wise. For example, the function c can be, for example, (c( x1 ),…,c(x n+1 )), where function c can be a truncation+rounding operation.

[0069] More generally, clipping is performed by reducing the resolution of the encrypted data item, which increases noise and reduces storage size. For example, one can take the most significant part of the representation and round to the nearest value.

[0070] FIG. 1c illustrates a schematic example of an embodiment of a system for performing computations using FHE. Shown in FIG. 1c are a data provider system 160 and three FHE devices: devices 111, 112, and 113. Each of devices 111, 112, and 113 can perform FHE operations and / or clipping operations on encrypted data items. The three devices together form an FHE system. There may be two or more than three FHE devices cooperating to form an FHE system.

[0071] In the case of Figure 1c, the computation is distributed across multiple FHE devices, although three FHE devices are shown in this example. For example, one of the multiple FHE devices may transmit an encrypted data item, such as a received encrypted data item, or an intermediate encrypted data item, such as a partial computation result, to one or more of the other multiple FHE devices. Similarly, each of the multiple FHE devices may be configured to receive encrypted data items from the other devices.

[0072] Because encrypted data items in an FHE system can be quite large, transmitting data between FHE devices can incur significant overhead. One or more of the FHE devices can perform a clipping operation before transmitting the encrypted data item. This reduces transmission delays. Especially for highly correlated calculations, such as neural network calculations, the clipping operation can provide a significant reduction in total computation time.

[0073] For example, FHE device 111 can receive an encrypted data item from data provider 160. FHE device 111 can clip the received encrypted data item and transmit it to device 112 and / or 113. For example, FHE devices 111, 112, and / or 113 can perform one or more FHE operations to obtain an intermediate encrypted data item, clip the intermediate encrypted data item, and transmit it to one or more of the other devices. Clipping can occur immediately before transmission, but can also occur before, such that FHE operations are performed on the clipped encrypted data item before transmission, and so on. Multiple FHE devices can cooperate to send and receive encrypted data items as needed, preferably performing computations together, at least partially in parallel.

[0074] Interestingly, the devices can clip the encrypted data items before transmitting them, but keep the unclipped data items locally. This has the advantage that for example the bootstrap calculation can be postponed, since the locally encrypted data items are less noisy, but also has the advantage of reducing delays. At the receiving device, the bootstrap calculation can be performed earlier. Thus, the calculations can be performed at least partly in parallel on at least the first device and the second device.

[0075] For example, consider a first operation f on a first device A and a second operation g on a second device B. For example, assume the following:

[0076] A: Calculate f(x1, x2). A needs to receive the encryption of x1 and x2. B: Calculate g(x1,x3). B needs to receive the encryption of x1 and x3.

[0077] Since encrypted data items can be large, sending these ciphertexts increases latency. For example, assume that device B has encryptions of x1 and x2, and device A needs them. Device B can clip these encrypted data items and send them to device A. For example, on device B, a calculation can be performed on the encrypted data items, producing, for example, an encryption of x2, if h(...,x4,...)=x2. Device B then performs the clipping and sends the clipped encryption of x2. When calculating with clipped values, it is important to note that the clipped parts may interact as well. This can be solved by replacing the clipped values ​​with zeros; for example, the remaining part after the clipping operation can be filled with zeros.

[0078] A particularly advantageous way of representing the encrypted value is to use a signed digit representation, in which the digits are selected from ±d, where d≦base / 2. As noted herein, the base may be 2 or a power of 2, or more generally any integer. The advantage of a signed digit representation is that the noise increase due to clipping is on average smaller; for example, the number 64 in base 10 can be written as (1)(−4)(4); for example, to represent 111 in base 2, it can be written as 100(−1).

[0079] Signed digit representation can also be used in clipped values: if necessary, numbers in the normal digit representation can be converted to signed digit representation, for example as part of a clipping operation.

[0080] If desired, device A can first perform bootstrapping on the received data items prior to function f, or perform a combination of bootstrap+function, e.g., a combination of bootstrap and function f, e.g., a bootstrap+activation function. The advantage of bootstrapping the received data is that it is easy to calculate how much clipping can be done, e.g., clipping a number of digits with an amount of noise boost that fits the remaining noise reserve of the encrypted data items.

[0081] Figure 1d illustrates a schematic example of an embodiment of a system for performing computations using FHE. In the example illustrated in Figure 1d, encrypted data items are stored for later FHE processing.

[0082] For example, FHE system 114—which may be a single device or multiple devices, e.g., as in FIG. 1c—may store the encrypted data items in storage 141. Storage 141 may be local storage or online storage, e.g., cloud storage. For example, FHE device 115 may later retrieve the encrypted data items from storage 141 and apply FHE operations to them.

[0083] For example, storage 141 can store a database of encrypted data items. For example, the database can be a medical database that stores, for example, genomic information. For example, storage 141 can store and perform calculations on other types of data, such as sensor data.

[0084] Before storing the encrypted data items, the FHE system 114 may first clip the encrypted data items. This reduces the storage requirements of the encrypted data items. Alternatively, the encrypted data items may be stored unclipped. The data size reduction device may perform the clipping operation at a later point in time. For example, FIG. 1d illustrates an optional data size reduction system 170. The data size reduction system 170 may be configured to retrieve one or more encrypted data items from the storage 141 and apply a clipping operation to the encrypted data items, which reduces the bit size of the encrypted data items and increases the associated noise level of the encrypted data items. An FHE system that uses the clipped data later may perform a bootstrap operation to reduce the noise level back to a lower level if necessary. The size reduction system 170 may perform other functions, such as repacking the clipped encrypted data items to better utilize the storage space freed up due to clipping. For example, assume that x1 and x2 are two encrypted data items that are stored sequentially next to each other. The size reduction device 170 may clip data item x1 and move x1 to be stored next to x2 again. For example, x1 may be moved but x2 may not be moved, or both x1 and x2 may be moved. For example, the size reduction device 170 may clip all clippable data items and then pack the data items in memory, e.g., store them adjacent to each other.

[0085] 1e illustrates generally an example of an embodiment of a system 110 for performing computations using FHE. For example, as in FIG. 1b, the FHE system 110 can receive one or more encrypted data items from a data provider system 160. The system 110 can be configured by an FHE configuration system 180.

[0086] The selection of appropriate locations for the clipping and / or bootstrap operations may be done statically or dynamically, for example before or during the calculations.

[0087] For example, configuration system 180 can be used statically. For example, configuration system 180 can be configured to receive a representation of a computation, e.g., computation representation 181. Computation representation 181 can take the form of a gate list, an operator list, a circuit description, etc., and may, for example, already reference available FHE operations. Computation representation 181 may be in a higher level language, e.g., expressing a formula to be computed. In the latter case, configuration system 180 may include a compiler for compiling computation representation 181. Thus, configuration system 180 obtains a set of FHE operations to be executed to perform the computation; as described herein, the set may be a network, graph, netlist, etc.

[0088] Once the configuration system 180 has a set of FHE operations to be performed to perform a computation, the configuration system 180 can estimate the noise levels of the encrypted input data items, intermediate data items, etc. For example, the configuration system 180 can use known formulas that limit the noise levels to a given input noise level and limit the operations to be performed. Typically, the known formulas depend on the particular FHE system used. While such mathematical limits can be formulated, in principle the noise levels can be established empirically, for example by simulating the system multiple times and decrypting the intermediate results. The empirical assessment is better performed statically prior to the actual computation.

[0089] Based on the noise calculation, the configuration system 180 can determine the point in the calculation where the noise level becomes too high; the configuration system 180 can counter this by inserting a bootstrapping operation. This is optional, but in typical embodiments, a bootstrapping operation is already included in the representation 181, if desired.

[0090] Based on the noise calculation, the configuration system 180 can determine a point in the calculation where the noise level is lower than necessary. For example, the estimated noise level before the bootstrapping operation or before the decoding may be lower than the level required for the bootstrapping operation or the decoding operation. Note that the decoding information may be included in the analysis of the configuration system 180 even if the decoding operation is not performed by the FHE system 110. Once it is established that the noise is low, e.g., below a threshold, the system can insert a clipping operation. For example, the clipping can be inserted just before the bootstrapping and / or decoding; for example, the clipping can be inserted one or more operations before the bootstrapping and / or decoding. Preferably, the clipping is pushed back until before a transmission or storage step. Such a transmission or storage step may be included in the set 181, e.g., as a dummy operation that keeps the noise constant.

[0091] To determine whether a clipping operation can be applied to the encrypted data item inserted before the operation, the configuration system 180 can determine the encrypted data items derived from the selected encrypted data item and the operations performed on them. For example, the network of operations can be traced forward from the selected encrypted data item. The latter search does not need to be extended beyond the bootstrap or decryption operations. From the operations found, the acceptable noise level of the selected encrypted data can then be derived. If the estimated noise level of the selected encrypted data is found to be below the acceptable noise level, the noise can be increased to this limit by inserting a clipping operation that clips the selected data item.

[0092] In a simple implementation of the FHE operation 181, it may be sufficient to simply limit the number of operations performed between two bootstraps, regardless of type. In such cases, only a rough limit is needed to select the number of operations. Such embodiments can gain many benefits from clipping. In a more complex implementation, more or fewer operations may be inserted between bootstraps in response to an increase in the noise of the operation. Still, there remains an opportunity for clipping in that case as well. Additionally, in addition to the clipping operation, additional bootstrap operations can also be inserted. For example, in the case of transmission, a clipping operation can be inserted before transmission and a bootstrap operation can be inserted after transmission.

[0093] For example, assume that the encrypted data item x has a noise level e. The operation O is applied to x, and subsequently the bootstrap operation B within the noise tolerance w is applied. Further, assume that the noise level of x is doubled by the operation - for example, assume that the operation can be a multiplication using small numbers. If 2e < w, there may be room for clipping before the operator O. For example,

Number

[0094] Typically, decisions regarding clipping, bootstrapping, etc. are performed before any computations are made, e.g., before the encrypted data items 161 are received. However, these decisions can also be made dynamically, e.g., after the encrypted data items 161 are received.

[0095] Configuration system 180 can also configure where FHE operations are performed. For example, configuration system 180 can also insert instructions to configure multiple devices to perform transmission operations and FHE operations required for a computation.

[0096] 3a-3d illustrate various examples of an embodiment of clipping and one or more FHE operations.

[0097] FIG. 3a shows an encrypted data item 321 on which an operation 331 is performed to obtain an encrypted data item 322. Typically, FHE operations such as operation 331 increase noise. Therefore, the noise of the encrypted data item 322 will be higher than that of the encrypted data item 321. However, if the noise tolerance of the encrypted data item 322 is high while the noise of the encrypted data item 321 is low, there may be room for a clipping operation 341. The clipping operation 341 increases the noise but is selected so that the operation 331 can still be performed safely. Further downstream processing of the encrypted data item 322 may impose further restrictions on the clipping operation 341. For example, the encrypted data item 322 may then be transmitted, stored, etc. For example, the encrypted data item 322 may subsequently be decrypted or bootstrapped. Instead of one operation 331, there may be multiple operations 331.

[0098] FIG. 3b shows an encrypted data item 321 on which an operation 331 is performed to obtain an encrypted data item 322. In this case, a bootstrap operation 351 is performed after operation 331. In FIG. 3b, operation 331 is optional or there may be multiple operations. Due to the bootstrap operation, there is generally more room for clipping; clipping increases noise, whereas bootstrapping decreases noise. Assuming that bootstrapping 351 is successful, the noise level of the encrypted data item 322 returns to a default level, regardless of the clipping operation. The advantage of performing bootstrapping on a clipped encrypted data item is that the input for bootstrapping is fewer, making the operation simpler.

[0099] 3c shows a transmit operation 361 after the clipping operation 341. The clipped encrypted data item is transmitted in a transmit operation 361 to another device for further FHE processing in the further device. For example, after clipping and transmitting, a bootstrap operation 351 can be performed on the further device. The bootstrap operation removes the effect of the clipping operation 341 by restoring the noise level back to a fixed noise level. After the bootstrap operation 351, there may be further operations on the further device, for example operation 332. The encrypted data item 322 thus produced may be returned to the first FHE device, output, further processed, etc.

[0100] In one embodiment, the operation of the multiple FHE operations includes a multi-sum, and clipping is performed on the output of the multi-sum operation. For example, operation 331 may be a multi-sum operation.

[0101] An advantage of sending the encrypted data item to another computing device is load management. For example, a computation can be performed on a device that is currently less loaded than another device. An advantage of sending the encrypted data item to another computing device is parallel computation. For example, two computations that depend on the same data item can be performed simultaneously. For example, in one embodiment, the computations are performed at least partially in parallel on at least a first device and a second device. The first and second devices can cooperate by sending and / or receiving an at least partially clipped encrypted data item.

[0102] 3d shows encrypted data item 321. Further operations, e.g. FHE operations 331 and 333, may depend on data item 321; although only one operation is shown, there may be multiple operations. Following operations 331 and 333 are bootstrap operations: bootstrap 351 and 352, respectively. Operation 331 may be able to handle more noise than operation 333. For example, operation 331 may be a multiplication while operation 333 may be an addition. For example, operation 331 may be a multiplication with a small number while operation 333 may be a multiplication with a large number. For example, operation 331 may be multiple operations while operation 333 is a single operation, etc. Operation 331 adds more noise than operation 333, so the input to operation 333 may contain more noise than the input to operation 331.

[0103] One way to address this issue is to perform different clipping operations before operations that require different levels of noise, such as operations 331 and 333. For example, as shown in Figure 3d, clipping operation 341, which operates on the input to operation 331, may clip fewer bits than clipping operation 342, which operates on the input to operation 333. After bootstrap operations 351 and 352, the noise levels may be equal, or nearly equal.

[0104] Bootstrap operations 351 and 352 may use the same encryption key and may produce the same noise level in their output. Bootstrap operations 351 and 352 may in fact use the same or similar code. The input to bootstrap 352 may have fewer bits, but these may be padded with zeros, for example.

[0105] However, in one embodiment, bootstrap operations 351 and 352 may be different. For example, they may be configured to receive different numbers of bits at their respective inputs. This has the advantage that circuit 352 may be smaller than circuit 351 because circuit 352 has fewer input gates. Fewer inputs means a smaller circuit, which can run faster and require less storage size. In one embodiment, multiple bootstrap operations may be used, with at least two of the multiple bootstrap operations configured for bootstrap inputs having different numbers of bits.

[0106] Note that the bootstrap operation may differ for other reasons: for example, as part of an FHE scheme, a data item may be re-encrypted against a different key, in which case the bootstrap operation may also take as input a different encrypted key.

[0107] Further, it should be noted that operation 331 and bootstrap operation 351 may be performed on a different computing device than operation 333 and bootstrap operation 352. This is not required, and operations 331, 332, 351, and 352 may all be performed on the same computing device, e.g., sequentially, interlaced, in parallel, etc. One or both of operations 331 and 333 may be omitted. Transmission may be included in FIG. 3d, for example, after clipping operations 341 and / or 342. Operations 331 and 333 are optional and may be omitted.

[0108] FIG. 4a illustrates a schematic of an example embodiment of a system for performing neural network computations using FHE. The neural network computation may be a neural network evaluation. An evaluation of the neural network may be performed to obtain an output for use in an application such as model evaluation. The evaluation may also be performed as part of a validation of the neural network. For example, the neural network may be evaluated on validation samples such that the weights and topology of the neural network are validated if the output of the samples is similar to an expected output. The input to the neural network may be an image. For example, the pixels of the image may be represented by one or more encrypted data items.

[0109] In the example shown in Figures 4a and 4b, the computations are performed at least partially in parallel on at least a first device and a second device: one or more nodes or parts thereof are computed on a first computing device, while one or more other nodes or parts thereof are computed on a second computing device.

[0110] FIG. 4a illustrates a multiple sum operation 431. A multiple sum has inputs x i , i>0. The multiple sum is ω0+Σx i ω i where the number ω i represents a weight and ω represents a bias. There may be multiple inputs and weights, e.g., at least two, at least four, at least 256, etc. The bias ω may or may not be included in the multiple sum. In one embodiment, the input x i are encrypted data items that can represent, for example, neural network inputs, such as pixels, or they can represent the outputs of other neural network nodes. iand the bias ω0 may be encrypted data items, but also plain data items. The former has the advantage that the computation system does not need access to the plain neural network, which may, for example, preclude its use for computational purposes in its own right. The latter has the advantage that computations may be performed faster and more accurate bounds on noise propagation are possible. It is also possible that some inputs are plain and some are encrypted data items. For example, some inputs to the neural network may be encrypted data items and some are plain data items. Computations involving only plain data items may remain plain, but computations involving encrypted data items result in encrypted data items.

[0111] The output of the multiple sum 431 may be an encrypted data item and may be clipped in the clipping operation 441. The output of the clipping operation 441 may be transmitted 461 to another computing device. For example, the multiple sum 431 and clipping 441 may be performed on the first FHE device 401, while the transmission 461 may be performed to the second FHE device 402. After the multiple sum, activation may be performed. Preferably, the combined FHE bootstrap and activation function operation 432 is performed in the device 402, and the combined FHE bootstrap and activation function operation 433 is performed in the device 401. The advantage of performing the clipping 441 before the transmission 461 is that the transmission is performed with fewer bits, resulting in shorter delays.

[0112] Weight ω i If is known, e.g., for a plane, clipping 441 can often clip more bits. For example, weight ω i If many of the weights ω happen to be low, or even zero, then the multiple sum operation introduces little noise and clipping 441 can be more aggressive. iIf many of x happen to be large, the multiple sum operation will introduce more noise and clipping 441 will need to be more conservative; in some nodes clipping 441 may even need to be cancelled. The activation / bootstrap function 433 can operate on clipped data as in operation 432, but this is not necessary. As shown, bootstrap 433 operates directly on unclipped data. This has the advantage of not unnecessarily increasing the risk of decoding failure in the future. On the other hand, bootstrap 433 may operate on the clipped output of clipping operation 441. The latter has the advantage that bootstrap operations 432 and 433 can be one and the same operation. Furthermore, both can operate on clipped data.

[0113] Interestingly, the activation functions implemented in typical neural network nodes can be combined in a single circuit with a bootstrap operation after multiple sums, e.g. after a weighted linear combination of the input values.

[0114] One way to look at bootstrapping is to consider it as an evaluation of decryption, all of which are performed as FHE operations on the encrypted data, i.e., behind the scenes of encryption, new ciphertext is produced. This is possible when the computational complexity, e.g., the circuit depth of these operations, is less than the number of operations that can be performed by the FHE scheme, taking into account that previous operations have already been performed. If the FHE scheme does not allow many operations, or the decryption complexity is high, a combination of nand operations followed by bootstrapping may be the best thing that can be done, but if the FHE scheme allows more operations, there is room to perform other operations in the bootstrap as well. This is an attractive possibility, since FHE schemes are becoming more and more efficient. Using an encrypted key to decrypt as an FHE operation is the usual way to do bootstrapping; in one embodiment, although this is not required, any helper data that allows for noise reduction, not necessarily an encrypted key, can be used, for example.

[0115] The inventors have discovered that a bootstrap operation, e.g., bootstrap 433 and / or 432, can combine bootstrapping with function evaluation; for example, bootstrap can combine decryption, activation function, and encryption all as a FHE operation operating on encrypted data. An example of an activation function is a sigmoid function. Examples of activation functions include; linear or identity activation function, non-linear activation function, sigmoid or logistic activation function, Tanh or hyperbolic tangent activation function, ReLU (Rectified Linear Unit) activation function, LeakyReLU, etc.

[0116] In Fig. 4a, a node is split, e.g., split in the middle: the multiple sum is computed on one side, but the activation function (possibly in combination with a bootstrap operation) is run on both device 401 and device 402.

[0117] Figure 4b shows a schematic of an alternative way of splitting neural network nodes. Shown in Figure 4b is a multiple sum 431, which may be the same as in Figure 4a. Following the multiple sum are activation functions 433 and bootstrap operations, possibly combined. The output is clipped and sent at 461 to the system 402. The output may also be used further in the device 401. As shown, the unclipped data is used further in the device 401, while the clipped data is sent to the device 402. The clipped data may also be used to continue computations in the device 401 and the device 402.

[0118] The advantage of the system shown in Fig. 4a is that the clipping is performed just before the bootstrap operation. Just before the bootstrap is a good moment for clipping, since the bootstrap restores the noise level just after the clipping. This means that the delay is significantly reduced in Fig. 4a. The disadvantage of the system in Fig. 4a is that the activation function is calculated twice: this results in an increase in the overall amount of work. The latter may not be particularly important, since the cost of the work is reduced by parallelization. On the other hand, in Fig. 4b, the clipping is performed after the activation / bootstrap function. In the case of clipping 441, the advantage is that there is little noise and therefore potentially much can be clipped, but on the other hand, operations such as the nodes following the clipping still need to be performed and their noise requirements must be taken into account.

[0119] Both Figures 4a and 4b have the advantage of reducing the amount of data before transmission. Interestingly, the placement of clipping operations can be optimized and automated, so the system designer does not need to make a conscious decision between Figures 4a and 4b.

[0120] The two approaches of Figures 4a and 4b can be combined, for example clipping after bootstrap, then transmitting and performing another bootstrap operation on another computing device, which allows maximum clipping at the expense of an additional bootstrap operation.

[0121] Fig. 4c shows an example of an embodiment of using FHE to calculate the multiple sum. The amount of noise in the multiple sum can determine the clipping ability. For example, in Fig. 4a, if the output of the multiple sum 431 is lower, the clipping 441 can be performed better.

[0122] Figure 4c shows how to compute a multiple sum. The multiple sum is split into two summation operations. Shown is a first multiple sum 434 whose output is bootstrapped and given as input to the next multiple sum 436. For example, given an input a i and b i and weight ω i and ψ i Given, the multiple sum 434 is Σa i ω i The multiple sum 436 can be calculated as y+Σb i ψ i where y is the output of the bootstrap 435. The output of the multiple sum 436 can be used as in FIG. 4a or 4b or variations thereof. For example, in the first part of the multiple sum 434, higher weights can be used so that noise can be controlled in the bootstrap 435. After the multiple sum 436, there can be a clipping operation, for example followed by a transmission or activation function followed by clipping.

[0123] Figure 4c can also be used without clipping. Figure 4c can be used with multiple multiple sums and bootstrap, e.g., three or more. The multiple sums of Figure 4c are particularly advantageous for neural networks with large inputs, such as images.

[0124] In one embodiment, the FHE operation includes a first multiple sum and a second multiple sum, and the calculation method includes: - performing a first multiple sum operation; - performing a bootstrap operation on an output of the first multiple sum; - performing a second multiple sum operation, the output of the bootstrap operation being one of the inputs of the second multiple sum operation. may include.

[0125] In various embodiments of systems 110, 111-113, 114, 115, 170, 180, 200, Figures 3a-3d, 401 and 402, the communication interface may be selected from a variety of alternatives. For example, the interface may be a network interface to a local or wide area network, such as the Internet, a storage interface to internal or external data storage, a keyboard, an application interface (API), etc.

[0126] The system can have a user interface, which can include known elements such as one or more buttons, a keyboard, a display, a touch screen, etc. The user interface can be configured to accept user interactions to configure the system, such as, for example, evaluating the FHE circuit, evaluating the neural network, or training the neural network on, for example, a training set, applying the system to new sensor data, etc.

[0127] The storage can be realized as an electronic memory, such as a flash memory, or a magnetic memory, such as a hard disk. The storage can include multiple separate memories that together constitute the storage, such as the storage 140. The storage can include a temporary memory, such as a RAM. The storage can be a cloud storage.

[0128] These systems can be realized in a single device. As an example, the system 110 or 200 can be realized in a single device. They may also be distributed, for example, across multiple FHE computing devices. Typically, the systems each comprise a microprocessor that executes appropriate software stored in the system; for example, the software may be downloaded and / or stored in a corresponding memory, for example a volatile memory such as RAM or a non-volatile memory such as Flash. Alternatively, the systems may be realized, in whole or in part, in programmable logic, for example as a field programmable gate array (FPGA). The systems may be realized, in whole or in part, as so-called application specific integrated circuits (ASICs), for example integrated circuits (ICs) customized for a specific application. For example, the circuits may be realized in CMOS, for example using hardware description languages ​​such as Verilog, VHDL, etc. In particular, as an example, the systems 110 and 200 may comprise circuits for the evaluation of neural networks.

[0129] A processor circuit may be implemented in a distributed manner, e.g., as multiple sub-processor circuits. Storage may be distributed across multiple distributed sub-storages. Some or all of the memory may be electronic memory, magnetic memory, etc. For example, there may be volatile and non-volatile portions of the storage. Some of the storage may be read-only. A system may include multiple processors, e.g., multiple microprocessors, e.g., at least one for each computing device in the system.

[0130] Below some further optional refinements, details and embodiments are presented with increased mathematical detail, e.g. many variations are possible since many types of lattices, underlying mathematical structures, ciphertext representations, etc. can be used.

[0131] The following embodiments provide an efficient way to obtain a compact representation of a torus FHE-like (TFHE-like) ciphertext. For example, we can take a specific implementation of the TFHE scheme in [Chillotti, Ilaria, Nicolas Gama, Mariya Georgieva, and Malika Izabachene. 2020. "TFHE: Fast Fully Homomorphic Encryption over the Torus." Journal of Cryptology 33(1): 34-91. https: / / doi.org / 10.1007 / s00145-019-09319-x]. A variant of that public key can be obtained using the general procedure presented in [Rothblum, Ron. 2011. "Homomorphic Encryption: From Private-Key to Public-Key". Theory of Cryptography (Tcc2011), Y. Ishai, ed., 6597:219-34. Lecture Notes in Computer Science. Springer. https: / / doi.org / 10.1007 / 978-3-642-19571-6_14.]

[0132] However, the clipping method is generally applicable to other lattice-based encryption schemes, not just to tori.

[0133] Real Torus

number

number

number

number

number

number

number

number

[0134] The encrypted data items may be, for example, enciphered into a matrix TLWE, which may contain multiple rows or columns, for different keys s. s (μ).

[0135] The torus element μ that goes into the encryption algorithm is called the plaintext. It corresponds to a cleartext m in a particular message space M. The correspondence between cleartext and plaintext is given by the message encoding function

number

number

[0136] Ciphertext c=(a1,…,a n ,b), the decoding algorithm is

number

[0137] In the above example, the components of the ciphertext c are

number

number

[0138] In one embodiment, for example, given a torus element u ∈ [0,1), u j ∈{0,1)

number

number

[0139] equivalence

number

number

[0140] Example of (T)LWE encryption with finite precision q: KeyGen(1 λ ) For an input security parameter λ, positive integers n and q,

number

number

[0141] Encrypt sk (μ)

number

number

number

number

number

number

[0142]

number

number

number

number

number

number

[0143] The normal distribution N, or Gaussian distribution, has mean μ and variance σ 2 Note that the function is defined as follows: Therefore, X←N(μ,σ 2 )in the case of,

number

number

number

number

[0144] q=2 ω For n=630, the TLWE ciphertext can be represented internally by (n+1)ω bits in one embodiment. For n=630, when ω=32, the TLWE ciphertext may use a memory buffer of (630+1)*32=20192 bits (i.e., 2.524 kB). When ω=64, the memory size is even 40384 bits (i.e., 5.048 kB). In addition to the large memory requirements, these large ciphertexts may also incur large delays during memory transfers, or more generally while data is moving. The need for large memory is problematic when storing encrypted data items for long-term storage, such as for later use. Thus, there is a need to find a more compact representation of the ciphertext.

[0145] Furthermore, the compact representations developed herein can be used losslessly in the sense that the resulting ciphertext remains valid and thus matches the same clear text. However, in some applications, the possibility of decryption failure is acceptable, so this is not essential. In particular, a reduction in latency can be obtained in exchange for an increased risk of decryption failure. When clipping an encrypted data item, it is preferable that the error introduced into the ciphertext as a result of the more compact representation is small, either reducing the impact on the system or allowing more of the encrypted data item to be clipped. Less efficient reduction methods are not preferred, but the efficiency is reduced somewhat and yet can be incorporated into a working system. It can be mathematically proven that clipping does not affect security.

[0146] Reducing the bit size of an encrypted data item, thereby increasing the noise and reducing the storage requirements, can be done by rounding, such as discarding digits like bits, to reduce the storage size. Mathematically, this can be done as follows. The family of ciphertext encoding functions can be parameterized by an integer 0 < t < q. The TLWE ciphertext

Number

Number

Number

Number

Number

number

number

[0147] We

number

[0148]

number

number

number

number

number

number

number

number

[0149] If q is a power of 2, the discarded digits of the encrypted data item can be regarded as a series of bits, perhaps signed digit radix 2 digits (also called trits). The numerical value q can be a power of other numbers. In that case, the digits can be, for example, ternary digits, etc. The numerical value q can also not be a power of other numbers. In that case, clipping can be regarded as reducing an integer from a range of length q to a range of shorter length, for example, a range of length t. Preferably t < q, and more preferably

Number

[0150] Errorful torus learning (TLWE) encryption is known to be semantically secure under the LWE assumption. It can be mathematically proven that this remains correct without a reduction in security in the new ciphertext encoding brought about by clipping. That is, as long as the decryption is successfully correct, the performance can be improved without sacrificing security.

[0151] Error propagation can be analyzed as in the following example. For example, assume q = 2 ω and t = 2 τ Under this assumption, the memory requirements for representing a compact TLWE ciphertext

Number

Number

number

number

number

number

number

number

number

number

number

[0152] For example, ω=32 and q=2 ω , and the set of recommended parameters (n=630 and σ=2 -15 ), for example, t=2 16 Whereas,

number

number

number

number

[0153] It is possible to increase the size reduction without decreasing the security level. The above limits are based on the standard deviation

number

number

number

[0154]

number

number

number

number

[0155] [Table 1]

[0156] It should be noted that a reduction factor of approximately 200% can be achieved with only a slight increase in noise.

[0157] Although the above embodiment is detailed for TLWE ciphertexts, the proposed ciphertext encoding is easily adapted to polynomial settings, i.e., TRLWE ciphertexts. The same is true for TGSW ciphertexts (respectively TRGSW ciphertexts), since they are also made with TLWE ciphertexts (respectively TRLWE ciphertexts). See, for example, the paper "Faster Bootstrapping with Polynomial Error" by Jacob Alperin-Sheriff and Chris Peikert, Advances in Cryptology-CRYPTO2014, Part I, Lecture Notes in Computer Science, Vol. 8616, pp. 297-314. Springer, 2014. See also (Chillotti et al. 2020). Similarly, the proposed ciphertext encoding can be easily extended to public-key variants of the aforementioned encryption schemes; this in particular uses the common transformations from (Rothblum 2011).

[0158] The proposed ciphertext encoding can be applied when it is known in advance that the tolerable noise will not reach a maximum level - for example, before bootstrapping - in this case the ciphertext can be reduced, resulting in memory savings and reduced latency.

[0159] Another useful application is the ability to reduce the size of the input ciphertext beyond the theoretical maximum given by the LWE estimator without compromising security. For example, for q=2 16 If you choose σ≫2 for security reasons, -16 Conversely, the value σ=2 -16 If you select q≫2, 16 Therefore, a typical parameter set for the original scheme is (n,σ)=(630,2 -15 ) is a 128-bit security level of q=2 16 However, (n,σ)=(630,2 -15 ) with the proposed method at t=2 16There is no loss of security when choosing , and in either case the size of the ciphertext can be reduced.

[0160] FIG. 5a illustrates a schematic example of an embodiment of a method 500 for performing a computation using FHE. The computation includes a set of FHE operations that perform the computation. The FHE operations operate on an encrypted data item, and possibly on multiple encrypted data items, and possibly on one or more plain data items. The encrypted data item has an associated noise level. Immediately after the encrypted data item is encrypted—when the encrypted data item is fresh—the noise is relatively low, but once the FHE operations are performed, the noise increases. However, a bootstrap operation, possibly combined with other useful operations such as activation functions, polynomial evaluation, squaring, etc., may restore the noise to a predetermined level.

[0161] This method is - receiving (510) one or more encrypted data items for computation from a data provider system, the one or more encrypted data items being encrypted using an encryption key of the data provider system; there may be multiple data providers; - performing (520) a set of FHE operations on the encrypted data items, including the received encrypted data items; e.g., the FHE operations may be combined into a script, a circuit, a sequence, etc. - clipping (530) the encrypted data item to reduce a bit size of the encrypted data item and increase an associated noise level of the encrypted data item, where an FHE operation or a decryption operation operates on the clipped encrypted data item as an input, and the noise level associated with the input is below a noise tolerance of the FHE operation or the decryption operation. Includes.

[0162] Interestingly, clipping intentionally increases noise, but since FHE implementations typically strive to keep noise as low as possible, the number of bootstrapping operations can be reduced or avoided altogether. The inventors have recognized that clipping operations also provide important benefits, such as reduced delay in transmission, reduced storage space, reduced circuit size, etc. Although clipping operations increase noise, if a bootstrap operation is performed soon after anyway, even this downside is insignificant, since the bootstrapping operation restores the noise level.

[0163] FIG. 5b illustrates in schematic form an example of an embodiment of a method 550 for configuring a set of FHE operations to perform a computation. In practice, the computation can initially be provided in the form of cooperating FHE operations without any clipping operations in place. The computation may be provided, for example, by a compiler that takes as input a technical description of the computation, for example, in a technical language, for example, in a high-level computer language such as Python, C, for example, in a high-level mathematical computer language such as MATLAB, Mathematica, etc., and the compiler can be configured to generate the FHE operations. For example, the compiler can be configured to parse the input description and map the computational elements of the parsed description to one or more FHE operations. The compiler can also include the method 550. The method 550 can also be implemented as a separate product, such as a device that operates on the provided FHE operations.

[0164] The FHE operations may also be provided by a third party, e.g., a data provider or a computation provider. The data provider, or computation provider, etc., may itself use the compiler described above. The output may be configured by the system implementing the method 550. For example, an FHE system, such as systems 110, 200, etc., may configure the computation before or during execution to make the computation more efficient. For example, the FHE system may perform the computation itself, e.g., as part of the method 500, or may be outsourced to another system, e.g., in the cloud. The method 500 may include: - Obtaining a set of FHE operations (555); - selecting (560) an operation in a set of FHE operations, or selecting a decryption operation; - selecting (570) an encrypted data item within the input of the selected operation and / or an encrypted data item from which the input of the selected operation is derived; - determining (575) an acceptable noise level for the encrypted data item from one or more of a noise level for the encrypted data item, a noise tolerance range for the bootstrap operation, and / or an operation depending on the encrypted data item; - deriving (580) a clipping operation from the tolerable noise level and inserting the clipping operation into the set of FHE operations to clip the encrypted data item; Includes.

[0165] For example, the noise can be estimated using the bounds provided herein or as known in the art, e.g., in the references provided. Note that different bounds can be used, e.g., less accurate but faster, or more accurate while capturing more information about the operation, different bounds for different FHE schemes, etc.

[0166] For example, one case where noise can be estimated particularly well is immediately after a bootstrap operation. For example, one way to perform high clipping may be to perform a bootstrap operation, a clipping operation, a pass operation, and another bootstrap. In this case, the noise level is low after the first bootstrap, while the clipping is immediately followed by the second bootstrap, so many bits may be removed by the clipping.

[0167] FIG. 5c illustrates a schematic example of an embodiment of a method 600 for reducing the size of an encrypted data item for use in a computation using fully homomorphic encryption (FHE) cryptography. An application of FHE operations is to store data received from another party, such as a data provider, so that a computation can be performed on it at a later time. For example, the data provider can provide genomic information at a first time, such as a point in time or moment in time, store the received information, and then perform the computation at a second time. For example, the data received at the first time can be encrypted; at the second time, a further encrypted data item is received and combined with the stored information in the computation. For example, at the second time, further genomic information can be provided that is matched with the genomic information provided at the first time.

[0168] Received encrypted data items may be very large and occupy a large amount of storage. One way to solve this is to clip the encrypted data items before storing (e.g., upon reception) or after computation. However, this is not always feasible, e.g., encrypted data items may be received and stored by a third party that cannot handle them, e.g., encrypted data items may be stored when future noise requirements are unknown, etc. Thus, there is a need for a data size reduction system that can reduce the size of encrypted data items already in storage.

[0169] The method (600) is configured to reduce the size of encrypted data items that may already be in storage and that are later used in computations using Fully Homomorphic Encryption (FHE) cryptography. - obtaining (610) one or more encrypted data items for computation, the one or more encrypted data items being encrypted using an encryption key; - clipping (620) the encrypted data item to reduce a bit size of the encrypted data item and increase an associated noise level of the encrypted data item, where an FHE operation or a decryption operation operates on the clipped encrypted data item as an input, and the noise level associated with the input is below a noise tolerance of the FHE operation or the decryption operation. Includes.

[0170] The methods 500, 550, and 600 can be implemented on a computer. For example, in this method, the computer can access data, such as training data, or data for calculation, or data for evaluation, for example one or more images, sensor data, data representing the technical state of a device, such as a machine, a plant, etc. Receiving the input data can be done using a communication interface, such as an electronic interface, a network interface, a memory interface, etc. Storing or retrieving parameters, such as parameters of the FHE operation, weights of the neural network, etc., can be done from electronic storage, such as a memory, a hard drive, etc. For example, applying the neural network to the data of the training data and / or adjusting the stored parameters to train the network can be done using an electronic computing device, such as a computer.

[0171] An embodiment of a neural network during training and / or application can have multiple layers, which can include, for example, convolutional layers, etc. For example, a neural network can have at least 2, 5, 10, 15, 20, or 40, or more, hidden layers. The number of neurons in a neural network can be, for example, at least 10, 100, 1000, 10000, 100000, 1000000, or more, etc.

[0172] As will be apparent to one skilled in the art, many different ways of performing this method are possible. For example, although the order of steps may be performed in the order shown, the order of steps may be changed or some steps may be performed in parallel. Furthermore, other method steps may be inserted between steps. The inserted steps may represent improvements to the method as described herein or may be unrelated to the method. For example, some steps may be performed at least partially in parallel. Furthermore, a given step may not be completely finished before the next step is started.

[0173] The method embodiments may be implemented using software that includes instructions for causing a processor system to perform the methods 500, 550, and 600. The software may include only steps taken by a particular subentity of the system. The software may be stored on a suitable storage medium such as a hard disk, floppy, memory, optical disk, etc. The software may be transmitted as a signal along a wired or wireless line or using a data network such as the Internet. The software may be made available for download and / or remote use on a server. The method embodiments may be implemented using a bitstream configured to configure a programmable logic, for example a field programmable gate array (FPGA), to perform the method.

[0174] It is to be understood that the presently disclosed subject matter also extends to computer programs, particularly computer programs on or in a carrier configured to carry out the presently disclosed subject matter. The programs may be in the form of object code, such as source code, object code, code intermediate sources and partially compiled forms, or any other form suitable for use in carrying out the method embodiments. An embodiment relating to a computer program product includes computer executable instructions corresponding to each of the processing steps of at least one of the described methods. These instructions may be subdivided into subroutines or may be stored in one or more files that may be statically or dynamically linked. Another embodiment relating to a computer program product includes computer executable instructions corresponding to each of at least one device, unit and / or part of the described system and / or product.

[0175] FIG. 6a shows a computer readable medium 1000 having a writable portion 1010 and a computer readable medium 1001 also having a writable portion. The computer readable medium 1000 is shown in the form of an optically readable medium. The computer readable medium 1001 is shown in the form of an electronic memory, in this case a memory card. The computer readable medium 1000 and 1001 can store data 1020, which when executed by a processor system can indicate instructions that cause the processor system to perform a method according to an embodiment, for example a calculation, configuration, or data reduction method. The computer program 1020 can be embodied on the computer readable medium 1000 as a physical mark or by magnetization of the computer readable medium 1000. However, other suitable embodiments are also contemplated. Furthermore, although the computer readable medium 1000 is shown here as an optical disk, it will be understood that the computer readable medium 1000 can be any suitable computer readable medium, such as a hard disk, a solid state memory, a flash memory, etc., and can be non-recordable or recordable. The computer program 1020 includes instructions for causing a processor system to carry out the method.

[0176] Fig. 6b shows a schematic diagram of a processor system 1140 according to an embodiment, e.g., a system for computation, and / or configuration, and / or data size reduction. The processor system comprises one or more integrated circuits 1110. The architecture of the one or more integrated circuits 1110 is shown in Fig. 6b. The circuit 1110 comprises a processing unit 1120, e.g., a CPU, for executing computer program components to perform a method according to an embodiment and / or to realize a module or unit thereof. The circuit 1110 comprises a memory 1122 for storing programming code, data, etc. Part of the memory 1122 may be read-only. The circuit 1110 may comprise a communication element 1126, e.g., an antenna, a connector, or both. The circuit 1110 may comprise a dedicated integrated circuit 1124 for performing some or all of the processing defined in the method. The processor 1120, the memory 1122, the dedicated IC 1124, and the communication element 1126 may be connected to each other via an interconnect 1130, e.g., a bus. The processor system 1110 may be configured for contact and / or contactless communication using antennas and / or connectors, respectively.

[0177] For example, in one embodiment, the processor system 1140, e.g., a device, comprises a processor circuit and a memory circuit, the processor configured to execute software stored in the memory circuit. For example, the processor circuit may be an Intel Core i7 processor, an ARM Cortex-R8, etc. In one embodiment, the processor circuit may be an ARM Cortex M0. The memory circuit may be a ROM circuit or a non-volatile memory, such as a flash memory. The memory circuit may be a volatile memory, e.g., an SRAM memory. In the latter case, the device may comprise a non-volatile software interface, e.g., a hard drive, a network interface, etc., configured to provide the software.

[0178] Additionally, both memory and storage may be considered “non-transitory machine-readable media.” As used herein, the term “non-transitory” is understood to exclude transitory signals, but to include all forms of storage, including both volatile and non-volatile memory.

[0179] Although device 1140 is shown as including one of each of the described components, various components may be duplicated in various embodiments. For example, processor 1120 may include multiple microprocessors and may be configured to independently perform the methods described herein or to perform steps or subroutines of the methods described herein such that the multiple processors cooperate to achieve the functions described herein. Furthermore, when device 1100 is implemented in a cloud computing system, various hardware components may reside in separate physical systems. For example, processor 1120 may include a first processor in a first server and a second processor in a second server.

[0180] The following clauses represent aspects of the invention that may be contemplated and claimed, possibly in combination with additional elements supported herein.

[0181] 1. 1. A method (500) for performing a computation using fully homomorphic encryption (FHE) cryptography, the computation comprising a set of FHE operations operating on encrypted data items, the encrypted data items having an associated noise level, the method comprising: - receiving (510) one or more encrypted data items for computation from a data provider system, the one or more encrypted data items being encrypted using an encryption key of the data provider system; - performing (520) a set of FHE operations on encrypted data items, including the received encrypted data item; - clipping (530) the encrypted data item to reduce a bit size of the encrypted data item and increase an associated noise level of the encrypted data item, where an FHE operation or a decryption operation operates on the clipped encrypted data item as an input, and the noise level associated with the input is below a noise tolerance of the FHE operation or the decryption operation; A method (500).

[0182] 2. 2. A method for performing the computation described in clause 1, wherein the set of FHE operations includes one or more bootstrap operations, the bootstrap operations operating on one or more encrypted data items at a bootstrap input to generate one or more encrypted data items at a bootstrap output, the bootstrap input including clipped encrypted data items and / or encrypted data items derived from the clipped encrypted data items, and a noise level associated with the bootstrap input is below a noise tolerance of the bootstrap operations.

[0183] 3. - A method for performing a calculation according to clause 1 or 2, wherein the encrypted data items comprise tuples of numbers and / or polynomials, the tuples representing plain data items and noise, and wherein clipping is applied to one or more of the numbers and / or polynomial coefficients.

[0184] 4. A method for performing a calculation as described in any one of clauses 1 to 3, wherein clipping the encrypted data item comprises, for example, discarding one or more digits and rounding remaining digits, by one of reducing the resolution of one or more numerical values ​​contained in the encrypted data item.

[0185] 5. - storing the clipped encrypted data items for subsequent FHE processing, and / or - transmitting the clipped encrypted data items for further FHE processing on a further device, and / or - performing computations at least partially in parallel on at least a first device and a second device; wherein the first and second devices cooperate by sending and / or receiving the at least partially clipped encrypted data item; 5. A method for carrying out the calculation according to any one of clauses 1 to 4.

[0186] 6. 6. A method for performing a computation described in any one of clauses 1 to 5, wherein the set of FHE operations includes a plurality of bootstrapping operations, at least two of the plurality of bootstrapping operations being configured for bootstrap inputs having different numbers of bits.

[0187] 7. - determining an acceptable noise level for the encrypted data item from one or more of the noise level of the encrypted data item, a noise tolerance range for a subsequent bootstrap operation and / or an operation dependent on the encrypted data item; - clipping the encrypted data item, where the increased associated noise level of the encrypted data item is below the tolerable noise. 7. A method for performing a calculation according to any one of clauses 1 to 6, comprising:

[0188] 8. A method for performing the computation described in clause 6, wherein determining is performed after receiving one or more encrypted data items from a data provider system.

[0189] 9. 9. A method for performing a calculation according to any one of clauses 1 to 8, wherein the noise can be represented by parameters of a probability distribution.

[0190] 10. 11. A method for performing a calculation according to any one of clauses 1 to 10, wherein the calculation comprises evaluation of a neural network.

[0191] 11. 12. A method for performing a calculation according to any one of clauses 1 to 11, wherein the encrypted data items represent an image, each pixel of the image corresponding to one or more encrypted data items.

[0192] 12. 12. A method for performing a computation described in any one of clauses 1 to 11, wherein the computation is performed at least partially in parallel on at least a first device and a second device, the first device and the second device evaluating different neural network nodes of the neural network, and clipping is applied to encrypted data items representing node inputs, node outputs, and / or intermediate node computations, and the method includes sending the clipped encrypted data items from the first device to the second device.

[0193] 13. 12. A method for performing a calculation according to any one of clauses 1 to 11, wherein the bootstrap operation combines bootstrap and neural network activation functions.

[0194] 14. A method (550) for performing calculations and configuring a set of FHE operations to operate on encrypted data items, the encrypted data items having an associated noise level, the method comprising: - Obtaining a set of FHE operations (555); - selecting (560) an operation in a set of FHE operations, or selecting a decryption operation; - selecting (570) an encrypted data item within the input of the selected operation and / or an encrypted data item from which the input of the selected operation is derived; - determining (575) an acceptable noise level for the encrypted data item from one or more of a noise level for the encrypted data item, a noise tolerance range for the bootstrap operation, and / or an operation responsive to the encrypted data item; - deriving (580) a clipping operation from the tolerable noise level and inserting the clipping operation into the set of FHE operations to clip the encrypted data item; A method (550).

[0195] 15. 1. A method (600) for reducing the size of an encrypted data item for use in a computation using Fully Homomorphic Encryption (FHE) cryptography, the computation comprising a set of FHE operations performing computations operating on an encrypted data item, the encrypted data item having an associated noise level, the method comprising: - obtaining (610) one or more encrypted data items for computation, the one or more encrypted data items being encrypted using an encryption key; - clipping (620) the encrypted data item to reduce a bit size of the encrypted data item and increase an associated noise level of the encrypted data item, where an FHE operation or a decryption operation operates on the clipped encrypted data item as an input, and the noise level associated with the input is below a noise tolerance of the FHE operation or the decryption operation. A method (600).

[0196] 16. 1. A system for performing a computation using fully homomorphic encryption (FHE) cryptography, the computation comprising a set of FHE operations operating on encrypted data items, the encrypted data items having an associated noise level, the system comprising: - an interface configured to receive one or more encrypted data items for computation from a data provider system; - Processor system and Equipped with one or more encrypted data items are encrypted using an encryption key of the data provider system; The processor system comprises: - performing (520) a set of FHE operations on encrypted data items, including the received encrypted data item; - clipping (530) the encrypted data item to reduce the bit size of the encrypted data item and to increase the associated noise level of the encrypted data item; It is configured as follows: an FHE operation or decryption operation operates on the clipped encrypted data item as input, and a noise level associated with the input is below the noise tolerance of the FHE operation or decryption operation; system.

[0197] 17. 1. A system for performing computations and configuring a set of FHE operations to operate on encrypted data items, the encrypted data items having an associated noise level, the system comprising: - an interface configured to obtain a set of FHE operations (555); -Processor system and Equipped with The processor system comprises: - selecting an operation in a set of FHE operations or selecting a decryption operation; - selecting encrypted data items in the input of the selected operation and / or encrypted data items from which the input of the selected operation is derived, - determining an acceptable noise level for the encrypted data item from one or more of a noise level for the encrypted data item, a noise tolerance range for the bootstrap operation, and / or an operation dependent on the encrypted data item; - Derive a clipping operation from the tolerable noise level and insert the clipping operation into the set of FHE operations to clip the encrypted data items It is configured as follows: system.

[0198] 18. 1. A system for reducing the size of an encrypted data item for use in a computation using a fully homomorphic encryption (FHE) cryptography, the computation comprising a set of FHE operations performing a computation operating on an encrypted data item, the encrypted data item having an associated noise level, the system comprising: - an interface configured to obtain one or more encrypted data items for a computation; - Processor system and Equipped with one or more encrypted data items are encrypted with an encryption key, The processor system comprises: - clipping (620) the encrypted data item to reduce the bit size of the encrypted data item and to increase the associated noise level of the encrypted data item; It is configured as follows: an FHE operation or decryption operation operates on the clipped encrypted data item as input, and a noise level associated with the input is below the noise tolerance of the FHE operation or decryption operation; system.

[0199] 19. A transitory or non-transitory computer readable medium (1000) containing data (1020), the data comprising: - instructions which, when executed by a processor system, cause the processor system to perform a method according to any one of clauses 1 to 15; a set of FHE operations for performing calculations, including one or more clipping operations, and configured in accordance with clause 14; A transitory or non-transitory computer readable medium (1000) illustrating one or more of:

[0200] It should be noted that the above-described embodiments are illustrative rather than limiting of the presently disclosed subject matter, and that those skilled in the art may design many alternative embodiments.

[0201] In the claims, reference signs placed between parentheses shall not be construed as limiting the scope of the claim. Use of the verb "comprise" and its conjugations does not exclude the presence of elements or steps other than those stated in the claim. The article "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. Expressions such as "at least one of" preceding a list of elements denote the selection of all or any subset of the elements from the list. For example, the expression "at least one of A, B, and C" is to be understood as including A only, B only, C only, both A and B, both A and C, both B and C, or all of A, B, and C. The presently disclosed subject matter may be implemented by means of hardware comprising several distinct elements, and by means of a suitably programmed computer. In a device claim enumerating several parts, several of these parts may be embodied by one and the same item of hardware. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

[0202] In the claims, references in parentheses refer to reference symbols in the drawings of exemplary embodiments or to formulas of embodiments, thus enhancing the comprehension of the claims, and these references should not be construed as limiting the scope of the claims.

Claims

1. 1. A method (500) performed by one or more FHE devices for performing computations using a fully homomorphic encryption (FHE) cryptography, the computations comprising a set of FHE operations operating on encrypted data items, the encrypted data items having an associated noise level, the method comprising: receiving (510) one or more encrypted data items for computation from a data provider system, the one or more encrypted data items being encrypted using an encryption key of the data provider system; performing (520) a set of FHE operations on encrypted data items, including the received encrypted data item; clipping (530) the encrypted data item, said clipping comprising reducing a bit size of one or more numerical values ​​representing the encrypted data item and increasing an associated noise level of the encrypted data item, an FHE or decryption operation operating on the clipped encrypted data item as input, the noise level associated with the input being below the noise tolerance of the FHE or decryption operation; storing the clipped encrypted data item for subsequent FHE processing and / or transmitting the clipped encrypted data item for further FHE processing on a further device; A method comprising:

2. 2. A method for performing a computation as claimed in claim 1, wherein the set of FHE operations includes one or more bootstrap operations, the bootstrap operations operating on one or more encrypted data items at a bootstrap input and generating one or more encrypted data items at a bootstrap output, the bootstrap inputs including clipped encrypted data items and / or encrypted data items derived from the clipped encrypted data items, and a noise level associated with the bootstrap inputs is below a noise tolerance of the bootstrap operations.

3. A method for performing a calculation as claimed in claim 1 or 2, wherein the encrypted data items comprise tuples of numerical values ​​and / or polynomials, the tuples representing the plain data items and noise, and clipping is applied to one or more of the numerical values ​​and / or polynomial coefficients.

4. 4. A method for performing a calculation as claimed in any one of claims 1 to 3, wherein clipping the encrypted data item comprises discarding one or more digits and rounding remaining digits, for example by one of reducing the resolution of one or more numerical values ​​contained in the encrypted data item.

5. - performing computations at least partially in parallel on at least a first device and a second device; wherein the first and second devices cooperate by sending and / or receiving the at least partially clipped encrypted data item. A method for carrying out the calculations according to any one of claims 1 to 4.

6. 6. A method for performing a computation as claimed in any one of claims 1 to 5, wherein the set of FHE operations includes a plurality of bootstrapping operations, at least two of the plurality of bootstrapping operations being configured for bootstrap inputs having different numbers of bits.

7. determining an acceptable noise level for the encrypted data item from one or more of the noise level of the encrypted data item, a noise tolerance range of a subsequent bootstrap operation and / or an operation depending on the encrypted data item; Clipping the encrypted data item, where the increased associated noise level of the encrypted data item is below the tolerable noise. A method for performing the calculations of any one of claims 1 to 6, comprising:

8. 7. The method for performing computations of claim 6, wherein determining is performed after receiving one or more encrypted data items from a data provider system.

9. A method for performing calculations as claimed in any one of claims 1 to 8, wherein the noise can be represented by parameters of a probability distribution.

10. 10. A method for performing a calculation as claimed in any one of claims 1 to 9, wherein the calculation comprises evaluation of a neural network.

11. A method for performing computations as claimed in any one of claims 1 to 10, wherein the encrypted data items represent an image, each pixel of the image corresponding to one or more encrypted data items.

12. 12. A method for performing a computation as claimed in any one of claims 1 to 11, wherein the computation is performed at least partially in parallel on at least a first device and a second device, the first device and the second device evaluating different neural network nodes of the neural network, and clipping is applied to encrypted data items representing node inputs, node outputs, and / or intermediate node computations, and the method includes sending the clipped encrypted data items from the first device to the second device.

13. 13. A method for performing computations as claimed in any one of claims 1 to 12, wherein the bootstrap operation combines bootstrap and neural network activation functions.

14. 14. A method for performing a calculation as claimed in any preceding claim, wherein clipping reduces the resolution of one or more numerical values ​​representing the encrypted data item.

15. The clipping step comprises: - discarding one or more digits from one or more numerical values ​​representing the encrypted data; and / or - rounding one or more numbers representing the encrypted data; and / or - Scaling towards a smaller range of values, said scaling being optionally followed by a rounding, floor or ceiling operation. and / or The clipping step includes applying a clipping function to one or more numerical values ​​representing the encrypted data, the clipping function comprising: [0010] For values ​​x and parameters 0<t<q, [0025] 15. A method for performing a calculation according to any one of claims 1 to 14, which may be defined by:

16. 16. A method for performing a calculation as claimed in any one of claims 1 to 15, wherein said clipping comprises applying a clipping operation to one or more or all of the numerical values ​​representing the encrypted data item, thus obtaining a clipped encrypted data item, the clipping operation reducing a bit size of one or more or all of the numerical values ​​representing the encrypted data item, thus increasing an associated noise level of the encrypted data item.

17. A method (550) performed by an FHE configuration system for performing calculations and configuring a set of FHE operations to operate on encrypted data items, the encrypted data items having an associated noise level, the method comprising: - obtaining (555) a set of FHE operations; - selecting (560) an operation in the set of FHE operations, or selecting a decode operation; - selecting (570) an encrypted data item within the input of the selected operation and / or an encrypted data item from which the input of the selected operation is derived, - determining (575) an acceptable noise level for the encrypted data item from one or more of the noise level of the encrypted data item, the noise tolerance of the bootstrap operation and / or the operation depending on the encrypted data item; - deriving (580) a clipping operation from the tolerable noise level and inserting a clipping operation into the set of FHE operations to clip the encrypted data item, said clipping operation reducing the bit size of one or more numerical values ​​representing the encrypted data item and increasing the associated noise level of the encrypted data item. The method (550).

18. 1. A method (600) for reducing the size of an encrypted data item for use in a computation using Fully Homomorphic Encryption (FHE) cryptography, the method being performed by a system for reducing the size of an encrypted data item for use in a computation using Fully Homomorphic Encryption (FHE) cryptography, the computation comprising a set of FHE operations performing a computation operating on the encrypted data item, the encrypted data item having an associated noise level, the method comprising: obtaining (610) one or more encrypted data items for a computation, the one or more encrypted data items being encrypted using an encryption key; clipping (620) the encrypted data item, said clipping comprising reducing a bit size of one or more numerical values ​​representing the encrypted data item and increasing an associated noise level of the encrypted data item, an FHE or decryption operation operating on the clipped encrypted data item as input, the noise level associated with the input being below the noise tolerance of the FHE or decryption operation; The method (600).

19. 1. A system for performing a computation using fully homomorphic encryption (FHE) cryptography, the computation comprising a set of FHE operations operating on encrypted data items, the encrypted data items having an associated noise level, the system comprising: an interface configured to receive one or more encrypted data items for computation from a data provider system; - Processor system and Equipped with one or more encrypted data items are encrypted using an encryption key of the data provider system; The processor system comprises: - performing (520) a set of FHE operations on the encrypted data items, including the received encrypted data item; - clipping (530) the encrypted data item, said clipping reducing the bit size of one or more numerical values ​​representing the encrypted data item and increasing the associated noise level of the encrypted data item; - storing the clipped encrypted data item for later FHE processing and / or transmitting the clipped encrypted data item for further FHE processing on a further device It is configured as follows: an FHE operation or a decryption operation operates on the clipped encrypted data item as input, and a noise level associated with the input is below the noise tolerance of the FHE operation or the decryption operation; system.

20. 1. A system for performing computations and constructing a set of FHE operations to operate on encrypted data items, the encrypted data items having an associated noise level, the system comprising: an interface configured to obtain (555) a set of FHE operations; - Processor system and Equipped with The processor system comprises: Select an operation in the set of FHE operations or select a decryption operation, selecting encrypted data items within the input of the selected operation and / or encrypted data items from which the input of the selected operation is derived, determining an acceptable noise level for the encrypted data item from one or more of the noise level of the encrypted data item, a noise tolerance of the bootstrap operation and / or an operation dependent on the encrypted data item; - deriving a clipping operation from the tolerable noise level and inserting a clipping operation into the set of FHE operations to clip the encrypted data item, said clipping operation reducing the bit size of one or more numerical values ​​representing the encrypted data item and increasing the associated noise level of the encrypted data item; It is configured as follows: system.

21. 1. A system for reducing the size of an encrypted data item for use in a computation using a fully homomorphic encryption (FHE) cryptography, the computation comprising a set of FHE operations performing a computation operating on the encrypted data item, the encrypted data item having an associated noise level, the system comprising: an interface configured to obtain one or more encrypted data items for a computation; - Processor system and Equipped with one or more encrypted data items are encrypted using an encryption key; The processor system comprises: - clipping (620) the encrypted data item, said clipping reducing the bit size of one or more numerical values ​​representing the encrypted data item and increasing the associated noise level of the encrypted data item. It is configured as follows: an FHE operation or a decryption operation operates on the clipped encrypted data item as input, and a noise level associated with the input is below the noise tolerance of the FHE operation or the decryption operation; system.

22. A computer readable medium (1000) including data (1020), the data comprising: - A computer readable medium (1000) comprising instructions which, when executed by a processor system, cause the processor system to perform the method of any one of claims 1 to 18.

Images