A cryptographic method, system, and service for evaluating a univariate or multivariate real-valued function on encrypted data

Abstract

The present invention relates to cryptographic methods and variants thereof based on homomorphic encryption that allow evaluation of real-valued functions on encrypted data in order to enable more extensive and efficient performance of homomorphic operations on the encrypted data.

Description

[Technical Field]

[0001] This invention relates to improving the homomorphic evaluation of one or more functions applied to pre-encrypted data. This technical field is based on recent cryptographic research and may have numerous applications in all areas of activity where confidentiality constraints exist (but not limited to those involving privacy, trade secrets, or medical data).

[0002] More specifically, the present invention relates to a method for enabling one or more specially programmed computer systems to automatically complete the computations required for homomorphic evaluation of one or more functions. Therefore, it is necessary to consider limited memory and computation time capacity, or, in the case of cloud computing-type remote processing, the transmission capacity known to the information processing system that needs to perform this type of evaluation.

[0003] As will be explained below, the development of homomorphic encryption methods has been largely hampered so far by technical constraints inherent in most of the schemes proposed in the literature, particularly in relation to the processing capacity of computers, in terms of the machine resources and supported computation time required to perform the various computational stages. [Background technology]

[0004] In fully homomorphic encryption (FHE), any participant can access a set of ciphertexts (plaintext x1, ..., x p (corresponding to) this participant does not need to access the plaintext itself to access a given function f(x1,…,x) of the plaintext p ) can be publicly converted into ciphertext corresponding to this. It is well known that such methods can be used to build protocols that comply with privacy standards: users can store encrypted data on a server and allow third parties to perform operations on the encrypted data without having to expose the data itself to the server.

[0005] The first fully homomorphic encryption scheme was finally proposed in 2009 by Gentry (who obtained U.S. Patent No. 8630422 in 2014 based on his first application in 2009); see also Craig Gentry, “Fully homomorphic encryption using ideal lattices,” 41st Annual ACM Symposium on Theory of Computing, pp. 169–178, ACM Press, 2009). Although Gentry's construction is no longer in use, one of the features introduced, “bootstrapping,” and in particular one of its implementations, has been widely used in subsequently proposed schemes. Bootstrapping is a technique used to reduce noise in ciphertext. In fact, in all known FHE schemes, the ciphertext contains a small amount of random noise necessary for security reasons. Performing operations on a noisy ciphertext increases the noise. After evaluating operations on a given number, this noise can become very high and potentially compromise the computation result. Therefore, while bootstrapping is fundamental to building homomorphic cryptographic schemes, this technique is very expensive in terms of memory usage or computation time.

[0006] Research following the release of Gentry aims to provide new schemes and improve bootstrapping to make homomorphic encryption truly feasible. The most famous constructs are DGHV [Marten van Dijk, Craig Gentry, Shai Halevi, and Vinod Vaikuntanathan, "Fully homomorphic encryption over the integers," Advances in Cryptology-EUROCRYPT2010, Lecture Notes in Computer Science, Vol. 6110, pp. 24-43, Springer, 2010], BGV [Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan, "(Levelled) fully homomorphic encryption without bootstrapping," ITCS2012; 3rd Innovations in Theoretical Computer Science, pp. 309-325, ACM Press, 2012], and GSW [Craig Gentry, Eds, Amit Sahai, and Brent Waters, "Homomorphic encryption from learning with errors: Conceptually simpler, asymptotically faster, Attribute-based," Advances in This is a variation of [Cryptology-CRYPTO2013, Part I, Lecture Notes in Computer Science, Vol. 8042, pp. 75-92, Springer, 2013]. While the execution of bootstrapping in the first Gentry method was not actually feasible (one lifetime was insufficient to complete the computation), the subsequently proposed construction made this operation feasible, although it is not very practical (each bootstrapping lasts for several minutes).In 2015, Ducas and Micciancio proposed a faster bootstrapping method that runs in a GSW-type manner [Leo Ducas and Daniele Micciancio, "FHEW: Bootstrapping homomorphic encryption in less than a second," Advances in Cryptology-EUROCRYPT2015, Part I, Lecture Notes in Computer Science, Vol. 9056, pp. 617-640, Springer, 2015]: the bootstrapping operation runs in just over 0.5 seconds. In 2016, Chillotti, Gama, Georgieva, and Izabachene proposed a new variation of the FHE scheme called TFHE [Iria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene, "Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds," Advances in Cryptology-ASIACRYPT2016, Part I, Lecture Notes in Computer Science, Vol. 10031, pp. 3-33, Springer, 2016]. Their bootstrapping technique has formed the basis for subsequent research.The research of Bourse et al. can be referenced [Florian Bourse, Micheles Minelli, Matthias Minihold, and Pascal Paillier, "Fast homomorphic evaluation of deep discretised neural networks," Advances in Cryptology-CRYPTO2018, Part III, Lecture Notes in Computer Science, Vol. 10993, pp. 483-512, Springer, 2018], Carpov et al. [Sergiu Carpov, Malika Izabachene, and Victor Mollimard, "New techniques for multi-value input homomorphic evaluation and applications," Topics in Cryptology-CT-RSA2019, Lecture Notes in Computer Science, Vol. 11405, pp. 106-126, Springer, 2019], Boura et al. [Christina Boura, Nicolas Gama, Mariya Georgieva, and Dimitar Jetchev, "Simulating homomorphic evaluation of deep learning [Predictions], Cyber ​​Security Cryptography and Machine Learning (CSCML2019), Lecture Notes in Computer Science, Vol. 11527, pp. 212-230, Springer, 2019 [and Chillotti et al.] [Ilaria Chillotti, Nicolas Gama, Mariya Georgieva and Malika Izabachene, "TFHE: Fast fully homomorphic encryption over the torus", Journal of Cryptology, 31(1), pp. 34-91, 2020]. The performance of TFHE is noteworthy. They have contributed to advances in research in this field and to making homomorphic encryption more practical.The proposed new technology allows bootstrapping to be calculated in milliseconds. [Prior art documents] [Patent Documents]

[0007] [Patent Document 1] U.S. Patent No. 8630422 [Non-patent literature]

[0008] [Non-Patent Document 1] Craig Gentry, "Fully homomorphic encryption using ideal lattices," 41st Annual ACM Symposium on Theory of Computing, pp. 169-178, ACM Press, 2009. [Non-Patent Document 2] Marten van Dijk, Craig Gentry, Shai Halevi, and Vinod Vaikuntanathan, "Fully homomorphic encryption over the integers", Advances in Cryptology-EUROCRYPT2010, Lecture Notes in Computer Science, volume 6110, pp. 24-43, Springer, 2010. [Non-Patent Document 3] Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan, "(Leveled) fully homomorphic encryption without bootstrapping", ITCS2012;3rd Innovations in Theoretical Computer Science, pp. 309-325, ACM Press, 2012. [Non-Patent Document 4] Craig Gentry, Eds, Amit Sahai, and Brent Waters, "Homomorphic encryption from learning with errors: Conceptually simpler, asymptotically faster, attribute-based," Advances in Cryptology-CRYPTO2013, Part I, Lecture Notes in Computer Science, Vol. 8042, pp. 75-92, Springer, 2013. [Non-Patent Document 5] Leo Ducas and Daniele Micciancio, "FHEW: Bootstrapping homomorphic encryption in less than a second," Advances in Cryptology-EUROCRYPT2015, Part I, Lecture Notes in Computer Science, Vol. 9056, pp. 617-640, Springer, 2015. [Non-Patent Document 6] IIaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene, "Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds," Advances in Cryptology-ASIACRYPT2016, Part I, Lecture Notes in Computer Science, Vol. 10031, pp. 3-33, Springer, 2016. [Non-Patent Document 7] Florian Bourse, Micheles Minelli, Matthias Minihold, and Pascal Paillier, "Fast homomorphic evaluation of deep discretised neural networks," Advances in Cryptology-CRYPTO2018, Part III, Lecture Notes in Computer Science, Vol. 10993, pp. 483-512, Springer, 2018. [Non-Patent Document 8] Sergiu Carpov, Malika Izabachene, and Victor Mollimard, "New techniques for multi-value input homomorphic evaluation and applications," Topics in Cryptology-CT-RSA2019, Lecture Notes in Computer Science, Vol. 11405, pp. 106-126, Springer, 2019. [Non-Patent Document 9] Christina Boura, Nicolas Gama, Mariya Georgieva, and Dimitar Jetchev, "Simulating homomorphic evaluation of deep learning predictions," Cyber ​​Security Cryptography and Machine Learning (CSCML2019), Lecture Notes in Computer Science, Vol. 11527, pp. 212-230, Springer, 2019. [Non-Patent Document 10] Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene, "TFHE: Fast fully homomorphic encryption over the torus," Journal of Cryptology, 31(1), pp. 34-91, 2020. [Non-Patent Document 11] Arey N. Kolmogorov, "On the representation of continuous functions of dynamic variables by superposition of continuous functions of one variable and addition", Dokl. Akad. Nauk SSSR, 114, pp. 953-956, 1957. [Non-Patent Document 12] David A. Sprecher, "On the structure of continuous functions of several variables," Transactions of the American Mathematical Society, 115, pp. 340-355, 1965. [Non-Patent Document 13] Pierre-Emmanuel Leni, Yohan Fougerolle, and Frederic Truchetet, "Komogorov superposition theory and its application to the decomposition of multivariate functions," MajecSTIC'08, October 29-31, 2008, Marseille, France, 2008. [Non-Patent Document 14] BF Logan and LA Shepp, "Optimal reconstruction of a function from its projections," Duke Mathematical Journal, 42(4), pp. 645-659, 1975. [Non-Patent Document 15] Allan Pinkus, "Approximating by ridge functions," in A. Le Mehaute, C. Rabut, and LL. Schumaker (Eds.), *Surface Fitting and Multiresolution Methods*, pp. 279–292, Vanderbilt University Press, 1997. [Non-Patent Document 16] Jerome H. Friedman and Werner Stuetzle, "Projection pursuit regression," Journal of the American Statistical Association, 76(376), pp. 817-823, 1981. [Non-Patent Document 17] DS Broomhead and David Lowe, "Multivariable functional interpolation and adaptive networks," Complex Systems, 2, pp. 321-355, 1988. [Non-Patent Document 18] Oded Regev, “On lattices, learning with errors, random linear codes, and cryptography,” 37th Annual ACM Symposium on Theory of Computing, pp. 84-93, ACM Press, 2005. [Non-Patent Document 19] Damien Stehle, Ron Steinfeld, Keisuke Tanaka, and Keita Xagawa, "Efficient public key encryption based on ideal lattices," Advances in Cryptology-ASIACRYPT2009, Lecture Notes in Computer Science, Vol. 5912, pp. 617-635, Springer, 2009. [Non-Patent Document 20] Vadim Lyubashevsky, Chris Peikert, and Oded Regev, "On ideal lattices and learning with errors over rings," Advances in Cryptology-EUROCRYPT2010, Lecture Notes in Computer Science, Vol. 6110, pp. 1-23, Springer, 2010. [Non-Patent Document 21] Ron Rothblum, "Homomorphic encryption: From private-key to public-key," Theory of Cryptography (TCC2011), Lecture Notes in Computer Science, Vol. 6597, pp. 219-234, Springer, 2011. [Non-Patent Document 22] David A. Sprecher, "A implementation numerical of Kolmogorov's superpositions," Neural Networks, 9(5), pp. 765-772, 1996. [Non-Patent Document 23] David A. Sprecher, "A implementation numerical of Kolmogorov's superpositions II," Neural Networks, 10(3), pp. 447-457, 1997. [Non-Patent Document 24] Juergen Braun and Michael Griebel, "On a constructive proof of Kolmogorov's superposition theorem," Constructive Approximation, 30(3), pp. 653-675, 2007. [Overview of the project] [Problems that the invention aims to solve]

[0009] Despite the progress achieved, known computational procedures that can publicly convert a set of ciphertexts (corresponding to plaintexts x1,…,x p corresponding) into ciphertexts corresponding to a given function f(x1,…,x p ) of the plaintexts are limited to some examples or remain impractical. In fact, the current main general means is to represent this function in the form of a Boolean circuit composed of AND, NOT, OR, or XOR type logic gates, and then, taking the ciphertexts of the bits representing the input (plaintext) of the function f as input, evaluate this circuit homomorphically. A measure of the complexity of a Boolean circuit is its multiplicative depth, defined as the maximum number of consecutive AND gates that need to be calculated to obtain the calculation result. In order to continuously control the noise during this calculation, it is necessary to regularly perform bootstrapping operations during its progress. As shown above, even using the latest technology, these bootstrapping operations involve complex calculations and have a large multiplicative depth, so the overall calculation becomes even slower. This approach operates on binary inputs and is only executable for functions with simple Boolean circuits.

[0010] Generally, the function to be evaluated takes one or more real-valued variables x1,…,x p as input. There can even be some functions f1,…,f q evaluated over a set of real-valued variables. Therefore, there is great technical and economic interest in finding a way to quickly execute the aforementioned operation of publicly converting a set of ciphertexts (corresponding to plaintexts x1,…,x p ) into a set of ciphertexts corresponding to multiple real-valued functions f1,…,f q of the plaintexts without mobilizing overly large computational means. In fact, due to the lack of an effective solution to this technical problem, no actual implementation is known to date for the theoretical progress made by Gentry in 2009. What the present invention provides a response to is this problem.

Means for Solving the Problem

[0011] This application relates to a set of ciphertexts (plaintexts x1,…,x p(corresponding to) multiple functions f1, ..., f in plain text q This describes a set of methods intended to be executed digitally by at least one information processing system specifically programmed to effectively and publicly convert a set of ciphertexts corresponding to a given set. This new method involves multivariable functions f1,…,f q This is transformed into a form that combines the summation and composition of multivariable functions. Preferably, functions f1, ..., f q The intermediate values ​​obtained from the transformation are reused in the evaluation. Finally, each of the single-variable functions is preferably represented in tabular form rather than in the usual form of a Boolean circuit.

[0012] Notably, any multivariable function defined in real numbers and possessing real values ​​is supported. Entries undergo pre-encoding to ensure compatibility with the native space of the underlying cryptographic algorithm's message. Decryption can also be applied to the image of the function under consideration in its output after decryption.

[0013] The techniques implemented in this invention can be considered independently or in combination, and apply to multiple functions f1, ..., f while significantly reducing complexity and the computation time required. q The technical effect of the present invention is significant because it enables the evaluation of the results. As described below, this weight reduction stems from several facts, in particular: (i) the multivariable function to be evaluated is transformed into a single-variable function rather than directly acting on a function of several variables; (ii) these functions can be decomposed so as to share the results of intermediate calculations rather than performing individual evaluations; and (iii) the resulting single-variable function is represented in a table rather than a Boolean circuit.

[0014] The function f is a function of several variables x1, ..., x pWhen given, the method according to the present invention transforms the function f as a combination of summation and composition of single-variable functions. Note that these two operations, summation and composition of single-variable functions, can represent affine transformations or linear combinations. By analogy with neural networks, the expression "network of single-variable functions" is used to refer to the representation when the transformation from multivariable to single-variable is complete, combining the summation and composition of single-variable functions, and this network is homomorphically evaluated with multiple encrypted values. The transformation may be exact or approximate; however, note that an exact transformation is an error-free approximation. In practice, the network thus obtained is characterized by being shallower in depth compared to a Boolean circuit that implements the same function. Next, using this new representation of the function f, the encrypted input E(encode(x1)),…,E(encode(x p Evaluate the function f in type E(encode(z), where E is the encryption algorithm and encode is the encoding function, and thus you get type E(encode(z k Starting from the input of )), several single-variable functions g j The type E(encode(g j (z k The calculation of ))) can be completed, and here, z k These are intermediate results. These calculations utilize the homomorphic properties of encryption algorithms.

[0015] It is interesting that when the same network of single-variable functions is reused several times, it is not necessary to redo all the computational steps. Therefore, according to the present invention, the first step is to pre-computate the network of single-variable functions; it is then homomorphically evaluated against encrypted data in a subsequent step.

[0016] The fact that any continuous multivariable function can be written as a sum and composition of single-variable functions was demonstrated by Kolmogorov in 1957 [Arey N. Kolmogorov, "On the representation of continuous functions of dynamic variables by superposition of continuous functions of one variable and addition," Dokl. Akad. Nauk SSSR, 114, pp. 953-956, 1957].

[0017] This result remained theoretical for a long time, but an algorithmic version was discovered, particularly by Sprecher, who proposed an algorithm that explicitly describes a method for constructing single-variable functions [David A. Sprecher, "On the structure of continuous functions of several variables," Transactions of the American Mathematical Society, 115, pp. 340-355, 1965]. A detailed explanation can be found, for example, in the following article [Pierre-Emmanuel Leni, Yohan Fougerolle, and Frederic Truchetet, "Komogorov superposition theory and its application to the decomposition of multivariate functions," MajecSTIC '08, October 29-31, 2008, Marseille, France, 2008]. Furthermore, it should be noted that the assumption of continuity of the function being decomposed can be relaxed by considering the latter approximation.

[0018] Another possible approach is to approximate the multivariable function by the sum of certain multivariable functions called ridge functions, in English terminology [BF Logan and LA Shepp, "Optimal reconstruction of a function from its projections," Duke Mathematical Journal, 42(4), pp. 645-659, 1975]. For a real-valued variable vector x = (x1, ..., x p The Ridge function of this variable vector is the real parameter vector a=(a1,…,a p This is a function applied to the scalar product of ) and, that is, of type g a (x) is a function of the form g(a·x), where g is a single variable. As previously mentioned, scalar products or equivalent linear combinations are specific cases of combinations of summation and composition of single-variable functions, and the decomposition of multivariable functions in the form of summation of ridge functions forms an embodiment of the multivariable-to-single-variable transformation according to the present invention. It is known that any multivariable function can be approximated with as much accuracy as necessary by summation of ridge functions, provided that the number of ridge functions can be increased [Allan Pinkus, "Approximating by ridge functions," A. Le Mehaute, C. Rabut, and LL Schumaker (Eds.), Surface Fitting and Multiresolution Methods, pp. 279–292, Vanderbilt University Press, 1997]. These mathematical results gave rise to a statistical optimization method known as projection pursuit [Jerome H. Friedman and Werner Stuetzle, "Projection pursuit regression," Journal of the American Statistical Association, 76(376), pp. 817-823, 1981].

[0019] g instead of ridge function aIt is also possible to use so-called radial functions of the form (x)=g(||xa||) [DS Broomhead and David Lowe, "Multivariable functional interpolation and adaptive networks," Complex Systems, 2, pp. 321-355, 1988], and other families of basic functions can be used with similar approximation quality (convergence rate).

[0020] In some cases, a formal decomposition is possible without going through Kolmogorov's theorem or one of its algorithmic versions (such as Sprecher's), or without going through ridge functions, radial functions, or variations thereof. For example, the function g(z1,z2)=max(z1,z2) (in particular, functioning as the so-called "maximum pooling" layer used in neural networks) can therefore be decomposed as follows: max(z1,z2)=z2+(z1-z2) + Here,

number

number

[0021] Functions f, ..., f q Given data, each of which is intended to be represented by a network of single-variable functions and then homomorphically evaluated with the encrypted data, this evaluation can be performed in an optimized manner if one or more of these single-variable functions are reused. Thus, for each of the redundancies observed in the set of single-variable functions of the network, some of the steps of homomorphic evaluation of the single-variable functions with respect to the encrypted values ​​need to be performed only once. Since this function homomorphism is usually performed on the fly and is known to be very resource-intensive, sharing intermediate values ​​results in a significant performance gain.

[0022] The following three types of optimization are possible:

[0023] Same function, Do argument When the number of single-variable functions is equal, this optimization prioritizes the network of single-variable functions that repeats the same single-variable function applied to the same argument the most times. In fact, whenever a single-variable function and the input it evaluates to are the same, it is not necessary to recalculate the homomorphic evaluation of this single-variable function for that input.

[0024] Different functions, same arguments This optimization applies embodiments that can share a large portion of the computation when homomorphic evaluations of two or more single-variable functions for the same input can be performed essentially at the expense of a single homomorphic evaluation. The aforementioned CT-RSA 2019 article discusses a similar situation under the name of the multi-output version. Examples of such embodiments are shown in the section “Modes for Carrying Out the Invention”. In the case of multiple variables, this situation is, for example, when the coefficients of the decomposition (a ik When ) is fixed, it appears in the form of a sum of ridge or radial functions of several multivariable functions.

[0025] The same function, differing only in its non-zero addition constant argument. Another situation in which computation can be sped up is when the same single-variable function is evaluated for arguments whose differences are known. This occurs, for example, when Kolmogorov-type decompositions, particularly the approximation algorithm version of Sprecher, are used. In this situation, the decomposition includes a so-called "internal" single-variable function; see, in particular, the application to the internal function Ψ in the "Modes for Carrying Out the Invention" section. The additional cost in the latter case is minimal.

[0026] These optimizations involve several functions f1, ..., f qThese apply when it is necessary to evaluate them, but they also apply when there is only one function to evaluate (q=1). In all cases, it is interesting to prefer different functions for the same argument, or the same function for arguments that differ only by an additive constant, in order to reduce the cost of evaluation as well as create a reduced number of single-variable functions. This property is unique to networks of single-variable functions when the network evaluates homomorphically with encrypted inputs.

[0027] Regardless of whether the function to be evaluated according to the present invention is multivariable and formed through the first step described above, or whether it is intended to process an original single-variable function, the present invention provides a way to perform homomorphic evaluation of these single-variable functions, and in favorable variations, a tabular representation is used for this purpose.

[0028] The homomorphic evaluation of single-variable functions, or more generally, the homomorphic evaluation of combinations of single-variable functions, is based on homomorphic cryptography.

[0029] The LWE (Learning With Errors) problem, introduced by Regev in 2005 [Oded Regev, "On lattices, learning with errors, random linear codes, and cryptography," 37th Annual ACM Symposium on Theory of Computing, pp. 84-93, ACM Press, 2005], enables the construction of homomorphic encryption schemes on a large number of algebraic structures. Typically, an encryption scheme includes an encryption algorithm E and a decryption algorithm D, where c=E(μ) is an encryption of plaintext μ, and D(c) returns the plaintext μ. The LWE problem and encryption algorithms derived from its variations have the peculiarity of introducing noise into the ciphertext. This is called the native space of the plaintext, which accounts for noise, in order to show the space of plaintext in which the encryption algorithm is defined and the decryption of the ciphertext is the first plaintext. For an encryption algorithm E with M as the native space of plaintext, recall that the encoding function encode is a function that brings elements of any set into the set M or a subset thereof. Preferably, this function is injective.

[0030] As detailed in the aforementioned article by Chillotti et al. (ASIACRYPT2016), a real torus modulo 1

number

number

number

number

number

number

number

number

[0031] In the same article, the author

number

number

number

number

number

number

number

number

number

[0032]

number

number

number

number

number

number

number

number

number

number

[0033] Finally, this same article from ASIACRYPT2016 introduces the outer product between RLWE type ciphertexts and RGSW type ciphertexts (an abbreviation for Gentry-Sahai-Waters, where "R" stands for ring). It should be recalled that the RLWE type encryption algorithm gives rise to the RGSW type encryption algorithm. The notation from the previous paragraph is used. For an integer l≧1, Z is

number

[0034]

number

number

number

number

number

number

number

number

number

number

number

[0035] As shown, the aforementioned schemes are so-called symmetric encryption schemes or private-key encryption schemes. This is by no means a limitation, because, as Rothblum shows [Ron Rothblum, "Homomorphic encryption: From private-key to public-key," Theory of Cryptography (TCC2011), Lecture Notes in Computer Science, Vol. 6597, pp. 219-234, Springer, 2011], any additive homomorphic private-key encryption scheme can be converted to a public-key encryption scheme.

[0036] As recalled above, bootstrapping refers to a method that makes it possible to reduce any noise that may be present in the ciphertext. In his aforementioned STOC2009 founding article, Gentry implements bootstrapping with a technique now commonly called "re-encryption," which was introduced therein. Re-encryption involves homomorphically evaluating a decryption algorithm in an encrypted domain. In the plaintext domain, the decryption algorithm takes a ciphertext C and a secret key K as input and returns the corresponding plaintext x. In the encrypted domain, using a homomorphic encryption algorithm E and an encoding function encode, the evaluation of the decryption algorithm takes the ciphertext of the encryption of C and the ciphertext of the encryption of K, E(encode(C)) and E(encode(K)), as input, and thus, under the encryption key of algorithm E, gives a new ciphertext of the encryption of the same plaintext, E(encode(x)). Thus, even assuming that the ciphertext is given as the output of the homomorphic encryption algorithm E does not form a restriction, as it allows the re-encryption technique to end in this case.

[0037] Due to the homomorphism properties of LWE-type encryption schemes and their variants, the plaintext can be computed by performing operations on the corresponding ciphertext. The domain of the definition of the single-variable function f being evaluated is discretized into several intervals that cover the domain of that definition. Each interval is for the value x i and the function f(x i It is represented by the corresponding value of (x). Therefore, the function f is, i ,f(x i It is aggregated by a series of pairs of the form )). These pairs are actually used to homomorphize the ciphertext of f(x), or an approximation starting from the ciphertext of x, for any value of x within the domain of the function's definition.

[0038] At the heart of this invention lies a novel, general technique that combines bootstrapping and encoding. Several embodiments are described in the "Modes for Carrying Out the Invention" section.

[0039] The homomorphism assessment techniques described in the aforementioned ASIACRYPT2016 article, and the techniques introduced in the subsequent research mentioned above, cannot perform homomorphic evaluation of arbitrary functions in arbitrary domains. Firstly, they are strictly limited to single-variable functions. No correspondence for multi-variable cases is known in the prior art. Furthermore, in the single-variable case, the prior art assumes conditions regarding the input values ​​or the function being evaluated. Among these limitations, note, for example, inputs restricted to binary values ​​(bits) and the necessary negative cyclic properties of the function being evaluated (e.g., verified by the "sign" function of a torus). General handling of input or output values ​​that would allow us to end up in these specific cases is not described in the prior art for functions with arbitrary real values.

[0040] Conversely, the implementation of the present invention enables homomorphic evaluation of functions with real-valued variables in their input, which are real-valued LWE-type ciphertexts, regardless of the domain of the function's form or definition, while allowing for noise control (boosting) in the output. [Brief explanation of the drawing]

[0041] [Figure 1] This diagram schematically replicates the first two steps. [Figure 2] As an example, this figure shows the case where p=2. [Figure 3] This figure shows a single-variable function f of a real-valued variable that has arbitrary precision in the domain of definition D and real values ​​in image I. [Modes for carrying out the invention]

[0042] The present invention relates to a method by which at least one specially programmed information processing system processes encrypted data using one or more variables having real values ​​to perform one or more functions f1, ..., f q This enables the evaluation to be performed digitally, with each function being a real-valued variable x1, ..., x p It takes multiple real-valued variables as input from among them.

[0043] When at least one of the functions takes at least two variables as input, the method according to the present invention comprises, in general terms, three steps: 1. The so-called pre-computation step involves transforming each of the aforementioned multivariable functions into a network of single-variable functions composed of a sum and composition of single-variable functions having real values. 2. In the pre-computed single-variable function network, the so-called pre-selection step involves identifying different types of redundancy and selecting all or some of them. 3. A so-called homomorphic evaluation step for each of the pre-computed networks of single-variable functions, in which the redundancy selected in the pre-selection step is evaluated in an optimized manner.

[0044] Regarding the second step (pre-selection), the selection of all or some redundancy is not solely driven by the objective of optimizing the digital processing of homomorphic evaluation, whether it is for the benefit in terms of computation time or for availability reasons such as memory resources for storing intermediate calculation values.

[0045] Figure 1 schematically replicates the first two steps as implemented in accordance with the present invention by a computer system programmed for this purpose.

[0046] Therefore, in one embodiment of the present invention, one or more multivariable functions f1, ..., f having real values q This is an evaluation of each function, where each function is a variable x1, ..., x p From among these, multiple real-valued variables are taken as input, and at least one of the functions takes at least two variables as input, input x i E(encode(x i The ciphertexts of each of the following encryptions are taken as input, where 1 ≤ i ≤ p, and f1, ..., f are applied to each of these inputs. q The function returns multiple ciphertexts of the encryption, where E is a homomorphic encryption algorithm, and encodes the elements of the native space of the plaintext of E into real numbers x.i An encoding function associated with each of these is a multivariable function f1, ..., f, which has real values ​​and is one or more variables. q The rating is: 1. A pre-computation step which involves transforming each of the aforementioned multivariable functions into a network of single-variable functions composed of a sum and composition of single-variable functions having real values. 2. In the network of pre-computed single-variable functions, there are three types a. The same single-variable function applied to the same argument, b. Different single-variable functions applied to the same argument, c. The same single-variable function applied to arguments that differ only by a non-zero addition constant, The pre-selection step involves identifying one of the redundancies and selecting all or part of it. 3. Steps for evaluating each homomorphic evaluation of the pre-computed network of single-variable functions, in which the redundancy selected in the pre-selection step is evaluated in an optimized manner. This is a possible characteristic.

[0047] Regarding the pre-computation step, by an explicit version of Kolmogorov's superposition theorem, the identity hypercube Ip=[0,1] of dimension p is obtained. p Any continuous function defined in

number

number

number

number

[0048] As an example, Figure 2 shows the case where p=2.

[0049] Functions Ψ and ξ are so-called "internal" functions and are independent of a given arity f. Function Ψ is I p The real vector (x1, ..., x p Any component x of ) i Associate the values ​​[0,1] with the function ξ. p )∈Ip, a numerical value in the interval [0,1]

number

[0050] Sprecher proposed algorithms for determining the intrinsic and extrinsic functions in [David A. Sprecher, "A numerical implementation of Kolmogorov's superpositions," Neural Networks, 9(5), pp. 765-772, 1996] and [David A. Sprecher, "A numerical implementation of Kolmogorov's superpositions II," Neural Networks, 10(3), pp. 447-457, 1997], respectively.

[0051] Instead of the function Ψ originally defined by Sprecher to construct ξ (which is discontinuous for some input values), one can use the function Ψ defined in [Jurgen Braun and Michael Griebel, "On a constructive proof of Kolmogorov's superposition theorem," Constructive Approximation, 30(3), pp. 653–675, 2007].

[0052] When the internal functions Ψ and ξ are fixed, the external function g k The remaining task is to determine (depending on function f). For this purpose, Sprecher uses the external function g. k The r function converges toward

number

number

number

number

number

[0053] Therefore, in one embodiment of the present invention, the pre-calculation step is f1, ..., f q at least one function f from among jRegarding the conversion of the pre-calculation step,

number

number

[0054] Multivariable function f(x1,…,x p Another technique for breaking down ) is transformation

number

[0055] Therefore, decomposition is an approximation in the general case, and its purpose is to identify the best approximation, or an approximation of sufficient quality. This approximation appears in literature specializing in statistical optimization as projection tracking. As mentioned above, the notable result is that any function f can be approximated by this method with arbitrary accuracy. However, in practice, f generally allows for an exact decomposition, that is, it can be analytically expressed in the form of a sum of ridge functions for all or part of its inputs.

[0056] function f jwhen taking a subset of t variables from {x1,…,x p} as input, where these variables are j1,…,j t ∈{1,…,p} and

Number

Number

Number

[0057] Thus, in one embodiment of the present invention, for at least one function f q from f1,…,f j in the precomputation stage, the transformation of the precomputation step is

Number

[0058] Similar decomposition techniques using the same statistical optimization tools are not ridge functions but

Number

[0059] When the function f j takes as input a subset of t variables of {x1, …, x p} with t ≤ p, and these variables are represented using j1, …, j t ∈ {1, …, p}, then the previous decomposition is written as

Number

Number

Number

[0060] Thus, in one embodiment of the invention, for at least one function f q from f1, …, f j in the precomputation stage, the transformation of the precomputation step is

number

number

[0061] As shown in the aforementioned Pinkus article, another important class of function decomposition is the coefficient a i , k When g is fixed, the function g k is a variable. This class applies to decompositions of both ridge function forms and radial function forms. Several methods are known to solve this problem, including the von Neumann algorithm, the cyclic coordinate algorithm, the Schwarz domain decomposition method, the Dilibert-Strauss algorithm, and variations found in specialized literature on tomography; see the same Pinkus article and its references.

[0062] Therefore, in one particular embodiment of the present invention, this pre-calculation step is performed using coefficient a i , k It is further characterized by the fact that it is fixed.

[0063] In some cases, the transformation of the pre-computation step can be precisely performed by the equivalent formal representation of a multivariable function.

[0064] Consider the g multivariable function. When this function g calculates the maximum value of z1 and z2, g(z1, z2) = max(z1, z2), the formal equivalence max(z1, z2) = z2 + (z1 - z2) + can be used, where

Number

Number

Number

Number

Number

[0065] Generally, in the case of three or more variables z1,..., z m , for any i satisfying 1 ≤ i ≤ m - 1, max(z1,..., z i , z i+1 ,..., z m ) = max(max(z1,..., z i ), max(z i+1 ,..., z m )) is set, then max(z1,..., z m ) is thus repeatedly obtained as a combination of sums and the function |·| (absolute value) or (·) + .

[0066] Therefore, in one embodiment of the present invention, the pre-calculation step is formally equivalent to max(z1,z2)=z2+(z1-z2) in the transformation of this pre-calculation step. + Use the function

number

[0067] In certain embodiments of the present invention, this pre-calculation step is further characterized in that, when a multivariable function includes three or more variables, a formal equivalence is obtained for the function from iterative formal equivalences for two variables.

[0068] Similarly, in the case of the "minimum" function g(z1,z2)=min(z1,z2), the formal equivalent is min(z1,z2)=z2+(z1-z2). - You can use it here

number

number

[0069] Therefore, in one embodiment of the present invention, the pre-calculation step is formally equivalent to min(z1,z2)=z2+(z1-z2) in the transformation of this pre-calculation step. - Use the function

number

[0070] In certain embodiments of the present invention, this pre-calculation step is further characterized in that, with respect to the function, when the latter includes three or more variables, a formal equivalence is obtained from iterating formal equivalences for two variables.

[0071] Another very useful multivariable function that can be easily formally decomposed into a combination of sums and compositions of single-variable functions is multiplication. In the first embodiment, for g(z1,z2)=z1×z2, the formal equivalent is z1×z2=(z1+z2) 2 / 4-(z1-z2) 2 This involves using / 4, a single-variable function.

number

number

[0072] Therefore, in one embodiment of the present invention, the pre-calculation step is such that the transformation of this pre-calculation step is formally equivalent to z1 × z2 = (z1 + z2) 2 / 4-(z1-z2) 2 Using / 4, function

number

[0073] These embodiments show z1 × … × z for 1 ≤ i ≤ m-1. i ×z i+1 ×…×z m =(z1 × ... × z i )×(z i+1 ×…×z m By observing this, it can be generalized to an m-variable function for m≧3.

[0074] In certain embodiments of the present invention, this pre-calculation step is further characterized in that, with respect to the function, when the latter includes three or more variables, a formal equivalence is obtained from iterating formal equivalences for two variables.

[0075] The second embodiment is a single-variable function

number

number

number

number

number

number

[0076] Therefore, in one embodiment of the present invention, the pre-calculation step is performed by using the formal equivalent |z1×z2|=exp(ln|z1|+ln|z2|) and the function as a combination of summation and composition of single-variable functions.

number

[0077] In certain embodiments of the present invention, this pre-calculation step is further characterized in that, with respect to the function, when the latter includes three or more variables, a formal equivalence is obtained from iterating formal equivalences for two variables.

[0078] As mentioned above, a multivariable function given as input is transformed into a network of multivariable functions. Such a network is not necessarily unique, even if the transformation is accurate.

[0079] As an example, the multivariable function max(x1,x2) as shown above, that is, max(x1,x2) = x2 + (x1 - x2) + And we have seen at least two decompositions of max(x1,x2)=(x1+x2+|x1-x2|) / 2. Specifically, each of these transformations can proceed in detail as follows:

[0080] 1. max(x1,x2)=x2+(x1-x2) + Assuming z1 = x1 - x2, g1(z) = z + Define. We write max(x1,x2)=x2+g1(z1).

[0081] 2.max(x1,x2)=(x1+x2+|x1-x2|) / 2 Assume z1 = x1 - x2 and z2 = x1 + x2. We define g1(z)=|z| and g2(z)=z / 2. Let z3 = z2 + g1(z1) and write max(x1, x2) = g2(z3).

[0082] Generally, two types of operations are observed in a network of single-variable functions: summation and evaluation of single-variable functions. When the network evaluation is performed homomorphically with respect to encrypted values, the most costly operation is the evaluation of single-variable functions, which usually involves a bootstrapping step. Therefore, it is interesting to construct a network of single-variable functions that minimizes these single-variable function evaluation operations.

[0083] Therefore, in the previous example, the first transformation of the "maximum" function is [max(x1,x2)=x2+(x1-x2)] + This is the evaluation of a single-variable function, i.e., the function g1(z)=z + It appears to be more advantageous because only the evaluation of is needed. In practice, the difference is inconspicuous because the second single-variable function of the second transformation does not actually need to be evaluated; all that is needed is to return 2max(x1,x2)=x1+x2+|x1-x2| or to integrate this factor into the decoding function of the output. In general, single-variable functions that are multiplications by a constant can be ignored by (i) computing a multiple of the starting function, or (ii) absorbing the constant by composition if these functions are in the input of another single-variable function. For example, the multivariable function sin(max(x1,x2)) can be written as follows:

[0084] 1.sin(max(x1,x2))=sin(x2+(x1-x2) + ) Let z1 = x1 - x2, and define g1(z) = z+. Define g2(z) = sin(z).

[0085] 2. Write sin(max(x1,x2))=g2(z2) for z2=x2+g1(z1). sin(max(x1,x2))=sin((x1+x2+|x1-x2|) / 2) Assume z1 = x1 - x2 and z2 = x1 + x2. We define g1(z)=|z| and g2(z)=sin(z / 2).

[0086] 3. Write sin(max(x1,x2))=g2(z3) using z3=z2+g1(z1). (In the second case, by the function g2(z)=sin(z / 2)

number

[0087] Apart from single-variable functions of type g(z) = z + a (addition of a constant a) or type g(z) = az (multiplication by a constant a), the evaluation of single-variable functions can be fast in other situations.

[0088]

number

number

[0089] Three types of optimization are considered:

[0090] 1) Same function, same argument: g k = g k’ and

Number

Number

Number

Number

[0091] 2) Different functions, same argument: g k ≠ g k’ and

Number

Number

[0092] a. max(x1, x2) + |x1 × x2| = x2 + (x1 - x2) a.max(x1,x2)+|x1×x2|=x2+(x1 - x2) ++exp(ln|x1|+ln|x2|) Assuming z1 = x1 - x2, g1(z) = z + define Define g2(z)=ln|z| and g3(z)=exp(z). Using z2 = g2(x1) + g2(x2), write max(x1, x2) + |x1 × x2| = x2 + g1(z1) + g3(z2). b.max(x1,x2)+|x1×x2|=x2+(x1-x2) + +|(x1+x2) 2 / 4-(x1-x2) 2 / 4| Assuming z1 = x1 - x2, g1(z) = z + define Let z2 = x1 + x2, then g2(z) = z 2 Define / 4 and g3(z)=|z| Using z3 = g2(z2) - g2(z1), we write max(x1, x2) + |x1 × x2| = x2 + g1(z1) + g3(z3).

[0093] The two embodiments described above include evaluations of four single-variable functions. However, the second embodiment includes two single-variable functions for the same argument, namely g1(z1) and g2(z1), with g1(z1) taking precedence.

[0094] The sharing of single-variable functions for the same arguments is not limited to transformations performed by equivalent formal representations. This also applies to digital transformations.

number

number

number

[0095] In this construction, the so-called "internal" functions Ψ and ξ are independent of f for a given domain of definition. Therefore, several multivariable functions f1, ..., f defined in the same domain are independent of f. q If a function is evaluated as a homomorphism, then the homomorphism evaluations of functions Ψ and ξ do not need to be recalculated when they are applied to the same input. This situation is, for example, when the coefficients of a decomposition (a ik It also appears in the decomposition of some multivariable functions using ridge functions or radial functions when ) is fixed.

[0096] 3) The same function, but with different arguments due to the addition constant: The known constant a k For ≠0, g k =g k’ and

number

[0097] For example, in Sprecher's construction, the homomorphic evaluation of f above still requires a variable that is additively different by a constant value, i.e., x when ka is known for 1 ≤ i ≤ p. i This includes several homomorphic evaluations of the same single-variable function Ψ with respect to +ka. In this case, Ψ(x i The encrypted value of +ka) is Ψ(x i It can be efficiently obtained from the encryption of ), and one embodiment is described in detail below.

[0098] Formally, each of those arguments,

number

Number

Number

Number

Number

[0099] As shown in "Figure 3", in the case of a univariate function f of any real-valued variable with arbitrary precision in the domain of definition D and having real values in the image I,

Number

number

number

number

number

number

number

number

number

number

number

number

[0100] Therefore, in one embodiment, the present invention covers the approximate homomorphic evaluation of a single-variable function f of a real-valued variable x having arbitrary precision in the domain of definition D and real values ​​in image I, which is performed digitally by a specially programmed information processing system, taking an encrypted ciphertext of x, E(encode(x)), as input, and returning an encrypted ciphertext of an approximate value of f(x), E'(encode'(y)), where y≈f(x), E and E' are homomorphic encryption algorithms, the native spaces of their respective plaintexts are M and M', and their evaluation is: • An integer N≧1 that quantifies the actual precision of the representation of the variables in the input of the function f being evaluated. • An encoding function, encode, that takes elements from region D as input and associates them with elements from region M. • Encoding function encode' takes elements of image I as input and associates them with elements of M'. • A discretization function that takes elements of M as input and associates them with integer indices. • Encryption algorithm E H It has a native space M of its plaintext. H This is a homomorphic encryption scheme having a cardinality of at least N. · Take an integer as input, M H Encoding function encode that returns the elements H Parameterized by, as a result the image of region D is encoded and then discretized,

number

[0101] Using these parameters, the approximate homomorphism evaluation of the single-variable function f requires the implementation of the following two consecutive steps by a specially programmed information processing computer system:

[0102] 1. A step of pre-calculating a table corresponding to the single-variable function f, a. Region D is divided into N selected subintervals R0, ..., R N-1 This involves decomposing the set into its constituent parts, and the union of these parts is D. For each index i in bS = {0, ..., N-1}, the subinterval R i Determine a representative x(i) and calculate its value y(i) = f(x(i)). c. For 0 ≤ i ≤ N-1, T[i] = y(i)) and return a table T consisting of N components T[0], ..., T[N-1]. This is the step.

[0103] 2. Steps for evaluating homomorphisms in the table, ax∈R i For this, the index in the set S={0,…,N-1}

number

number

number

number

number

number

number

number

[0104] The domain of the definition D of the function f being evaluated is the real interval [x min ,x max When ), N subintervals R that cover D i (For 0≦i≦N-1) the following half-open intervals can be selected:

number

number

[0105] Therefore, in one embodiment of the present invention, the approximate homomorphism evaluation of a single-variable function f is The domain of the definition of the function f being evaluated is the real interval D = [x min ,x max ) is given • N intervals R that cover region D i (for 0 ≤ i ≤ N-1) is a half-open subinterval.

number

[0106] Encoding function H Algorithm E H The choice is E(encode(x))

number

number

number

[0107] Therefore, in one embodiment of the present invention, the approximate homomorphism evaluation of a single-variable function f is performed by the additive group S for integers M≧N.

number

[0108] group

number

number

Number

Number

[0109] The modular multiplication operation (X M - 1) induces a group isomorphism between the additive group

Number

Number

[0110] Therefore, in one embodiment of the present invention, the approximate quasi-homomorphic evaluation of the univariate function f is further characterized in that the group

Number

number

number

[0111] Homomorphic encryption algorithm E is a torus

number

number

number

number

number

number

[0112] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a single-variable function f is, the homomorphic encryption algorithm E is, a torus

number

number

[0113] Next, the discretization function is parameterized for integers M≧N as a function that associates integer rounding of the product M×t modulo M with the elements t of the torus, where M×t is

number

number

number

[0114] This discretization function can be naturally extended to a torus vector.

number

number

number

number

number

number

number

number

number

number

[0115]

number

number

number

number

number

number

number

number

number

number

number

number

number

[0116] Therefore, in one embodiment of the present invention, the approximate homomorphism evaluation of a single-variable function f is, • The encoding function encodes a subinterval of a torus.

number

number

number

number

[0117] The domain of the definition of the function f being evaluated is the real interval D = [x min ,x max ) and the native space of plaintext M is a torus

number

[0118]

number

number

number

[0119] Therefore, in one embodiment of the present invention, the approximate homomorphism evaluation of a single-variable function f is performed when the domain of the definition of the function f is the real interval D=[x min ,x max When ), the encoding function encode is

number

[0120] construction

number

number

number

number

number

number

number

number

number

number

number

number

[0121] Therefore, in one embodiment of the present invention, the approximate homomorphism evaluation of a single-variable function f is performed using the homomorphic encryption algorithm EH This is an LWE-type encryption algorithm, and the encoding function is encode H It is further characterized by being an identity function.

[0122] From E(encode(x))

number

number

number

number

number

number

number

[0123]

number

number

number

number

number

number

number

number

[0124] In this case, E H teeth

number

number

number

number

number

[0125] Therefore, RLWE(m) is key (s'1,…,s' k ) under

number

number

number

[0126] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a single-variable function f parameterized by an even integer M is performed using the homomorphic cryptographic algorithm E H However, it is an RLWE type encryption algorithm,

number

number

number

[0127] According to one of the two preceding embodiments,

number

[0128] 1. The first case is the encoding function encode H but

number

number

number

number

number

number

number

number

number

[0129] 2. The second case is any polynomial

number

number

number

number

number

number

number

number

number

number

number

[0130] In particular, for integers L>1,

number

number

number

number

number

number

[0131] In both cases, the expected polynomial is the return of this first substep of the homomorphism evaluation of table T.

number

number

number

number

number

[0132] The second substep of the homomorphism evaluation of Table T (common to both cases) is from the RLWE ciphertext.

number

number

number

number

number

number

number

number

number

number

[0133] For each 1 ≤ j ≤ k, the polynomial

number

number

number

number

number

number

number

number

[0134] Once this calculation is complete, the ciphertext

number

[0135] Therefore, in one embodiment of the present invention, an approximate homomorphic evaluation of a single-variable function f parameterized by an even integer M equal to 2N is an LWE-type ciphertext on a torus.

number

number

number

number

[0136] The image I of the function f being evaluated is on the real interval [y min ,y max) and the native space of the plaintext M' in LWE encryption is a torus

number

number

number

[0137] Therefore, in one embodiment of the present invention, the approximate homomorphism evaluation of a single-variable function f is such that the image of the function f is on the real interval I=[y min ,y max ) when, • The homomorphic encryption algorithm E' is a torus

number

number

number

number

[0138] When adding ciphertext, the encoding must be considered. If the encoding function of the homomorphic encoding algorithm E is denoted as encode, then using μ1=encode(x1) and μ2=encode(x2), we obtain E(μ1+μ2)=E(μ1)+E(μ2). If the encoding function is homomorphic, then we actually obtain E(encode(x1+x2))=E(encode(x1))+E(encode(x2)). Otherwise, if the encoding function does not conform to addition, a correction ε must be applied to the encoding: ε=encode(x1+x2)-encode(x1)-encode(x2), resulting in E(encode(x1+x2))=E(encode(x1))+E(encode(x2))+E(ε). In particular, if the encoding is

number

number

[0139] Of course, the previous considerations are also valid for images. For a homomorphic encryption algorithm E' with encoding function encode', for a correction ε' = encode'(f(x1)+f(x2))-encode'(f(x1))-encode'(f(x2)), we obtain E'(encode'(f(x1)+f(x2))) = E'(encode'(f(x1)))+E'(encode'(f(x2)))+E'(ε'). In particular, if the encoding encode' conforms to addition, the correction ε' is zero. The correction ε' is equal to the encoding

number

number

[0140] Another important specific case is when we need to homomorphically evaluate the same single-variable function f for inputs x1 and x2 = x1 + A for a given constant A. A typical example of this application is the internal function Ψ in the aforementioned Sprecher application. For a homomorphic cryptographic algorithm E with an encoding function encode, given the fact that E(encode(x1)), we can estimate E(encode(x2)) = E(encode(x1 + A)), and then obtain E'(encode'(f(x1))) and E'(encode'(f(x2))) as described above. However, all steps must be repeated. In the specific case where E is an LWE-type algorithm on a torus and M = 2N, the expected polynomial for input E(encode(x1)) is the return of the first substep of the homomorphic evaluation in Table T.

number

number

number

number

number

number

number

number

[0141] The present invention also covers an information processing system specifically programmed to implement a homomorphic cryptographic evaluation method using one of the alternative methods described above.

[0142] Furthermore, it also covers computer program products that implement one of the above alternative methods and are specifically designed to be loaded and implemented by an information processing system programmed for this purpose.

[0143] Examples of applications of the present invention The above invention can be used very advantageously to maintain the confidentiality of certain data, such as personal, health, or sensitive information data, or more generally, any data whose owner wishes to keep secret but who wants a third party to be able to perform digital processing on it, but which is not limited to this. Delocalizing processing to one or more third-party service providers is interesting for several reasons; by delocalizing, it is possible to perform calculations that would require costly or unavailable resources, and also to perform confidential calculations. Then, the third party responsible for performing the digital processing calculation may not actually want to disclose the actual content of the processing and the digital functions implemented therein.

[0144] In such use, the present invention particularly covers the implementation of remote digital services such as cloud computing services, and a third-party service provider responsible for applying digital processing to encrypted data in cloud computing services, on its side, performs the above-mentioned first pre-computation step, which is to use functions f1,..., f q among each multivariate function f j to pre-compute a network of univariate functions. For all the obtained univariate functions (for a given

Number

Number

Number

Number

Number

Number

[0145] Next, the secret data (x1,..., x pThe owner of ) performs encryption using the homomorphic encryption algorithm E, and transmits the data to a third party as type data E(μ1), ..., E(μ p ) sends, and here μ i x is encoded by the encoding function i This is the value of [the algorithm]. Typically, the selection of algorithm E is imposed by the third-party service provider. Alternatively, the data owner can use their chosen encryption algorithm, even if it is not homomorphic, in which case the steps prior to re-encryption are performed by a third party (or another service provider) and the encrypted data is obtained in the desired format.

[0146] Accordingly, in one embodiment of the present invention, the homomorphic evaluation cryptography method described above is characterized in that the input encrypted data is derived from a re-encryption step before it is set in the form of a ciphertext encrypted by the homomorphic encryption algorithm E.

[0147] Third parties encrypted data of type E(μ i When we obtain the ciphertexts, in the step of homomorphic evaluation of the single-variable function network, we homomorphize each of the single-variable function networks in a series of consecutive steps based on these ciphertexts and apply the f of the encryption algorithm E' to their inputs (for 1 ≤ j ≤ q). j Obtain the ciphertext of the encrypted message.

[0148] Different functions f considered j Regarding that, once the encrypted results of the encryption for those input values ​​are obtained, the third party involved sends all of these results back to the owner of the confidential data.

[0149] The owner of the confidential data then, based on the corresponding decryption key it holds, decrypts the homomorphically encrypted input data (x1, ..., x p One or more functions (f1, ..., f) starting with ) qThe result value of ) can be obtained, and the third party has not performed digital processing, which is the implementation of one or more functions, on the said data, nor has the data been able to know the exact content of the data, nor, conversely, the data owner had any need to know the details of the implemented functions.

[0150] Sharing such tasks between data owners and third parties acting as digital processing service providers can be advantageously carried out remotely, particularly across cloud computing services, without impacting the security of the data and associated processing. Furthermore, various steps in digital processing may be the responsibility of different service providers.

[0151] Accordingly, in one embodiment of the present invention, a cloud computing-type remote service implements one or more of the homomorphic evaluation cryptographic methods described above, where the task is shared between the data owner and a third party acting as a digital processing service provider.

[0152] In a particular embodiment of the present invention, data x1, ..., x that you wish to keep confidential p This remote service involves the owner of the said data and one or more third parties responsible for applying the digital processing of the said data. 1. The relevant third party performs a first step and a second pre-selection step of pre-calculating a network of single-variable functions in accordance with the present invention. 2. The owner of the data uses the homomorphic encryption algorithm E to obtain x1, ..., x p Encryption is performed, and the type data E(μ1), ..., E(μ p ) sends, and here, μ i x is encoded by the encoding function i It is a value. 3. Encrypted data type E(μ) by a third party involved iUpon obtaining these ciphertexts, the third party concerned evaluates each of the aforementioned networks of single-variable functions homomorphically in a series of consecutive steps based on these ciphertexts and applies the f of the encryption algorithm E' to their inputs (for 1 ≤ j ≤ q). j Get the ciphertext of the encryption 4. Different functions f considered j Regarding that, once the encrypted results of the encryption for those input values ​​are obtained, the third party involved sends all of these results back to the data owner. 5. The data owner, based on the corresponding decryption key they hold, can use one or more functions (f1, ..., f) after decryption. q Get the result value of ). This is another distinguishing feature.

[0153] A variation of this embodiment is in the second step (2.) described above: • The data owner uses a different encryption algorithm than E, x1, ..., x p The encryption is performed, and the encrypted data is transmitted. • The received encrypted data is re-encrypted by the relevant third party, and the ciphertext E(μ1), ..., E(μ) is created under the homomorphic encryption algorithm E. p ) obtain, and here, μ i x is encoded by the encoding function i It is a value. It is characterized by the following:

[0154] In particular, different applications of the remote digital service according to the present invention can be mentioned. For example, as mentioned in the aforementioned MajecSTIC'08 article, it is already known that an approximate image of the original image can be reconstructed by a Kolmogorov-type decomposition applied to a gray-level image—which can be viewed as a two-variable function f(x,y)=I(x,y), where I(x,y) gives the gray intensity of the pixel at coordinate (x,y). Thus, with knowledge of the coordinates (x1,y1) and (x2,y2) that define the bounding box, a trimming operation can be performed in a simple manner. A similar process can be applied to color images, taking into account that the two-variable functions f1(x,y)=R(x,y), f2(x,y)=G(x,y), and f3(x,y)=B(x,y) give the red, green, and blue levels, respectively. This type of processing is known for unencrypted data, but now in the present invention it can be performed using homomorphic encryption. Therefore, according to the present invention, if a user transmits, in an encrypted manner, his GPS coordinates recorded at regular intervals (e.g., every 10 seconds) during a sports activity, and the coordinates of the furthest point of movement (defining the bounding box), a service provider possessing an image of the mapping plan can obtain the ciphertext of the portion of the plan relevant to the activity by cropping; furthermore, movement within the still encrypted area can be represented, for example, using a color code to indicate local speed homomorphically calculated based on the encrypted image of the received GPS coordinates. Conveniently, the (third-party) service provider knows nothing about the exact location of the activity (unless it is according to the service provider's plan) or the user's performance. Moreover, the third party does not disclose the entire map.

[0155] The present invention can also be advantageously used to enable artificial intelligence processing to perform machine learning-type processing on input data, in particular, while the input data remains encrypted, and a service provider implementing a neural network on the input data applies one or more activation functions to values ​​derived from the encrypted data. As an example of this use of the present invention related to the implementation of a neural network, one can refer to the decomposition of the function g(z1,z2)=max(z1,z2), which functions as the aforementioned "maximum pooling" used in a neural network, in particular, and z2+(z1-z2) + And here

number

number

number

number

number

[0156] Therefore, in one embodiment of the present invention, a remote service implementing one or more of the cryptographic homomorphism evaluation methods described above is intended to be a digital process that implements a neural network.

[0157] Disclosure of the invention as a feature The present invention enables the evaluation of one or more functions relating to encrypted data through the implementation of data computation and processing capabilities of one or more digital information processing systems. In some cases, this function or these functions may be single-variable or multi-variable. Therefore, in its different variations, the method according to the present invention enables the evaluation of both types of functions.

[0158] When the function to be evaluated is of the multivariable type, the present invention first provides performing the following two preliminary steps: the first is a pre-computation step, followed by a second pre-selection step, and then, according to any known method for homomorphic evaluation of a single-variable function, a third step of homomorphic evaluation of the network of single-variable functions is applied to the network of single-variable functions obtained upon completion of the execution of these two preliminary steps. This is the object of claim 1.

[0159] Several variations of the above method are disclosed in claims 2 to 5, depending on whether the initial pre-computation steps can implement the various mathematical techniques described above: one Kolmogorov-type decomposition of the algorithm, such as that proposed by Sprecher (claim 5), relying on a sum of certain multivariable functions called ridge functions (claims 2 and 4), or using so-called radial functions (claims 3 and 4). In some specific cases, the present invention also offers the advantageous possibility of not using any of these three aforementioned variations and simply proceeding with the formal decomposition using different formal equivalents (such as those claimed in each of claims 6 to 10).

[0160] If the function to be evaluated is of the single-variable type, the present invention provides, in one of its implementations, implementations of two homomorphic encryption algorithms at their respective inputs and outputs, a step of pre-computing a table of each function under consideration, and, according to claim 11, a subsequent step of homomorphic evaluation of the resulting table. Advantageously, this modality of homomorphic evaluation of one or more single-variable functions can also be implemented to perform a third homomorphic evaluation step provided upon completion of pre-computation and pre-selection steps previously applied to one or more multivariable functions according to claim 1.

[0161] Claim 11 covers two variations of such combinations, including when the initial pre-computation stage uses an approximate transformation (characterized by claims 2 to 5) or a transformation based on formal equivalence (characterized by claims 6 to 10).

Claims

1. one or more multivariate real-valued functions f １ , ..., f ｑ wherein each function is a function of a variable x １ , ..., x ｐ as inputs, and at least one of the functions takes at least two variables as inputs; Input x for 1≦i≦p ｉ , E(encode(x ｉ )) as inputs, and １ , ..., f ｑ where E is a homomorphic encryption algorithm, and encode converts elements of the native space of plaintexts of E into real numbers x ｉ is the encoding function associated with each of a pre-computation step consisting in transforming each of said multivariate functions into a network of univariate functions made up of compositions and sums of univariate functions with real values; b. In said network of precomputed univariate functions, three types: The same univariate function applied to the same arguments, ○ Different univariate functions applied to the same arguments, The same univariate function applied to arguments that differ by a non-zero additive constant a pre-selection step consisting in identifying redundancies in one of the c) A step of homomorphic evaluation of each of the networks of precomputed univariate functions, in which when all or part of one or more of these univariate functions are reused, the redundancies selected in the preselection step are evaluated in a shared manner.

2. f １ , ..., f ｑ At least one function f ｊ For t, the transformation of the precomputation step is t≦p and j １ , ..., j ｔ ∈{1,...,p} [Equation 1] is an approximate transformation in the form ｉ , ｋ is a real number, and g ｋ is a univariate function defined on real numbers and having real values, and the function g ｋ and the coefficient a ｉ , ｋ is the function of f for a given parameter K. ｊ 2. The encryption method of claim 1, wherein the encryption key is determined in response to:

3. f １ , ..., f ｑ At least one function f ｊ whereas the transformation in the precomputation step is [Equation 2] 、 [Equation 3] , t≦p and j １ , ..., j ｔ ∈{1,...,p} [Equation 4] is an approximate transformation of the form ｋ is the coefficient a ｉ , ｋ and g ｋ is a real-valued univariate function defined on real numbers, and the function g ｋ and the coefficient a ｉ , ｋ is the function of f for a given parameter K and a given norm ||·||. ｊ 2. The encryption method of claim 1, wherein the encryption key is determined in response to:

4. Coefficient a ｉ , ｋ 4. The encryption method according to claim 2, wherein is fixed.

5. f １ , ..., f ｑ At least one function f ｊ For t, the transformation of the precomputation step is １ , ..., j ｔ ∈{1,...,p} [Equation 5] where Ψ is a univariate function defined on the real numbers and having real values, [Equation 6] is a real constant, and g ｋ is a real-valued univariate function defined on real numbers, and the function g ｋ is the function of f for a given parameter K. ｊ 2. The encryption method of claim 1, wherein the encryption key is determined in response to:

6. The transformation of the precomputation step is formally equivalent to max(z １ , z ２ ) = z ２ +(z １ -z ２ ) ＋ Using the function [Equation 7] 2. The encryption method according to claim 1, wherein the expression is expressed as a combination of sums and compositions of single-variable functions.

7. The transformation of the precomputation step is formally equivalent to min(z １ , z ２ ) = z ２ +(z １ -z ２ ) － Using the function [Equation 8] 2. The encryption method according to claim 1, wherein the expression is expressed as a combination of sums and compositions of single-variable functions.

8. The transformation of the precomputation step is formally equivalent to z １ xz ２ = (z １ +z ２ ) ２ / 4-(z １ -z ２ ) ２ Using / 4, the function [Equation 9] 2. The encryption method according to claim 1, wherein the expression is expressed as a combination of sums and compositions of single-variable functions.

9. The transformation of the precomputation step is formally equivalent to |z １ xz ２ |=exp(ln|z １ |+ln|z ２ |) to the function [Equation 10] 2. The encryption method according to claim 1, wherein the expression is expressed as a combination of sums and compositions of single-variable functions.

10. 10. The encryption method according to claim 6, wherein when a function includes three or more variables, formal equivalence of the function is obtained by repeating formal equivalence of two variables.

11. In the step of homomorphic evaluation of at least one of the precomputed networks of univariate functions, the method includes a subprocess for approximately homomorphic evaluation of at least one of said univariate functions f of a real-valued variable x having arbitrary precision in the domain of definition D and real values ​​in image I, which takes as input a ciphertext E(encode(x)) of the encryption of x and returns a ciphertext E'(encode'(y)) of the encryption of an approximation of f(x), y≈f(x), where E and E' are homomorphic encryption algorithms and the respective native spaces of plaintexts are M and M'; The sub-method comprises: an integer N≧1 that quantifies the actual precision of the representation of the variables at the input of the function f to be evaluated, an encoding function encode that takes as input an element of domain D and associates it with an element of M; an encoding function encode' that takes as input an element of image J and associates to it an element of M'; a discretization function discretize that takes as input an element of M and associates it with an index expressed as an integer; - the native space M of the plaintext Ｈ an encryption algorithm E Ｈ a homomorphic encryption method having - Takes an integer as input and M Ｈ An encoding function encode that returns the elements of Ｈ is parameterized by As a result, the image of domain D by encoding encode followed by discretization discretise [0011] is a set of at most N indices selected from S={0,...,N-1}, a. Pre-calculating a table corresponding to said single variable function f, ○Let D be the domain D, and let R be the N selected subintervals whose union makes up D. ０ , ..., R Ｎ－１ To decompose into For each index i in S={0,...,N-1}, the subinterval R ｉ determining the representative x(i) of Step 3: Returning a table T consisting of N elements T[0], ..., T[N-1], where T[i] = y(i), for 0≦i≦N-1. b. A step of homomorphic evaluation of tables, ○x∈R ｉ If , the index in the set S = {0, ..., N-1} [0012] An integer with expected value [0013] For the ciphertext E(encode(x)), [0014] Converting it into ○Ciphertext [Equation 15] Based on Table T, the expected value is [0016] An element with [Equation 17] For the ciphertext [Equation 18] To obtain ○ [Equation 19] The step is to return 11. The cryptographic method according to claim 1, wherein:

12. The domain of definition of the function f to be evaluated is the real interval D = [x ｍｉｎ , x ｍａｘ ) and N intervals R covering the region D ｉ (for 0≦i≦N-1) is a half-open subinterval [Equation 20] 12. The cryptographic method according to claim 11, wherein D is divided in a regular manner.

13. A set S is an additive group for integers M≧N [0000] 12. The cryptographic method of claim 11, wherein the sigma is a subset of sigma.

14. group [Equation 22] is expressed multiplicatively as the power of a primitive root of the unit represented by X to the Mth power, [Equation 23] Element i of element X ｉ are related to all the M-th roots of unity {1, X, ..., X Ｍ－１ } is (X Ｍ About multiplication modulo -1 [0000] 14. The cryptographic method of claim 13, wherein the group is homomorphic to

15. The homomorphic encryption algorithm E is a torus [Equation 25] is given by the LWE type encryption algorithm applied to [Equation 26] 15. The cryptographic method according to any one of claims 11 to 14, characterized in that it comprises:

16. parameterized by integers M≧N, The encoding function encode is a subinterval of the torus [0000] and has its image contained in The discretization function discretize applies the element t of the torus to the rounded integer of the product M×t modulo M, where M×t is [0000] It is calculated in mathematical form as: [0000] 16. The cryptographic method according to claim 15, wherein:

17. The domain of the definition of the function f is the real number interval D = [x ｍｉｎ , x ｍａｘ ), the encoding function encode is [Equation 30] ， [Equation 31] 17. The encryption method according to claim 16, wherein

18. Homomorphic encryption algorithm E Ｈ is the LWE type encryption algorithm, and the encoding function encode Ｈ 16. The cryptographic method of claim 15, wherein is an identity function.

19. A homomorphic encryption algorithm E is parameterized by an even integer M. Ｈ is an RLWE type encryption algorithm, and the encoding function encode Ｈ but, [Equation 32] For any polynomial p in function [Equation 33] ， [Equation 34] 16. The cryptographic method according to claim 15, wherein:

20. LWE-type ciphertext on a torus, parameterized by an even number M equal to 2N [Equation 35] but, [Equation 36] of [Equation 37] T'[j]=encode'(T[j]), 0≦j≦N-1, [Number 38] 20. The cryptographic method according to claim 18 or 19, wherein the RLWE ciphertext is extracted from a RLWE ciphertext that approximates

21. The image of the at least one function f is in the real interval I=[y ｍｉｎ , y ｍａｘ ) when - The homomorphic encryption algorithm E' is a torus [Number 39] is given by the LWE type encryption algorithm applied to [Equation 40] and - The encoding function encode' [Equation 41] 15. The cryptographic method according to claim 11, wherein:

22. 22. The encryption method according to claim 1, wherein the input encrypted data is derived from a previous re-encryption step so as to be set in the form of a ciphertext for encryption of the homomorphic encryption algorithm E.

23. An information processing system, characterized in that it is programmed to implement the homomorphic evaluation encryption method according to any one of claims 1 to 22.

24. A computer program intended to be loaded and implemented in an information processing system according to claim 23.

25. A cloud computing-based remote service implementing the cryptographic method of any one or more of claims 1 to 22, wherein the task is shared between the data owner and one or more third parties acting as digital processing service providers.

26. Data x １ , ..., x ｐ and one or more third parties responsible for applying digital processing to said data, a. A relevant third party carries out a first step of pre-calculating a network of single-variable functions and a second pre-selection step according to claim 1; - b. Data x held by the data holder １ , ..., x ｐ Starting from the type data E(μ １ ), ..., E(μ ｐ ) is calculated, E is the homomorphic encryption algorithm, and μ ｉ is the x encoded by the encoding function ｉ is the value of - c. The third party concerned has encrypted the type data E(μ ｉ ), an interested third party can then apply f to those inputs (for 1≦j≦q) under the encryption algorithm. ｊ homomorphically evaluating each of said networks of univariate functions based on these ciphertexts in a series of successive steps to obtain ciphertexts for encryption of - d. The different functions f considered ｊ , and obtains the encrypted results of the encryption on those input values, the third party involved sends all these results back to the data owner, e. The owner of the data may, after decryption, apply one or more functions (f １ , ..., f ｑ ) to get the resulting value 26. The remote service of claim 25.

27. In the second step shown in (b) of claim 26, the owner of the data encrypts x by a homomorphic encryption algorithm E. １ , ..., x ｐ , and the encryption of the type data E(μ １ ), ..., E(μ ｐ ) to a third party, and μ ｉ is the x encoded by the encoding function ｉ 27. The remote service of claim 26, wherein the value of

28. In the second step shown in (b) of claim 26, - The owner of the data encrypts x using a different encryption algorithm from E. １ , ..., x ｐ and transmitting said data thus encrypted, The received encrypted data is re-encrypted by a related third party under the homomorphic encryption algorithm E to generate ciphertext E(μ １ ), ..., E(μ ｐ ) and μ ｉ is the encoded x by the encoding function ｉ 27. The remote service of claim 26, wherein the value of

29. A remote service according to any one of claims 25 to 28, intended for digital processing implementing a neural network.

Images