Homomorphic operation / decoding system, decoding device, decoding method and program

Abstract

To detect an overflow which is generated by a homomorphic calculation, and to cope with the overflow.SOLUTION: In a homomorphic calculation / decryption system including a homomorphic calculation processor for performing homomorphic calculation processing with respect to N-pieces of plain sentences in which N-pieces of the respective plane sentences are encrypted by homomorphic cyphers, and a decryption device for decrypting a result of the homomorphic calculation processing, the decryption device has: a decryption circuit which is constituted so as to decrypt the result of the homomorphic calculation processing by enlarging a space for outputting a decryption result of the result of the homomorphic calculation processing more than a space of the plain sentences; an overflow detection unit which is constituted so as to detect an overflow with respect to the decryption result; and a substitution unit which is constituted so as to substitute the decryption result with a value of the space of the plain sentences when the overflow is detected by the overflow detection unit.SELECTED DRAWING: Figure 7

Description

[Technical Field]

[0001] The present invention relates to a homomorphic operation and decoding system, a decoding device, a decoding method, and a program. [Background technology]

[0002] In web conferences where multiple people are expected to connect simultaneously, the devices of each user participating in the conference do not communicate directly with each other, but instead use an intermediate server to mediate communication. The intermediate server shares keys between users (devices) and processes data sent from each device.

[0003] End-to-end encryption (E2EE) is a technology that prevents unauthorized decryption of data by third parties other than the users participating in a web conference by ensuring that only the users who use the encryption have the key. In a web conference system, end-to-end encryption not only encrypts the data during transmission but also keeps the contents of the communication confidential from intermediate servers, allowing only devices with the key to decrypt the data.

[0004] On the other hand, homomorphic encryption is an encryption method in which the ciphertext is homomorphic. Homomorphic encryption is an encryption method that allows addition and multiplication to be performed on the encrypted state. Encryption that is additively homomorphic is called additive homomorphic encryption, encryption that is multiplicatively homomorphic is called multiplicative homomorphic encryption, and encryption that has both additive and multiplicative homomorphism is called fully homomorphic encryption. It consists of four algorithms: key generation, encryption, decryption, and homomorphic operation. Key generation: Takes security parameters as input and outputs a private key sk. Also, takes the private key sk as input and outputs a public key pk. Encryption: Encrypt input m using public key pk and output ciphertext c. Decryption: Takes secret key sk and ciphertext c as input and outputs m. Homomorphic operation: Takes ciphertexts c1 and c2 of different plaintexts m1 and m2 as input, and outputs cmixed←c1+c2. [Prior art documents] [Non-patent literature]

[0005] [Non-Patent Document 1] Mana Ueno, Shigeo Mitsunari, Tetsutaro Kobayashi, Keizo Murakami, "Implementation of Scalable and E2EE Speech Overlay Using Homomorphic Encryption", 1E3-1, CSS2021 Summary of the Invention [Problem to be solved by the invention]

[0006] The inventors of this application have investigated the realization of an E2EE voice communication system using homomorphic encryption to enable processing at the intermediate server without the intermediate server decrypting the ciphertext. In this case, the intermediate server performs homomorphic computation. In many cases, the ciphertext space is larger than the plaintext space, so the result of a homomorphic computation does not overflow in the ciphertext space. However, as shown in Figure 1, there are cases where the decrypted result of a homomorphic computation does not fit into the plaintext space. Since the presence or absence of an overflow cannot be determined from the encrypted state, if decryption is performed without decryption, the decryption of the overflowed value will fail. For example, in voice overlapping, the overflow location becomes noise. Therefore, it is necessary to be able to detect and deal with overflows caused by homomorphic computation.

[0007] The present invention has been made in view of the above points, and has an object to make it possible to detect and deal with overflows that occur due to homomorphic operations. [Means for solving the problem]

[0008] In order to solve the above problem, in a homomorphic computation / decryption system including a homomorphic computation processing device that performs homomorphic computation on N ciphertexts, each of which is obtained by encrypting N plaintexts using homomorphic encryption, and a decryption device that decrypts a result of the homomorphic computation, the decryption device has: a decryption circuit unit that is configured to decrypt the result of the homomorphic computation by making a space for outputting the decrypted result larger than the space of the plaintext; an overflow detection unit that is configured to detect overflow in the decryption result; and a substitution unit that is configured to replace the decryption result with a value in the space of the plaintext when overflow is detected by the overflow detection unit. [Effects of the Invention]

[0009] It is possible to deal with a decoding failure due to an overflow. [Brief explanation of the drawings]

[0010] [Figure 1] FIG. 10 is a diagram for explaining an overflow caused by a homomorphic operation. [Figure 2] 1 is a diagram illustrating an example of the configuration of a web conference system according to a first embodiment. [Figure 3] FIG. 2 is a diagram illustrating an example of a hardware configuration of a user terminal 10 according to the first embodiment. [Figure 4] FIG. 2 is a diagram illustrating an example of a functional configuration of a user terminal 10 according to the first embodiment. [Figure 5] FIG. 2 is a diagram illustrating a first example of the functional configuration of the intermediate server 20 according to the first embodiment. [Figure 6] FIG. 10 is a diagram illustrating a second example of the functional configuration of the intermediate server 20 according to the first embodiment. [Figure 7] FIG. 2 is a diagram illustrating a decoding unit 13 of a user terminal 10 according to the first embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Fig. 2 is a diagram showing an example of the configuration of a web conference system in a first embodiment. In Fig. 2, N user terminals 10, user terminal 10-1 to user terminal 10-N, are connected to an intermediate server 20 via a network such as the Internet.

[0012] The user terminal 10 is a terminal such as a PC (Personal Computer) used by a participant of a web conference.

[0013] The intermediate server 20 is one or more computers that mediate (relay) communications between the user terminals 10.

[0014] In the web conference system of the first embodiment, end-to-end encryption (E2EE) is performed on the voice data. Therefore, the voice data exchanged in the web conference is encrypted or decrypted at each user terminal 10, and the intermediate server 20 cannot access the plaintext of the voice data.

[0015] Fig. 3 is a diagram showing an example of the hardware configuration of a user terminal 10 in the first embodiment. The user terminal 10 in Fig. 3 includes a drive device 100, an auxiliary storage device 102, a memory device 103, a processor 104, and an interface device 105, which are all interconnected via a bus B.

[0016] A program that realizes processing on the user terminal 10 is provided by a recording medium 101 such as a CD-ROM. When the recording medium 101 storing the program is inserted into the drive device 100, the program is installed from the recording medium 101 to the auxiliary storage device 102 via the drive device 100. However, the program does not necessarily have to be installed from the recording medium 101; it may be downloaded from another computer via a network. The auxiliary storage device 102 stores the installed program as well as necessary files, data, etc. However, the program that realizes processing on the user terminal 10 may also be downloaded by a browser. In this case, the program does not have to be installed on the user terminal 10.

[0017] When an instruction to start a program is received, the memory device 103 reads and stores the program from the auxiliary storage device 102. The processor 104 is a CPU or a GPU (Graphics Processing Unit), or a CPU and a GPU, and executes functions related to the user terminal 10 in accordance with the program stored in the memory device 103. The interface device 105 is used as an interface for connecting to a network.

[0018] Fig. 4 is a diagram illustrating an example of the functional configuration of the user terminal 10 in the first embodiment. In Fig. 4, the user terminal 10 has an encryption unit 11, a communication unit 12, and a decryption unit 13. Each of these units is realized by a process executed by a processor 104 of one or more programs installed in the user terminal 10. Alternatively, each of these units may be realized using a dedicated circuit.

[0019] The encryption unit 11 encrypts input mn, which is plaintext audio data, using an encryption key, and outputs ciphertext E(mn) (mn=m1 to mN). In this embodiment, the plaintext audio data is in uncompressed WAV file format. Audio data in WAV file format consists of a header and data blocks. Each data block is described as a signed integer with a data length of 16 bits. In other words, the input plaintext is an integer value in the range of -2^15<=m<2^15. Audio overlapping in WAV file format can be performed by simple addition of each audio data block. In other words, the property required for an encryption method to perform simple overlapping of encrypted audio data is additive homomorphism.

[0020] Multiplication is necessary when processing such as audio adjustment is involved. For example, if a user wants to double the overall audio, one possible use would be to send an additional file with the value 2 encrypted in addition to the audio data, and then perform the multiplication.

[0021] Therefore, the encryption unit 11 encrypts the input m using additive homomorphic encryption or fully homomorphic encryption.

[0022] The communication unit 12 transmits the ciphertext E(mn) to the intermediate server 20, and also receives E(mMix) from the intermediate server 20, which is the result of the overlapping process of the ciphertext E(mn) from each user terminal 10 and is transmitted from the intermediate server 20.

[0023] The decryption unit 13 decrypts E(mMix) and outputs mFix. mFix is the same value as mMix if the decryption result of mMix is a value within the range of the space of the input plaintext (mn), and if not, it is the minimum or maximum value of the range.

[0024] Figure 5 is a diagram illustrating a first example of the functional configuration of the intermediate server 20 in the first embodiment. In Figure 5, the intermediate server 20 has a communication unit 21 and a processing unit 22. These units are realized by processing that is executed by a processor of the intermediate server 20 by one or more programs installed in the intermediate server 20.

[0025] The communication unit 21 receives a plurality of encrypted inputs E(m1) to E(mN) transmitted from each user terminal 10, and inputs E(m1) to E(mN) to the processing unit 22. The communication unit 21 also transmits E(mMix) output from the processing unit 22 to each user terminal 10.

[0026] The processing unit 22 performs a superimposing process on a plurality of encrypted inputs E(m1) to E(mN) input from the communication unit 21 while keeping them encrypted, and outputs E(mMix).

[0027] Although the above description has been given of an example in which the processing unit 22 has one output, the processing unit 22 may have multiple outputs as shown in FIG.

[0028] Figure 6 is a diagram illustrating a second example of the functional configuration of the intermediate server 20 in the first embodiment. In Figure 6, parts that are the same as or correspond to those in Figure 5 are given the same reference numerals. In Figure 6, only the differences from Figure 5 will be explained.

[0029] 6, the processing unit 22 performs homomorphic arithmetic processing on a plurality of encrypted inputs E(m1) to E(mN) received from the communication unit 21 while keeping them encrypted, and outputs E(mMix1) to E(mMixN'). As an example, overlapping processing is performed as the homomorphic arithmetic processing. Note that the values of N and N' are independent values.

[0030] In this case, the communication unit 21 may transmit the same E(mMix1) to E(mMixN') to each of the user terminals 10, or may transmit different signals to different user terminals 10.

[0031] 7 is a diagram illustrating the decoding unit 13 of the user terminal 10 in the first embodiment. In FIG. 7, the decoding unit 13 includes a decoding circuit unit 131, an overflow detection unit 132, and a mixing unit 133.

[0032] The decryption circuit unit 131 decrypts the input E(mMix) using an encryption key, and outputs the decryption result mMix.

[0033] Encryption encrypts an integer m with a number of bits (16 bits for audio data) depending on the data to be encrypted. In general encryption methods, the plaintext cannot be known in the encrypted state. Therefore, even if the plaintext resulting from a homomorphic operation between ciphertexts overflows, it cannot be detected unless it is decrypted. The ciphertext space (range of ciphertext) is much larger than the plaintext space (range of plaintext), so overflow in the ciphertext space does not need to be considered.

[0034] In this embodiment, in order to correctly decode values that "exceed" the input plaintext space, the output space (range of output values) of the decryption circuit unit 131 is set larger than the input plaintext space according to the number N of connected users. For example, if the input plaintext is a 16-bit signed integer, a maximum of 17 bits is required to represent all the simple addition results of two pieces of data (for two people), and a maximum of 25 bits is required to represent all the simple addition results of 1024 pieces of data (for 1024 people). In other words, 16+(N-1) bits are required to represent all the simple addition results of N people's voice data. During decryption, the output space of the decryption circuit unit 131 is set to a space that can represent a range 2^(N-1) times the input plaintext space as the decryption result.

[0035] Furthermore, when multiplication is used as the homomorphic operation, the decryption circuit unit 131 makes the output space of the decryption results N' times larger than the input plaintext space, where N' is the number of homomorphic multiplications performed in the encrypted state.

[0036] Note that a space X times the plaintext space is a space whose minimum value is X times the minimum value of the plaintext space and whose maximum value is X times the maximum value of the plaintext space. In other words, this space is a space that can express a range from X times the minimum value of the plaintext space to X times the maximum value of the plaintext space.

[0037] To achieve the above, the decryption circuit unit 131 performs decryption by making the output space of the decryption result larger than the input plaintext space.

[0038] As an example, we will explain in more detail the case where encryption of audio data (16-bit signed integers) is performed using the elliptic Lifted ElGamal encryption method. Decryption of the elliptic Lifted ElGamal encryption method consists of two steps: (1) converting the ciphertext C to a point M obtained by transferring the plaintext onto the elliptic curve, and (2) converting the point M on the elliptic curve to the plaintext m. The step (2) is called the discrete logarithm problem, and a dedicated table (hash table) is used to solve it. In conventional methods, the input plaintext is 16 bits, and when no processing such as addition is performed, the hash table is secured to a size corresponding to the 16-bit input. The decryption circuit unit 131 adjusts the size of this hash table to correspond to a size larger than the size of the input plaintext space, enabling decryption even with overflow values, and enabling detection and handling.

[0039] To explain this in a simple example, if the plaintext space is {0,1} and one addition is performed in the encrypted state, the output pattern will be {0,1,2}. Therefore, by having a hash table corresponding to the elliptic points and plaintext for these three patterns, the output space of the decryption circuit unit 131 can be made larger than the input plaintext space. In the Elliptic Lifted ElGamal encryption, the conversion in (2) can be performed even if the hash table does not cover the entire output space. However, since the conversion processing speed decreases when the output value is a value not present in the hash table, it is desirable to have a hash table that can cover the entire output space. In conventional encryption, the plaintext space is very large, making it difficult to have a hash table for the entire output space. However, this is possible because the input variation of uncompressed voice data is only 2^16, and even if the output space when 1,000 people are connected is maximized, the variation is only about 2^25.

[0040] The overflow detection unit 132 detects overflow by comparing the decryption result mMix, which is the output of the decryption circuit unit 131, with the maximum and minimum values of the plaintext space. The overflow detection unit 132 sets a positive overflow flag if the output result of the decryption circuit unit 131 exceeds the maximum value. The overflow detection unit 132 also sets a negative overflow flag if the output result of the decryption circuit unit 131 is below the minimum value.

[0041] The mixing unit 133 arranges the output (decoded result) from the decryption circuit unit 131 into the input format. Specifically, if a positive overflow flag is set, the mixing unit 133 replaces the decrypted result with the maximum value of the plaintext (32767 in the case of a 16-bit signed integer type) and outputs the result. If a negative overflow flag is set, the mixing unit 133 replaces the decrypted result with the minimum value of the plaintext (-32768 in the case of a 16-bit signed integer type) and outputs the result. If the overflow flag is not set, the mixing unit 133 outputs the value as is.

[0042] As described above, according to the first embodiment, it is possible to detect and deal with overflows that occur due to homomorphic computation. As a result, it is possible to correctly decode the results of homomorphic computation at high speed. Furthermore, by detecting overflows using signed values rather than absolute values, it is possible to accurately replace the values with maximum or minimum values, thereby reducing noise in the output.

[0043] Next, a second embodiment will be described. In the second embodiment, differences from the first embodiment will be mainly described. Points not specifically mentioned in the second embodiment may be the same as those in the first embodiment.

[0044] In the second embodiment, an example will be described in which the plaintext m is image or video data (hereinafter simply referred to as "image data") of a whiteboard in a web conference system.

[0045] The plaintext image data is assumed to be uncompressed. Furthermore, one frame is composed of pixels arranged vertically and horizontally, and each pixel is represented by a binary value. Here, the binary values are white or black, which are 0 and 1, respectively. One pixel of the input plaintext is represented by one bit. Binary image overlay can be achieved by adding each pixel. Furthermore, binary moving image or video overlay and whiteboard can be achieved by adding the values of each pixel for each frame. In other words, the property required for the encryption method to overlay encrypted binary values is additive homomorphism. Therefore, the encryption unit 11 uses additive homomorphic encryption or fully homomorphic encryption.

[0046] A 1-bit integer m is encrypted by the encryption unit 11. In a general encryption method, the plaintext cannot be known in the encrypted state. Therefore, even if the plaintext resulting from a homomorphic operation between ciphertexts overflows, it cannot be detected unless the ciphertext is decrypted. Since the ciphertext space is much larger than the plaintext space, overflow in the ciphertext space does not need to be considered.

[0047] In this embodiment, in order to correctly decrypt values that "exceed" the input plaintext space, the output space of the decryption circuit unit 131 is set larger than the input plaintext space in accordance with the number of connected users.

[0048] When the input plaintext is a 1-bit unsigned integer, the possible values for the simple addition result of two pieces of data are {0, 1, 2}. The maximum value for the simple addition result of image data of N people is 2N. When decrypting, the output space of the decryption circuit unit 131 is set to a range of values N times the input plaintext space. Furthermore, when multiplication is used as the homomorphic operation, the output space of the decryption result is set to be N' times larger than the input plaintext space. Here, N' is the number of homomorphic multiplications performed in the encrypted state.

[0049] The overflow detection unit 132 compares the output (decryption result) of the decryption circuit unit 131 with the maximum value in the plaintext space. If the decryption result exceeds the maximum value, the overflow detection unit 132 sets an overflow flag. Note that in the second embodiment, since only positive integers are added or multiplied, comparison with the minimum value is not necessary.

[0050] If the overflow flag is set, the mixing unit 133 replaces the decryption result with the maximum value of the plaintext (1 for 1-bit input) and outputs it. If the overflow flag is not set, the mixing unit 133 outputs the decryption result as is.

[0051] As described above, according to the second embodiment, it is possible to obtain the same effects as in the first embodiment with respect to binary image data.

[0052] Next, a third embodiment will be described. In the third embodiment, differences from the second embodiment will be mainly described. Points not specifically mentioned in the third embodiment may be the same as those in the second embodiment.

[0053] In the third embodiment, the plaintext image data (whiteboard image or video data) is assumed to be uncompressed. One frame is composed of pixels arranged vertically and horizontally, and each pixel is represented by a value {0, 1, 2, ..., (N-1)}. 0 is white, N-1 is black, and the values in between are gray values that become linearly darker in proportion to the value.

[0054] Hereafter, assuming that 8 bits are used to represent each pixel, white is represented by 0, black by 255, and gray, which is an intermediate color, is represented by 254 shades. In other words, the space of input plaintext is assumed to be {0, 1, 2, ..., 255}. An image represented in this way using white, black, and gray, which is an intermediate color, is called a "grayscale image."

[0055] Overlaying grayscale image data can be achieved by adding the values of each pixel in each frame. That is, the encryption method must have additive homomorphism to perform overlaying of encrypted grayscale images. Therefore, the encryption unit 11 uses additive homomorphic encryption or fully homomorphic encryption.

[0056] Encryption encrypts an 8-bit unsigned integer value m. In general encryption methods, the plaintext cannot be known in the encrypted state. Therefore, even if the plaintext resulting from a homomorphic operation between ciphertexts overflows, it cannot be detected unless decryption is performed. Since the ciphertext space is much larger than the plaintext space, overflow in the ciphertext space does not need to be considered.

[0057] In this embodiment, in order to correctly decrypt values that "exceed" the input plaintext space, the output space of the decryption circuit unit 131 is set larger than the input plaintext space in accordance with the number of connected users.

[0058] When the input plaintext is an 8-bit unsigned integer, the possible values for the simple addition result of two data are {0, 1, 2, 3, ..., 510}. The maximum value for the simple addition result of Nu grayscale image data is 2Nu. When decrypting, the decryption result is Nu times the input message space, which is the output space of the decryption circuit unit 131. Furthermore, when multiplication is used as the homomorphic operation, the output space of the decryption result is N' times larger than the input space. Here, N' is the number of homomorphic multiplications performed in the encrypted state.

[0059] The overflow detection unit 132 compares the output (decryption result) of the decryption circuit unit 131 with the maximum value of the plaintext space, and sets an overflow flag if the decryption result exceeds the maximum value.

[0060] If the overflow flag is set, the mixing unit 133 replaces the decryption result with the maximum value of the plaintext (255 for an 8-bit input) and outputs it. If the overflow flag is not set, the mixing unit 133 outputs the decryption result as is.

[0061] As described above, according to the third embodiment, it is possible to obtain the same effects as those of the first embodiment for grayscale images.

[0062] Next, a fourth embodiment will be described. In the fourth embodiment, differences from the second embodiment will be mainly described. Points not specifically mentioned in the fourth embodiment may be the same as those in the second embodiment.

[0063] In the fourth embodiment, the plaintext image data (whiteboard image or video data) is assumed to be uncompressed. Furthermore, one frame is composed of pixels arranged vertically and horizontally, and each pixel is represented by RGB. RGB is represented by an integer value between 0 and 255. For the sake of explanation, it is assumed that one pixel is represented by one byte per color, and one byte for RGB and spare, for a total of four bytes, in accordance with the bitmap format. RGB image overlay can be achieved by adding the parameters for each color at each pixel. In other words, additive homomorphism is a required property of the encryption method for overlaying encrypted RGB video. Therefore, the encryption unit 11 uses additive homomorphic encryption or fully homomorphic encryption.

[0064] Let the input plaintext be m=(m r , m g , m b , m R ) where m r , m g , m b , m R are the RGB values and reserved bits of the pixel to be encrypted, and each is expressed in 1 byte. Since these values must be added independently, the encryption unit 11 r , m g , m b , m R The processing unit 22 performs encryption independently for m r , m g , m b , m R Addition is performed independently on each ciphertext. In general encryption methods, the plaintext cannot be known in the encrypted state. Therefore, even if the plaintext resulting from a homomorphic operation between ciphertexts overflows, it cannot be detected unless the ciphertext is decrypted. Since the ciphertext space is much larger than the plaintext space, overflow in the ciphertext space does not need to be considered.

[0065] In this embodiment, in order to correctly decrypt values that "exceed" the input plaintext space, the output space of the decryption circuit unit 131 is set larger than the input plaintext space in accordance with the number of connected users.

[0066] The overflow detection unit 132 compares the output (decryption result) of the decryption circuit unit 131 with the maximum value of the plaintext space, and sets an overflow flag if the decryption result exceeds the maximum value.

[0067] If the overflow flag is set, the mixing unit 133 replaces the decryption result with the maximum value of the plaintext and outputs it. If the overflow flag is not set, the mixing unit 133 outputs the decryption result as is.

[0068] As described above, according to the fourth embodiment, it is possible to obtain the same effects as in the first embodiment with respect to RGB image data.

[0069] In each of the above embodiments, the user terminal 10 is an example of a decryption device, the intermediate server 20 is an example of a homomorphic processing device, and the mixing unit 133 is an example of a permutation unit.

[0070] Although the embodiments of the present invention have been described in detail above, the present invention is not limited to such specific embodiments, and various modifications and variations are possible within the scope of the gist of the present invention as described in the claims. [Explanation of symbols]

[0071] 10 User terminal 11 Encryption section 12 Communications Department 13 Decoding section 20 Intermediate Server 21 Communications Department 22 Processing section 100 Drive device 101 Recording media 102 Auxiliary storage device 103 Memory Device 104 processors 105 Interface Device 131 Decoding circuit section 132 Overflow detection unit 133 Mixing Section B Bus

Claims

1. A homomorphic computation and decryption system including: a homomorphic computation processing device that performs homomorphic computation on N ciphertexts, each of which is obtained by encrypting N plaintexts using homomorphic encryption; and a decryption device that decrypts a result of the homomorphic computation, The decoding device a decryption circuit unit configured to decrypt the result of the homomorphic arithmetic processing by making a space for outputting the decrypted result of the homomorphic arithmetic processing larger than the space for the plaintext; an overflow detection unit configured to detect an overflow in the decoding result; a substitution unit configured to substitute the decryption result with a value of the plaintext space when an overflow is detected by the overflow detection unit; A homomorphic operation and decoding system comprising:

2. the decryption circuitry is configured to decrypt the result of the homomorphic arithmetic operation using a hash table corresponding to a space larger than the space of the plaintext; 2. The homomorphic operation and decoding system according to claim 1.

3. the substitution unit is configured to replace the result of the decryption by a minimum or maximum value of the space of the plaintext.

3. The homomorphic operation and decoding system according to claim 1 or 2.

4. The space larger than the plaintext space is a space having a size corresponding to N.

4. The homomorphic operation and decoding system according to claim 1, wherein the homomorphic operation and decoding system comprises:

5. The plaintext is audio data, image data, video data, or a whiteboard.

5. The homomorphic operation and decoding system according to claim 1, wherein the homomorphic operation and decoding system comprises:

6. a decryption circuit unit configured to decrypt the results of the homomorphic arithmetic processing by setting a space for outputting decryption results of the homomorphic arithmetic processing results for N ciphertexts, each of which is obtained by encrypting N plaintexts using homomorphic encryption, to be larger than the space for the plaintexts; and an overflow detection unit configured to detect an overflow in the decoding result; a substitution unit configured to substitute the decryption result with a value of the plaintext space when an overflow is detected by the overflow detection unit; A decoding device comprising:

7. a decryption step of decrypting the results of the homomorphic arithmetic processing for N ciphertexts, each of which is obtained by encrypting N plaintexts using homomorphic encryption, by setting a space for outputting the decryption results to be larger than the space for the plaintexts; and an overflow detection step of detecting an overflow in the decoding result; a substitution step of replacing the decryption result with a value in the space of the plaintext when an overflow is detected in the overflow detection step; A decryption method characterized by being executed by a computer.

8. a decryption step of decrypting the results of the homomorphic arithmetic processing for N ciphertexts, each of which is obtained by encrypting N plaintexts using homomorphic encryption, by setting a space for outputting the decryption results to be larger than the space for the plaintexts; and an overflow detection step of detecting an overflow in the decoding result; a substitution step of replacing the decryption result with a value in the space of the plaintext when an overflow is detected in the overflow detection step; A program characterized by causing a computer to execute the above.

Images