Homomorphic encryption methods applied to private information retrieval

Abstract

To provide a homomorphic encryption method applied to private information retrieval.SOLUTION: In a method for encrypted communication, a client sends a public key (pk) to a server, and the server receives the public key. The client encrypts data using a key of an (F)HE encryption scheme 70, including in particular the use of a gadget matrix or a variant thereof. The client sends the encrypted data to the server, and the server receives the encrypted data. The server stores the data in a database 28 as cipher texts. Further in the method, the client generates an encrypted request and a query for information stored at the server, where the request and query are encrypted via the (F)HE scheme. The query is realized as a circuit. The client sends the request and query to the server, and the server receives the request and query.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] The present invention relates generally to homomorphic encryption (HE), and more particularly to compressible homomorphic encryption and fully homomorphic encryption (FHE) applied to private information retrieval (PIR). [Background technology]

[0002] Homomorphic encryption is a form of encryption that allows computations on ciphertext (encrypted plaintext) that, when decrypted, produce an encrypted result that matches the results of operations as if the operations were performed on the plaintext. Those operations are typically considered to be defined by a circuit. While various types of HE exist, only fully homomorphic encryption (FHE) allows the evaluation of arbitrary circuits of unlimited depth.

[0003] FHE (and to some extent other types of HE) allows service providers to perform operations on encrypted data and determine encrypted results for user queries without being able to decrypt the results or the stored information used to derive the results. This has a wide range of applications, particularly in domains where anonymity is important, such as healthcare.

[0004] Thus, one application of FHE is private information retrieval (PIR). PIR allows a user to retrieve items of the user's personal information from a server holding a database (e.g., containing health care information) without revealing which items are being retrieved. One (e.g., obvious) way to implement PIR is for the server to send a copy of the entire database to the user. This method uses modern communication systems and requires a huge amount of data for a reasonably sized database.

[0005] FHE is useful for PIR because the user's query is encrypted and the service provider does not know the contents of the results or which items were retrieved. However, current FHE techniques are computationally expensive and impractical for databases of any reasonable size. Summary of the Invention

[0006] In one example embodiment, a method is disclosed that includes receiving, at a first computer system, from a second computer system a request for specific information determined using data in a database on the first computer system, where the first computer system does not have a decryption key for decrypting the encrypted data or the encrypted request, and where at least a portion of the data is encrypted or the request is encrypted. The method also includes performing, by the first computer system, compressible homomorphic encryption operations on the data in the database to determine one or more compressed ciphertexts corresponding to the specific information in the database, where the compressible homomorphic encryption operations use a first uncompressed homomorphic encryption scheme and a second compressed homomorphic encryption scheme.

[0007] Performing a compressible homomorphic encryption operation includes using a first homomorphic encryption scheme on the data to create a plurality of other ciphertexts and using a second homomorphic encryption scheme on the other plurality of ciphertexts to compress the other plurality of ciphertexts into fewer compressed ciphertexts, where the first and second homomorphic encryption schemes both use the same secret key. The method further includes transmitting, by the first computer system to the second computer system, a response to the request, the response including one or more compressed ciphertexts corresponding to the particular information requested.

[0008] An exemplary apparatus includes one or more processors and one or more memories containing computer program code, the one or more memories and the computer program code, together with the one or more processors, causing the apparatus to: receive, at a first computer system, from a second computer system, a request for specific information determined using data in a database on the first computer system, where the first computer system does not have a decryption key for decrypting the encrypted data or the encrypted request, and where at least a portion of the data is encrypted or the request is encrypted; and perform, by the first computer system, a compressible homomorphic encryption operation on the data in the database to determine one or more compressed ciphertexts corresponding to the specific information in the database. and determining, by the first computer system to transmit a response to the request to the second computer system, the response including one or more compressed ciphertexts corresponding to the particular information requested.

[0009] Yet another example embodiment is a computer program product comprising a computer-readable storage medium having program instructions embodied thereon, the program instructions including: receiving, at a first computer system, a request from a second computer system for specific information determined using data in a database on the first computer system, where the first computer system does not have a decryption key for decrypting the encrypted data or the encrypted request, and where at least a portion of the data is encrypted or the request is encrypted; and performing, by the first computer system, a compressible homomorphic encryption operation on the data in the database to generate one or more compressed encrypted data corresponding to the specific information in the database. determining a plurality of compressed ciphertexts, wherein the compressible homomorphic encryption operation uses a first non-compressible homomorphic encryption scheme and a second compressible homomorphic encryption scheme, and performing the compressible homomorphic encryption operation includes using the first homomorphic encryption scheme on the data to create a plurality of other ciphertexts and using a second homomorphic encryption scheme on the other plurality of ciphertexts to compress the other plurality of ciphertexts into compressed fewer ciphertexts, wherein the first and second homomorphic encryption schemes both use the same secret key; and transmitting, by the first computer system to the second computer system, a response to the request, the response including one or more compressed ciphertexts corresponding to the particular information requested.

[0010] In another example embodiment, a method includes encrypting plaintext to create encrypted data, executed at a second computer system, for transmission to a first computer system; and transmitting the encrypted data from the second computer system to the first computer system, where the first system does not have a decryption key for decrypting the encrypted data. The method also includes transmitting, by the second computer system, a request for specific information determined using the encrypted data. The method includes receiving, at the second computer system, a response to the request from the first computer system, the response including one or more compressed ciphertexts corresponding to the specific information requested. The method further includes decrypting, by the second computer system, the one or more compressed ciphertexts into corresponding plaintext.

[0011] An exemplary apparatus includes one or more processors and one or more memories containing computer program code configured, in conjunction with the one or more processors, to cause the apparatus to perform operations including encrypting plaintext to create encrypted data, executed at a second computer system, for transmission to a first computer system, transmitting the encrypted data from the second computer system to the first computer system when the first system does not have a decryption key for decrypting the encrypted data, sending, by the second computer system, a request for specific information determined using the encrypted data, receiving, at the second computer system, a response to the request from the first computer system, the response including one or more compressed ciphertexts corresponding to the specific information requested, and decrypting, by the second computer system, the one or more compressed ciphertexts into corresponding plaintext.

[0012] In yet an additional example embodiment, a computer program product comprises a computer-readable storage medium having program instructions embodied thereon, the program instructions executable by the device to cause the device to perform operations including: encrypting plaintext to create encrypted data, which is executed at a second computer system for transmission to a first computer system; transmitting the encrypted data from the second computer system to the first computer system, where the first system does not have a decryption key for decrypting the encrypted data; sending, by the second computer system, a request for specific information determined using the encrypted data; receiving, at the second computer system, a response to the request from the first computer system, the response including one or more compressed ciphertexts corresponding to the specific information requested; and decrypting, by the second computer system, the one or more compressed ciphertexts into corresponding plaintext.

[0013] An additional example embodiment is a method that includes receiving, at a first computer system, a request for a selected entry from a database on the first computer system from a second computer system. The method includes performing, by the first computer system, a compressible homomorphic encryption scheme on data in the database to compute an encrypted answer corresponding to the selected entry in the database, where the compressible homomorphic encryption scheme generates an encrypted answer that is not significantly longer than a corresponding plaintext answer, and where computing the encrypted answer requires several cycles per byte in the database. The method also includes transmitting, by the first computer system, a response to the request to the second computer system, the response including the encrypted answer corresponding to the selected entry being requested.

[0014] An exemplary apparatus includes one or more processors and one or more memories containing computer program code that, in conjunction with the one or more processors, configures the apparatus to perform operations including receiving, at a first computer system, a request from a second computer system for a selected entry from a database on the first computer system, performing, by the first computer system, a compressible homomorphic encryption scheme on data in the database to calculate an encrypted answer corresponding to the selected entry in the database, where the compressible homomorphic encryption scheme produces an encrypted answer that is not significantly longer than a corresponding plaintext answer, and where calculation of the encrypted answer requires several cycles per byte in the database, and transmitting, by the first computer system, a response to the request to the second computer system, where the response includes the encrypted answer that corresponds to the selected entry being requested.

[0015] An additional example embodiment is a computer program product comprising a computer-readable storage medium having program instructions embodied thereon that are executable by a device to cause the device to perform operations including receiving, at a first computer system, a request from a second computer system for a selected entry from a database on the first computer system; performing, by the first computer system, a compressible homomorphic encryption scheme on data in the database to calculate an encrypted answer corresponding to the selected entry in the database, where the compressible homomorphic encryption scheme produces an encrypted answer that is not significantly longer than a corresponding plaintext answer, and where calculation of the encrypted answer requires several cycles per byte in the database; and transmitting, by the first computer system, a response to the request to the second computer system, where the response includes the encrypted answer that corresponds to the selected entry being requested.

[0016] In one example embodiment, a method is disclosed that includes encrypting an index i of an entry sent by a second computer system to a first computer system and stored in a database by the first computer system, where index i is N D The database is represented in a mixed radix of N D The method also includes a base number. The method includes requesting, by a second computer system, a search for an item from the first computer system using the encrypted index. The method includes receiving, by the second computer system, a response to the request from the first computer system, the response including an encrypted answer including one or more compressed ciphertexts that correspond to entries in the requested database using the encrypted index. The method also includes decrypting, by the second computer system, the one or more compressed ciphertexts into corresponding plaintexts.

[0017] An exemplary apparatus includes one or more processors and one or more memories containing computer program code that, together with the one or more processors, causes the apparatus to encrypt an index i of an entry sent by a second computer system to a first computer system and stored in a database by the first computer system, where index i is greater than or equal to N D It is expressed in a mixed radix of radixes, and the database is N D the encrypted index also including a cardinality; requesting, by a second computer system, a search for the item from the first computer system using the encrypted index; receiving, by the second computer system, a response to the request from the first computer system, the response including an encrypted answer including one or more compressed ciphertexts that correspond to entries in the requested database using the encrypted index; and decrypting, by the second computer system, the one or more compressed ciphertexts into corresponding plaintexts.

[0018] Yet another example embodiment is a computer program product comprising a computer-readable storage medium having program instructions embodied thereon, the program instructions causing a device to encrypt an index i of an entry sent by a second computer system to a first computer system and stored in a database by the first computer system, wherein index i is greater than or equal to N D It is expressed in a mixed radix of radixes, and the database is N Dthe encrypted index also including a cardinality; requesting, by a second computer system, a search for the item from the first computer system using the encrypted index; receiving, by the second computer system, a response to the request from the first computer system, the response including an encrypted answer including one or more compressed ciphertexts that correspond to entries in the requested database using the encrypted index; and decrypting, by the second computer system, the one or more compressed ciphertexts into corresponding plaintexts. [Brief explanation of the drawings]

[0019] [Figure 1] 1 is a flowchart of an exemplary method for encrypted communication between a user and a server using compressible (F)HE in an exemplary embodiment. [Figure 2] FIG. 2 is a block diagram of an exemplary computer system that may be used in the devices of FIG. 1. [Figure 3] FIG. 1 is a diagram of a matrix in one exemplary structure. [Figure 4A] 1 is a flowchart of an exemplary method for using compressible (F)HE applied to PIR. [Figure 4B] 10 is a continuation flow chart of an exemplary method for using compressible (F)HE as applied to PIR. DETAILED DESCRIPTION OF THE INVENTION

[0020] Abbreviations that may appear in the specification and / or drawings are defined as follows:

[0021] AES Advanced Encryption Standard

[0022] AES-CTR AES Counter Mode

[0023] CRT Chinese Remainder Theorem

[0024] ctxt ciphertext

[0025] FFT Fast Fourier Transform

[0026] HE Homomorphic Encryption

[0027] FHE Fully Homomorphic Encryption

[0028] (F)HE HE or FHE

[0029] GSW (Craig) Gentry, (Amit) Sahai, and (Brent) Waters

[0030] Learning with LWE errors

[0031] MPC Multi-Party Computation

[0032] PKE public key encryption

[0033] PIR Private Information Search

[0034] RLWE RingLWE

[0035] (R)LWE LWE or RLWE

[0036] The word "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any embodiment described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments. All embodiments described in this Detailed Description are example embodiments provided to enable those skilled in the art to make or use the invention, but not to limit the scope of the invention, which is defined by the claims.

[0037] Homomorphic encryption (HE) is often considered impractical in both communication and computation. This specification provides an additive homomorphic encryption scheme based on (e.g., ring) LWE with near-optimal ratio (1-ε for any ε>0). Furthermore, a method is described for compressing many Gentry-Sahai-Waters (GSW) ciphertexts (e.g., ciphertexts that may have been obtained from homomorphic evaluation) into (fewer) high-rate ciphertexts.

[0038] In an example embodiment, an exemplary high-rate HE scheme is used to construct a single-server private information retrieval (PIR) scheme with a ratio of (4 / 9) that has very low computational overhead. Single-server PIR essentially requires a server to perform at least one operation per bit in the database. The computation in one exemplary PIR scheme is not much worse than this inherent lower bound, and is likely less than AES encryption of the entire database (i.e., approximately 1.5 mod-q multiplications per byte of the database, where q is a number about 50-60 bits in length). Asymptotically, the computational overhead of this exemplary PIR scheme is

number

[0039] How bandwidth-efficient is (fully) homomorphic encryption ((F)HE)? While it is easy to encrypt a message with little loss in bandwidth, the same is usually not true for homomorphic encryption. Ciphertexts evaluated in current HE schemes tend to be significantly larger than the plaintexts they encrypt, by at least a significant constant factor, and often by many more.

[0040] Beyond the fundamental theoretical interest in the bandwidth limitations of FHE, homomorphic schemes with high rates have multiple applications. Perhaps the most obvious is the case of private information retrieval (PIR), where bandwidth is paramount. Clearly, PIR can be implemented using HE, but even the best PIR implementations to date (e.g., [1, 5]) are still quite far from being able to support large databases, primarily due to the large expansion factors of current HE schemes. Another application can be seen in the work of Badrinarayanan et al. [9], who showed that compressible (additive) homomorphic encryption with rates better than 1 / 2 can be used for high rates of oblivious transfer and can also be used for a variety of purposes in the context of secure computation. Prior to this work, the only example of high-rate homomorphic encryption was the Damgard-Jurik cryptosystem

[31] , which was (a) only additively homomorphic, (b) quite expensive, and (c) not quantum-safe.

[0041] This document improves on this situation by devising the first compressible fully homomorphic encryption scheme and shows how to use this scheme to obtain efficient PIR. That is, in one example embodiment, an (F)HE scheme is described in which the evaluated ciphertexts of this (F)HE scheme are publicly compressed to approximately the same size as the plaintexts that the scheme encrypts, while still being decryptable. The exemplary compressible scheme takes the final results of homomorphic evaluation (particularly under the GSW cryptosystem

[43] ) and can pack them into matrix-encrypting matrix-ciphertexts, where the ratio of the total size of the ciphertexts to the total size of the plaintexts can be 1-ε for any ε (the sum of the plaintexts is 1 / ε). 3(We assume that σ is sufficiently large proportionally to σ). The compressed ciphertexts are no longer GSW ciphertexts. However, these ciphertexts still have enough structure to allow additive homomorphism and left-hand multiplication with encryption of small scalars, all while remaining compressed (note that these operations slightly increase the "noise" of the ciphertext). As with GSW, the security of the exemplary scheme is based on the assumption of learning with errors

[71] or ring deformation

[62] (and, for example, the assumption of cycle security in the case of fully homomorphic encryption).

[0042] We note that compressible fully homomorphic encryption easily produces a high rate of end-to-end FHE. The newly encrypted ciphertext is immediately compressed during encryption, then "decompressed" using bootstrapping before processing, and finally compressed again before decryption. As a result, this scheme compresses ciphertexts at any given time; they are only temporarily expanded while they are being processed. We also note that hybrid encryption can be used, where new ciphertexts are generated using, for example, AES-CTR, and the AES key encrypted according to FHE is transmitted.

[0043] For PIR, a number of exemplary optimizations to the basic scheme are described below that yield a single-server private information retrieval scheme with low communication overhead while being computationally efficient. Asymptotically, the computational overhead is O(loglogλ + logloglogN), where λ is a security parameter and N is the number of database files, assumed to be sufficiently large.

[0044] The reasons why this exemplary PIR scheme is estimated to be not only theoretically efficient but also practically fast are explained in detail. In particular, a single-server PIR scheme with a ratio of 4 / 9 can be obtained, in which the amortized work of the server is only 1.5 single-precision modular multiplications for every byte in the database. For comparison, a trivial PIR solution that transmits the entire database would need to encrypt the entire database (for communication security) at least, thus incurring the cost of an AES block encryption for every 16 bytes of the database, which is certainly more work than the exemplary scheme here performs. Thus, contrary to Sion-Carbunar

[77] , PIR is ultimately more efficient than the trivial solution, not only in terms of communication but also in terms of computation.

[0045] Those accustomed to considering homomorphic encryption based on (R)LWE impractical may find the low computational overhead of the PIR scheme described herein hard to believe. However, RLWE-based HE (especially the GSW scheme with the exemplary adaptation described herein) certainly stands out in the PIR setting for several reasons. First, the noise in the GSW ciphertext only increases additively when the left-multiplied message is {0,1} (the receiver's GSW ciphertext encrypts the target index bits). Furthermore, clearly, even if we need to perform Ω(N) ciphertext operations for a database containing N files, we can guarantee that the noise only increases proportionally to logN (so the bit size only increases with loglogN). The small noise increase allows the exemplary PIR scheme to use a small RLWE modulus q, not much larger than the RLWE modulus q used in the basic RLWE-based PKE scheme. Third, the recursive / hierarchical nature of classical methods for single-server PIR [58, 79] can be exploited to hide the more expensive steps of RLWE-based homomorphic evaluation, namely the polynomial FFT (and, less importantly, CRT lifting). In classical hierarchical methods for PIR, the dominant computational step is the effective database size N = N1 × … × N in the example embodiment. dThe first step is a projection from q to N / N1. To maximize the efficiency of this first step, the database polynomial may be preprocessed so that it is already included in the evaluation representation, thereby avoiding the polynomial FFT and allowing each (log q)-bit block of the database to be "absorbed" into the encrypted query using a small constant mod-q multiplication. In the first step, for example, the server generates N1 ciphertexts from the client's logN1 ciphertexts, including the FFT, but their amortized cost is negligible when N1 = N. Thus, the computational overhead of the first step amounts to only the overhead of multiplying integers modulo q, where q can be quite small. Multiplication modulo q can be performed asymptotically faster by making q a product of prime numbers and using a CRT representation, and multiplication modulo the prime divisors can be further accelerated using a table lookup. After the first step of PIR, homomorphic evaluation similar to GSW requires a conversion between the polynomial coefficients and the evaluation representation, which is

number

[0046] Regarding ciphertext compression, ciphertext compression has always had an obvious requirement in the public-key setting (and sometimes in the context of symmetric keys as well, e.g.,

[57] ). Perhaps the best-known ciphertext compression technique is hybrid encryption, in which a (long) message is encrypted according to a symmetric encryption scheme, and only the symmetric decryption key is encrypted according to a public-key scheme. Other examples of ciphertext compression are using only the x-coordinates of points on an elliptic curve [11, 34], and compressing Rabin ciphertexts to (2 / 3)logn bits with security based on a factor n (assuming the message contains less than 2 / 3logn bits of entropy)

[44] .

[0047] Rivest, Adleman, and Dertouzos

[73] proposed the concept of homomorphic encryption shortly after the invention of public key cryptography [32, 72]. Gentry

[45] constructed the first plausibly secure (allowing arbitrary computations on data that remains encrypted) fully homomorphic encryption (FGE) scheme. Currently, FHE schemes exist that guarantee very good performance and security [80, 78, 42, 16, 27, 15, 18, 39, 38, 40, 61, 21, 12, 63, 14, 37, 43, 3, 4, 50, 48, 68, 74, 26, 17, 49, 33, 36, 23, 6, 81, 82, 28, 54, 46, 24, 19, 10, 22, 65, 20, 56, 29].

[0048] There has also been much research into improving the ratio of FHE and other (R)LWE-based cryptosystems. Some important examples are dimensionality reduction and modulus reduction [16, 15], which convert the ciphertext into a lower-dimensional vector with coefficients reduced by a smaller modulus, making the ciphertext smaller and potentially reducing decryption complexity (see

[75] for other work in this direction). Another important approach is "ciphertext compression" [70, 78, 15, 14], in which each ciphertext encrypts an array of plaintext elements rather than a single one. In practice, not only the ratio but also the overall FHE computational overhead can be reduced, sometimes to only a polylogarithmic function of the security parameter

[39] . Some FHE schemes can also convert the plaintext into a matrix [70, 14, 52, 35].

[0049] In the context of HE, there has also been research on hybrid encryption [45, 41, 66], where data encrypted according to AES can be homomorphically decrypted using an AES key according to HE schemes, and the data can then be manipulated while still encrypted. However, the other direction (as far as is known) is not possible. There is no way to convert HE ciphertext of the same message into AES ciphertext without using a secret key. Some previous work involved "post-evaluation" ciphertext compression techniques, such as van Dijk et al.'s work on integer-based HE

[80] and Hohenberger et al.'s work on attribute-based encryption

[47] . However, the ratios achieved in these techniques were still low, and in practice, methods prior to this work were unable to break the ½ ratio barrier (thus, for example, LWE-based methods could not be used for the high-rate OT applications of Badrinarayanan et al. [9]).

[0050] Regarding the method of van Dijk et al.

[80] , as specifically described in that paper, the method encrypts only 1 bit per ciphertext. Therefore, the ciphertext does not grow much larger than the RSA modulus. For example, if the ciphertext is 1024 bits, the ciphertext will be 1024 times longer than the plaintext. Generally, to obtain sufficiently good security, the ciphertext needs to exceed 100 bits. Therefore, any method that securely encrypts only 1 bit per ciphertext will have a ratio of less than 1 / 100.

[0051] A more detailed explanation is as follows. The method of van Dijk et al. is fine-tuned to encrypt more than 1 bit at a time, but the method for obtaining a very good ratio is not yet clear. To understand this, a little more background on van Dijk is needed. The secret key is an arbitrary large integer p, and the ciphertext that encrypts the number x modulo n (i.e., a number within {0, 1,..., n - 1}) has the form c = q1 * p + q2 * n + x, where the numbers q2 and n are selected such that the magnitude of q2 * n + x is much smaller than p. Decryption is x = (c mod p) mod n, where (c mod p) reduces the value to the range {0,..., p - 1}, and mod n reduces the result to {0,..., n - 1}. The ciphertext c is usually a larger number of bits than p, and p is usually a larger number of bits than the plaintext and is a number within {0,..., n - 1}.

[0052] The ciphertext compression technique calculates g c mod N such that the multiplicative group modulo N has order M (< N), and M is divisible by p. Basically, it takes g c and maintains the value of (c mod p) while discarding other information about p. Therefore, the problem that the initial c has a larger number of bits than p is alleviated to some extent.

[0053] However, p still needs to be many more bits than n (the plaintext space), and the number N above needs to be many more bits than p (though N does not need to be the same number of bits as the original c). The reason p needs to be many more bits than n is a problem with typical homomorphic encryption, where homomorphic operations increase the magnitude of the noise, which now becomes (c mod p). Even if a single multiplication doubles the number of bits in this magnitude, it is still smaller than p, allowing for correct decryption. This means that n has many times fewer bits than p. The number N needs to be at least four times as many bits as p; otherwise, N could be factored and break the system. The entire compressed ciphertext, a number modulo N, contains many more bits than the plaintext space modulo n. Therefore, the van Dijk scheme does not provide ratios close to the potential ratios described herein, in any case.

[0054] The only previous cryptosystem with the homomorphic property known for rates better than 1 / 2 is due to Damgard and Jurik

[31] . Damgard and Jurik described an extension of Paillier's cryptosystem

[69] that allows encryption of rates (1-o(1)) with additive homomorphism. Specifically, for an RSA modulus N and any exponent s ≥ 1, mod-N s The plaintext of mod-N s+1 can be encrypted in the ciphertext of

[0055] Regarding private information retrieval (PIR), PIR was introduced in the work of Chor et al.

[25] . In this setting, a client can retrieve the Nth bit (or file) from a database while hiding the target index i∈[N] from the server, with the overall communication being sublinear in N (this sublinear communication requirement rules out a trivial protocol in which the server sends the entire database to the client). Chor et al. provided a construction involving multiple servers, and later Kushilevitz and Ostrovsky

[58] showed that PIR is possible using a single server under computational assumptions. Kushilevitz and Ostrovsky showed that PIR is possible using a single server under computational assumptions where N=N1×…N dWe have described a recursive PIR structure for a 10-bit database. In its first step, the PIR scheme is applied to N / N1 slices of the database with N1 elements in parallel, then PIR is applied to the "new database" of N / N1 PIR responses, and so on. Stern

[79] improved this structure using other additively homomorphic encryption schemes. Kiayias et al.

[55] (see also

[60] ) provided the first single-server PIR scheme with a ratio of 1-o(1) based on Damgard-Jurik

[31] . As noted in [55, 1, 60], maximizing the ratio is crucial for modern applications of PIR, considering streaming gigabit video files from among thousands of videos, where individual files can be very large. However, Damgard-Jurik is computationally prohibitively expensive and therefore cannot be used practically for large-scale PIR [77, 67]. At a minimum, PIR using Damgard-Jurik requires a server to compute mod-N multiplications for every bit in the database, where N is 2048 or more bits. Nested decryption is also quite expensive. Papers [55, 60] explicitly propose an underlying encryption scheme to replace Damgard-Jurik to lower the computational cost of rate-optimal PIR schemes. Note that the exemplary matrix-based version of GSW allows nesting, where plaintext recursively becomes ciphertext at the next level, as in the Damgard-Jurik method for PIR. Therefore, the exemplary schemes herein can be used as a replacement to improve the efficiency of those schemes. However, we have found that avoiding nesting and using the natural homomorphism of GSW is even more efficient.

[0056] In a single-server PIR protocol, the server's computation must be at least N; otherwise, the server learns that bits it did not touch while constructing the response were irrelevant to the query (thereby violating privacy). This "problem" with PIR is so fundamental even in multi-server protocols that Boyle et al.

[13] found that "PIR hardness" is a useful way to partition multiparty computation (MPC) problems into those that can involve protocols with sublinear computation (since such protocols imply PIR with sublinear computation) and those that cannot. Given that many MPC problems are PIR-hard, minimizing the computational overhead of PIR becomes crucial. The computationally state-of-the-art PIR scheme is XPIR by Aguilar-Melchor et al. [1], which was further optimized in the work of SealPIR by Angel et al. [5]. This method features many clever optimizations, including preprocessing the database into a rating representation based on RLWE, but the ratio decreases exponentially with recursion depth (by more than a factor of 5 at each level), and too few levels results in excessive work for the client. Indeed, Angel et al. stated that even with their optimizations, "supporting large databases has not yet been achieved."

[0057] At a high level, the exemplary compressible scheme herein combines two cryptosystems: a low-rate (uncompressed) FHE scheme that is a slight variation of GSW

[43] , and a new high-rate (compressed) additive homomorphic scheme for matrices that is somewhat similar to the matrix homomorphic encryption of Hiromasa et al.

[52] . The fact that these two cryptosystems "work well together" in the sense that they share the same secret key and allow many GSW ciphertexts to be packed into a single compressed ciphertext makes the exemplary scheme herein compressible.

[0058] Low-rate schemes are similar to GSW, except that matrices are used as keys rather than vectors, as is done in

[70] . That is, an exemplary private key is a matrix of the form S = [S'|I], and the public key is a pseudorandom matrix P satisfying S × P = E(mod q), where q is the LWE modulus and E is a low-norm matrix. Just like GSW, low-rate cryptosystems encrypt small scalars (usually just bits σ∈{0,1}), the ciphertext is a matrix C, and the decryption invariant is SC = σSG + E(mod q), where G is the Micciancio-Peikert gadget matrix

[64] and E is a low-norm matrix.

[0059] The exemplary high-rate scheme herein encrypts the entire matrix modulo q in a single ciphertext matrix whose dimensions are only slightly larger than the plaintext matrix. The new technical material introduced is a different gadget matrix called II. Like the G gadget matrix in GSW, this exemplary II adds redundancy to the ciphertext, and H has a "public trapdoor" that allows noise removal during decryption. The difference is that H is an approximately square matrix, thus enabling high-rate ciphertext with little expansion. More specifically, G has dimensions n × m, where m = n log q. For example, q = 2 60 , m is 60 times larger than n. On the other hand, H typically contains only one more column than rows. It should be noted that an almost rectangular H cannot add much redundancy and therefore cannot have high-quality trapdoors. In this way, one ends up making do with low-quality trapdoors that can only remove a small amount of noise.

[0060] The slight increase in dimension from plaintext to ciphertext in the exemplary scheme is introduced in two steps. First, to obtain SM' = M,

number

[52] .) Then, by right-multiplying this matrix by the gadget matrix H, redundancy is added to M', allowing for the removal of a small amount of noise during decryption. As is known, noise increases for homomorphic operations such as addition and especially multiplication on ciphertext. The invariant for decrypting compressed ciphertext is SC = M'H + E(mod q). To obtain a high rate of compressed ciphertext, example embodiments ensure that the increase in dimensionality from plaintext to ciphertext is as small as possible. For an n0 × n0 plaintext matrix M, we need to add as many zero rows as the dimension of the LWE secret (denoted by k). Denoting n1 = n0 + k, the padded matrix M' has dimensions n1 × n0. Further redundancy is added by multiplying on the right by a somewhat rectangular gadget matrix H of dimension n0 × n2. Since the final dimensions of the ciphertext are n1 × n2, the ratio of information in the compressed ciphertext is

number

[0061] Here, the size

number

number

[0062] Instead of using a new gadget matrix H, we state that redundancy is added to the ciphertext using the decryption invariant SC=f M'+E(mod q) for a sufficiently large integer f (e.g., f>1). This variant (described below) has the same asymptotic behavior as the variant using H, and although the specific efficiency appears to be somewhat less, it is still usable.

[0063] As an additional overview, the process described below when describing compressible FHE is generally (1) encrypting data with low-rate (uncompressed) ciphertext, computing something on the encrypted data, then (2) compressing the result into high-rate (compressed) ciphertext, and finally (3) decrypting and recovering the result. Note that when describing compressed (F)HE schemes below, phrases such as "adding redundancy to the plaintext" are used, and this phrase refers to the plaintext being processed in some way, perhaps by directly encrypting the plaintext into high-rate ciphertext. While it is true that plaintext can be directly encrypted into compressed ciphertext (and how this is done is described below), the focus in the following description uses a different technique. In particular, the two equations SC = M'H + E(mod q) (described above and below as a first variant) and SC = f · M' + E(mod q) (described above as another variant) represent the decryption process. First, we multiply the ciphertext C by the secret key S to obtain either M'H+E(mod q) or f·M'+E(mod q). The term E is the noise that needs to be removed, and to do so, we can use the fact that M'H (or f·M') has some redundancy. Therefore, the following summary uses the processes (1)-(3) described above and also incorporates the decryption process just described.

[0064] The ideas so far are sufficient to obtain an asymptotically efficient scheme, and are described below. However, many more specific methods can be used to obtain practical efficiency. Specifically, example embodiments can use RLWE instead of LWE for the underlying scheme, preprocess the database to reduce FFTs, and apply modulus switching techniques to obtain better noise management, all of which are described below. However, before presenting any of these ideas, an overview of exemplary methods and systems is provided in the next part of this document, followed by additional background.

[0065] Referring to Figure 1, this figure is a flowchart of an exemplary method for encrypted communication between a client and a server using a compressible (F)HE scheme in an exemplary embodiment. This method does not include PIR, but does include the basic building blocks of PIR, which are described below. Actions performed by client 110 (e.g., under user control) are shown on the left, and actions performed by server 170 (e.g., as part of the operation of a service provider) are shown on the right.

[0066] There is a compressible (F)HE scheme 70 that includes the following steps, which are described in more detail below: KeyGen, a key generation procedure; Encrypt, which performs homomorphic encryption of plaintext; Evaluate, which performs homomorphic evaluation using a circuit on the ciphertext; Compress, which compresses the ciphertext that has been homomorphically evaluated; and Decrypt, which performs decryption of the compressed ciphertext. This scheme can be used in multiple locations in FIG. 1, as described below.

[0067] At block 10, client 110 sends a public key (pk) to server 170, and at block 20, server 170 receives the public key. At block 30, client 110 encrypts data using the (e.g., public or private) key in an (F)HE encryption scheme 70, which includes, among other things, the use of a gadget matrix or a variant thereof, as described below. At block 40, client 110 sends the encrypted data to the server (e.g., as ciphertext), and at block 50, the server receives the encrypted data. Server 170 stores this data as ciphertext in database 20. Note also that in some embodiments, database 28 may contain a mixture of plaintext and ciphertext (or only plaintext) instead of only ciphertext. With respect to the plaintext in database 28, encrypted queries may be used, as described below, and a plaintext-only database may also be used.

[0068] At some point, the client may generate, for example, encrypted requests and queries regarding information stored on the server (see block 55), and these requests and queries may be encrypted by the (F)HE method 70. The queries may be implemented as circuits. Block 55 shows client 110 sending the requests and queries (e.g., circuits) to server 170, which receives them in block 60. In principle, the circuits to be evaluated against the encrypted data may be obtained from any location. For example, one FHE scenario is for a client to encrypt financial data and send the encrypted data to an online tax preparation company (which stores the encrypted data in database 28), after which the client requests a tax liability assessment. In this case, the request simply tells the company to perform the tax assessment and need not be encrypted. The company (using server 170) applies its proprietary tax form software (e.g., as a circuit) to the encrypted financial data to obtain the tax liability assessment. In this scenario, the circuit is not obtained from the client.

[0069] Another (alternative or additional) option is that the beginning of this flow does not necessarily occur directly between client 110 and server 170. For example, it may be the case that a variety of (e.g., random) parties encrypt data according to the client's public key, and this information is eventually collected in database 28 at the server (together with the client's public key pk). Later, client 110 may generate and send to the server (block 55) a request (using circuitry) to the effect of, for example, "send me all files you encrypted according to my key that contain a certain keyword," and the server can respond to this request. In practice, this coordination occurs automatically (since all that is required is that client 110 and server 170 agree on the key to be used).

[0070] At block 65, server 170 performs a computation (e.g., defined in part by a circuit) on the ciphertext stored in database 28. At this point, server 170 has generated the answer to the query as ciphertext. In a standard (F)HE scenario, the resulting ciphertext can be quite large. However, here, the (F)HE encryption method 70 is used to compress the ciphertext, thereby significantly reducing the size of the ciphertext. Thus, block 65 includes the server compressing the ciphertext to create a compressed ciphertext.

[0071] At block 70, server 170 forms a message containing compressed ciphertext corresponding to the request and query. The server also sends a message (or messages) containing compressed ciphertext of the answer to the query. At block 80, client 110 receives the message with compressed ciphertext 70 and, at block 90, decrypts the compressed ciphertext 70, for example, using (F)HE encryption scheme 70, to obtain plaintext. Client 110 may perform one or more operations using the plaintext, as is well known.

[0072] Although the computer systems involved in the schemes herein are referred to as clients 110 and servers 170, there need not be a client / server relationship between these computer systems; for example, there could be a peer-to-peer relationship instead.

[0073] Referring to FIG. 2, this figure is a block diagram of an exemplary computer system that may be used in the devices of FIG. 1. The computer system 210 includes one or more processors 220, one or more memories 225, one or more transceivers 230, one or more network (N / W) interfaces (I / F) 245, and user interface circuitry 265, interconnected via one or more buses 227. Each of the one or more transceivers 230 includes a receiver Rx 232 and a transmitter Tx 233. A user 201 may interact with the user interface elements 205. The transceivers may use any applicable protocol, such as wireless fidelity (Wi-Fi), Bluetooth, near field communication (NFC), or a cellular protocol such as 4G (fourth generation) or 5G (fifth generation), or a combination thereof. The one or more buses 227 may be an address bus, a data bus, or a control bus, or a combination thereof, and may include any interconnection mechanism, such as a series of wires on a motherboard or integrated circuit, optical fiber, or other optical communication equipment. The one or more transceivers 230 are connected to one or more antennas 228. The one or more memories 225 contain the computer program code 223.

[0074] The computer system 210 includes a control module 240, which includes one or both of components 240-1 and 240-2. The control module 240 causes the computer system 210 to perform the operations previously described herein as being performed by individual devices. The control module 240 may be implemented in multiple ways. The control module 240 may be implemented in hardware as control module 240-1, such as as part of one or more processors 220. The control module 240-1 may be implemented as an integrated circuit or other hardware, such as a programmable gate array. In another example, the control module 240 may be implemented as control module 240-2, which is implemented as computer program code 223 and executed by one or more processors 220. For example, the one or more memories 225 and the computer program code 223, together with the one or more processors 220, may be configured to cause the user computer system 210 to perform one or more of the operations described herein. It should also be noted that other different or fewer devices may be used, rather than being limited to the devices shown in user computer system 210. For example, wired N / W IF 225 may not be necessary if only wireless networking via one or more transceivers 230 is used instead.

[0075] The user interface circuitry 265, which may or may not be implemented, if implemented, communicates with one or more user interface elements 205, which may be formed integrally with the user computer system 210, or formed external to but coupled to the user computer system 210, or both. The user interface elements 205 include one or more cameras, one or more audio devices (such as microphones, speakers, etc.), one or more sensors (such as GPS sensors, fingerprint sensors, orientation sensors, etc.), one or more displays, or one or more keyboards, or any combination thereof. This list is not exhaustive or limiting, and other, different, or fewer elements may be used. A user 201 (e.g., using a client 110) interacts with the user interface elements 205 to cause the corresponding computer system 210 to perform an action. For example, client 110 may be, in part, under the control of user 201, requesting information from, for example, a bank, which in turn controls server 170, possibly without interacting with the corresponding user 201.

[0076] With respect to exemplary implementations of the various devices of FIG. 2 , the control module 240 may be implemented as one of a (fully) homomorphic encryption and communication (and e.g., PIR) application 112 in the client 110 or a (fully) homomorphic encryption and communication (and e.g., PIR) application 172 in the server 170 for the corresponding device's computer system 210.

[0077] Additionally, computer system 210 may reside in the cloud, for example as a resource allocated to server 170, and may be formed from processor 220 and memory 225. Computer system 210 may be a device, such as a smartphone, tablet, or personal computer, for user 201 of client 110.

[0078] Now that we have outlined exemplary methods and systems, we provide some additional background. Regarding learning with (ring) errors (LWE), the security of the GSW cryptosystem

[43] is based on the difficulty of the learning with (ring) errors (R) LWE decision problem [71, 62]. While LWE uses the ring of integers R = Z, RLWE typically uses the ring of integers R in a cyclotomic field. The "yes" case for this problem for modulus q, dimension k, and noise distribution χ over R is given by

number

number

number

number

[0079] For LWEs involving secret matrices, instances of the LWE are related (more generally) to a secret matrix S', and hybrid reasoning can prove that cracking the matrix version of an LWE is just as hard as cracking a traditional LWE. In the matrix version of an LWE, a "yes" instance consists of uniform matrices A and B = S'A+E. Let us give these matrices dimensions: S' is n0×k, A is k×m, and B and E are n0×m. See Figure 3 for an illustration of these matrices in one exemplary structure. Set n1=n0+k. So that B is a matrix with -A on top of it,

number

[0080] With reference to Figure 3, for some small ε > 0, there exists n1 = n0 + k ≈ n2 = n0 (1 + ε / 2) and m = n1 log q. Therefore, n0 ≈ 2k / ε. Therefore, for correct decryption of a ciphertext with error E using the gadget matrix H, PEP ∞ ε / 2 is necessary.

number

number

[0081] Regarding the gadget matrix, GSW is a rectangular gadget matrix

[64] .

number

number

number

number

number

number

number

number

[0082] For GSW encryption and decryption, a scalar matrix

number

number

number

[0083] S·C=S·M'·G+S·P·X=M·S·G+E'

[0084] E' = E·X contains small coefficients. Assuming E' contains coefficients bounded by appropriate β, E'·G -1 (0) contains entries that are too small to wrap around modulo q, and (G -1(because 0 is maximal rank and is invertible over the fractional field associated with R), allowing the decoder to recover E' and therefore M S G. S G has rank n0 (in fact, as a submatrix

number

[0085] If M is not a scalar matrix, it is unclear how to obtain a GSW encryption of M. As before, if the candidate ciphertext is C = M' G + P X, then M' must satisfy S M' = M S. If M is a scalar matrix, finding such an M' is easy: M is a scalar matrix containing the same scalar, but with larger dimensions. However, if M is not a scalar matrix, finding such an M' appears to require knowing S. Hiromasa et al.

[52] show how to obtain a version of GSW that encrypts non-scalar matrices, given LWE and the assumption of cycle security that private key encryption is required for the matrix encryption step. One example embodiment relies on LWE (which does not include cycle encryption) for the encryption step, so the GSW ciphertext encrypts only scalars.

[0086] Regarding homomorphic operations in GSW, suppose there exist C1 and C2 that GSW encrypt M1 and M2, respectively. Then, clearly, C1+C2 GSW encrypts M1+M2, provided that the total error remains bounded by β. For multiplication, C X =C1 G -1 Set (C2) mod q. The result is:

[0087] S.C. X =(M1 S G+E1) G -1(C2)=M1·M2·S·G+M1·E2+E1·G -1 (C2)

[0088] Therefore, the new error E'=M1·E2+E1·G -1 Provided that (C2) remains bounded by β, C X encrypts M1 and M2 with GSW. -1 Since (C2) contains small coefficients, the term E1 G -1 (C2) is only slightly larger than the original error E1. There are two strategies for keeping the term M1·E2 small. First, if M1 corresponds to a small scalar (e.g., 0 or 1), this term will be as small as the original error in C2. Second, if E2=0, this term will not even appear. For example, if the constant σ2∈R q If we want to perform homomorphic multiplication by, we set C2 = σ2 · G (not including P · X) and then use C as above. X The plaintext in C1 is multiplied by σ2, and the new error does not depend on σ1 or σ2, so R q It can be any within.

[0089] Regarding partial compression of GSW ciphertext, GSW already supports partial compression of ciphertext in the sense that it encrypts larger scalars in R (without significantly increasing noise) so that many bits of ciphertext are compressed into a single ciphertext (relatively speaking, the resulting compressed ciphertext is much larger than the compressed ciphertext implemented here). As a simple example, consider the case of GSW (R=Z) based on LWE, and C n , ..., C l-1 , bit σ n , ..., σ l-1 Let be the GSW ciphertext to encrypt. To compress it, we simply

number

[0090] This generalizes to other rings R as long as the bit σ can be recovered from x upon decryption, where the scalar x ∈ R is encoded as x = Σ i σ i r i in binary (using r i ∈ R as a fixed basis independent of x and using σ i as the "bits of x"). For example, in the case of R = Z i [X] / F(X), q for

Number

[0091] Note, however, that this simply partially compresses the GSW ciphertext and keeps the plaintext / ciphertext ratio at most 1 / n1m. To keep the noise small, GSW ciphertexts usually encrypt bits. Roughly speaking, for some upper bound L, GSW ciphertexts C0,..., C l-1 with l < L can be compressed, and these GSW ciphertexts encrypt the bits σ0,..., σ l-1 into a single ciphertext C, and the single ciphertext C encrypts σ ∈ R l-1 with binary representation (σ0,..., σ L , 0,..., 0) ∈ {0, 1} q . For this binary representation, the map ρ(σ1,..., σ L ) = Σσ i · r i given by ρ : {0, 1} L → Rq is injective, and the elements r1,...,r are computed so that the preimage of ρ can be computed efficiently. L ∈R q For example, if R=Z, then r i or simply

number

[0092] Regarding compressible homomorphic encryption, this topic starts by defining the concept of compressible (fully) homomorphic encryption, then explains how to realize it based on LWE (and cycle security if we obtain FHE).

[0093] In terms of definition, compressible (F)HE is very similar to standard (F)HE, except that it insists on decryption being split into a first compression and a subsequent "compressed decryption". Here, definitions are presented only for the simple case of one-hop fully homomorphic encryption of bits, but the same kind of definitions apply equally well to multiple hops, different plaintext spaces, or partial homomorphism, or a combination thereof (see

[51] for a detailed treatment of all these variants).

[0094] Definition 1. A compressible fully homomorphic encryption scheme (e.g., scheme 25 in Figure 1) includes the following five procedures: KenGen, Encrypt, Evaluate, Compress, and Decrypt.

[0095] (1)

number

[0096] (2)

number

[0097] (3)

number

number

number

[0098] (4)

number

number

number

[0099] (5)

number

[0100] The procedure Decrypt is extended to vectors of compressed ciphertext by decrypting each vector separately. This method is

number

[0101]

number

[0102] All circuits with sufficiently long outputs, Π, bits of plaintext

number

number

number

[0103] Regarding the gadget matrix H, a new technical component in one variant of the exemplary structure is the "near-square" gadget matrix. First, the usual Micciancio-Peikert gadget row used in GSW

[64]

number

[52] )

number

number

[0104] Naturally, for B>2

number

number

number

number

[0105] 1.F includes small entries (=q)

[0106] 2. G·F=0 mod q

[0107] 3. F is of full rank on R (but of course, since it is the kernel of G, R q (not above)

[0108] Given such F, G -1 For any ciphertext, the entries in (C) are not much larger than the modulus of F.

number

[0109] In our example setting, we want the new gadget matrix (called H instead of G to avoid confusion) to have nearly maximum rank modulo q (so that it is "nearly square"), so that F=H -1 It is desirable for (R) to have a very low rank modulo q. After there exists a low-norm matrix F with full rank on R but with very low rank modulo q, H is simply set as a basis for the mod-q kernel of F.

[0110] For simplicity, let q=p for some integers p and t. t Assume that −1 exists. A matrix F′ can be created that has full rank over the real numbers but contains “slightly smaller” coefficients with rank 1 modulo q as follows:

[0111]

number

number

[0112]

number

number

[0113] In the example embodiment, F' is an r x r identity matrix

number

[0114]

number

[0115] The decryption of the following compressed ciphertext uses a "slightly small" F=H-1 (0) is used. Specifically,

number

[0116]

number

number

[0117] The restriction q=p'-1 is not necessary in practice, and many variations are possible. The following fairly rough method is valid for any q that may arise:

number

number

number

number

number

number

number

number

number

[0118] Mutually relative prime numbers p i For q=p1...p t If the vector

number

[0119] We now describe in detail different procedures involving an exemplary compressible homomorphic encryption scheme, such as a high-rate HE scheme and compression techniques.

[0120] For key generation, two uniformly random matrices are used to generate a private / public key pair.

number

number

number

number

[0121] The private key is a matrix

number

number

[0122] Regarding encryption, decryption, and evaluation, the encryption and decryption of small scalars and the evaluation of the circuits for encryption and decryption can be performed exactly as in the original GSW scheme. That is, for a matrix X ∈ R containing small entries, m×m The scalar σ∈R is encrypted by choosing σG+PX(mod q) and then outputting the ciphertext C:=σG+PX(mod q).

[0123] The decoding invariant is SC = σSG + E(mod q), with E = q. To decode, set Z:=S×C mod q, then use a trapdoor on G to remove small noise E and find σ.

[0124] The evaluation is also the same as in GSW, where addition is implemented by simply adding the ciphertext matrix modulo q, and multiplication is implemented by adding the ciphertext matrix modulo q. X :=C1×G -1 (C2) mod q. Showing that these operations preserve the decryption invariant (as long as the encrypted scalar is small) is again done exactly as in GSW.

[0125] For compressed decryption, the compressed ciphertext is converted into the plaintext matrix

number

number

number

[0126] Regarding compression, we now show how to pack many GSW bit ciphers into a single compressed ciphertext. For convenience, we use the partial compression technique described above to compress (many) GSW ciphertexts, which then encrypt bits into (fewer) ciphertexts, and these ciphertexts are compressed into R q It is assumed that the original GSW ciphertext is encrypted under a key S appropriate for the exemplary compressed HE scheme. However, note that the noise level of the final compressed ciphertext would be even lower if the entire compression were performed in one step instead of two. It is also assumed that the original GSW ciphertext is encrypted under a key S appropriate for the exemplary compressed HE scheme. If this is not the case, a "key switch" can be performed to make it so. Key switching [16, 15, 39] converts from a message under one key to a message under another key via homomorphic decoding, but does not reduce the noise level and does so in a "linear" way that is much less computationally expensive than bootstrapping.

[0127] R q element σ of u,v Encrypt each of the

number

number

[0128] To pack all these ciphertexts into a single compressed ciphertext, T u,v is a square n0×n0 singleton matrix with 1 in the entry (u,v) and 0 elsewhere, i.e.

number

number

number

[0129]

number

[0130]

number

number

[0131]

number

number

number

[0132] The above compressed decoding recovers the matrix M, and then the entries of M, σ u,v Note that you can read

[0133] In addition to the basic compressible HE interface, the exemplary scheme also supports several other operations that are useful in PIR applications, which are described below.

[0134] For the procedure indicated as step (i) (encryption of compressed ciphertext), a random

number

number

number

[0135] Regarding the procedure shown as step (ii) (additive homomorphism of compressed ciphertext), it is clear that the compressed ciphertexts are added and multiplied by small scalars. Indeed, M1, M2 are added to R q If the matrix above, σ is a small scalar, and for i=1, 2, SC i =M i H+E i If there exists, then S(C1+C2)=(M1+M2)H+(E1+E2) and S×σC1=σM1H+σE1. If (E1+E2) and σE1 are smaller than β, then ∞ , the result is a valid compressed ciphertext of M1+M2 mod q and σM1 mod q, respectively.

[0136] For the procedure shown as step (iii) (multiplication of the GSW ciphertext by the compressed ciphertext), the GSW ciphertext C that encrypts the smaller scalar σ is multiplied by R q Compressed ciphertext for encrypting the matrix M above

number

[0137]

number

[0138] Regarding the step indicated as step (iv) (multiplication of the GSW ciphertext by the plaintext matrix), it is the same technique, where the GSW ciphertext is multiplied to the right by the compressed ciphertext, and then multiplied to the right by the plaintext matrix.

number

number

[0139] Many other possible optimizations and variations are described below when describing an exemplary PIR application. One exemplary key optimization is the use of modulus switching techniques to handle larger noise.

[0140] Regarding parameter setting, it remains to be shown how to set various parameters, including the matrix dimensions n0, n1, and n2, as well as the noise limits α and β, depending on the security parameters. When a slightly homomorphic variant of GSW is used without bootstrapping, the parameter β, which limits the noise in the evaluated ciphertext, depends on the desired function to be calculated. One such concrete example (including fully specified constants) is presented below for an exemplary PIR application. Here, an asymptotic analysis of the parameters when using GSW as a fully homomorphic scheme with bootstrapping is presented. That is, we wish to evaluate an arbitrary function with a long output (using the GSW FHE scheme) on the encrypted data, and pack the resulting encrypted bits into a compressed ciphertext that remains decodable.

[0141] The example embodiment guarantees that the compressed ciphertext has a ratio of 1-ε for some small ε of a given choice.

number

number

number

number

[0142] According to [43, 17], when using GSW with the noise of the size α of the new ciphertext and the ciphertext matrix of dimension n1×m, any calculation may be performed, and then the result of the execution is bootstrapped, and the noise after bootstrapping is limited by being less than am 2 Using the above techniques and further the compression of equation (3) to unify the partial compression into one step, all PE u,v,w P ∞ satisfies <am2 [Number] error matrices E of u,v,w are obtained. Therefore, the terms of the error after compression are Σ u,v,w E u,v,w G -1 (something), and its size is [Number] is limited by. Therefore, it is sufficient to show an example of the method using the limit [Number] Since β < q ε / 2 / 2 is required, the following justification constraint is determined.

[0143] [Number]

[0144] Set α ≦ poly(k / ε), which means that q = (k / ε) θ(1 / ε) is required. Therefore, the security of this method depends on the hardness of LWE including the gap k θ(1 / ε) , and in particular, when ε is a constant, it may depend on LWE including a polynomial gap.

[0145] Note that there are many techniques that can be applied to slow down the increase of noise. Many of these techniques (e.g., modular switching) are described below in the context of an exemplary PIR application. These techniques can significantly improve the constant of the exponent without changing the asymptotic behavior (q = (k / ε) θ(1 / ε) may always be required).

[0146] Regarding a variant that does not include the gadget matrix H, here, an exemplary variant in a similar manner to Regev's encryption is described in terms of the variant not using the gadget matrix H but relying on the expansion of the message such that the message is larger than the noise. Specifically, this scheme features a plaintext modulus (p < q) smaller than the ciphertext modulus. The compressed ciphertext is the vector

Number

Number

Number

Number

Number

Number

[0147] The ratio of the compressed ciphertext is

Number

Number

Number

[0148] Compressing GSW ciphertext is similar to the above, but differs in that when partially compressing bit ciphers into scalar ciphers,

Number

Number

Number

Number

number

number

number

[0149] It is easy to verify that this variant also enjoys the additive homomorphism of the compressed ciphertext, and the ability to right-multiply the GSW ciphertext by the compressed ciphertext (encrypting the product to produce the compressed ciphertext).

[0150] Now that general schemes for (F)HE compression of ciphertext have been described, the application of these schemes to Private Information Retrieval (PIR) will be described. PIR allows a client to retrieve entries from a database maintained by a server without the server learning which entries were retrieved. A naive solution would have the server send the entire database to the client, and Chor et al.

[25] began work on more bandwidth-efficient solutions. The PIR protocol provides a way to reduce the bandwidth overhead (compared to insecure solutions), making the bandwidth overhead sublinear in the number N of entries in the database.

[0151] It is well known that homomorphic encryption can be used for this purpose: the client can encrypt an index of the required entry, and the server can perform a homomorphic evaluation of the table lookup function that returns the encrypted entry. This solution forces the server to return a single encrypted entry, so the bandwidth overhead is almost the same as the plaintext-to-ciphertext ratio of the homomorphic scheme, independent of the number of entries. However, when the entries themselves are large (as in a video database where each video is several gigabytes long), even this N-independent overhead can become prohibitively expensive. For a detailed discussion, see [55, 1, 60]. Clearly, if a compressible HE scheme exists, it can be used to reduce the bandwidth overhead arbitrarily close to 1.

[0152] The first single-server, rate-1 PIR scheme for large entries was described by Kiayias et al.

[55] , using the Damgard-Jurik encryption scheme

[31] , which supports an arbitrarily close-to-1 plaintext-to-ciphertext expansion ratio. However, because Damgard-Jurik is only additively homomorphic, its solution is much more complex and relies on the homomorphic structure of Ishai-Paskin branching programs

[53] (which internally uses Damgard-Jurik). Therefore, the exemplary compressible HE scheme provides a new means to obtain rate-1 PIR that relies on the (quantum-safe) LWE hardness instead of relying on the Damgard-Jurik Nth-order modulus hardness assumption. Besides bandwidth, realistic PIR systems must also be concerned about computational efficiency. PIR schemes must process every bit in the database for every query, and most single-server PIR schemes apply fairly expensive processing to each bit. In particular, the optimal ratio scheme in

[55] must apply, at a minimum, one multiplication per bit modulo RSA modulus (at least 2048 bits). This is emphasized by the work of Sion and Carbunar

[77] , which concluded (in 2007) that "recent deployment of nontrivial single-server PIR protocols on real-world hardware was several orders of magnitude less time-efficient than trivial full-database transfer." Note that transmitting the entire database is not computationally free; this transmission involved at least encrypting the entire database for communications security purposes. Nevertheless, for the decade following the Sion-Carbunar work, prior to this work, no single-server PIR schemes were computationally competitive with trivial schemes. Below, a series of optimizations for an exemplary scheme are described that produce a construction that is not only bandwidth-efficient but also outperforms full-database AES encryption.

[0153] In working towards an exemplary optimized PIR scheme, the starting point is a basic hierarchical PIR, where N database entries are in a hierarchy of dimensions N = N1 × … × N. D The algorithm uses a homomorphism of degree d.

[0154] (1) The client index i∈[N] is a base N1,...,N D is expressed in a mixed base, i.e.,

number

[0155] (2) Process the first dimension, multiplying each hyper-row u∈[N1] by the u-th encrypted bit from the first vector, zeroing out all but the i1-th hyper-row. Note that the i-th hyper-row (say, in the first dimension) is simply a slice of the hypercube whose first index is i. That is, all entries in the hypercube with indices of the form (i, *, *, …, *) (where * can be anything). Similarly, the i-th hyper-row in the second dimension is all entries with indices of the form (*, i, *, …, *). Then, add up all the resulting encrypted hyper-rows, thus creating a dimension N / N1=N2×…N consisting of only the i1-th hyper-row of the database. D We obtain a smaller hypercube of

[0156] (3) A similar method is then used to collapse the other dimensions one by one until a zero-dimensional hypercube consisting only of the selected entry i is left.

[0157] Note that the first step (step (1)) of reducing the size of the database from N to N / N1 is usually the most expensive because it processes the most data. However, this step can sometimes be optimized better than the other steps because it only requires multiplication of ciphertext by plaintext (as opposed to the multiplication of plaintext by plaintext required in subsequent steps).

[0158] A series of derivations and optimizations have now been described to obtain an exemplary final structure that results in a high-rate PIR scheme that is also computationally efficient. This structure features a trade-off between bandwidth and computation. In the following, a variant with a ratio of 4 / 9 is described.

[0159] With respect to using ring LWE, as with ordinary LWE schemes, performance can be improved by switching to ring (or module) variants, where the LWE secret has low dimension over a large extension field. Instead of requiring manipulation of large matrices, these variants operate on lower-dimensional matrices over the same large extension field; these lower-dimensional matrices require fewer bits to represent and can be manipulated faster (using FFTs). If, to obtain equivalent security, the basic LWE scheme requires an LWE secret of dimension k, the new scheme has a secret of dimension k' over an extension field of degree d, such that k'd ≥ k (for ring LWE, there exists k' = 1 and d = k). The various matrices in this scheme consist of elements of the extension field, and their dimensions are (n, n ... i , instead of m)n' i =n i / d and m' = m / d. In what follows, the notations n'1 and m' are used to emphasize the smaller values ​​in the context of RLWE.

[0160] Regarding reducing FFTs, one optimization that can be used to make the exemplary PR scheme more efficient (for large databases) is to preprocess the database to minimize the number of FFTs during processing. The operation of the scheme in the ring LWE variant requires matrix multiplication over the underlying field, which is most efficient when the elements are represented in the evaluation (CRT) basis, and representation in the coefficient (decoding) basis. -1 This involves applying (·). Converting between these two is performed in sublinear time using an FFT, but is still arguably the most expensive operation used in the implementation (for example standard sizes, converting an element between these representations is perhaps 10-20 times slower than multiplying two elements represented in the CRT basis).

[0161] As in the XPIR work [1], the number of FFTs can be significantly reduced by preprocessing the database and putting it all into a CRT representation. j It is only necessary to compute the FFT when the client's message is processed to obtain the encrypted unary representation of ∑(N / N1) (this is independent of the size of the entries in the database), and only after the first dimension has been collapsed (so the FFT is only applied to the compressed ciphertext that encrypts N / N1 database entries).

[0162] If we set N1 large enough (relative to the FFT overhead), the FFT will be amortized and insignificant after folding down the first dimension. On the other hand, we need to set N1 small enough (relative to N / N1 and the entry length L) so that the initial FFTs (one of which contains approximately n'1 m' N1) are also insignificant.

[0163] In the following explanation, N1=2 8 Various parameters at are shown and appear to offer good trade-offs. i For N, there is (almost) no reason to make them large, so N2=N3=…=ND = 4. In the following construction, we can use such a small N i Note that there is (almost) no restriction on the number of 20 Although shown for a database containing entries, this structure can handle much larger databases (up to infinity and at least

number

[0164] For client-side encryption, in the context of the PIR scheme, the encryptor is the client that holds the decryption key. Thus, the client generates a new pseudorandom public key P for each ciphertext. i Select C i :=σ i G+P i By setting mod q, we can create a ciphertext using the private key. This will give us a slightly less noisy ciphertext, i.e., the E × X we get from the ciphertext encrypted by the public key. i (as opposed to simply low-norm E i is obtained.

[0165] Since the exemplary PIR structure uses small dimensions N2=N3=...=4, the client may directly send the encrypted unary vectors of these dimensions, i.e.,

number

[0166] However, for the first dimension, large N1=2 8Since there exists a cipher for i1, the client sends the cipher for the i1 bits, and the GSW homomorphism is used to compute the encrypted unary vector for this dimension. Thus, the client has a total of logN1+(N2+N3+…N D ) encrypted bits, which for the exemplary shown sizes amounts to 8+4×6=32 encrypted bits.

[0167] For multiple G matrices, the cumulative noise in an exemplary manner is of the form E×G -1 (something) contains many terms, but not all of them are created equal. In particular, when folding the first (large) dimension N1, GSW ciphertexts are evaluated, and the noise of those GSW ciphertexts is itself the sum of such noises. When those GSW ciphertexts are multiplied by the plaintext matrix, the larger E × G -1 We get (something) × G1(something). On the other hand, for other (smaller) dimensions, we achieve much smaller noise because these dimensions are multiplied by the new ciphertext. This imbalance leads to a waste of resources.

[0168] Additionally, during the initial processing of the client's bits, -1 Multiplication by (something) applies only to a small amount of data, but multiplication between a GSW matrix and plaintext data touches all data in the database. Therefore, the latter is very expensive, and it is beneficial to reduce the dimensions of the matrices involved as much as possible.

[0169] For all of these resources, it is better to use different G matrices for different parts of the calculation. In particular, when processing the client bits first, (G -1 A very wide and short G matrix (with a smaller norm of 0) may be used, followed by a more square / higher norm G matrix.

[0170] Regarding modulus switching, even a carefully balanced G matrix cannot reduce the noise as much as desired for the exemplary compressed scheme. Therefore, the modulus switching technique of [16, 15] can be used: calculations for a large modulus Q are performed, and then a switch to a smaller modulus q is made before sending the final result to the client, thereby changing the noise magnitude by approximately q / Q.

[0171] An exemplary initial noise analysis showed that if the GSW G matrix was set to be very wide and short, then a roughly 64-bit modulus q could be used because using a wide and short matrix kept the noise very small throughout the computation. However, this came at the cost of a large increase in bandwidth, computation, and storage on the server. For example, the server could not compute all plaintext matrices G that were more than 32 times larger than the plaintext matrix M itself. -1 (M') needs to be stored in the CRT basis (and no parameters were found that would allow a ratio better than 1 / 3 to be achieved in that case).

[0172] A better option is to use a significantly larger modulus, at least initially, and then use modulus switching to reduce the modulus to 64 bits (or even smaller bits, in some cases). This makes the system more tolerant to noise and improves many of the parameters, e.g., Q ≈ q 25 We can also replace the G matrix in the actual data with an identity matrix by using (G). Even though it means we need to use an LWE secret with twice the dimensionality and write numbers that are more than twice as large, using an identity matrix still saves us a large constant coefficient. Furthermore, using an identity matrix allows us to use a more square matrix H (e.g., 2x3), thereby obtaining a higher ratio.

[0173] Note that the use of modulus switching requires that the secret key be chosen from an error distribution, rather than uniformly chosen (and that the way modulus switching can be implemented is that for some of the bits, q'·σ is encrypted, rather than σ itself (Q=q'·q)).

[0174] A detailed PIR scheme example will now be presented. This example is presented in part in conjunction with FIG. 4, which is a flowchart of an exemplary method for using compressible (F)HE as applied to PIR. In this example, an exemplary structure is shown with index 2 13 and dimension 2 12 The cyclotomic ring of, i.e.,

number

[0175] In this example, R Q The LWE ring above is used, and in particular, the LWE secret is a secret of R chosen from the error distribution Q [7] (Using this cyclotomic ring with a modulus Q of size up to 111 bits yields a 128-bit security level, see Table 1 in [2]).

[0176] For various matrices in the exemplary structure in this example, dimensions k'=1, n'0=2, and n'1=n'2=3 are used, and the elements of the plaintext are q Therefore,

number

[0177] 4 illustrates operations that may be performed by client 110 on the left and operations that may be performed by server 170 on the right. The coordinated operations of FIG. 1 for configuring and using the compressible (F)HE scheme of this example are not shown in FIG. 4. However, one configuration operation that may be performed is illustrated by block 405, in which server 170 constructs an indexed (e.g., hierarchical) database of the plaintext of a user's personal information, e.g., N database entries (e.g., N D The database 28-1 is in an N-dimensional hypercube (containing cardinal numbers). This database 28-1 may be constructed using personal information of the user 201 provided by the client 110 or by other providers. The examples below use plaintext in the database 28-1, but the database 28-1 may store ciphertext from the user 201 (instead of plaintext).

[0178] In one example, in block 406, server 170 builds a database of size N of plaintext associated with user 201, and in block 408, server 170 divides the database of size N into hypercube databases. More specifically, the database of size N is divided into hypercubes of dimension N=256×4×4×...×4. A client wishing to retrieve entry i∈[N] first computes i for all j>1. i ∈

[0256] and i j ∈[4], where i is (i1,i2,...i D ) In block 415, the client 110 obtains the index i (e.g., N DEncrypt the index i) expressed in mixed radix of σ radix. This encryption is performed using the Encrypt procedure. More specifically, 1,0 ,...σ 1,7 Let be the bits of i1, and then the client 110 calculates the scalar q' σ 1,0 and σ 1,1 ,...,σ 1,7 in the GSW ciphertext (modulo Q). For j=2,...,D, the client encrypts the j A unit vector that is 1 at

number

[0179] (a) For the LSB of i1 (the rightmost bit multiplied using GSW), the gadget matrix G is entirely removed and only the identity element is used, but the bit σ 1,0 Multiply by q', i.e.

number

number

[0180] (b) For other bits of i1, wide and short

number

number

number

[0181] (c) Other i j For bits encoding unary representations (j>1), a somewhat rectangular (3x6) matrix

number

number

[0182] In block 420, the client 110 sends all these ciphertexts to the server as part of a search request for an item from the server using the encrypted index. The encryption of the i1 bits consists of 9 elements to encrypt the LSB and 7·3·159=3381 elements to encrypt the other 7 bits. In block 425, the server receives the request. In block 430, the server 170 processes the client's message and derives the (e.g., D) index elements (e.g., (i1,...i D )) to obtain a unary representation of the GSW ciphertext. Note that this may use step (iii) described above, multiplication of the GSW ciphertext by the compressed ciphertext. For example, the request may be in the form of a GSW query ciphertext. More specifically, for other indexes i j For each, 4 3 6 = 72 elements are j It is used to encrypt the unary representation of N-2 20 In this numerical example containing database entries, six more i j Therefore, the number of elements of the ring sent by the client is 9 + 3381 + 6 72 = 3822. Each element requires 106 2 12bits, and therefore the total number of bits sent by the client is 106 2 12 3822≒2 30.6 (a large 198MB). For applications where the size of the client query is an issue, the parameters can be tweaked (e.g., giving up a factor of 2 in the ratio and getting a 2-4x improvement in the client query size). Even better, the query expansion techniques in the SealPIR work [5] can also be applied in this setting to get a very large reduction in the client query size without compromising on the ratio.

[0183] Note that this assumes that database 28-1 has been preprocessed prior to block 430. That is, in block 410, the server processes each entry in R q Preprocess the database by splitting it into the above 2x2 plaintext matrix (q≒2 46 (Recall that each matrix is ​​3·2·46·2 12 =2 20.11 The server encodes each entry in these matrices with a CRT representation modulo Q (block 410). Note that if the database 28-1 contains plaintext, then further processing may use step (iv) described above: multiplication of the GSW ciphertext by the plaintext matrix. The result of the CRT representation modulo Q is the plaintext. Note also that while this example uses a plaintext (or partially plaintext) database 28-1, the database could also be encrypted, after which step (iii) described above: multiplication of the GSW ciphertext by the compressed ciphertext could be used. The entries in the plaintext matrix are small ([±2 45 ]), but their CRT representation modulo Q is not small. Therefore, this representation entails a 106 / 46 ≈ 2.3x expansion in storage requirements on the server. Below, L is set to be the number of matrices needed to encode a single database entry (a single JPEG image contains L ≈ 3, and a 4GB video is encoded with about 29K matrices).

[0184] Given the client's ciphertext, in block 435 the server calculates, for the first dimension, the unit vector

number

[0185] The server then continues folding successively smaller dimensions (block 440). For each dimension of size 4, the server multiplies the four GSW encrypted bits by all the compressed ciphertext in the four hyper-columns, then adds the results across the current dimension, obtaining a four-fold reduction in the number of ciphertexts. This continues until the server is left with only a single entry of the L compressed ciphertexts modulo Q.

[0186] Finally, the server encrypts each ciphertext C

number

number

number

number

[0187] At block 450, server 170 sends the selected entry, which is an encrypted response to the request, to the user, and at block 455, client 110 receives the encrypted response. At block 460, client 110 decrypts the encrypted response to plaintext, thus revealing the requested entry. At block 465, client 110 performs one or more operations using the plaintext. For example, if user 201 requested the balance in their checking account, user 201 could, for example, add more cash to the checking account or use the checking account to pay off a credit card.

[0188] Regarding noise analysis, for the first dimension, we need to compute a unary vector encrypted using GSW evaluation, and each ciphertext in that vector is a product of logN1 = 8 ciphertexts. Therefore, the noise of each of these evaluated ciphertexts is E u is one of the error matrices sampled during encryption and has the approximate form

number

[0189]

number

number

number

[0190] E u The entries of G can be chosen from a distribution with variance 8 (which is sufficient to prevent the Arora-Ge attack [8]). -1 The entries of (·) are in the range [±2] (because m1=n1log1(Q) exists), so

number

number

number

[0191] As we continue to fold more dimensions, we use equation (4), this time using G2, to again multiply the encrypted unary vector of those dimensions (which is the GSW ciphertext) with the result of the previous dimension (which is the compressed ciphertext). Note that the GSW ciphertext in these dimensions is raw, and therefore their noise term is simply the matrix E chosen during encryption. Therefore, the N j Each of the noise terms is given by, for one of these E matrices,

number

[0192] G2

number

number

number

[0193] The analysis so far has shown that noise must be 2 73.5 +2 67.1 This means that the magnitude of the noise term due to rounding errors in modulus switching is limited to

number

number

[0194]

number

number

[0195] Regarding complexity analysis, the server's work during query processing is primarily done by R Q (The summation and multiplication of G after the FFT is performed. -1 Other operations, such as applying (), take very little time in comparison.)

[0196] Dimension 2 12 In a cyclotomic ring, each FFT operation is about 10-20 times slower than a ring multiplication operation in the evaluation representation. However, it is easy to see that if N / N1 times the size of the database entries L is large enough, the number of multiplications will outnumber the number of FFTs by more than a factor of 20. In fact, the FFT is performed by multiplying the index i sent by the client (which is independent of L and N / N1). iThis is performed only in the early stages when L N / N1 bits are processed, and after the first dimension fold (which applies to only N / N1 ≈ 0.25% of the data). In the example configuration, when L N / N1 exceeds a few thousand, the multiplication time will exceed the FFT time. With N / N1 = 4000 in this example, even holding a single JPEG image in each entry already means that processing the FFT takes less than 50% of the total time. For a video with L = 29K, the FFT time is quite small.

[0197] We can now evaluate the time taken for multiplications as a function of the database size. For large L N / N1, the largest number of multiplications is arguably performed when multiplying the GSW ciphertext by the plaintext matrix encoding the database while collapsing the dimensions of the first hypercube. These multiplications have the form C':=C×M'H mod q'q, where C' is the hybrid ciphertext of dimension n1×n1 and M'H is the redundant plaintext matrix of dimension n1×n2 (n1=n2=3). In a naive fashion without optimization, each of these matrix multiplications (modulo the double-sized modulus q'q) takes 3 3 = 27 ring multiplications are required. Each ring multiplication (on an element in the CRT representation) is 2 12 Each such matrix multiplication consists of twice the number of modular integer multiplications, totaling 2 27 2 12 ≒2 17.75 This requires approximately 2 modular multiplications. 17.11 A single plaintext matrix containing the bytes is processed, so the amortized work is approximately 1.56 modular multiplications per database byte. (Using Laderman's method, a 3x3 matrix can be multiplied using only 23 multiplications

[59] , so the amortized work is only 1.33 modular multiplications per byte.) Given that other work should not significantly change this number when L is large, these multiplications are likely to account for at least 90% of the execution time.

[0198] One (or two) modular multiplications per byte should be significantly faster than AES encryption of the same data. For example, software implementations of AES without hardware assistance are estimated to take over 25 cycles per byte [76, 30]. By exploiting the fact that the same GSW matrix is ​​multiplied by a large number of plaintext matrices, it may be possible to preprocess the modular multiplications, which should make performance competitive with hardware-assisted AES implementations on CPUs.

[0199] For large databases, the method described above should be computationally faster than the naive method of transmitting the entire database, even without considering the significant communication savings. It is emphasized that this speed is achieved while still providing significant bandwidth savings. In fact, the ratio for this solution is 0.44, so you pay 2.25 times as much in bandwidth to gain privacy.

[0200] Please note that reference citations are arranged as numbers within square brackets (e.g., "[1]" means reference number 1). These references are associated below.

[0201] [1] Carlos Aguilar-Melchor, Joris Barrier, Laurent Fousse, and Marc-Olivier Killijian. Xpir: Private information retrieval for everyone. Proceedings on Privacy Enhancing Technologies, 2016(2):155-174, 2016.

[0202] [2]Martin Albrecht, Melissa Chase, HaoChen, Jintai Ding, Shafi Goldwasser, Sergey Gorbunov, Shai Halevi, Jeffrey Hoffstein, Kim Laine, Kristin Lauter, Satya Lokam, Daniele Micciancio, Dustin Moody, Travis Morrison, Amit Sahai, and Vinod Vaikuntanathan. Standard homomorphic encryption. Available at http: / / homomorphicencryption.org / , accessed February 2019, November

[0203] [3] Jacob Alperin-Sheriff and Chris Peikert. Practical bootstrapping in quasilinear time. In Advances in Cryptology - CRYPTO'13, volume 8042 of Lecture Notes in Computer Science, pages1-20.Springer,

[0204] [4]Jacob Alperin-Sheriff and Chris Peikert. Faster bootstrapping with polynomial error. In Advances in Cryptology - CRYPTO 2014, Part I, pages 297-314.Springer,

[0205] [5]Sebastian Angel, Hao Chen, Kim Laine,and Srinath Setty. Pir with compressed queries and amortized query processing. In 2018 IEEE Symposium on Security and Privacy (SP), pages 962-979.IEEE, 2018.

[0206] [6]Yoshinori AONO, Takuya HAYASHI, Le Trieu PHONG, and Lihua WANG. Privacy-preserving logistic regression with distributed data sources via homomorphic encryption. IEICE Transactions on Information and Systems, E99.D(8):2079-2089, 2016.

[0207] [7]Benny Applebaum, David Cash, Chris Peikert, and Amit Sahai. Fast cryptographic primitives and circular-secure encryption based on hard learning problems. In Advances in Cryptology- CRYPTO 2009, 29th Annual International Cryptology Conference, Santa Barbara, CA,USA, August 16-20, 2009.Proceedings, pages 595-618, 2009.

[0208] [8]Sanjeev Arora and Rong Ge. New algorithms for learning in presenceof errors. In ICALP (1), volume6755 of Lecture Notes in Computer Science, pages 403-415.Springer, 2011.

[0209] [9]Saikrishna Badrinarayanan, Sanjam Garg,Yuval Ishai, Amit Sahai, and Akshay Wadia.Two-message witness indistinguishability and secure computation in the plain model from new assumptions.In International Conference on the Theory and Application of Cryptology and Information Security, pages 275-303.Springer, 2017.

[0210]

[10] Daniel Benarroch, Zvika Brakerski, and Tancrede Lepoint. FHE over theintegers: Decomposed and batched in the post-quantum regime. In Public Key Cryptography (2), volume10175 of Lecture Notes in Computer Science, pages 271-301.Springer, 2017.

[0211]

[11] Elliptic curve point multiplication,en.wikipedia.org / wiki / Elliptic_curve_point_multiplication, downloaded on6 / 13 / 19.

[0212]

[12] Dan Boneh, Craig Gentry, Shai Halevi,Frank Wang, and David J. Wu.Private database queries using somewhat homomorphic encryption. In ACNS, volume 7954 of Lecture Notes in Computer Science, pages 102-118.Springer, 2013.

[0213]

[13] Elette Boyle, Yuval Ishai, andAntigoni Polychroniadou. Limits ofpractical sublinear secure computation.In Annual International Cryptology Conference, pages 302-332.Springer,2018.

[0214]

[14] Zvika Brakerski, Craig Gentry, andShai Halevi. Packed ciphertexts inLWE-based homomorphic encryption.In Kaoru Kurosawa and Goichiro Hanaoka, editors, Public Key Cryptography, volume 7778 of Lecture Notes in Computer Science, pages1-13.Springer, 2013.

[0215]

[15] Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan. Fully homomorphic encryption without bootstrapping. In Innovations in Theoretical Computer Science (ITCS’12), 2012. Available at http: / / eprint.iacr.org / 2011 / 277.

[0216]

[16] Zvika Brakerski and Vinod Vaikuntanathan. Efficient fully homomorphic encryption from (standard) lwe. SIAM Journal on Computing, 43(2):831-871,2014.

[0217]

[17] Zvika Brakerski and Vinod Vaikuntanathan. Lattice-based FHE as secure as PKE. In Moni Naor,editor, Innovations in Theoretical Computer Science, ITCS’14, pages 1-12.ACM, 2014.

[0218]

[18] Zvika Brakerski. Fully homomorphic encryption without modulus switching from classical gapsvp.In Reihaneh Safavi-Naini and Ran Canetti, editors, CRYPTO, volume 7417of Lecture Notes in Computer Science, pages 868-886.Springer, 2012.

[0219]

[19] Hao Chen, Kim Laine, and Rachel Player. Simple encrypted arithmetic library - SEAL v2.1. In Financial Cryptography Workshops, volume 10323 of Lecture Notes in Computer Science,pages 3-18.Springer, 2017.

[0220]

[20] Jingwei Chen, Yong Feng, Yang Liu, and Wenyuan Wu. Faster binary arithmetic operations on encrypted integers. In WCSE’17, Proceedings of 2017 the 7th International Workshop on Computer Science and Engineering, 2017.

[0221]

[21] Jung Hee Cheon, Jean-Sebastien Coron,Jinsu Kim, Moon Sung Lee, Tancrede Lepoint, Mehdi Tibouchi, and Aaram Yun. Batch fully homomorphic encryption overthe integers. In Advances in Cryptology- EUROCRYPT 2013, 32nd Annual International Conference on the Theory and Applications of Cryptographic Techniques, Athens, Greece, May 26-30,2013.Proceedings, pages 315-335, 2013.

[0222]

[22] Jung Hee Cheon, Andrey Kim, Miran Kim,and Yong Soo Song. Homomorphic encryption for arithmetic of approximate numbers. In ASIACRYPT (1), volume 10624 ofLecture Notes in Computer Science, pages 409-437.Springer, 2017.

[0223]

[23] Jung Hee Cheon, Miran Kim, and Myungsun Kim. Search-and-compute onencrypted data. In International Conference on Financial Cryptography and Data Security, pages 142-159.Springer,2015.

[0224]

[24] Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene.Improving TFHE: faster packed homomorphic operations and efficient circuit bootstrapping. In ASIACRYPT(1), volume 10624 of Lecture Notes in Computer Science, pages 377-408.Springer,2017.

[0225]

[25] Benny Chor, Oded Goldreich, Eyal Kushilevitz, and Madhu Sudan.Private information retrieval.Journal of the ACM (JACM) JACM, Volume 45 Issue 6, Nov. 1998, Pages 965-981.

[0226]

[26] Jean-Sebastien Coron, Tancrede Lepoint, and Mehdi Tibouchi.Scale-invariant fully homomorphic encryption over the integers. In Public-Key Cryptography - PKC’14, volume 8383 of Lecture Notes in Computer Science, pages 311-328.Springer, 2014.

[0227]

[27] Jean-Sebastien Coron, David Naccache,and Mehdi Tibouchi. Public key compression and modulus switching for fully homomorphic encryption over the integers. In Advances in Cryptology- EUROCRYPT 2012 - 31st Annual International Conference on the Theory and Applications of Cryptographic Techniques, Cambridge, UK, April 15-19,2012.Proceedings, pages 446-464, 2012.

[0228]

[28] Anamaria Costache, Nigel P. Smart,Srinivas Vivek, and Adrian Waller.Fixed-point arithmetic in SHE schemes. In SAC, volume 10532 of Lecture Notes in Computer Science, pages 401-422.Springer, 2016.

[0229]

[29] Jack L.H.Crawford, Craig Gentry, Shai Halevi, Daniel Platt, and Victor Shoup.Doing real work with fhe: The case of logistic regression. Cryptology ePrint Archive, Report 2018 / 202, 2018. https: / / eprint.iacr.org / 2018 / 202.

[0230]

[30] Crypto++ 5.6.0, pentium 4 benchmarks.https: / / www.cryptopp.com / benchmarks-p4.html, accessed February 2019,2009.

[0231]

[31] Ivan Damgard and Mads Jurik. A generalisation, a simplification and some applications of paillier’s probabilistic public-key system. In International Workshop on Public Key Cryptography, pages 119-136.Springer, 2001.

[0232]

[32] Whitfield Diffie and Martin Hellman. New directions in cryptography. IEEE transactions on Information Theory, 22(6):644-654, 1976.

[0233]

[33] Leo Ducas and Daniele Micciancio. FHEW: bootstrapping homomorphic encryption in less than a second.In EUROCRYPT (1), volume 9056 of Lecture Notes in Computer Science,pages 617-640.Springer, 2015.

[0234]

[34] Steven D Galbraith and Xibin Lin. Computing pairings using x-coordinates only. Designs, Codes and Cryptography, 50(3):305-324, 2009.

[0235]

[35] Nicholas Genise, Craig Gentry, Shai Halevi, Baiyu Li, and Daniele Micciancio.Homomorphic encryption for finite automata. Cryptology ePrint Archive, Report 2019 / 176, 2019. https: / / eprint.iacr.org / 2019 / 176.

[0236]

[36] Craig Gentry, Shai Halevi, Charanjit S. Jutla, and Mariana Raykova.Private database access with he-over-oram architecture. In ACNS, volume 9092 of Lecture Notes in Computer Science, pages 172-191.Springer, 2015.

[0237]

[37] Craig Gentry, Shai Halevi, Chris Peikert, and Nigel P. Smart. Field switching in BGV-style homomorphic encryption. Journal of Computer Security,21(5):663-684, 2013.

[0238]

[38] Craig Gentry, Shai Halevi, and Nigel P. Smart. Better bootstrapping in fully homomorphic encryption. In Public Key Cryptography - PKC 2012, volume 7293 of Lecture Notes in Computer Science, pages 1-16.Springer, 2012.

[0239]

[39] Craig Gentry, Shai Halevi, and Nigel Smart. Fully homomorphic encryption with polylog overhead. In "Advances in Cryptology - EUROCRYPT 2012", volume 7237 of Lecture Notes in Computer Science, pages 465-482.Springer, 2012. Full version at http: / / eprint.iacr.org / 2011 / 566.

[0240]

[40] Craig Gentry, Shai Halevi, and Nigel Smart. Homomorphic evaluation ofthe AES circuit. In "Advancesin Cryptology - CRYPTO 2012", volume 7417 of Lecture Notes in Computer Science, pages 850-867.Springer, 2012.Full version at http: / / eprint.iacr.org / 2012 / 099.

[0241]

[41] Craig Gentry and Shai Halevi. Fully homomorphic encryption without squashing using depth-3 arithmetic circuits. In Foundations of Computer Science(FOCS), 2011 IEEE 52nd Annual Symposium on, pages 107-109.IEEE, 2011.

[0242]

[42] Craig Gentry and Shai Halevi. Implementing gentry’s fully-homomorphic encryption scheme. In Advances in Cryptology - EUROCRYPT’11, volume6632 of Lecture Notes in ComputerScience, pages 129-148.Springer, 2011.

[0243]

[43] Craig Gentry, Amit Sahai, and Brent Waters. Homomorphic encryption from learning with errors: Conceptually-simpler, asymptotically-faster,attribute-based. In Ran Canetti and Juan A. Garay, editors, Advances in Cryptology - CRYPTO 2013, Part I, pages75-92.Springer, 2013.

[0244]

[44] Craig Gentry. How to compress rabin ciphertexts and signatures (and more). In Annual International Cryptology Conference, pages 179-200.Springer, 2004.

[0245]

[45] Craig Gentry. Fully homomorphic encryption using ideal lattices. In Proceedings of the41st ACM Symposium on Theory of Computing - STOC 2009, pages 169-178.ACM, 2009.

[0246]

[46] Ran Gilad-Bachrach, Nathan Dowlin, KimLaine, Kristin E. Lauter, Michael Naehrig, and John Wernsing. Cryptonets: Applying neural networks to encrypted data with high throughput and accuracy. In ICML, volume 48 of JMLR Workshop and Conference Proceedings, pages 201-210.JMLR.org, 2016.

[0247]

[47] Matthew Green, Susan Hohenberger, and Brent Waters. Outsourcing thedecryption of ABE ciphertexts. In20th USENIX Security Symposium, San Francisco, CA, USA, August 8-12, 2011,Proceedings.USENIX Association, 2011.

[0248]

[48] Shai Halevi and Victor Shoup. Algorithms in HElib. In CRYPTO (1), volume 8616 of LectureNotes in Computer Science, pages 554-571.Springer, 2014.

[0249]

[49] Shai Halevi and Victor Shoup. Bootstrapping for HElib. In EUROCRYPT (1), volume 9056 of Lecture Notes in Computer Science, pages 641-670.Springer, 2015.

[0250]

[50] Shai Halevi and Victor Shoup. HElib - An Implementation of homomorphic encryption. https: / / github.com / shaih / HElib / , AccessedSeptember 2014.

[0251]

[51] Shai Halevi. Homomorphic encryption. In Tutorials on the Foundations of Cryptography, pages 219-276.Springer International Publishing, 2017.

[0252]

[52] Ryo Hiromasa, Masayuki Abe, and Tatsuaki Okamoto. Packing messages and optimizing bootstrapping in gsw-fhe. IEICE TRANSACTIONS on Fundamentals of Electronics, Communications and Computer Sciences, 99(1):73-82, 2016.

[0253]

[53] Yuval Ishai and Anat Paskin. Evaluating branching programs on encrypted data. In Theory of Cryptography Conference, pages 575-594.Springer, 2007.

[0254]

[54] Alhassan Khedr, P. Glenn Gulak, and Vinod Vaikuntanathan. SHIELD:scalable homomorphic implementation of encrypted data-classifiers. IEEE Trans.Computers, 65(9):2848-2858,2016.

[0255]

[55] Aggelos Kiayias, Nikos Leonardos,Helger Lipmaa, Kateryna Pavlyk, and Qiang Tang. Optimal rate private information retrieval from homomorphic encryption.Proceedings on Privacy Enhancing Technologies, 2015(2):222-243, 2015.

[0256]

[56] Miran Kim, Yongsoo Song, Shuang Wang,Yuhou Xia, and Xiaoqian Jiang.Secure logistic regression based on homomorphic encryption. Cryptology ePrint Archive, Report 2018 / 074,2018. https: / / eprint.iacr.org / 2018 / 074.

[0257]

[57] Demijan Klinc, Carmit Hazay, Ashish Jagmohan, Hugo Krawczyk, and Tal Rabin.On compression of data encrypted with block ciphers. arXiv:1009.1759 [cs.IT].

[0258]

[58] Eyal Kushilevitz and Rafail Ostrovsky. Replication is not needed: Single database, computationally-private information retrieval. In Foundations of Computer Science,1997.Proceedings., 38th Annual Symposium on, pages 364-373.IEEE, 1997.

[0259]

[59] Julian D. Laderman. A noncommutative algorithm formultiplying 3x3 matrices using 23 multiplications. Bull.Amer.Math.Soc., 82(1):126-128, 011976.

[0260]

[60] Helger Lipmaa and Kateryna Pavlyk. A simpler rate-optimal cpirprotocol. In International Conference on Financial Cryptography and Data Security, pages 621-638.Springer, 2017.

[0261]

[61] Adriana Lopez-Alt, Eran Tromer, and Vinod Vaikuntanathan. On-the-flymultiparty computation on the cloud via multikey fully homomorphic encryption. In STOC, pages 1219-1234, 2012.

[0262]

[62] Vadim Lyubashevsky, Chris Peikert, and Oded Regev. On ideal lattices andlearning with errors over rings.J. ACM, 60(6):43, 2013.Early version in EUROCRYPT 2010.

[0263]

[63] Vadim Lyubashevsky, Chris Peikert, and Oded Regev. A toolkit for ring-LWE cryptography. In Thomas Johansson and Phong Q. Nguyen, editors, Advances in Cryptology - EUROCRYPT 2013, pages35-54.Springer, 2013.

[0264]

[64] Daniele Micciancio and ChrisPeikert. Trapdoors for lattices:Simpler, tighter, faster, smaller.In EUROCRYPT, volume 7237 ofLecture Notes in Computer Science, pages 700-718.Springer, 2012.

[0265]

[65] Payman Mohassel and Yupeng Zhang. Secureml: A system for scalableprivacy-preserving machine learning.In 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA,USA, May 22-26, 2017, pages 19-38.IEEE Computer Society, 2017.

[0266]

[66] Michael Naehrig, Kristin Lauter, and Vinod Vaikuntanathan. Can homomorphic encryption be practical? In Proceedings of the 3rd ACM workshop on Cloud computing security workshop, pages 113-124.ACM, 2011.

[0267]

[67] Femi Olumofin and Ian Goldberg. Revisiting the computational practicality of private information retrieval. In International Conference on Financial Cryptography and Data Security, pages 158-172.Springer, 2011.

[0268]

[68] Emmanuela Orsini, Joop van de Pol, and Nigel P. Smart. Bootstrapping BGV ciphertexts with a wider choice of p and q. Cryptology ePrint Archive, Report 2014 / 408, 2014. http: / / eprint.iacr.org / .

[0269]

[69] Pascal Paillier. Public-key cryptosystems based on composite degree residuosity classes.In International Conference on the Theory and Applications of Cryptographic Techniques, pages 223-238.Springer, 1999.

[0270]

[70] Chris Peikert, Vinod Vaikuntanathan,and Brent Waters. A framework for efficient and composable oblivious transfer. In Advances in Cryptology - CRYPTO 2008,volume 5157 of Lecture Notes in Computer Science, pages 554-571.Springer, 2008.

[0271]

[71] Oded Regev. On lattices, learning with errors,random linear codes, and cryptography. J. ACM, 56(6):34:1-34:40, 2009.

[0272]

[72] Ronald L Rivest, Adi Shamir, and Leonard Adleman. A method for obtaining digital signatures and public-key cryptosystems. Communications of the ACM, 21(2):120-126,1978.

[0273]

[73] R. Rivest, L. Adleman, and M.Dertouzos. On data banks and privacy homomorphisms. In Foundations of Secure Computation, pages 169-177.Academic Press, 1978.

[0274]

[74] Kurt Rohloff and David B.Cousins. A scalable implementation of fully homomorphic encryption built on NTRU. 2nd Workshop on Applied Homomorphic Cryptography and Encrypted Computing, WAHC’14,2014. Available athttps: / / www.dcsec.uni-hannover.de / fileadmin / ful / mitarbeiter / brenner / wahc14_RC.pdf,accessed September 2014.

[0275]

[75] Markku-Juhani Olavi Saarinen. Ring-lwe ciphertext compression and error correction: Tools for lightweight post-quantum cryptography. In Proceedings of the 3rd ACM International Workshop on IoT Privacy, Trust, and Security, pages 15-22.ACM, 2017.

[0276]

[76] Patrick Schmid and Achim Roos. "aes-ni performance analyzed;limited to 32nm core i5 cpus". https: / / www.tomshardware.com / reviews / clarkdale-aes-ni-encryption,2538.html,accessed February 2019, 2010.

[0277]

[77] Radu Sion and Bogdan Carbunar. On the practicality of private information retrieval. In Proceedings of the Network and Distributed System Security Symposium, NDSS2007, San Diego, California, USA, 28th February - 2nd March 2007, 2007.

[0278]

[78] Nigel P. Smart and Frederik Vercauteren. Fully homomorphic SIMD operations. Des.Codes Cryptography,71(1):57-81, 2014. Early verion athttp: / / eprint.iacr.org / 2011 / 133.

[0279]

[79] Julien P Stern. A new and efficient all-or-nothing disclosure of secrets protocol. InInternational Conference on the Theory and Application of Cryptology andInformation Security, pages 357-371.Springer, 1998.

[0280]

[80] Marten van Dijk, Craig Gentry, Shai Halevi, and Vinod Vaikuntanathan.Fully homomorphic encryption over the integers. In Advances in Cryptology - EUROCRYPT 2010, 29th Annual International Conference on the Theory and Applications of Cryptographic Techniques, French Riviera, May 30 - June 3, 2010.Proceedings,pages 24-43, 2010.

[0281]

[81] Shuang Wang, Yuchen Zhang, Wenrui Dai,Kristin Lauter, Miran Kim, Yuzhe Tang, Hongkai Xiong, and Xiaoqian Jiang. Healer: homomorphic computation of exactlogistic regression for secure rare disease variants analysis in gwas. Bioinformatics, 32(2):211-218,2016.

[0282]

[82] Chen Xu, Jingwei Chen, Wenyuan Wu, and Yong Feng. Homomorphically encrypted arithmetic operations over the integer ring. In Feng Bao, Liqun Chen, Robert H. Deng, and Guojun Wang, editors, Information Security Practice and Experience, pages 167-181, Cham, 2016. Springer International Publishing. https: / / ia.cr / 2017 / 387.

[0283] The present invention may be a system, a method, and / or a computer program product, which may include a computer-readable storage medium containing computer-readable program instructions for causing a processor to perform aspects of the present invention.

[0284] A computer-readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device, such as, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination thereof. A non-exhaustive list of more specific examples of computer-readable storage media includes portable floppy disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital versatile disk (DVD), memory sticks, floppy disks, mechanically encoded devices such as punch cards or ridge structures in grooves in which instructions are recorded, and any suitable combinations thereof. As used herein, computer-readable storage media should not itself be construed as being ephemeral signals such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., light pulses passing through a fiber optic cable), or electrical signals transmitted over wires.

[0285] The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to each computing / processing device or to an external computer or storage device over a network (e.g., the Internet, a local area network, a wide area network, and / or a wireless network). This network may include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. A network adapter card or network interface within each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage on a computer-readable storage medium within each computing / processing device.

[0286] Computer-readable program instructions for carrying out the operations of the present invention may be source or object code written in any combination of one or more programming languages, including assembler instructions, instruction-set-architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state-setting data, or object code, including object-oriented programming languages ​​such as Smalltalk, C++, and conventional procedural programming languages ​​such as the "C" programming language or similar programming languages. The computer-readable program instructions may execute entirely on the user's computer, partially on the user's computer as a standalone software package, partially on the user's computer and on a remote computer, or entirely on a remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be to an external computer (e.g., via the Internet using an Internet Service Provider). In some embodiments, to carry out aspects of the present invention, electronic circuitry including, for example, programmable logic circuits, field-programmable gate arrays (FPGAs), or programmable logic arrays (PLAs), may execute computer-readable program instructions to customize the electronic circuitry by utilizing state information of the computer-readable program instructions.

[0287] Aspects of the present invention are described herein with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, are implemented by computer-readable program instructions.

[0288] These computer-readable program instructions may be provided to a processor of a general-purpose computer, special-purpose computer, or other programmable data processing apparatus to create a machine, where the instructions, executed by the processor of the computer or other programmable data processing apparatus, create means for performing the functions / acts specified in the blocks of the flowcharts and / or block diagrams. These computer-readable program instructions may be stored on a computer-readable storage medium and capable of directing a computer, programmable data processing apparatus, or other device, or combination thereof, to function in a particular manner, such that the computer-readable storage medium on which the instructions are stored comprises an article of manufacture containing instructions that implement aspects of the functions / acts specified in the blocks of the flowcharts and / or block diagrams.

[0289] Computer-readable program instructions may be loaded into a computer, other programmable data processing apparatus, or other device such that the instructions, which execute on the computer, other programmable apparatus, or other device, perform the functions / acts specified in the flowchart and / or block diagram blocks, thereby causing a series of operable steps to be performed on the computer, other programmable apparatus, or other device to produce a computer-implemented process.

[0290] The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions, comprising one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions shown in the blocks may occur out of the order shown in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or in the reverse order, depending on the functionality involved. It should also be noted that each block in the block diagrams and / or flowchart diagrams, and combinations of blocks included in the block diagrams and / or flowchart diagrams, are implemented by a special-purpose hardware-based system that performs the specified function(s) or operation(s) or executes a combination of special-purpose hardware and computer instructions.

[0291] The present invention, according to preferred embodiments, is summarized by the following paragraphs. 1. Receiving, at a first computer system, from a second computer system, a request for specific information determined using data in a database on the first computer system, where the first computer system does not have a decryption key for decrypting the encrypted data or the encrypted request, and where at least a portion of the data is encrypted or the request is encrypted; and performing, by the first computer system, a compressible homomorphic encryption operation on the data in the database to determine one or more compressed ciphertexts corresponding to the specific information in the database, where the compressible homomorphic encryption operation 1. A method comprising: determining, by a first computer system to transmit a response to the request to a second computer system, the response including one or more compressed ciphertexts corresponding to the particular information requested; and transmitting, by the first computer system to a second computer system, a response to the request including one or more compressed ciphertexts corresponding to the particular information requested. 2. The method of claim 1, wherein the size of the compressed ciphertext can be made arbitrarily close to the size of the unencrypted data to which the compressed ciphertext corresponds by using a second compressed homomorphic encryption scheme. 3. The method of clause 2, wherein the second homomorphic encryption scheme is constructed so that the size of the compressed ciphertext can be arbitrarily close to the size of the plaintext to which the compressed ciphertext corresponds, and where, for any chosen ε, there exists an instance of the second homomorphic encryption scheme such that the size of the compressed ciphertext is (1 + ε) times the size of the corresponding plaintext. 4. The method of claim 1, wherein performing a compressible homomorphic encryption operation on the data by the first computer system further comprises performing partial compression on the data, the data including many-bit ciphertexts representing scalars in the ring of integers R, to compress the many-bit ciphertexts into a single ciphertext that encrypts a larger scalar in the ring of integers R. 5. Compressing the plurality of homomorphic ciphertexts into a single compressed ciphertext using a second homomorphic encryption scheme on the plurality of homomorphic ciphertexts;

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

number

Claims

1. encrypting the plaintext to produce encrypted data executed on a second computer system for transmission to the first computer system; transmitting the encrypted data from the second computer system to the first computer system, the first computer system not having a decryption key for decrypting the encrypted data; sending, by the second computer system, a request for specific information that can be determined using the encrypted data; receiving, at the second computer system, from the first computer system a response to the request, the response including one or more compressed ciphertexts corresponding to the particular information requested; decrypting, by the second computer system, the one or more compressed ciphertexts into corresponding plaintexts; decrypting the response, including the one or more compressed ciphertexts, using a private key to obtain a matrix including a redundant encoding of the plaintext and additional noise corresponding to the one or more compressed ciphertexts; and using the redundancy in the encoding to remove the noise and recover the plaintext corresponding to the one or more compressed ciphertexts. the redundant encoding of the plaintext comprises a matrix containing the plaintext multiplied by an integer greater than one.

2. The method of claim 1 , wherein the redundant encoding of the plaintext comprises a matrix containing the plaintext multiplied by an integer greater than one.

3. the secret key is a matrix of the form S=[S′|I], where S′ is a learning with errors (LWE) secret; The matrix containing the plaintext is the matrix [Equation 1] 3. The method of claim 2, wherein M is the plaintext, such that SM'=M.

4. 4. The method of claim 3, wherein the plaintext is an nxn matrix M, and the matrix M' is obtained from M by adding a number of zero rows equal to the dimension of the learning-with-errors (LWE) secret, where the dimension is denoted by k and n = n + k, such that the filled matrix M' has dimensions nxn.

Images