Cryptographic methods, systems, and services for evaluating real-valued functions on encrypted data.

Abstract

To provide cryptographic methods, systems and services for evaluating real-valued functions on encrypted data.SOLUTION: The invention relates to a cryptographic method based on homomorphic encryption enabling the evaluation of univariate or multivariate real-valued functions on encrypted data, in order to make it possible to carry out homomorphic processing on encrypted data more broadly and efficiently. The method is implemented in a digital form by at least one information processing system specially programmed to effectively and publicly transform a set of ciphertexts (corresponding to cleartexts x1, ..., xp) into a set of ciphertexts corresponding to a plurality of functions f1, ..., fq of the cleartexts.SELECTED DRAWING: Figure 1

Description

[Technical Field]

[0001] This invention relates to improving the homomorphic evaluation of one or more functions applied to pre-encrypted data. This technical field is based on recent cryptographic research and may have numerous applications in all areas of activity where confidentiality constraints exist (but not limited to those involving privacy, trade secrets, or medical data).

[0002] More specifically, the present invention relates to a method for enabling one or more specially programmed computer systems to automatically complete the computations required for homomorphic evaluation of one or more functions. Therefore, it is necessary to consider limited memory and computation time capacity, or, in the case of cloud computing-type remote processing, the transmission capacity known to the information processing system that needs to perform this type of evaluation.

[0003] As will be explained below, the development of homomorphic encryption methods has been largely hampered so far by technical constraints inherent in most of the schemes proposed in the literature, particularly in relation to the processing capacity of computers, in terms of the machine resources and supported computation time required to perform the various computational stages. [Background technology]

[0004] In fully homomorphic encryption (FHE), any participant can access a set of ciphertexts (plaintext x1, ..., x p (corresponding to) this participant does not need to access the plaintext itself to access a given function f(x1,…,x) of the plaintext p ) can be publicly converted into ciphertext corresponding to this. It is well known that such methods can be used to build protocols that comply with privacy standards: users can store encrypted data on a server and allow third parties to perform operations on the encrypted data without having to expose the data itself to the server.

[0005] The first fully homomorphic encryption scheme was finally proposed in 2009 by Gentry (who obtained U.S. Patent No. 8630422 in 2014 based on his first application in 2009); see also Craig Gentry, “Fully homomorphic encryption using ideal lattices,” 41st Annual ACM Symposium on Theory of Computing, pp. 169–178, ACM Press, 2009). Although Gentry's construction is no longer in use, one of the features introduced, “bootstrapping,” and in particular one of its implementations, has been widely used in subsequently proposed schemes. Bootstrapping is a technique used to reduce noise in ciphertext: in fact, all known FHE schemes contain a small amount of random noise in the ciphertext, necessary for security reasons. Performing operations on a noisy ciphertext increases the noise. After evaluating operations on a given number, this noise can become very high and potentially compromise the computation result. Therefore, while bootstrapping is fundamental to building homomorphic cryptography, this technique is very expensive in terms of memory usage or computation time.

[0006] Research following the release of Gentry aims to provide new schemes and improve bootstrapping to make homomorphic encryption truly feasible. The most famous constructs are DGHV [Marten van Dijk, Craig Gentry, Shai Halevi, and Vinod Vaikuntanathan, "Fully homomorphic encryption over the integers," Advances in Cryptology-EUROCRYPT2010, Lecture Notes in Computer Science, Vol. 6110, pp. 24-43, Springer, 2010], BGV [Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan, "(Levelled) fully homomorphic encryption without bootstrapping," ITCS2012; 3rd Innovations in Theoretical Computer Science, pp. 309-325, ACM Press, 2012], and GSW [Craig Gentry, Eds, Amit Sahai, and Brent Waters, "Homomorphic encryption from learning with errors: Conceptually simpler, asymptotically faster, Attribute-based," Advances in This is a variation of [Cryptology-CRYPTO2013, Part I, Lecture Notes in Computer Science, Vol. 8042, pp. 75-92, Springer, 2013]. While the execution of bootstrapping in the first Gentry method was not actually feasible (one lifetime was insufficient to complete the computation), the subsequently proposed construction made this operation feasible, although it is not very practical (each bootstrapping lasts for several minutes).In 2015, Ducas and Micciancio proposed a faster bootstrapping method that runs in a GSW-type manner [Leo Ducas and Daniele Micciancio, "FHEW: Bootstrapping homomorphic encryption in less than a second," Advances in Cryptology-EUROCRYPT2015, Part I, Lecture Notes in Computer Science, Vol. 9056, pp. 617-640, Springer, 2015]: the bootstrapping operation runs in just over 0.5 seconds. In 2016, Chillotti, Gama, Georgieva, and Izabachene proposed a new variation of the FHE scheme called TFHE [Iria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene, "Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds," Advances in Cryptology-ASIACRYPT2016, Part I, Lecture Notes in Computer Science, Vol. 10031, pp. 3-33, Springer, 2016]. Their bootstrapping technique has formed the basis for subsequent research.The research of Bourse et al. can be referenced [Florian Bourse, Micheles Minelli, Matthias Minihold, and Pascal Paillier, "Fast homomorphic evaluation of deep discretised neural networks," Advances in Cryptology-CRYPTO2018, Part III, Lecture Notes in Computer Science, Vol. 10993, pp. 483-512, Springer, 2018], Carpov et al. [Sergiu Carpov, Malika Izabachene, and Victor Mollimard, "New techniques for multi-value input homomorphic evaluation and applications," Topics in Cryptology-CT-RSA2019, Lecture Notes in Computer Science, Vol. 11405, pp. 106-126, Springer, 2019], Boura et al. [Christina Boura, Nicolas Gama, Mariya Georgieva, and Dimitar Jetchev, "Simulating homomorphic evaluation of deep learning [Predictions], Cyber ​​Security Cryptography and Machine Learning (CSCML2019), Lecture Notes in Computer Science, Vol. 11527, pp. 212-230, Springer, 2019 [and Chillotti et al.] [Ilaria Chillotti, Nicolas Gama, Mariya Georgieva and Malika Izabachene, "TFHE: Fast fully homomorphic encryption over the torus", Journal of Cryptology, 31(1), pp. 34-91, 2020]. The performance of TFHE is noteworthy. They have contributed to advances in research in this field and to making homomorphic encryption more practical.The proposed new technology allows bootstrapping to be calculated in milliseconds. [Prior art documents] [Patent Documents]

[0007] [Patent Document 1] U.S. Patent No. 8630422 [Non-patent literature]

[0008] [Non-Patent Document 1] Craig Gentry, "Fully homomorphic encryption using ideal lattices," 41st Annual ACM Symposium on Theory of Computing, pp. 169-178, ACM Press, 2009. [Non-Patent Document 2] Marten van Dijk, Craig Gentry, Shai Halevi, and Vinod Vaikuntanathan, "Fully homomorphic encryption over the integers", Advances in Cryptology-EUROCRYPT2010, Lecture Notes in Computer Science, volume 6110, pp. 24-43, Springer, 2010. [Non-Patent Document 3] Zvika Brakerski, Craig Gentry, and Vinod Vaikuntanathan, "(Leveled) fully homomorphic encryption without bootstrapping", ITCS2012;3rd Innovations in Theoretical Computer Science, pp. 309-325, ACM Press, 2012. [Non-Patent Document 4] Craig Gentry, Eds, Amit Sahai, and Brent Waters, "Homomorphic encryption from learning with errors: Conceptually simpler, asymptotically faster, attribute-based," Advances in Cryptology-CRYPTO2013, Part I, Lecture Notes in Computer Science, Vol. 8042, pp. 75-92, Springer, 2013. [Non-Patent Document 5] Leo Ducas and Daniele Micciancio, "FHEW: Bootstrapping homomorphic encryption in less than a second," Advances in Cryptology-EUROCRYPT2015, Part I, Lecture Notes in Computer Science, Vol. 9056, pp. 617-640, Springer, 2015. [Non-Patent Document 6] IIaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene, "Faster fully homomorphic encryption: Bootstrapping in less than 0.1 seconds," Advances in Cryptology-ASIACRYPT2016, Part I, Lecture Notes in Computer Science, Vol. 10031, pp. 3-33, Springer, 2016. [Non-Patent Document 7] Florian Bourse, Micheles Minelli, Matthias Minihold, and Pascal Paillier, "Fast homomorphic evaluation of deep discretised neural networks," Advances in Cryptology-CRYPTO2018, Part III, Lecture Notes in Computer Science, Vol. 10993, pp. 483-512, Springer, 2018. [Non-Patent Document 8] Sergiu Carpov, Malika Izabachene, and Victor Mollimard, "New techniques for multi-value input homomorphic evaluation and applications," Topics in Cryptology-CT-RSA2019, Lecture Notes in Computer Science, Vol. 11405, pp. 106-126, Springer, 2019. [Non-Patent Document 9] Christina Boura, Nicolas Gama, Mariya Georgieva, and Dimitar Jetchev, "Simulating homomorphic evaluation of deep learning predictions," Cyber ​​Security Cryptography and Machine Learning (CSCML2019), Lecture Notes in Computer Science, Vol. 11527, pp. 212-230, Springer, 2019. [Non-Patent Document 10] Ilaria Chillotti, Nicolas Gama, Mariya Georgieva, and Malika Izabachene, "TFHE: Fast fully homomorphic encryption over the torus," Journal of Cryptology, 31(1), pp. 34-91, 2020. [Non-Patent Document 11] Arey N. Kolmogorov, "On the representation of continuous functions of dynamic variables by superposition of continuous functions of one variable and addition", Dokl. Akad. Nauk SSSR, 114, pp. 953-956, 1957. [Non-Patent Document 12] David A. Sprecher, "On the structure of continuous functions of several variables," Transactions of the American Mathematical Society, 115, pp. 340-355, 1965. [Non-Patent Document 13] Pierre-Emmanuel Leni, Yohan Fougerolle, and Frederic Truchetet, "Komogorov superposition theory and its application to the decomposition of multivariate functions," MajecSTIC'08, October 29-31, 2008, Marseille, France, 2008. [Non-Patent Document 14] BF Logan and LA Shepp, "Optimal reconstruction of a function from its projections," Duke Mathematical Journal, 42(4), pp. 645-659, 1975. [Non-Patent Document 15] Allan Pinkus, "Approximating by ridge functions," in A. Le Mehaute, C. Rabut, and LL. Schumaker (Eds.), *Surface Fitting and Multiresolution Methods*, pp. 279–292, Vanderbilt University Press, 1997. [Non-Patent Document 16] Jerome H. Friedman and Werner Stuetzle, "Projection pursuit regression," Journal of the American Statistical Association, 76(376), pp. 817-823, 1981. [Non-Patent Document 17] DS Broomhead and David Lowe, "Multivariable functional interpolation and adaptive networks," Complex Systems, 2, pp. 321-355, 1988. [Non-Patent Document 18] Oded Regev, “On lattices, learning with errors, random linear codes, and cryptography,” 37th Annual ACM Symposium on Theory of Computing, pp. 84-93, ACM Press, 2005. [Non-Patent Document 19] Damien Stehle, Ron Steinfeld, Keisuke Tanaka, and Keita Xagawa, "Efficient public key encryption based on ideal lattices," Advances in Cryptology-ASIACRYPT2009, Lecture Notes in Computer Science, Vol. 5912, pp. 617-635, Springer, 2009. [Non-Patent Document 20] Vadim Lyubashevsky, Chris Peikert, and Oded Regev, "On ideal lattices and learning with errors over rings," Advances in Cryptology-EUROCRYPT2010, Lecture Notes in Computer Science, Vol. 6110, pp. 1-23, Springer, 2010. [Non-Patent Document 21] Ron Rothblum, "Homomorphic encryption: From private-key to public-key," Theory of Cryptography (TCC2011), Lecture Notes in Computer Science, Vol. 6597, pp. 219-234, Springer, 2011. [Non-Patent Document 22] David A. Sprecher, "A implementation numerical of Kolmogorov's superpositions," Neural Networks, 9(5), pp. 765-772, 1996. [Non-Patent Document 23] David A. Sprecher, "A implementation numerical of Kolmogorov's superpositions II," Neural Networks, 10(3), pp. 447-457, 1997. [Non-Patent Document 24] Juergen Braun and Michael Griebel, "On a constructive proof of Kolmogorov's superposition theorem," Constructive Approximation, 30(3), pp. 653-675, 2007. [Overview of the project] [Problems that the invention aims to solve]

[0009] Despite the progress achieved, known computational procedures that can publicly convert a set of ciphertexts (corresponding to plaintexts x1,…,x p ), corresponding to a given function f(x1,…,x p ) of the plaintexts into ciphertexts corresponding to the given function are limited to a few examples or remain impractical. In fact, the current main general means is to represent this function in the form of a Boolean circuit composed of AND, NOT, OR, or XOR type logic gates, and then to evaluate this circuit homomorphically with the ciphertexts of the bits representing the inputs (plaintexts) of the function f as inputs. A measure of the complexity of a Boolean circuit is its multiplicative depth, defined as the maximum number of consecutive AND gates that need to be calculated to obtain the calculation result. In order to continuously control the noise during this calculation, it is necessary to perform the bootstrapping operation regularly during its progress. As shown above, even using the latest technology, these bootstrapping operations involve complex calculations and have a large multiplicative depth, so the overall calculation becomes even slower. This approach operates on binary inputs and is only executable for functions with simple Boolean circuits.

[0010] Generally, the function to be evaluated takes one or more real variables x1,…,x p as inputs. There can even be some functions f1,…,f q evaluated over a set of real variables. Therefore, there is great technical and economic interest in finding a way to quickly execute the aforementioned operation of publicly converting a set of ciphertexts (corresponding to plaintexts x1,…,x p ) into a set of ciphertexts corresponding to multiple real-valued functions f1,…,f q of the plaintexts without mobilizing overly large computational means. In fact, the theoretical progress made by Gentry in 2009 has not led to any known practical implementation to date because there is no effective solution to this technical problem. The present invention provides a response to this problem.

Means for Solving the Problem

[0011] This application relates to a set of ciphertexts (plaintexts x1,…,x p(corresponding to) multiple functions f1, ..., f in plain text q This describes a set of methods intended to be executed digitally by at least one information processing system specifically programmed to effectively and publicly convert a set of ciphertexts corresponding to a given set. This new method involves multivariable functions f1,…,f q This is transformed into a form that combines the summation and composition of multivariable functions. Preferably, functions f1, ..., f q The intermediate values ​​obtained from the transformation are reused in the evaluation. Finally, each of the single-variable functions is preferably represented in tabular form rather than in the usual form of a Boolean circuit.

[0012] Notably, any multivariable function defined in real numbers and possessing real values ​​is supported. Entries undergo pre-encoding to ensure compatibility with the native space of the underlying cryptographic algorithm's message. Decryption can also be applied to the image of the function under consideration in its output after decryption.

[0013] The techniques implemented in this invention can be considered independently or in combination, and apply to multiple functions f1, ..., f while significantly reducing complexity and the computation time required. q The technical effect of the present invention is significant because it enables the evaluation of the results. As described below, this weight reduction stems from several facts, in particular: (i) the multivariable function to be evaluated is transformed into a single-variable function rather than directly acting on a function of several variables; (ii) these functions can be decomposed so as to share the results of intermediate calculations rather than performing individual evaluations; and (iii) the resulting single-variable function is represented in a table rather than a Boolean circuit.

[0014] The function f is a function of several variables x1, ..., x pWhen given, the method according to the present invention transforms the function f as a combination of summation and composition of single-variable functions. Note that these two operations, summation and composition of single-variable functions, can represent affine transformations or linear combinations. By analogy with neural networks, the expression "network of single-variable functions" is used to refer to the representation when the transformation from multivariable to single-variable is complete, combining the summation and composition of single-variable functions, and this network is homomorphically evaluated with multiple encrypted values. The transformation may be exact or approximate; however, note that an exact transformation is an error-free approximation. In practice, the network thus obtained is characterized by being shallower in depth compared to a Boolean circuit that implements the same function. Next, using this new representation of the function f, the encrypted input E(encode(x1)),…,E(encode(x p Evaluate the function f in type E(encode(z), where E is the encryption algorithm and encode is the encoding function, and thus you get type E(encode(z k Starting from the input of )), several single-variable functions g j The type E(encode(g j (z k The calculation of ))) can be completed, and here, z k These are intermediate results. These calculations utilize the homomorphic properties of encryption algorithms.

[0015] It is interesting that when the same network of single-variable functions is reused several times, it is not necessary to redo all the computational steps. Therefore, according to the present invention, the first step is to pre-computate the network of single-variable functions; it is then homomorphically evaluated against encrypted data in a subsequent step.

[0016] The fact that any continuous multivariable function can be written as a sum and composition of single-variable functions was demonstrated by Kolmogorov in 1957 [Arey N. Kolmogorov, "On the representation of continuous functions of dynamic variables by superposition of continuous functions of one variable and addition," Dokl. Akad. Nauk SSSR, 114, pp. 953-956, 1957].

[0017] This result remained theoretical for a long time, but an algorithmic version was discovered, particularly by Sprecher, who proposed an algorithm that explicitly describes a method for constructing single-variable functions [David A. Sprecher, "On the structure of continuous functions of several variables," Transactions of the American Mathematical Society, 115, pp. 340-355, 1965]. A detailed explanation can be found, for example, in the following article [Pierre-Emmanuel Leni, Yohan Fougerolle, and Frederic Truchetet, "Komogorov superposition theory and its application to the decomposition of multivariate functions," MajecSTIC'08, October 29-31, 2008, Marseille, France, 2008]. Furthermore, it should be noted that the assumption of continuity of the decomposed function can be relaxed by considering the latter approximation.

[0018] Another possible approach is to approximate the multivariable function by the sum of certain multivariable functions called ridge functions, in English terminology [BF Logan and LA Shepp, "Optimal reconstruction of a function from its projections," Duke Mathematical Journal, 42(4), pp. 645-659, 1975]. For a real-valued variable vector x = (x1, ..., x p The Ridge function of this variable vector is the real parameter vector a=(a1,…,a p This is a function applied to the scalar product of ) and, that is, of type g a (x) is a function of the form g(a·x), where g is a single variable. As previously mentioned, scalar products or equivalent linear combinations are specific cases of combinations of summations and compositions of single-variable functions; the decomposition of multivariable functions in the form of summations of ridge functions forms an embodiment of the multivariable-to-single-variable transformation according to the present invention. It is known that any multivariable function can be approximated with as much accuracy as necessary by a summation of ridge functions, provided that the number of ridge functions can be increased [Allan Pinkus, "Approximating by ridge functions," A. Le Mehaute, C. Rabut, and LL Schumaker (Eds.), Surface Fitting and Multiresolution Methods, pp. 279–292, Vanderbilt University Press, 1997]. These mathematical results gave rise to a statistical optimization method known as projection pursuit [Jerome H. Friedman and Werner Stuetzle, "Projection pursuit regression," Journal of the American Statistical Association, 76(376), pp. 817-823, 1981].

[0019] g instead of ridge function aIt is also possible to use so-called radial functions of the form (x)=g(||xa||) [DS Broomhead and David Lowe, "Multivariable functional interpolation and adaptive networks," Complex Systems, 2, pp. 321-355, 1988], and other families of basic functions can be used with similar approximation quality (convergence rate).

[0020] In some cases, a formal decomposition is possible without going through Kolmogorov's theorem or one of its algorithmic versions (such as Sprecher's), or without going through ridge functions, radial functions, or variations thereof. For example, the function g(z1,z2)=max(z1,z2) (in particular, functioning as the so-called "maximum pooling" layer used in neural networks) can therefore be decomposed as follows: max(z1,z2)=z2+(z1-z2) + Here,

number

number

[0021] Functions f, ..., f q Given data, each of which is intended to be represented by a network of single-variable functions and then homomorphically evaluated with the encrypted data, this evaluation can be performed in an optimized manner if one or more of these single-variable functions are reused. Thus, for each of the redundancies observed in the set of single-variable functions of the network, some of the steps of homomorphic evaluation of the single-variable functions with respect to the encrypted values ​​need to be performed only once. Since this function homomorphism is usually performed on the fly and is known to be very resource-intensive, sharing intermediate values ​​results in a significant performance gain.

[0022] The following three types of optimization are possible:

[0023] Same function, Do argument When the number of single-variable functions is equal, this optimization prioritizes the network of single-variable functions that repeats the same single-variable function applied to the same argument the most times. In fact, whenever a single-variable function and the input it evaluates to are the same, it is not necessary to recalculate the homomorphic evaluation of this single-variable function for that input.

[0024] Different functions, same arguments This optimization applies embodiments that can share a large portion of the computation when homomorphic evaluations of two or more single-variable functions for the same input can be performed essentially at the expense of a single homomorphic evaluation. The aforementioned CT-RSA 2019 article discusses a similar situation under the name of the multi-output version. Examples of such embodiments are shown in the section “Modes for Carrying Out the Invention”. In the case of multiple variables, this situation is, for example, when the coefficients of the decomposition (a ik When ) is fixed, it appears in the form of a sum of ridge or radial functions of several multivariable functions.

[0025] The same function, differing only in its non-zero addition constant argument. Another situation in which computation can be sped up is when the same single-variable function is evaluated for arguments whose differences are known. This occurs, for example, when Kolmogorov-type decompositions, particularly the approximation algorithm version of Sprecher, are used. In this situation, the decomposition includes a so-called "internal" single-variable function; see, in particular, the application to the internal function Ψ in the "Modes for Carrying Out the Invention" section. The additional cost in the latter case is minimal.

[0026] These optimizations involve several functions f1, ..., f qThese apply when it is necessary to evaluate them, but they also apply when there is only one function to evaluate (q=1). In all cases, it is interesting to prefer different functions for the same argument, or the same function for arguments that differ only by an additive constant, in order to reduce the cost of evaluation as well as create a reduced number of single-variable functions. This property is unique to networks of single-variable functions when the network evaluates homomorphically with encrypted inputs.

[0027] Regardless of whether the function to be evaluated according to the present invention is multivariable and formed through the first step described above, or whether it is intended to process an original single-variable function, the present invention provides a way to perform homomorphic evaluation of these single-variable functions, and in favorable variations, a tabular representation is used for this purpose.

[0028] The homomorphic evaluation of single-variable functions, or more generally, the homomorphic evaluation of combinations of single-variable functions, is based on homomorphic cryptography.

[0029] The LWE (Learning With Errors) problem, introduced by Regev in 2005 [Oded Regev, "On lattices, learning with errors, random linear codes, and cryptography," 37th Annual ACM Symposium on Theory of Computing, pp. 84-93, ACM Press, 2005], enables the construction of homomorphic encryption schemes on a large number of algebraic structures. Typically, an encryption scheme includes an encryption algorithm E and a decryption algorithm D, where c=E(μ) is an encryption of plaintext μ, and D(c) returns the plaintext μ. The LWE problem and encryption algorithms derived from its variations have the peculiarity of introducing noise into the ciphertext. This is called the native space of the plaintext, which takes noise into account, in order to show the space of plaintext where the encryption algorithm is defined and the decryption of the ciphertext is the first plaintext. For a cryptographic algorithm E having M as the native space of plaintext, it should be noted that the encoding function `encode` is a function that brings elements of any set into the set M or a subset thereof; preferably, this function is injective.

[0030] As detailed in the aforementioned article by Chillotti et al. (ASIACRYPT2016), a real torus modulo 1

number

number

number

number

number

number

number

number

[0031] In the same article, the author

number

number

number

number

number

number

number

number

number

[0032]

number

number

number

number

number

number

number

number

number

number

[0033] Finally, this same article from ASIACRYPT2016 introduces the outer product between RLWE type ciphertexts and RGSW type ciphertexts (an abbreviation for Gentry-Sahai-Waters, where "R" stands for ring). It should be recalled that the RLWE type encryption algorithm gives rise to the RGSW type encryption algorithm. The notation from the previous paragraph is used. For an integer l≧1, Z is

number

[0034]

number

number

number

number

number

number

number

number

number

number

number

[0035] As shown, the aforementioned schemes are so-called symmetric encryption schemes or private-key encryption schemes. This is by no means a limitation, because, as Rothblum shows [Ron Rothblum, "Homomorphic encryption: From private-key to public-key," Theory of Cryptography (TCC2011), Lecture Notes in Computer Science, Vol. 6597, pp. 219-234, Springer, 2011], any additive homomorphic private-key encryption scheme can be converted to a public-key encryption scheme.

[0036] As recalled above, bootstrapping refers to a method that makes it possible to reduce any noise that may be present in the ciphertext. In his aforementioned STOC2009 founding article, Gentry implements bootstrapping with a technique now commonly called "re-encryption," which was introduced therein. Re-encryption involves homomorphically evaluating a decryption algorithm in an encrypted domain. In the plaintext domain, the decryption algorithm takes a ciphertext C and a secret key K as input and returns the corresponding plaintext x. In the encrypted domain, using a homomorphic encryption algorithm E and an encoding function encode, the evaluation of the decryption algorithm takes the ciphertext of the encryption of C and the ciphertext of the encryption of K, E(encode(C)) and E(encode(K)) as input, and thus, under the encryption key of algorithm E, gives a new ciphertext of the encryption of the same plaintext, E(encode(x)). Thus, even assuming that the ciphertext is given as the output of the homomorphic encryption algorithm E does not form a restriction, as it allows the re-encryption technique to end in this case.

[0037] Due to the homomorphism properties of LWE-type encryption schemes and their variants, the plaintext can be computed by performing operations on the corresponding ciphertext. The domain of the definition of the single-variable function f being evaluated is discretized into several intervals that cover the domain of that definition. Each interval is for the value x i and the function f(x i It is represented by the corresponding value of (x). Therefore, the function f is, i ,f(x i It is aggregated by a series of pairs of the form )). These pairs are actually used to homomorphize the ciphertext of f(x), or an approximation starting from the ciphertext of x, for any value of x within the domain of the function's definition.

[0038] At the heart of this invention lies a novel, general technique that combines bootstrapping and encoding. Several embodiments are described in the "Modes for Carrying Out the Invention" section.

[0039] The homomorphism assessment techniques described in the aforementioned ASIACRYPT2016 article, and the techniques introduced in the subsequent research mentioned above, cannot perform homomorphic evaluation of arbitrary functions in arbitrary domains. Firstly, they are strictly limited to single-variable functions. No correspondence for multi-variable cases is known in the prior art. Furthermore, in the single-variable case, the prior art assumes conditions regarding the input values ​​or the function being evaluated. Among these limitations, note, for example, inputs restricted to binary values ​​(bits) and the necessary negative cyclic properties of the function being evaluated (e.g., verified by the "sign" function of a torus). General handling of input or output values ​​that would allow us to end up in these specific cases is not described in the prior art for functions with arbitrary real values.

[0040] Conversely, the implementation of the present invention enables homomorphic evaluation of functions with real-valued variables in their input, which are real-valued LWE-type ciphertexts, regardless of the domain of the function's form or definition, while allowing for noise control (boosting) in the output. [Brief explanation of the drawing]

[0041] [Figure 1] This diagram schematically replicates the first two steps. [Figure 2] As an example, this figure shows the case where p=2. [Figure 3] This figure shows a single-variable function f of a real-valued variable that has arbitrary precision in the domain of definition D and real values ​​in image I. [Modes for carrying out the invention]

[0042] This invention relates to a method by which at least one specially programmed information processing system processes encrypted data using one or more real-valued variables to perform one or more functions f1, ..., f q This enables the evaluation to be performed digitally, with each function being a real variable x1, ..., x p It takes multiple real variables as input from among them.

[0043] When at least one of the functions takes at least two variables as input, the method according to the present invention comprises, in general terms, three steps: 1. The so-called pre-computation step involves transforming each of the aforementioned multivariable functions into a network of single-variable functions composed of a sum and composition of single-variable real-valued functions. 2. In the pre-computed single-variable function network, the so-called pre-selection step involves identifying different types of redundancy and selecting all or some of them. 3. A so-called homomorphic evaluation step for each of the pre-computed networks of single-variable functions, in which the redundancy selected in the pre-selection step is evaluated in an optimized manner.

[0044] Regarding the second step (pre-selection), the selection of all or some redundancy is not solely driven by the objective of optimizing the digital processing of homomorphic evaluation, whether it is for the benefit in terms of computation time or for availability reasons such as memory resources for storing intermediate calculation values.

[0045] Figure 1 schematically replicates the first two steps as implemented in accordance with the present invention by a computer system programmed for this purpose.

[0046] Therefore, in one embodiment of the present invention, one or more multivariable real-valued functions f1, ..., f q This is an evaluation of each function, where each function is a variable x1, ..., x p From among these, multiple real-valued variables are taken as input, and at least one of the functions takes at least two variables as input, input x i , E(encode(x i The ciphertexts of each of the following encryptions are taken as input, where 1 ≤ i ≤ p, and f1, ..., f are applied to each of these inputs. q The function returns multiple ciphertexts of the encryption, where E is a homomorphic encryption algorithm, and encodes the elements of the native space of the plaintext of E into real numbers x. iOne or more multivariable real-valued functions f1, ..., f are encoding functions associated with each of them. q The rating is: 1. A pre-computation step which involves transforming each of the aforementioned multivariable functions into a network of single-variable functions composed of a sum and composition of single-variable real-valued functions. 2. In the network of pre-computed single-variable functions, there are three types a. The same single-variable function applied to the same argument, b. Different single-variable functions applied to the same argument, c. The same single-variable function applied to arguments that differ only by a non-zero addition constant, The pre-selection step involves identifying one of the redundancies and selecting all or part of it. 3. Steps for evaluating each homomorphic evaluation of the pre-computed network of single-variable functions, in which the redundancy selected in the pre-selection step is evaluated in an optimized manner. This is a possible characteristic.

[0047] Regarding the pre-computation step, by an explicit version of Kolmogorov's superposition theorem, the identity hypercube Ip=[0,1] of dimension p is obtained. p Any continuous function defined in

number

number

number

number

[0048] As an example, Figure 2 shows the case where p=2.

[0049] Functions Ψ and ξ are so-called "internal" functions and are independent of a given arity f. Function Ψ is I p The real vector (x1, ..., x p Any component x of ) i Associate the values ​​[0,1] with the function ξ. p )∈I p The numerical values ​​in the interval [0,1]

number

[0050] Sprecher proposed algorithms for determining the intrinsic and extrinsic functions in [David A. Sprecher, "A numerical implementation of Kolmogorov's superpositions," Neural Networks, 9(5), pp. 765-772, 1996] and [David A. Sprecher, "A numerical implementation of Kolmogorov's superpositions II," Neural Networks, 10(3), pp. 447-457, 1997], respectively.

[0051] Instead of the function Ψ originally defined by Sprecher to construct ξ (which is discontinuous for some input values), one can use the function Ψ defined in [Jurgen Braun and Michael Griebel, "On a constructive proof of Kolmogorov's superposition theorem," Constructive Approximation, 30(3), pp. 653–675, 2007].

[0052] When the internal functions Ψ and ξ are fixed, the external function g k The remaining task is to determine (depending on function f). For this purpose, Sprecher uses the external function g. k The r function converges toward

number

number

number

number

number

[0053] Therefore, in one embodiment of the present invention, the pre-calculation step is f1, ..., f q at least one function f from among jRegarding the conversion of the pre-calculation step,

number

number

[0054] Multivariable function f(x1,…,x p Another technique for breaking down ) is transformation

number

[0055] Therefore, decomposition is an approximation in the general case, and its purpose is to identify the best approximation, or an approximation of sufficient quality. This approximation appears in literature specializing in statistical optimization as projection tracking. As mentioned above, the notable result is that any function f can be approximated by this method with arbitrary accuracy. However, in practice, f generally allows for an exact decomposition, that is, it can be analytically expressed in the form of a sum of ridge functions for all or part of its inputs.

[0056] function f jWhen taking a subset of t variables from {x1,…,x p} as input, these variables are j1,…,j t ∈{1,…,p} and

Number

Number

Number

[0057] Therefore, in one embodiment of the present invention, in the precomputation stage, for at least one function f q from f1,…,f j , the conversion of the precomputation step is

Number

[0058] Similar decomposition techniques using the same statistical optimization tools are not ridge functions, but ​ It is applied using a radial function that follows the formula x=(x1,…,x p ), a k =( a 1,k ,…,a p,k ) is used, where vector a k is the coefficient a i , k It has real numbers as, where g k is a single-variable function defined by real numbers, and has real values, and the function g k and the coefficient a i , k This is determined by f, given a given parameter K and a given norm ||·||. Typically, the Euclidean norm is used.

[0059] function f j The input is {x1, ..., x} for t≦p. p When we take a subset of t variables in}, j1, ..., j t Using ∈{1,…,p}, these variables

number

number

number

[0060] Therefore, in one embodiment of the present invention, the pre-calculation step is performed by f1, ..., f q at least one function f from among them j Regarding the conversion of the pre-calculation step,

number

number

[0061] As shown in the aforementioned Pinkus article, another important class of function decomposition is the coefficient a i , k When g is fixed, the function g k is a variable. This class applies to decompositions of both ridge function forms and radial function forms. Several methods are known to solve this problem, including the von Neumann algorithm, the cyclic coordinate algorithm, the Schwarz domain decomposition method, the Dilibert-Strauss algorithm, and variations found in specialized literature on tomography; see the same Pinkus article and its references.

[0062] Therefore, in one particular embodiment of the present invention, this pre-calculation step is performed using coefficient a i , k It is further characterized by the fact that it is fixed.

[0063] In some cases, the transformation of the pre-computation step can be precisely performed by the equivalent formal representation of a multivariable function.

[0064] Consider the multi-variable function g. When this function g calculates the maximum value of z1 and z2, g(z1, z2) = max(z1, z2), the formal equivalence max(z1, z2) = z2 + (z1 - z2) + can be used, where [Number] is a single-variable function [Number] corresponds to. Using this formal equivalence, other formal equivalences of the function max(z1, z2) can be easily obtained. As an example, (z1 - z2) + is [Number] can be expressed in an equivalent way, so the formal equivalence max(z1, z2) = (z1 + z2 + |z1 - z2|) / 2 is obtained, where [Number] is the single-variable function "absolute value", where [Number] is the single-variable function "division by 2".

[0065] Generally, for three or more variables z1,…,z m in the case of, for any i satisfying 1 ≤ i ≤ m - 1, max(z1,…,z i ,z i+1 ,…,z m ) = max(max(z1,…,z<00001​​​​​​​​​​​​Therefore, in one embodiment of the present invention, the pre-calculation step is formally equivalent to max(z1,z2)=z2+(z1-z2) in the transformation of this pre-calculation step. + Use the function

number

[0067] In certain embodiments of the present invention, this pre-calculation step is further characterized in that, when a multivariable function includes three or more variables, a formal equivalence is obtained for the function from iterative formal equivalences for two variables.

[0068] Similarly, in the case of the "minimum" function g(z1,z2)=min(z1,z2), the formal equivalent is min(z1,z2)=z2+(z1-z2). - You can use it here

number

number

[0069] Therefore, in one embodiment of the present invention, the pre-calculation step is formally equivalent to min(z1,z2)=z2+(z1-z2) in the transformation of this pre-calculation step. - Use the function

number

[0070] In certain embodiments of the present invention, this pre-calculation step is further characterized in that, with respect to the function, when the latter includes three or more variables, a formal equivalence is obtained from iterating formal equivalences for two variables.

[0071] Another very useful multivariable function that can be easily formally decomposed into a combination of sums and compositions of single-variable functions is multiplication. In the first embodiment, for g(z1,z2)=z1×z2, the formal equivalent is z1×z2=(z1+z2) 2 / 4-(z1-z2) 2 This involves using / 4, a single-variable function.

number

number

[0072] Therefore, in one embodiment of the present invention, the pre-calculation step is such that the transformation of this pre-calculation step is formally equivalent to z1 × z2 = (z1 + z2) 2 / 4-(z1-z2) 2 Using / 4, function

number

[0073] These embodiments show z1 × … × z for 1 ≤ i ≤ m-1. i ×z i+1 ×…×z m =(z1 × ... × z i )×(z i+1 ×…×z m By observing this, it can be generalized to an m-variable function for m≧3.

[0074] In certain embodiments of the present invention, this pre-calculation step is further characterized in that, with respect to the function, when the latter includes three or more variables, a formal equivalence is obtained from iterating formal equivalences for two variables.

[0075] The second embodiment is a single-variable function

number

number

number

number

number

number

[0076] Therefore, in one embodiment of the present invention, the pre-calculation step is performed by transforming this pre-calculation step using the formal equivalent |z1×z2|=exp(ln|z1|+ln|z2|) and the function as a combination of summation and composition of single-variable functions.

number

[0077] In certain embodiments of the present invention, this pre-calculation step is further characterized in that, with respect to the function, when the latter includes three or more variables, a formal equivalence is obtained from iterating formal equivalences for two variables.

[0078] As mentioned above, a multivariable function given as input is transformed into a network of multivariable functions. Such a network is not necessarily unique, even if the transformation is accurate.

[0079] As an example, the multivariable function max(x1,x2) as shown above, that is, max(x1,x2) = x2 + (x1 - x2) + And we have seen at least two decompositions of max(x1,x2)=(x1+x2+|x1-x2|) / 2. Specifically, each of these transformations can proceed in detail as follows:

[0080] 1. max(x1,x2)=x2+(x1-x2) + Assuming z1 = x1 - x2, g1(z) = z + Define. We write max(x1,x2)=x2+g1(z1).

[0081] 2.max(x1,x2)=(x1+x2+|x1-x2|) / 2 Assume z1 = x1 - x2 and z2 = x1 + x2. We define g1(z)=|z| and g2(z)=z / 2. Let z3 = z2 + g1(z1) and write max(x1, x2) = g2(z3).

[0082] Generally, two types of operations are observed in a network of single-variable functions: summation and evaluation of single-variable functions. When the network evaluation is performed homomorphically with respect to encrypted values, the most costly operation is the evaluation of single-variable functions, which usually involves a bootstrapping step. Therefore, it is interesting to construct a network of single-variable functions that minimizes these single-variable function evaluation operations.

[0083] Therefore, in the previous example, the first transformation of the "maximum" function is [max(x1,x2)=x2+(x1-x2)] + This is the evaluation of a single-variable function, i.e., the function g1(z)=z + It appears to be more advantageous because only the evaluation of is needed. In practice, the difference is inconspicuous because the second single-variable function of the second transformation does not actually need to be evaluated; all that is needed is to return 2max(x1,x2)=x1+x2+|x1-x2| or to integrate this factor into the decoding function of the output. In general, single-variable functions that are multiplications by a constant can be ignored by (i) computing a multiple of the starting function, or (ii) absorbing the constant by composition if these functions are in the input of another single-variable function. For example, the multivariable function sin(max(x1,x2)) can be written as follows:

[0084] 1.sin(max(x1,x2))=sin(x2+(x1-x2) + ) Assuming z1 = x1 - x2, g1(z) = z + Define. Define g2(z) = sin(z).

[0085] 2. Write sin(max(x1,x2))=g2(z2) for z2=x2+g1(z1). sin(max(x1,x2))=sin((x1+x2+|x1-x2|) / 2) Assume z1 = x1 - x2 and z2 = x1 + x2. We define g1(z)=|z| and g2(z)=sin(z / 2).

[0086] 3. Write sin(max(x1,x2))=g2(z3) using z3=z2+g1(z1). (In the second case, by the function g2(z)=sin(z / 2)

number

[0087] Apart from single-variable functions of type g(z) = z + a (addition of a constant a) or type g(z) = az (multiplication by a constant a), the evaluation of single-variable functions can be fast in other situations.

[0088]

number

number

[0089] Three types of optimization are considered:

[0090] 1) Same function, same argument: g k =g k’ and

Number

Number

Number

Number

[0091] 2) Different functions, same argument: g k ≠g<​​​​​​​​​​​​​​​​​​​​​+ +exp(ln|x1|+ln|x2|) Assuming z1 = x1 - x2, g1(z) = z + define Define g2(z)=ln|z| and g3(z)=exp(z). Using z2 = g2(x1) + g2(x2), write max(x1, x2) + |x1 × x2| = x2 + g1(z1) + g3(z2). b.max(x1,x2)+|x1×x2|=x2+(x1-x2) + +|(x1+x2) 2 / 4-(x1-x2) 2 / 4| Assuming z1 = x1 - x2, g1(z) = z + define Let z2 = x1 + x2, then g2(z) = z 2 Define / 4 and g3(z)=|z| Using z3 = g2(z2) - g2(z1), we write max(x1, x2) + |x1 × x2| = x2 + g1(z1) + g3(z3).

[0093] The two embodiments described above include evaluations of four single-variable functions. However, the second embodiment includes two single-variable functions for the same argument, namely g1(z1) and g2(z1), with g1(z1) taking precedence.

[0094] The sharing of single-variable functions for the same arguments is not limited to transformations performed by equivalent formal representations. This also applies to digital transformations.

number

number

number

[0095] In this construction, the so-called "internal" functions Ψ and ξ are independent of f for a given domain of definition. Therefore, several multivariable functions f1, ..., f defined in the same domain are independent of f. q If a function is evaluated as a homomorphism, then the homomorphism evaluations of functions Ψ and ξ do not need to be recalculated when they are applied to the same input. This situation is, for example, when the coefficients of a decomposition (a ik It also appears in the decomposition of some multivariable functions using ridge functions or radial functions when ) is fixed.

[0096] 3) The same function, but with different arguments due to the addition constant: The known constant a k For ≠0, g k =g k’ and

number

[0097] For example, in Sprecher's construction, the homomorphic evaluation of f above still requires a variable that is additively different by a constant value, i.e., x when ka is known for 1 ≤ i ≤ p. i This includes several homomorphic evaluations of the same single-variable function Ψ with respect to +ka. In this case, Ψ(x i The encrypted value of +ka) is Ψ(x i It can be efficiently obtained from the encryption of ), and one embodiment is described in detail below.

[0098] Formally, each of those arguments,

number

[0099] As shown in "Figure 3", in the case of a univariate function f of any real-valued variable with arbitrary precision in the domain of definition D and having real values in the image I, [Number] The method according to the present invention uses two homomorphic encryption algorithms denoted by E and E'. Their native plaintext spaces are denoted by M and M', respectively. The method is parameterized by an integer N≧1 that quantifies the so-called actual precision of the input on which the function f is evaluated. In fact, the inputs to the domain D of the definition of the function f can have any precision, but these are internally represented by at most N selected values. This directly results in the function f being represented by at most N possible values. The method is also parameterized by encoding functions encode and encode', where encode takes elements of D as input and associates them with elements of M, and encode' takes elements of I as input and associates them with elements of M'. The method is also parameterized by a so-called discretise function, which takes elements of M as input and associates them with integers. The encoding and discretise functions are defined as encoding and subsequent discretise

number

number

number

number

number

number

number

number

number

number

number

[0100] Therefore, in one embodiment, the present invention covers the approximate homomorphic evaluation of a single-variable function f of a real-valued variable x having arbitrary precision in the domain of definition D and real values ​​in image I, which is performed digitally by a specially programmed information processing system, taking an encrypted ciphertext of x, E(encode(x)), as input, and returning an encrypted ciphertext of an approximate value of f(x), E'(encode'(y)), where y≈f(x), E and E' are homomorphic encryption algorithms, the native spaces of their respective plaintexts are M and M', and their evaluation is: • An integer N≧1 that quantifies the actual precision of the representation of the variables in the input of the function f being evaluated. • An encoding function, encode, that takes elements from region D as input and associates them with elements from region M. • Encoding function encode' takes elements of image I as input and associates them with elements of M'. • A discretization function that takes elements of M as input and associates them with integer indices. • Encryption algorithm E H It has a native space M of its plaintext. H This is a homomorphic encryption scheme having a cardinality of at least N. · Take an integer as input, M H Encoding function encode that returns the elements H Parameterized by, as a result the image of region D is encoded and then discretized,

number

[0101] Using these parameters, the approximate homomorphism evaluation of the single-variable function f requires the implementation of the following two consecutive steps by a specially programmed information processing computer system:

[0102] 1. A step of pre-calculating a table corresponding to the single-variable function f, a. Region D is divided into N selected subintervals R0, ..., R N-1 This involves decomposing the set into its constituent parts, and the union of these parts is D. For each index i in bS = {0, ..., N-1}, the subinterval R i Determine a representative x(i) and calculate its value y(i) = f(x(i)). c. For 0 ≤ i ≤ N-1, T[i] = y(i)) and return a table T consisting of N components T[0], ..., T[N-1]. This is the step.

[0103] 2. Steps for evaluating homomorphisms in the table, ax∈R i For this, the index in the set S={0,…,N-1}

number

number

number

number

number

number

number

number

[0104] The domain of the definition D of the function f being evaluated is the real interval [x min ,x max When ), N subintervals R that cover D i (For 0≦i≦N-1) the following half-open intervals can be selected:

number

number

[0105] Therefore, in one embodiment of the present invention, the approximate homomorphism evaluation of a single-variable function f is The domain of the definition of the function f being evaluated is the real interval D = [x min ,x max ) is given • N intervals R that cover region D i (for 0 ≤ i ≤ N-1) is a half-open subinterval.

number

[0106] Encoding function H Algorithm E H The choice is E(encode(x))

number

number

number

[0107] Therefore, in one embodiment of the present invention, the approximate homomorphism evaluation of a single-variable function f is performed by the additive group S for integers M≧N.

number

[0108] group

number

number

[0109] The modular multiplication operation (X M - 1) induces a group isomorphism between the additive group [Number] and the set of M-th roots of unity {1, X,..., X M-1}. When M is even, the relation X M = 1 means X M / 2 = - 1. Thus, [Number] for X i+j = X i · X j (mod(X M / 2 + 1)) is obtained, and the set of M-th roots of unity is {±1, ±X,..., ±X (M / 2)-1}.

[0110] Therefore, in one embodiment of the present invention, the approximate quasi-homomorphic evaluation of the univariate function f is further characterized in that the group [Number] is multiplicatively represented as powers of the primitive M-th root of unity represented by X, and as a result,

number

number

[0111] Homomorphic encryption algorithm E is a torus

number

number

number

number

number

number

[0112] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a single-variable function f is, the homomorphic encryption algorithm E is, a torus

number

number

[0113] Next, the discretization function is parameterized for integers M≧N as a function that associates integer rounding of the product M×t modulo M with the elements t of the torus, where M×t is

number

number

number

[0114] This discretization function can be naturally extended to a torus vector.

number

number

number

number

number

number

number

number

number

number

[0115]

number

number

number

number

number

number

number

number

number

number

number

number

number

[0116] Therefore, in one embodiment of the present invention, the approximate homomorphism evaluation of a single-variable function f is, • The encoding function encodes a subinterval of a torus.

number

number

number

number

[0117] The domain of the definition of the function f being evaluated is the real interval D = [x min ,x max ) and the native space of plaintext M is a torus

number

number

number

number

[0118] Therefore, in one embodiment of the present invention, the approximate homomorphism evaluation of a single-variable function f is performed when the domain of the definition of the function f is the real interval D=[x min ,x max When ), the encoding function encode is

number

[0119] construction

number

number

number

number

number

number

number

number

number

number

number

number

[0120] Therefore, in one embodiment of the present invention, the approximate homomorphism evaluation of a single-variable function f is performed using the homomorphic encryption algorithm E HThis is an LWE-type encryption algorithm, and the encoding function is encode H It is further characterized by being an identity function.

[0121] From E(encode(x))

number

number

number

number

number

number

number

[0122]

number

number

number

number

number

number

number

number

[0123] In this case, E H teeth

number

number

number

number

number

[0124] Therefore, RLWE(m) is key (s'1,…,s' k ) under

number

number

number

[0125] Therefore, in one embodiment of the present invention, the approximate homomorphic evaluation of a single-variable function f parameterized by an even integer M is performed using the homomorphic cryptographic algorithm E H However, it is an RLWE type encryption algorithm,

number

number

number

[0126] According to one of the two preceding embodiments,

number

[0127] 1. The first case is the encoding function encode H but

number

number

number

number

number

number

number

number

number

[0128] 2. The second case is any polynomial

number

number

number

number

number

number

number

number

number

number

number

[0129] In particular, for integers L>1,

number

number

number

number

number

number

[0130] In both cases, the expected polynomial is the return of this first substep of the homomorphism evaluation of table T.

number

number

number

number

number

[0131] The second substep of the homomorphism evaluation of Table T (common to both cases) is from the RLWE ciphertext.

number

number

number

number

number

number

number

number

number

number

[0132] For each 1 ≤ j ≤ k, the polynomial

number

number

number

number

number

number

number

number

[0133] Once this calculation is complete, the ciphertext

number

[0134] Therefore, in one embodiment of the present invention, an approximate homomorphic evaluation of a single-variable function f parameterized by an even integer M equal to 2N is an LWE-type ciphertext on a torus.

number

number

number

number

[0135] The image I of the function f being evaluated is on the real interval [y min ,y max) and the native space of the plaintext M' in LWE encryption is a torus

number

number

number

[0136] Therefore, in one embodiment of the present invention, the approximate homomorphism evaluation of a single-variable function f is such that the image of the function f is on the real interval I=[y min ,y max ) when, • The homomorphic encryption algorithm E' is a torus

number

number

number

number

[0137] When adding ciphertext, the encoding must be considered. If the encoding function of the homomorphic encoding algorithm E is denoted as encode, then using μ1=encode(x1) and μ2=encode(x2), we obtain E(μ1+μ2)=E(μ1)+E(μ2). If the encoding function is homomorphic, then we actually obtain E(encode(x1+x2))=E(encode(x1))+E(encode(x2)). Otherwise, if the encoding function does not conform to addition, a correction ε must be applied to the encoding: ε=encode(x1+x2)-encode(x1)-encode(x2), resulting in E(encode(x1+x2))=E(encode(x1))+E(encode(x2))+E(ε). In particular, if the encoding is

number

number

[0138] Of course, the previous considerations are also valid for images. For a homomorphic encryption algorithm E' with encoding function encode', for a correction ε' = encode'(f(x1)+f(x2))-encode'(f(x1))-encode'(f(x2)), we obtain E'(encode'(f(x1)+f(x2))) = E'(encode'(f(x1)))+E'(encode'(f(x2)))+E'(ε'). In particular, if the encoding encode' conforms to addition, the correction ε' is zero. The correction ε' is equal to the encoding

number

number

[0139] Another important specific case is when we need to homomorphically evaluate the same single-variable function f for inputs x1 and x2 = x1 + A for a given constant A. A typical example of this application is the internal function Ψ in the aforementioned Sprecher application. For a homomorphic cryptographic algorithm E with an encoding function encode, given the fact that E(encode(x1)), we can estimate E(encode(x2)) = E(encode(x1 + A)), and then obtain E'(encode'(f(x1))) and E'(encode'(f(x2))) as described above. However, all steps must be repeated. In the specific case where E is an LWE-type algorithm on a torus and M = 2N, the expected polynomial for input E(encode(x1)) is the return of the first substep of the homomorphic evaluation in Table T.

number

number

number

number

number

number

number

number

[0140] The present invention also covers an information processing system specifically programmed to implement a homomorphic cryptographic evaluation method using one of the alternative methods described above.

[0141] Furthermore, it also covers computer program products that implement one of the above alternative methods and are specifically designed to be loaded and implemented by an information processing system programmed for this purpose.

[0142] Examples of applications of the present invention The above invention can be used very advantageously to maintain the confidentiality of certain data, such as personal, health, or sensitive information data, or more generally, any data whose owner wishes to keep secret but who wants a third party to be able to perform digital processing on it, but which is not limited to this. Delocalizing processing to one or more third-party service providers is interesting for several reasons; by delocalizing, it is possible to perform calculations that would require costly or unavailable resources, and also to perform confidential calculations. Then, the third party responsible for performing the digital processing calculation may not actually want to disclose the actual content of the processing and the digital functions implemented therein.

[0143] In such use, the present invention particularly covers the implementation of remote digital services such as cloud computing services, and a third-party service provider responsible for applying digital processing to encrypted data in cloud computing services performs, on its side, the above-mentioned first precomputation step, which consists of precomputing, for each multivariate function f among the functions f1, …, f q a network of univariate functions. For all the resulting univariate functions (for a given j k≧1), among which the third party, in a second step, preselects the univariate function g

Number

Number

Number

Number

Number

Number

[0145] Accordingly, in one embodiment of the present invention, the homomorphic evaluation cryptography method described above is characterized in that the input encrypted data is derived from a previous re-encryption step in which the input encrypted data is set in the form of the ciphertext of the encryption of the homomorphic encryption algorithm E.

[0146] Third parties encrypted data of type E(μ i When we obtain the ciphertexts, in the step of homomorphic evaluation of the single-variable function network, we homomorphize each of the single-variable function networks in a series of consecutive steps based on these ciphertexts and apply the f of the encryption algorithm E' to their inputs (for 1 ≤ j ≤ q). j Obtain the ciphertext of the encrypted message.

[0147] Different functions f considered j Regarding that, once the encrypted results of the encryption for those input values ​​are obtained, the third party involved sends all of these results back to the owner of the confidential data.

[0148] The owner of the confidential data then, based on the corresponding decryption key it holds, decrypts the homomorphically encrypted input data (x1, ..., x p One or more functions (f1, ..., f) starting with ) qThe result value of ) can be obtained, and the third party has not performed digital processing, which is the implementation of one or more functions, on the said data, nor has the data been able to know the exact content of the data, nor, conversely, the data owner had any need to know the details of the implemented functions.

[0149] Sharing such tasks between data owners and third parties acting as digital processing service providers can be advantageously carried out remotely, particularly across cloud computing services, without impacting the security of the data and associated processing. Furthermore, various steps in digital processing may be the responsibility of different service providers.

[0150] Accordingly, in one embodiment of the present invention, a cloud computing-type remote service implements one or more of the homomorphic evaluation cryptographic methods described above, where the task is shared between the data owner and a third party acting as a digital processing service provider.

[0151] In a particular embodiment of the present invention, data x1, ..., x that you wish to keep confidential p This remote service involves the owner of the said data and one or more third parties responsible for applying the digital processing of the said data. 1. The relevant third party performs a first step and a second pre-selection step of pre-calculating a network of single-variable functions in accordance with the present invention. 2. The owner of the data uses the homomorphic encryption algorithm E to obtain x1, ..., x p Encryption is performed, and the type data E(μ1), ..., E(μ p ) sends, and here, μ i x is encoded by the encoding function i It is a value. 3. Encrypted data type E(μ) by a third party involved iUpon obtaining these ciphertexts, the third party concerned evaluates each of the aforementioned networks of single-variable functions homomorphically in a series of consecutive steps based on these ciphertexts and applies the f of the encryption algorithm E' to their inputs (for 1 ≤ j ≤ q). j Get the ciphertext of the encryption 4. Different functions f considered j Regarding that, once the encrypted results of the encryption for those input values ​​are obtained, the third party involved sends all of these results back to the data owner. 5. The data owner, based on the corresponding decryption key they hold, can use one or more functions (f1, ..., f) after decryption. q ) Get the result value This is another distinguishing feature.

[0152] A variation of this embodiment is in the second step (2.) described above: • The data owner uses a different encryption algorithm than E, x1, ..., x p The encryption is performed, and the encrypted data is transmitted. • The received encrypted data is re-encrypted by the relevant third party, and the ciphertext E(μ1), ..., E(μ) is created under the homomorphic encryption algorithm E. p ) obtain, and here, μ i x is encoded by the encoding function i It is a value. It is characterized by the following:

[0153] In particular, different applications of the remote digital service according to the present invention can be mentioned. For example, as mentioned in the aforementioned MajecSTIC'08 article, it is already known that an approximate image of the original image can be reconstructed by Kolmogorov-type decomposition applied to gray-level images—which can be viewed as a two-variable function f(x,y)=I(x,y), where I(x,y) gives the gray intensity of the pixel at coordinate (x,y). Thus, with knowledge of the coordinates (x1,y1) and (x2,y2) that define the bounding box, a trimming operation can be performed in a simple manner. A similar process can be applied to color images, taking into account that the two-variable functions f1(x,y)=R(x,y), f2(x,y)=G(x,y), and f3(x,y)=B(x,y) give the red, green, and blue levels, respectively. This type of processing is known for unencrypted data, but now in the present invention it can be performed using homomorphic encryption. Therefore, according to the present invention, if a user transmits, in an encrypted manner, his GPS coordinates recorded at regular intervals (e.g., every 10 seconds) during a sports activity, and the coordinates of the furthest point of movement (defining the bounding box), a service provider possessing an image of the mapping plan can obtain the ciphertext of the portion of the plan relevant to the activity by cropping; furthermore, movement within the still encrypted area can be represented, for example, using a color code to indicate local speed homomorphically calculated based on the encrypted image of the received GPS coordinates. Conveniently, the (third-party) service provider knows nothing about the exact location of the activity (unless it is according to the service provider's plan) or the user's performance. Moreover, the third party does not disclose the entire map.

[0154] The present invention can also be advantageously used to enable artificial intelligence processing to perform machine learning-type processing on input data, in particular, while the input data remains encrypted, and a service provider implementing a neural network on the input data applies one or more activation functions to values ​​derived from the encrypted data. As an example of this use of the present invention related to the implementation of a neural network, one can refer to the decomposition of the function g(z1,z2)=max(z1,z2), which functions as the aforementioned "maximum pooling" used in a neural network, in particular, and z2+(z1-z2) + And here

number

number

number

number

number

[0155] Therefore, in one embodiment of the present invention, a remote service implementing one or more of the cryptographic homomorphism evaluation methods described above is intended to be a digital process that implements a neural network.

[0156] Disclosure of the invention as a feature The present invention enables the evaluation of one or more functions relating to encrypted data through the implementation of data computation and processing capabilities of one or more digital information processing systems. In some cases, this function or these functions may be single-variable or multi-variable. Therefore, in its different variations, the method according to the present invention enables the evaluation of both types of functions.

[0157] If the function to be evaluated is of the single-variable type, the present invention provides, in one implementation thereof, implementations of two homomorphic encryption algorithms at their respective inputs and outputs, and a step of pre-computing a table of each function under consideration, followed by a step of homomorphic evaluation of the resulting table, as claimed in claim 1.

[0158] If the function to be evaluated is of the multivariable type, the present invention further provides performing the following two preliminary steps: a first pre-computation step, followed by a second pre-selection step, and then applying a third step of homomorphism evaluation of the single-variable function network to the single-variable function network obtained upon completion of these two preliminary steps, according to any known method for single-variable function homomorphism evaluation. This is the object of claim 12.

Claims

1. An encryption method that is performed digitally by at least one information processing system specially programmed to perform an approximate homomorphic evaluation of a single-variable function f of a real-valued variable x in a domain D of definition, wherein the method takes an encoding of x, E(encode(x)), as input and returns an encoding of an approximate value of f(x), E'(encode'(y)), where y ≈ f(x), and E and E' are homomorphic encryption algorithms, and encode and encode' are encoding functions. The method is, - a. A step of pre-calculating a table corresponding to the single-variable function f, ○The domain D of the function definition is defined by N selected subintervals R whose union constitutes D. ０ , ..., R Ｎ－１ To break it down, ○For each index i in S = {0, ..., N-1}, the subinterval R ｉ This involves determining a representative x(i) and calculating the value y(i) = f(x(i)), where an integer N≧1 quantifies the actual accuracy of the representation of the variables in the input of the function f being evaluated. ○ For 0 ≤ i ≤ N-1, the step includes returning a table T containing N components T[0], ..., T[N-1] such that T[i] = y(i). - b. Steps for evaluating homomorphisms in a table, ○x∈R ｉ In this case, the index in the set S = {0, ..., N-1} [Math 1] An integer whose expected value is [Math 2] In contrast, the ciphertext E (encode(x)) is the ciphertext [Math 3] This involves converting to a discretization function where discretise is a discretization function that associates integers with its input, and ε Ｈ However, it is a homomorphic encryption algorithm. ○Ciphertext [Math 4] Based on Table T, the expected value is [Math 5] elements [Math 6] In contrast, cipher text [Number 7] To obtain, ○ [Number 8] A cryptographic method that includes steps, including returning a value.

2. - The domain of the definition of the function f being evaluated is the real interval D = [x ｍｉｎ , x ｍａｘ ) is given, - N intervals R that cover region D ｉ (For 0 ≤ i ≤ N-1) is a half-open subsection. [Number 9] The encryption method according to claim 1, wherein D is divided in a regular manner.

3. The set S is an additive group for integers M ≥ N. [Number 10] The cryptographic method according to claim 1, which is a subset of the above.

4. group [Math 11] However, it can be expressed multiplicatively as the power of the primitive root of the identity element raised to the power of M, represented by X. [Math 12] Element X is associated with element i ｉ such that all M-th roots of unity {1, X,..., X Ｍ－１} are for multiplication modulo (X Ｍ - 1) [Number 13] The cryptographic method according to claim 3, which forms a group of the same shape as the one described above.

5. Homomorphic encryption algorithm E is a torus [Number 14] Given by an LWE-type encryption algorithm applied to the plaintext native space, [Number 15] The encryption method according to claim 1, comprising:

6. Parameterized by integer M ≥ N, - The encoding function encode is a subinterval of a torus. [Number 16] Having the image included, - The discretization function `discretise` is applied to the elements t of the torus, and the rounded integer of the product M × t modulo M is [Number 17] It is calculated in mathematical form: [Number 18] , [Number 19] The encryption method according to claim 5.

7. The domain of the definition of the function f is the real interval D = [x ｍｉｎ , x ｍａｘ When this is the case, the encoding function encode is, [Number 20] ， [Math 21] The encryption method according to claim 6.

8. Homomorphic encryption algorithm ε Ｈ However, it is an LWE-type encryption algorithm, and the encoding function encode Ｈ The encryption method according to claim 5, wherein the identity function is the same.

9. The homomorphic encryption algorithm ε is parameterized by an even integer M. Ｈ However, it is an RLWE type encryption algorithm, and the encoding function encode Ｈ but, [Number 22] For any polynomial p, the function [Number 23] ， [Number 24] The encryption method according to claim 5.

10. Parameterized by an even number M equal to 2N, LWE type ciphertext on a torus [Number 25] but, [Number 26] of [Number 27] Using this, a polynomial T'[j] = encoder'(T[j]) such that 0 ≤ j ≤ N-1 [Number 28] The encryption method according to claim 8, which is extracted from an RLWE ciphertext approaching.

11. The image of the function f is in the real interval I = [y ｍｉｎ , y ｍａｘ ) when - Homomorphic encryption algorithm E' is a torus [Number 29] The LWE-type encryption algorithm applied to it is given as the native space of the plaintext. [Number 30] It has, - The encoding function 'encode' [Number 31] ， [Number 32] The encryption method according to claim 1.

12. The at least one unvariable function that undergoes the approximate homomorphism evaluation is derived from the prior processing of at least one multivariable function by implementing the following prior steps: - a. A pre-computation step which includes transforming each of the multivariable functions into a network of single-variable functions, including the composition and summation of single-variable real-valued functions. - b. In the network of pre-computed single-variable functions, there are three types: - The same single-variable function applied to the same argument, - Different single-variable functions applied to the same argument, - The same single-variable function applied to arguments that differ only by a non-zero addition constant. A pre-selection step which includes identifying one of the redundancies and selecting all or part of it, - c. A step in the homomorphic evaluation of each of the pre-computed single-variable functions, wherein if all or some of these single-variable functions are reused, the redundancy selected in the pre-selection step is evaluated in a shared manner. The encryption method according to claim 1.

13. The encryption method according to claim 1, wherein the input encrypted data is derived from the previous re-encryption step so that it is set in the form of the ciphertext of the encryption of the homomorphic encryption algorithm E.

14. An information processing system programmed to implement the homomorphic evaluation cryptographic method described in claim 1.

15. A computer program, intended to implement the cryptographic method described in claim 1 when loaded onto an information processing system.

16. A cloud computing remote service that implements the cryptographic method described in claim 1, wherein tasks are shared between a data owner and one or more third parties acting as digital processing service providers.

Images