Homomorphic computing device, homomorphic computing method, homomorphic computing program, and secret information processing system

Abstract

The bootstrapping processing unit (414) generates a ciphertext C obtained by encrypting the plaintext m using the encryption key PK. PK A decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is used as input to perform homomorphic computation to generate a new ciphertext C' PK The homomorphic arithmetic unit (416) generates a new ciphertext C' PK (m) is used as input and homomorphic arithmetic is performed to obtain the ciphertext C PK Generate (M).

Description

[Technical field]

[0001] This disclosure relates to a technique called circuit secrecy + homomorphic encryption. [Background technology]

[0002] Homomorphic encryption is an encryption technology that allows calculations to be performed on data while it remains encrypted. In recent years, the use of cloud services has become widespread, but due to concerns about cracking and the reliability of cloud services, it is considered to encrypt data before storing it on the cloud. Homomorphic encryption allows calculations to be performed on encrypted data without decrypting it. Therefore, it is a technology that allows the use of cloud services without compromising security.

[0003] In order to improve the security of homomorphic encryption, homomorphic encryption that satisfies circuit secrecy is an encryption technology that achieves security in which information about the arithmetic process is not leaked from the encrypted arithmetic result. In particular, among homomorphic encryptions that satisfy circuit secrecy, homomorphic encryption that achieves security in which information about the arithmetic process is not leaked from the encrypted arithmetic result for ciphertext that is not generated by a specified encryption algorithm is said to satisfy circuit secrecy+. The first example of the configuration of homomorphic encryption that satisfies circuit secrecy+ is described in Non-Patent Document 1. [Prior art documents] [Non-patent literature]

[0004] [Non-Patent Document 1] Adi Akavia, Craig Gentry, Shai Halevi, and Margarita Vald. Achievable CCA2 Relaxation for Homomorphic Encryption. In TCC, 2022. Summary of the Invention [Problem to be solved by the invention]

[0005] Conventional homomorphic encryption that satisfies circuit secrecy+ requires that when performing calculations while the data is encrypted, a calculation process called bootstrapping, in which the data is decrypted while still encrypted, must be performed multiple times before and after the calculation process while still encrypted. The bootstrapping process is a computational process for calculating the decryption process of an encryption method while the encryption is in progress, and is known to be very inefficient. In particular, the homomorphic encryption technique disclosed in Non-Patent Document 1 requires the bootstrapping process to be performed many times before and after the computational process while the encryption is in progress, which is very inefficient. An object of the present disclosure is to make it possible to realize homomorphic encryption that can achieve circuit secrecy+ with a single bootstrapping process. [Means for solving the problem]

[0006] The homomorphic arithmetic device according to the present disclosure comprises: The ciphertext C is the plaintext m encrypted using the encryption key PK. PK A decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is input to perform homomorphic arithmetic processing to generate a new ciphertext C' PK A bootstrapping processor that generates (m); The new ciphertext C' generated by the arithmetic circuit f and the bootstrapping processing unit PK (m) is used as input and homomorphic arithmetic is performed to obtain the ciphertext C PK A homomorphic computation unit that generates (M) Equipped with. Effect of the Invention

[0007] In this disclosure, homomorphic arithmetic processing is performed using a decryption circuit and a bootstrapping key as input. This homomorphic arithmetic processing converts the encrypted ciphertext C PK (m) is decrypted and the new ciphertext C' of plaintext m is PK (m) is generated. This results in ciphertext C that has not been generated by the specified encryption algorithm. PK(m) is the new ciphertext C' generated by the specified encryption algorithm. PK (m) can be converted into the new ciphertext C' PK By performing homomorphic arithmetic processing on (m), it is possible to achieve circuit secrecy+. Here, the homomorphic computation performed on the bootstrapping key is the bootstrapping process. In other words, it is possible to achieve circuit secrecy+ with a single bootstrapping process. [Brief description of the drawings]

[0008] [Figure 1] FIG. 1 is a configuration diagram of a secret information processing system 100 according to a first embodiment. [Diagram 2] FIG. 2 is a configuration diagram of a key generating device 200 according to the first embodiment. [Diagram 3] FIG. 2 is a configuration diagram of an encryption device 300 according to the first embodiment. [Figure 4] FIG. 1 is a configuration diagram of a homomorphic arithmetic device 400 according to a first embodiment. [Diagram 5] FIG. 1 shows a configuration of a decoding device 500 according to the first embodiment. [Figure 6] 4 is a flowchart of a key generation process according to the first embodiment. [Figure 7] 4 is a flowchart of a calculation process according to the first embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] Embodiment 1 ***Configuration Description*** The configuration of a secret information processing system 100 according to the first embodiment will be described with reference to FIG. The secret information processing system 100 includes a key generation device 200, an encryption device 300, a homomorphic arithmetic device 400, and a decryption device 500. The key generation device 200, the encryption device 300, the homomorphic arithmetic device 400, and the decryption device 500 are connected via the Internet 900. The Internet 900 is an example of a transmission path. Instead of the Internet 900, another type of transmission path may be used.

[0010] The configuration of the key generating device 200 according to the first embodiment will be described with reference to FIG. The key generating device 200 is a computer such as a PC. PC is an abbreviation for Personal Computer. The key generating device 200 generates a decryption key SK, an encryption key PK, and a bootstrapping key BK. The key generation device 200 includes the following hardware components: a processor 201, a memory 202, a storage 203, and a communication interface 204. The processor 201 is connected to other hardware components via signal lines and controls the other hardware components.

[0011] The key generation device 200 includes, as functional components, an input unit 211, a decryption key generation unit 212, an encryption key generation unit 213, a bootstrapping key generation unit 214, and a transmission unit 215. The functions of the functional components of the key generation device 200 are realized by software. Storage 203 stores a program that realizes the function of each functional component of key generation device 200. This program is loaded into memory 202 by processor 201 and executed by processor 201. In this way, the function of each functional component of key generation device 200 is realized.

[0012] The configuration of the encryption device 300 according to the first embodiment will be described with reference to FIG. The encryption device 300 is a computer such as a PC. The encryption device 300 encrypts a plaintext m. The data is encrypted using the encryption key PK. The encryption device 300 includes the following hardware components: a processor 301, a memory 302, a storage 303, and a communication interface 304. The processor 301 is connected to other hardware components via signal lines and controls the other hardware components.

[0013] The encryption device 300 includes, as functional components, an input unit 311, an encryption key storage unit 312, an encryption unit 313, and a transmission unit 314. The functions of the functional components of the encryption device 300 are realized by software. Storage 303 stores a program that realizes the functions of each functional component of encryption device 300. This program is loaded into memory 302 by processor 301 and executed by processor 301. In this way, the function of each functional component of encryption device 300 is realized.

[0014] The configuration of a homomorphic arithmetic device 400 according to the first embodiment will be described with reference to FIG. The homomorphic arithmetic device 400 is a computer such as a server having a large-capacity storage 403. The homomorphic arithmetic device 400 performs homomorphic arithmetic on ciphertext. The homomorphic arithmetic device 400 also functions as a data storage device that stores the ciphertext. The homomorphic computing device 400 includes the following hardware components: a processor 401, a memory 402, a storage 403, and a communication interface 404. The processor 401 is connected to other hardware components via signal lines and controls the other hardware components.

[0015] The homomorphic arithmetic device 400 includes, as functional components, an input unit 411, an encryption key storage unit 412, a bootstrapping key storage unit 413, a bootstrapping processing unit 414, a ciphertext storage unit 415, a homomorphic arithmetic unit 416, and a transmission unit 417. The functions of the functional components of the homomorphic arithmetic device 400 are realized by software. The storage 403 stores a program that realizes the functions of each functional component of the homomorphic arithmetic device 400. This program is loaded into the memory 402 by the processor 401 and executed by the processor 401. In this way, the functions of each functional component of the homomorphic arithmetic device 400 are realized.

[0016] The configuration of decoding device 500 according to the first embodiment will be described with reference to FIG. The decryption device 500 is a computer such as a PC. The decryption device 500 decrypts the ciphertext with a decryption key SK. The decryption device 500 also functions as a decryption key storage device that stores the decryption key SK. The decoding device 500 includes the following hardware components: a processor 501, a memory 502, a storage 503, and a communication interface 504. The processor 501 is connected to other hardware components via signal lines and controls the other hardware components.

[0017] The decryption device 500 includes, as functional components, an input unit 511, a decryption key storage unit 512, a decryption processing unit 513, and a decryption result storage unit 514. The functions of the functional components of the decryption device 500 are realized by software. Storage 503 stores a program that realizes the functions of each functional component of decoding device 500. This program is loaded into memory 502 by processor 501 and executed by processor 501. In this way, the function of each functional component of decoding device 500 is realized.

[0018] Note that one computer may simultaneously include the functions of at least two or more devices, namely, the key generation device 200, the encryption device 300, the homomorphic arithmetic device 400, and the decryption device 500.

[0019] The processors 201, 301, 401, and 501 are ICs that perform processing. IC stands for Integrated Circuit. Specific examples of the processors 201, 301, 401, and 501 include a CPU, a DSP, and a GPU. CPU stands for Central Processing Unit. DSP stands for Digital Signal Processor. GPU stands for Graphics Processing Unit.

[0020] The memories 202, 302, 402, and 502 are storage devices that temporarily store data. Specific examples of the memories 202, 302, 402, and 502 are SRAMs and DRAMs. SRAM is an abbreviation for Static Random Access Memory. DRAM is an abbreviation for Dynamic Random Access Memory.

[0021] The storages 203, 303, 403, and 503 are storage devices that store data. A specific example of the storages 203, 303, 403, and 503 is a HDD. HDD is an abbreviation for Hard Disk Drive. The storages 203, 303, 403, and 503 may also be portable recording media such as an SD (registered trademark) memory card, CompactFlash (registered trademark), NAND flash, a flexible disk, an optical disk, a compact disk, a Blu-ray (registered trademark) disk, or a DVD. SD is an abbreviation for Secure Digital. DVD is an abbreviation for Digital Versatile Disk.

[0022] The communication interfaces 204, 304, 404, and 504 are interfaces for communicating with external devices. Specific examples of the communication interfaces 204, 304, 404, and 504 are Ethernet (registered trademark), USB, and HDMI (registered trademark) ports. USB is an abbreviation for Universal Serial Bus. HDMI is an abbreviation for High-Definition Multimedia Interface.

[0023] There may be a plurality of processors 201, 301, 401, 501, and the plurality of processors 201, 301, 401, 501 may cooperate to execute programs for realizing the respective functions.

[0024] ***Explanation of Operation*** The operation of the secret information processing system 100 according to the first embodiment will be described with reference to FIGS. An operation procedure of the secret information processing system 100 according to the embodiment 1 corresponds to the secret information processing method according to the embodiment 1. Moreover, a program for realizing the operation of the secret information processing system 100 according to the embodiment 1 corresponds to the secret information processing program according to the embodiment 1. An operation procedure of the homomorphic arithmetic device 400 in the secret information processing system 100 according to the embodiment 1 corresponds to the homomorphic arithmetic method according to the embodiment 1. Moreover, a program for realizing the operation of the homomorphic arithmetic device 400 in the secret information processing system 100 according to the embodiment 1 corresponds to the homomorphic arithmetic program according to the embodiment 1.

[0025] The operation of the secret information processing system 100 includes key generation processing and arithmetic processing.

[0026] The key generation process according to the first embodiment will be described with reference to FIG. (Step S101: Security parameter reception process) The input unit 211 of the key generation device 200 accepts an input of a security parameter λ. The input unit 211 transmits the security parameter λ to the decryption key generation unit 212.

[0027] (Step S102: Decryption key generation process) The decryption key generation unit 212 of the key generation device 200 receives the security parameter λ received in step S101 as an input and generates a decryption key SK. The decryption key generation unit 212 transmits the decryption key SK to the encryption key generation unit 213, the bootstrapping key generation unit 214, and the transmission unit 215. Here, the decryption key generation unit 212 generates the decryption key SK using a key generation algorithm in a homomorphic encryption method with circuit confidentiality. In the first embodiment, the decryption key generation unit 212 generates the decryption key SK using a key generation algorithm in a reference document. The reference document is "Florian Bourse, Rafael Del Pino, Michele Minelli, and Hoeteck Wee. FHE Circuit Privacy Almost For Free. In CRYPTO, 2016.

[0028] (Step S103: Encryption key generation process) The encryption key generation unit 213 of the key generation device 200 receives the decryption key SK generated in step S102 as an input and generates an encryption key PK. The encryption key generation unit 213 transmits the encryption key PK to the bootstrapping key generation unit 214 and the transmission unit 215. Here, the encryption key generation unit 213 generates the encryption key PK using a key generation algorithm in a homomorphic encryption method having circuit confidentiality. In the first embodiment, the encryption key generation unit 213 generates the encryption key PK using a key generation algorithm in the reference document.

[0029] If the key generation algorithm in the reference is KeyGen, the processes in steps S102 and S103 can be written as shown in Equation 1.

number

[0030] (Step S104: Bootstrapping key generation process) The bootstrapping key generation unit 214 of the key generation device 200 receives as input the decryption key SK generated in step S102 and the encryption key PK generated in step S103, and generates the bootstrapping key BK. Specifically, the bootstrapping key generation unit 214 generates the bootstrapping key BK by encrypting the decryption key SK with the encryption key PK. The bootstrapping key generation unit 214 transmits the bootstrapping key BK to the transmission unit 215. Here, the bootstrapping key generation unit 214 generates the bootstrapping key BK by encrypting the decryption key SK with the encryption key PK using an encryption algorithm in a homomorphic encryption method having circuit confidentiality. The encryption algorithm used here is a specified encryption algorithm required to satisfy circuit confidentiality+. In the first embodiment, the bootstrapping key generation unit 214 generates the bootstrapping key BK by encrypting the decryption key SK with the encryption key PK using the encryption algorithm in the reference document.

[0031] If the encryption algorithm in the reference is Enc, the process of step S104 can be written as Equation 2.

number

[0032] (Step S105: Key transmission process) The transmission unit 215 of the key generation device 200 transmits the encryption key PK generated in step S103 to the encryption device 300 via the Internet 900. In addition, the transmission unit 215 transmits the encryption key PK generated in step S103 and the bootstrapping key BK generated in step S104 to the homomorphic arithmetic device 400 via the Internet 900. In addition, the transmission unit 215 transmits the decryption key SK generated in step S102 to the decryption device 500 via the Internet 900. Since the decryption key SK is confidential information, it is transmitted in a manner that prevents it from being leaked. The encryption key PK, the decryption key SK, and the bootstrapping key BK may be transmitted by mail or other methods.

[0033] (Step S106: First key reception process) The input unit 311 of the encryption device 300 receives the encryption key PK transmitted in step S105. The input unit 311 transmits the encryption key PK to the encryption key storage unit 312.

[0034] (Step S107: First key storage process) The encryption key storage unit 312 of the encryption device 300 stores in the storage 303 the encryption key PK received in step S106.

[0035] (Step S108: Second key reception process) The input unit 411 of the homomorphic computing device 400 receives the encryption key PK and the bootstrapping key BK transmitted in step S105. The input unit 411 transmits the encryption key PK to the encryption key storage unit 412, and transmits the bootstrapping key BK to the bootstrapping key storage unit 413.

[0036] (Step S109: Second key storage process) The encryption key storage unit 412 of the homomorphic computing device 400 stores the encryption key PK received in step S108 in the storage 403. In addition, the bootstrapping key storage unit 413 stores in the storage 403 the bootstrapping key BK received in step S108.

[0037] (Step S110: Third key reception process) The input unit 511 of the decryption device 500 receives the decryption key SK transmitted in step S105. The input unit 511 transmits the decryption key SK to the decryption key storage unit 512.

[0038] (Step S111: Third key storage process) The decryption key storage unit 512 of the decryption device 500 stores the decryption key SK received in step S110 in the storage 503. Since the decryption key SK is confidential information, it is stored in such a way that it is not leaked.

[0039] The calculation process according to the first embodiment will be described with reference to FIG. (Step S201: Plain text reception process) The input unit 311 of the encryption device 300 accepts an input of plain text m. The plain text m is, for example, data collected from a sensor, etc. The input unit 311 transmits the plain text m to the encryption unit 313.

[0040] (Step S202: Encryption process) The encryption unit 313 of the encryption device 300 encrypts the plaintext m received in step S201 with the encryption key PK stored in the storage 303 to generate a ciphertext C PK (m) The encryption unit 313 generates the ciphertext C PK (m) is transmitted to the transmitting unit 314. Here, the encryption unit 313 encrypts the plaintext m with the encryption key PK using an encryption algorithm in a homomorphic encryption method with circuit confidentiality to generate a ciphertext C PK In the first embodiment, the encryption unit 313 encrypts the plaintext m with the encryption key PK using the encryption algorithm in the reference document to generate the ciphertext C PK Note that the encryption algorithm used here does not have to be the specified encryption algorithm required to satisfy circuit secrecy+.

[0041] If the encryption algorithm in the reference is Enc, the process of step S202 can be written as Equation 3.

number

[0042] (Step S203: Ciphertext transmission process) The transmission unit 314 of the encryption device 300 transmits the ciphertext C generated in step S202 via the Internet 900. PK (m) is transmitted to the homomorphic computing device 400.

[0043] (Step S204: Ciphertext reception process) The input unit 411 of the homomorphic arithmetic device 400 receives the ciphertext C PK The input unit 411 receives the ciphertext C PK (m) is sent to the bootstrapping processing unit 414.

[0044] (Step S205: Ciphertext conversion process) The bootstrapping unit 414 of the homomorphic arithmetic device 400 performs a bootstrapping on the ciphertext C received in step S204. PK A decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK stored in the storage 403 is used as input to perform homomorphic arithmetic processing to generate a new ciphertext C' PK That is, the bootstrapping processing unit 414 applies the arithmetic processing of the decryption circuit to the bootstrapping key BK while keeping it encrypted. The bootstrapping processing unit 414 generates a new ciphertext C' PK (m) is transmitted to the ciphertext storage unit 415. Here, the bootstrapping unit 414 performs homomorphic computation using a homomorphic computation algorithm in a homomorphic encryption method having circuit confidentiality. In the first embodiment, the bootstrapping unit 414 performs homomorphic computation using a homomorphic computation algorithm in a reference document.

[0045] The decryption algorithm in the reference is Dec, and the homomorphic operation algorithm in the reference is Eval. Then, the decryption circuit can be written as in Equation 4. Here, the ciphertext C PK It can be thought that (m) is set as a fixed value inside the decoding circuit.

number

number

[0046] The bootstrapping key BK is the ciphertext of the decryption key SK. Therefore, by performing the homomorphic arithmetic processing shown in Equation 5, the ciphertext C PK (m) is decrypted and the new ciphertext C' of plaintext m is generated. PK (m) is generated. Now, new ciphertext C' PK When generating (m), the encryption algorithm that generated the input ciphertext is used. Here, the input ciphertext is the bootstrapping key BK. Therefore, the encryption algorithm used to generate the bootstrapping key BK generates a new ciphertext C' of the plaintext m. PK (m) is generated. As a result, a new ciphertext C' PK (m) is a ciphertext encrypted by a specified encryption algorithm. That is, a ciphertext C encrypted by an encryption algorithm other than the specified encryption algorithm PK (m) is the new ciphertext C' encrypted by the specified encryption algorithm. PK (m).

[0047] (Step S206: Ciphertext storage process) The ciphertext storage unit 415 of the homomorphic arithmetic device 400 stores the new ciphertext C′ generated in step S205. PK (m) is stored in storage 403.

[0048] (Step S207: Calculation reception process) The input unit 411 of the homomorphic arithmetic device 400 receives an input of an arithmetic circuit f. The arithmetic circuit f is a circuit that defines an arbitrary arithmetic operation. The input unit 411 transmits the arithmetic circuit f to the homomorphic arithmetic unit 416.

[0049] (Step S208: Calculation execution process) The homomorphic arithmetic unit 416 of the homomorphic arithmetic device 400 converts the arithmetic circuit f received in step S207 into the new ciphertext C′ stored in the storage 403. PK (m) is used as input and homomorphic arithmetic processing is performed to obtain the ciphertext CPK That is, the homomorphic computation unit 416 generates a new ciphertext C' PK (m) is encrypted and the arithmetic processing of the arithmetic circuit f is applied to it to obtain the ciphertext C PK Here, M=f(m). In other words, M represents the result of applying the arithmetic processing of the arithmetic circuit f to the plaintext m. The homomorphic arithmetic unit 416 generates the ciphertext C PK (M) is transmitted to the transmitting unit 417. Here, the homomorphic computation unit 416 performs homomorphic computation processing using a homomorphic computation algorithm in a homomorphic encryption method having circuit confidentiality. In the first embodiment, the homomorphic computation unit 416 performs homomorphic computation processing using a homomorphic computation algorithm in a reference document.

[0050] If the homomorphic computation algorithm in the reference is Eval, the process of step S208 can be written as Equation 6.

number

[0051] (Step S209: Calculated ciphertext transmission process) The transmission unit 417 of the homomorphic arithmetic device 400 transmits the post-operation ciphertext C generated in step S208 via the Internet 900. PK (M) is transmitted to the decoding device 500.

[0052] (Step S210: Calculation-encrypted text reception process) The input unit 511 of the decryption device 500 receives the post-operation ciphertext C PK The input unit 511 receives the post-operation ciphertext C PK (M) is sent to the decoding processing unit 513.

[0053] (Step S211: Decryption process) The decryption processing unit 513 of the decryption device 500 decrypts the post-operation ciphertext C PKThe decryption processing unit 513 decrypts (M) with the decryption key SK stored in the storage 503 to generate the decryption result D. The decryption processing unit 513 transmits the decryption result D to the decryption result storage unit 514. Here, the decryption processing unit 513 uses a decryption algorithm in a homomorphic encryption method having circuit confidentiality to obtain the post-operation ciphertext C PK In the first embodiment, the decryption unit 513 uses the decryption algorithm in the reference document to decrypt the ciphertext C PK Decrypt (M) with the decryption key SK.

[0054] If the decoding algorithm in the reference document is Dec, the process of step S211 can be written as Equation 7.

number

[0055] (Step S212: Decryption result storage process) The decryption result storage unit 514 of the decryption device 500 stores the decryption result D generated in step S211 in the storage 503.

[0056] 7 may be divided into a ciphertext storage process which is a process from step S201 to step S206, and an operation application process from step S207 to step S212. In this case, in step S207, the input unit 411 receives a new ciphertext C' PK Then, in step S208, the homomorphic computation unit 416 converts the specified new ciphertext C' PK All that is required is to perform homomorphic arithmetic processing on (m).

[0057] ***Advantages of the First Embodiment*** As described above, the secret information processing system 100 according to the first embodiment performs homomorphic arithmetic processing using the decryption circuit and the bootstrapping key BK as input. PK (m) is decrypted and the new ciphertext C' of plaintext m is PK(m) is generated. This results in ciphertext C that has not been generated by the specified encryption algorithm. PK (m) is the new ciphertext C' generated by the specified encryption algorithm. PK (m) can be converted into the new ciphertext C' PK By performing homomorphic arithmetic processing on (m), it is possible to achieve circuit secrecy+. Here, the homomorphic computation performed on the bootstrapping key is the bootstrapping process. In other words, the circuit secrecy can be achieved by just one bootstrapping process.

[0058] ***Other configurations*** <Variation 1> In the first embodiment, each functional component is realized by software. However, as a first modification, each functional component may be realized by hardware. The following describes the first modification in terms of differences from the first embodiment.

[0059] When each functional component is realized by hardware, the key generation device 200 includes an electronic circuit instead of the processor 201, the memory 202, and the storage 203. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 202, and the storage 203.

[0060] Similarly, when each functional component is realized by hardware, the encryption device 300 includes an electronic circuit instead of the processor 301, the memory 302, and the storage 303. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 302, and the storage 303.

[0061] Similarly, when each functional component is realized by hardware, the homomorphic computing device 400 includes an electronic circuit instead of the processor 401, the memory 402, and the storage 403. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 402, and the storage 403.

[0062] Similarly, when each functional component is realized by hardware, the decoding device 500 includes an electronic circuit instead of the processor 501, the memory 502, and the storage 503. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 502, and the storage 503.

[0063] The electronic circuits include single circuits, composite circuits, programmed processors, parallel programmed processors, logic ICs, GAs, ASICs, and FPGAs. GA stands for Gate Array. ASIC stands for Application Specific Integrated Circuit. FPGA stands for Field-Programmable Gate Array. Each functional component may be realized by one electronic circuit, or each functional component may be realized by distributing it among a plurality of electronic circuits.

[0064] <Variation 2> As a second modification, some of the functional components may be realized by hardware, and other functional components may be realized by software.

[0065] The processors 201, 301, 401, and 501, the memories 202, 302, 402, and 502, the storages 203, 303, 403, and 503, and the electronic circuits are collectively referred to as a processing circuit. In other words, the functions of the functional components are realized by the processing circuit.

[0066] Furthermore, the term "part" in the above description may be read as a "circuit," "step," "procedure," "processing," or "processing circuit."

[0067] Various aspects of the present disclosure are summarized below as appendices. (Appendix 1) The ciphertext C is the plaintext m encrypted using the encryption key PK. PK A decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is input to perform homomorphic arithmetic processing to generate a new ciphertext C'PK A bootstrapping processor that generates (m); The new ciphertext C' generated by the arithmetic circuit f and the bootstrapping processing unit PK (m) is used as input and homomorphic arithmetic is performed to obtain the ciphertext C PK A homomorphic computation unit that generates (M) A homomorphic computing device comprising: (Appendix 2) The homomorphic computation is a homomorphic computation in a homomorphic encryption method having circuit confidentiality. 2. The homomorphic computing device of claim 1. (Appendix 3) The encryption key PK and the decryption key SK are encryption and decryption keys in the homomorphic encryption method. 3. The homomorphic arithmetic device of claim 2. (Appendix 4) The computer encrypts the plaintext m using the encryption key PK to generate the ciphertext C PK A decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is input to perform homomorphic arithmetic processing to generate a new ciphertext C' PK (m) A computer generates the new ciphertext C' by using an arithmetic circuit f. PK (m) is used as input and homomorphic arithmetic is performed to obtain the ciphertext C PK A homomorphic computational method for generating (M). (Appendix 5) The ciphertext C is the plaintext m encrypted using the encryption key PK. PK A decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is input to perform homomorphic arithmetic processing to generate a new ciphertext C' PK A bootstrapping process to generate (m); An arithmetic circuit f and the new ciphertext C' generated by the bootstrapping process PK (m) is used as input and homomorphic arithmetic is performed to obtain the ciphertext C PK A homomorphic computation to generate (M) A homomorphic arithmetic program that causes a computer to function as a homomorphic arithmetic device that performs the above operations. (Appendix 6) Encrypt the plaintext m using the encryption key PK to obtain the ciphertext C PK (m), and The ciphertext C generated by the encryption device PK (m) to create a new ciphertext C' PK (m), and the arithmetic circuit f and the new ciphertext C' PK (m) is used as input and homomorphic arithmetic is performed to obtain the ciphertext C PK A homomorphic arithmetic unit that generates (M); The post-operation ciphertext C generated by the homomorphic arithmetic device PK A decryption device that decrypts (M) with a decryption key SK. Equipped with The homomorphic arithmetic device PK A decryption circuit that decrypts (m) with the decryption key SK and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is used as an input to perform homomorphic arithmetic processing to generate the new ciphertext C' PK A secret information processing system that generates (m).

[0068] The above describes the embodiments and modifications of the present disclosure. Some of these embodiments and modifications may be combined and implemented. Also, one or some of them may be partially implemented. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as necessary. [Explanation of symbols]

[0069] 100 Secret information processing system, 200 Key generation device, 300 Encryption device, 400 Homomorphic arithmetic device, 500 Decryption device, 201 Processor, 202 Memory, 203 Storage, 204 Communication interface, 211 Input unit, 212 Decryption key generation unit, 213 Encryption key generation unit, 214 Bootstrapping key generation unit, 215 Transmission unit, 301 Processor, 302 Memory, 303 Storage, 304 Communication interface, 311 Input unit, 312 Encryption key storage unit, 313 Encryption unit, 314 Transmission unit, 401 Processor, 402 Memory, 403 Storage, 404 Communication interface, 411 Input unit, 412 Encryption key storage unit, 413 Bootstrapping key storage unit, 414 Bootstrapping processing unit, 415 Ciphertext storage unit, 416 Homomorphic arithmetic unit, 417 A transmission unit, 501, a processor, 502, a memory, 503, a storage, 504, a communication interface, 511, an input unit, 512, a decryption key storage unit, 513, a decryption processing unit, 514, a decryption result storage unit, 900, the Internet.

Claims

1. A ciphertext C obtained by encrypting a plaintext m using an encryption key PK in a circuit-secretive homomorphic encryption method. ＰＫ a decryption circuit that decrypts (m) with a decryption key SK in the homomorphic encryption scheme, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK as input, and performs homomorphic operation processing in the homomorphic encryption scheme to generate a new ciphertext C' ＰＫ a bootstrapping processor that generates (m); The new ciphertext C′ generated by the arithmetic circuit f and the bootstrapping processing unit ＰＫ (m) is input and the homomorphic operation process is performed in the homomorphic encryption method to obtain the ciphertext C ＰＫ a homomorphic computation unit that generates (M); A homomorphic computing device comprising:

2. A computer encrypts a plaintext m using an encryption key PK in a homomorphic encryption scheme with circuit secrecy to generate a ciphertext C ＰＫ a decryption circuit that decrypts (m) with a decryption key SK in the homomorphic encryption scheme, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK as input, and performs homomorphic operation processing in the homomorphic encryption scheme to generate a new ciphertext C' ＰＫ (m), The computer uses an arithmetic circuit f and the new ciphertext C' ＰＫ (m) is input and the homomorphic operation process is performed in the homomorphic encryption method to obtain the ciphertext C ＰＫ A homomorphic computation method for generating (M).

3. A ciphertext C obtained by encrypting a plaintext m using an encryption key PK in a circuit-secretive homomorphic encryption method. ＰＫ a decryption circuit that decrypts (m) with a decryption key SK in the homomorphic encryption scheme, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK as input, and performs homomorphic operation processing in the homomorphic encryption scheme to generate a new ciphertext C' ＰＫ a bootstrapping process to generate (m); an arithmetic circuit f and the new ciphertext C′ generated by the bootstrapping process ＰＫ (m) is input and the homomorphic operation process is performed in the homomorphic encryption method to obtain the ciphertext C ＰＫ A calculation process to generate (M) A homomorphic arithmetic program that causes a computer to function as a homomorphic arithmetic device that performs the following:

4. Encrypting plaintext m using an encryption key PK in a circuit-secretive homomorphic encryption method to generate ciphertext C ＰＫ an encryption device for generating (m); The ciphertext C generated by the encryption device ＰＫ (m) to generate a new ciphertext C' ＰＫ (m), and the operation circuit f and the new ciphertext C' ＰＫ (m) is input and the homomorphic operation process is performed in the homomorphic encryption method to obtain the ciphertext C ＰＫ a homomorphic arithmetic unit for generating (M); The post-operation ciphertext C generated by the homomorphic arithmetic device ＰＫ a decryption device that decrypts (M) using a decryption key SK in the homomorphic encryption method; Equipped with The homomorphic arithmetic device ＰＫ A decryption circuit decrypts (m) with the decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is input to the decryption circuit, and performs homomorphic operation processing in the homomorphic encryption method to generate the new ciphertext C' ＰＫ A secret information processing system that generates (m).

Images