Fully homomorphic encryption bootstrapping system and method

Abstract

A fully homomorphic encryption bootstrapping system and method are proposed. The method includes the following steps executed by a computing device: performing large number decomposition on an original ciphertext to generate two first ciphertexts, wherein the coefficients of the two first ciphertexts are smaller than those of the original ciphertext; sequentially performing Gadget decomposition, fast Fourier transform (FFT), polynomial operations, and inverse fast Fourier transform (iFFT) on the two first ciphertexts to generate two second ciphertexts; and merging the two second ciphertexts to produce an output result, wherein the coefficient range of either of the two second ciphertexts are smaller than those of the output result.

Description

[Technical Field]

[0001] This invention relates to fully homomorphic encryption, and more particularly to a bootstrap computing system and method for fully homomorphic encryption. [Previous Technology]

[0002] Fully Homomorphic Encryption (FHE) technology allows data to be processed in an encrypted state without decryption. FHE is widely used in scenarios such as cloud computing, machine learning, and privacy data analysis. The third-generation FHE scheme (FHEW / TFHE) has lighter parameters (such as ciphertext modulus and key) and a smaller modulus to noise ratio compared to the previous generation scheme, thus making it more resistant to traditional and quantum attacks.

[0003] Bootstrapping is a crucial basic operation in FHEW / TFHE. Its main function is to reduce noise in the ciphertext, ensuring that encryption operations can continue. Bootstrapping is also the most time-consuming operation among all ciphertext operations: when the ciphertext modulus is small (less than 2 to the power of 60, 2^60), bootstrapping is 1000 to 10000 times slower than ciphertext addition, 1000 times slower than encryption, and 10000 times slower than decryption. The ciphertext form during bootstrapping consists of a ring of polynomials with integer coefficients and involves numerous polynomial operations. The coefficients of these polynomials are affected by the ciphertext modulus; therefore, as the ciphertext modulus increases, the corresponding large-coefficient polynomial operations become more complex.

[0004] However, for high-precision calculations or large number numerical analysis, FHEW / TFHE requires a larger ciphertext modulus. The fastest library currently available, TFHE-rs, does not support ciphertext moduli exceeding 2^64, while the most widely used OpenFHE requires 128-bit integers for polynomial operations when the modulus exceeds 2^60. This is extremely unfriendly to existing 64-bit computer architectures and further reduces the efficiency of the already slow bootstrap computation. [Summary of the Invention]

[0005] In view of this, the present invention proposes a fully homomorphic encryption bootstrap operation system and method to solve the above problems.

[0006] A bootstrap operation method for fully homomorphic encryption according to an embodiment of the present invention includes performing the following steps with a computing device: performing large number decomposition on the original ciphertext to generate two first ciphertexts, wherein the coefficients corresponding to the two first ciphertexts are smaller than the coefficients corresponding to the original ciphertext; sequentially performing Gadget decomposition, fast Fourier transform, polynomial operation and inverse fast Fourier transform on the two first ciphertexts to generate two second ciphertexts; and merging the two second ciphertexts to generate an output result, wherein the coefficient range corresponding to either of the two second ciphertexts is smaller than the coefficient range corresponding to the output result.

[0007] A bootstrap computing system for fully homomorphic encryption according to an embodiment of the present invention includes a storage device and a computing device. The storage device is used to store original ciphertext and a plurality of instructions. The computing device is electrically connected to the storage device. The computing device is used to execute the plurality of instructions to implement a plurality of operations, including: performing large number decomposition on the original ciphertext to generate two first ciphertexts, wherein the coefficients corresponding to the two first ciphertexts are smaller than the coefficients corresponding to the original ciphertext; sequentially performing Gadget decomposition, fast Fourier transform, polynomial operation and inverse fast Fourier transform on the two first ciphertexts to generate two second ciphertexts; and merging the two second ciphertexts to generate an output result, wherein the coefficient range corresponding to either of the two second ciphertexts is smaller than the coefficient range corresponding to the output result.

[0008] In summary, based on considerations of lightweight design and security, this invention improves upon the existing FHEW / TFHE by proposing a bootstrap computing system and method that supports large encrypted moduli (greater than 2^60), thus solving the problem that existing libraries do not support large encrypted moduli or have significantly low computational efficiency.

[0009] The above description of the disclosure and the following description of the embodiments are intended to demonstrate and explain the spirit and principles of the present invention, and to provide a further explanation of the scope of the patent application of the present invention.

Implementation Method

[0010] The detailed features and advantages of the present invention are described below in the embodiments. The content is sufficient to enable anyone skilled in the art to understand the technical content of the present invention and implement it accordingly. Based on the disclosure, patent claims, and drawings in this specification, anyone skilled in the art can easily understand the relevant objectives and advantages of the present invention. The following embodiments further illustrate the viewpoints of the present invention, but are not intended to limit the scope of the present invention in any way.

[0011] Table 1 below lists the abbreviations used in this article, along with their full names and descriptions.

[0012] Table 1 abbreviation Full name describe FFT Fast Fourier Transform Fast Fourier Transform iFFT Inverse Fast Fourier Transform Inverse Fast Fourier Transform NTT Number Theoretic Transform Number Theory Transformation LWE Learn With Error Fault-tolerant learning RLWE Ring Learning With Errors On-ring fault-tolerant learning GINX Gama–Izabachene–Nguyen–Xie A method of bootstrapping computation

[0013] Figure 1 is a block architecture diagram of a fully homomorphic encrypted bootstrap computing system according to an embodiment of the present invention. As shown in Figure 1, the bootstrap computing system includes a storage device 1 and a computing device 3.

[0014] The storage device 1 is used to store the original ciphertext, the ciphertext modulus, and a plurality of instructions, wherein the ciphertext modulus is greater than 260. In one embodiment, the storage device 1 may be at least one of the following: flash memory, hard disk, solid-state drive, dynamic random access memory, static random access memory, or other non-volatile memory; however, the present invention does not limit the type of hardware device used to implement the storage device 1.

[0015] The arithmetic device 3 is electrically connected to the storage device 1. The arithmetic device 3 is used to execute the plurality of instructions to perform a plurality of operations, including: obtaining the original ciphertext from the storage device 1; performing large number decomposition on the original ciphertext to generate two first ciphertexts; sequentially performing Gadget decomposition, fast Fourier transform, polynomial operation, and inverse fast Fourier transform on the two first ciphertexts to generate two second ciphertexts; and merging the two second ciphertexts to generate an output result. In one embodiment, the arithmetic device 3 may be at least one of the following: a personal computer, a network server, a central processing unit, a graphics processor, a microcontroller, an application processor, a field-programmable gate array, an application-specific integrated circuit, a system chip, a deep learning accelerator, or any electronic device with similar functionality; however, the present invention does not limit the type of hardware used to implement the arithmetic device 3.

[0016] Figure 2 is a flowchart of a fully homomorphic encryption bootstrap operation method according to an embodiment of the present invention. As shown in Figure 2, the bootstrap operation method includes steps S1 to S3.

[0017] Step S1: The arithmetic unit 3 obtains the original ciphertext from the storage unit 1 and performs large number decomposition on the original ciphertext to generate two first ciphertexts. This step can be expressed as: where is the large number decomposition function, represents the original ciphertext, and are the two first ciphertexts after decomposition.

[0018] The original ciphertext has the structure RLWE, which consists of two polynomials, namely:

[0019] The two first ciphertexts are:

[0020] The large number decomposition function satisfies:

[0021] The purpose of large number decomposition is to decompose a polynomial with large coefficients into multiple polynomials with small coefficients, and to control the range of small coefficients through the basis. Therefore, the coefficients corresponding to the two first ciphertexts are both smaller than the coefficients corresponding to the original ciphertexts.

[0022] In step S2, the computing device 3 sequentially performs Gadget decomposition, FFT, polynomial operation, and iFFT on the two first ciphertexts to generate two second ciphertexts. Step S2 is repeated n times before proceeding to step S3, where n is the dimension of the polynomial in the LWE ciphertext. During each Gadget decomposition, the result of the previous round of computation is used to ensure that subsequent FFT, polynomial operation, and iFFT operations can effectively reduce ciphertext noise.

[0023] In step S2, based on considerations of computational speed, this invention uses FFT instead of NTT used in the OpenFHE function library. Generally speaking, in hardware implementation, since NTT requires modulo arithmetic and uses special prime numbers as the modulus, even though both NTT and FFT can be computed using SIMD instructions, the computational cost of NTT is higher than that of FFT. In addition, there are currently more optimized algorithms for FFT, so its execution speed is faster than that of NTT. However, FFT relies on IEEE 754 floating-point arithmetic, which may lead to precision loss when the values ​​are too large. To reduce this impact, in step S1, this invention controls the range of small coefficients through basis multiplication, thus limiting the coefficients after multiplying each set of polynomials, thereby reducing the precision loss during FFT computation.

[0024] In the polynomial operation in step S2, polynomials with many small coefficients are multiplied together and have the following characteristics: When two polynomials are multiplied together, it can be expressed as, where is the output of Gadget decomposition, and the range of coefficients is limited by the basis of Gadget decomposition. Therefore, if an appropriate choice is made, only polynomials with large coefficients need to be decomposed, thereby reducing the number of polynomials that need to be decomposed.

[0025] For example, decomposing it into two polynomials with small coefficients can be expressed as:

[0026] of which

[0027] The accuracy loss can be expressed as:

[0028] where represents the relative error, which is related to the multinomial dimension and the FFT function library. Specifically, it is proportional to , that is, where is a constant, and the implementation of the FFT function library will affect the value of .

[0029] represents rounding, where is the coefficient range of , and is the coefficient range of , and:

[0030] As can be seen from the above, the resulting accuracy loss has the greatest impact on the overall accuracy. Therefore, by selecting an appropriate method, the overall accuracy loss can be reduced to only a fraction of the original value.

[0031] Step S3: The processing device 3 merges the two second ciphertexts to produce an output result. This step can be expressed as: where is the merging function, and and are the two second ciphertexts respectively, representing the output result, and satisfying:

[0032] As can be seen from the above, the coefficient range corresponding to either of the two second ciphertexts is smaller than the coefficient range corresponding to the output result. For example: if the coefficient range of is , then the coefficient range of is , and the coefficient range of is .

[0033] In summary, the present invention integrates FFT-based polynomial multiplication into bootstrapping operation. Compared with the existing process, the embodiment shown in Figure 2 adds step S1 "large number decomposition" and step S3 "RLWE ciphertext recombination". These two steps help to realize bootstrapping operation of large ciphertext modulus.

[0034] Figure 3 is a flowchart illustrating a bootstrap operation method for fully homomorphic encryption according to another embodiment of the present invention. As shown in Figure 3, before executing step S2 to generate two first ciphertexts, steps R1 to R3 are further included. In step R1, the computing device 3 performs a modulus switch on the ciphertext modulus to reduce the ciphertext modulus, for example, from to . In step R2, after the ciphertext modulus is reduced, the computing device 3 performs a key switch on the original ciphertext to reduce the dimension of the original ciphertext, for example, from to . In step R3, after the dimension of the original ciphertext is reduced, the computing device 3 again performs a modulus switch on the ciphertext modulus to reduce the ciphertext modulus, for example, from to .

[0035] It should be noted that in the prior art, the process of steps R1 to R3 is usually executed after step S2 shown in Figure 2. However, in order to enhance the advantage of using a large ciphertext modulus, the present invention adjusts the bootstrap operation process so that the ciphertext modulus entering the process of Figure 2 is a larger modulus.

[0036] Because the present invention proposes two embodiments, Figure 2 and Figure 3, it is necessary to measure the error of the ciphertext before and after entering the process of Figure 2. These errors can be regarded as Gaussian standard deviation.

[0037] The noise accumulated by calculation in the original ciphertext, the noise caused by analog-to-digital switching, and the noise caused by key switching can all be considered as Gaussian distributions. In another embodiment, since the ciphertext goes through the process shown in Figure 3 before entering the process shown in Figure 2, in addition to the originally calculated accumulated error, there will also be errors caused by two analog-to-digital switching operations and errors caused by key switching. Therefore, before entering the process shown in Figure 2, the first error is as follows:

[0038] On the other hand, given the large encrypted modulus and high efficiency, the present invention cannot ignore the accuracy loss caused by FFT. Therefore, the present invention improves the error calculation method used in the bootstrap operation so that the user can find the optimal FHE parameters. After completing the process shown in Figure 2, the second error can be regarded as the Gaussian standard deviation, as follows:

[0039] This refers to the error generated by the algorithm used in step S2, which is the error caused by the introduction of FFT, as shown below:

[0040] wherein is the precision loss of polynomial multiplication, as shown below:

[0041] These represent the precision loss caused by decomposing the polynomial into two polynomials with small coefficients, and their calculation methods can be found in the previously listed formulas. Therefore, at that time, only [the polynomial] remained.

[0042] Figure 4 is a graph showing the relationship between the basis used in the large number decomposition and the second error. As can be seen from Figure 4, when the error occurs, the error decreases significantly. Here, represents the dimension of the second ciphertext, represents the basis of the Gadget decomposition, represents the modulus of the first ciphertext, represents the relative error, and represents the number of Gadget decompositions.

[0043] Overall, in order to support ciphertext moduli greater than 260, the present invention first accelerates polynomial operations in step S1 by decomposing large numbers, and then integrates the decomposition results into step S2. To avoid decryption failure due to excessive noise in the ciphertext after bootstrapping, the loss of precision must be appropriately controlled. Since step S2 involves a large number of ring multiplication operations of polynomials with integer coefficients, and the range of coefficients of these polynomials is related to the ciphertext moduli, selecting appropriate coefficients is crucial to the accuracy of the operation.

[0044] Table 2 is a comparison of the computation time of the present invention and the prior art under different moduli. The environment settings are as follows: Implementation is based on OpenFHE, compiled using g++ 11.4 -ffast-math and OpenFHE with NATIVE_SIZE=128. OpenMP 4.5 is used for parallel processing, and FFTW v3.3.10 is used for FFT implementation. The system is a 32-core AMD Ryzen Threadripper PRO 5975WX CPU, 256GB of memory, and Ubuntu 22.04.2 LTS operating system. The computation time is based on the EvalFunc time. EvalFun is a function supported by OpenFHE, which consists of two bootstrap operations.

[0045] Table 2 method 1T(s) 32T(s) OpenFHE This invention This invention 62 62 62 3 3 4 N / A 44 44 33 33 29 7.92(1X) 0.97 (8.2X) 1.17 (6.7X) 0.28(1X) 0.04 (7X) 0.05 (5.6X) OpenFHE This invention This invention 64 64 64 3 3 4 N / A 44 44 34 34 29 8.24(1X) 0.98 (8.4X) 1.25 (6.6X) 0.28(1X) 0.04 (7X) 0.05 (5.6X) OpenFHE This invention This invention 66 66 66 3 3 4 N / A 46 46 35 35 30 8.54 (1X) 0.95 (9X) 1.23 (6.9X) 0.29(1X) 0.04 (7.3X) 0.05 (5.8X) OpenFHE This invention This invention 68 68 68 3 3 4 N / A 49 49 35 36 31 8.53(1X) 0.97 (8.8X) 1.13 (7.5X) 0.29(1X) 0.04 (7.3X) 0.05 (5.8X) OpenFHE This invention This invention 70 70 70 3 3 4 N / A 52 52 36 40 34 8.53(1X) 0.97 (8.8X) 1.12 (7.6X) 0.29(1X) 0.04 (7.3X) 0.05 (5.8X) OpenFHE This invention This invention 72 72 72 3 3 4 N / A 54 53 37 42 36 8.55 (1X) 0.95 (9X) 1.11 (7.7X) 0.29(1X) 0.04 (7.3X) 0.05 (5.8X) OpenFHE This invention This invention 74 74 74 3 3 4 N / A 57 53 37 46 36 8.55 (1X) 0.97 (8.8X) 1.18 (7.2X) 0.29(1X) 0.04 (7.3X) 0.05 (5.8X) OpenFHE This invention This invention 76 76 76 3 3 4 N / A 61 54 38 51 38 8.52(1X) 0.97 (8.8X) 1.18 (7.2X) 0.29(1X) 0.04 (7.3X) 0.05 (5.8X)

[0046] As can be seen from Table 2, the present invention can achieve a speedup of 7 to 8 times in a single thread (1T) and a speedup of 5 to 7 times in a multi-threaded (32T) environment under different moduli and the same noise level.

[0047] In summary, based on considerations of lightweight design and security, this invention improves upon existing FHEW / TFHE systems by proposing a bootstrap computing system and method that supports large encrypted moduli, thus solving the problem that existing libraries do not support large encrypted moduli or have significantly low computational efficiency. This invention can be applied to embedded systems where hardware only supports small bit numbers (such as int16). Through this method, larger moduli (such as int32) can be supported while maintaining lightweight design and high performance, achieving the effect of large moduli. In the future, when AI models need to encrypt large-scale numerical data (such as astronomical data), this invention can be used to increase the moduli size to encrypt larger plaintext, further expanding the practical application scope of fully homomorphic encryption technology in data privacy protection.

[0048] Although the present invention has been disclosed above with reference to the foregoing embodiments, it is not intended to limit the present invention. Any modifications and refinements made without departing from the spirit and scope of the present invention are within the scope of patent protection of the present invention. For the scope of protection defined by the present invention, please refer to the appended claims. [Simplified Explanation of the Diagram]

[0049] Figure 1 is a block architecture diagram of a fully homomorphic encryption bootstrap computing system according to an embodiment of the present invention;

[0050] Figure 2 is a flowchart illustrating a bootstrap operation method for fully homomorphic encryption according to an embodiment of the present invention;

[0051] Figure 3 is a flowchart illustrating a bootstrap operation method for fully homomorphic encryption according to another embodiment of the present invention; and

[0052] Figure 4 is a graph showing the relationship between the basis used in large number decomposition and the second error.

Claims

1. A bootstrap computation method for fully homomorphic encryption, comprising, performed by a computing device: performing large number decomposition on an original ciphertext to generate two first ciphertexts, wherein the coefficients corresponding to the two first ciphertexts are less than the coefficients corresponding to the original ciphertext; sequentially performing Gadget decomposition, Fast Fourier Transform, polynomial operation, and Inverse Fast Fourier Transform on the two first ciphertexts to generate two second ciphertexts; and merging the two second ciphertexts to generate an output result, wherein the coefficient range corresponding to either of the two second ciphertexts is less than the coefficient range corresponding to the output result; wherein the basis of the large number decomposition is , and , where represents the basis of the Gadget decomposition, represents the modulus of the two first ciphertexts, represents the relative error, represents the number of decompositions in the Gadget decomposition, and represents the dimension of the second ciphertext.

2. The bootstrap method for fully homomorphic encryption as described in claim 1, further comprising, before generating the two first ciphertexts: Modulus switching is performed on the ciphertext modulus to reduce the ciphertext modulus, where the ciphertext modulus is greater than 2 to the power of 60; After the ciphertext modulus is reduced, the original ciphertext is key-switched to reduce its dimensionality; and after the original ciphertext dimensionality is reduced, the ciphertext modulus is switched again to reduce its modulus.

3. A fully homomorphic encryption bootstrap computing system, comprising: A storage device for storing the original ciphertext and multiple instructions; The storage device includes a computing unit electrically connected to the storage device, the computing unit executing instructions to perform multiple operations, the operations including: retrieving the original ciphertext from the storage device and performing large number decomposition on the original ciphertext to generate two first ciphertexts, wherein the coefficients corresponding to the two first ciphertexts are less than the coefficients corresponding to the original ciphertext; sequentially performing Gadget decomposition, fast Fourier transform, polynomial operation, and inverse fast Fourier transform on the two first ciphertexts to generate two second ciphertexts; and merging the two second ciphertexts to generate an output result, wherein the coefficient range corresponding to either of the two second ciphertexts is less than the coefficient range corresponding to the output result; wherein the basis of the large number decomposition is , and , where represents the basis of the Gadget decomposition, represents the modulus of the two first ciphertexts, represents the relative error, represents the number of decompositions of the Gadget decomposition, and represents the dimension of the second ciphertext.

4. The fully homomorphic encryption bootstrap computing system as described in claim 3, wherein the storage device is further used to store ciphertext moduli greater than 2 to the power of 60, and the operations further include: Before generating the two first ciphertexts, the ciphertext modulus is switched to reduce the ciphertext modulus; After the ciphertext modulus is reduced, the original ciphertext is key-switched to reduce its dimensionality; and after the original ciphertext dimensionality is reduced, the ciphertext modulus is switched again to reduce its modulus.

Images