Ciphertext processing method and apparatus

Abstract

Embodiments of the present application disclose a ciphertext processing method and apparatus. The method can be applied to a homomorphic computing party, and comprises: first, obtaining a target learning with error (LWE) ciphertext at level 0; then, converting the target LWE ciphertext at level 0 to obtain a first RLWE ciphertext at level 2; next, performing redundancy removal on the first RLWE ciphertext at level 2 to obtain a first target RLWE' ciphertext; and finally, obtaining a target RGSW ciphertext at level 2 on the basis of the first target RLWE' ciphertext. Using the method to convert the ciphertext form and reduce noise of a ciphertext can not only improve the efficiency of ciphertext processing, but also reduce the storage overhead incurred during the ciphertext processing.

Description

A method and device for processing ciphertext Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a ciphertext processing method and device. Background Art

[0002] To ensure the privacy of user data, fully homomorphic encryption (FHE) technology has been proposed. This encryption technology supports performing arbitrary operations (including addition and multiplication) on ciphertext. The result of the ciphertext operation, after decryption, is the same as the result obtained by performing the corresponding operation on the unencrypted plaintext data. To ensure the security of the ciphertext, FHE schemes generally require the introduction of noise. However, as the number of ciphertext operations increases, the noise in the ciphertext also increases, causing subsequent ciphertext decryption failures. To overcome this problem and enable FHE schemes to support an unlimited number of homomorphic operations, FHE schemes introduce a bootstrapping process. After a number of homomorphic operations on the ciphertext, it is determined whether the noise level of the ciphertext has reached the threshold that supports correct decryption. If so, the ciphertext with high noise is bootstrapped (refreshed) to obtain a new ciphertext with low noise.

[0003] Boolean fully homomorphic encryption (TFHE) provides a hierarchical homomorphic computation model that can efficiently compute multi-input lookup tables (LUTs), bit sequence representations (BSRs), and weighted finite automata (WFAs). Because the inputs and outputs of hierarchical homomorphic computations are ciphertexts of different types (forms) and cannot be directly combined for computation, a circuit bootstrapping process is required to reduce (refresh) the ciphertext noise while converting the ciphertext type (form). However, in the TFHF hierarchical homomorphic computation model, the circuit bootstrapping process involves numerous polynomial multiplications and linear combination operations, resulting in long computational time and low computational efficiency. Furthermore, the bootstrapping key used in the bootstrapping process is large in size, resulting in high storage overhead. Therefore, improving the computational efficiency of ciphertext bootstrapping and reducing the storage overhead of the bootstrapping process are currently pressing issues.

[0004] Summary of the Invention

[0005] The present application provides a ciphertext processing method and apparatus, which can effectively improve the computational efficiency of the ciphertext bootstrapping process and reduce storage overhead.

[0006] In the first aspect, an embodiment of the present application provides a ciphertext processing method, which can be applied to a homomorphic computing party. The method can be executed by a device of the homomorphic computing party (which can be referred to as a homomorphic computing device) or a corresponding component (module, chip, etc.); or it can be executed by a device corresponding to the homomorphic computing device and used, and the present application does not make specific restrictions on this. The method can specifically include: obtaining a target error-learning LWE ciphertext of level 0; converting the target LWE ciphertext of level 0 to obtain a first RLWE ciphertext of level 2; performing redundancy processing on the first RLWE ciphertext of level 2 to obtain a first target RLWE' ciphertext; and obtaining a target RGSW (ring GSW) ciphertext of level 2 based on the first target RLWE' ciphertext.

[0007] In the embodiment of the present application, the target RGSW ciphertext of level 2 can be used for, but not limited to, the next hierarchical homomorphic computation.

[0008] The solution described in the embodiment of the present application is an improvement based on the current TFHE circuit bootstrap process. The current TFHE circuit bootstrap process involves three levels (i.e., level 0, level 1, and level 2), while the embodiment of the present application performs the circuit bootstrap process (i.e., converting the target LWE ciphertext at level 0 to obtain the first RLWE ciphertext at level 2) only involving two levels (i.e., level 0 and level 2), so the ciphertext bootstrap process is executed more efficiently; in addition, the solution of the present application further removes redundant items from the first RLWE ciphertext after bootstrapping to obtain the target RGSW ciphertext, thereby reducing the storage overhead occupied by the ciphertext bootstrap process.

[0009] In one possible implementation, obtaining a target error-learning LWE ciphertext of level 0 includes: first obtaining an initial LWE ciphertext of level 2, where the initial LWE ciphertext of level 2 is obtained through hierarchical homomorphic computation based on the RGSW ciphertext of level 2; and then performing key switching on the initial LWE ciphertext of level 2 to obtain the target LWE ciphertext of level 0.

[0010] Through this implementation, the target LWE ciphertext of level 0 can be effectively obtained for use in the bootstrapping process.

[0011] In one possible implementation, the target LWE ciphertext at level 0 is converted to obtain a first RLWE ciphertext at level 2, including: obtaining a target key; performing sparsification processing on the target LWE ciphertext at level 0 to obtain a sparse target LWE ciphertext; determining an initial accumulator value that satisfies the RLWE ciphertext form; processing the sparse target LWE ciphertext, the initial accumulator value that satisfies the RLWE ciphertext form, and the target key using a blind rotation algorithm to obtain an updated accumulator value; and obtaining the first RLWE ciphertext at level 2 based on the updated accumulator value.

[0012] Through this implementation, the target LWE ciphertext of level 0 can be effectively converted into the first RLWE ciphertext of level 2. In addition, since the larger the level value, the smaller the noise of the ciphertext, it can be seen that the noise of the ciphertext is also reduced while converting the ciphertext form.

[0013] In one possible embodiment, the target key includes a bootstrap key and an auxiliary key, and an automorphic key set, the automorphic key set including at least one automorphic key; the bootstrap key is the first RGSW ciphertext after the homomorphic encryption of the homomorphic key component of level 0 is homomorphically encrypted using the homomorphic encryption key of level 2; the automorphic key is the RLWE ciphertext after the automorphism of the key plaintext is homomorphically encrypted using the homomorphic key, and the auxiliary key is the second RGSW ciphertext after the sum of the homomorphic key components of level 0 is homomorphically encrypted using the homomorphic encryption key of level 2.

[0014] Optionally, the target key includes a bootstrap key, an auxiliary key, and a self-similar key set. In the embodiment of the present application, the key types and corresponding quantities included in the target key may not be limited to the above.

[0015] Through this implementation, the target key includes the keys required for the bootstrapping process of the embodiment of the present application, so that the bootstrapping process is executed effectively and accurately.

[0016] In a possible implementation, performing sparsification processing on the target LWE ciphertext at level 0 to obtain a sparse target LWE ciphertext includes: performing sparsification rounding processing on each component of the target LWE ciphertext using a module switching method to obtain the sparse target LWE ciphertext, wherein each component of the sparse target LWE ciphertext satisfies k·2 θ In the form of , k is an integer greater than or equal to 0, and θ is a positive integer.

[0017] Through this implementation, each component of the target LWE ciphertext can be effectively sparsified into k·2 θ , which is used in the subsequent sparse isomorphism-based automorphism blind rotation algorithm.

[0018] In one possible implementation, the sparse target LWE ciphertext consists of a first part and a second part; determining an initial value of the accumulator that satisfies the RLWE ciphertext form includes: obtaining a test polynomial; and obtaining the initial value of the accumulator that satisfies the RLWE ciphertext form based on the second part of the sparse target LWE ciphertext and the test polynomial.

[0019] Through this implementation, the accumulator initial value (ie, the initial value of the accumulator) that satisfies the RLWE ciphertext form can be effectively obtained.

[0020] In a possible implementation, the sparse target LWE ciphertext consists of a first part and a second part; based on the sparse target LWE ciphertext, the accumulator initial value that satisfies the RLWE ciphertext form, and the target key, a blind rotation algorithm is used to process to obtain an updated accumulator value, which may include: rotating each component of the first part of the sparse target LWE ciphertext from k·2 θ Convert to k·2 θ +1 form; perform outer product calculation on the accumulator initial value and the auxiliary key that satisfy the RLWE ciphertext form to obtain the first accumulator value; based on each component satisfying k·2 θ The sparse target LWE ciphertext in the form of +1, the first accumulator value, the bootstrap key and the automorphic key set are used to obtain the updated accumulator value through a blind rotation algorithm.

[0021] Through this implementation, the blind rotation algorithm operation can be effectively implemented without destroying the isomorphism.

[0022] In the embodiment of the present application, based on the fact that each component satisfies k·2 θ The sparse target LWE ciphertext in the form of +1, the first accumulator value, the bootstrap key, and the automorphic key set are used to obtain the updated accumulator value through a blind rotation algorithm, which may include but is not limited to the following specific implementations:

[0023] Implementation method 1: The automorphic key set includes w automorphic keys, where w is an integer greater than 1;

[0024] Get the updated accumulator value, which may include:

[0025] First, each component of the sparse target LWE ciphertext is transformed from k·2 θ +1 form converted to g k form; Z represents a set of integers, N is a power of 2; then each component satisfies g k The sparse target LWE ciphertext of the form is determined A set I;

[0026] Furthermore, for set I l , Set the initial value of counter v to 0, and repeat the following steps in descending order of the value of l. times: based on the current value of the accumulator and the bootstrap key, perform outer product processing and update the current value of the accumulator; the value of the counter v is increased by 1; when a preset condition is met, perform the automorphism algorithm once based on the currently updated value of the accumulator and the automorphism key to obtain a new accumulator value and reset the value of the counter v to 0; the preset condition includes any of the following:

[0027] v=w、next set I l-1 Not a non-empty set, l = 1;

[0028] When l=0, for the set I0, the following steps are performed: based on the current value of the accumulator and the bootstrap key, an outer product process is performed to obtain the updated accumulator value.

[0029] In a possible implementation, the size of w can be determined by using a Monte Carlo method and preset parameters.

[0030] Through this first embodiment, using an automorphic key set, multiple automorphisms can be combined to perform one (one) automorphism calculation, thereby improving the efficiency of the automorphism calculation and further improving the computational efficiency of the circuit bootstrapping.

[0031] Implementation method 2: Obtaining the updated accumulator value may specifically include:

[0032] First, each component of the sparse target LWE ciphertext is transformed from k·2 θ +1 form converted to g k form; Z represents a set of integers, N is a power of 2; then, based on this, each component satisfies g k The sparse target LWE ciphertext of the form is determined A set I;

[0033] Furthermore, for set I l , Repeat the following steps in descending order of l value: Second: Based on the current value of the accumulator and the bootstrap key, perform outer product processing and update the current value of the accumulator; Based on the currently updated value of the accumulator and the automorphism key, perform the automorphism algorithm once to obtain a new accumulator value;

[0034] When l=0, for the set I0, perform: based on the current value of the accumulator and the bootstrap key, perform outer product processing to obtain the updated accumulator value.

[0035] Through this second embodiment, an automorphic key is used to perform automorphic calculations, thereby effectively reducing the storage overhead generated by the key, and further reducing the storage overhead of the circuit bootstrapping process.

[0036] In one possible implementation, obtaining the first RLWE ciphertext of level 2 based on the updated accumulator value includes: adding the updated accumulator value to X -j Perform product processing to obtain the first RLWE ciphertext of level 2; j∈[0,l-1].

[0037] In one possible implementation, performing redundancy removal processing on the first RLWE ciphertext at level 2 to obtain a first target RLWE' ciphertext may include: first obtaining a level 2 automorphic key of a homomorphic estimation trace algorithm; then executing the homomorphic estimation trace algorithm once to eliminate redundant items in the first RLWE ciphertexts to obtain a level 2 RLWE ciphertext free of redundant items; and finally concatenating the level 2 RLWE ciphertexts free of redundant items to obtain the first target RLWE' ciphertext at level 2. In this embodiment of the present application, the aforementioned l represents the dimension of the decomposition vector.

[0038] Through this embodiment, the first target RLWE′ ciphertext of level 2 with redundancy removed (ie, valid) can be obtained efficiently.

[0039] In one possible implementation, obtaining the target RGSW ciphertext of level 2 based on the first target RLWE' ciphertext may include: first obtaining a scheme switching key; then, based on the first target RLWE' ciphertext and the scheme switching key, using a scheme switching algorithm to perform calculations to obtain the second target RLWE' ciphertext; finally, concatenating the first target RLWE' ciphertext and the second target RLWE' ciphertext to obtain the target RGSW ciphertext of level 2.

[0040] Through this implementation, the target RGSW ciphertext of level 2 can be effectively obtained based on the first target RLWE' ciphertext.

[0041] In one possible implementation, the method further includes: receiving a homomorphic computation key, parameters of the homomorphic computation key, and homomorphic scheme parameters from a homomorphic key generator; the homomorphic computation key may include, but is not limited to, one or more of the following:

[0042] a set of bootstrap keys, a set of automorphic keys, an auxiliary key, a set of automorphic keys of the homomorphic trace algorithm, a scheme switching key, and at least one key switching key;

[0043] The parameters of the homomorphic computation key may include, but are not limited to, one or more of the following:

[0044] Level 0 LWE ciphertext dimension, level 2 ciphertext modulus, integer set The generator {g} of , the number w of automorphic keys in the set of automorphic keys, and the dimension of the ring polynomial of level 2;

[0045] The homomorphic scheme parameters may include but are not limited to one or more of the following:

[0046] LWE ciphertext dimensions at each level, ciphertext modulus at each level, decomposition basis for outer product operations in function bootstrapping, decomposition dimension or length for outer product operations in function bootstrapping, decomposition basis for key switching, and decomposition dimension or length for key switching.

[0047] In an embodiment of the present application, the key types and corresponding quantities included in the above-mentioned homomorphic computing keys may not be limited to the above.

[0048] Through this implementation, the homomorphic computing party can effectively obtain the keys and key parameters in the circuit bootstrapping process, thereby effectively performing circuit bootstrapping.

[0049] In a second aspect, the present application provides a ciphertext processing device, which has the function of implementing the above-mentioned first aspect. For example, the ciphertext processing device includes a module or unit or means corresponding to the operation involved in the above-mentioned first aspect. The module or unit or means can be implemented by software, or by hardware, or the corresponding software can be implemented by hardware.

[0050] In one possible design, the ciphertext processing device includes a communication unit and a processing unit. The communication unit can be used to send and receive data and / or information to enable communication between the ciphertext processing device and other devices; the processing unit can be used to perform certain internal operations of the communication device. The functions performed by the processing unit and the communication unit can correspond to the operations described in the first aspect above.

[0051] In a third aspect, an embodiment of the present application provides a cryptographic processing device, which includes: at least one processor and a communication interface; wherein the communication interface is used to communicate with other devices; the processor is used to run a set of programs so that the cryptographic processing device implements the method provided by the above-mentioned first aspect or any possible implementation method thereof.

[0052] In a fourth aspect, the present application provides a computer-readable storage medium, in which computer-readable instructions are stored. When a computer reads and executes the computer-readable instructions, the computer executes the method provided in the first aspect or any possible implementation method thereof.

[0053] In a fifth aspect, the present application provides a computer program product. When a computer reads and executes the computer program product, the computer executes the method provided in the first aspect or any possible implementation method thereof.

[0054] In a sixth aspect, the present application provides a chip, which includes a processor. The processor is coupled to a memory and is used to read and execute a software program stored in the memory to implement the method provided in the first aspect or any possible implementation method thereof.

[0055] In a possible implementation, the chip may include the memory. Optionally, the processor and the memory may be integrated together.

[0056] In a possible implementation, the memory may be a memory outside the chip.

[0057] In the seventh aspect, the present application provides a communication system, which includes a homomorphic encryption party, a homomorphic computing party, and a homomorphic decryption party; the homomorphic computing party is used to execute the method provided in the above-mentioned first aspect or any possible implementation method thereof.

[0058] It should be noted that the technical effects that can be achieved by any possible implementation method of the above-mentioned second to seventh aspects or the second to seventh aspects can be described in correspondence with the technical effects that can be achieved by any possible implementation method of the above-mentioned first aspect or the first aspect; they will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 is a schematic diagram of the plaintext and ciphertext forms corresponding to LWE, RLWE, and RGSW;

[0060] FIG2A is a schematic diagram of a sample extraction algorithm flow;

[0061] FIG2B is a schematic diagram of a structure of sample extraction;

[0062] FIG3A is a schematic diagram of a key generation process of a homomorphic key generator;

[0063] FIG3B is a schematic diagram of a homomorphic encryption method performing an encryption process;

[0064] FIG3C is a schematic diagram of a decryption process performed by a homomorphic decryption party;

[0065] FIG3D is a schematic diagram of a homomorphic computing process performed by a homomorphic computing party;

[0066] FIG3E is a schematic diagram of homomorphic encryption;

[0067] FIG4A is a schematic diagram of the structure of a function bootstrap;

[0068] FIG4B is a schematic diagram of a circuit bootstrap structure;

[0069] FIG4C is a schematic diagram of the entire blind rotation process;

[0070] FIG4D is a schematic diagram of a TFHE function bootstrapping algorithm process;

[0071] FIG4E is a schematic diagram of a circuit bootstrapping algorithm flow of a PBSmanyLUT;

[0072] FIG5 is a schematic diagram of a system architecture to which the method according to an embodiment of the present application can be applied;

[0073] FIG6A is a schematic diagram of a flow chart of a ciphertext processing method provided in an embodiment of the present application;

[0074] FIG6B is a flowchart of a circuit bootstrap architecture provided by an embodiment of the present application;

[0075] FIG7 is a flow chart of an MV-FBS algorithm without sample extraction provided in an embodiment of the present application;

[0076] FIG8 is a flow chart of a blind rotation algorithm (BR3) provided in an embodiment of the present application;

[0077] FIG9 is a flow chart of a blind rotation algorithm (BR2) provided in an embodiment of the present application;

[0078] FIG10 is a flow chart of a blind rotation algorithm (BR1) provided in an embodiment of the present application;

[0079] FIG11 is a schematic diagram of a flow chart of a homomorphic evaluation algorithm for a trace function provided in an embodiment of the present application;

[0080] FIG12 is a schematic diagram of a flow chart of a scheme switching algorithm provided in an embodiment of the present application;

[0081] FIG13 is a schematic diagram of a homomorphic computing scenario to which the method according to an embodiment of the present application can be applied;

[0082] FIG14 is a schematic diagram of the structure of a ciphertext processing device provided in an embodiment of the present application;

[0083] FIG15 is a schematic diagram of the structure of another ciphertext processing device provided in an embodiment of the present application;

[0084] FIG16 is a schematic diagram of the device structure of a chip provided in an embodiment of the present application. DETAILED DESCRIPTION

[0085] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. The terms used in the following embodiments are only for the purpose of describing specific embodiments and are not intended to be limiting of the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include expressions such as "one or more", unless there is a clear contrary indication in the context. It should also be understood that in the embodiments of the present application, "one or more" refers to one, two or more; "and / or" describes the association relationship of associated objects, indicating that three relationships may exist; for example, A and / or B can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the related objects before and after are in an "or" relationship.

[0086] The terms "including," "comprising," "having," and their variations in the embodiments of this application all mean "including but not limited to," unless otherwise specifically emphasized. Words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. The use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete manner for easier understanding.

[0087] The "multiple" involved in the embodiments of the present application means greater than or equal to two. It should be noted that in the description of the embodiments of the present application, the words "first" and "second" are only used for the purpose of distinguishing the description and cannot be understood as indicating or implying relative importance or order.

[0088] This application provides a method for processing ciphertext. To better understand the embodiments of this application, the following first explains the symbols, algorithms, and related technical features involved in the embodiments of this application. It should be noted that these explanations are intended to make the embodiments of this application easier to understand and should not be regarded as limiting the scope of protection claimed by this application.

[0089] 1. Description of symbols in the embodiments of this application:

[0090] Vector: Lowercase bold letters denote vectors. For example, a vector a with n elements is described as a = (a1, ..., a n ).<a,b> is the inner product between two vectors.

[0091] Matrix: Indicated by uppercase bold letters.

[0092] Represents a set of integers.

[0093] Represents the set of real numbers. Represents the binary set {0,1}.

[0094] Indicates a ring in The range is is the ciphertext modulus q.

[0095] r represents a real number,

[0096] symbol They are respectively expressed as: floor, ceiling, and round functions.

[0097] represents a 2N-th cyclotomic ring, modulo X N +1 integer polynomial where N is a power of 2.

[0098] The coefficient is The quotient ring on the

[0099] express Polynomials with binary coefficients in .

[0100] Real torus is the set of real numbers modulo 1.

[0101] is a torus polynomial, that is Where N is a power of 2.

[0102] Polynomial The coefficient vector can be expressed as φ(m)=(m0,...,m N-1 ).

[0103] x←D: represents sampling x according to distribution D.

[0104] random variable Var(a) represents the variance of a, and stddev(a) represents the standard deviation of a.

[0105] vector Indicates that the 2-norm of the polynomial is calculated using the coefficient vector.

[0106] Semicolon: Indicates the vertical concatenation of vectors or matrices, such as [A; B].

[0107] II. Description of the algorithms involved in the implementation of this application:

[0108] 1. Gadget decomposition:

[0109] Gadget decomposition includes various methods, including digit decomposition and residue number system (RNS) decomposition. Digit decomposition uses a basis to break down a large number into multiple independent smaller numbers. RNS decomposition uses the Chinese remainder theorem (CRT) to decompose the large modulus of a polynomial into a set of coprime integer moduli.

[0110] The following is an introduction to the digital decomposition technology involved in the embodiments of the present application:

[0111] Assuming the radix base of the gadget is B, digital decomposition can use the base to decompose a large number into multiple independent small numbers.

[0112] set up Q is the ciphertext modulus. The decomposition function h is based on the base B. -1 or g -1 , the decomposition function is to divide the ciphertext by the decomposition basis one by one. -1 For example, the decomposition function h -1 Satisfy the following formula (1):

[0113] The expansion function h or g is to multiply the ciphertext by the basis successively. Taking h as an example, the expansion function satisfies the following formula (2):

[0114] Therefore, for any You can get: <h -1 (a),h(b)>≡a·b mod Q.

[0115] In the outer product operation of the current technology, the homomorphic message ciphertext is decomposed into small values ​​through gadget, that is, h -1(), similarly, the expression structure of the bootstrap key also corresponds to the use of the gadget expansion function h(), so that h() and h -1 () can be canceled, which does not affect the correctness of the calculation results and can reduce noise.

[0116] 2. Homomorphic encryption of different ciphertext forms (ciphertext types):

[0117] There are usually multiple forms (types) of ciphertext, such as ciphertext in the form of learning with errors (LWE), torus version of the learning with errors (TLWE), ciphertext in the form of ring learning with errors assumption (RLWE), torus version of the ring-LWE problem (TRLWE), ciphertext in the form of ring GSW (Ring version of Gentry Sahai Water's, RGSW), and torus version of RGSW TRGSW. In an embodiment of the present application, these ciphertext forms can be converted to each other to cope with different computing tasks. The following describes the aforementioned ciphertext forms accordingly.

[0118] (1)LWE:

[0119] An LWE sample is represented as a vector b=<a,s> +e mod q; where the secret key s is an n-dimensional vector that can be sampled from a key distribution χ (e.g., a Gaussian distribution); is a uniformly random n-dimensional vector from The error (which can be equivalent to noise) e←χ δ Sampling from an error distribution (e.g., Gaussian distribution). The positive integers n and q represent the vector dimension and the ciphertext modulus, respectively.

[0120] For example, the LWE ciphertext of message m can be expressed as △ = q / t, t is the plaintext modulus. The dimensions of b, m, and e are 1

[0121] (2)TLWE:

[0122] The TLWE ciphertext is the Torus version of LWE and can be expressed as Specifically, b=<a,s> +m+e, where vector a is from uniformly sampled from B, the key s is n uniform sampling, is the plaintext message, and the error e is sampled from a Gaussian distribution with mean 0 and standard deviation σ.

[0123] (3)RLWE:

[0124] RLWE is R Q A valid RLWE sample can be represented as a pair of Among them, the secret key s of the RLWE sample is sampled from the key distribution χ (such as Gaussian distribution), and a is in R Q Uniformly random, error is sampled from the error distribution. Then (a, b) is equivalent to the RLWE ciphertext of message 0. To simplify the description, the polynomial dimension N of RLWE is generally ignored.

[0125] Similar to the LWE sample, the RLWE ciphertext of message m can be expressed as Where △ = Q / t, t is the plaintext modulus.

[0126] The encryption of LWE and RLWE corresponds to the following two formulas (3) and (4):

[0127] The decryption of LWE and RLWE corresponds to the following two formulas (5) and (6):

[0128] (4)TRLWE:

[0129] The TRLWE ciphertext is the Torus version of RLWE and can be expressed as Specifically, b=<a,s> +m+e; where a is from The key s is uniformly sampled from uniform sampling, is the plaintext message polynomial; the error is a polynomial with random coefficients, Sample from a Gaussian distribution with mean 0 and standard deviation σ.

[0130] (5)RGSW (can also be expressed as RLWE'):

[0131] An RGSW sample is a vector based on d RLWE samples and can be expressed as Given a gadget vector v=(v0,v1,...,v d-1 ), RLWE' represents the concept of gadget RLWE, which can be defined as the following formula (7): RLWE' sk (m) = (RLWE sk (v0·m),RLWE sk (v1·m),...,RLWE sk (v d-1 ·m)); (7)

[0132] sk is the key, then the message m∈R q The RGSW ciphertext can be expressed as the following formula (8): RGSW sk (m) = (RLWE′ sk (sk·m),RLWE′ sk (m)); (8)

[0133] Among them, the parameters of the same dimension and ciphertext modulus are omitted here.

[0134] (6)TRGSW:

[0135] TRGSW is a torus version of RGSW that can convert plaintext messages Encrypted to ciphertext in, It is a matrix, each row of the matrix Z is the TRLWE ciphertext of the plaintext message 0 under the same key; h -1 is the gadget decomposition matrix, which is used to control noise propagation.

[0136] Assume k = 1, TRGSW ciphertext It can be further expressed as the following formula (9):

[0137] in, is the TRLWE ciphertext of plaintext message 0 encrypted with the same key, B g represents the basis of gadget decomposition, is the length of the gadget decomposition.

[0138] The different plaintext and ciphertext forms corresponding to the above-mentioned LWE, RLWE, and RGSW are shown in FIG1 .

[0139] 3. Products:

[0140] (1) Gadget decomposition product (Gadget Product):

[0141] The gadget product is R×RLWE′→RLWE, which is defined as follows:

[0142] Where t∈R, (t0,t1,...,t l-1 ) is the gadget decomposition of t based on the gadget decomposition vector v, that is, ∑ i v i t i = t. B = max{t i} is the gadget decomposition basis, l is the gadget decomposition length. The noise variance of the gadget product result is is the noise variance of the input RLWE' ciphertext, and N is the polynomial dimension.

[0143] (2) External Product:

[0144] Enter the RLWE ciphertext: RLWE sk (m1)=(a,b),RGSW sk (m2) = (RLWE′ sk (sk·m2),RLWE′ sk (m2)).

[0145] The result of the external product operation between the RGSW ciphertext and the RLWE ciphertext is the RLWE ciphertext, which is shown in the following formula (11): sk (m1)⊙RGSW sk (m2)=(a,b)⊙(RLWE′ sk (sk·m2),RLWE′ sk (m2)) = a⊙RLWE′ sk (sk·m2)+b⊙RLWE′ sk (m2) = RLWE sk (a·sk·m2+b·m2) =RLWE sk ((a·sk+b)·m2) =RLWE sk (m1·m2+e1·m2); (11)

[0146] If m2 has a small norm, such as binary, then the noise term e1·m2 will be small enough. Thus, the output of the outer product is the RLWE encryption of the message m1·m2, and its noise variance is upper bounded by in, represents the noise variance of the gadget product result of the input RGSW ciphertext, represents the noise variance of the input RLWE ciphertext.

[0147] (3) Outer product in blind rotation:

[0148] The homomorphic ciphertext in RLWE form can be expressed as: μ1 can identify homomorphically encrypted messages. Perform gadget decomposition on RLWE(μ1) and split the decomposed polynomial into l parts (e.g., l is 3), which can be expressed as

[0149] Homomorphic ciphertext in RGSW form can be expressed as: That is, 2l RLWE-form ciphertexts and 1 gadget matrix, μ2 can be identified as the homomorphic decryption key.

[0150] The outer product in blind rotation can be expressed as the following formula (12):

[0151] In the above formula (12), s is a part of the homomorphic decryption key in the homomorphic ciphertext in RGSW form, (A,A·s) is the homomorphic encryption key, which is equivalent to pk' in the bootstrapping process. is the gadget matrix, g=(B 0 ,B 1 ,...,B l-1 ), B is the decomposition basis of gadget.

[0152] 4. Key switching:

[0153] Key switching technology can change the size and key in the ciphertext, which requires the use of corresponding key switching keys. The LWE-to-LWE key-switching process is as follows:

[0154] (1) Key switching key generation algorithm:

[0155] For example, with key z∈Z N ,s∈Z n ,B k As input, B k As the base, the key switching key is generated by the key switching key generation algorithm and the key switching key is output.

[0156] (2) Key switching process:

[0157] Given a key switching key ksk i,j and ciphertext That is, b = a·z+m+e, and the key switching operation calculates each coefficient of the LWE ciphertext Base B k Expand and output the ciphertext ct′ after key switching, which is expressed as the following formula (13):

[0158] Correctness verification:

[0159] Set key switch key For some and e i,j ∈χ δ , we can get a′=-∑ i ∑ j a i,j a′ i,j and b′=ba·z+a′·s-∑ i ∑ j a i,j e i,j , which is a LWE ciphertext under a new secret key s, and the variance of the noise satisfies: The noise e can be obtained from the error distribution χ δ (such as Gaussian distribution).

[0160] Trade-offs between efficiency and storage:

[0161] There is currently a technique that adds a more efficient and less noisy variation on key switching. The main idea is to store B k The key is switched between two keys, and the LWE ciphertext is then used to retrieve the corresponding key material.

[0162] In this case, the key switching key is

[0163] The key switching operation can be expressed as the following formula (14):

[0164] Therefore, the variance of the noise is: Var(e′)≤Nd k ·Var(e ksk )+Var(e).

[0165] 5. Public key switching algorithm:

[0166] The public key switching algorithm refers to the homomorphic calculation of a given public function f while switching the key.

[0167] For example, define a public Lipschitz morphism as And, the public key switching key is PubKS key =RLWE′ sk′ (sk i ),i∈[1,n],sk i is the i-th item of the LWE key.

[0168] The public key switching key is n RLWE' ciphertexts, which contains nt RLWE ciphertexts in total. t represents the dimension of gadget decomposition (t is defined here to distinguish it from l in scheme switching described below. The specific parameter selection varies in different algorithms to avoid confusion).

[0169] Then, the LWE to RLWE public key switching algorithm is shown in the following equation (15):

[0170] The specific definition is shown in the following formula (16):

[0171] Among them, the input includes: ciphertext LWE sk (m)=(a i ,b), the key sk corresponding to the ciphertext, the function f, and the public key switching key RLWE′ sk′ (sk i ).

[0172] Homomorphic computation refers to the homomorphic computation of the function f while performing public key switching.

[0173] Output includes: Ciphertext RLWE sk′ (f(m)), the corresponding key is sk′, that is, the key is switched from sk to sk′, and the function f is calculated.

[0174] 6. Private Key Switching Algorithm:

[0175] Privacy key switching refers to calculating a given privacy function f while switching the key.

[0176] For example, define a private Lipschitz morphism as And, the privacy key switching key PrivKS key Includes: RLWE' sk′ (f(sk i )),i∈[1,n] and RLWE′ sk′ (f(1)),sk i is the i-th item of the LWE key.

[0177] Then, the LWE to RLWE privacy key switching algorithm is shown in Equation (17):

[0178] The specific definition is shown in the following formula (18):

[0179] 7. Scheme switching algorithm:

[0180] The scheme switching algorithm is to calculate the RGSW ciphertext by Gadget RLWE ciphertext. For example, define the scheme switching key SS key =RLWE′ sk (sk 2 ), is an RLWE' ciphertext, containing l RLWE ciphertexts, where l represents the dimension of gadget decomposition (l is defined to distinguish it from the above t, indicating that the specific parameters in different algorithms are different to avoid confusion).

[0181] The scheme switching algorithm is shown in the following formula (19): SS RLWE′→RGSW :RLWE′ sk (m)→RGSW sk (m); (19)

[0182] Specifically, for each RLWE with noise e′ sk (v i ·m)=(a i ,b i ),i∈[0,l-1], that is, l RLWE sk (v i m) can be assembled into a RLWE′ sk (m), then the other components RLWE′ of the RGSW ciphertext are calculated by the above formula (19): sk (sk·m), RLWE′ sk The calculation of the i-th RLWE ciphertext in (sk·m) is specifically expressed as follows: (a i ⊙RLWE′ sk (sk 2 )+(b i ,0)) =RLWE sk ((a i ·sk 2 )+b i ·sk)=RLWE sk ((a i ·sk+b i )·sk)=RLWE sk (v i ·sk·m+ei ·sk); (20)

[0183] Thus, RLWE′ sk (sk·m) and RLWE′ sk (m) are assembled together to obtain the RGSW ciphertext, which can be expressed as the following formula (21): SS RLWE′→RGSW (RLWE′ sk (m)):=(RLWE′ sk (sk·m),RLWE′ sk (m)); (21)

[0184] 8. Sample extraction:

[0185] Through the sample extraction operation, LWE / TLWE ciphertext can be extracted from RLWE / TRLWE ciphertext.

[0186] Specifically, given a ciphertext c = (a(x), b(x)) ∈ TRLWE(m(x)), index i ∈ [0, N-1], we can extract the TLWE ciphertext (a, b) of the i-th coefficient of the message m(x) without introducing any new noise. This operation can be called sample extraction. i (c) The sample extraction algorithm inputs a RLWE ciphertext c = (a, b) ∈ RLWE sk,q (m) and given position i, can output or return an LWE ciphertext LWE sk,q (m i ), where m i is the i-th coefficient of m.

[0187] For example, SampleExtract0(c) is This can be easily proved by decrypting TRLWE. Referring to FIG2A , it shows a sample extraction algorithm flow; FIG2B shows a schematic diagram of the process of extracting samples based on RLWE to obtain LWE.

[0188] 9. Modulus switching:

[0189] Mode switching technology can change the mode of ciphertext. As input, the mode switching algorithm outputs the ciphertext as follows (22):

[0190] The noise variance satisfies:

[0191] 3. Related technologies involved in the embodiments of this application:

[0192] 1. Homomorphic encryption (HE):

[0193] Homomorphic encryption (or fully homomorphic encryption (FHE)) aims to perform computations on ciphertext without exposing the plaintext data. It focuses on privacy-preserving computing, a technology that enables data value mining while maintaining privacy. Homomorphic encryption builds on basic encryption by adding homomorphic computation capabilities over ciphertext. It allows computations to be performed directly on encrypted ciphertext, and the decrypted result is consistent with the plaintext result. Fully homomorphic encryption can be either asymmetric public-key or symmetric, as long as the ciphertext has a certain algebraic structure.

[0194] Homomorphic encryption can be categorized as single homomorphic encryption, partially homomorphic encryption, and fully homomorphic encryption. Single homomorphic encryption only supports homomorphic addition or homomorphic multiplication. Partially homomorphic encryption supports a finite number of arbitrary homomorphic operations, where a homomorphic operation can be either homomorphic addition or homomorphic multiplication. Fully homomorphic encryption supports an unlimited number of arbitrary homomorphic operations. Fully homomorphic encryption can be either asymmetric public key encryption or symmetric encryption, as long as the ciphertext has a certain algebraic structure.

[0195] Homomorphic encryption (HE) (HE.Keygen, HE.Enc, HE.Dec, HE.Eval) consists of four algorithms: HE.Keygen represents key generation, HE.Enc represents homomorphic encryption, HE.Dec represents homomorphic decryption, and HE.Eval represents homomorphic evaluation, also known as homomorphic computation. The following describes homomorphic encryption using asymmetric encryption schemes as an example, where n is a security parameter.

[0196] 1.1、Key generation:(pk,evk,sk)←HE.Keygen(1 n ).

[0197] As shown in FIG3A , the homomorphic key generator (HEKG) can generate the key material (such as 1 n ) is input to the key generator and outputs the public key (pk) as the homomorphic encryption key K enc , that is, K enc =pk; output the private key (secret key, sk) as the homomorphic decryption key K dec , that is, K dec=sk; output evaluation key (evk) as homomorphic evaluation key K eval , that is, K eval =evk, the homomorphic evaluation key can also be called the homomorphic computation key.

[0198] 1.2 Homomorphic Encryption: c←HE.Enc pk (m).

[0199] As shown in Figure 3B, the homomorphic encryption party (HEenc for short) can use the homomorphic encryption key K enc =pk, encrypting a single-bit plaintext message m∈{0,1} into a ciphertext c.

[0200] 1.3 Homomorphic Decryption: m←HE.Dec sk (c).

[0201] As shown in Figure 3C, the homomorphic decryption party (HEdec for short) can use the homomorphic decryption key K dec =sk, decrypt the ciphertext c and restore it to the plaintext message m∈{0,1}.

[0202] 1.4. Homomorphic evaluation (also known as homomorphic computation): c f ←HE.Eval evk (f,c1,...,c l ), which can also be called homomorphic computing.

[0203] As shown in Figure 3D, based on the input ciphertext c1,...,c l and homomorphically compute the key K eval =evk, the homomorphic computation method (HEcalc, or HEeval) can perform homomorphic computation on the encrypted data. l →{0,1}, obtain the output ciphertext c of the homomorphic calculation f .

[0204] Where f represents an arithmetic circuit with addition and multiplication gates on GF(2) (GF represents a finite field, GF is the abbreviation of Galois Field). The general homomorphic computation HE.Eval can be decomposed into multiple basic operators, homomorphic addition c add ←HE.Add evk (c1,c2) ​​and homomorphic multiplication c mult ←HE.Mult evk (c1,c2).

[0205] The entire homomorphic encryption scheme HE = (HE.Keygen, HE.Enc, HE.Dec, HE.Eval) is shown in Figure 3E. The ciphertext calculation result is equivalent to the plaintext calculation result after decryption. Homomorphic key generator A generates homomorphic encryption key K enc , homomorphically compute the key K eval , homomorphic decryption key K dec , needs to be distributed to the homomorphic encryption party B, the homomorphic computing party C, and the homomorphic decryption party D respectively.

[0206] In a homomorphic encryption task, there can be multiple homomorphic encryptors encrypting data from different sources, multiple homomorphic computation parties executing homomorphic computation circuits, and single-hop or multi-hop homomorphic computation parties. A homomorphic encryption task can also have multiple homomorphic decryptors, and the decryption results can be provided to multiple data consumers. Depending on key deployment, the homomorphic decryptor and data consumer can be the same or different entities.

[0207] The keys used by multiple homomorphic encryption parties in a homomorphic encryption task can be the same or different. Homomorphic computation keys can include a bootstrapping key (BSK) and a key switching key (KSK). The BSK can be used in the homomorphic computation decryption circuit to reduce noise while in the ciphertext state. The KSK can be used to convert the ciphertext product into a new ciphertext with the same dimension as the original ciphertext after ciphertext computation, eliminating the cross terms of the corresponding keys to reduce the problem of increased ciphertext size caused by ciphertext multiplication.

[0208] 2. Ciphertext bootstrapping:

[0209] To ensure the security of ciphertext, fully homomorphic encryption (FHE) schemes typically require the introduction of noise. However, as the number of ciphertext operations increases, the noise in the ciphertext increases, causing subsequent ciphertext decryption failures. To overcome this limitation and enable FHE schemes to support an unlimited number of homomorphic operations, FHE schemes introduce a bootstrapping process. After a number of homomorphic operations on the ciphertext, the noise level is determined to have reached a threshold that supports correct decryption. If so, the noisy ciphertext is bootstrapped (refreshed) to produce a new ciphertext with lower noise. Bootstrapping can be considered the decryption algorithm for homomorphic FHE computations: decrypting the inner ciphertext back to the original text to obtain a new, low-noise FHE ciphertext. The bootstrapping algorithm is always the most time-consuming part of FHE applications.

[0210] 3. TFHE bootstrapping:

[0211] The Boolean fully homomorphic encryption (TFHE) algorithm is one of the most practical FHE schemes currently. It provides a hierarchical homomorphic computation model that can efficiently compute hierarchical circuits such as multi-input lookup tables (LUTs), bit sequence representations (BSRs), and weighted finite automata (WFAs). Because the inputs and outputs of hierarchical homomorphic computations are ciphertexts of different types (forms) and cannot be directly combined, TFHE introduces two bootstrapping operations to reduce ciphertext noise and transform its form, namely gate bootstrapping and circuit bootstrapping, to achieve homomorphic computation on circuits of arbitrary depth. Furthermore, TFHE currently has the lowest bootstrapping latency of all fully homomorphic encryption schemes, with gate bootstrapping requiring only approximately 13ms.

[0212] See Figure 4A, which shows the bootstrapping process of TFHE gate bootstrapping. See Figure 4B, which shows the architecture diagram of TFHE's hierarchical homomorphic computing mode.

[0213] The following is an introduction to several bootstrapping schemes.

[0214] 3.1 Gate bootstrapping (GBS):

[0215] Gate bootstrapping is a typical form of bootstrapping. During homomorphic computation, a bootstrapping operation is performed on each binary gate. The core of gate bootstrapping is blind rotation, which involves rotating a polynomial using a ciphertext. This can be implemented using n CMUX gates. The CMUX gates in a blind rotation can be constructed using the outer product of an RLWE ciphertext and an RGSW ciphertext.

[0216] Referring to the TFHE gate bootstrapping process shown in Figure 4A, the input to the gate bootstrapping is a homomorphically computed, high-noise (i.e., high-noise) LWE / TLWE homomorphic ciphertext c = (a, b), and its corresponding homomorphic encryption and decryption keys are (pk, sk). The output of the gate bootstrapping is a low-noise (i.e., low-noise) LWE (or TLWE) ciphertext, which reduces the noise to a relatively low range. Specific steps may include the following:

[0217] Step 1: You can first use the new homomorphic encryption key pk' to re-homomorphically encrypt b in the homomorphic ciphertext c, that is, RLWE.Enc(X -b ), denoted as the initial value of the blind rotation accumulator ACC.

[0218] Step 2: Input the initial value of ACC to the first CMUX gate, rotate a rotation component through the first CMUX gate, and obtain the ACC output by the first CMUX gate. The ACC output by the first CMUX gate is then input to the second CMUX gate to form an iteration. And so on. After n CMUX gates are iteratively updated, the result output by the nth CMUX gate is RLWE.Enc(X -b+<a,s> ).

[0219] For ease of understanding, among n CMUX gates, the calculation process of the i-th CMUX gate can be expressed as the following formula (23): ACC=CMUX((ACC,X a[i] ACC), BK i )=ACC+(X a[i] -1) ACC⊙BK i ; (twenty three)

[0220] Among them, X a[i] is the i-th rotation component of the blind rotator operation, i is an integer from 1 to n, and n is the polynomial dimension of a. i is the i-th RLWE pk′ and RGSW pk′ The outer product of (sk[i]). ACC is the homomorphic ciphertext in RLWE form. BK i The homomorphic ciphertext in RGSW format can be specifically the ciphertext obtained by homomorphically encrypting the original homomorphic decryption key sk using the new homomorphic encryption key pk'. It can be understood that based on the characteristics of homomorphic computing, the bootstrapped high-noise homomorphic ciphertext (b, a) is multiplied by its corresponding decryption key (1, sk), that is, the high-noise homomorphic ciphertext is homomorphically decrypted, ultimately obtaining a low-noise homomorphic ciphertext, thus achieving noise suppression.

[0221] After n CMUX gate iterative updates and sample extraction, the bootstrapped low-noise homomorphic ciphertext can be obtained, which is denoted as LWE.Enc(m).

[0222] Blind Rotation:

[0223] Blind rotation is a core component of the core bootstrapping of FHEW and TFHE schemes. It rotates the test polynomial using an encrypted index. The blind rotation process consists of k CMUX gates. The outer product operation of the RLWE and RGSW ciphertexts can be used to construct CMUX gates. Specifically, it can include the following:

[0224] 1. Set the encrypted rotation position p, which can be expressed as: p = p0·2 0 +...+p j 2j +...+p k 2 k ; Among them, p j For secret, 2 j is a known constant, and j is any integer from 0 to k.

[0225] 2. Rotate the encrypted polynomial M according to the encrypted rotation position p, which can be expressed as the following formula (24):

[0226] 3. Referring to the above formula (24), each term can be implemented by a CUMX gate. For example, each term can be determined by the following formula (25):

[0227] 4. See FIG4C , which shows the entire blind rotation process.

[0228] 3.2 Functional bootstrapping (FBS):

[0229] The TFHE scheme supports constructing arbitrary circuits through gate bootstrapping. This technique has been further developed into function bootstrapping (FBS), which can calculate a single-input, single-output lookup table function (LUT) while refreshing the ciphertext. Figure 4D shows the algorithm flow of function bootstrapping, which is as follows:

[0230] First define the test polynomial testP encoded by the LUT function f, and the bootstrap key as Function bootstrapping can be expressed as:

[0231] If it is a function bootstrap in a circuit bootstrap, sk i is the i-th item of the LWE key (eg, private key), that is, the key for level 0 in the circuit bootstrapping. The key for level 2.

[0232] Specifically, the homomorphic ciphertext with high noise after homomorphic calculation is c = (b, a), and its corresponding homomorphic encryption and decryption keys are (pk, sk). You can also use the new homomorphic encryption key pk' to re-homomorphically encrypt b in the homomorphic ciphertext c, that is, RLWE.Enc(X -b The initial value of the accumulator ACC (also called acc) can be written as ACC = (0, X -b·testP), input the initial value of ACC into the first CMUX gate, rotate a rotation component through the first CMUX gate, obtain the ACC output by the first CMUX gate, and then input the ACC output by the first CMUX gate into the second CMUX gate to form an iteration. The calculation process of the i-th CMUX gate can be shown as follows (26):

[0233] Among them, X a[i] is the i-th rotation component of the blind rotation, i∈[1,n], and n is the polynomial dimension of a. is the outer product of the i-th RLWE and RGSW. ACC is the homomorphic ciphertext in RLWE form. It is a homomorphic ciphertext in RGSW form.

[0234] After n CMUX gates are iteratively updated, and then through operations such as sample extraction, the bootstrapped low-noise homomorphic ciphertext can be obtained, which is recorded as

[0235] 3.3、Circuit bootstrapping (CBS):

[0236] TFHE provides a hierarchical homomorphic computing / hierarchical homomorphic encryption mode (LHE). Since the input and output of hierarchical homomorphic computing have different ciphertext forms, circuit bootstrapping can be used to refresh the noise and convert the ciphertext form. The latency of circuit bootstrapping is almost 10 times that of function bootstrapping and is the main computational overhead in the LHE mode.

[0237] To ensure security and operational correctness, TFHE's hierarchical homomorphic computation model spans three levels, also known as grades: level 0, level 1, and level 2. Each level sets different parameters, such as the homomorphic key. The following provides a reference description of the dimension, modulus, and noise corresponding to each level.

[0238] Level 0: The dimension n is relatively low, such as n = 635; the ciphertext modulus q is relatively small, such as 32 bits; but the noise is relatively large, such as σ 2 ≈2 -30 , σ represents the noise at level 0. Level 0 calculations are faster, but usually allow for more limited linear operations.

[0239] Level 1: The dimension n is medium, such as n = 1024; the ciphertext modulus q is relatively small, such as 32 bits; but the noise is relatively large, such as σ 2 ≈2 -50, σ represents the noise of level 1. Level 1 calculation is relatively fast and can allow relatively high depth. For example, the above-mentioned LUT, BSR, WFA, etc. can all be executed at level 1.

[0240] Level 2: The dimension n is medium, such as n = 2048; the ciphertext modulus q is relatively large, such as 64 bits; but the noise is relatively small, such as Indicates noise at level 2. Level 2 calculations are slower.

[0241] It should be noted that: in the embodiments of the present application, in order to distinguish variables of different levels, variables of level 0 are represented by underscores, variables of level 1 are not represented by underscores, and variables of level 2 are represented by overscores.

[0242] Referring to the architecture diagram of TFHE circuit bootstrapping in Figure 4B, the circuit bootstrapping algorithm includes function bootstrapping and privacy key switching. The dashed boxes in Figure 4B contain hierarchical circuit computations (such as LUT / BSR / WFA). The input to the circuit bootstrapping is noisy LWE (or TLWE) ciphertext, and the output is quiet RGSW (or TRGSW) ciphertext. The circuit bootstrapping spans three levels, from level 0 to level 2 and from level 2 to level 1 (the bolded lines in Figure 4B).

[0243] The circuit bootstrap key includes: the key switching key from level 1 to level 0, and the function bootstrap key from level 0 to level 2, such as sk i is the i-th item of the LWE key sk at level 0, i∈[1,n], where n is the polynomial dimension;

[0244] And, the circuit bootstrapping key also includes: 2 privacy key switching keys from level 2 to level 1, such as and RLWE′ sk (f 0,1 (1)). Here, function f0 is the identity function, function f1(x) = sk·x, sk is the RLWE key of level 1, Is a level 2 LWE key The jth item of , j∈[1,n], n is the polynomial dimension.

[0245] See Figure 4B, the circuit bootstrap: CBS LWE→RGSW :LWE sk (m)→RGSW sk (m) may include the following steps:

[0246] Step 1: Sample extraction and key switching (level 1 to level 0).

[0247] A Level 1 RLWE sample with a large noise amplitude is input. First, based on the Level 1 RLWE sample, a sample extraction algorithm is used to extract the LWE ciphertext. Then, LWE-to-LWE key-switching is used to obtain the Level 0 LWE ciphertext.

[0248] Step 2: Function bootstrapping (level 0 to level 2).

[0249] In this step 2, 1 function bootstrap or 1 multi-value bootstrap (or PBSmanyLUT) is called to refresh the noise and perform function calculation.

[0250] Function bootstrapping can be expressed as shown in the following formula (27):

[0251] Where v=(v0,v1,…,v l-1 ) is the gadget vector. Among them, the level 0 ciphertext is bootstrapped by the function to obtain the level 2 ciphertext sk is the key of level 0, is the level 2 key. l is equivalent to breaking a large number into smaller numbers, i.e., l LWE ciphertexts. testP is the test polynomial encoded by the LUT function f. Function bootstrapping can calculate a function f while simultaneously denoising and refreshing the ciphertext.

[0252] In addition, in function bootstrapping, if it is an expression that calculates a gate (such as the CUMX gate), it can also be called gate bootstrapping.

[0253] Step 3: Privacy key switching (such as level 2 to level 1).

[0254] In step 3, PrivateKS is called 2l times, and the privacy key switching process can be expressed as the following equations (28), (29), and (30): RGSW sk (m) = (RLWE′ sk (sk·m),RLWE′ sk (m)); (30)

[0255] Among them, the ciphertext of level 2 is converted into the ciphertext of level 1 after the privacy key is switched. is the key for level 2, and sk is the key for level 1. The input of privacy key switching is LWE ciphertext, and the output is RGSW ciphertext.

[0256] Specifically, privacy key switching means: 1) changing the ciphertext form and calculating the function f0 (i.e., identity function) and the function f1 (i.e., message m multiplied by the key sk), as shown in formulas (28) and (29); 2) concatenating l RLWE ciphertexts into one RLWE' ciphertext, and then concatenating the two RLWE' (i.e., RLWE' sk (m) and RLWE′ sk (sk·m)) are concatenated into an RGSW ciphertext, as shown in formula (30).

[0257] 3.4. Multi-value bootstrapping or Programmable Bootstrapping evaluating many look-up tables (PBSmanyLUT):

[0258] Since the TLWE ciphertexts of level 0 to level 2 inputs in the circuit bootstrapping are the same, the l function bootstrapping operation can be replaced by a multi-value bootstrapping or a programmable bootstrapping of multiple lookup tables (PBSmanyLUT).

[0259] Multi-valued bootstrapping: Supports evaluating multiple functions on the same input using only one blind rotation. First, from all functions (TVF i ) extract a public function v0; then, use the input ciphertext to blindly rotate the test polynomial v0; finally; TVF i / v0 (the norm coefficient is smaller) are multiplied by the accumulator acc to obtain the result.

[0260] PBSmanyLUT: First, the initial TLWE ciphertext is rescaled using a modulus switching algorithm and the ρ least significant bits are adjusted to zero. A blind rotation algorithm can be used to evaluate the 2 ρ different functions.

[0261] Compared with multi-value bootstrapping, PBSmanyLUT generates less ciphertext noise. One PBSmanyLUT can be replaced by one function bootstrapping in the circuit bootstrapping to speed up the function bootstrapping step in the circuit bootstrapping. The specific PBSmanyLUT algorithm is shown in Figure 4E and expressed as Equation (31).

[0262] Among them, ct in is the level 0 TLWE ciphertext that needs bootstrapping, bsk represents the bootstrapping key, and the test polynomial P(X) is:

[0263] in, B g is the basis of gadget decomposition, is the length of the gadget decomposition.

[0264] 4. Automorphism and blind rotation:

[0265] For an automorphism ψ t :a(X)→a(X t ), given an automorphic key ATK t =RLWE′ sk,q (sk(X t )), Homomorphic automorphism algorithm HomAuto t :RLWE sk,q (m)→RLWE sk,q (m(X t )), can be defined as the following formula (32): HomAuto t (RLWE sk,q (m))=a(X t )⊙RLWE′ sk,q (sk(X t ))+(0,b(X t )) =RLWE sk,q (a(X t )·sk(X t )+b(X t )) =RLWE sk,q (m(X t )). (32)

[0266] 5. LMKC+ function bootstrapping:

[0267] Lee et al. proposed a function bootstrapping algorithm in EuroCypto 23, which reduced the key size by 30% with slightly higher computational efficiency. In the latest LMKC+ blind rotation algorithm, the number of automorphisms to be calculated is the same as the number of set Z. 2N a in i , i∈[0, n-1] is inversely proportional to the sparsity, where a i is the i-th component of the input LWE ciphertext. Without optimization, the number of automorphisms is roughly equal to a i The count of different values.

[0268] Function bootstrapping can evaluate the 1-in / 1-out LUT function encoded in the test polynomial testP while refreshing the ciphertext noise. LMKC+ function bootstrapping consists of three steps, which are as follows:

[0269] Step 1: Perform round-to-odd modulus switching.

[0270] Execute MS odd Algorithm: The algorithm inputs a LWE ciphertext (a, b)∈LWE sk,q (m). Output all odd ciphertext in, Rounds the given input to the nearest odd integer.

[0271] Step 2: Execute for odd number a i The automorphism-based blind rotation algorithm.

[0272] Execute blind rotation (BR) algorithm: The algorithm input is MS odd All odd LWE ciphertexts output, when observed In the case of , then every odd number a i It can be expressed using the generator {g, -1}, thus obtaining the following equation (33):

[0273] in, Each odd number a i Mapping to ±g k , reducing the number of automorphic keys from N to 2.

[0274] Furthermore, given an initial value of the accumulator acc=(0,X -gb ·testP(X -g ), a bootstrap key and 2 automorphism keys ATK g , ATK -g ; Perform blind rotation algorithm operation: First, for all Multiply the accumulator acc by BSK j (outer product); then apply HomAuto g And repeat for each I (i.e., multiply by After that, apply HomoAuto-g The final result is

[0275] Step 3: Based on the RLWE ciphertext obtained in step 2, the LWE ciphertext is obtained through a sample extraction algorithm.

[0276] This step three can be performed with reference to the existing sample extraction algorithm introduced in the above two, and will not be described in detail here.

[0277] As can be seen from the above-mentioned related technologies, in the TFHE hierarchical homomorphic computing mode, the circuit bootstrapping process involves many polynomial multiplications and linear combination operations, resulting in long computational time and low computational efficiency. Furthermore, the bootstrapping key used in the bootstrapping process is large in size, resulting in high storage overhead (related to the dimension n, modulus q, etc.). Therefore, improving the computational efficiency of ciphertext bootstrapping and reducing the storage overhead of the bootstrapping process are currently one of the most pressing issues to be addressed.

[0278] The present application provides a ciphertext processing method, which can effectively improve the computational efficiency of ciphertext bootstrapping and reduce the storage overhead of the bootstrapping process. The technical solution provided in the embodiment of the present application can be applied to the fourth generation mobile communication technology (the 4th generation, 4G) system, such as the long term evolution (long term evolution, LTE) system, or can be applied to the 5G system, such as the NR system, or the next generation wireless local area network system or various future communication systems, without specific limitation.

[0279] Figure 5 shows a possible, non-limiting communication system architecture applicable to embodiments of the present application. As shown in Figure 5, communication system 5000 includes a radio access network (RAN) 100 and a core network (CN) 200. Optionally, communication system 5000 may also include the Internet 300. RAN 100 includes at least one network device (such as 110a and 110b in Figure 5, collectively referred to as 110) and at least one terminal device (such as 120a-120j in Figure 5, collectively referred to as 120). RAN 100 may also include other RAN nodes, such as wireless relay devices and / or wireless backhaul devices (not shown in Figure 5). Terminal device 120 is wirelessly connected to network device 110. Network device 110 is wirelessly or wiredly connected to core network 200. The core network device in core network 200 and network device 110 in RAN 100 may be different physical devices, or they may be the same physical device that integrates core network logical functions and radio access network logical functions.

[0280] The RAN 100 may be a cellular system related to the Third Generation Partnership Project (3GPP), such as a fourth generation (4G) or fifth generation (5G) mobile communication system, or an evolved system beyond 5G (such as a 6G mobile communication system). The RAN 100 may also be an open access network (O-RAN or ORAN), a cloud radio access network (CRAN), or a WiFi system. The RAN 100 may also be a communication system that integrates two or more of the above systems.

[0281] It will be understood that FIG5 only illustrates one possible communication system architecture that may be applied in an embodiment of the present application. In other possible scenarios, the communication system architecture may also include other devices.

[0282] The network device 110 is a node in the radio access network (RAN), which can also be called an access network device or a RAN node (or device). The network device 110 is used to help terminal devices achieve wireless access. The multiple network devices 110 in the communication system 5000 can be nodes of the same type or different types. In some scenarios, the roles of the network device 110 and the terminal device 120 are relative. For example, the network element 120i in Figure 5 can be a helicopter or a drone, which can be configured as a mobile base station. For terminal devices 120j that access the RAN 100 through the network element 120i, the network element 120i is a base station; but for the base station 110a, the network element 120i is a terminal device. The network device 110 and the terminal device 120 are sometimes referred to as communication devices. For example, the network elements 110a and 110b in Figure 5 can be understood as communication devices with base station functions, and the network elements 120a-120j can be understood as communication devices with terminal device functions.

[0283] In one possible scenario, a network device can be a base station, an evolved NodeB (eNodeB), a transmitting and receiving point (TRP), a transmitting point (TP), a next-generation NodeB (gNB), a next-generation base station in a sixth-generation (6G) mobile communication system, a base station in a future mobile communication system, a satellite, an access point (AP) in a WiFi system, an integrated access and backhaul (IAB) node, a mobile switching center, or a network device in a non-terrestrial network (NTN) communication system, i.e., it can be deployed on a high-altitude platform or satellite. The network device can be a macro base station (such as 110a in Figure 5 ), a micro base station or an indoor station (such as 110b in Figure 5 ), a relay node or a donor node, or a wireless controller in a CRAN scenario. The network device can also be a device that functions as a base station in device-to-device (D2D) communication, vehicle-to-vehicle communication, drone communication, or machine communication. Optionally, the network device may also be a server, a wearable device, a vehicle or an onboard device, etc. For example, the access network device in vehicle to everything (V2X) technology may be a road side unit (RSU).

[0284] In another possible scenario, multiple network devices collaborate to assist the terminal device in achieving wireless access, and different network devices respectively implement part of the functions of the base station. For example, the network device can be a centralized unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU). The CU and DU can be set separately, or they can also be included in the same network element, such as a baseband unit (BBU). The RU can be included in a radio frequency device or a radio frequency unit, such as a remote radio unit (RRU), an active antenna unit (AAU), or a remote radio head (RRH). It can be understood that the network device can be a CU node, a DU node, or a device including a CU node and a DU node. In addition, the CU can be divided into a network device in the access network RAN, or the CU can be divided into a network device in the core network CN, which is not limited here.

[0285] It should be noted that in different systems, CU (or CU-CP and CU-UP), or DU may have different names, but those skilled in the art can understand their meanings. For example, in an open radio access network (O-RAN) system, CU may also be referred to as O-CU (open CU), DU may also be referred to as O-DU, CU-CP may also be referred to as O-CU-CP, CU-UP may also be referred to as O-CU-UP, and RU may also be referred to as O-RU. For the sake of convenience of description, this application uses CU, CU-CP, CU-UP, DU and RU as examples for description. Any of the CU (or CU-CP and CU-UP), DU and RU in this application may be implemented by a software module, a hardware module, or a combination of a software module and a hardware module.

[0286] In the embodiments of the present application, the form of the network device is not limited. The device used to implement the function of the network device can be a network device; it can also be a device that can support the network device to implement the function, such as a chip system. The device can be installed in the network device or used in conjunction with the network device.

[0287] The terminal device 120, which may also be referred to as a terminal, user equipment (UE), mobile station (MS), mobile terminal (MT), etc., is a device used to provide voice or data connectivity to users, or an IoT device. For example, the terminal device includes a handheld device with wireless connection capabilities, an in-vehicle device, etc. Currently, terminal devices can include: mobile phones, tablet computers, laptop computers, PDAs, mobile internet devices (MIDs), wearable devices (such as smart watches, smart bracelets, pedometers, etc.), vehicle-mounted devices (such as cars, bicycles, electric vehicles, airplanes, ships, trains, high-speed trains, etc.), satellite terminals, virtual reality (VR) devices, augmented reality (AR) devices, smart point-of-sale (POS) machines, customer-premises equipment (CPE), wireless terminals in industrial control, smart home devices (such as refrigerators, televisions, air conditioners, electricity meters, etc.), intelligent robots, robotic arms, workshop equipment, wireless terminals in unmanned driving, wireless terminals in telemedicine, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, and flying devices (such as intelligent robots, hot air balloons, drones, airplanes). Terminal devices can also be other devices with terminal functions, for example, terminal devices can also be devices that function as terminals in D2D communication.

[0288] The embodiments of this application do not limit the device form factor of the terminal device. The device used to implement the functions of the terminal device can be the terminal device; it can also be a device that supports the terminal device to implement the functions, such as a chip system. The device can be installed in the terminal device or used in conjunction with the terminal device. In the embodiments of this application, the chip system can be composed of a chip or include a chip and other discrete components.

[0289] Each network element or device in the communication system (also referred to as a communication network) shown in Figure 5 may have the ability of homomorphic encryption / decryption / computation. Therefore, in an embodiment of the present application, it is possible to consider supporting homomorphic tasks corresponding to homomorphic encryption in the communication network to provide privacy computing capabilities for the communication network.

[0290] The solution provided in the embodiments of the present application can be applied to homomorphic computing scenarios. As shown in Figure 3E or Figure 13, the solution provided in the embodiments of the present application is related to the design scheme of the core component circuit bootstrapping in the TFHE fully homomorphic encryption algorithm. In addition, the ciphertext processing method provided in the embodiments of the present application can be applied to the communication field involving logistic regression models or neural network applications with a relatively small number of layers.

[0291] 4. Introduction to the embodiments of this application:

[0292] The technical solution of this application is introduced below in conjunction with specific embodiments.

[0293] The embodiment of the present application provides a ciphertext processing method, which is applicable to but not limited to the communication system shown in Figure 5, and the method is applicable to but not limited to the homomorphic computing scenario shown in Figure 3E or Figure 13. The method can be executed by a homomorphic computing device, or by a component (module, chip, etc.) of a homomorphic computing device, or by a device used by a homomorphic computing device. The present application does not limit the specific form and quantity of the device for executing the embodiment of the present application. Please refer to Figure 6A. The specific process of the method is as follows:

[0294] S601A: The homomorphic computing device obtains the target error-learning LWE ciphertext at level 0.

[0295] In the embodiments of the present application, the method provided in the embodiments of the present application (i.e., steps S601A to S604A) can be executed by a device of a homomorphic computing party; or can be executed by a component (such as a module, chip, etc.) corresponding to the device of the homomorphic computing party; or can be executed by a device corresponding to and used with the homomorphic computing party, and this application does not make specific limitations on this. The embodiments of the present application take a homomorphic computing device as an example to provide a detailed introduction to the method provided in the embodiments of the present application.

[0296] In one possible implementation, when the homomorphic computing device executes step S601A, it may include: first obtaining the initial LWE ciphertext of level 2, where the initial LWE ciphertext of level 2 is obtained through hierarchical homomorphic calculation based on the RGSW ciphertext of level 2; then performing key switching on the initial LWE ciphertext of level 2 to obtain the target LWE ciphertext of level 0.

[0297] In the embodiment of the present application, the hierarchical homomorphic computation may include but is not limited to one or more of the following:

[0298] Multi-input look-up table function LUT, bit sequence representation BSR, weighted finite automaton WFA.

[0299] S602A: The homomorphic computing device converts the target LWE ciphertext of level 0 to obtain a first RLWE ciphertext of level 2.

[0300] In the embodiment of the present application, when the homomorphic computing device executes step S602A, the following steps may be included:

[0301] Step 1: The homomorphic computing device obtains a target key; and performs sparsification processing on the target LWE ciphertext at level 0 to obtain a sparse target LWE ciphertext.

[0302] The target key includes a bootstrap key, an auxiliary key, and an automorphic key set, wherein the automorphic key set includes at least one automorphic key. The bootstrap key is a first RGSW ciphertext obtained by homomorphically encrypting a level 0 homomorphic key component using a level 2 homomorphic encryption key; the automorphic key is an RLWE ciphertext obtained by homomorphically encrypting an automorphism of the key plaintext using the homomorphic key; and the auxiliary key is a second RGSW ciphertext obtained by homomorphically encrypting the sum of the level 0 homomorphic key components using the level 2 homomorphic encryption key.

[0303] In a possible implementation, the homomorphic computing device obtains the target key, which may specifically include: obtaining the target key from a homomorphic key generator.

[0304] In a possible implementation, the homomorphic computing device performs a sparse processing on the target LWE ciphertext at level 0 to obtain a sparse target LWE ciphertext, which may specifically include: performing a sparse rounding processing on each component of the target LWE ciphertext using a module switching method to obtain the sparse target LWE ciphertext, wherein each component of the sparse target LWE ciphertext satisfies k·2 θ In the form of , k is an integer greater than or equal to 0, and θ is a positive integer.

[0305] In the embodiment of the present application, the mode switching method can be predetermined or set, such as a special mode switching count, a rounding method, or a sparse rounding method. Z is an integer set; θ can be expressed as a sparse interval, and the value of θ can be determined according to the decryption error rate of the homomorphic decryption party.

[0306] Step 2: The homomorphic computing device determines an initial value of the accumulator that satisfies the RLWE ciphertext form.

[0307] In one possible implementation, the sparse target LWE ciphertext consists of a first part and a second part; then, the homomorphic computing device determines an initial accumulator value that satisfies the RLWE ciphertext form, which may specifically include: first obtaining a test polynomial; and then obtaining the initial accumulator value that satisfies the RLWE ciphertext form based on the second part of the sparse target LWE ciphertext and the test polynomial.

[0308] Step 3: The homomorphic computing device uses a blind rotation algorithm to process the sparse target LWE ciphertext, the accumulator initial value that satisfies the RLWE ciphertext form, and the target key to obtain an updated accumulator value.

[0309] In one possible implementation, the sparse target LWE ciphertext consists of a first part and a second part; the homomorphic computing device uses a blind rotation algorithm to process the sparse target LWE ciphertext, the accumulator initial value that satisfies the RLWE ciphertext form, and the target key to obtain an updated accumulator value, which may specifically include the following steps:

[0310] S1: Each component of the first part of the sparse target LWE ciphertext is converted from k·2 θ Convert to k·2 θ +1 form.

[0311] Exemplarily, the i-th component of the first part after sparseness may satisfy the following formula:

[0312] a i =a i +1 mod 2N; a i Indicates that k·2 is satisfied θ The i-th component of the first part of the form .

[0313] S2: Perform outer product calculation on the accumulator initial value and the auxiliary key that satisfies the RLWE ciphertext form to obtain a first accumulator value.

[0314] In the embodiment of the present application, the accumulator may refer to a temporary register that satisfies the RLWE ciphertext format.

[0315] S3: Based on the fact that each component satisfies k·2 θ The sparse target LWE ciphertext in the form of +1, the first accumulator value, the bootstrap key and the automorphic key set are used to obtain the updated accumulator value through a blind rotation algorithm.

[0316] In the embodiment of the present application, the blind rotation algorithm may be a predetermined or set algorithm.

[0317] Regarding step S3, the embodiment of the present application can be implemented through, but not limited to, the following implementations:

[0318] Implementation method 1: The automorphic key set includes w automorphic keys, where the size of w is determined by the Monte Carlo method and preset parameters, and w is an integer greater than 1. Then, when the homomorphic computing device executes S3, it may specifically include the following:

[0319] First, each component of the sparse target LWE ciphertext (i.e. the first part) is transformed from k·2θ +1 form converted to g k form; Z represents a set of integers, and N is a power of 2;

[0320] Then based on each component satisfying g k The sparse target LWE ciphertext of the form is determined A set I;

[0321] For Set I l , Set the initial value of counter v to 0, and repeat the following steps in descending order of the value of l. Second-rate:

[0322] Based on the current value of the accumulator and the bootstrap key, performing an outer product process and updating the current value of the accumulator;

[0323] The value of the counter v is increased by 1;

[0324] When a preset condition is met, the automorphism algorithm is executed based on the currently updated accumulator value and the automorphic key to obtain a new accumulator value and reset the value of the counter v to 0; the preset condition includes any of the following:

[0325] v=w、next set I l-1 Not a non-empty set, l = 1;

[0326] When l=0, for the set I0, perform the following steps:

[0327] Based on the current value of the accumulator and the bootstrap key, an outer product process is performed to obtain the updated accumulator value.

[0328] During the above calculations, each time an outer product is executed, the accumulator value entered is the value updated by the previous outer product. When executing the automorphism algorithm, the accumulator value entered is the value updated by the most recent outer product.

[0329] In this embodiment 1, according to set I l The value of the subscript l is in descending order, for the front The automorphism algorithm operation is performed only when the set I meets the above preset conditions. It can be seen that the automorphism algorithm operation is performed once by combining multiple automorphisms, and there is no need to perform the automorphism algorithm operation for each automorphism, thereby effectively improving the efficiency of the automorphism algorithm operation in the bootstrapping process, and further improving the execution efficiency of the bootstrapping process.

[0330] Based on the algorithm principle of implementation mode 1, it is also possible to use set I lThe above steps are performed in ascending order of the value of the subscript l, and this application does not make any specific limitation on this.

[0331] Implementation method 2: The self-similar key set includes one self-similar key. Then, when the homomorphic computing device executes S3, it may specifically include the following:

[0332] First, each component of the (first part) of the sparse target LWE ciphertext is transformed from k·2 θ +1 form converted to g k form; Z represents a set of integers, and N is a power of 2;

[0333] Then based on each component satisfying g k The sparse target LWE ciphertext of the form is determined A set I;

[0334] For Set I l , Repeat the following steps in descending order of l value: Second-rate:

[0335] Based on the current value of the accumulator and the bootstrap key, performing an outer product process and updating the current value of the accumulator;

[0336] Execute an automorphism algorithm based on the currently updated accumulator value and the automorphism key to obtain a new accumulator value;

[0337] When l=0, for the set I0, perform the following steps:

[0338] Based on the current value of the accumulator and the bootstrap key, an outer product process is performed to obtain the updated accumulator value.

[0339] During the above calculations, each time an outer product is executed, the accumulator value entered is the value updated by the previous outer product. When executing the automorphism algorithm, the accumulator value entered is the value updated by the most recent outer product.

[0340] In the second embodiment, an automorphic key is used to execute the automorphic algorithm operation, which can effectively reduce the storage overhead occupied by the key, and further reduce the storage overhead of the bootstrapping process.

[0341] Step 4: The homomorphic computing device obtains the first RLWE ciphertext of level 2 based on the updated accumulator value.

[0342] In a possible implementation, the homomorphic computing device obtains the first RLWE ciphertext of the level 2 based on the updated accumulator value, which may specifically include: comparing the updated accumulator value with X -j Perform product processing to obtain the first RLWE ciphertext of level 2; j∈[0,l-1].

[0343] This step S602A is equivalent to the function bootstrapping step in the circuit bootstrapping process. Through the above four steps (i.e., steps 1 to 4), the target LWE ciphertext at level 0 is converted into the first RLWE ciphertext at level 2. Obviously, this not only effectively achieves the conversion of the ciphertext form, but also reduces the noise of the ciphertext (the noise of the first RLWE ciphertext at level 2 is less than the noise of the target LWE ciphertext at level 0).

[0344] S603A: The homomorphic computing device performs redundancy removal processing on the first RLWE ciphertext of level 2 to obtain a first target RLWE′ ciphertext.

[0345] In one possible implementation, when the homomorphic computing device executes step S603A, it may include: first, obtaining the automorphic key of level 2 of the homomorphic estimation trace algorithm; then, executing the homomorphic estimation trace algorithm l times, eliminating the redundant items in l first RLWE ciphertexts, and obtaining l level 2 RLWE ciphertexts without redundant items; finally, splicing the l level 2 RLWE ciphertexts without redundant items to obtain the first target RLWE' ciphertext of level 2.

[0346] In the embodiment of the present application, the above l represents the dimension of the decomposition vector.

[0347] Optionally, the homomorphic computing device may also use a sample extraction algorithm to perform redundancy removal based on the first RLWE ciphertext of level 2 to obtain the first target RLWE' ciphertext. Specifically, the algorithm may be performed with reference to an existing sample extraction algorithm and will not be described in detail here.

[0348] S604A: The homomorphic computing device obtains a target RGSW ciphertext of level 2 according to the first target RLWE′ ciphertext.

[0349] In one possible implementation, when the homomorphic computing device executes step S604A, it may include: first, obtaining a scheme switching key; then, based on the first target RLWE' ciphertext and the scheme switching key, using a scheme switching algorithm to perform calculations to obtain a second target RLWE' ciphertext; finally, concatenating the first target RLWE' ciphertext and the second target RLWE' ciphertext to obtain the target RGSW ciphertext of level 2.

[0350] In the embodiment of the present application, the target RGSW ciphertext of level 2 can be used for, but not limited to, the next hierarchical homomorphic computation.

[0351] In a possible implementation, in addition to executing steps S601A to S604A above, the homomorphic computing device further includes: receiving a homomorphic computing key and parameters of the homomorphic computing key and homomorphic scheme parameters from a homomorphic key generator;

[0352] The homomorphic computing key may include, but is not limited to, one or more of the following:

[0353] a set of bootstrap keys, a set of automorphic keys, an auxiliary key, a set of automorphic keys of the homomorphic trace algorithm, a scheme switching key, and at least one key switching key;

[0354] The parameters of the homomorphic computation key may include, but are not limited to, one or more of the following:

[0355] Level 0 LWE ciphertext dimension, level 2 ciphertext modulus, integer set The generator {g} of , the number w of automorphic keys in the set of automorphic keys, and the dimension of the ring polynomial of level 2;

[0356] The homomorphic scheme parameters may include but are not limited to one or more of the following:

[0357] LWE ciphertext dimensions at each level, ciphertext modulus at each level, decomposition basis for outer product operations in function bootstrapping, decomposition dimension or length for outer product operations in function bootstrapping, decomposition basis for key switching, and decomposition dimension or length for key switching.

[0358] Through the above steps S601A to S604A, it is equivalent to implementing the circuit bootstrapping process in homomorphic computing. Therefore, applying the method provided by the embodiment of the present application to circuit bootstrapping can not only effectively improve the computational efficiency of the circuit bootstrapping process, but also effectively reduce the storage occupied by the circuit bootstrapping process. In addition, compared with the circuit bootstrapping of the prior art TFHE, the method provided by the embodiment of the present application can be more efficiently applied to logistic regression models or neural networks with a relatively small number of layers.

[0359] In summary, an embodiment of the present application provides a ciphertext processing method that can be applied to a homomorphic computing party, including: first obtaining a target error-learning LWE ciphertext at level 0; then converting the target LWE ciphertext at level 0 to obtain a first RLWE ciphertext at level 2; secondly performing redundancy processing on the first RLWE ciphertext at level 2 to obtain a first target RLWE' ciphertext; and finally, obtaining a target RGSW ciphertext at level 2 based on the first target RLWE' ciphertext. By converting the ciphertext format and reducing the noise of the ciphertext through this method, not only can the efficiency of ciphertext processing be improved, but also the storage overhead required for ciphertext processing can be reduced.

[0360] 5. Introduction to specific embodiments:

[0361] Based on the ciphertext processing method described in FIG. 6A , the solution described in FIG. 6A will be described in detail below through several specific embodiments.

[0362] Example 1:

[0363] In this first embodiment, based on the solution described in FIG6A above, a circuit bootstrap and LHE mode are designed. Referring to FIG6B , which is an architecture diagram of the circuit bootstrap based on automorphism corresponding to the solution of the first embodiment, the specific process includes the following:

[0364] S601B: Level 0 to Level 2 Steps to perform function bootstrapping:

[0365] In step S601B, automorphism-based multi-valued function bootstrapping without sample extraction (MV-FBS without sample extraction) is performed to convert the level 0 high-noise LWE ciphertext into the level 2 low-noise RLWE ciphertext.

[0366] This step S601B is a possible implementation of step S602A in the solution described in FIG. 6A .

[0367] S602B: Level 2: Perform l homomorphic evaluation operations of the HomTrace function to obtain the valid ciphertext RLWE′(m). Specifically, it includes the following:

[0368] 1) Eliminate redundant positions and generate l valid RLWE ciphertexts, namely RLWE(v i ·m), i∈[0,l-1];

[0369] 2) l valid RLWE ciphertexts, namely RLWE(v i·m), i∈[0,l-1] are concatenated into a RLWE' ciphertext.

[0370] This step S602B is a possible implementation of step S603A in the solution described in FIG. 6A .

[0371] S603B: Based on the effective RLWE′(m), obtain the RGSW ciphertext. Specifically, it includes the following:

[0372] First, RLWE′(sk·m) is calculated based on the RLWE′(m) ciphertext through a scheme switching operation. Then, the two RLWE′ ciphertexts are concatenated into an RGSW ciphertext.

[0373] Exemplarily, the RGSW ciphertext may be expressed as: RGSW(m)=(RLWE'(sk·m),RLWE'(m)).

[0374] Step S603B is a possible implementation of step S604A in the solution described in FIG. 6A .

[0375] In step S603B, these RLWE-to-RLWE switching algorithms do not switch ciphertext dimensions. Therefore, circuit computation (also known as circuit evaluation) in LHE mode (e.g., LUT / TBSR / WFA, etc.) is performed at level 2, allowing for simultaneous computation of deeper circuits and batch processing of more ciphertexts.

[0376] In FIG6B , the square represents the algorithm execution process, the circle represents the ciphertext form of the result, and the dotted box represents the circuit bootstrapping step.

[0377] Example 2:

[0378] In this second embodiment, step S601B in the solution described in FIG. 6B (equivalent to S602A in the solution described in FIG. 6A ) is described in detail. Specifically, in this second embodiment, a multi-valued function bootstrapping algorithm based on automorphism (MV-FBS) without sample extraction is used to convert a high-noise level 0 LWE ciphertext (equivalent to the target level 0 LWE ciphertext in the solution described in FIG. 6A ) into a low-noise level 2 RLWE ciphertext (equivalent to the first level 2 RLWE ciphertext in the solution described in FIG. 6A ). Specifically, the following steps may be included:

[0379] First, the components of the level 0 LWE ciphertext are sparsely converted to k·2 based on sparse rounding. θThen, based on the components of the sparsified LWE ciphertext, the new blind rotation algorithm (BR3) is called to obtain the RLWE ciphertext; finally, the components of the RLWE ciphertext are multiplied by X -j , to rotate the desired component of the RLWE ciphertext to the front.

[0380] In the MV-FBS algorithm, the component a of the LWE ciphertext is used. i The sparsity of 2 θ The algorithm can be expressed as the following formula 1, where the useful message m is in the constant term:

[0381] In addition, in order to delete the LWE ciphertext type from the circuit bootstrap process, the sample extraction algorithm SampleExtract in the original function bootstrap is replaced by j Replace it with multiplying by X -j .

[0382] Referring to FIG. 7 , a flowchart of a multi-valued function bootstrapping (MV-FBS) algorithm based on automorphism without sample extraction provided in the second embodiment of the present application is shown. The algorithm can be executed by writing a program into code and storing it in a homomorphic computing device. The input and output of the MV-FBS algorithm are as follows:

[0383] Input: A level 0 LWE ciphertext c = (a, b) ∈ LWE sk , q (m), a bootstrap key A set of automorphic keys That is, w automorphic keys and an auxiliary key

[0384] Output: Level 2 RLWE ciphertext

[0385] The specific steps of the algorithm are as follows:

[0386] Step 1: Use a rounding algorithm to sparse the components of the LWE ciphertext c, which is also called sparse rounding.

[0387] The LWE ciphertext c is composed of a (equivalent to the first part of the LWE ciphertext in the scheme described in FIG. 6A ) and b (equivalent to the second part of the LWE ciphertext in the scheme described in FIG. 6A ).

[0388] Specifically, a special module switching technique is used to convert each component a of the LWE ciphertext c into i and b is switched to 2 θMultiples of, i∈[0,n-1], that is, let each component a i and b satisfy k·2 θ The parameter θ can represent a sparse interval, k is an integer greater than or equal to 0, and θ is a positive integer.

[0389] Step 1 is equivalent to step 1 in step S602A of the solution described in FIG. 6A (ie, the homomorphic computing device performs sparsification processing on the target LWE ciphertext at level 0 to obtain a sparse target LWE ciphertext).

[0390] Step 2: Set the test polynomial

[0391] Where N is the dimension of the polynomial, v i represents the i-th item of the decomposition vector v.

[0392] Step 3: Set the initial value of the accumulator acc to (0, X gb ·testP(X g )).

[0393] The initial value of acc can be considered as a normal RLWE ciphertext, which can be expressed as

[0394] Step 2 and Step 3 are equivalent to step 2 in step S602A of the solution described in FIG. 6A (ie, the homomorphic computing device determines the initial value of the accumulator that satisfies the RLWE ciphertext form).

[0395] Step 4: Satisfy k·2 θ The LWE ciphertext of level 0 c = (a, b), the current value of acc, the bootstrap key BSK, the automorphism key ATK, and the auxiliary key AUX are used as input, and the blind rotation BR3 algorithm is called for calculation to obtain the updated acc.

[0396] Among them, BR3 can be regarded as the embodiment of the present application for LWE ciphertext that satisfies k·2 θ The component of the form a i A new blind rotation algorithm is constructed.

[0397] Step 5:

[0398] In the above, v is the gadget decomposition vector, and l is the dimension of the gadget decomposition vector.

[0399] Step 4 and Step 5 are equivalent to step 3 in step S602A of the solution described in Figure 6A above (i.e., the homomorphic computing device uses a blind rotation algorithm to process the sparse target LWE ciphertext, the accumulator initial value that satisfies the RLWE ciphertext form, and the target key to obtain an updated accumulator value).

[0400] Steps 6-8: Multiply acc by X -j , get the ciphertext

[0401] That is, based on the updated accumulator acc obtained in the above Step 5, Steps 6 to 8 are executed again.

[0402] Step 6 to Step 8 are equivalent to the implementation of step 4 in step S602A of the solution described in FIG. 6A (ie, the homomorphic computing device compares the updated accumulator value with X -j Perform product processing to obtain the first RLWE ciphertext of level 2).

[0403] With respect to Step 4 of the algorithm described in FIG. 7 , the present embodiment proposes a blind rotation BR3 algorithm, as shown in FIG. 8 . The algorithm can be executed by writing a program into code and storing it in a homomorphic computing device. The input and output of the blind rotation BR3 algorithm are as follows:

[0404] Input: A level 0 LWE ciphertext c = (a, b) ∈ LWE sk ,2N (m) (the components of the LWE ciphertext c satisfy k·2 θ form), the initial value of the accumulator acc in RLWE ciphertext form A bootstrap key A set of automorphic keys That is, w automorphic keys and one auxiliary key

[0405] Output: RLWE ciphertext

[0406] The specific process of the algorithm is as follows:

[0407] Step 1: Input the initial value of the accumulator acc in the form of RLWE ciphertext With an auxiliary key in RGSW ciphertext form Perform outer product calculation (i.e. multiplication of different ciphertext forms) to obtain the updated value.

[0408] Step 2: Based on the input ciphertext component satisfying k·2 θ The LWE ciphertext of the form is obtained by formula ai =a i +1 mod 2N is calculated to satisfy k·2 θ Ciphertext component in the form of +1.

[0409] Among them, a i is the i-th component of a in the LWE ciphertext, satisfying k·2 θ +1 form; a i is the i-th component of a in the input LWE ciphertext.

[0410] Step 3: Set the updated acc and ciphertext components to meet k·2 θ The +1 form LWE ciphertext c = (a, b), the bootstrap key BSK, and the automorphism key ATK are used as input, and the BR2 blind rotation algorithm is called for operation.

[0411] Step 4: Return (output)

[0412] After the BR2 blind rotation operation in Step 3 above, the final updated acc value is obtained, which is used as the RLWE ciphertext

[0413] In the algorithm described in Figures 7 and 8 above, the component a of the LWE ciphertext is first i Rounded to 2 θ Multiples of (i.e. k·2 θ form) to allow 2 θ function evaluation / calculation, but this approach will destroy the isomorphism. To address this problem, in this second embodiment, it is also proposed to satisfy k·2 θ The component a of the LWE ciphertext is of the form i Convert to k·2 θ +1 form, which is used in the following BR1 algorithm and BR2 algorithm, so that the ciphertext component a can be replaced by the BR1 algorithm and BR2 algorithm. i k·2 θ The BR2 algorithm is a computationally efficient blind rotation algorithm, and the BR1 algorithm is a storage-efficient blind rotation algorithm.

[0414] The following is a detailed introduction to the BR2 algorithm and the BR1 algorithm.

[0415] 1. BR2 blind rotation algorithm (component a of the ciphertext i Satisfy k·2 θ +1 form):

[0416] Referring to the LMKC+ function bootstrap in the existing related art 5, it can be known that for the dimension N≥8 and the interval θ≥2, the set Z 2N in k·2 θ +1 form of odd numbers is isomorphic to the set with the generator {g} Therefore, each component a of the ciphertext i can be re-transformed to be converted into the form of g k where Let Then the following formula 2 can be obtained:

[0417] When some I l is an empty set, the number of automorphisms can be further reduced. That is, for the empty set I l , the outer product processing (the symbol ⊙ represents the outer product) is not performed; and multiple automorphisms can be combined into one automorphism to perform the calculation.

[0418] The following introduces the calculation of combining multiple automorphisms into one automorphism.

[0419] Suppose there are k non-empty sets I l , k is a positive integer greater than 1; the non-empty set I l The corresponding combined automorphism can be expressed as where v l ≥1 is the accumulation of each index from the current non-empty set I l to the next non-empty set. v l is expressed as v l =v′ l +v" l ·w, where 0≤v′ l <w. w represents the window size, and g w is a known automorphism. Referring to the following formula, can be represented by 1+v" l known automorphisms. This technology is called modulus representation (MR). Correspondingly, the stored automorphism key is

[0420] For example, FIG9 shows a flowchart of an automorphic blind rotation algorithm based on sparse isomorphism (i.e., the BR2 algorithm). This BR2 algorithm is equivalent to the first embodiment of step 3 of S602A of the solution described in FIG6A above. In this BR2 algorithm, w automorphic keys are required, and the window size w and the number of automorphisms in this algorithm can be quickly determined based on given parameters using the Monte Carlo method. Referring to FIG9 , the input and output of this BR2 algorithm are as follows:

[0421] Input: A level 0 LWE ciphertext c = (a, b) ∈ LWE sk ,2N (m)(the ciphertext component satisfies k·2 θ +1 form), the initial value of the accumulator acc in the RLWE ciphertext form A bootstrap key A set of automorphic keys That is, w automorphic keys.

[0422] Output: RLWE ciphertext

[0423] As shown in Figure 9, the algorithm process analysis is as follows:

[0424] Step 1: Set the initial value of counter v to 0.

[0425] Step 2: For The following steps are executed in a loop:

[0426] That is, the current Execute the following Step 3 to Step 6 for each value of l (l>0) in the order of l from large to small (successively decremented by 1).

[0427] Step 3: For j∈I l , perform the following steps:

[0428] Bootstrap Key BSK j j∈I l , execute the following steps Step 4 to Step 6.

[0429] Step 4: The current value of the accumulator acc and the bootstrap key BSK j Perform outer product (multiplication of different ciphertext forms).

[0430] For example, for acc and Perform the outer product to get the updated

[0431] Step 6: v is accumulated and increased by 1.

[0432] Each time the above Step 3 to 4 (acc and bootstrap key BSK) are executed j The value of the counter v is accumulated and added by 1.

[0433] Step 7: When the next set is a non-empty set When v=w or l=1, execute the following Step 8.

[0434] Step 8: Homomorphically compute (evaluate) an automorphism ψ g :X→X g , get the updated accumulator acc.

[0435] The updated accumulator acc is expressed as follows:

[0436] Step 9: The value of v is cleared to zero.

[0437] That is, while performing an automorphism calculation, the value of the counter v is reset at the same time.

[0438] Step 10: Repeat the process from Step 2 to Step 9 to complete the above The for loop produces the following output:

[0439] Step 12: For j∈I0, perform the following steps:

[0440] That is, for j∈I0, execute the following steps Step13 to Step15.

[0441] Step 13~Step 15: Compare the current acc and BSK j Perform outer product operation (multiplication of different ciphertext forms) acc = acc ⊙ BSK j , to update acc.

[0442] The output obtained through the above steps can satisfy the following formula 4:

[0443] because Thus we can get The following formula 5 is satisfied:

[0444] From the BR2 algorithm process shown in Figure 9 above, we can see that BR2 is an automorphic blind rotation algorithm based on sparse isomorphism after automorphic re-expression optimization. The algorithm can transform the ciphertext component a into i Expressed as k·2θ +1 form, and by combining the automorphisms corresponding to the empty set, the number of automorphisms can be effectively reduced, that is, all possible automorphisms can be represented based on a finite number w of automorphisms. This algorithm can effectively improve the computational efficiency of the blind rotation algorithm. Since the blind rotation operation process is part of the circuit bootstrapping process, the computational efficiency of the bootstrapping process can be effectively improved.

[0445] 2. BR1 blind rotation algorithm (component a of the ciphertext i Satisfy k·2 θ +1 form):

[0446] Refer to the introduction of LMKC+ function bootstrapping in the above related technology 5: for N ≥ 8 and θ ≥ 2, Z 2N Middle k 2 θ +1 form odd numbers are isomorphic to the generator {g} For example, when N = 16 and θ = 2, the set {1, 5, 9, 13, 17, 21, 25, 29} is isomorphic to the multiplicative group generated by the generator g = 5 (mod 32).

[0447] Therefore, each ciphertext component a i can be rewritten as g k of the form, in which set up Thus, the following formula 6 can be obtained:

[0448] For example, FIG10 shows a flow chart of an automorphic blind rotation algorithm based on sparse isomorphism (ie, BR1 algorithm), which is equivalent to the second implementation of step 3 of S602A of the solution described in FIG6A above. In the BR1 algorithm, an automorphic key ATK is used. g (low memory storage overhead), the number of automorphisms is N′-1, N′=2N / 2 θ As shown in Figure 10, the input and output of the algorithm are as follows:

[0449] Input: A level 0 LWE ciphertext c = (a, b) ∈ LWE sk ,2N (m)(ciphertext component satisfies k·2 θ +1 form), the initial value of the accumulator acc in the RLWE ciphertext form A bootstrap key An automorphic key

[0450] Output: Level 2 RLWE ciphertext

[0451] As shown in Figure 10, the algorithm process analysis is as follows:

[0452] Step 1: For (l=2N / 2 θ -1, l>0; l=l-1), repeat steps 2 to 5:

[0453] Complete the θ -1] for loop; that is, for set I in turn l , l∈[1,2N / 2 θ -1], and repeat Steps 2 to 5.

[0454] Step 2: j∈I l , perform the following Step 3.

[0455] That is, for the current set I l For each item in , execute the following Step 3 once.

[0456] Step 3: The current value of the accumulator acc and the bootstrap key BSK j Perform outer product (multiplication of different ciphertext forms).

[0457] For example, l=2N / 2 θ -1, acc and Perform the outer product to get the updated

[0458] Step 5: Perform a homomorphic evaluation of the automorphism ψ g :X→X g , get the updated accumulator acc.

[0459] The updated accumulator acc satisfies the following formula 7:

[0460] Repeat Step 2 to 5 to complete the θ -1], the output is:

[0461] Step 7: For j∈I0, repeat the following Step 8.

[0462] In Step 7, for each item in the set I0 (l=0), the following Step 8 is executed once to cyclically update the acc value.

[0463] Step 8: The current value of the accumulator acc and the bootstrap key BSK j Perform outer product (acc = acc ⊙ BSK j) to update the current value of acc.

[0464] The output The following formula 8 is satisfied:

[0465] because Based on the above formula 8, the following formula 9 can be obtained:

[0466] As shown in FIG10 , the BR1 algorithm is based on a generator {g} to convert the ciphertext component a into i Expressed as k·2 θ +1 form, and designed a new blind rotation algorithm based on the automorphism HomAuto, and only uses one automorphic key. It can be seen that BR1 is a storage-efficient automorphic blind rotation algorithm based on sparse isomorphism, which can effectively reduce the overhead of storing keys.

[0467] Example 3:

[0468] This third embodiment provides a detailed description of step S602B in the solution described in FIG. 6B (which is equivalent to step S603A in the solution described in FIG. 6A ).

[0469] In the third embodiment, the HomTrace algorithm is executed on the circuit bootstrap Level 2.

[0470] First, receive Redundant RLWE ciphertexts are converted into a valid level 2 RLWE' ciphertext by executing the homomorphic trace algorithm. As shown in the following formula 10, first, based on the homomorphic trace algorithm, The redundant items of redundant RLWE ciphertexts are eliminated, and we get A RLWE ciphertext without redundancy; then The redundancy-free RLWE ciphertexts are concatenated to obtain a level 2 RLWE' ciphertext, as shown in the following formula 11:

[0471] If ignored The received redundant RLWE ciphertext has a valid value m in the constant term and can be used to construct the RGSW ciphertext. Then, the homomorphic trace (HomTrace) is homomorphically calculated to remove the power X term.

[0472] Specifically, for the algebraic expansion E / F, the function Tr(E / F) is expressed as Tr E / F (·)=∑σ∈Gal(E / F)σ(·), which has the unique property that for all 0≠i∈[N], TrE / F (1) = N and Tr E / F (X i )=0.

[0473] Therefore, the HomTrace function can satisfy the following formula 12:

[0474] in, yes middle The multiplicative inverse of , so and Should be relatively prime numbers. In the circuit bootstrap implementation described in the embodiment of the present application, the selected Is a power of 2, choose is an NTT prime. An intuitive way to evaluate the trace function is to compute every Galois automorphism and sum all the results.

[0475] In this embodiment 3, another more efficient method is adopted. The trace of the intermediate field K of the finite field E / F can be expressed as a combination of the traces of K / F and E / K, which can be expressed as Tr E / F =Tr K / F °Tr E / K Therefore, for the finite field tower case E = K N ≥K N / 2 ≥...≥K1=F, where K d represents the d-th power of 2 of the (2n)-th cyclotomic field, then there exists This method can reduce the number of HomeTraces from N to logN.

[0476] For example, FIG11 shows a flowchart of an algorithm for homomorphic evaluation of a trace function. Referring to FIG11 , the input and output of the algorithm are as follows:

[0477] Input: a set of RLWE ciphertext (including redundant items), a set of self-similar keys logN automorphic keys. Among them, It is a power of 2.

[0478] The output of this algorithm is the level 2 RLWE ciphertext Among them, the test polynomial The multi-valued function bootstrap can set the value to the position of the desired polynomial coefficient through f(m), for example, j∈[0,2], They are:

[0479] An RLWE ciphertext is a polynomial with N coefficients, the dimension of the polynomial is N, and it is modulo X N +1 integer polynomial, that is, X N +1=0, or X N =-1, or X 2N =1.

[0480] Output: a set of RLWE ciphertext (excluding redundant items).

[0481] As shown in Figure 11, the specific analysis of the above algorithm is as follows:

[0482] Because N=2 log N ,

[0483] Assume that j = 0, other The items are also calculated according to the following steps.

[0484] Step 1: When k=1, Need to execute automorphism X→X N+1 =(-X), then through the calculation of the algorithm in step 3 shown in Figure 11, the following formula 13 can be obtained:

[0485] From the above formula 13, we can see that the automorphism The signs of all odd powers in become -1. Furthermore, executing After processing, The (updated) corresponding formula only contains terms that are even powers of X.

[0486] Step 2: When k=2, Need to perform automorphism X→X N / 2+1 , then through the calculation of the algorithm in step 3 shown in Figure 11, the following formula 14 can be obtained:

[0487] From the above formula 14, we can see that the automorphism All the multiples of 4 in the power are positive, and the other terms are negative. The calculation results obtained The only terms left in the (updated) corresponding formula are those that are multiples of X to the power of 4.

[0488] Step 3: When k = [3, log N], refer to the calculation method for k = 1 and k = 2 above and continue iterating Finally, we can calculate

[0489] Through Example 3, the algorithm for homomorphic evaluation of the trace function proposed in the embodiment of the present application is adopted. Without converting the ciphertext form, the level 2 RLWE ciphertext can be effectively de-redundanted to obtain a valid level 2 RLWE' ciphertext. Therefore, the method of the embodiment of the present application can effectively solve the problem of low computational efficiency and high storage caused by redundant items of the RLWE ciphertext, and compared with the existing sample extraction method to remove redundant items of the RLWE ciphertext, the algorithm proposed in the embodiment of the present application is more efficient in de-redundanting the ciphertext.

[0490] Example 4:

[0491] In this fourth embodiment, S603B in the solution described in FIG. 6B (equivalent to S604A in the solution described in FIG. 6A ) is mainly described in detail.

[0492] For example, FIG12 shows a flow chart of a scheme switching algorithm, that is, performing scheme switching at Level 2 of the circuit bootstrap. Referring to FIG12 , the input and output of the algorithm are as follows:

[0493] Input: A level 2 gadget RLWE ciphertext A scheme switching key SSK is a RLWE' ciphertext containing l RLWE ciphertexts, where l represents the dimension of gadget decomposition.

[0494] Output: Level 2 RGSW ciphertext.

[0495] For example,

[0496] As shown in Figure 12, the switching algorithm of this solution is analyzed as follows:

[0497] First receive a level 2 gadget RLWE ciphertext Then according to level 2 Using the scheme switching algorithm (refer to the introduction of the scheme switching algorithm in the algorithm involved in the above embodiment of this application), calculate and generate Finally, based on and Construct the RGSW ciphertext of level 2, that is, RLWE′ sk (sk·m) and RLWE′ sk (m) are assembled together to obtain RGSW(RLWE′ sk (m)) ciphertext, RGSW(RLWE′ sk (m)) satisfies the following formula 15: SS RLWE′→RGSW :(RLWE′ sk (m))=(RLWE′ sk (sk·m),RLWE′ sk (m)); Formula 15

[0498] In this fourth embodiment, based on the valid RLWE ciphertext obtained in the third embodiment, a scheme switching algorithm is used to effectively obtain the RGSW ciphertext for the next hierarchical circuit calculation.

[0499] Embodiment 5:

[0500] In this fifth embodiment, the keys, parameters and performance analysis involved in the embodiments of the present application are introduced in detail.

[0501] Figure 13 shows a diagram of a homomorphic computing scenario to which the method according to an embodiment of the present application can be applied, as well as the interaction process between keys and parameters in the homomorphic computing scenario. The specific process may include the following:

[0502] Step 1: The homomorphic key generator generates the homomorphic key and homomorphic scheme parameters for the homomorphic task.

[0503] Homomorphic scheme parameters may include: the dimensions of the LWE at the three levels (i.e., level 0, level 1, and level 2), the ciphertext modulus, the basis for gadget decomposition during outer product operations in function bootstrapping, the length of the gadget decomposition during outer product operations, the basis for gadget decomposition during key switching, and the length of the gadget decomposition during key switching. For details, see the homomorphic scheme parameters in the circuit bootstrapping scheme in Figure 6B above.

[0504] Homomorphic keys may include: homomorphic encryption keys, homomorphic decryption keys, homomorphic computation keys (including but not limited to scheme switching keys, key switching keys, bootstrapping keys, self-isomorphic keys, auxiliary keys), etc.

[0505] Step 2: The homomorphic key generator A sends (e.g., broadcasts) homomorphic scheme parameters to the homomorphic encryptor B, the homomorphic computer C, and the homomorphic decryptor D, and the homomorphic key generator A also sends the homomorphic encryption key to the homomorphic encryptor B, the homomorphic computer C, and the homomorphic decryption key to the homomorphic decryptor D.

[0506] Step 3: Homomorphic encryption party B homomorphically encrypts the plaintext data based on the homomorphic scheme parameters and the homomorphic encryption key to obtain the homomorphic ciphertext, and then sends the homomorphic ciphertext to the homomorphic computing party C.

[0507] Step 4: The homomorphic computing party C performs homomorphic computing on the homomorphic ciphertext according to the homomorphic scheme parameters, homomorphic computing key and homomorphic ciphertext, and sends the ciphertext of the homomorphic computing result to the homomorphic decryption party D.

[0508] Step 5: Homomorphic decryption party D executes the homomorphic decryption algorithm on the ciphertext of the homomorphic calculation result according to the homomorphic scheme parameters and the homomorphic decryption key to obtain the plaintext result.

[0509] Optionally, the homomorphic decryption party D may also obtain the homomorphic ciphertext directly from the homomorphic encryption party B, and then perform a homomorphic decryption algorithm on the homomorphic ciphertext according to the homomorphic decryption key to obtain a plaintext result.

[0510] The method provided in the embodiment of the present application can be applied to a homomorphic computing party. Based on the process of the homomorphic computing scenario shown in Figure 13 above, it can be seen that before the homomorphic computing party performs homomorphic computing, the homomorphic key generator should send the homomorphic computing key to the homomorphic computing party; in addition, since the homomorphic computing key is generated by the homomorphic key generator according to the corresponding parameters, the homomorphic key generator also needs to transmit the parameters of these homomorphic computing keys to the homomorphic computing party so that the homomorphic computing party sets the values ​​of the parameters of these homomorphic computing keys to be consistent with the values ​​on the key generator side.

[0511] Specifically, the homomorphic computation key may include but is not limited to the following:

[0512] 1. The homomorphic computation keys involved in the second embodiment (multi-valued function bootstrapping from level 0 to level 2) include the following:

[0513] A set of bootstrap keys

[0514] A set of automorphic keys That is, w automorphic keys;

[0515] A secondary key

[0516] 2. The homomorphic computation keys involved in Example 3 (Level 2 homomorphic trace) include:

[0517] A set of automorphic keys logN automorphic keys. It's 2

[0518] Power.

[0519] 3. The homomorphic computation keys involved in the fourth embodiment (Level 2 solution switching) include:

[0520] A scheme switching key SSK, which is an RLWE' ciphertext, that is, it contains l RLWE ciphertexts, where l represents the dimension or length of the gadget decomposition of the scheme switching key.

[0521] Specifically, the parameters of the homomorphic computation key may include but are not limited to the following:

[0522] n: the dimension of LWE ciphertexts in level 0;

[0523] the ciphertext module in level 2;

[0524] g: The generator {g} of

[0525] w: Window size w, i.e., w automorphic keys (applied to bootstrap multi-valued functions from level 0 to level 2);

[0526] the dimension of ring polynomials in level 2;

[0527] Other parameters involved in the embodiments of this document may be set by the homomorphic computing party. For example, the parameter θ may be set or selected by the homomorphic computing party based on the homomorphic decryption error rate fed back by the homomorphic decryption party.

[0528] In the embodiments provided in the present application above, the methods provided in the embodiments of the present application are introduced from the perspective of interaction between various devices. In order to implement the various functions in the methods provided in the embodiments of the present application above, the homomorphic computing device may include a hardware structure and / or a software module to implement the above functions in the form of a hardware structure, a software module, or a hardware structure plus a software module. Whether one of the above functions is executed in the form of a hardware structure, a software module, or a hardware structure plus a software module depends on the specific application and design constraints of the technical solution.

[0529] The division of modules in the embodiments of the present application is illustrative and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the present application may be integrated into a single processor, or may exist physically separately, or two or more modules may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or software functional modules.

[0530] Similar to the above concept, as shown in Figure 14, the embodiment of the present application also provides a ciphertext processing device 1400 for implementing the functions of the homomorphic computing device (homomorphic computing party) in the above method. For example, the ciphertext processing device 1400 can be a software module or a chip system. In the embodiment of the present application, the chip system can be composed of a chip, or it can include a chip and other discrete devices. The ciphertext processing device 1400 may include: a communication unit 1401 and a processing unit 1402.

[0531] In the embodiment of the present application, the communication unit 1401 may also be referred to as a transceiver unit, and may include a sending unit and / or a receiving unit, each configured to execute the steps of sending and receiving by the network device or terminal device in the above method embodiment. The processing unit 1402 may be configured to read instructions and / or data from the storage module, so that the ciphertext processing apparatus 1400 implements the above method embodiment.

[0532] Optionally, the ciphertext processing apparatus 1400 may further include a storage unit 1403 , which is equivalent to a storage module and may be used to store instructions and / or data.

[0533] The following describes in detail the ciphertext processing device provided by the embodiment of the present application in conjunction with Figures 14 and 15. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, for matters not described in detail, please refer to the method embodiment described in Figure 6A above. For the sake of brevity, it will not be repeated here.

[0534] Communication unit 1401 may also be referred to as a transceiver, transceiver, or transceiver device. A processing unit may also be referred to as a processor, processing board, processing module, or processing device. Alternatively, the device in communication unit 1401 that implements the receiving function may be considered a receiving unit, and the device in communication unit 1401 that implements the transmitting function may be considered a transmitting unit. That is, communication unit 1401 includes both a receiving unit and a transmitting unit. A communication unit may also be referred to as a transceiver, transceiver, or transceiver circuit. A receiving unit may also be referred to as a receiver, receiver, or receiving circuit. A transmitting unit may also be referred to as a transmitter, transmitter, or transmitting circuit.

[0535] When the ciphertext processing apparatus 1400 executes the homomorphic computing device in the process shown in FIG. 6A in the above embodiment:

[0536] The communication unit 1401 is used to obtain the target error-learning LWE ciphertext of level 0;

[0537] The processing unit 1402 is configured to convert the target LWE ciphertext at level 0 to obtain a first RLWE ciphertext at level 2; and then perform redundancy removal processing on the first RLWE ciphertext at level 2 to obtain a first target RLWE′ ciphertext.

[0538] The processing unit 1402 is further configured to obtain a target RGSW ciphertext of level 2 according to the first target RLWE' ciphertext.

[0539] The above is just an example. The processing unit 1402 and the communication unit 1401 can also perform other functions. For more detailed description, please refer to the relevant description of the method embodiment described in Figures 6A and 6B, which will not be repeated here.

[0540] FIG15 shows a ciphertext processing device 1500 provided in an embodiment of the present application. The ciphertext processing device shown in FIG15 may be a hardware circuit implementation of the ciphertext processing device shown in FIG14 . The ciphertext processing device 1500 may be applicable to the flowchart shown above to perform the functions of the homomorphic computing device (homomorphic computing party) in the above-mentioned method embodiment. For ease of explanation, FIG15 only shows the main components of the ciphertext processing device.

[0541] As shown in Figure 15 , the ciphertext processing apparatus 1500 includes a communication interface 1501 and a processor 1502. The communication interface 1501 and the processor 1502 are coupled to each other. It is understood that the communication interface 1501 can be a transceiver or an input / output interface, or an interface circuit such as a transceiver circuit. Optionally, the ciphertext processing apparatus 1500 can also include a memory 1503 for storing instructions executed by the processor 1502, or storing input data required by the processor 1502 to execute instructions, or storing data generated after the processor 1502 executes instructions.

[0542] When the ciphertext processing apparatus 1500 is used to implement the method shown in FIG. 6A and FIG. 6B , the communication interface 1501 is used to implement the functions of the communication unit 1401 , and the processor 1502 is used to implement the functions of the processing unit 1402 .

[0543] The specific connection medium between the communication interface 1501, the processor 1502, and the memory 1503 is not limited in the embodiments of the present application. In Figure 15, the embodiment of the present application shows that the memory 1503, the processor 1502, and the communication interface 1501 are connected via a communication bus 1504. The communication bus 1504 is represented by a bold line in Figure 15. The connection method between other components is only for schematic illustration and is not intended to be limiting. The communication bus 1504 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bold line is used in Figure 15, but this does not mean that there is only one bus or one type of bus.

[0544] When the above-mentioned ciphertext processing device is a chip, FIG16 shows a simplified schematic diagram of the chip structure, wherein the chip 1600 includes an interface circuit 1601 and one or more processors 1602. Optionally, the chip 1600 may further include a bus.

[0545] The processor 1602 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above-mentioned communication method can be completed by an integrated logic circuit of the hardware in the processor 1602 or an instruction in the form of software. The above-mentioned processor 1602 can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The various methods and steps disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0546] The interface circuit 1601 can be used to send or receive data, instructions or information. The processor 1602 can use the data, instructions or other information received by the interface circuit 1601 to process it, and can send the processing completion information through the interface circuit 1601.

[0547] Optionally, the chip further includes a memory 1603, which may include a read-only memory and a random access memory, and provides operating instructions and data to the processor. A portion of the memory 1603 may also include a non-volatile random access memory (NVRAM).

[0548] Optionally, the memory stores an executable software module or a data structure, and the processor can perform corresponding operations by calling an operation instruction stored in the memory (the operation instruction may be stored in an operating system).

[0549] Optionally, the chip can be used in a homomorphic computing device according to an embodiment of the present application. Optionally, the interface circuit 1601 can be used to output the execution result of the processor 1602. For the ciphertext processing method provided in one or more embodiments of the present application, reference can be made to the aforementioned embodiments and will not be repeated here.

[0550] It should be noted that the corresponding functions of the interface circuit 1601 and the processor 1602 can be implemented through hardware design, software design, or a combination of hardware and software, and there is no limitation here.

[0551] An embodiment of the present application also provides a computer-readable storage medium on which computer instructions for implementing the method executed by the homomorphic computing device (homomorphic computing party) in the above method embodiment are stored.

[0552] For example, when the computer program is executed by a computer, the computer can implement the method performed by the homomorphic computing device in the above method embodiment.

[0553] An embodiment of the present application also provides a computer program product comprising instructions, which, when executed by a computer, enables the computer to implement the method performed by the homomorphic computing device (homomorphic computing party) in the above method embodiment.

[0554] An embodiment of the present application also provides a chip, including a processor, for calling the computer program or computer instructions stored in the memory so that the processor executes the ciphertext processing method of the embodiment shown in Figures 6A-6B above.

[0555] In one possible implementation, the input of the chip corresponds to the receiving operation in the embodiment shown in FIG. 6A and FIG. 6B , and the output of the chip corresponds to the sending operation in the embodiment shown in FIG. 6A and FIG. 6B .

[0556] Optionally, the processor is coupled to the memory via an interface.

[0557] Optionally, the chip further includes a memory in which computer programs or computer instructions are stored.

[0558] The processor mentioned in any of the above may be a general-purpose central processing unit, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of a program of a ciphertext processing method according to the embodiment shown in FIG6A and FIG6B . The memory mentioned in any of the above may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, a random access memory (RAM), etc.

[0559] It should be noted that, for the sake of convenience and brevity of description, the explanation and beneficial effects of the relevant contents in any of the above-mentioned ciphertext processing devices can refer to the corresponding communication method embodiments provided above, and will not be repeated here.

[0560] In this application, the ciphertext processing device may further include a hardware layer, an operating system layer running on top of the hardware layer, and an application layer running on top of the operating system layer. The hardware layer may include hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also known as main memory). The operating system of the operating system layer may be any one or more computer operating systems that implement business processing through processes, such as the Linux operating system, Unix operating system, Android operating system, iOS operating system, or Windows operating system. The application layer may include applications such as browsers, address books, word processing software, and instant messaging software.

[0561] The division of modules in the embodiments of the present application is illustrative and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the present application may be integrated into a single processor, or may exist physically separately, or two or more modules may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or software functional modules.

[0562] Through the description of the above embodiments, it will be clear to those skilled in the art that the embodiments of the present application can be implemented in hardware, firmware, or a combination thereof. When software is used for implementation, the above functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein the communication media include any medium that facilitates the transmission of a computer program from one place to another. The storage medium can be any available medium that a computer can access. For example, but not limited to: a computer-readable medium may include RAM, ROM, electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer. In addition, any connection can be appropriately a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of the medium. As used in the embodiments of the present application, disk and disc include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk, and Blu-ray disc, where disks typically reproduce data magnetically and discs use lasers to reproduce data optically. Combinations of the above should also be included within the scope of protection of computer-readable media.

[0563] In short, the above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent replacements, improvements, etc. made based on the disclosure of the present application should be included in the scope of protection of the present application.

Claims

1. A ciphertext processing method, characterized in that: The method is applied to a homomorphic computing party, including: Get the target error-learning LWE ciphertext at level 0; Converting the target LWE ciphertext at level 0 to obtain a first RLWE ciphertext at level 2; Performing redundancy removal processing on the first RLWE ciphertext of the level 2 to obtain a first target RLWE' ciphertext; According to the first target RLWE' ciphertext, the target RGSW ciphertext of level 2 is obtained.

2. The method according to claim 1, characterized in that The step of obtaining the target error-learning LWE ciphertext at level 0 includes: Obtaining an initial LWE ciphertext of level 2, wherein the initial LWE ciphertext of level 2 is obtained through hierarchical homomorphic calculation based on the RGSW ciphertext of level 2; Key switching is performed on the initial LWE ciphertext of level 2 to obtain the target LWE ciphertext of level 0.

3. The method according to claim 1 or 2, characterized in that: The converting the target LWE ciphertext of level 0 to obtain the first RLWE ciphertext of level 2 includes: Obtaining a target key; and performing sparse processing on the target LWE ciphertext of level 0 to obtain a sparse target LWE ciphertext; Determine the initial value of the accumulator that satisfies the RLWE ciphertext form; Based on the sparse target LWE ciphertext, the accumulator initial value satisfying the RLWE ciphertext form, and the target key, a blind rotation algorithm is used for processing to obtain an updated accumulator value; Based on the updated accumulator value, a first RLWE ciphertext of the level 2 is obtained.

4. The method according to claim 3, characterized in that The target key includes a bootstrap key and an auxiliary key, and an automorphic key set, wherein the automorphic key set includes at least one automorphic key; the bootstrap key is a first RGSW ciphertext obtained by homomorphically encrypting a homomorphic key component of level 0 using a homomorphic encryption key of level 2; the automorphic key is an RLWE ciphertext obtained by homomorphically encrypting an automorphism of a key plaintext using a homomorphic key, and the auxiliary key is a second RGSW ciphertext obtained by homomorphically encrypting the sum of the homomorphic key components of level 0 using the homomorphic encryption key of level 2.

5. The method according to claim 3 or 4, characterized in that: The performing sparse processing on the target LWE ciphertext of level 0 to obtain a sparse target LWE ciphertext includes: A module switching method is used to perform sparse rounding processing on each component of the target LWE ciphertext to obtain the sparse target LWE ciphertext, and each component of the sparse target LWE ciphertext satisfies k·2 θ In the form of, k is an integer greater than 0 or equal to 0, and θ is a positive integer.

6. The method according to any one of claims 3 to 5, characterized in that: The sparse target LWE ciphertext consists of a first part and a second part; the determining of the accumulator initial value that satisfies the RLWE ciphertext form includes: Get the test polynomial; According to the second part of the sparse target LWE ciphertext and the test polynomial, an initial value of the accumulator satisfying the RLWE ciphertext form is obtained.

7. The method according to any one of claims 3 to 6, characterized in that: The sparse target LWE ciphertext consists of a first part and a second part; the accumulator initial value based on the sparse target LWE ciphertext and the RLWE ciphertext form, and the target key are processed using a blind rotation algorithm to obtain an updated accumulator value, including: Each component of the first part of the sparse target LWE ciphertext is reduced from k·2 θ The form is converted to k·2 θ +1 form; Performing an outer product calculation on the accumulator initial value satisfying the RLWE ciphertext form and the auxiliary key to obtain a first accumulator value; Based on the fact that each component satisfies k·2 θ The sparse target LWE ciphertext in the form of +1, the first accumulator value, the bootstrap key and the automorphic key set are used to obtain the updated accumulator value through a blind rotation algorithm.

8. The method according to claim 7, characterized in that The self-similar key set includes w self-similar keys, the size of w is determined by the Monte Carlo method and preset parameters, and w is an integer value greater than 1; The method is based on each component satisfying k·2 θ The sparse target LWE ciphertext in the form of +1, the first accumulator value, the bootstrap key and the automorphic key set, and obtaining the updated accumulator value through a blind rotation algorithm, including: Each component of the sparse target LWE ciphertext is transformed from k·2 θ +1 form converted to g k form; Z represents a set of integers, and N is a power of 2; Based on the fact that each component satisfies g k The sparse target LWE ciphertext of the form A set I; For set I l , Set the initial value of counter v to 0, and repeat the following steps in descending order of the value of l. Second-rate: Based on the current value of the accumulator and the bootstrap key, performing an outer product process and updating the current value of the accumulator; The value of the counter v is increased by 1; When a preset condition is met, an automorphic algorithm is executed based on the currently updated value of the accumulator and the automorphic key to obtain a new accumulator value and reset the value of the counter v to 0; the preset condition includes any one of the following: v = w, the next set I l-1 Not a non-empty set, l = 1; When l=0, for the set I0, perform the following steps: Based on the current value of the accumulator and the bootstrap key, an outer product process is performed to obtain the updated accumulator value.

9. The method according to claim 7, characterized in that: The self-similar key set includes 1 self-similar key; The method is based on each component satisfying k·2 θ The sparse target LWE ciphertext in the form of +1, the first accumulator value, the bootstrap key and the automorphic key set, and obtaining the updated accumulator value through a blind rotation algorithm, including: Each component of the sparse target LWE ciphertext is transformed from k·2 θ +1 form converted to g k form; Z represents a set of integers, and N is a power of 2; Based on the fact that each component satisfies g k The sparse target LWE ciphertext of the form A set I; For set I l , Repeat the following steps in descending order of l value: Second-rate: Based on the current value of the accumulator and the bootstrap key, performing an outer product process and updating the current value of the accumulator; Execute an automorphism algorithm based on the currently updated value of the accumulator and the automorphism key to obtain a new accumulator value; When l=0, for the set I0, perform the following steps: Based on the current value of the accumulator and the bootstrap key, an outer product process is performed to obtain the updated accumulator value.

10. The method according to any one of claims 3 to 9, characterized in that: The obtaining, based on the updated accumulator value, the first RLWE ciphertext of the level 2, comprises: Compare the updated accumulator value to X -j Perform product processing to obtain the first RLWE ciphertext of level 2; j∈[0,l-1].

11. The method according to any one of claims 1 to 10, characterized in that: The performing redundancy removal processing on the first RLWE ciphertext of the level 2 to obtain the first target RLWE' ciphertext includes: Get the automorphism key of level 2 of the homomorphic estimation trace algorithm; Execute the homomorphic estimation trace algorithm l times to eliminate redundant items in l first RLWE ciphertexts, and obtain l level 2 RLWE ciphertexts without redundant items; The l level 2 RLWE ciphertexts without redundant items are concatenated to obtain the first target RLWE' ciphertext of level 2.

12. The method according to any one of claims 8 to 11, characterized in that The l represents the dimension of the decomposition vector.

13. The method according to any one of claims 1 to 12, characterized in that: The step of obtaining a target RGSW ciphertext of level 2 according to the first target RLWE' ciphertext includes: Get the scheme switching key; Based on the first target RLWE' ciphertext and the scheme switching key, a scheme switching algorithm is used to perform calculation to obtain a second target RLWE' ciphertext; The first target RLWE' ciphertext and the second target RLWE' ciphertext are concatenated to obtain the target RGSW ciphertext of level 2.

14. The method according to any one of claims 1 to 13, characterized in that: The target RGSW ciphertext of level 2 is used for the next hierarchical homomorphic computation.

15. The method according to any one of claims 1 to 14, characterized in that The method further comprises: Receiving a homomorphic computing key and parameters of the homomorphic computing key and homomorphic scheme parameters from a homomorphic key generator; The homomorphic computing key includes one or more of the following: a set of bootstrapping keys, a set of automorphic keys, an auxiliary key, a set of automorphic keys of the homomorphic trace algorithm, a scheme switching key, and at least one key switching key; The parameters of the homomorphic computation key include one or more of the following: LWE ciphertext dimension at level 0, ciphertext modulus at level 2, integer set The generator {g} of , the number w of automorphic keys in the set of automorphic keys, and the dimension of the ring polynomial of level 2; The homomorphic scheme parameters include one or more of the following: LWE ciphertext dimensions at each level, ciphertext modulus at each level, decomposition basis for outer product operations in function bootstrapping, decomposition dimension or length for outer product operations in function bootstrapping, decomposition basis during key switching, decomposition dimension or length during key switching.

16. A ciphertext processing device, characterized in that: The method comprises a module or a unit for executing the method according to any one of claims 1 to 15.

17. A ciphertext processing device, characterized in that: It includes a processor, which is coupled to a memory, and a computer program is stored in the memory; the processor is used to call the computer program in the memory so that the ciphertext processing device executes the method as described in any one of claims 1 to 15.

18. A ciphertext processing device, characterized in that: It includes a processor and an interface circuit, wherein the interface circuit is used to receive signals from other communication devices outside the communication device and transmit them to the processor or send signals from the processor to other communication devices outside the communication device, and the processor is used to implement the method as described in any one of claims 1 to 15 through a logic circuit or executing code instructions.

19. A computer-readable storage medium, characterized in that: The storage medium stores a computer program or instruction, and when the computer program or instruction is executed by a computer, the method as claimed in any one of claims 1 to 15 is implemented.

20. A computer program product, characterized in that When a computer reads and executes the computer program product, the computer is enabled to execute the method according to any one of claims 1 to 15.

21. A communication system, comprising a homomorphic encryption party, a homomorphic computing party and a homomorphic decryption party, wherein the homomorphic computing party is used to execute the method described in any one of claims 1 to 15.

Images