Data processing method and apparatus

Abstract

Provided in the embodiments of the present application are a data processing method and apparatus. The method comprises: a first apparatus determining a ciphertext modulus for homomorphic encryption, wherein the ciphertext modulus is a prime number obtained by means of accumulating products of n different powers of 2 and a coefficient, n being an integer greater than or equal to 2 and less than or equal to 5; and then, performing homomorphic processing on the basis of the ciphertext modulus, wherein the homomorphic processing can comprise at least one of homomorphic encryption, homomorphic decryption and homomorphic computation. Generally, operations such as homomorphic encryption, homomorphic decryption and homomorphic computation may all involve a modulo operation or modulo calculation. In the implementation of the present application, a modulus is designed, such that the modulo operation or modulo calculation can be more convenient and more efficient, thus improving the processing efficiency of all the operations such as the homomorphic encryption, the homomorphic decryption and the homomorphic computation that include the modulo operation / modulo calculation.

Description

Data processing method and device

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the State Intellectual Property Office of the People's Republic of China on January 23, 2024, with application number 202410098988.3 and application name "A Data Processing Method and Device", the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of communication technology, and in particular to a data processing method and device. Background Art

[0004] To protect the privacy of user data, homomorphic encryption (FHE) technology has been proposed. Its basic principle is to use a special encryption algorithm so that the results of mathematical operations performed on ciphertext are consistent with those of the same operations performed on plaintext. Homomorphic encryption consists of four steps: key generation, homomorphic encryption, homomorphic computation (also called homomorphic evaluation), and homomorphic decryption. During key generation, the key generator generates homomorphic encryption keys, homomorphic decryption keys, and homomorphic computation keys. During homomorphic encryption, the encryptor uses the homomorphic encryption key to encrypt the plaintext message into ciphertext. During homomorphic computation, the computational provider performs homomorphic computation based on the ciphertext and the homomorphic computation key, resulting in the resulting ciphertext. During homomorphic decryption, the decryptor uses the homomorphic decryption key to restore the ciphertext to the plaintext message.

[0005] To support arbitrary encryption and / or multiplication calculations on ciphertext, fully homomorphic encryption (FHE) was proposed based on homomorphic encryption. The existing fully homomorphic encryption process adds a small random "noise" component to improve the security of the ciphertext. However, when performing homomorphic calculations on ciphertext with added "noise," the noise in the ciphertext after homomorphic calculation increases with the number of homomorphic calculations or the complexity of the homomorphic calculations. When the noise in the ciphertext exceeds a critical value, it will destroy or even overwrite the original ciphertext, causing homomorphic decryption to fail. To address this problem, the FHE scheme proposes a process called bootstrapping, which can "refresh" (process) a ciphertext with noise close to or exceeding a critical value into a new ciphertext with much lower noise.

[0006] When the algorithms corresponding to the above-mentioned homomorphic encryption and homomorphic computation (including the bootstrapping process) and homomorphic decryption are implemented by computers, they involve not only operations such as addition and / or multiplication, but also modular operations. Computers generally find it easier to perform operations such as addition and multiplication, but it is more difficult to perform modular operations, and the computational efficiency is very low. The efficiency of modular operations will affect the overall execution efficiency of the homomorphic processing (such as homomorphic encryption, homomorphic computation, and homomorphic decryption). For example, a blind rotation processing method based on number theoretic transform (NTT) has been proposed to improve the execution efficiency of the bootstrapping process. The blind rotation processing based on the number theoretic transform NTT includes NTT processing. In NTT processing, in order to improve the correctness of the data, it is necessary to frequently perform modular operations on the result data after multiplication and addition and subtraction, which will affect the overall execution efficiency of the bootstrapping process. Summary of the Invention

[0007] This application proposes a data processing method and device, which can effectively improve the efficiency of homomorphic processing.

[0008] In a first aspect, embodiments of the present application provide a data processing method, which may include: a first device determining a ciphertext modulus for homomorphic encryption; the ciphertext modulus is a prime number obtained by multiplying and summing n different powers of 2 and coefficients, where n is an integer greater than or equal to 2 and less than or equal to 5; and the first device performing homomorphic processing based on the ciphertext modulus. The homomorphic processing may include, but is not limited to, at least one of homomorphic encryption, homomorphic decryption, and homomorphic computation.

[0009] In an embodiment of the present application, if the first device performs homomorphic encryption based on the ciphertext modulus, the first device may be a homomorphic encryption party device, the first device may also be a component (such as a module, chip, etc.) corresponding to the homomorphic encryption party device, and the first device may also be a device used in conjunction with the homomorphic encryption party device. If the first device performs homomorphic decryption based on the ciphertext modulus, the first device may be a homomorphic decryption party device, the first device may also be a component (such as a module, chip, etc.) corresponding to the homomorphic decryption party device, and the first device may also be a device used in conjunction with the homomorphic decryption party device. If the first device performs homomorphic calculation (or homomorphic evaluation) based on the ciphertext modulus, the first device may be a homomorphic calculation party device, the first device may also be a component (module, chip, etc.) of the homomorphic calculation party device, and the first device may also be a device used in conjunction with the homomorphic calculation party.

[0010] Typically, homomorphic encryption, homomorphic decryption, and homomorphic computing involve modulo operations or modulo calculations, and the usual modulo operation or modulo calculation method may be to directly perform vertical division calculations to obtain the result. However, when the divisor and dividend of the modulo operation are large, it is obviously more difficult to use vertical calculations to obtain the result. To this end, the present application designs a modulus, which is a prime number obtained by multiplying and adding n different powers of 2 and coefficients. Based on such a modulus, modulo operations or modulo calculations are more convenient, and the modulo efficiency is higher, thereby improving the processing efficiency of homomorphic encryption, homomorphic decryption, and homomorphic computing that include modulo operations / modulo calculations.

[0011] In one possible implementation, the ciphertext modulus may satisfy the following form:

[0012] Where Q is the modulus of the ciphertext, and the first n-1 different powers of 2 are exponents k. i is an integer greater than 0 and less than or equal to m (m≥k1>…k i >k n-1 >0), the exponent k of the nth power of 2 n Equal to 0(k n =0), m is the bit width of the ciphertext modulus Q, and the coefficient a i The value of is +1 or -1, and i is an integer greater than or equal to 1 and less than or equal to n.

[0013] For example, when n is 2, the ciphertext modulus satisfies the form Where k1 is an integer greater than 0 and less than or equal to m. When n is 3, the ciphertext modulus satisfies the form Wherein, k1 and k2 are both integers greater than 0 and less than or equal to m.

[0014] In one possible implementation, the homomorphic encryption, homomorphic decryption, and homomorphic calculation all include modulo operations; the first device performs homomorphic processing based on the ciphertext modulus, which may include: performing a modulo operation based on the ciphertext modulus, the modulo operation including shift processing and / or logical operation processing; wherein the number of bits moved in the shift processing is related to the exponent of the n powers of 2 in the ciphertext modulus, and the number of logical operation processing is related to the value of n.

[0015] In a possible implementation, the method may further include: the first device performing a number theoretic transformation (NTT) based on a modulo operation.

[0016] In one possible implementation, one NTT includes M butterfly operations; M is an integer greater than or equal to 3; the first device performs a number theory transformation NTT based on a modulo operation, which may specifically include: performing the modulo operation once after every three butterfly operations; and performing modulo operation on each multiplication result in each butterfly operation using a power modulo operation algorithm.

[0017] In a second aspect, an embodiment of the present application further provides a data processing method, which may include: a first device determining a ciphertext modulus for homomorphic encryption; the ciphertext modulus is a composite number obtained by multiplying d different prime numbers, where each prime number is obtained by summing up the products of n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5, and d is an integer greater than 1; and then performing homomorphic processing based on the ciphertext modulus. In an embodiment of the present application, homomorphic processing may include, but is not limited to, at least one of homomorphic encryption, homomorphic decryption, and homomorphic computation.

[0018] In an embodiment of the present application, if the first device performs homomorphic encryption based on the ciphertext modulus, the first device may be a homomorphic encryption party device, the first device may also be a component (such as a module, chip, etc.) corresponding to the homomorphic encryption party device, and the first device may also be a device used in conjunction with the homomorphic encryption party device. If the first device performs homomorphic decryption based on the ciphertext modulus, the first device may be a homomorphic decryption party device, the first device may also be a component (such as a module, chip, etc.) corresponding to the homomorphic decryption party device, and the first device may also be a device used in conjunction with the homomorphic decryption party device. If the first device performs homomorphic calculation (or homomorphic evaluation) based on the ciphertext modulus, the first device may be a homomorphic calculation party device, the first device may also be a component (module, chip, etc.) of the homomorphic calculation party device, and the first device may also be a device used in conjunction with the homomorphic calculation party.

[0019] Typically, homomorphic encryption, homomorphic decryption, and homomorphic computing involve modulo operations or modulo calculations, and the usual modulo operation or modulo calculation method may be to directly perform vertical division calculations to obtain the result. However, when the divisor and dividend of the modulo operation are large, it is obviously difficult to use vertical calculations to obtain the result. To this end, the present application designs a modulus, which is a composite number obtained by multiplying d different prime numbers, and each prime number is obtained by adding n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5. In application, the modulus of the composite number can be first decomposed to obtain a modulus of d different prime numbers, and then a modulo operation / calculation is performed based on the modulus of d different prime numbers. Similar to the above method, the modulo efficiency will be higher, thereby improving the processing efficiency of homomorphic encryption, homomorphic decryption, and homomorphic computing that include modulo operations / modulo calculations.

[0020] In one possible implementation, the ciphertext modulus may satisfy the following form:

[0021] Among them, Q represents the ciphertext modulus, and d represents the prime number Q obtained by multiplying the ciphertext modulus. j The number of prime numbers Q j Satisfy the following form:

[0022] Prime Q j The exponent k of the power of 2 ji is greater than 0 and less than or equal to m j The integer (m j ≥k j1 >…k ji >k j(n-1) >k jn =0), m j Q j The bit width, coefficient a i The value of is +1 or -1.

[0023] In one possible implementation, when the first device performs homomorphic encryption based on the ciphertext modulus, it includes: based on the ciphertext modulus, performing homomorphic encryption on the second ciphertext component of the initial input ciphertext to obtain a first ciphertext; the first ciphertext is an RLWE ciphertext; wherein the initial input ciphertext includes a first ciphertext component and a second ciphertext component, and the first ciphertext component includes N items; N is an integer greater than 1; and then blindly rotating the first ciphertext based on the optimized number theoretic transformation NTT processing and decomposition method to obtain a second ciphertext.

[0024] For example, the initial input ciphertext is represented as The second ciphertext component of the initial input ciphertext is represented as -b. The first ciphertext is represented as The second ciphertext is expressed as

[0025] In the embodiment of the present application, the first device performs blind rotation processing on the first ciphertext based on the optimized number theoretic transformation NTT processing and decomposition algorithm to obtain the second ciphertext, which may include but is not limited to the following implementation methods:

[0026] Implementation method 1: The first device iteratively performs N blind rotator operations based on an optimized number theoretic transform (NTT) processing and decomposition method and a first ciphertext to obtain a second ciphertext; N is an integer greater than 1; each blind rotator operation is performed based on the result or output ciphertext of the previous blind rotator operation;

[0027] Among them, the i-th blind rotation sub-operation is performed, i∈[1,N]; the i-th blind rotation sub-operation is combined with the i-th item a of the first ciphertext component of the initial input ciphertext iand the i-th key component s of the initial input ciphertext i Associated or corresponding terms may include the following:

[0028] First, the current ciphertext is decomposed by the decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts correspond to d different prime numbers one by one; among them, the jth third ciphertext contains the modulus Q j The decomposed ciphertext components and other modulus Q k The decomposed ciphertext component, Q k ≠Q j , j, k∈[1,d]; the current ciphertext is the initial input ciphertext (i.e., the first ciphertext) or the output ciphertext of the last blind rotation operation;

[0029] Then, the d third ciphertexts are used as initial values ​​of the d accumulators; the optimized number theoretic transformation NTT is performed on the initial values ​​of the d accumulators respectively to obtain the conversion values ​​of the d accumulators; the optimized number theoretic transformation NTT includes a modulo operation, and the modulo operation may include a shift process and / or a logical operation process; wherein, in the modulo operation included in the NTT process of the initial value of the j-th accumulator, the number of bits moved in the shift process is the same as the corresponding j-th prime modulus Q j The number of times this logic operation is processed is related to the exponential of the n powers of 2 in the equation. The number of times this logic operation is processed is related to the j-th prime modulus Q. j The value of the power of 2 is related to the number of terms n;

[0030] Secondly, based on the conversion values ​​of the d accumulators, corresponding outer product and accumulation processing are performed respectively to obtain the outer product values ​​of the d accumulators;

[0031] Further, INTT processing is performed on the outer product values ​​of the d accumulators respectively to obtain the updated values ​​of the d accumulations;

[0032] Then, the updated values ​​of the d accumulators are processed using the inverse transformation of the decomposition method to obtain the output ciphertext; the output ciphertext is used for the next blind rotation operation.

[0033] After performing the above-mentioned blind rotation sub-operation N times, the output ciphertext of the last blind rotation sub-operation is used as the second ciphertext.

[0034] Exemplarily, for the above-mentioned implementation method 1: the first device iteratively performs N blind rotation sub-operations based on the optimized number theoretic transformation NTT processing and decomposition method and the first ciphertext to obtain the second ciphertext, including the following steps:

[0035] Step 1: Decompose the first ciphertext using a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts are equal to the d prime numbers. The jth third ciphertext contains the modulus Qj The decomposed ciphertext components and other modulus Q k The decomposed ciphertext component, Q k ≠Q j , j,k∈[1,d] (j,k are integers, and the value range of j,k is 1 to d, including 1 and d).

[0036] Exemplarily, the above decomposition method may be RNS decomposition, digital decomposition, gadget decomposition, or the like.

[0037] Step 2: Perform optimized number theoretic transformation (NTT) on the d third ciphertexts to obtain d transformed fourth ciphertexts.

[0038] In the embodiment of the present application, the optimized number theory transformation NTT processing includes a modulo operation, which may include a shift process and / or a logical operation process; wherein, in the modulo operation included in the NTT processing of the j-th third ciphertext, the number of bits moved in the shift process is the same as the corresponding j-th prime modulus Q j The number of logical operations is related to the exponential of the n powers of 2, and the number of logical operations is related to the j-th prime modulus Q. j The value of n is related to the number of powers of 2.

[0039] Step 3: Based on the d transformed fourth ciphertexts, perform corresponding outer product and accumulation processing to obtain d fifth ciphertexts.

[0040] In one possible implementation, the first device obtains d first bootstrap keys, each of which satisfies the RGSW ciphertext form; the d first bootstrap keys are key components corresponding to the d bootstrap keys, and the moduli of the d bootstrap ciphertexts are equal to d different prime numbers. When executing step three, the process may include performing outer product and accumulation processing based on the d converted fourth ciphertexts and the d first bootstrap keys to obtain d fifth ciphertexts.

[0041] Step 4: Perform inverse number theoretic transformation INTT on the d fifth ciphertexts respectively to obtain d sixth ciphertexts.

[0042] Step 5: Process the d sixth ciphertexts by the inverse transformation of the decomposition method (such as ICRT) to obtain the seventh ciphertext.

[0043] The above steps 1 to 5 can be regarded as the process of a blind rotation operation (which can be called the i=1 blind rotation operation). If the initial input ciphertext is represented by c, The i-th blind rotation sub-operation and the i-th item a of the first ciphertext component a of the initial input ciphertext i and the i-th key component s of the initial input ciphertext i Related or corresponding.

[0044] Step 6: Use the seventh ciphertext as the new input ciphertext for step 1 of the next blind rotator operation (equivalent to the first ciphertext); iterate steps 1 to 5 above N-1 times, where N is an integer greater than 1. Use the seventh ciphertext obtained in step 5 of the last blind rotator operation (which can be called the i=Nth blind rotator operation) as the second ciphertext.

[0045] Implementation method 2: The first device decomposes the current first ciphertext using a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts correspond to d different prime numbers one by one; wherein the jth third ciphertext contains the modulus Q j The decomposed ciphertext components and other modulus Q k The decomposed ciphertext component, Q k ≠Q j , j, k∈[1,d]; then, optimized NTT processing is performed on the d third ciphertexts respectively to obtain d fourth ciphertexts; secondly, the d fourth ciphertexts are used as initial values ​​of d accumulators; based on the initial values ​​of the d accumulators, N-1 CMUX gate processing and ciphertext combination processing are performed to obtain updated values ​​of the d accumulators; N is an integer greater than 1; each CMUX gate processing and ciphertext combination processing is performed based on the result or output ciphertext of the previous CMUX gate processing and ciphertext combination processing; further, a CMUX gate processing and inverse number theory transformation INTT processing are performed on the updated values ​​of the d accumulators respectively to obtain d target ciphertexts; finally, based on the d target ciphertexts, the second ciphertext is obtained by the inverse method of the decomposition method.

[0046] In one possible implementation, the first device performs N-1 CMUX gate processing and ciphertext combination processing based on the initial values ​​of the d accumulators to obtain updated values ​​of the d accumulators, including:

[0047] Perform the i-th CMUX gate processing and ciphertext combination processing, the i-th CMUX gate processing and ciphertext combination processing and the i-th item a of the first ciphertext component of the initial input ciphertext i and the i-th key component s of the initial input ciphertext i The associated or corresponding, i∈[1,N-1], can include the following:

[0048] First, based on the current initial values ​​of the d accumulators, corresponding outer product and accumulation processing are performed respectively to obtain the outer product values ​​of the d accumulators.

[0049] Then, based on the outer product values ​​of the current d accumulators, d combined ciphertexts are determined; wherein based on the outer product value of the j-th accumulator (any one of the d accumulators), the j-th combined ciphertext is determined, including: rearranging and combining the outer product value of the j-th accumulator and the ciphertext component of the k-th accumulator to obtain the j-th combined ciphertext, the ciphertext component of the k-th accumulator being modulo Q based on the outer product value of the k-th accumulator k INTT and modulus Q j The d combined ciphertexts are obtained after NTT processing, k≠j; the d combined ciphertexts are used for the next CMUX gate processing and ciphertext combination processing.

[0050] For example, for the above-mentioned implementation method 2, the first device performs blind rotation processing on the first ciphertext based on the optimized NTT processing and decomposition algorithm to obtain the second ciphertext, which may include the following steps:

[0051] Step 1: The first device decomposes the first ciphertext using a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts correspond to d different prime numbers. The jth third ciphertext contains the modulus Q j The decomposed ciphertext components and the non-Q j Other modules Q k ≠Q j The decomposed ciphertext components; j, k∈[1,d] (j and k are integers, and the values ​​of j and k range from 1 to d and include 1 and d).

[0052] Step 2: The first device performs optimized number theoretic transformation (NTT) on the d third ciphertexts to obtain d transformed fourth ciphertexts.

[0053] In the embodiment of the present application, the optimized number theory transformation NTT processing includes a modulo operation, which may include a shift process and / or a logical operation process; wherein, in the modulo operation included in the NTT processing of the j-th third ciphertext, the number of bits moved in the shift process is the same as the corresponding j-th prime modulus Q j The number of logical operations is related to the exponential of the n powers of 2, and the number of logical operations is related to the j-th prime modulus Q. j The value of n is related to the number of powers of 2.

[0054] Step 3: The first device performs corresponding outer product and accumulation processing based on the d converted fourth ciphertexts to obtain d fifth ciphertexts (equivalent to the outer product values ​​of the d accumulators mentioned above).

[0055] In one possible implementation, the first device obtains d first bootstrap keys, each of which satisfies the RGSW ciphertext form; the d first bootstrap keys are key components corresponding to the d bootstrap keys, and the moduli of the d bootstrap ciphertexts are equal to d different prime numbers. When executing step three, the process may include performing outer product and accumulation processing based on the d converted fourth ciphertexts and the d first bootstrap keys to obtain d fifth ciphertexts.

[0056] Step 4: The first device obtains corresponding d sixth ciphertexts (equivalent to the d combined ciphertexts) based on the d fifth ciphertexts (equivalent to the outer product values ​​of the d accumulators).

[0057] In one possible implementation, in step 4, for the jth fifth ciphertext, obtaining the corresponding jth sixth ciphertext may include: executing the modulus Q based on the kth (k≠j) fifth ciphertext k INTT and modulus Q j The NTT calculation is performed to obtain the corresponding first ciphertext component; the j-th fifth ciphertext and the first ciphertext component are then rearranged and combined to obtain the j-th sixth ciphertext.

[0058] Furthermore, the d sixth ciphertexts are used as new input ciphertexts (equivalent to the fourth ciphertext in step 3); steps 3 to 4 are iterated N-2 times to obtain updated values ​​of d accumulators; N is an integer greater than 1.

[0059] Step 5: Perform a CMUX gate process and an inverse number theory transform INTT process on the updated values ​​of the d accumulators respectively to obtain d target ciphertexts;

[0060] Step 6: The first device obtains the second ciphertext based on the d target ciphertexts through the inverse transformation of the decomposition method (such as ICRT).

[0061] Compared with the above implementation method 1, in the implementation method 2, the sixth ciphertext is not obtained by performing a complete decomposition operation, but the modulus in step 3 is Q j The fifth ciphertext is directly stored and rearranged with the first ciphertext components corresponding to the other moduli to obtain the corresponding sixth ciphertext. Therefore, for d sixth ciphertexts, a total of d*2 NTT or INTT calculations can be saved. In the process of obtaining the first ciphertext components, a single combined function can also be used to implement two or more consecutive NTT or INTT transformations.

[0062] In a third aspect, the present application also provides a data processing device, which has the function of implementing the above-mentioned first aspect. For example, the data processing device includes modules or units or means corresponding to executing the operations involved in the above-mentioned first aspect. The modules or units or means can be implemented through software, or through hardware, or the corresponding software can be implemented through hardware.

[0063] In one possible design, the data processing device includes a communication unit and a processing unit. The communication unit can be used to send and receive data and / or information to implement communication between the data processing device and other devices; the processing unit can be used to perform certain internal operations of the communication device. The functions performed by the processing unit and the communication unit can correspond to the operations described in the first aspect above.

[0064] In a fourth aspect, the present application also provides a data processing device, which has the function of implementing the above-mentioned first aspect. For example, the data processing device includes a module or unit or means corresponding to the operation involved in the above-mentioned second aspect. The module or unit or means can be implemented by software, or by hardware, or the corresponding software can be implemented by hardware.

[0065] In one possible design, the data processing device includes a communication unit and a processing unit. The communication unit can be used to send and receive data and / or information to enable communication between the data processing device and other devices; the processing unit can be used to perform certain internal operations of the communication device. The functions performed by the processing unit and the communication unit can correspond to the operations described in the second aspect above.

[0066] In a fifth aspect, an embodiment of the present application provides a data processing device, which includes: at least one processor and a communication interface; wherein the communication interface is used to communicate with other devices; the processor is used to run a set of programs so that the data processing device implements the method provided by the above-mentioned first aspect or any possible implementation method thereof.

[0067] In the sixth aspect, an embodiment of the present application provides a data processing device, which includes: at least one processor and a communication interface; wherein the communication interface is used to communicate with other devices; the processor is used to run a set of programs so that the data processing device implements the method provided in the above-mentioned second aspect or any possible implementation method thereof.

[0068] In the seventh aspect, the present application provides a computer-readable storage medium, which stores computer-readable instructions. When a computer reads and executes the computer-readable instructions, the computer executes the method provided in the above-mentioned first aspect or any possible implementation method thereof, or the computer executes the method provided in the above-mentioned second aspect or any possible implementation method thereof.

[0069] In an eighth aspect, the present application provides a computer program product. When a computer reads and executes the computer program product, it enables the computer to execute the method provided in the above-mentioned first aspect or any possible implementation method thereof, or enables the computer to execute the method provided in the above-mentioned first aspect or any possible implementation method thereof.

[0070] In a ninth aspect, the present application provides a chip, comprising a processor, wherein the processor is coupled to a memory and is configured to read and execute a software program stored in the memory to implement the method provided in the first aspect or any possible implementation thereof, or to implement the method provided in the second aspect or any possible implementation thereof.

[0071] In a possible implementation, the chip may include the memory. Optionally, the processor and the memory may be integrated together.

[0072] In a possible implementation, the memory may be a memory outside the chip.

[0073] In the tenth aspect, the present application provides a communication system, which includes at least one of a homomorphic encryption party, a homomorphic computing party, and a homomorphic decryption party; the homomorphic encryption party or the homomorphic computing party or the homomorphic decryption party is used to execute the method provided by the above-mentioned first aspect or any possible implementation method thereof, or the homomorphic encryption party or the homomorphic computing party or the homomorphic decryption party is used to execute the method provided by the above-mentioned second aspect or any possible implementation method thereof.

[0074] It should be noted that the technical effects that can be achieved by any possible implementation method of the above-mentioned third to tenth aspects or the third to tenth aspects can be correspondingly described with reference to the technical effects that can be achieved by any possible implementation method of the above-mentioned first to second aspects or the first and second aspects; they will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 is a schematic diagram of the plaintext and ciphertext forms corresponding to LWE, RLWE, and RGSW;

[0076] FIG2A is a schematic diagram of a sample extraction algorithm flow;

[0077] FIG2B is a schematic diagram of a structure of sample extraction;

[0078] FIG3A is a schematic diagram of a key generation process of a homomorphic key generator;

[0079] FIG3B is a schematic diagram of a homomorphic encryption method performing an encryption process;

[0080] FIG3C is a schematic diagram of a decryption process performed by a homomorphic decryption party;

[0081] FIG3D is a schematic diagram of a homomorphic computing process performed by a homomorphic computing party;

[0082] FIG3E is a schematic diagram of homomorphic encryption;

[0083] FIG3F is a schematic diagram of a bootstrapping process;

[0084] FIG4A is a schematic diagram of the structure of a function bootstrap;

[0085] FIG4B is a schematic diagram of the entire blind rotation process;

[0086] FIG4C is a schematic diagram of a GINX blind rotation process in the form of CMux Gate;

[0087] FIG4D is a schematic diagram of a GINX blind rotation algorithm based on gadget decomposition;

[0088] FIG4E is a schematic diagram of a TFHE function bootstrapping algorithm process;

[0089] FIG4F is a schematic diagram of a Montgomery modulo algorithm;

[0090] FIG5 is a schematic diagram of a communication system architecture to which the method according to an embodiment of the present application can be applied;

[0091] FIG6A is a schematic diagram of a flow chart of a data processing method provided in an embodiment of the present application;

[0092] FIG6B is a flow chart of another data processing method provided in an embodiment of the present application;

[0093] FIG7A is a schematic diagram of a flow chart of an MV-FBS algorithm without sample extraction provided in an embodiment of the present application;

[0094] FIG7B is a schematic diagram of a flow chart of an MV-FBS algorithm without sample extraction provided in an embodiment of the present application;

[0095] FIG8A is a schematic diagram of a bootstrapping judgment process for fully homomorphic encryption provided in an embodiment of the present application;

[0096] FIG8B is a schematic diagram of a judgment process of fully homomorphic encryption provided in an embodiment of the present application;

[0097] FIG8C is a schematic diagram of a GINX blind rotation algorithm based on RNS decomposition provided in an embodiment of the present application;

[0098] FIG8D is a schematic diagram of a direct RNS decomposition and blind rotation process provided in an embodiment of the present application;

[0099] FIG8E is a schematic diagram of an RNS decomposition and blind rotation process that can save NTT and INTT, provided in an embodiment of the present application;

[0100] FIG9 is a schematic diagram of a homomorphic computing scenario to which the method according to an embodiment of the present application can be applied;

[0101] FIG10 is a schematic structural diagram of a data processing device provided in an embodiment of the present application;

[0102] FIG11 is a schematic structural diagram of another data processing device provided in an embodiment of the present application;

[0103] FIG12 is a schematic diagram of the device structure of a chip provided in an embodiment of the present application. DETAILED DESCRIPTION

[0104] The technical solutions in the embodiments of the present application will be described clearly and completely below in conjunction with the drawings in the embodiments of the present application. The terms used in the following embodiments are only for the purpose of describing specific embodiments and are not intended to be limiting of the present application. As used in the specification and appended claims of the present application, the singular expressions "one", "a kind of", "said", "above", "the" and "this" are intended to also include expressions such as "one or more", unless there is a clear contrary indication in the context. It should also be understood that in the embodiments of the present application, "one or more" refers to one, two or more; "and / or" describes the association relationship of associated objects, indicating that three relationships may exist; for example, A and / or B can represent: the existence of A alone, the existence of A and B at the same time, and the existence of B alone, where A and B can be singular or plural. The character " / " generally indicates that the related objects before and after are in an "or" relationship.

[0105] The terms "including," "comprising," "having," and their variations in the embodiments of this application all mean "including but not limited to," unless otherwise specifically emphasized. Words such as "exemplary" or "for example" are used to indicate examples, illustrations, or descriptions. Any embodiment or design described as "exemplary" or "for example" should not be construed as being preferred or advantageous over other embodiments or designs. The use of words such as "exemplary" or "for example" is intended to present related concepts in a concrete manner for easier understanding.

[0106] The "multiple" involved in the embodiments of the present application means greater than or equal to two. It should be noted that in the description of the embodiments of the present application, the words "first" and "second" are only used for the purpose of distinguishing the description and cannot be understood as indicating or implying relative importance or order.

[0107] This application provides a data processing method. To better understand the embodiments of this application, the following first explains the symbols, algorithms, and related technical features involved in the embodiments of this application. It should be noted that these explanations are intended to make the embodiments of this application easier to understand and should not be regarded as limiting the scope of protection claimed by this application.

[0108] 1. Description of symbols in the embodiments of this application:

[0109] Vector: Lowercase bold letters denote vectors. For example, a vector a with n elements is described as a = (a1, ..., a n ).<a,b> is the inner product between two vectors.

[0110] Matrix: Indicated by uppercase bold letters.

[0111] Represents a set of integers.

[0112] Represents the set of real numbers. Represents the binary set {0,1}.

[0113] Indicates a ring in The range is is the ciphertext modulus q.

[0114] r represents a real number,

[0115] symbol They are respectively expressed as: floor, ceiling, and round functions.

[0116] represents a 2N-th cyclotomic ring, modulo X N +1 integer polynomial where N is a power of 2.

[0117] The coefficient is The quotient ring on the

[0118] express Polynomials with binary coefficients in .

[0119] Real torus is the set of real numbers modulo 1.

[0120] is a torus polynomial, that is Where N is a power of 2.

[0121] Polynomial The coefficient vector can be expressed as φ(m)=(m0,...,m N-1 ).

[0122] x←D: represents sampling x according to distribution D.

[0123] random variable Var(a) represents the variance of a, and stddev(a) represents the standard deviation of a.

[0124] vector Indicates that the 2-norm of the polynomial is calculated using the coefficient vector.

[0125] Semicolon: Indicates the vertical concatenation of vectors or matrices, such as [A; B].

[0126] II. Description of the algorithms involved in the implementation of this application:

[0127] 1. Decomposition technology:

[0128] Gadget decomposition includes various methods, including digit decomposition and residue number system (RNS) decomposition. Digit decomposition uses a basis to break down a large number into multiple independent smaller numbers. RNS decomposition uses the Chinese remainder theorem (CRT) to decompose the large modulus of a polynomial into a set of coprime integer moduli.

[0129] The following describes several decomposition techniques involved in the embodiments of this application:

[0130] RNS decomposition (RNSDecomposition) technology:

[0131] RNS decomposition is a common technique used in FHE to decompose multi-precision integers. Q When the length of the modulus Q in the ring exceeds 64 bits, arithmetic operations on this ring cannot be performed using the native types of most CPUs. To solve this problem, the RNS decomposition technique can be used to decompose the modulus Q into several relatively prime small integers Q1,...,Q d , where each Q i Can be stored using 32-bit or 64-bit native integer types.

[0132] RNS is often used in conjunction with NTT to improve computational efficiency. Since NTT is essentially CRT, this method of storing NTT in RNS format is called Double CRT.

[0133] For a polynomial a(x)∈R Q , the coefficient vector of the resulting polynomial after RNS decomposition is:

[0134] Among them, a i (x) = a(x)(mod Q i ); coefficient vector a i =(a i,0 ,a i,1 ,···,a i,N-1 ), its NTT form is expressed as Therefore, for two polynomials a(x),b(x)∈R Q , the multiplication calculation using RNS decomposition can be expressed as:

[0135] For the decomposed and calculated results, the inverse CRT can be used to recover them to obtain R Q For example, the gadget vector is: where Q′ i =Q / Q i ,

[0136] Digital decomposition technology:

[0137] Digital decomposition is often used to decompose ciphertext in FHE to control the noise in homomorphic multiplication. In digital decomposition technology, we need to pay attention to three positive integers, namely the ciphertext modulus Q, the decomposition basis B, and the number of decomposition blocks. Let g represent the d-dimensional column vector g=(B 0 ,B 1 ,····,B d-1 ) T .

[0138] Given an integer a∈Z Q , decomposition function g -1 A can be decomposed into Z B The decomposition function g with base B as the base -1 or h -1 , decomposition function g -1 or h -1 Divide the ciphertext by the decomposition basis one by one. -1 For example, by decomposing the function g -1 The decomposition a satisfies the following formula (1):

[0139] The expansion function h or g is to multiply the ciphertext by the basis successively. Taking g as an example, the decomposition of a by the expansion function g satisfies the following formula (2):

[0140] g -1 (a) and g(a) satisfy <g -1 (a),g>=a(mod Q).

[0141] Apply the decomposition function g to each coefficient -1 Similarly, the decomposition of integers can be extended to the decomposition of polynomials. For example, for a polynomial a(x)∈R Q , the decomposition function satisfies the following formula (3):

[0142] Among them, a i is the i-th coefficient of a(x); is the rounding symbol, ∑ is the summation symbol, and mod is the modulus operator symbol. Then, the decomposition function g -1 R Q A polynomial in R is decomposed into B Similarly, we can use g -1 (a(x))·g=a(x) to recover the polynomial.

[0143] This decomposition can be used for an RLWE ciphertext <g -1 (a),g(b)>≡a·b mod Q.

[0144] Let I2 be the 2×2 identity matrix, represents tensor product. It is a gadget matrix that can be used to decompose numbers based on B to ensure the recovery of the ciphertext after multiplication. The decomposition function is formula (4):

[0145] It satisfies g -1 (a,b)·G=(a,b). For the ciphertext ct in matrix form, it can be decomposed by row. Therefore, for Its decomposition function

[0146] In the outer product operation of the current technology, a homomorphic message ciphertext (such as RLWE ciphertext) is decomposed into small values ​​through gadget, that is, g -1 (), similarly, the expression structure of the bootstrap key in the RGSW ciphertext form also corresponds to the use of the gadget expansion function g(), so that g() and g can be combined in the outer product calculation process. -1 () can be eliminated, which does not affect the correctness of the calculation results and can reduce noise.

[0147] Approximate gadget decomposition technique:

[0148] Approximate gadget decomposition requires the introduction of an approximate factor P, which satisfies the relationship Specifically, given a module Q of length l-bit, we can choose to satisfy l = log2P + d g log2 B g The approximate factor P (approximate factor) and the decomposition basis B g (decomposition base). The number of decomposition blocks is Accordingly, the gadget vector is For a polynomial a∈R Q , its decomposition function can be recorded as Satisfies the following formula (5):

[0149] Therefore, a polynomial a∈R can be decomposed into Q Get d g polynomials This decomposition technique can minimize the decomposition error

[0150] For example, when using approximate gadget decomposition in the outer product between RLWE and RGSW ciphertexts, the gadget matrix G P It can be expressed as The ciphertext of message m in RGSW form is: Among them, ct i ∈RLWE sk,Q (0) is from R Q Random sampling with noise term e′ i RLWE ciphertext. RLWE ciphertext ct=(a,b)∈RLWE sk,Q (μ) and RGSW ciphertext CT∈RGSW sk,Q The outer product between (m) using the approximate gadget decomposition is the following formula (6):

[0151] Among them, ε is satisfied The approximation factor of , and the plaintext message m∈{0,1}. The term ct′ i is the i-th result of the approximate decomposition on the RLWE ciphertext ct, e′ i is the error term in the RGSW ciphertext, e ct is the error term in the RLWE ciphertext. Therefore, the error generated by using the outer product of the approximate gadget decomposition is

[0152] 2. Homomorphic encryption of different ciphertext forms (ciphertext types):

[0153] There are usually multiple forms (types) of ciphertext, such as ciphertext in the form of learning with errors (LWE), torus version of the learning with errors (TLWE), ciphertext in the form of ring learning with errors assumption (RLWE), torus version of the ring-LWE problem (TRLWE), ciphertext in the form of ring GSW (Ring version of Gentry Sahai Water's, RGSW), and torus version of RGSW TRGSW. In an embodiment of the present application, these ciphertext forms can be converted to each other to cope with different computing tasks. The following describes the aforementioned ciphertext forms accordingly.

[0154] (1)LWE:

[0155] An LWE sample is represented as a vector b=<a,s> +e mod q; where the secret key s is an n-dimensional vector that can be sampled from a key distribution χ (e.g., a Gaussian distribution); is a uniformly random n-dimensional vector from The error (which can be equivalent to noise) e←χ δ Sampling from an error distribution (e.g., Gaussian distribution). The positive integers n and q represent the vector dimension and the ciphertext modulus, respectively.

[0156] For example, the LWE ciphertext of message m can be expressed as △ = q / t, where t is the plaintext modulus. The dimensions of b, m, and e are all 1.

[0157] (2)TLWE:

[0158] The TLWE ciphertext is the Torus version of LWE and can be expressed as Specifically, b=<a,s> +m+e, where vector a is from uniformly sampled from B, the key s is n uniform sampling, is the plaintext message, and the error e is sampled from a Gaussian distribution with mean 0 and standard deviation σ.

[0159] (3)RLWE:

[0160] RLWE is R QA valid RLWE sample can be represented as a pair of Among them, the secret key s of the RLWE sample is sampled from the key distribution χ (such as Gaussian distribution), and a is in R Q Uniformly random, error is sampled from the error distribution. Then (a, b) is equivalent to the RLWE ciphertext of message 0. To simplify the description, the polynomial dimension N of RLWE is generally ignored.

[0161] Similar to the LWE sample, the RLWE ciphertext of message m can be expressed as Where △ = Q / t, t is the plaintext modulus.

[0162] The encryption of LWE and RLWE corresponds to the following two formulas (7) and (8):

[0163] The decryption of LWE and RLWE corresponds to the following two formulas (9) and (10):

[0164] (4)TRLWE:

[0165] The TRLWE ciphertext is the Torus version of RLWE and can be expressed as Specifically, b=<a,s> +m+e; where a is from uniformly sampled from uniform sampling, is the plaintext message polynomial; the error is a polynomial with random coefficients, Sample from a Gaussian distribution with mean 0 and standard deviation σ.

[0166] (5)RGSW (can also be expressed as RLWE'):

[0167] An RGSW sample is a vector based on d RLWE samples and can be expressed as Given a gadget vector v=(v0,v1,...,v d-1 ), RLWE' represents the concept of gadget RLWE, which can be defined as the following formula (11):

[0168] RLWE′ sk (m) = (RLWE sk (v0·m),RLWE sk (v1·m),...,RLWE sk (vd-1 ·m)); (11)

[0169] sk is the key, then the message m∈R q The RGSW ciphertext can be expressed as the following formula (12):

[0170] RGSW sk (m) = (RLWE′ sk (sk·m),RLWE′ sk (m)); (12)

[0171] Among them, the parameters of the same dimension and ciphertext modulus are omitted here.

[0172] (6)TRGSW:

[0173] TRGSW is a torus version of RGSW that can convert plaintext messages Encrypted to ciphertext in, It is a matrix, each row of the matrix Z is the TRLWE ciphertext of the plaintext message 0 under the same key; h -1 is the gadget decomposition matrix, which is used to control noise propagation.

[0174] Assume k = 1, TRGSW ciphertext It can be further expressed as the following formula (13):

[0175] Among them, (a i (x),b i (x)), is the TRLWE ciphertext of plaintext message 0 encrypted with the same key, B g represents the basis of gadget decomposition, is the length of the gadget decomposition.

[0176] The different plaintext and ciphertext forms corresponding to the above-mentioned LWE, RLWE, and RGSW are shown in FIG1 .

[0177] 3. Products:

[0178] (1) Gadget decomposition product (Gadget Product):

[0179] The gadget product is R×RLWE′→RLWE, which is defined as follows:

[0180] Where t∈R, (t0,t1,...,t l-1) is the gadget decomposition of t based on the gadget decomposition vector v, that is, ∑ i v i t i = t. B = max{t i} is the gadget decomposition basis, l is the gadget decomposition length. The noise variance of the gadget product result is is the noise variance of the input RLWE' ciphertext, and N is the polynomial dimension.

[0181] (2) External Product:

[0182] Enter the RLWE ciphertext: RLWE sk (m1)=(a,b),RGSW sk (m2) = (RLWE′ sk (sk·m2),RLWE′ sk (m2)).

[0183] The result of the external product operation between the RGSW ciphertext and the RLWE ciphertext is the RLWE ciphertext, which is shown in the following formula (15):

[0184] RLWE sk (m1)⊙RGSW sk (m2)=(a,b)⊙(RLWE′ sk (sk·m2),RLWE′ sk (m2))=a⊙RLWE′ sk (sk·m2)+b⊙RLWE′ sk (m2) = RLWE sk (a·sk·m2+b·m2)=RLWE sk ((a·sk+b)·m2)=RLWE sk (m 1· m2+e1·m2); (15)

[0185] If m2 has a small norm, such as binary, then the noise term e1·m2 will be small enough. Thus, the output of the outer product is the RLWE encryption of the message m1·m2, and its noise variance is upper bounded by in, represents the noise variance of the gadget product result of the input RGSW ciphertext, represents the noise variance of the input RLWE ciphertext.

[0186] (3) Outer product in blind rotation:

[0187] The homomorphic ciphertext in RLWE form can be expressed as: μ1 can identify homomorphically encrypted messages. Perform gadget decomposition on RLWE(μ1) and split the decomposed polynomial into l parts (e.g., l is 3), which can be expressed as

[0188] Homomorphic ciphertext in RGSW form can be expressed as: That is, 2l RLWE-form ciphertexts and 1 gadget matrix, μ2 can be identified as the homomorphic decryption key.

[0189] The outer product in blind rotation can be expressed as the following formula (16):

[0190] In the above formula (12), s is a part of the homomorphic decryption key in the homomorphic ciphertext in RGSW form, (A,A·s) is the homomorphic encryption key, which is equivalent to pk' in the bootstrapping process. is the gadget matrix, g=(B 0 ,B 1 ,...,B l-1 ), B is the decomposition basis of gadget.

[0191] 4. Sample extraction:

[0192] Through the sample extraction operation, LWE / TLWE ciphertext can be extracted from RLWE / TRLWE ciphertext.

[0193] Specifically, given a ciphertext c = (a(x), b(x)) ∈ TRLWE(m(x)), index i ∈ [0, N-1], we can extract the TLWE ciphertext (a, b) of the i-th coefficient of the message m(x) without introducing any new noise. This operation can be called sample extraction. i (c) The sample extraction algorithm inputs a RLWE ciphertext c = (a, b) ∈ RLWE sk,q (m) and given position i, can output or return an LWE ciphertext LWE sk,q (m i ), where m i is the i-th coefficient of m.

[0194] For example, SampleExtract0(c) is This can be easily proved by decrypting TRLWE. Referring to FIG2A , it shows a sample extraction algorithm flow; FIG2B shows a schematic diagram of the process of extracting samples based on RLWE to obtain LWE.

[0195] 5. Modulus switching:

[0196] Mode switching technology can change the mode of ciphertext. As input, the mode switching algorithm outputs the ciphertext as follows (17):

[0197] The noise variance satisfies:

[0198] 3. Related technologies involved in the embodiments of this application:

[0199] 1. Homomorphic encryption (HE):

[0200] Homomorphic encryption (or fully homomorphic encryption (FHE)) aims to perform computations on ciphertext without exposing the plaintext data. It focuses on privacy-preserving computing, a technology that enables data value mining while maintaining privacy. Homomorphic encryption builds on basic encryption by adding homomorphic computation capabilities over ciphertext. It allows computations to be performed directly on encrypted ciphertext, and the decrypted result is consistent with the plaintext result. Fully homomorphic encryption can be either asymmetric public-key or symmetric, as long as the ciphertext has a certain algebraic structure.

[0201] Homomorphic encryption can be categorized as single homomorphic encryption, partially homomorphic encryption, and fully homomorphic encryption. Single homomorphic encryption only supports homomorphic addition or homomorphic multiplication. Partially homomorphic encryption supports a finite number of arbitrary homomorphic operations, where a homomorphic operation can be either homomorphic addition or homomorphic multiplication. Fully homomorphic encryption supports an unlimited number of arbitrary homomorphic operations. Fully homomorphic encryption can be either asymmetric public key encryption or symmetric encryption, as long as the ciphertext has a certain algebraic structure.

[0202] Homomorphic encryption (HE) (HE.Keygen, HE.Enc, HE.Dec, HE.Eval) consists of four algorithms: HE.Keygen represents key generation, HE.Enc represents homomorphic encryption, HE.Dec represents homomorphic decryption, and HE.Eval represents homomorphic evaluation, also known as homomorphic computation. The following describes homomorphic encryption using asymmetric encryption schemes as an example, where n is a security parameter.

[0203] 1.1、Key generation:(pk,evk,sk)←HE.Keygen(1 n ).

[0204] As shown in FIG3A , the homomorphic key generator (HEKG) can generate the key material (such as 1 n ) is input to the key generator and outputs the public key (pk) as the homomorphic encryption key K enc , that is, K enc =pk; output the private key (secret key, sk) as the homomorphic decryption key K dec , that is, K dec =sk; output evaluation key (evk) as homomorphic evaluation key K eval , that is, K eval =evk, the homomorphic evaluation key can also be called the homomorphic computation key.

[0205] 1.2 Homomorphic Encryption: c←HE.Enc pk (m).

[0206] As shown in Figure 3B, the homomorphic encryption party (HEenc for short) can use the homomorphic encryption key K enc =pk, encrypting a single-bit plaintext message m∈{0,1} into a ciphertext c.

[0207] 1.3 Homomorphic Decryption: m←HE.Dec sk (c).

[0208] As shown in Figure 3C, the homomorphic decryption party (HEdec for short) can use the homomorphic decryption key K dec =sk, decrypt the ciphertext c and restore it to the plaintext message m∈{0,1}.

[0209] 1.4. Homomorphic evaluation (also known as homomorphic computation): c f ←HE.Eval evk (f,c1,...,c l ).

[0210] As shown in Figure 3D, based on the input ciphertext c1,...,c l and homomorphically compute the key K eval =evk, the homomorphic computation method (HEcalc, or HEeval) can perform homomorphic computation on the encrypted data. l →{0,1}, obtain the output ciphertext c of the homomorphic calculation f .

[0211] Where f represents an arithmetic circuit with addition and multiplication gates on GF(2) (GF represents a finite field, which is the abbreviation of Galois Field). The general homomorphic computation HE.Eval can be decomposed into multiple basic operators, homomorphic addition c add ←HE.Add evk (c1,c2) ​​and homomorphic multiplication c mult ←HE.Mult evk (c1,c2).

[0212] The entire homomorphic encryption scheme HE = (HE.Keygen, HE.Enc, HE.Dec, HE.Eval) is shown in Figure 3E. The ciphertext calculation result is equivalent to the plaintext calculation result after decryption. Homomorphic key generator A generates homomorphic encryption key K enc , homomorphic calculation key K eval , homomorphic decryption key K dec , needs to be distributed to the homomorphic encryption party B, the homomorphic computing party C, and the homomorphic decryption party D respectively.

[0213] In a homomorphic encryption task, there can be multiple homomorphic encryptors encrypting data from different sources, multiple homomorphic computation parties executing homomorphic computation circuits, and single-hop or multi-hop homomorphic computation parties. A homomorphic encryption task can also have multiple homomorphic decryptors, and the decryption results can be provided to multiple data users. Depending on the key deployment, the homomorphic decryptor and data user can be the same or different entities. The keys of multiple homomorphic encryptors in a homomorphic encryption task can be the same or different. Homomorphic computation keys can include a bootstrapping key (BSK) and a key switching key (KSK). The BSK can be used in the homomorphic computation decryption circuit in the ciphertext state to reduce noise. The KSK can be used to convert the ciphertext product into a new ciphertext with the same dimension as the original ciphertext after ciphertext computation, eliminating the cross terms of the corresponding keys to reduce the problem of increased ciphertext size caused by ciphertext multiplication.

[0214] 2. Ciphertext bootstrapping:

[0215] Existing fully homomorphic encryption schemes all have a common feature, which is to add a small random "noise" component e during the encryption process. Performing homomorphic calculations on ciphertexts will cause these noises to grow. When multiple ciphertexts are superimposed together for homomorphic calculations, the noise in each ciphertext will be superimposed and amplified. In particular, the noise growth caused by homomorphic multiplication may reach exponential levels, and cross terms of noise and ciphertext multiplication will appear. If relatively simple calculations are performed on the ciphertext, the superimposed noise is within a controllable range (critical value), then the ciphertext can be easily restored to plaintext through the decryption algorithm. However, if the calculations performed on the ciphertext are too complex, causing the noise to exceed the controllable range (critical value), then the original plaintext will be destroyed or even overwritten, resulting in the failure of homomorphic decryption. To solve this problem, the FHE scheme proposes the process of bootstrapping. Bootstrapping is a special processing technique for ciphertexts. After processing, a ciphertext with noise close to the critical value can be "refreshed" into a new ciphertext with very low noise. As shown in Figure 3F, a new key k2 is used to convert a high-noise ciphertext into a new ciphertext with very low noise. Re-encrypt into another fully homomorphic ciphertext And use the new key k2 to encrypt the old key k1 into ciphertext That is, the bootstrapping key (BSK), and then the homomorphic computing party calculates the corresponding homomorphic decryption circuit through homomorphic computing Decrypting the inner ciphertext back to plaintext can obtain a new low-noise FHE ciphertext under a new key.

[0216] 3. TFHE bootstrapping:

[0217] The Boolean fully homomorphic encryption (TFHE) algorithm is one of the most practical FHE schemes currently. It provides a hierarchical homomorphic computation model that can efficiently compute hierarchical circuits such as multi-input lookup tables (LUTs), bit sequence representations (BSRs), and weighted finite automata (WFAs). Because the inputs and outputs of hierarchical homomorphic computations are ciphertexts of different types (forms) and cannot be directly combined, TFHE introduces two bootstrapping operations to reduce ciphertext noise and transform its form, namely gate bootstrapping and circuit bootstrapping, to achieve homomorphic computation on circuits of arbitrary depth. Furthermore, TFHE currently has the lowest bootstrapping latency of all fully homomorphic encryption schemes, with gate bootstrapping requiring only approximately 13ms.

[0218] See Figure 4A, which shows the bootstrapping process of TFHE gate bootstrapping. See Figure 4B, which shows the architecture diagram of TFHE's hierarchical homomorphic computing mode.

[0219] The following is a corresponding introduction to the bootstrapping scheme involved in the embodiments of the present application.

[0220] 3.1 Gate bootstrapping (GBS):

[0221] Gate bootstrapping is a typical form of bootstrapping. During homomorphic computation, a bootstrapping operation is performed on each binary gate. The core of gate bootstrapping is blind rotation, which involves rotating a polynomial using a ciphertext. This can be implemented using n CMUX gates. The CMUX gates in a blind rotation can be constructed using the outer product of an RLWE ciphertext and an RGSW ciphertext.

[0222] Referring to the TFHE gate bootstrapping process shown in Figure 4A, the input to the gate bootstrapping is a homomorphically computed, high-noise (i.e., high-noise) LWE / TLWE homomorphic ciphertext c = (a, b), and its corresponding homomorphic encryption and decryption keys are (pk, sk). The output of the gate bootstrapping is a low-noise (i.e., low-noise) LWE (or TLWE) ciphertext, which reduces the noise to a relatively low range. Specific steps may include the following:

[0223] Step 1: You can first use the new homomorphic encryption key pk' to re-homomorphically encrypt b in the homomorphic ciphertext c, that is, RLWE.Enc(X -b ), denoted as the initial value of the blind rotation accumulator ACC.

[0224] Step 2: Input the initial value of ACC to the first CMUX gate, rotate a rotation component through the first CMUX gate, and obtain the ACC output by the first CMUX gate. The ACC output by the first CMUX gate is then input to the second CMUX gate to form an iteration. And so on. After n CMUX gates are iteratively updated, the result output by the nth CMUX gate is RLWE.Enc(X -b+<a,s> ).

[0225] For ease of understanding, among n CMUX gates, the calculation process of the i-th CMUX gate can be expressed as the following formula (18):

[0226] ACC=CMUX((ACC,X a[i] ACC), BK i )=ACC+(X a[i] -1) ACC⊙BK i ; (18)

[0227] Among them, X a[i]is the i-th rotation component of the blind rotator operation, i is an integer from 1 to n, and n is the polynomial dimension of a. i is the i-th RLWE pk′ and RGSW pk′ The outer product of (sk[i]). ACC is the homomorphic ciphertext in RLWE form. BK i The homomorphic ciphertext in RGSW format can be specifically the ciphertext obtained by homomorphically encrypting the original homomorphic decryption key sk using the new homomorphic encryption key pk'. It can be understood that based on the characteristics of homomorphic computing, the bootstrapped high-noise homomorphic ciphertext (b, a) is multiplied by its corresponding decryption key (1, sk), that is, the high-noise homomorphic ciphertext is homomorphically decrypted, ultimately obtaining a low-noise homomorphic ciphertext, thus achieving noise suppression.

[0228] After n CMUX gate iterative updates and sample extraction, the bootstrapped low-noise homomorphic ciphertext can be obtained, which is denoted as LWE.Enc(m).

[0229] Blind Rotation:

[0230] Blind rotation is a core component of the core bootstrapping process in FHEW and TFHE schemes. It rotates the test polynomial using an encrypted index. The blind rotation process consists of k CMUX gates. The outer product operation of the RLWE and RGSW ciphertexts can be used to construct the CMUX gates. Specifically, the following steps may be involved:

[0231] 1. Set the encrypted rotation position p, which can be expressed as: p = p0·2 0 +...+p j 2 j +...+p k 2 k ; Among them, p j For secret, 2 j is a known constant, and j is any integer from 0 to k.

[0232] 2. Rotate the encrypted polynomial M according to the encrypted rotation position p, which can be expressed as the following formula (19):

[0233] 3. Referring to the above formula (24), each term can be implemented by a CMUX gate. For example, each term can be determined by the following formula (20):

[0234] 4. See FIG4B , which shows the entire blind rotation process.

[0235] See Figure 4C, which is a schematic diagram of the main process of GINX blind rotation in the form of a CMUX gate. Given an LWE ciphertext to be homomorphically decrypted The bootstrap key is a LWE key s=(s0,····,s n-1 ) The homomorphic ciphertext after re-encryption, the bootstrap key is n RGSW ciphertexts bsk=(bsk0,····,bsk n-1 ). Blind rotation outputs a pair The encrypted RLWE ciphertext has a key of sk and a modulus of Q, where t is a test polynomial. Referring to FIG4D , this is a blind rotation algorithm based on or with GINX with gadget decomposition.

[0236] The first line sets the initial polynomial acc to the RLWE ciphertext. Lines 3 through 6 perform the outer product between the RLWE ciphertext and the bootstrap key, which computes the CMUX gate. Line 3 invokes a decomposition technique, such as the digital decomposition or RNS decomposition described above. Lines 4 and 6 invoke the NTT transform and INTT transform, which are described below. The entire blind rotation involves the computation and accumulation of CMUX gates and can be expressed as follows:

[0237] 3.2 Functional bootstrapping (FBS):

[0238] The TFHE scheme supports constructing arbitrary circuits through gate bootstrapping. This technique has been further developed into function bootstrapping (FBS), which can calculate a single-input, single-output lookup table function (LUT) while refreshing the ciphertext. Figure 4E shows the algorithm flow of function bootstrapping, which is as follows:

[0239] First define the test polynomial testP encoded by the LUT function f, and the bootstrap key as Function bootstrapping can be expressed as:

[0240] If it is a function bootstrap in a circuit bootstrap, sk i is the i-th item of the LWE key (eg, private key), that is, the key for level 0 in the circuit bootstrapping. The key for level 2.

[0241] Specifically, the homomorphic ciphertext with high noise after homomorphic calculation is c = (b, a), and its corresponding homomorphic encryption and decryption keys are (pk, sk). You can also use the new homomorphic encryption key pk' to re-homomorphically encrypt b in the homomorphic ciphertext c, that is, RLWE.Enc(X -bThe initial value of the accumulator ACC (also called acc) can be written as ACC = (0, X -b ·testP), input the initial value of ACC into the first CMUX gate, rotate a rotation component through the first CMUX gate, obtain the ACC output by the first CMUX gate, and then input the ACC output by the first CMUX gate into the second CMUX gate to form an iteration. The calculation process of the i-th CMUX gate can be shown as follows (21):

[0242] Among them, X a[i] is the i-th rotation component of the blind rotation, i∈[1,n], and n is the polynomial dimension of a. is the outer product of the i-th RLWE and RGSW. ACC is the homomorphic ciphertext in RLWE form. It is a homomorphic ciphertext in RGSW form.

[0243] After n CMUX gates are iteratively updated, and then through operations such as sample extraction, the bootstrapped low-noise homomorphic ciphertext can be obtained, which is recorded as

[0244] 4. NTT and FFT:

[0245] There are several ways to represent polynomials:

[0246] 1. Coefficient representation:

[0247] f(x)=a0+a1x+a2x 2 +...+a n-1 x n-1 , the coefficients of the polynomial can be expressed as a vector (a0, a1, ..., a n-1 ).

[0248] 2. Point value representation: If we select n different numbers x0,…,x n-1 Evaluate the polynomial and get f(x0),…,f(x n-1 ), the polynomial is expressed in point value notation as: (x i ,f(x i )), 0≤i≤n-1,

[0249] The advantage of point value representation is that for two polynomials represented by point value representation (such as (x i ,f(x i )) and (x i ,g(x i ))) multiplication (actually convolution), we can directly multiply the corresponding terms, as shown in the following formula (22):

[0250] G(x)={((x0,f(x0)·g(x0)),(x1,f(x1)·g(x1)),(x2,f(x2)·g(x2)),…,(x n-1 ,f(x n-1 )·g(x n-1 )))}; (twenty two)

[0251] The process of converting a polynomial from coefficient representation to point value representation can be achieved through discrete Fourier transform DFT, FFT, or NTT.

[0252] The process of converting a polynomial from point value representation to coefficient representation can be achieved through inverse discrete Fourier transform IDFT, IFFT, or INTT.

[0253] DFT: Given an input vector a=(a0,a1,…,a n-1 ) to the output vector A=(A0,A1,…,A n-1 ), in, The essence of DFT is to substitute n roots of unity and convert the coefficient expression into a point value expression.

[0254] FFT: FFT uses complex roots ω that satisfy periodicity, symmetry, and reducibility n The DFT expression of the polynomial f(x) can be recursively decomposed to obtain the FFT form, as shown in the following equation (23):

[0255] 4.1 Number theoretic transform (NTT):

[0256] NTT is an implementation of the discrete Fourier transform (DFT) over a finite field, making it easier to perform modular operations. NTT utilizes the CRT to decompose a polynomial ring, mapping the original ring into several rings of lower orders. To ensure the mapping is feasible, parameters are required to ensure the existence of roots to decompose the modular polynomial of the polynomial ring.

[0257] For example, the forward n-point NTT transformation A k =NTT(a) is defined as the following formula (24):

[0258] The inverse n-point NTT transform a = INTT(A) is defined by the following equation (25):

[0259] Specifically, for a polynomial ring R Q = Z Q [X] / (X N + 1), where N is a power of 2. If the modulus Q is a prime number such that Q ≡ 1 (mod 2N), then there exists a 2N-th primitive root of unity ζ ∈ Z Q . In addition, ζ also satisfies the following 3 properties:

[0260] Periodicity: ζ 0 , ζ 1 , …, ζ 2N-1 are distinct, and when i < 2N and k ∈ Z, ζ i+k*(2N) = ζ i (mod Q);

[0261] Symmetry: When i < N, ζ i+N = -ζ i (mod Q);

[0262] Reducibility: When i < N, ζ 2i = ω i (mod Q), where ω is an N-th primitive root of unity.

[0263] Therefore, the root ζ can be used to factor the polynomial X N+1 into multiple linear polynomials X - ζ i , where i = 1, 3, …, 2N - 1. More specifically, using the property ζ N = -1 (mod Q), there exists a ring isomorphism φ: Subsequent calculations in R Q can be implemented separately in these two rings with dimensions not exceeding . Therefore, for a polynomial a(x) ∈ R Q , its NTT transform NTT Q (a) is to calculate

[0264] Since N is an integer that is a power of 2, the factorization of the polynomial X N+1 can be completed in log2 N levels. Specifically, the fully factored NTT corresponds to the following ring isomorphism:

[0265] Accordingly, CRT is also calculated: φ(a)=(a mod(X-ζ 1 ),a mod(X-ζ 3 ),···,a mod(X-ζ 2N-1 )).

[0266] By exploiting the symmetry of the root ζ, a product of the coefficient and the primitive root can be used twice in each level, e.g. and This form of operation is called the Cooley-Tukey butterfly (CT butterfly for short). Using the CT butterfly operation, the number of multiplications at each level can be reduced to N / 2. Therefore, the complexity of a single NTT is O(N·log2 N). The NTT of the coefficient vector a of the polynomial a(x) is the following equation (26):

[0267] The INTT of a polynomial naturally computes the inverse isomorphism φ in a similar way. -1 , the above process is iterated by using negative powers of the primitive roots, which requires the same number of multiplications at each level. Accordingly, the basic computational unit in INTT is the so-called Gentleman-Sande butterfly (GS butterfly for short). The calculation formula of the INTT vector a' satisfies the following formula (27):

[0268] Therefore, R Q The product c(x)=a(x)·b(x) can be efficiently computed INTT(NTT(a)⊙NTT(b)) by utilizing negative circular convolution, and the computational complexity is O(N·log2 N).

[0269] 4.2 Fast Fourier Transform (FFT):

[0270] FFT is a fast algorithm that uses complex numbers as roots of unity to calculate the DFT over the real field. The 2N-th unity root is ζ∈R. The 2N-th unity root ζ has the same properties as the unity root in NTT, and its calculation is the same as NTT with complex roots. Then the FFT of the coefficient vector a of the polynomial a(x) satisfies the following formula ():

[0271] FFT(a)=(a(ζ 1 ),a(ζ 3 ),···,a(ζ 2N-1 ))∈R N .

[0272] Similarly, the inverse fast Fourier transform (IFFT) of the FFT vector a′ is:

[0273] The computational complexity of calculating FFT and IFFT using butterfly transforms is O(N·log2 N).

[0274] Since FFT and NTT are used in current FHE schemes to improve computing efficiency, the different characteristics between FFT and NTT will have different impacts on computing efficiency.

[0275] The differences between NTT and FFT include the following:

[0276] (1) Computational domain: NTT uses integers to perform exact calculations on a finite field, while FFT uses floating-point numbers to perform approximate calculations on a real field.

[0277] (2) Intermediate data size: FFT can preserve the amplitude using complex roots smaller than 1, but the amplitude in NTT is irregular due to the negative convolution [GLH23].

[0278] (3) Data friendliness: In terms of implementation, NTT is more friendly to small data because the smaller the data size, the faster the implementation of integers. FFT is more friendly to large data and uses double-precision floating-point numbers to store all intermediate values.

[0279] (4) Modular Reduction: NTT requires frequent integer modulo operations to ensure correctness after multiplication, but the Barrett and Montgomery algorithms can be used to accelerate these operations. In FFT, the program itself does not require modulo operations, but modular reduction is required when mapping the results back to the polynomial ring.

[0280] NTT-based blind rotation is useful in scenarios where only prime modules can be used, such as homomorphisms and automorphisms.

[0281] In one possible implementation, NTT and FFT are applied in the bootstrapping process (blind rotation) of homomorphic encryption. From the above differences between NTT and FFT, it can be seen that the computational efficiency of NTT-based blind rotation with a prime modulus is lower than that of FFT-based blind rotation with a quadratic modulus.

[0282] 5. Montgomery modular reduction algorithm:

[0283] The Montgomery modular reduction algorithm mainly utilizes the characteristics of modular operations, which can convert modular operations into addition, subtraction and shift operations, thereby improving the execution efficiency of modular operations.

[0284] For example, referring to the Montgomery modular reduction algorithm shown in FIG4F , two coefficients x and y are input, and modular reduction is performed according to the following steps to obtain the result r:

[0285] Input: two coefficients x,y∈Z Q ;

[0286] Precomputed constant Q -1 modβ.

[0287] Output: r = x·y·β -1 mod Q, -Q <r<Q。

[0288] The specific steps include the following:

[0289] Step 1. m = lo(x·y)·Q -1 modβ

[0290] Step 2.

[0291] Step 3. r = hi(x·y) - t.

[0292] In the above, lo (abbreviation of low) means taking the low-order bit; hi (abbreviation of high) means taking the high-order bit.

[0293] In view of the relevant technologies introduced above, taking the bootstrapping process of homomorphic encryption as an example, the core part of the bootstrapping process is the blind rotation process. A blind rotation processing method based on number theoretic transform (NTT) is currently proposed to improve the efficiency of the bootstrapping process. In NTT processing, in order to improve the correctness of the data after the operation, integer modulo operations need to be performed frequently, which affects the execution efficiency of the blind rotation processing method based on NTT. Similarly, in some homomorphic processing (such as homomorphic encryption, homomorphic decryption or homomorphic computing, etc.), the efficiency of the overall processing may be affected due to the involvement of modulo operations.

[0294] Therefore, the present application provides a data processing method that can effectively improve the processing efficiency of homomorphic processing (including homomorphic encryption, homomorphic decryption, homomorphic computing, etc.). The technical solution provided in the embodiment of the present application can be applied to the fourth generation mobile communication technology (the 4th generation, 4G) system, such as the long term evolution (long term evolution, LTE) system, or can be applied to the 5G system, such as the NR system, or the next generation wireless local area network system or various future communication systems, without specific limitation.

[0295] Figure 5 shows a possible, non-limiting communication system architecture applicable to embodiments of the present application. As shown in Figure 5, communication system 5000 includes a radio access network (RAN) 100 and a core network (CN) 200. Optionally, communication system 5000 may also include the Internet 300. RAN 100 includes at least one network device (such as 110a and 110b in Figure 5, collectively referred to as 110) and at least one terminal device (such as 120a-120j in Figure 5, collectively referred to as 120). RAN 100 may also include other RAN nodes, such as wireless relay devices and / or wireless backhaul devices (not shown in Figure 5). Terminal device 120 is wirelessly connected to network device 110. Network device 110 is wirelessly or wiredly connected to core network 200. The core network device in core network 200 and network device 110 in RAN 100 may be different physical devices, or they may be the same physical device that integrates core network logical functions and radio access network logical functions.

[0296] The RAN 100 may be a cellular system related to the Third Generation Partnership Project (3GPP), such as a fourth generation (4G) or fifth generation (5G) mobile communication system, or an evolved system beyond 5G (such as a 6G mobile communication system). The RAN 100 may also be an open access network (O-RAN or ORAN), a cloud radio access network (CRAN), or a WiFi system. The RAN 100 may also be a communication system that integrates two or more of the above systems.

[0297] It will be understood that FIG5 only illustrates one possible communication system architecture that may be applied in an embodiment of the present application. In other possible scenarios, the communication system architecture may also include other devices.

[0298] The network device 110 is a node in the radio access network (RAN), which can also be called an access network device or a RAN node (or device). The network device 110 is used to help terminal devices achieve wireless access. The multiple network devices 110 in the communication system 5000 can be nodes of the same type or different types. In some scenarios, the roles of the network device 110 and the terminal device 120 are relative. For example, the network element 120i in Figure 5 can be a helicopter or a drone, which can be configured as a mobile base station. For terminal devices 120j that access the RAN 100 through the network element 120i, the network element 120i is a base station; but for the base station 110a, the network element 120i is a terminal device. The network device 110 and the terminal device 120 are sometimes referred to as communication devices. For example, the network elements 110a and 110b in Figure 5 can be understood as communication devices with base station functions, and the network elements 120a-120j can be understood as communication devices with terminal device functions.

[0299] In one possible scenario, a network device can be a base station, an evolved NodeB (eNodeB), a transmitting and receiving point (TRP), a transmitting point (TP), a next-generation NodeB (gNB), a next-generation base station in a sixth-generation (6G) mobile communication system, a base station in a future mobile communication system, a satellite, an access point (AP) in a WiFi system, an integrated access and backhaul (IAB) node, a mobile switching center, or a network device in a non-terrestrial network (NTN) communication system, i.e., it can be deployed on a high-altitude platform or satellite. The network device can be a macro base station (such as 110a in Figure 5), a micro base station or an indoor station (such as 110b in Figure 5), a relay node or a donor node, or a wireless controller in a CRAN scenario. The network device can also be a device that functions as a base station in device-to-device (D2D) communication, vehicle-to-vehicle communication, drone communication, or machine communication. Optionally, the network device may also be a server, a wearable device, a vehicle or an onboard device, etc. For example, the access network device in vehicle to everything (V2X) technology may be a road side unit (RSU).

[0300] In another possible scenario, multiple network devices collaborate to assist the terminal device in achieving wireless access, and different network devices respectively implement part of the functions of the base station. For example, the network device can be a centralized unit (CU), a distributed unit (DU), a CU-control plane (CP), a CU-user plane (UP), or a radio unit (RU). The CU and DU can be set separately, or they can also be included in the same network element, such as a baseband unit (BBU). The RU can be included in a radio frequency device or a radio frequency unit, such as a remote radio unit (RRU), an active antenna unit (AAU), or a remote radio head (RRH). It can be understood that the network device can be a CU node, a DU node, or a device including a CU node and a DU node. In addition, the CU can be divided into a network device in the access network RAN, or the CU can be divided into a network device in the core network CN, which is not limited here.

[0301] In the embodiments of the present application, the form of the network device is not limited. The device used to implement the function of the network device can be a network device; it can also be a device that can support the network device to implement the function, such as a chip system. The device can be installed in the network device or used in conjunction with the network device.

[0302] The terminal device 120, which may also be referred to as a terminal, user equipment (UE), mobile station (MS), mobile terminal (MT), etc., is a device used to provide voice or data connectivity to users, or an IoT device. For example, the terminal device includes a handheld device with wireless connection capabilities, an in-vehicle device, etc. Currently, terminal devices can include: mobile phones, tablet computers, laptop computers, PDAs, mobile internet devices (MIDs), wearable devices (such as smart watches, smart bracelets, pedometers, etc.), vehicle-mounted devices (such as cars, bicycles, electric vehicles, airplanes, ships, trains, high-speed trains, etc.), satellite terminals, virtual reality (VR) devices, augmented reality (AR) devices, smart point-of-sale (POS) machines, customer-premises equipment (CPE), wireless terminals in industrial control, smart home devices (such as refrigerators, televisions, air conditioners, electricity meters, etc.), intelligent robots, robotic arms, workshop equipment, wireless terminals in unmanned driving, wireless terminals in telemedicine, wireless terminals in smart grids, wireless terminals in transportation safety, wireless terminals in smart cities, wireless terminals in smart homes, and flying devices (such as intelligent robots, hot air balloons, drones, airplanes). Terminal devices can also be other devices with terminal functions, for example, terminal devices can also be devices that function as terminals in D2D communication.

[0303] The embodiments of this application do not limit the device form factor of the terminal device. The device used to implement the functions of the terminal device can be the terminal device; it can also be a device that supports the terminal device to implement the functions, such as a chip system. The device can be installed in the terminal device or used in conjunction with the terminal device. In the embodiments of this application, the chip system can be composed of a chip or include a chip and other discrete components.

[0304] Each network element or device in the communication system (also referred to as a communication network) shown in FIG5 may have at least one of homomorphic encryption capability, homomorphic decryption capability, and homomorphic computing capability. Therefore, in the embodiments of the present application, it is possible to consider supporting corresponding homomorphic encryption and decryption as well as homomorphic computing capabilities in the communication network.

[0305] The solution provided in the embodiments of the present application can be applied to but not limited to homomorphic encryption scenarios and homomorphic decryption scenarios as well as homomorphic computing scenarios as shown in Figure 3E.

[0306] 4. Introduction to the embodiments of this application:

[0307] The technical solution of this application is introduced below in conjunction with specific embodiments.

[0308] An embodiment of the present application provides a data processing method, which can be applied to but not limited to the communication system shown in Figure 5, and the method can be applied to but not limited to homomorphic encryption scenarios and homomorphic decryption scenarios and the homomorphic computing scenarios shown in Figure 3E. In one possible implementation, the method is applied in a homomorphic encryption scenario, and the method can be executed by a homomorphic encryption party device, or by a component (such as a module, chip, etc.) corresponding to the homomorphic encryption party device, or by a device matched with the homomorphic encryption party device. In another possible implementation, the method is applied in a homomorphic decryption scenario, and the method can be executed by a homomorphic decryption party device, or by a component (such as a module, chip, etc.) corresponding to the homomorphic decryption party device, or by a device matched with the homomorphic decryption party device. In another possible implementation, the method is applied in a homomorphic computing scenario, and the method can be executed by a homomorphic computing party device, or by a component (module, chip, etc.) of the homomorphic computing party device, or by a device matched with the homomorphic computing party. It is understandable that the present application does not specifically limit the specific structure of the execution subject of the method provided in the embodiment of the present application and the number of each execution subject. As long as it can run a program that records the code of the method provided in the embodiment of the present application and can communicate with other devices, the first device is used below to refer to the execution subject of the method for explanation. The order of steps in the following processes is only an example. In actual applications, the order of execution of the steps in each process can be adjusted. Referring to Figure 6A, the specific process of the method provided in the embodiment of the present application is as follows:

[0309] S601A: The first device determines the ciphertext modulus of homomorphic encryption, where the ciphertext modulus is a prime number obtained by multiplying and summing n different powers of 2 and coefficients, where n is an integer greater than or equal to 2 and less than or equal to 5.

[0310] In an embodiment of the present application, homomorphic processing may include but is not limited to at least one of homomorphic encryption, homomorphic decryption, and homomorphic computing.

[0311] In one possible implementation, the ciphertext modulus may satisfy the following form (or it may be understood that the ciphertext modulus and the n different powers of 2 satisfy the following relationship):

[0312] Where Q is the modulus of the ciphertext, and the first n-1 different powers of 2 are exponents k. i is an integer greater than 0 and less than or equal to m (m≥k1>...k i >k n-1 >0), the exponent k of the nth power of 2n Equal to 0(k n =0), m is the bit width of the ciphertext modulus Q, and the coefficient a i The value of is +1 or -1, and i is an integer greater than or equal to 1 and less than or equal to n.

[0313] For example, when n is 2, the ciphertext modulus satisfies the form Where k1 is an integer greater than 0 and less than or equal to m. When n is 3, the ciphertext modulus satisfies the form Wherein, k1 and k2 are both integers greater than 0 and less than or equal to m.

[0314] S602A: The first device performs homomorphic processing based on the ciphertext modulus.

[0315] In one possible implementation, homomorphic encryption, homomorphic decryption, and homomorphic calculation all include modulo operations; then the first device performs homomorphic processing based on the ciphertext modulus, which may include: performing a modulo operation based on the ciphertext modulus, and the modulo operation includes shift processing and / or logical operation processing; wherein, the number of bits moved in the shift processing is related to the exponent of the n powers of 2 in the ciphertext modulus, and the number of logical operation processing is related to the value of n.

[0316] In a possible implementation, the method may further include: the first device performs at least one number theoretic transformation NTT based on a modulo operation.

[0317] The principle of number theoretic transformation NTT can refer to the NTT in the existing related technology involved in the embodiments of this application introduced above, and will not be described in detail here.

[0318] In one possible implementation, an NTT includes M butterfly operations (or butterfly calculations); M is an integer greater than or equal to 3; then the first device performs a number theory transformation NTT based on a modulo operation, which may specifically include: performing the modulo operation once after every three butterfly operations; and using a power modulo operation algorithm to perform modulo on each multiplication result in each butterfly operation.

[0319] For example, the above-mentioned exponentiation modular operation algorithm may be the Montgomery algorithm.

[0320] In summary, an embodiment of the present application provides a data processing method, which includes: a first device determines a ciphertext modulus for homomorphic encryption; the ciphertext modulus is a prime number obtained by multiplying and adding n different powers of 2 and coefficients, where n is an integer greater than or equal to 2 and less than or equal to 5; and then performing homomorphic processing based on the ciphertext modulus, which homomorphic processing may include at least one of homomorphic encryption, homomorphic decryption, and homomorphic calculation. Typically, homomorphic encryption, homomorphic decryption, and homomorphic computing all involve modulo operations or modulo calculations, and the usual modulo operation or modulo calculation method may be to directly perform vertical division calculations to obtain the result. However, when the divisor and dividend of the modulo operation are large, it is obviously more difficult to use vertical calculations to obtain the result. To this end, the present application implements the design of a modulus, which is a prime number obtained by multiplying and adding n different powers of 2 and coefficients. Based on such a modulus, modulo operations or modulo calculations are more convenient, and the modulo efficiency is higher, thereby improving the processing efficiency of homomorphic encryption, homomorphic decryption, and homomorphic computing that include modulo operations / modulo calculations.

[0321] The embodiment of the present application also provides a data processing method, which can also be applied to but not limited to the communication system shown in Figure 5, and the method can be applied to but not limited to homomorphic encryption scenarios and homomorphic decryption scenarios and the homomorphic computing scenarios shown in Figure 3E. The execution subject of the method described in Figure 6B can refer to the content described in the execution subject of the method described in Figure 6A above, and will not be repeated here. The order of steps in the following processes is only an example. In actual applications, the order of execution of the steps in each process can be adjusted. As shown in Figure 6B, the specific process of the method provided in the embodiment of the present application is as follows:

[0322] S601B: The first device determines the ciphertext modulus of homomorphic encryption; the ciphertext modulus is a composite number obtained by multiplying d different prime numbers, where each prime number is obtained by adding up n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5, and d is an integer greater than 1.

[0323] In one possible implementation, the ciphertext modulus may satisfy the following form (or it may be understood that the ciphertext modulus and the d different prime numbers satisfy the following relationship):

[0324] Among them, Q represents the ciphertext modulus, and d represents the prime number Q obtained by multiplying the ciphertext modulus. j The number of prime numbers Q j The following forms can be met:

[0325] Prime Q j The exponent k of the power of 2 ji is greater than 0 and less than or equal to m j The integer (mj ≥k j1 >...k ji >k j(n-1) >k jn =0);m j Q j The bit width, coefficient a i The value of is +1 or -1; * is the multiplication sign.

[0326] S602B: The first device performs homomorphic processing based on the ciphertext modulus.

[0327] In an embodiment of the present application, homomorphic processing may include but is not limited to at least one of homomorphic encryption, homomorphic decryption, and homomorphic computing.

[0328] In an embodiment of the present application, if the first device performs homomorphic encryption based on the ciphertext modulus, the first device may be a homomorphic encryption party device, the first device may also be a component (such as a module, chip, etc.) corresponding to the homomorphic encryption party device, and the first device may also be a device used in conjunction with the homomorphic encryption party device. If the first device performs homomorphic decryption based on the ciphertext modulus, the first device may be a homomorphic decryption party device, the first device may also be a component (such as a module, chip, etc.) corresponding to the homomorphic decryption party device, and the first device may also be a device used in conjunction with the homomorphic decryption party device. If the first device performs homomorphic calculation (or homomorphic evaluation) based on the ciphertext modulus, the first device may be a homomorphic calculation party device, the first device may also be a component (module, chip, etc.) of the homomorphic calculation party device, and the first device may also be a device used in conjunction with the homomorphic calculation party. This application does not specifically limit the form and number of the execution subject. This article introduces the solution by referring to the execution subject as the first device.

[0329] In one possible implementation, when the first device performs homomorphic encryption based on the ciphertext modulus, it can include: based on the ciphertext modulus, performing homomorphic encryption on the information to be processed to obtain a first ciphertext; and then performing blind rotation processing on the first ciphertext based on the optimized number theoretic transformation NTT processing and decomposition method to obtain a second ciphertext.

[0330] In an embodiment of the present application, the scheme shown in Figure 6B is applied in the scenario of homomorphic encryption, then the first device can be a homomorphic encryption party device, or a component corresponding to the encryption party device (such as a module or chip, etc.), or a device used in conjunction with the homomorphic encryption party device.

[0331] In one possible implementation, when the first device performs homomorphic encryption based on the ciphertext modulus, it includes: based on the ciphertext modulus, performing homomorphic encryption on the second ciphertext component of the initial input ciphertext to obtain a first ciphertext; the first ciphertext is an RLWE ciphertext; wherein the initial input ciphertext includes a first ciphertext component and a second ciphertext component, and the first ciphertext component includes N items; N is an integer greater than 1; and then blindly rotating the first ciphertext based on the optimized number theoretic transformation NTT processing and decomposition method to obtain a second ciphertext.

[0332] For example, the initial input ciphertext is represented as The second ciphertext component of the initial input ciphertext is represented as -b. The first ciphertext is represented as The second ciphertext is expressed as

[0333] In the embodiment of the present application, the first device performs blind rotation processing on the first ciphertext based on the optimized number theoretic transformation NTT processing and decomposition algorithm to obtain the second ciphertext, which may include but is not limited to the following implementation methods:

[0334] Implementation method 1: The first device iteratively performs N blind rotator operations based on an optimized number theoretic transform (NTT) processing and decomposition method and a first ciphertext to obtain a second ciphertext; N is an integer greater than 1; each blind rotator operation is performed based on the result or output ciphertext of the previous blind rotator operation;

[0335] Among them, the i-th blind rotation sub-operation is performed, i∈[1,N]; the i-th blind rotation sub-operation is combined with the i-th item a of the first ciphertext component of the initial input ciphertext i and the i-th key component s of the initial input ciphertext i Associated or corresponding terms may include the following:

[0336] First, the current ciphertext is decomposed by the decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts correspond to d different prime numbers one by one; among them, the jth third ciphertext contains the modulus Q j The decomposed ciphertext components and other modulus Q k The decomposed ciphertext component, Q k ≠Q j , j, k∈[1,d]; the current ciphertext is the initial input ciphertext (i.e., the first ciphertext) or the output ciphertext of the last blind rotation operation;

[0337] Then, the d third ciphertexts are used as initial values ​​of the d accumulators; the optimized number theoretic transformation NTT is performed on the initial values ​​of the d accumulators respectively to obtain the conversion values ​​of the d accumulators; the optimized number theoretic transformation NTT includes a modulo operation, and the modulo operation may include a shift process and / or a logical operation process; wherein, in the modulo operation included in the NTT process of the initial value of the j-th accumulator, the number of bits moved in the shift process is the same as the corresponding j-th prime modulus Q j The number of times this logic operation is processed is related to the exponential of the n powers of 2 in the equation. The number of times this logic operation is processed is related to the j-th prime modulus Q. j The value of the power of 2 is related to the number of terms n;

[0338] Secondly, based on the conversion values ​​of the d accumulators, corresponding outer product and accumulation processing are performed respectively to obtain the outer product values ​​of the d accumulators;

[0339] Further, INTT processing is performed on the outer product values ​​of the d accumulators respectively to obtain the updated values ​​of the d accumulations;

[0340] Then, the updated values ​​of the d accumulators are processed using the inverse transformation of the decomposition method to obtain the output ciphertext; the output ciphertext is used for the next blind rotation operation.

[0341] After performing the above-mentioned blind rotation sub-operation N times, the output ciphertext of the last blind rotation sub-operation is used as the second ciphertext.

[0342] Exemplarily, for the above-mentioned implementation method 1: the first device iteratively performs N blind rotation sub-operations based on the optimized number theoretic transformation NTT processing and decomposition method and the first ciphertext to obtain the second ciphertext, which may include the following steps:

[0343] Step 1: Decompose the first ciphertext using a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts are equal to the d prime numbers. The jth third ciphertext contains the modulus Q j The decomposed ciphertext components and other modulus Q k The decomposed ciphertext component, Q k ≠Q j , j,k∈[1,d] (j,k are integers, and the value range of j,k is 1 to d, including 1 and d).

[0344] Exemplarily, the above decomposition method may be RNS decomposition, digital decomposition, gadget decomposition, etc.

[0345] Step 2: Perform optimized number theoretic transformation (NTT) on the d third ciphertexts to obtain d transformed fourth ciphertexts.

[0346] In the embodiment of the present application, the optimized number theory transformation NTT processing includes a modulo operation, which may include a shift process and / or a logical operation process; wherein, in the modulo operation included in the NTT processing of the j-th third ciphertext, the number of bits moved in the shift process is the same as the corresponding j-th prime modulus Q j The number of logical operations is related to the exponential of the n powers of 2, and the number of logical operations is related to the j-th prime modulus Q. j The value of n is related to the number of powers of 2.

[0347] Step 3: Based on the d transformed fourth ciphertexts, perform corresponding outer product and accumulation processing to obtain d fifth ciphertexts.

[0348] In one possible implementation, the first device obtains d first bootstrap keys, each of which satisfies the RGSW ciphertext form; the d first bootstrap keys are key components corresponding to the d bootstrap keys, and the moduli of the d bootstrap ciphertexts are equal to d different prime numbers. When executing step three, the process may include performing outer product and accumulation processing based on the d converted fourth ciphertexts and the d first bootstrap keys to obtain d fifth ciphertexts.

[0349] Step 4: Perform inverse number theoretic transformation INTT on the d fifth ciphertexts respectively to obtain d sixth ciphertexts.

[0350] Step 5: Process the d sixth ciphertexts by the inverse transformation of the decomposition method (such as ICRT) to obtain the seventh ciphertext.

[0351] The above steps 1 to 5 can be regarded as the process of a blind rotation operation (which can be called the i=1 blind rotation operation). If the initial input ciphertext is represented by c, The i-th blind rotation sub-operation and the i-th item a of the first ciphertext component a of the initial input ciphertext i and the i-th key component s of the initial input ciphertext i Related or corresponding.

[0352] Step 6: Use the seventh ciphertext as the new input ciphertext for step 1 of the next blind rotator operation (equivalent to the first ciphertext); iterate steps 1 to 5 above N-1 times, where N is an integer greater than 1. Use the seventh ciphertext obtained in step 5 of the last blind rotator operation (which can be called the i=Nth blind rotator operation) as the second ciphertext.

[0353] Implementation method 2: The first device decomposes the current first ciphertext using a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts correspond to d different prime numbers one by one; wherein the jth third ciphertext contains the modulus Q j The decomposed ciphertext components and other modulus Qk The decomposed ciphertext component, Q k ≠Q j , j, k∈[1,d]; then, optimized NTT processing is performed on the d third ciphertexts respectively to obtain d fourth ciphertexts; secondly, the d fourth ciphertexts are used as initial values ​​of d accumulators; based on the initial values ​​of the d accumulators, N-1 CMUX gate processing and ciphertext combination processing are performed to obtain updated values ​​of the d accumulators; N is an integer greater than 1; each CMUX gate processing and ciphertext combination processing is performed based on the result or output ciphertext of the previous CMUX gate processing and ciphertext combination processing; further, a CMUX gate processing and inverse number theory transformation INTT processing are performed on the updated values ​​of the d accumulators respectively to obtain d target ciphertexts; finally, based on the d target ciphertexts, the second ciphertext is obtained by the inverse method of the decomposition method.

[0354] In one possible implementation, the first device performs N-1 CMUX gate processing and ciphertext combination processing based on the initial values ​​of the d accumulators to obtain updated values ​​of the d accumulators, including:

[0355] Perform the i-th CMUX gate processing and ciphertext combination processing, the i-th CMUX gate processing and ciphertext combination processing and the i-th item a of the first ciphertext component of the initial input ciphertext i and the i-th key component s of the initial input ciphertext i The associated or corresponding, i∈[1,N-1], can include the following:

[0356] First, based on the current initial values ​​of the d accumulators, corresponding outer product and accumulation processing are performed respectively to obtain the outer product values ​​of the d accumulators.

[0357] Then, based on the outer product values ​​of the current d accumulators, d combined ciphertexts are determined; wherein based on the outer product value of the j-th accumulator (any one of the d accumulators), the j-th combined ciphertext is determined, including: rearranging and combining the outer product value of the j-th accumulator and the ciphertext component of the k-th accumulator to obtain the j-th combined ciphertext, the ciphertext component of the k-th accumulator being modulo Q based on the outer product value of the k-th accumulator k INTT and modulus Q j The d combined ciphertexts are obtained after NTT processing, k≠j; the d combined ciphertexts are used for the next CMUX gate processing and ciphertext combination processing.

[0358] For example, for the above-mentioned implementation method 2, the first device performs blind rotation processing on the first ciphertext based on the optimized NTT processing and decomposition algorithm to obtain the second ciphertext, which may include the following steps:

[0359] Step 1: The first device decomposes the first ciphertext using a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts correspond to d different prime numbers. The jth third ciphertext contains the modulus Q j The decomposed ciphertext components and the non-Q j Other modules Q k ≠Q j The decomposed ciphertext components; j, k∈[1,d] (j and k are integers, and the values ​​of j and k range from 1 to d and include 1 and d).

[0360] Step 2: The first device performs optimized number theoretic transformation (NTT) on the d third ciphertexts to obtain d transformed fourth ciphertexts.

[0361] In the embodiment of the present application, the optimized number theory transformation NTT processing includes a modulo operation, which may include a shift process and / or a logical operation process; wherein, in the modulo operation included in the NTT processing of the j-th third ciphertext, the number of bits moved in the shift process is the same as the corresponding j-th prime modulus Q j The number of logical operations is related to the exponential of the n powers of 2, and the number of logical operations is related to the j-th prime modulus Q. j The value of n is related to the number of powers of 2.

[0362] Step 3: The first device performs corresponding outer product and accumulation processing based on the d converted fourth ciphertexts to obtain d fifth ciphertexts (equivalent to the outer product values ​​of the d accumulators mentioned above).

[0363] In one possible implementation, the first device obtains d first bootstrap keys, each of which satisfies the RGSW ciphertext form; the d first bootstrap keys are key components corresponding to the d bootstrap keys, and the moduli of the d bootstrap ciphertexts are equal to d different prime numbers. When executing step three, the process may include performing outer product and accumulation processing based on the d converted fourth ciphertexts and the d first bootstrap keys to obtain d fifth ciphertexts.

[0364] Step 4: The first device obtains corresponding d sixth ciphertexts (equivalent to the d combined ciphertexts) based on the d fifth ciphertexts (equivalent to the outer product values ​​of the d accumulators).

[0365] In one possible implementation, in step 4, for the jth fifth ciphertext, obtaining the corresponding jth sixth ciphertext may include: executing the modulus Q based on the kth (k≠j) fifth ciphertext k INTT and modulus Q j The NTT calculation is performed to obtain the corresponding first ciphertext component; the j-th fifth ciphertext and the first ciphertext component are then rearranged and combined to obtain the j-th sixth ciphertext.

[0366] Furthermore, the d sixth ciphertexts are used as new input ciphertexts (equivalent to the fourth ciphertext in step 3); steps 3 to 4 are iterated N-2 times to obtain updated values ​​of d accumulators; N is an integer greater than 1.

[0367] Step 5: Perform a CMUX gate process and an inverse number theory transform INTT process on the updated values ​​of the d accumulators respectively to obtain d target ciphertexts.

[0368] Step 6: The first device obtains the second ciphertext based on the d target ciphertexts through the inverse transformation of the decomposition method (such as ICRT).

[0369] Compared with the above implementation method 1, in the implementation method 2, the sixth ciphertext is not obtained by performing a complete decomposition operation, but the modulus in step 3 is Q j The fifth ciphertext is directly stored and rearranged with the first ciphertext components corresponding to the other moduli to obtain the corresponding sixth ciphertext. Therefore, for d sixth ciphertexts, a total of d*2 NTT or INTT calculations can be saved. In the process of obtaining the first ciphertext components, a single combined function can also be used to implement two or more consecutive NTT or INTT transformations.

[0370] In summary, an embodiment of the present application provides a data processing method, which includes: a first device determines a ciphertext modulus for homomorphic encryption; the ciphertext modulus is a composite number obtained by multiplying d different prime numbers, where each prime number is obtained by summing up the products of n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5, and d is an integer greater than 1; and then homomorphic processing is performed based on the ciphertext modulus, wherein the homomorphic processing includes at least one of homomorphic encryption, homomorphic decryption, and homomorphic calculation. Typically, homomorphic encryption, homomorphic decryption, and homomorphic computing all involve modulo operations or modulo calculations, and the usual modulo operation or modulo calculation method may be to directly perform vertical calculations to obtain the result. However, when the divisor and dividend of the modulo operation are large, it is obviously difficult to use the vertical calculation of division to obtain the result. To this end, the present application implements a design of a modulus, which is a composite number obtained by multiplying d different prime numbers, and each prime number is obtained by the accumulation of n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5. In application, the modulus of the composite number can be first decomposed to obtain the moduli of d different prime numbers, and then the modulo operation / calculation can be performed based on the moduli of d different prime numbers. Similar to the above method, the modulo efficiency will be higher, thereby improving the processing efficiency of homomorphic encryption, homomorphic decryption, and homomorphic computing that include modulo operations / modulo calculations.

[0371] 5. Introduction to specific embodiments:

[0372] Based on the data processing method described in FIG. 6A and FIG. 6B , several specific embodiments are described in detail below.

[0373] Example 1:

[0374] In this first embodiment, based on the solution described in FIG. 6A , in homomorphic encryption, a prime modulus is used to implement encryption and other processing, and a modulo operation is designed, as shown below:

[0375] In one possible implementation, the ciphertext modulus Q is set to Solinas prime form: Where k1>k2>0, and k1 and k2 are integers.

[0376] In another possible implementation, the ciphertext modulus Q is set to the Mersenne prime form: k1>0, and k1 is an integer.

[0377] For example, as shown in FIG7A , if the fully homomorphic encryption process is used, the modulus Q is set to a Solinas prime number. Or set the modulus to Based on this or The information to be encrypted is homomorphically encrypted with a modulus Q in the form of to obtain a ciphertext.

[0378] In this embodiment 1, the modulus As an example, the calculation modulo r=a mod Q, the present application designs a modulo operation / modulo calculation, which can be implemented through simple shift operations and logical operations.

[0379] Example 1: Modulus Design a modulo operation / modulo calculation, including the following steps:

[0380] 1: t is an integer; after right shifting by k1 bits and then rounding down, we get a relative to The first quotient value of .

[0381] 2: u is an integer; determine a relative to The first remainder of .

[0382] 3: u=ut; subtract the first remainder from step 2 from the first quotient from step 1.

[0383] 4: t is shifted left by k2 and then subtracted from u.

[0384] For example, Q = 37 = 100101 = 2 5 +2 2 +1, a=40; r=a mod Q=40 mod 37=3; the modulo operation designed by the embodiment of the present application is as follows:

[0385] 1:

[0386] 2: u = 40 mod 2 5 =8;

[0387] 3: u = ut = 8 - 1 = 7;

[0388] 4: r = 7-1·2 2 =3.

[0389] Example 2: Modulus A modular operation / modulo calculation is designed, comprising the following steps:

[0390] Step 1: t is an integer; after right shifting by k1 bits and then rounding down, we get a relative to The first quotient value of .

[0391] Step 2: u is an integer; determine a relative to The first remainder of .

[0392] Step 3: u=ut; perform a subtraction operation on the first remainder of step 2 and the first quotient of step 1.

[0393] Step 4: Shift t left by k2 and then add it to u.

[0394] For example, FIG7B shows that when the ciphertext modulus Q=2 29 -2 18 An algorithm for modulo operation when +1=536608769 is shown in FIG7B . Input a coefficient a, -2 31 ≤a≤2 31 ; Refer to the modulo operation method of the above example 2, output the modulo result r, r satisfies -2 31 +4Q≤r≤2 31 -3Q.

[0395] In the first embodiment, the ciphertext modulus Q is set to form or Based on this special form of modulus, an efficient modulo operation / calculation can be designed, that is, the modulo result is obtained through simple shift operations and logical operations.

[0396] Example 2:

[0397] In this second embodiment, in order to improve the efficiency of NTT processing in blind rotation, the ciphertext modulus and modulo operation / modulo operation designed in the above embodiment are applied to NTT. That is, in blind rotation, the RLWE ciphertext modulus Q is set to The Solinas prime number of the form and the modulo operation / modulo operation designed in the embodiment of the application are used.

[0398] For example, using a 29-bit prime number as the ciphertext modulus, performing NTT-based blind rotation processing includes the following:

[0399] For example, the ciphertext modulus is a prime number 536608769, which can be written as 2 29 -2 18 +1 form.

[0400] In one possible implementation, the NTT-based blind rotation process includes an NTT calculation, which includes M butterfly operations, where M is an integer greater than or equal to 3. When performing the NTT calculation in the embodiment of the present application, it includes:

[0401] 1. After every three butterfly operations, a modulo operation / modulo calculation as described in the first embodiment is used to perform a modulo operation on the result of the butterfly operation.

[0402] Since each butterfly operation includes one addition and subtraction, it is equivalent to executing the algorithm shown in FIG7B once for the calculation results of the three addition and subtraction operations after every three addition and subtraction operations. That is, the modular reduction of the addition and subtraction is performed by the modular algorithm shown in FIG7B, and the calculation results of the three addition and subtraction operations are converted to the form of For example, r = a mod Q, a is the result of addition and subtraction, and the modulus Q is Prime numbers of the form.

[0403] 2. In each butterfly operation, the result after each multiplication operation is modulo-ed using the Montgomery algorithm. That is, after each multiplication of the unity root * x[n], the Montgomery algorithm is used to find the modulus. For details about the Montgomery algorithm, see the Montgomery algorithm flow shown in the above-mentioned prior art 5.

[0404] According to the output range of the algorithm described in FIG. 7B , it is obvious that the output of the algorithm can continue to be added or subtracted with the output of the Montgomery algorithm of three butterfly operations before performing modular reduction on the sum or difference of the addition and subtraction results.

[0405] In the embodiment of the present application, for a signed integer a within 32 bits, the algorithm shown in FIG7B is used to perform a modulo operation (a mod Q), and the output modulo result r satisfies -2 31 +4Q≤r<2 31 -3Q.

[0406] The following verifies that the result r of the modulo operation designed in the embodiment of the present application satisfies: 31 +4Q≤r<2 31 -3Q.

[0407] For a 32-bit signed integer a, the integer t is The quotient of , integer u is The remainder of t∈[-4,3]∩Z, and u∈[0,2 29 -1]∩Z. Therefore, a can be expressed by t and u, that is, a=t·2 29 +u. Since Q=2 29 -2 18 +1, 2 29 ≡2 18 -1 mod Q. Therefore, the modulus Q has the following relationship:

[0408] a=t·2 29 +u=t·(2 18 -1) + u = r mod Q;

[0409] According to t∈[-4,3], u∈[0,2 29 -1], and the above formula, we can get the range of r output by the algorithm shown in FIG7B as:

[0410] -4·(2 18 -1)+0≤r≤3·(2 18 -1)+2 29 -1; further:

[0411] -2 31 +4Q=-4·(2 18 -1)+0≤r≤3·(2 18 -1)+2 29 -1<2 31 -3Q.

[0412] Regarding 3·(2 18 -1)+2 29 -1<2 31 -3Q, the proof is as follows:

[0413] Since Q=2 29 -2 18 +1, then 2 18 -1=229 -Q, further:

[0414] 3(2 18 -1)+2 29 -1=3(2 29 -Q)+2 29 -1=3*2 29 -3Q+2 29 -1=(2 2 -1)*2 29 -3Q+2 29 -1=2 31 -3Q-1;

[0415] Therefore, 3(2 18 -1)+2 29 -1<2 31 -3Q.

[0416] In Example 2, in NTT, the special reduction method shown in Figure 7B (simple shifts and logical operations) and the Montgomery reduction with lazy reduction idea in NTT (that is, after three butterfly calculations / butterfly operations, a modulo operation is performed using the method shown in Figure 7B in the embodiment of the present application) are used to optimize the NTT processing in blind rotation, thereby effectively reducing the execution time of the outer product in the blind rotation, and thus improving the overall processing efficiency of the blind rotation or bootstrapping.

[0417] Example 3:

[0418] In Example 3, based on the scheme described in FIG6B above, in the bootstrapping process of homomorphic encryption, a composite number is used as the ciphertext modulus Q, that is, Among them, Q j It can be of the form Solinas primes or the form Different prime numbers of Q j They are mutually prime; j is an integer, and its value range is: 1≤j≤d R .

[0419] In one possible implementation, referring to the process shown in FIG8A , if it is a fully homomorphic encryption bootstrapping process, then the modulus Q of the bootstrapped ciphertext RLWE is set to a composite number Q j yes Prime numbers of the form or Prime numbers of the form.

[0420] In one possible implementation, RNS decomposition techniques and NTT can be applied during the homomorphic encryption bootstrapping process to control noise growth, thereby improving the efficiency of blind rotation processing during the bootstrapping process. For example, for a module that can be directly represented within 64 bits, RNS decomposition is first used to decompose the module into several prime numbers of no more than 32 bits. Then, based on the RNS decomposition module, parallel NTT-based outer product calculations are performed.

[0421] For example, in the homomorphic encryption process, a The composite number of is used as the modulus (for example, a modulus represented within 64 bits) to encrypt the encrypted information, where Q j It is in the form of 32 bits or less. Solinas primes or the form Prime number. Further, referring to the process shown in FIG8B , it is determined whether the current process is the bootstrap process for fully homomorphic encryption. If so, it is determined whether the ciphertext modulus is greater than 32 bits. If the ciphertext modulus is a prime number greater than 32 bits, a blind rotation process based on the optimized NTT and RNS decomposition techniques is performed.

[0422] The following is an introduction to the blind rotation processing based on the optimized NTT and RNS decomposition techniques:

[0423] The blind rotation processing based on the optimized NTT and RNS decomposition technology includes the following steps:

[0424] Step 1: Decompose the ring R Q An RLWE ciphertext on is decomposed into d R Each in The ciphertext in .

[0425] That is, in step 1, the RNS decomposition technique is used to decompose the RLWE ciphertext with modulus Q into d R This ciphertext. R The moduli of the ciphertexts are: This R The modulus of each ciphertext is a prime number within 32 bits.

[0426] Step 2: d R The ciphertext is processed by NTT.

[0427] We use an optimized NTT implementation in the outer product, so we need to R The ciphertext is transformed into NTT.

[0428] In addition, in the optimized NTT processing, the same modulo operation / modulo calculation as described in the first embodiment is used, that is, for a signed integer a within 32 bits, the modulo operation can be completed through simple shifting and logical operations.

[0429] Step 3: Perform outer product and accumulation between the RLWE ciphertext and the bootstrap key (satisfying the form of the RGSW ciphertext) on each ring.

[0430] Step 4: Perform INTT processing on the outer product and accumulation results.

[0431] For example, if d R =2, in each outer product calculation process, according to the principle of cancellation of consecutive NTT and INTT transformations, and the use of a combined single function to implement two consecutive NTT or INTT conversions, four NTT calculations can be reduced.

[0432] Regarding the outer product operation involved in step 3, the following is d R =2 is used as an example to introduce the outer product operation in blind rotation based on RNS decomposition.

[0433] An RLWE ciphertext ct = (a, b) ∈ RLWE sk,Q (μ), define the two RLWE ciphertexts obtained by RNS decomposition of the RLWE ciphertext ct as and and The corresponding RNS decomposition and complement results can be expressed as:

[0434] For RLWE ciphertext based on modulus Q1 and is the result of the complement of other moduli, and is the result of RNS decomposition based on modulus Q1. For RLWE ciphertext based on modulus Q2 and is the result of the complement of other moduli, and is the result of RNS decomposition based on modulus Q2.

[0435] Typically, the bootstrap key used in blind rotation is in the form of RGSW ciphertext. The RGSW ciphertext is stored as modulus Q1 and Q2. and is the gadget matrix. The RGSW ciphertext can be expressed as:

[0436] Defined in each ring The RLWE ciphertext ct=(a,b)∈RLWE sk,Q (μ) and RGSW ciphertext CT∈RGSW sk,Q The RNS-based outer product between (m) is expressed as:

[0437] Furthermore, in the outer product result ICRT can be used to recover the outer product result of the original modulus Q:

[0438] Based on the above-mentioned blind rotation processing solution based on optimized NTT and RNS decomposition technology, the following is a detailed introduction to GINX blind rotation based on RNS decomposition as an example.

[0439] Referring to the algorithm shown in FIG8C , the bootstrap key used for blind rotation is bsk1∈{RGSW sk,Q (s i )mod Q1} and bsk2∈{RGSW sk,Q (s i )mod Q2}, i=0,····,n-1, and perform blind rotation using RNS decomposition.

[0440] Input an LWE ciphertext c = (a, b), where And two bootstrap key sets bsk1 and bsk2; output an RLWE ciphertext

[0441] Referring to FIG8C , the analysis of the algorithm shown in FIG8C is as follows:

[0442] Lines 1-2: Set up two accumulators acc1 and acc2.

[0443] The form of acc1 and acc2 is:

[0444] Lines 3-4: Set the input ciphertexts ct1 and ct2 of the two outer products.

[0445] The forms of ct1 and ct2 are:

[0446] Since the ciphertext consists of n(N) components a i , so it is necessary to perform n(N) outer product operations and update the accumulator value.

[0447] Lines 5-6: For accumulators acc1 and acc2, perform the first outer product operation and update the values ​​of acc1 and acc2 respectively.

[0448] acc1 and acc2 respectively perform outer product operations and update accumulator values, satisfying the following formula:

[0449] renew

[0450] renew

[0451] Lines 7-11: Based on the values ​​of the accumulators acc1 and acc2 updated by the first outer product, continue to perform the remaining n-1 outer product operations and update the accumulator values.

[0452] Specifically, for accumulators acc1 and acc2, the following steps are executed in a loop n-1 times:

[0453] Step 1: The accumulator acc1 obtains the value of ct1 through the decomposition operation shown in Formula 3 (which serves as the outer product ct1 input value in Formula 1 of Step 2 below). The accumulator acc2 obtains the value of ct2 through the decomposition operation shown in Formula 4 (which serves as the outer product ct2 input value in Formula 2 of Step 2 below):

[0454] renew

[0455] renew

[0456] Step 2: acc1 performs outer product operation according to formula 1 and updates the value of acc1. Acc2 performs outer product operation according to formula 2 and updates the value of acc2.

[0457] renew

[0458] renew

[0459] The values ​​of acc1 and acc2 obtained from each outer product operation and update are used in the next outer product operation and accumulator value update process. For example, the values ​​of acc1 and acc2 obtained from the current step 2 update are used as the values ​​of acc1 and acc2 in step 1 of the next outer product operation.

[0460] For example, by performing the outer product in step 1 above and updating acc1 and acc2, they are actually two RLWE ciphertexts stored in NTT form. and Will and Input to the next outer product processing. Usually in the next outer product processing, first put these two NTT forms ct' Q1 and ct′ Q2 Through INTT transformation, it is converted back to the coefficient representation. Then, through the above formula 3 and formula 4, ct1 is obtained and Furthermore, the outer product result is obtained by formula 1 and formula 2 in step 2 and In the outer product operations of Formula 1 and Formula 2, acc and ct are both performed in NTT form.

[0461] For the decomposition function in step 1 above Make corresponding introductions:

[0462] The embodiment of the present application defines a new decomposition function for obtaining ciphertext input in an outer product operation. The new decomposition function includes NTT, INTT, and RNS decomposition.

[0463] For example, taking the above step 1 as an example, the decomposition function used to obtain ct1 and ct2 is expressed as and For ciphertext (such as acc1 in Formula 3 and Formula 4) and (Such as acc2 in formula 3 and formula 4) is decomposed. The decomposition function includes NTT, INTT and RNS decomposition. For the ciphertext in NTT form and Its decomposition function can be expressed as follows:

[0464] For the above decomposition operation For example, when calculating the ciphertext modulus Q k When decomposing and filling the RNS, only non-Q k The ciphertext of other moduli performs NTT and INTT, while the modulus is Q k The ciphertext is directly stored. Therefore, compared with directly calculating the outer product on each RNS ring, this method can reduce the total number of NTT or INTT operations. In addition, the present application designs a new decomposition function, which is essentially a merge function that includes NTT and INTT processing. Therefore, for two ciphertexts, two consecutive INTT transformations and NTT transformations can be realized, which is equivalent to realizing INTT and INTT at one time by calling the new decomposition function of the embodiment of the present application in the algorithm implementation or program implementation, without calling two functions (i.e., the function that realizes INTT and the function that realizes NTT), which can save the time of calling functions.

[0465] The following is a detailed introduction and comparison of two implementation methods based on RNN decomposition and blind rotation in the solution shown in FIG. 6B of an embodiment of the present application.

[0466] Implementation method 1: Taking the first ciphertext as RLWE ciphertext as an example, FIG8D shows a process of direct RNS decomposition and blind rotation processing, as shown in FIG8D , including the following steps:

[0467] Step 1: An RLWE ciphertext ct = (a, b), the modulus of which is Q = Q1 * Q2; the RLWE ciphertext is decomposed by RNS to obtain the RNS decomposition result and complement (RNS & complement), which is shown in Figure 8D. and

[0468] visible It includes the ciphertext component with modulus Q1 and the ciphertext component related to the complement modulus Q2 of Q1.

[0469] visible It includes the ciphertext component with modulus Q2 and the ciphertext component related to the complement modulus Q1 of Q2.

[0470] Step 2: and Perform NTT processing to obtain and

[0471] The NTT process includes the modulo operation (including shift processing and logical operation) in the embodiment of the present application, that is, In the modulo operation included in the NTT processing, the number of bits moved in the shift processing is related to the exponents of the n powers of 2 in the corresponding modulus Q1, and the number of logical operations is related to the value of the number n of powers of 2 in Q1; In the modulo operation included in the NTT processing, the number of bits moved in the shift processing is related to the exponents of the n powers of 2 in the corresponding modulus Q2, and the number of logical operation processing is related to the value of the number n of powers of 2 in Q2.

[0472] Step 3: Based on and Execute the corresponding outer product and accumulation processing respectively to obtain the corresponding processing results, that is, and

[0473] Step 4: respectively process the results ( and ) is processed by INTT to obtain and

[0474] Step 5: and As new input, repeat the above steps 1 to 4 for N-1 times.

[0475] After performing INTT processing on the results of the last (i=n-1) outer product and accumulation processing, we get and based on and Perform step six below.

[0476] Step 6: Based on and The final result obtained by ICRT method is ct=([a] Q ,[b] Q ).

[0477] Implementation method 2: Taking the first ciphertext as RLWE ciphertext as an example, FIG8E shows a process of RNS decomposition and blind rotation processing that can save NTT and INTT. As shown in FIG8E , the process includes the following steps:

[0478] Step 1: An RLWE ciphertext ct = (a, b), the modulus of which is Q = Q1 * Q2; the RLWE ciphertext is decomposed by RNS to obtain the RNS decomposition result and complement (RNS & complement), which is shown in Figure 8D. and

[0479] visible It includes the ciphertext component with modulus Q1 and the ciphertext component related to the complement modulus Q2 of Q1.

[0480] visible It includes the ciphertext component with modulus Q2 and the ciphertext component related to the complement modulus Q1 of Q2.

[0481] Step 2: and Perform NTT processing to obtain and

[0482] The NTT process includes the modulo operation (including shift processing and logical operation) in the embodiment of the present application, that is, In the modulo operation included in the NTT processing, the number of bits moved in the shift processing is related to the exponent of the n powers of 2 in the corresponding modulus Q1, and the number of logical operations is related to the value of the number n of powers of 2 in Q1; In the modulo operation included in the NTT processing, the number of bits moved in the shift processing is related to the exponents of the n powers of 2 in the corresponding modulus Q2, and the number of logical operation processing is related to the value of the number n of powers of 2 in Q2.

[0483] Step 3: Based on and Execute the corresponding outer product and accumulation processing respectively to obtain the corresponding processing results, that is, and

[0484] Step 4: and Splicing combination (You can also combine single functions Implementation, (see the process indicated by the bold black line on the upper left side of Figure 8E). and Splicing combination (You can also combine single functions Implementation, see the process indicated by the bold dotted line in the upper right corner of Figure 8E).

[0485] in, Yes implement Processing and Obtained after processing. Yes implement Processing and Obtained after processing.

[0486] The result obtained in step 4 and Repeat steps 3 and 4 above N-2 times as the new input. That is, in each iteration, the result of step 4 is used as the input for the next step 3. The i-th iteration is associated or corresponds to the i-th item of the first ciphertext component of the initial input ciphertext and the i-th key component of the initial input ciphertext.

[0487] Step 5: After the above N-2 times, the combination based on step 4 is obtained and Execute the corresponding outer product and accumulation processing respectively to obtain the corresponding processing results and That is, the last external accumulation process is performed.

[0488] Step 6: Add the last outer product and the result after accumulation and Execute INTT processing separately and get and

[0489] Step 7: Based on and The final result obtained by ICRT method is ct=([a] Q ,[b] Q ).

[0490] Compared with the implementation method 1 shown in FIG8D , in the implementation method 2, the input of the outer product and accumulation processing is not obtained by performing a complete decomposition operation, but a ciphertext with a modulus Q1 is converted into Direct storage and (i.e., the example of the first ciphertext component in the scheme described in FIG. 6B above) is concatenated and combined to obtain Therefore, the number of consecutive NTT or INTT calculations can be saved. Similarly, a ciphertext with a modulus of Q2 Direct storage and Combine and combine to obtain Therefore, two consecutive NTTs or INTTs can also be saved. Compared with the process shown in FIG8D , it can be seen that the second implementation shown in FIG8E can save a total of four NTTs or INTTs.

[0491] Therefore, if the d ciphertexts obtained by RLWE ciphertext decomposition (the d sixth ciphertexts in the scheme described in FIG6B above) are executed using the above implementation method 2, a total of d*2 NTT or INTT calculation times can be saved.

[0492] In the third embodiment, the number of NTTs does not decrease when using RNS decomposition, but compared with the blind rotation using digital decomposition, the embodiment of the present application uses a smaller amount of data (smaller modulus), the degree of parallel execution is improved, and the efficiency of the operation can also be improved. In addition, a combined processing method or a new decomposition function is designed. To save the NTT result, you can avoid performing INTT and NTT operations on all polynomials in each outer product loop.

[0493] Example 4:

[0494] In this fourth embodiment, the keys, parameters and performance analysis involved in the embodiments of the present application are introduced in detail.

[0495] Figure 9 shows a diagram of a homomorphic computing scenario to which the method according to an embodiment of the present application can be applied, as well as the interaction process between keys and parameters in the homomorphic computing scenario. The specific process may include the following:

[0496] Step 1: The homomorphic key generator generates the homomorphic key and homomorphic scheme parameters for the homomorphic task.

[0497] Homomorphic scheme parameters may include: the dimension of LWE at each level, the ciphertext modulus Q, the basis of gadget decomposition during outer product operations in bootstrapping, the length of gadget decomposition during outer product operations, the basis of gadget decomposition during key switching, and the length of gadget decomposition during key switching.

[0498] The ciphertext modulus Q can be the aforementioned prime modulus obtained by the accumulation of n different powers of 2 and coefficients, or a composite modulus obtained by the continuous multiplication of d different prime numbers, where each prime number is obtained by the accumulation of n different powers of 2 and coefficients.

[0499] Homomorphic keys may include: homomorphic encryption keys, homomorphic decryption keys, homomorphic computation keys (including but not limited to scheme switching keys, key switching keys, bootstrapping keys, self-isomorphic keys, auxiliary keys), etc.

[0500] Step 2: Homomorphic key generator A broadcasts the homomorphic scheme parameters to homomorphic encryptor B, homomorphic computer C, and homomorphic decryptor D, and homomorphic key generator A also sends the homomorphic encryption key to homomorphic encryptor B, the homomorphic computer C, and the homomorphic decryption key to homomorphic decryptor D.

[0501] Step 3: Homomorphic encryption party B homomorphically encrypts the plaintext data based on the homomorphic scheme parameters and the homomorphic encryption key to obtain the homomorphic ciphertext, and then sends the homomorphic ciphertext to the homomorphic computing party C.

[0502] Step 4: The homomorphic computing party C performs homomorphic computing on the homomorphic ciphertext according to the homomorphic scheme parameters, homomorphic computing key and homomorphic ciphertext, and sends the ciphertext of the homomorphic computing result to the homomorphic decryption party D.

[0503] Step 5: Homomorphic decryption party D executes the homomorphic decryption algorithm on the ciphertext of the homomorphic calculation result according to the homomorphic scheme parameters and the homomorphic decryption key to obtain the plaintext result.

[0504] Optionally, the homomorphic decryption party D may also obtain the homomorphic ciphertext directly from the homomorphic encryption party B, and then perform a homomorphic decryption algorithm on the homomorphic ciphertext according to the homomorphic decryption key to obtain a plaintext result.

[0505] The method provided in the embodiment of the present application can be applied to a homomorphic computing party. Based on the process of the homomorphic computing scenario shown in Figure 9 above, it can be seen that before the homomorphic computing party performs homomorphic computing, the homomorphic key generator should send the homomorphic computing key to the homomorphic computing party; in addition, since the homomorphic computing key is generated by the homomorphic key generator according to the corresponding parameters, the homomorphic key generator also needs to transmit the parameters of these homomorphic computing keys to the homomorphic computing party so that the homomorphic computing party sets the values ​​of the parameters of these homomorphic computing keys to be consistent with the values ​​on the key generator side.

[0506] In the present application, the solutions described in the above embodiments can be executed independently, and all or part of the solutions involved in the above embodiments can also be used in combination with each other, without limitation.

[0507] In the embodiments provided in the present application above, the methods provided in the embodiments of the present application are introduced from the perspective of interaction between various devices. In order to implement the various functions in the methods provided in the embodiments of the present application above, the first device may include a hardware structure and / or a software module, and implement the above functions in the form of a hardware structure, a software module, or a hardware structure plus a software module. Whether a function of the above functions is executed in the form of a hardware structure, a software module, or a hardware structure plus a software module depends on the specific application and design constraints of the technical solution.

[0508] The division of modules in the embodiments of the present application is illustrative and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the present application may be integrated into a single processor, or may exist physically separately, or two or more modules may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or software functional modules.

[0509] Similar to the above concept, as shown in Figure 10, an embodiment of the present application also provides a data processing device 1000 for implementing the functions of the homomorphic computing device (homomorphic computing party) in the above method. For example, the data processing device 1000 can be a software module or a chip system. In the embodiment of the present application, the chip system can be composed of a chip, or it can include a chip and other discrete devices. The data processing device 1000 may include: a communication unit 1001 and a processing unit 1002.

[0510] In the embodiments of the present application, the communication unit 1001 may also be referred to as a transceiver unit, and may include a sending unit and / or a receiving unit, each configured to execute the steps of sending and receiving by the network device or terminal device in the above method embodiments. The processing unit 1002 may be configured to read instructions and / or data from the storage module, so that the data processing device 1000 implements the above method embodiments.

[0511] Optionally, the data processing device 1000 may further include a storage unit 1003 , which is equivalent to a storage module and may be used to store instructions and / or data.

[0512] The data processing device provided in the embodiments of the present application is described in detail below in conjunction with Figures 10 and 11. It should be understood that the description of the device embodiment corresponds to the description of the method embodiment. Therefore, for matters not described in detail, reference can be made to the method embodiment described in Figures 6A and 6B above. For the sake of brevity, they will not be repeated here.

[0513] Communication unit 1001 may also be referred to as a transceiver, transceiver, or transceiver device. A processing unit may also be referred to as a processor, processing board, processing module, or processing device. Alternatively, the device in communication unit 1001 that implements the receiving function may be considered a receiving unit, and the device in communication unit 1001 that implements the transmitting function may be considered a transmitting unit. That is, communication unit 1001 includes both a receiving unit and a transmitting unit. A communication unit may also be referred to as a transceiver, transceiver, or transceiver circuit. A receiving unit may also be referred to as a receiver, receiver, or receiving circuit. A transmitting unit may also be referred to as a transmitter, transmitter, or transmitting circuit.

[0514] When the data processing device 1000 executes the first device in the process shown in FIG. 6A in the above embodiment: the communication unit 1001 is used to communicate with other devices. The processing unit 1002 is used to determine the ciphertext modulus for homomorphic encryption, where the ciphertext modulus is a prime number obtained by multiplying and summing n different powers of 2 and coefficients, where n is an integer greater than or equal to 2 and less than or equal to 5; the processing unit 1002 is further used to perform homomorphic processing based on the ciphertext modulus; the homomorphic processing includes but is not limited to at least one of homomorphic encryption, homomorphic decryption, and homomorphic computation.

[0515] When the data processing device 1000 executes the first device in the process shown in FIG6B of the above embodiment: the communication unit 1001 is used to communicate with other devices. The processing unit 1002 is used to determine the ciphertext modulus of homomorphic encryption; the ciphertext modulus is a composite number obtained by multiplying d different prime numbers, where each prime number is obtained by adding up n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5, and d is an integer greater than 1. The processing unit 1002 is also used to perform homomorphic processing based on the ciphertext modulus; the homomorphic processing includes but is not limited to at least one of homomorphic encryption, homomorphic decryption and homomorphic calculation.

[0516] The above is just an example. The processing unit 1002 and the communication unit 1001 can also perform other functions. For more detailed description, please refer to the relevant description of the method embodiment shown in Figures 6A and 6B, which will not be repeated here.

[0517] As shown in FIG11 , a data processing device 1100 provided in an embodiment of the present application is shown. The data processing device shown in FIG11 may be a hardware circuit implementation of the data processing device shown in FIG11 . The data processing device 1100 may be applicable to the flowchart shown above to perform the functions of the homomorphic computing device (homomorphic computing party) in the above-mentioned method embodiment. For ease of explanation, FIG11 only shows the main components of the data processing device.

[0518] As shown in Figure 11, data processing device 1100 includes a communication interface 1101 and a processor 1102. Communication interface 1101 and processor 1102 are coupled to each other. It is understood that communication interface 1101 can be a transceiver or input / output interface, or an interface circuit such as a transceiver circuit. Optionally, data processing device 1100 can also include a memory 1103 for storing instructions executed by processor 1102, input data required by processor 1102 to execute instructions, or data generated by processor 1102 after executing instructions.

[0519] When the data processing device 1100 is used to implement the method shown in FIG. 6A-FIG . 6B , the processor 1102 is used to implement the functions of the processing unit 1002 , and the communication interface 1101 is used to implement the functions of the receiving unit and / or sending unit.

[0520] The specific connection medium between the communication interface 1101, the processor 1102, and the memory 1103 is not limited in the embodiments of the present application. In Figure 11, the embodiment of the present application shows that the memory 1103, the processor 1102, and the communication interface 1101 are connected via a communication bus 1104. The communication bus 1104 is represented by a bold line in Figure 11. The connection method between other components is only for schematic illustration and is not intended to be limiting. The communication bus 1104 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one bold line is used in Figure 11, but this does not mean that there is only one bus or one type of bus.

[0521] When the data processing device is a chip, FIG12 shows a simplified schematic diagram of the chip structure, wherein the chip 1200 includes an interface circuit 1201 and one or more processors 1202. Optionally, the chip 1200 may further include a bus.

[0522] The processor 1202 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method can be completed by an integrated logic circuit of hardware in the processor 1202 or instructions in the form of software. The above-mentioned processor 1202 can be a general-purpose processor, a digital communicator (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. The various methods and steps disclosed in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor, etc.

[0523] The interface circuit 1201 can be used to send or receive data, instructions or information. The processor 1202 can use the data, instructions or other information received by the interface circuit 1201 to process it, and can send the processing completion information through the interface circuit 1201.

[0524] Optionally, the chip further includes a memory 1203, which may include a read-only memory and a random access memory, and provides operating instructions and data to the processor. A portion of the memory 1203 may also include a non-volatile random access memory (NVRAM).

[0525] Optionally, the memory stores an executable software module or a data structure, and the processor can perform corresponding operations by calling an operation instruction stored in the memory (the operation instruction may be stored in an operating system).

[0526] Optionally, the chip can be used in a homomorphic computing device according to an embodiment of the present application. Optionally, the interface circuit 1201 can be used to output the execution result of the processor 1202. For the data processing method provided in one or more embodiments of the present application, reference can be made to the aforementioned embodiments and will not be repeated here.

[0527] It should be noted that the corresponding functions of the interface circuit 1201 and the processor 1202 can be implemented through hardware design, software design, or a combination of hardware and software, and there is no limitation here.

[0528] An embodiment of the present application further provides a computer-readable storage medium storing computer instructions for implementing the method executed by the first device in the above method embodiment.

[0529] For example, when the computer program is executed by a computer, the computer can implement the method performed by the first device in the above method embodiment.

[0530] An embodiment of the present application further provides a computer program product comprising instructions, which, when executed by a computer, enables the computer to implement the method performed by the first device in the above method embodiment.

[0531] An embodiment of the present application also provides a chip, including a processor, for calling the computer program or computer instructions stored in the memory so that the processor executes the data processing method of the embodiment shown in Figures 6A and 6B above.

[0532] In one possible implementation, the input of the chip corresponds to the receiving operation in the embodiment shown in FIG. 6A-FIG . 6B , and the output of the chip corresponds to the sending operation in the embodiment shown in FIG. 6A-FIG . 6B .

[0533] Optionally, the processor is coupled to the memory via an interface.

[0534] Optionally, the chip further includes a memory in which computer programs or computer instructions are stored.

[0535] The processor mentioned in any of the above may be a general-purpose central processing unit, a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits for controlling the execution of a program of a data processing method according to the embodiment shown in FIG6A-FIG6B. The memory mentioned in any of the above may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, a random access memory (RAM), etc.

[0536] It should be noted that, for the sake of convenience and brevity of description, the explanation of the relevant contents and beneficial effects of any of the above-mentioned data processing devices can refer to the corresponding data processing method embodiments provided above, and will not be repeated here.

[0537] In this application, the data processing devices may also include a hardware layer, an operating system layer running on the hardware layer, and an application layer running on the operating system layer. The hardware layer may include hardware such as a central processing unit (CPU), a memory management unit (MMU), and memory (also known as main memory). The operating system of the operating system layer may be any one or more computer operating systems that implement business processing through processes, such as the Linux operating system, Unix operating system, Android operating system, iOS operating system, or Windows operating system. The application layer may include applications such as browsers, address books, word processing software, and instant messaging software.

[0538] The division of modules in the embodiments of the present application is illustrative and is merely a logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the present application may be integrated into a single processor, or may exist physically separately, or two or more modules may be integrated into a single module. The aforementioned integrated modules may be implemented in the form of hardware or software functional modules.

[0539] Through the description of the above embodiments, it will be clear to those skilled in the art that the embodiments of the present application can be implemented in hardware, firmware, or a combination thereof. When software is used for implementation, the above functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, wherein the communication media include any medium that facilitates the transmission of a computer program from one place to another. The storage medium can be any available medium that a computer can access. For example, but not limited to: a computer-readable medium may include RAM, ROM, electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer. In addition, any connection can be appropriately a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of the medium. As used in the embodiments of the present application, disk and disc include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk, and Blu-ray disc, where disks typically reproduce data magnetically and discs use lasers to reproduce data optically. Combinations of the above should also be included within the scope of protection of computer-readable media.

[0540] In short, the above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent replacements, improvements, etc. made based on the disclosure of the present application should be included in the scope of protection of the present application.

Claims

1. A data processing method, characterized in that The method includes: Determining a ciphertext modulus for homomorphic encryption; the ciphertext modulus is a prime number obtained by accumulating the products of n different powers of 2 and coefficients, where n is an integer greater than or equal to 2 and less than or equal to 5; Performing homomorphic processing based on the ciphertext modulus, where the homomorphic processing includes at least one of homomorphic encryption, homomorphic decryption, and homomorphic calculation.

2. The method according to claim 1, wherein The ciphertext modulus satisfies the following form: where Q is the ciphertext modulus, and the exponents k of the first n - 1 distinct powers of 2 i are integers greater than 0 and less than or equal to m (m ≥ k1 >... k i > k n-1 > 0), and the exponent k of the nth power of 2 n is equal to 0 (k n = 0), m is the bit width of the ciphertext modulus Q, and the coefficient a i takes the value of +1 or -1, and i is an integer greater than or equal to 1 and less than or equal to n.

3. The method according to claim 2, wherein When n is 3, the form satisfied by the ciphertext modulus is where both k1 and k2 are integers greater than 0 and less than or equal to m.

4. The method according to claim 2, characterized in that, When n is 2, the form satisfied by the ciphertext modulus is where k1 is an integer greater than 0 and less than or equal to m.

5. The method according to any one of claims 1 to 4, characterized in that, The homomorphic encryption, the homomorphic decryption, and the homomorphic calculation all include a modulo operation; The performing homomorphic processing based on the ciphertext modulus includes: performing a modulo operation based on the ciphertext modulus, where the modulo operation includes shift processing and / or logical operation processing; wherein, the number of bits shifted in the shift processing is related to the exponents of the n powers of 2 in the ciphertext modulus, and the number of times of the logical operation processing is related to the value of n.

6. The method according to claim 5, characterized in that, The method further includes: Performing at least one number-theoretic transform NTT based on the modulo operation.

7. The method according to claim 6, characterized in that, One NTT includes M butterfly operations; M is an integer greater than or equal to 3; the performing the number-theoretic transform NTT based on the modulo operation includes: performing the modulo operation after every three butterfly operations; and performing a power modulo operation algorithm on each multiplication result in each butterfly operation for modulo.

8. A data processing method, characterized in that, The method includes: Determining a ciphertext modulus for homomorphic encryption; the ciphertext modulus is a composite number obtained by multiplying d different prime numbers, where each prime number is obtained by accumulating the products of n different powers of 2 and coefficients; n is an integer greater than or equal to 2 and less than or equal to 5, and d is an integer greater than 1; Performing homomorphic processing based on the ciphertext modulus, where the homomorphic processing includes at least one of homomorphic encryption, homomorphic decryption, and homomorphic calculation.

9. The method according to claim 8, wherein The ciphertext modulus satisfies the following form: Where Q represents the ciphertext modulus, and d represents the number of prime numbers Q obtained by multiplying them; the prime number Q j satisfies the following form: j satisfies the following form: Prime number Q j The exponent k of the power of 2 ji Is an integer greater than 0 and less than or equal to m j (m j ≥ k j1 >...k ji > k j(n-1) > k jn = 0), m j Is the bit width size of Q j The coefficient a i Takes a value of +1 or -1.

10. The method according to claim 8 or 9, characterized in that When performing homomorphic encryption based on the ciphertext modulus, it includes: Based on the ciphertext modulus, homomorphically encrypting the second ciphertext component of the initial input ciphertext to obtain a first ciphertext; the first ciphertext is an RLWE ciphertext; the initial input ciphertext includes a first ciphertext component and the second ciphertext component, and the first ciphertext component includes N items, where N is a positive integer; Performing a blind rotation process on the first ciphertext based on an optimized number-theoretic transform NTT processing and decomposition method to obtain a second ciphertext.

11. The method according to claim 10, wherein The performing a blind rotation process on the first ciphertext based on an optimized number-theoretic transform NTT processing and decomposition method to obtain a second ciphertext includes: Based on the optimized number-theoretic transform NTT processing and decomposition method and the first ciphertext, iteratively performing N blind rotation sub-operations to obtain the second ciphertext; N is an integer greater than 1; wherein, each blind rotation sub-operation is performed based on the output ciphertext of the previous blind rotation sub-operation; Wherein, for the i-th blind rotation sub-operation, i ∈ [1, N]; the i-th blind rotation sub-operation is associated with the i-th item of the first ciphertext component of the initial input ciphertext and the i-th key component of the initial input ciphertext, and includes the following: The current ciphertext is decomposed by a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts are in one-to-one correspondence and equality with the d different prime numbers; wherein, the j-th third ciphertext contains ciphertext components obtained based on the modulus Q j and ciphertext components obtained based on other moduli Q k where Q k ≠Q j , j, k ∈ [1, d]; the current ciphertext is the first ciphertext or the output ciphertext of the previous blind rotation sub-operation; Using the d third ciphertexts as the initial values of the d accumulators; Perform number-theoretic transform (NTT) processing on the initial values of the d accumulators to obtain the transformed values of the d accumulators; the optimized number-theoretic transform (NTT) includes a modulo operation, and the modulo operation includes shift processing and / or logical operation processing; wherein, in the modulo operation included in the NTT processing of the initial value of the j-th accumulator, the number of bits shifted in the shift processing is related to the exponent of n powers of 2 in the corresponding j-th prime modulus Q j and the number of times of the logical operation processing is related to the value of the number of terms n of powers of 2 in the j-th prime modulus Q j ; Based on the converted values of the d accumulators, respectively performing corresponding outer product and accumulation processing to obtain the outer product values of the d accumulators; Respectively performing INTT processing on the outer product values of the d accumulators to obtain the updated values of the d accumulators; Process the updated values of the d accumulators by using the inverse transformation of the decomposition method to obtain an output ciphertext; the output ciphertext is used for the next blind rotation sub-operation.

12. The method according to claim 10, characterized in that, The blind rotation process of the first ciphertext based on the optimized number theory transform NTT process and decomposition method to obtain a second ciphertext includes: The current first ciphertext is decomposed by a decomposition method to obtain d third ciphertexts; the moduli of the d third ciphertexts are in one-to-one correspondence and equal to the d different prime numbers; wherein, the j-th third ciphertext includes ciphertext components obtained based on the modulus Q j and ciphertext components obtained based on other moduli Q k ; Q k ≠Q j , j, k ∈ [1, d]; Perform optimized NTT processing on the d third ciphertexts respectively to obtain d fourth ciphertexts; the optimized number-theoretic transform NTT processing includes a modulo operation, and the modulo operation includes a shift processing and / or a logical operation processing; wherein, in the modulo operation included in the NTT processing of the j-th third ciphertext, the number of bits shifted in the shift processing is related to the exponent of the n powers of 2 in the corresponding j-th prime modulus Q j and the number of times of the logical operation processing is related to the value of the number of terms n of the powers of 2 of the j-th prime modulus Q j ; Use the d fourth ciphertexts as the initial values of the d accumulators; Based on the initial values of the d accumulators, perform N - 1 times of CMUX gate processing and ciphertext combination processing to obtain the updated values of the d accumulators; N is an integer greater than 1; where each CMUX gate processing and ciphertext combination processing is performed based on the output ciphertext of the previous CMUX gate processing and ciphertext combination processing; Perform CMUX gate processing and inverse number theory transform INTT processing on the updated values of the d accumulators respectively to obtain d target ciphertexts; Based on the d target ciphertexts, obtain the second ciphertext through the inverse method of the decomposition method.

13. The method according to claim 12, wherein The performing N - 1 times of CMUX gate processing and ciphertext combination processing based on the initial values of the d accumulators to obtain the updated values of the d accumulators includes: Perform the i-th CMUX gate processing and ciphertext combination processing, where the i-th CMUX gate processing and ciphertext combination processing is associated with or corresponding to the i-th item of the first ciphertext component of the initial input ciphertext and the i-th key component of the initial input ciphertext, i ∈ [1, N - 1], and includes: Based on the current values of the d accumulators, perform corresponding outer product and accumulation processing respectively to obtain the outer product values of the d accumulators; Determine d combined ciphertexts based on the outer product values of the current d accumulators; the d combined ciphertexts are used for the next CMUX gate processing and ciphertext combination processing; wherein, determining the j-th combined ciphertext based on the outer product value of the j-th accumulator includes: rearranging and combining the outer product value of the j-th accumulator and the ciphertext component of the k-th accumulator to obtain the j-th combined ciphertext, where k≠j; the ciphertext component of the k-th accumulator is based on the outer product value of the k-th accumulator and is obtained after INTT modulo Q k and modulo Q j after NTT processing of 14. The method according to any one of claims 10 to 13, characterized in that The decomposition method is any one of the following: Residue number system RNS decomposition, digital decomposition, gadget decomposition.

15. A data processing device, characterized in that, Includes a module or unit for executing the method according to any one of claims 1 to 7, or a module or unit for executing the method according to any one of claims 8 to 14.

16. A data processing device, characterized in that, Includes a processor, the processor is coupled to a memory, and a computer program is stored in the memory; the processor is used to call the computer program in the memory, so that the device executes the method according to any one of claims 1 to 7, or so that the device executes the method according to any one of claims 8 to 14.

17. A data processing device, characterized in that, Includes a processor and an interface circuit, the interface circuit is used to receive signals from other communication devices outside the communication device and transmit them to the processor or send signals from the processor to other communication devices outside the communication device, and the processor is used to implement the method according to any one of claims 1 to 7 through logic circuits or executing code instructions, or the processor is used to implement the method according to any one of claims 8 to 14 through logic circuits or executing code instructions.

18. A computer-readable storage medium, characterized in that, A computer program or instruction is stored in the storage medium, and when the computer program or instruction is executed by a computer, the method according to any one of claims 1 to 14 is implemented.

19. A computer program product, characterized in that, When a computer reads and executes the computer program product, the computer is made to execute the method according to any one of claims 1 to 14.

20. A communication system, characterized in that, Including at least one of a homomorphic encryption party, a homomorphic computing party, and a homomorphic decryption party, and any one of the homomorphic encryption party, the homomorphic computing party, and the homomorphic decryption party is used to execute the method described in any one of claims 1 to 14.

Images