Approximation of FHE operations

Abstract

A method of fully homomorphic encryption, FHE, the method comprising: approximating a number as a rational number wherein approximating the number as a rational number comprises: determining the denominator based on a scaling parameter; and multiplying the number by the denominator and rounding the result to obtain the numerator; encrypting the numerator of the rational number with a predetermined FHE algorithm separately from the denominator; and storing the encrypting numerator in a data structure.

Description

[0001]Vaultree Ltd. PP25-376-WO Approximation of FHE operations Field The present disclosure is directed towards an approximate fully homomorphic encryption scheme (AFHE) that approximates a homomorphic encryption scheme (FHE). An AFHE operation provides an output which is an approximation of the output of a FHE operation. In particular, encrypting a number with AFHE will provide an encrypted value that, when decrypted, will approximate the number. The AFHE scheme can preferably enable the performance of approximate arithmetic operation on numbers which have been encrypted using the AFHE scheme. As a result, AFHE enables encryption of real and complex numbers, as well as the performance of arithmetic operations on the encrypted values unlike traditional FHE schemes which only support encryption of integers. This has many practical applications including e.g. the performance of training and / or inference operations in Artificial Intelligence (AI) or Machine Learning (ML) systems. This benefit is of significance as it allows training and / or inference operations to be performed on data which can remain securely encrypted. Background Homomorphic encryption (HE) is a type of encryption that allows computations to be performed on encrypted data without first having to decrypt it. The output from these computations can be left in encrypted form. When the output is decrypted, the result is a value identical to that produced had the operations been performed on the unencrypted data. As a result, HE can be used for privacy-preserving outsourced storage and computation. This allows the storage and processing of sensitive data to be out-sourced to commercial cloud environments, while still maintaining the security of the data through providing it in encrypted form. Due to this special property, HE has numerous potential applications in data-heavy industries, where one challenge is to gain meaningful insights from data through data analysis while keeping the data itself private. HE has a number of issues when used in applications which requires arithmetic on rational, irrational, and complex numbers. In particular, HE supports encryption and operations on integer and binary numbers but it does not inherently support encryption of rational, irrational, or complex numbers or performing operations on such numbers. As a result, in order to encrypt e.g. a rational number, it needs to be converted into an integer or binary number. This can be done by multiplication Vaultree Ltd. PP25-376-WO – e.g. a rational number can be scaled up to an integer, so that (in a decimal system) the fractional part becomes the less significant digits. As a result, the rate of increase in the magnitude of an output produced as homomorphic multiplications are performed on the ciphertext will increase by the same factor as that used to scale the rational number to an integer. However, the amount of storage space assigned to store plaintext in HE needs to be a predefined and set in advance. As a result, scaling a number such that it can be represented as an integer, causes excessive plaintext growth, which in turn may result in the plaintext outgrowing the storage space allocated to it. In 2016, Cheon, Kim, Kim and Song proposed an approximate homomorphic encryption scheme (CKKS) that supports a special kind of fixed-point arithmetic that is commonly referred to as block floating point arithmetic. CKKS introduced a novel encoding technique and a fast “scaling down” operation, which effectively controls the growth of plaintext. CKKS is recognized as one of the most efficient types of fully homomorphic encryption (FHE) that supports computation on rational, irrational, and complex numbers. Unlike other types of FHE that are designed for integer or binary numbers, CKKS is designed to encrypt and operate on rational, irrational, and complex numbers. This is because CKKS supports a scaling down operation which limits plaintext scaling. Since rational, irrational, and complex numbers are commonly used for many applications including AI, ML, and deep learning (DL), there have been various studies of, and applications using, CKKS. In CKKS, each multiplication consumes a certain amount of ciphertext modulus due to rescaling process. As an operation including a number of homomorphic multiplications progresses, the total ciphertext modulus decreases with each multiplication. Eventually the total ciphertext modulus becomes too small to allow for further multiplications. For this reason, CKKS is sometimes called a levelled FHE scheme. However, a mechanism exists to allow further operations to be performed. In particular, a homomorphic re-encryption of a ciphertext is performed. This is referred to as ‘bootstrapping’, and it is used to recover the ciphertext modulus. In this way, the levelled FHE provided by CKKS can be extended to true FHE. However, bootstrapping is a complex operation which consumes time and power, causing delays and increased power consumption in FHE system that uses it. Vaultree Ltd. PP25-376-WO Object The present disclosure is directed towards providing a method and system that provides true FHE and avoids the need for bootstrapping. In particular, the present application is directed towards a method and system for performing operations on encrypted data that does not require the rescaling process used in the CKKS scheme. As such, the present disclosure is directed to methods and systems for FHE which avoid the need for bootstrapping. By avoiding bootstrapping, the overall energy used and processing time for operations on encrypted data is significantly reduced. Summary The present disclosure is directed towards a method of fully homomorphic encryption, FHE, the method comprising: approximating a number as a rational number wherein the rational number has a numerator and a denominator; encrypting the numerator of the rational number with a predetermined FHE algorithm separately from the denominator; encrypting the denominator of the rational number with the predetermined FHE algorithm separately from the numerator; and whereby the resultant cipher-text comprises the encrypting numerator and the encrypted denominator as separate encrypted numbers. Preferably, the numerator and denominator are integers. Preferably, approximating a number as a rational number comprises: generating a denominator based on a predetermined scaling parameter ^^; and multiplying the number by the denominator and rounding the result to obtain the numerator. Preferably, the denominator equals ^^^^wherein ^^ is the predetermined scaling parameter and ^^ is an scaling index selected based on required numbers of bits of precision required. Preferably, the resultant cipher-text further comprises ^^. Preferably, the method comprises encrypting ^^ with the predetermined FHE algorithm and publishing the result. The present disclosure is also directed towards a method of decrypting a number, comprising: extracting and decrypting an encrypted numerator from the cypher-text; extracting and decrypting an encrypted denominator from the cypher-text; and dividing the numerator by the denominator. The present disclosure is also directed towards a method of multiplying an encrypted first number by an encrypted second number to obtain an encrypted result, the method of multiplying comprises: obtaining an encrypted numerator of the result by the performing an operation on an Vaultree Ltd. PP25-376-WO encrypted numerator of a first number and an encrypted numerator of a second number; and obtaining an encrypted denominator of the result by the performing the operation on the encrypted denominator of the first number and the encrypted denominator of the second number, wherein: the operation is an encrypted multiplication operation performed in the underlying FHE domain. Preferably, the encrypted first number and the encrypted second have been encrypted such that the denominator equals ^^^^wherein ^^ is the predetermined scaling parameter and ^^ is an scaling index selected based on required numbers of bits of precision required and the resultant cipher-text further comprises ^^ and the method of multiplying comprises obtaining a ^^ value for the encrypted result by adding the ^^ value of the first number and the ^^ value of the second number. The present disclosures is also directed towards a method of adding an encrypted first number to an encrypted second number to obtain an encrypted result, the method of adding comprising: obtaining an encrypted numerator of the result by the performing an operation on the encrypted numerator of the first number and the encrypted numerator of the second number, wherein: the operation is an encrypted addition operation performed in the underlying FHE domain. Preferably, the encrypted denominator is the encrypted denominator of the first number, and obtaining the encrypted numerator method comprises: scaling the encrypted numerator of the second number, wherein scaling comprises multiplying the encrypted numerator of the second number by a correction factor, wherein the correction factor is based on the encrypted denominator of the first number and the encrypted denominator of the second number; and performing the operation comprises performing the operation on the encrypted numerator of the first number and the scaled encrypted numerator of the second number. The present disclosure is also directed towards a data processing system comprising means for carrying out any of the methods set out above. The present disclosure is also directed towards a computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out any of the methods set out above. The present disclosure is also directed towards a computer-readable medium comprising instructions which, when executed by a computer, cause the computer to carry out any one of the methods set out above. The present disclosure is also directed towards a data structure for storing an encrypted number comprising: a portion for storing an encrypted denominator of a rational number; and a Vaultree Ltd. PP25-376-WO portion for storing an encrypted numerator of the rational number, wherein: dividing the numerator by the denominator provides an approximation of the number. Preferably, the data structure further comprises: a portion for storing a ^^ value, wherein the ^^ value is an scaling index indicative of a level of precision of the approximation. Detailed Description It is possible to approximate any real number as a rational number with the help of a scaling parameter – e.g. Where ^^ is the scaling parameter, and […] represents a rounding operation to the nearest integer, e.g. [5.1] = 5, and [5.8] = 6. For example: [452 ≈ 100 × 1. ]1. 452145 = 100 100 The resulting rational numbers can be represented as two integers i.e. a numerator and a denominator. Hence an irrational number ^^ can be mapped or approximated by two integers [^^^^] and ^^ such that^^ ≈[^^^^] ^^ , where ^^, the scaling parameter, an integer. Furthermore, if ^^ ≈[^^1^^] [^^2^^]^^1 and ^^ ≈^^2then: ^^ + ^^ ≈[^^1^^] ^^1 and [^^1^^] [^^2^^][^^ ^^] × [^^ ^^]^^ × ^^ ≈× =1 2^^1^^2^^1^^2 then:[^^ ] [ ][^^^^] + [^^^^]^^ + ^^ ≈^^ ^^^^ + = ^^ ^^ ^^ and ^^ × ^^ ≈[^^^^] [^^^^] = [^^^^][^^^^] × ^^ ^^ ^^2 Vaultree Ltd. PP25-376-WO However, if a suitable value is selected for ^^ for a given degree of accuracy then: and This gives us a map for converting any real numbers into a pair of integers defined as follows: Using this map, any real number can be converted into a pair of integers in a way that preserve the approximate homomorphic addition and multiplication properties. As a result, we can encrypt any real number by converting it into a pair of integers and then encrypting the pair of integers using any existing FHE scheme. For example, a plaintext ^^ can be converted into a pair of integers ^^ and ^^ such that ^^ ≈^^ ^^. Integer ^^ and integer ^^ can then be encoded separately from each other to produce enc (^^) and enc (^^), where enc () is any suitable homomorphic encryption scheme for integers and dec () is the corresponding decryption function. However, if the denominator is known to both the entity encrypting ^^ and the entity decrypting enc (^^), then there is no need to encrypt the denominator ^^ when encrypting ^^. Instead, ^^ may be stored in encrypted form as enc (^^). To generate integer ^^, a scaling parameter ^^ is selected. The scaling ^^ may be published so that it is publicly available parameter. For example, an encrypted version of the scaling parameter ^^, enc (^^), may be published (i.e. an encrypted version of the scaling parameter may be made available to the public). Alternatively, the scaling parameter may be a predetermined number known to the entity performing encryption and the entity performing decryption (e.g. they may be the same entity). For example, the scaling parameter may be a shared secret. In this case, the scaling parameter will be known during encryption and decryption. In both cases, there is no need to store the scaling parameter or the denominator with the encrypted numerator ^^. Vaultree Ltd. PP25-376-WO A scaling index ^^ may be selected based on required numbers of bits of precision required. In a system according to the present disclosure, the scaling index is used as a parameter. Preferably, the scaling factor is an integer. ^^ = [^^^^^^], ^^ = ^^^^^^^^is particularly easy to calculate if the scaling parameter ^^=2. Integers ^^ and ^^ are then encrypted using an integer-FHE scheme (e.g. enc (^^), enc (^^)). As ^^ merely indicates a level of precision, it is not essential to encrypt it because it does not provide any significant pointers to the data stored by integers ^^ and ^^. Based on this a cyphertext is obtained: ^^(^^) = ((^^^^^^(^^), ^^^^^^(^^), ^^))As noted above, ^^ (or enc (^^)) may be known by the entity encrypting and by the entity decrypting (e.g. they may be the same entity). As such the cyphertext need not include the encrypted denominator and may be simplified to: ^^(^^) = ((^^^^^^(^^), ^^))Decryption Acyphertext ^^ obtained as set out above may comprise three subcomponents, i.e. ^^ =(^^0, ^^1, ^^2). If ^^ is not encrypted, ^^2 = ^^. Thus, to decrypt ^^, ^^0 is decrypted to obtain ^^1 and ^^1 isdecrypted to obtain ^^2. Next an approximation ^̃^ of the plaintext ^^ is obtained by dividing ^^1by ^^2: Vaultree Ltd. PP25-376-WO As noted above, ^^ (or enc (^^)) may be known by the entity encrypting and by the entity decrypting (e.g. they may be the same entity). Thus, a cyphertext ^^ obtained as set out above maycomprise one or two subcomponents, i.e. ^^ = (^^0) (where there is no scaling index) or ^^ = (^^0, ^^2)(where ^^2 = ^^). As such ^̃^ may be determined using ^^1 (and k, where present). In particular, as thedenominator ^^2may be determined from ^^, there is no need to include the denominator in the cyphertext. Multiplication of Encrypted Data Taking two cyphertexts ^^′ and ^^′′, where ^^′ is an encryption of a first plaintext value (i.e.^^′ = ^^^^^^(^^′)) and ^^′′ is an encryption of a second plaintext value (i.e. ^^′′ = ^^^^^^(^^′′)) and the twocypher text were encrypted as set out above (i.e. ^^′ = (^^0′, ^^1′, ^^2′) and ^^′′ = (^^0′′, ^^1′′, ^^2′′)). If thesetwo cyphertexts are multiplied together we will obtain another cyphertext ^^′′′. ^^′′′ can be calculated using the components of ^^′ and ^^′′. In particular: ^^′′′ ′′ ′′′ ′′0 = ^^′0 ∗ ^^0 , ^^1 = ^^′ ′′′1 ∗ ^^1 , ^^2 = ^^′2 + ^^2′′ In the above equation, * represents an encrypted multiplication operation performed in theunderlying FHE domain – i.e. (^^^^^^(^^) ∗ ^^^^^^(^^)) = ^^^^^^(^^ × ^^).The calculation of ^^′′′can be proved as follows: ^^′′′2 = ^^′ + ^^′′Thus, ^^′′′ = (^^ ′′′ ′′′ ′′′ ′0 , ^^1 , ^^2 ) = ^^^^^^(^^ × ^^′′) Vaultree Ltd. PP25-376-WO As noted above, ^^ (or enc (^^)) may be known by the entity encrypting and by the entity decrypting (e.g. they may be the same entity). As such, ^^1′′′is redundant as it can be calculated from ^^2′′′- i.e. the denominator is a function of the known scaling parameter and k. As such there is no need to calculate or decrypt ^^1′′′. To put it differently, when the scaling parameter is predetermined, there is no need to store or operate on an encrypted denominator. As such, the cyphertext need not include the denominator. Addition of Encrypted Data Taking two cyphertexts ^^′ and ^^′′, where ^^′ is an encryption of a first plaintext value (i.e. ^^′=^^^^^^(^^′)) and ^^′′ is an encryption of a second plaintext value (i.e. ^^′′ = ^^^^^^(^^′′)) and the two cyphertext were encrypted as set out above (i.e. ^^′ = (^^0′, ^^1′, ^^2′) and ^^′′ = (^^0′′, ^^1′′, ^^2′′)). If these twocyphertexts are added together we will obtain another cyphertext ^^′′′. ^^′′′ can be calculated using the components of ^^′ and ^^′′. In particular if: And if ^^′ = ^^′′ = ^^, then: I.e. ^^′′′2 = ^^ = ^^ ′2 = ^^2′′Where ⊕ represents an encrypted addition operation performed in the underlying FHEdomain – i.e. (^^^^^^(^^) ⊕ ^^^^^^(^^)) = ^^^^^^(^^ + ^^). As such, if ^^′ = ^^′′ = ^^, then we can directlyperform addition operation on a rational number encrypted as set out above. Further, as noted above in the discussion of multiplication, as the scaling parameter is known, this can be performed without Vaultree Ltd. PP25-376-WO the need to store or perform a calculation to generate the denominator ^^1′′′and there is no need to decrypt the denominator because it is a function k and the known scaling parameter. However, if ^^′ ≠ ^^′′ (e.g. if ^^′ > ^^′′) then: It is notable that if ^^′ = ^^′′ then if ^^′ > ^^′′: ^^′′′2 = ^^′ = ^^2′By making ^^^^^^(^^)publicly available, ^^^^^^(^^)^^′−^^′′can be easily calculated in the FHE domain using ^^2′and ^^2′′because ^^′2 = ^^′ and ^^ ′′2 = ^^′′.If ^^′ > ^^′′: It is notable, that there is no need to store or perform a calculation to generate the denominator ^^1′′′because it is a function k and the known scaling parameter. While the methods of addition and multiplication can be used to perform calculations on any natural, integer, rational, and (through approximation) real numbers, the method can be extended to handling complex numbers by splitting the imaginary number into its real an imaginary portions and then i) approximating the real portion as rational number as set out above; and similarly ii) approximating the imaginary portion as rational number as set out above. Vaultree Ltd. PP25-376-WO As a result, a method in accordance with the present disclosure avoids the need for a rescaling process as described in the CKKS scheme, because it avoids the ciphertext modulus being decreased after each multiplication. Thus, bootstrapping not required. As a result, speed of performing operations over encrypted data is increased. Further increases of speed are obtained by removing the need to perform operations on the denominator of the rational number. This is significant because it enables the encryption of real and complex number in such a way that long sequences of operations can be performed on the encrypted data at speed without the need to perform bootstrapping. This means that e.g. encrypted data can be easily multiple different weights in sequence. Thus, the present method of encryption is particularly well suited to machine learning applications and use in neural networks, enabling machine learning and deep learning to be performed on encrypted data. In addition, as ^^ division by ^^ in the encrypteddomain becomes possible by inverting ^^ (i.e. swapping a and b) and then using multiplication.E.g. because ^^(^^) = ((^^^^^^(^^), ^^^^^^(^^), ^^)), ^^ (1 ^^) = ((^^^^^^(^^), ^^^^^^(^^), ^^)).Taking two cyphertexts ^^′ and ^^′′, where ^^′ is an encryption of a first plaintext value (i.e.^^′ = ^^^^^^(^^′)) and ^^′′ is an encryption of a second plaintext value (i.e. ^^′′ = ^^^^^^(^^′′)) and the twocypher text were encrypted as set out above (i.e. ^^′ = (^^0′, ^^1′, ^^2′) and ^^′′ = (^^0′′, ^^1′′, ^^2′′)). If wewish to divide ^^′ by ^^′′to obtain another cyphertext ^^′′′, ^^′′′ can be calculated using the components of ^^′ and ^^′′. In particular: ^^′′′0 = ^^′1 ∗ ^^ ′′0 , ^^ ′′′1 = ^^′0 ∗ ^^ ′′1 , ^^ ′′′2 = ^^′2 + ^^2′′^^′′′ = (^^ ′′′ ′′′0 , ^^1 , ^^2′′′) In the above equation, * represents a multiplication operation in the underlying FHE domain– i.e. (^^^^^^(^^) ∗ ^^^^^^(^^)) = ^^^^^^(^^ × ^^).The calculation of ^^′′′can be proved as follows: ^^′ = (^^0′, ^^1′, ^^2′) = (^^^^^^(^^′), ^^^^^^(^^′), ^^′),^^′′ = (^^0′′, ^^1′′, ^^2′′) = (^^^^^^(^^′′), ^^^^^^(^^′′), ^^′′)^^′′′0 = ^^^^^^(^^′) ∗ ^^^^^^(^^′′) Vaultree Ltd. PP25-376-WO ^^′′′1 = ^^^^^^(^^′) ∗ ^^^^^^(^^′′)^^′′′2 = ^^′ + ^^′′Thus, However, this comes at the cost of requiring the denominator to be stored for further operations. The description set out above intended to enable any person skilled in the art to obtain the benefit of the present disclosure. Those skilled in the art will recognise that various modifications to the disclosure are possible, and the generic principles defined herein may be applied to other variations, without departing from the spirit or scope of the present disclosure. Thus, the present disclosure is not intended to be limited to the examples and designs described herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

Vaultree Ltd. PP25-376-WO Claims 1. A method of fully homomorphic encryption, FHE, the method comprising: approximating a number as a rational number wherein the rational number has a numerator and a denominator, wherein approximating the number as a rational number comprises: determining the denominator based on a scaling parameter ^^; and multiplying the number by the denominator and rounding the result to obtain the numerator; and encrypting the numerator with a predetermined FHE algorithm separately from the denominator; whereby the resultant cipher-text comprises the encrypted numerator.

2. The method of claim 1, wherein the resultant cipher-text does not include the denominator.

3. The method of claim 1 or 2, wherein the denominator equals ^^^^wherein ^^ is the scaling parameter and ^^ is an scaling index selected based on required numbers of bits of precision required.

4. The method of claim 3, wherein the resultant cipher-text further comprises ^^.

5. The method of any preceding claim, wherein ^^ is a predetermined number.

6. The method of any one of claims 1 to 4, comprising publishing ^^.

7. The method of claim 6, wherein ^^ is encrypted with the predetermined FHE before it is published.

8. The method of claim 1, wherein the numerator and denominator are integers.

9. A method of decrypting a number encrypted according to any preceding claim, comprising: extracting and decrypting the encrypted numerator from the cipher-text; obtaining the denominator; andVaultree Ltd. PP25-376-WO dividing the numerator by the denominator.

10. A method of multiplying an encrypted first number by an encrypted second number to obtain an encrypted result, wherein the first and second numbers have been according to the method of any one of claims 1 to 8, the method of multiplying comprising: obtaining an encrypted numerator of the result by the performing an operation on the encrypted numerator of the first number and the encrypted numerator of the second number, wherein: the operation is an encrypted multiplication operation performed in the underlying FHE domain.

11. The method of claim 10, wherein the encrypted first number and the encrypted second have been encrypted using a method according to claim 3, further comprising obtaining a ^^ value for the encrypted result by adding the ^^ value of the first number and the ^^ value of the second number.

12. A method of adding an encrypted first number to an encrypted second number to obtain an encrypted result, wherein the first and second numbers have been according to the method of any one of claims 1 to 8, the method of adding comprising: obtaining an encrypted numerator of the result by the performing an operation on the encrypted numerator of the first number and the encrypted numerator of the second number, wherein: the operation is an encrypted addition operation performed in the underlying FHE domain.

13. The method of claim 12, when dependent upon claim 3, wherein: obtaining the encrypted numerator method comprises: scaling the encrypted numerator of the second number, wherein scaling comprises multiplying the encrypted numerator of the second number by a correction factor, wherein the correction factor is based on the value of ^^ for the first number and the value of ^^ for the second number; andVaultree Ltd. PP25-376-WO performing the operation comprises performing the operation on the encrypted numerator of the first number and the scaled encrypted numerator of the second number.

14. A data processing system comprising means for carrying out the method of any preceding claim.

15. A computer program comprising instructions which, when the program is executed by a computer, cause the computer to carry out a method according to any preceding claim.

16. A computer-readable medium comprising instructions which, when executed by a computer, cause the computer to carry out a method according to any preceding claim.

17. A data structure for storing an encrypted number comprising: a portion for storing an encrypted numerator of a rational number, wherein: dividing the numerator by a denominator in the plain-text domain provides an approximation of the plain-text version of the encrypted number.

18. The data structure of claim 17, which does not include a potion for storing the denominator.

19. The data structure of claim 17 or 18, further comprising: a portion for storing a ^^ value, wherein the ^^ value is an scaling index indicative of a level of precision of the approximation.