Homomorphic computing device, homomorphic computing method, homomorphic computing program, and confidential information processing system

Abstract

A boot strapping processing unit (414) generates a new ciphertext C'PK (m) by performing homomorphic computation processing by using, as inputs, a decryption circuit for decrypting, with a decryption key SK, a ciphertext CPK (m) in which plaintext m is encrypted by using an encryption key PK, and a bootstrapping key BK generated by encrypting the decryption key SK by using the encryption key PK. A homomorphic computation unit (416) generates a post-computation ciphertext CPK (M) by performing homomorphic computation processing by using a computation circuit f and the new ciphertext C'PK(m) as inputs.

Description

Homomorphic computing device, homomorphic computing method, homomorphic computing program, and secret information processing system

[0001] This disclosure relates to a technique called circuit secrecy plus homomorphic encryption.

[0002] Homomorphic encryption is an encryption technology that allows data to be processed while it remains encrypted. While the use of cloud services has become widespread in recent years, concerns about cracking and the reliability of cloud services mean that data is encrypted and stored in the cloud. Homomorphic encryption allows operations to be performed on encrypted data without decrypting it. This technology makes it possible to use cloud services without compromising security.

[0003] In order to improve the security of homomorphic encryption, homomorphic encryption that satisfies circuit secrecy is an encryption technology that achieves security by preventing information about the arithmetic processing from leaking from the encrypted arithmetic results. In particular, among homomorphic encryptions that satisfy circuit secrecy, homomorphic encryption that achieves security by preventing information about the arithmetic processing from leaking from the encrypted arithmetic results for ciphertext that is not generated by a specified encryption algorithm is said to satisfy circuit secrecy+. The first example of a homomorphic encryption that satisfies circuit secrecy+ is described in Non-Patent Document 1.

[0004] Adi Akavia, Craig Gentry, Shai Halevi, and Margarita Vald. Achievable CCA2 Relaxation for Homomorphic Encryption. In TCC, 2022.

[0005] Conventional homomorphic encryption that satisfies circuit secrecy+ requires multiple executions of a computational process called bootstrapping, which performs decryption while the data is encrypted, before and after the computational process while the data is encrypted. The bootstrapping process is a computational process that calculates the decryption process of an encryption method while the data is encrypted, and is known to be very inefficient. In particular, the homomorphic encryption technology disclosed in Non-Patent Document 1 requires multiple executions of bootstrapping before and after the computational process while the data is encrypted, and is therefore very inefficient. The present disclosure aims to realize homomorphic encryption that can achieve circuit secrecy+ with a single bootstrapping process.

[0006] The homomorphic arithmetic device according to the present disclosure encrypts plaintext m using an encryption key PK to generate ciphertext C ＰＫ A decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is input to perform homomorphic computation to generate a new ciphertext C' ＰＫ a bootstrapping unit that generates (m); an arithmetic circuit f; and the new ciphertext C′ generated by the bootstrapping unit. ＰＫ (m) is input and homomorphic operation is performed to obtain the ciphertext C ＰＫ and a homomorphic computation unit that generates (M).

[0007] In the present disclosure, a decryption circuit and a bootstrapping key are used as inputs to perform homomorphic arithmetic processing. By this homomorphic arithmetic processing, the ciphertext C is converted into ＰＫ (m) is decrypted to obtain the new ciphertext C' of the plaintext m. ＰＫ (m) is generated. This results in the generation of ciphertext C that has not been generated by the specified encryption algorithm. ＰＫ (m) is a new ciphertext C' generated by a specified encryption algorithm. ＰＫ (m) can be converted into the new ciphertext C' ＰＫBy performing homomorphic arithmetic processing on (m), it is possible to achieve circuit secrecy+. Here, the homomorphic arithmetic processing performed on the bootstrapping key is the bootstrapping processing. In other words, it is possible to achieve circuit secrecy+ with a single bootstrapping processing.

[0008] FIG. 1 is a configuration diagram of a secret information processing system 100 according to embodiment 1. FIG. 2 is a configuration diagram of a key generation device 200 according to embodiment 1. FIG. 3 is a configuration diagram of an encryption device 300 according to embodiment 1. FIG. 4 is a configuration diagram of a homomorphic arithmetic device 400 according to embodiment 1. FIG. 5 is a configuration diagram of a decryption device 500 according to embodiment 1. FIG. 6 is a flowchart of key generation processing according to embodiment 1. FIG. 7 is a flowchart of arithmetic processing according to embodiment 1.

[0009] First Embodiment *** Description of Configuration *** The configuration of a secret information processing system 100 according to the first embodiment will be described with reference to Fig. 1. The secret information processing system 100 includes a key generation device 200, an encryption device 300, a homomorphic arithmetic device 400, and a decryption device 500. The key generation device 200, the encryption device 300, the homomorphic arithmetic device 400, and the decryption device 500 are connected via the Internet 900. The Internet 900 is an example of a transmission path. Other types of transmission paths may be used instead of the Internet 900.

[0010] The configuration of a key generation device 200 according to the first embodiment will be described with reference to Fig. 2. The key generation device 200 is a computer such as a PC. PC stands for Personal Computer. The key generation device 200 generates a decryption key SK, an encryption key PK, and a bootstrapping key BK. The key generation device 200 includes hardware components: a processor 201, a memory 202, a storage 203, and a communication interface 204. The processor 201 is connected to other hardware components via signal lines and controls the other hardware components.

[0011] The key generation device 200 includes, as functional components, an input unit 211, a decryption key generation unit 212, an encryption key generation unit 213, a bootstrapping key generation unit 214, and a transmission unit 215. The functions of each functional component of the key generation device 200 are realized by software. A storage 203 stores a program that realizes the function of each functional component of the key generation device 200. This program is loaded into the memory 202 by the processor 201 and executed by the processor 201. In this way, the function of each functional component of the key generation device 200 is realized.

[0012] The configuration of an encryption device 300 according to the first embodiment will be described with reference to Fig. 3. The encryption device 300 is a computer such as a PC. The encryption device 300 encrypts plaintext m using an encryption key PK. The encryption device 300 includes the following hardware components: a processor 301, a memory 302, a storage 303, and a communication interface 304. The processor 301 is connected to other hardware components via signal lines and controls the other hardware components.

[0013] The encryption device 300 includes, as functional components, an input unit 311, an encryption key storage unit 312, an encryption unit 313, and a transmission unit 314. The functions of each functional component of the encryption device 300 are realized by software. A storage 303 stores a program that realizes the function of each functional component of the encryption device 300. This program is loaded into the memory 302 by the processor 301 and executed by the processor 301. In this way, the function of each functional component of the encryption device 300 is realized.

[0014] The configuration of a homomorphic arithmetic device 400 according to the first embodiment will be described with reference to Fig. 4. The homomorphic arithmetic device 400 is a computer such as a server having a large-capacity storage 403. The homomorphic arithmetic device 400 performs homomorphic operations on ciphertexts. The homomorphic arithmetic device 400 also functions as a data storage device that stores the ciphertexts. The homomorphic arithmetic device 400 includes hardware such as a processor 401, a memory 402, a storage 403, and a communication interface 404. The processor 401 is connected to other hardware via signal lines and controls the other hardware.

[0015] The homomorphic computing device 400 includes, as functional components, an input unit 411, an encryption key storage unit 412, a bootstrapping key storage unit 413, a bootstrapping processing unit 414, a ciphertext storage unit 415, a homomorphic computing unit 416, and a transmission unit 417. The functions of each functional component of the homomorphic computing device 400 are realized by software. A storage 403 stores a program that realizes the function of each functional component of the homomorphic computing device 400. This program is read into the memory 402 by the processor 401 and executed by the processor 401. In this way, the function of each functional component of the homomorphic computing device 400 is realized.

[0016] The configuration of a decryption device 500 according to the first embodiment will be described with reference to Fig. 5 . The decryption device 500 is a computer such as a PC. The decryption device 500 decrypts ciphertext using a decryption key SK. The decryption device 500 also functions as a decryption key storage device that stores the decryption key SK. The decryption device 500 includes hardware components including a processor 501, a memory 502, a storage 503, and a communication interface 504. The processor 501 is connected to other hardware components via signal lines and controls the other hardware components.

[0017] The decryption device 500 includes, as functional components, an input unit 511, a decryption key storage unit 512, a decryption processing unit 513, and a decryption result storage unit 514. The functions of each functional component of the decryption device 500 are realized by software. A storage 503 stores a program that realizes the function of each functional component of the decryption device 500. This program is read into the memory 502 by the processor 501 and executed by the processor 501. In this way, the function of each functional component of the decryption device 500 is realized.

[0018] Note that one computer may simultaneously include the functions of at least two or more devices, namely, the key generation device 200, the encryption device 300, the homomorphic arithmetic device 400, and the decryption device 500.

[0019] The processors 201, 301, 401, and 501 are ICs that perform processing. IC stands for Integrated Circuit. Specific examples of the processors 201, 301, 401, and 501 are CPUs, DSPs, and GPUs. CPU stands for Central Processing Unit. DSP stands for Digital Signal Processor. GPU stands for Graphics Processing Unit.

[0020] The memories 202, 302, 402, and 502 are storage devices that temporarily store data. Specific examples of the memories 202, 302, 402, and 502 include SRAM and DRAM. SRAM stands for Static Random Access Memory. DRAM stands for Dynamic Random Access Memory.

[0021] The storages 203, 303, 403, and 503 are storage devices that store data. Specific examples of the storages 203, 303, 403, and 503 are HDDs. HDD stands for Hard Disk Drive. The storages 203, 303, 403, and 503 may also be portable recording media such as SD (registered trademark) memory cards, CompactFlash (registered trademark), NAND flash, flexible disks, optical disks, compact disks, Blu-ray (registered trademark) disks, and DVDs. SD stands for Secure Digital. DVD stands for Digital Versatile Disk.

[0022] The communication interfaces 204, 304, 404, and 504 are interfaces for communicating with external devices. Specific examples of the communication interfaces 204, 304, 404, and 504 are Ethernet (registered trademark), USB, and HDMI (registered trademark) ports. USB is an abbreviation for Universal Serial Bus. HDMI is an abbreviation for High-Definition Multimedia Interface.

[0023] There may be a plurality of processors 201, 301, 401, and 501, and the plurality of processors 201, 301, 401, and 501 may cooperate to execute programs that realize the respective functions.

[0024] ***Description of Operation*** The operation of the secret information processing system 100 according to the first embodiment will be described with reference to Figs. 6 and 7. The operation procedure of the secret information processing system 100 according to the first embodiment corresponds to the secret information processing method according to the first embodiment. Moreover, a program that realizes the operation of the secret information processing system 100 according to the first embodiment corresponds to the secret information processing program according to the first embodiment. The operation procedure of the homomorphic arithmetic device 400 in the secret information processing system 100 according to the first embodiment corresponds to the homomorphic arithmetic method according to the first embodiment. Moreover, a program that realizes the operation of the homomorphic arithmetic device 400 in the secret information processing system 100 according to the first embodiment corresponds to the homomorphic arithmetic program according to the first embodiment.

[0025] The operation of the secret information processing system 100 includes key generation processing and arithmetic processing.

[0026] The key generation process according to the first embodiment will be described with reference to Fig. 6. (Step S101: Security Parameter Receiving Process) The input unit 211 of the key generation device 200 receives an input of a security parameter λ. The input unit 211 transmits the security parameter λ to the decryption key generation unit 212.

[0027] (Step S102: Decryption Key Generation Process) The decryption key generation unit 212 of the key generation device 200 receives the security parameter λ received in step S101 as input and generates the decryption key SK. The decryption key generation unit 212 transmits the decryption key SK to the encryption key generation unit 213, the bootstrapping key generation unit 214, and the transmission unit 215. Here, the decryption key generation unit 212 generates the decryption key SK using a key generation algorithm in a homomorphic encryption method with circuit confidentiality. In the first embodiment, the decryption key generation unit 212 generates the decryption key SK using the key generation algorithm in the reference document. The reference is "Florian Bourse, Rafael Del Pino, Michele Minelli, and Hoeteck Wee. FHE Circuit Privacy Almost For Free. In CRYPTO, 2016."

[0028] (Step S103: Encryption Key Generation Process) The encryption key generation unit 213 of the key generation device 200 receives the decryption key SK generated in step S102 as input and generates an encryption key PK. The encryption key generation unit 213 transmits the encryption key PK to the bootstrapping key generation unit 214 and the transmission unit 215. Here, the encryption key generation unit 213 generates the encryption key PK using a key generation algorithm in a homomorphic encryption method with circuit confidentiality. In the first embodiment, the encryption key generation unit 213 generates the encryption key PK using the key generation algorithm in the reference document.

[0029] If the key generation algorithm in the reference document is KeyGen, the processes in steps S102 and S103 can be written as shown in Equation 1.

[0030] (Step S104: Bootstrapping Key Generation Process) The bootstrapping key generation unit 214 of the key generation device 200 generates a bootstrapping key BK using the decryption key SK generated in step S102 and the encryption key PK generated in step S103 as input. Specifically, the bootstrapping key generation unit 214 generates the bootstrapping key BK by encrypting the decryption key SK with the encryption key PK. The bootstrapping key generation unit 214 transmits the bootstrapping key BK to the transmission unit 215. Here, the bootstrapping key generation unit 214 generates the bootstrapping key BK by encrypting the decryption key SK with the encryption key PK using an encryption algorithm in a homomorphic encryption scheme with circuit confidentiality. The encryption algorithm used here is a specified encryption algorithm required to satisfy circuit confidentiality +. In the first embodiment, the bootstrapping key generation unit 214 generates the bootstrapping key BK by encrypting the decryption key SK with the encryption key PK using the encryption algorithm in the reference document.

[0031] If the encryption algorithm in the reference document is Enc, the process of step S104 can be written as in Equation 2.

[0032] (Step S105: Key Transmission Process) The transmission unit 215 of the key generation device 200 transmits the encryption key PK generated in step S103 to the encryption device 300 via the Internet 900. The transmission unit 215 also transmits the encryption key PK generated in step S103 and the bootstrapping key BK generated in step S104 to the homomorphic computing device 400 via the Internet 900. The transmission unit 215 also transmits the decryption key SK generated in step S102 to the decryption device 500 via the Internet 900. Since the decryption key SK is confidential information, it is transmitted in a manner that prevents it from being leaked. The encryption key PK, decryption key SK, and bootstrapping key BK may be transmitted by mail or other methods.

[0033] (Step S106: First Key Reception Process) The input unit 311 of the encryption device 300 receives the encryption key PK transmitted in step S105. The input unit 311 transmits the encryption key PK to the encryption key storage unit 312.

[0034] (Step S107: First Key Storage Process) The encryption key storage unit 312 of the encryption device 300 stores the encryption key PK received in step S106 in the storage 303.

[0035] (Step S108: Second Key Reception Process) The input unit 411 of the homomorphic computing device 400 receives the encryption key PK and the bootstrapping key BK transmitted in step S105. The input unit 411 transmits the encryption key PK to the encryption key storage unit 412 and transmits the bootstrapping key BK to the bootstrapping key storage unit 413.

[0036] (Step S109: Second Key Storage Process) The encryption key storage unit 412 of the homomorphic computing device 400 stores the encryption key PK received in step S108 in the storage 403. In addition, the bootstrapping key storage unit 413 stores the bootstrapping key BK received in step S108 in the storage 403.

[0037] (Step S110: Third Key Receiving Process) The input unit 511 of the decryption device 500 receives the decryption key SK transmitted in step S105. The input unit 511 transmits the decryption key SK to the decryption key storage unit 512.

[0038] (Step S111: Third Key Storage Process) The decryption key storage unit 512 of the decryption device 500 stores the decryption key SK received in step S110 in the storage 503. Since the decryption key SK is confidential information, it is stored so as not to be leaked.

[0039] The computation process according to the first embodiment will be described with reference to Fig. 7. (Step S201: Plaintext Receiving Process) The input unit 311 of the encryption device 300 receives input of plaintext m. The plaintext m is, for example, data collected from a sensor or the like. The input unit 311 transmits the plaintext m to the encryption unit 313.

[0040] (Step S202: Encryption Process) The encryption unit 313 of the encryption device 300 encrypts the plaintext m received in step S201 using the encryption key PK stored in the storage 303 to generate ciphertext C ＰＫ The encryption unit 313 generates the ciphertext C ＰＫ The encryption unit 313 encrypts the plaintext m with the encryption key PK using an encryption algorithm in the homomorphic encryption method with circuit confidentiality, and transmits the encrypted text C ＰＫ In the first embodiment, the encryption unit 313 encrypts the plaintext m with the encryption key PK using the encryption algorithm in the reference document to generate the ciphertext C ＰＫ (m) Note that the encryption algorithm used here may not be the specified encryption algorithm required to satisfy circuit secrecy+.

[0041] If the encryption algorithm in the reference document is Enc, the process of step S202 can be written as in Equation 3.

[0042] (Step S203: Ciphertext Transmission Process) The transmission unit 314 of the encryption device 300 transmits the ciphertext C generated in step S202 via the Internet 900. ＰＫ (m) is transmitted to the homomorphic computing device 400.

[0043] (Step S204: Ciphertext Reception Process) The input unit 411 of the homomorphic arithmetic device 400 receives the ciphertext C transmitted in step S203. ＰＫ The input unit 411 receives the ciphertext C ＰＫ (m) is sent to the bootstrapping processing unit 414.

[0044] (Step S205: Ciphertext Conversion Process) The bootstrapping processing unit 414 of the homomorphic arithmetic device 400 converts the ciphertext C received in step S204 into ＰＫ A decryption circuit decrypts (m) with a decryption key SK, and performs homomorphic computation using the bootstrapping key BK stored in the storage 403 as input to generate a new ciphertext C' ＰＫThat is, the bootstrapping processing unit 414 applies the arithmetic processing of the decryption circuit to the bootstrapping key BK while it remains encrypted. ＰＫ (m) is transmitted to the ciphertext storage unit 415. Here, the bootstrapping processing unit 414 performs homomorphic computation using a homomorphic computation algorithm in a homomorphic encryption method with circuit confidentiality. In the first embodiment, the bootstrapping processing unit 414 performs homomorphic computation using the homomorphic computation algorithm in the reference document.

[0045] The decryption algorithm in the reference is Dec, and the homomorphic operation algorithm in the reference is Eval. Then, the decryption circuit can be written as in Equation 4. Here, the ciphertext C ＰＫ It can be considered that (m) is set as a fixed value inside the decoding circuit. The process of step S205 can be written as in Equation 5.

[0046] The bootstrapping key BK is the ciphertext of the decryption key SK. Therefore, by performing the homomorphic operation shown in Equation 5, the ciphertext C ＰＫ (m) is decrypted to obtain a new ciphertext C' of the plaintext m. ＰＫ (m) is generated. Here, new ciphertext C' ＰＫ When generating (m), the encryption algorithm that generated the input ciphertext is used. Here, the input ciphertext is the bootstrapping key BK. Therefore, the encryption algorithm used to generate the bootstrapping key BK generates a new ciphertext C' of the plaintext m. ＰＫ As a result, a new ciphertext C' ＰＫ (m) is a ciphertext encrypted by a specified encryption algorithm. In other words, a ciphertext C encrypted by an encryption algorithm other than the specified encryption algorithm is ＰＫ (m) is a new ciphertext C′ encrypted by a specified encryption algorithm. ＰＫ (m).

[0047] (Step S206: Ciphertext Storage Process) The ciphertext storage unit 415 of the homomorphic arithmetic device 400 stores the new ciphertext C′ generated in step S205. ＰＫ (m) is stored in the storage 403.

[0048] (Step S207: Computation Acceptance Process) The input unit 411 of the homomorphic computing device 400 accepts input of a computation circuit f. The computation circuit f is a circuit in which an arbitrary computation is defined. The input unit 411 transmits the computation circuit f to the homomorphic computing unit 416.

[0049] (Step S208: Operation Execution Process) The homomorphic operation unit 416 of the homomorphic operation device 400 executes an operation by combining the operation circuit f received in step S207 with the new ciphertext C′ stored in the storage 403. ＰＫ (m) and (m) are input and subjected to homomorphic operation processing to obtain the post-operation ciphertext C, which is the ciphertext of the operation result data M. ＰＫ That is, the homomorphic computation unit 416 generates a new ciphertext C' ＰＫ (m) is subjected to the arithmetic processing of the arithmetic circuit f while still encrypted, and the ciphertext C ＰＫ Here, M=f(m). That is, M represents the result of applying the arithmetic processing of the arithmetic circuit f to the plaintext m. The homomorphic arithmetic unit 416 generates the post-operation ciphertext C ＰＫ The homomorphic computation unit 416 transmits (M) to the transmitting unit 417. Here, the homomorphic computation unit 416 performs homomorphic computation using a homomorphic computation algorithm in a homomorphic encryption method with circuit confidentiality. In the first embodiment, the homomorphic computation unit 416 performs homomorphic computation using the homomorphic computation algorithm in the reference document.

[0050] If the homomorphic computation algorithm in the reference document is Eval, the process of step S208 can be written as in Equation 6.

[0051] (Step S209: Post-operation ciphertext transmission process) The transmission unit 417 of the homomorphic arithmetic device 400 transmits the post-operation ciphertext C generated in step S208 via the Internet 900. ＰＫ (M) is transmitted to the decoding device 500.

[0052] (Step S210: Calculated Ciphertext Receiving Process) The input unit 511 of the decryption device 500 receives the calculated ciphertext C transmitted in step S209. ＰＫ The input unit 511 receives the post-operation ciphertext C ＰＫ (M) is sent to the decoding processing unit 513.

[0053] (Step S211: Decryption Process) The decryption processing unit 513 of the decryption device 500 decrypts the post-operation ciphertext C received in step S210. ＰＫ The decryption processing unit 513 decrypts (M) with the decryption key SK stored in the storage 503 to generate the decryption result D. The decryption processing unit 513 transmits the decryption result D to the decryption result storage unit 514. Here, the decryption processing unit 513 uses a decryption algorithm in a homomorphic encryption method with circuit confidentiality to generate the decrypted ciphertext C ＰＫ In the first embodiment, the decryption processing unit 513 decrypts the ciphertext C (M) using the decryption key SK. ＰＫ (M) is decrypted with the decryption key SK.

[0054] If the decoding algorithm in the reference document is Dec, the process of step S211 can be written as in Equation 7.

[0055] (Step S212: Decoding Result Storage Process) The decryption result storage unit 514 of the decryption device 500 stores the decryption result D generated in step S211 in the storage 503.

[0056] 7 may be divided into a ciphertext storage process from step S201 to step S206 and an operation application process from step S207 to step S212. In this case, in step S207, the input unit 411 receives a new ciphertext C' to which the operation circuit f is applied. ＰＫ Then, in step S208, the homomorphic computation unit 416 performs the following operation on the specified new ciphertext C'. ＰＫ All that is required is to perform homomorphic arithmetic processing on (m).

[0057] ***Effects of First Embodiment*** As described above, the secret information processing system 100 according to the first embodiment performs homomorphic arithmetic processing using the decryption circuit and the bootstrapping key BK as input. By this homomorphic arithmetic processing, the ciphertext C is converted into a ciphertext C without being encrypted. ＰＫ (m) is decrypted to obtain the new ciphertext C' of the plaintext m. ＰＫ (m) is generated. This results in the generation of ciphertext C that has not been generated by the specified encryption algorithm. ＰＫ (m) is a new ciphertext C' generated by a specified encryption algorithm. ＰＫ (m) can be converted into the new ciphertext C' ＰＫ By performing homomorphic arithmetic processing on (m), it is possible to achieve circuit secrecy+. Here, the homomorphic arithmetic processing performed on the bootstrapping key is the bootstrapping processing. In other words, it is possible to achieve circuit secrecy+ with just one bootstrapping processing.

[0058] ***Other Configurations*** <Modification 1> In the first embodiment, each functional component is realized by software. However, in Modification 1, each functional component may be realized by hardware. The differences between Modification 1 and the first embodiment will be described below.

[0059] When each functional component is realized by hardware, the key generation device 200 includes an electronic circuit instead of the processor 201, the memory 202, and the storage 203. The electronic circuit is a dedicated circuit that realizes the functions of each functional component, the memory 202, and the storage 203.

[0060] Similarly, when each functional component is realized by hardware, the encryption device 300 includes an electronic circuit in place of the processor 301, the memory 302, and the storage 303. The electronic circuit is a dedicated circuit that realizes the functions of each functional component, the memory 302, and the storage 303.

[0061] Similarly, when each functional component is realized by hardware, the homomorphic computing device 400 includes an electronic circuit in place of the processor 401, the memory 402, and the storage 403. The electronic circuit is a dedicated circuit that realizes the functions of each functional component, the memory 402, and the storage 403.

[0062] Similarly, when each functional component is realized by hardware, the decoding device 500 includes an electronic circuit instead of the processor 501, the memory 502, and the storage 503. The electronic circuit is a dedicated circuit for realizing the functions of each functional component, the memory 502, and the storage 503.

[0063] Possible electronic circuits include a single circuit, a composite circuit, a programmed processor, a parallel programmed processor, a logic IC, a GA, an ASIC, and an FPGA. GA stands for Gate Array. ASIC stands for Application Specific Integrated Circuit. FPGA stands for Field-Programmable Gate Array. Each functional component may be realized by a single electronic circuit, or each functional component may be distributed across multiple electronic circuits.

[0064] <Modification 2> As a modification 2, some of the functional components may be realized by hardware, and other functional components may be realized by software.

[0065] The processors 201, 301, 401, and 501, the memories 202, 302, 402, and 502, the storages 203, 303, 403, and 503, and the electronic circuits are collectively referred to as a processing circuit. In other words, the functions of the respective functional components are realized by the processing circuit.

[0066] Furthermore, the term "unit" in the above description may be read as a "circuit," "step," "procedure," "process," or "processing circuit."

[0067] Hereinafter, various aspects of the present disclosure will be described together as appendices. (Appendix 1) A ciphertext C is obtained by encrypting a plaintext m using an encryption key PK. ＰＫA decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is input to perform homomorphic computation to generate a new ciphertext C' ＰＫ a bootstrapping unit that generates (m); an arithmetic circuit f; and the new ciphertext C′ generated by the bootstrapping unit. ＰＫ (m) is input and homomorphic operation is performed to obtain the ciphertext C ＰＫ and a homomorphic arithmetic unit that generates ciphertext C (M). (Supplementary Note 2) The homomorphic arithmetic device according to Supplementary Note 1, wherein the homomorphic arithmetic processing is a homomorphic arithmetic processing in a homomorphic encryption method having circuit confidentiality. (Supplementary Note 3) The homomorphic arithmetic device according to Supplementary Note 2, wherein the encryption key PK and the decryption key SK are the encryption key and the decryption key in the homomorphic encryption method. (Supplementary Note 4) A homomorphic arithmetic device according to Supplementary Note 1, wherein a computer generates ciphertext C obtained by encrypting plaintext m using encryption key PK. ＰＫ A decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is input to perform homomorphic computation to generate a new ciphertext C' ＰＫ (m), and the computer generates the new ciphertext C' using the arithmetic circuit f. ＰＫ (m) is input and homomorphic operation is performed to obtain the ciphertext C ＰＫ (Supplementary Note 5) A homomorphic computation method for generating a ciphertext C obtained by encrypting a plaintext m using an encryption key PK. ＰＫ A decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is input to perform homomorphic computation to generate a new ciphertext C' ＰＫ a bootstrapping process for generating (m); an arithmetic circuit f; and the new ciphertext C′ generated by the bootstrapping process. ＰＫ (m) is input and homomorphic operation is performed to obtain the ciphertext C ＰＫ (Appendix 6) A homomorphic computation program that causes a computer to function as a homomorphic computation device that performs homomorphic computation to generate a ciphertext C by encrypting a plaintext m using an encryption key PK.ＰＫ (m), and the ciphertext C generated by the encryption device ＰＫ (m) to generate new ciphertext C' ＰＫ (m), and the operation circuit f and the new ciphertext C' ＰＫ (m) is input and homomorphic operation is performed to obtain the ciphertext C ＰＫ a homomorphic arithmetic unit that generates (M), and a post-operation ciphertext C generated by the homomorphic arithmetic unit ＰＫ and a decryption device that decrypts the ciphertext C (M) with a decryption key SK, ＰＫ A decryption circuit that decrypts (m) with the decryption key SK and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is used as an input to perform homomorphic arithmetic processing to generate the new ciphertext C' ＰＫ A secret information processing system that generates (m).

[0068] The embodiments and modifications of the present disclosure have been described above. Some of these embodiments and modifications may be combined and implemented. Furthermore, one or more of them may be implemented partially. Note that the present disclosure is not limited to the above embodiments and modifications, and various modifications are possible as needed.

[0069] 100 Secret information processing system, 200 Key generation device, 300 Encryption device, 400 Homomorphic arithmetic device, 500 Decryption device, 201 Processor, 202 Memory, 203 Storage, 204 Communication interface, 211 Input unit, 212 Decryption key generation unit, 213 Encryption key generation unit, 214 Bootstrapping key generation unit, 215 Transmission unit, 301 Processor, 302 Memory, 303 Storage, 304 Communication interface, 311 Input unit, 312 Encryption key storage unit, 313 Encryption unit, 314 Transmission unit, 401 Processor, 402 Memory, 403 Storage, 404 Communication interface, 411 Input unit, 412 Encryption key storage unit, 413 Bootstrapping key storage unit, 414 Bootstrapping processing unit, 415 Ciphertext storage unit, 416 Homomorphic arithmetic unit, 417 Transmitter 501, processor 502, memory 503, storage 504, communication interface 511, input unit 512, decryption key storage unit 513, decryption processing unit 514, decryption result storage unit 900, Internet.

Claims

1. Ciphertext C is the plaintext m encrypted using the encryption key PK. ＰＫ A decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is input to perform homomorphic computation to generate a new ciphertext C' ＰＫ a bootstrapping unit that generates (m); an arithmetic circuit f; and the new ciphertext C′ generated by the bootstrapping unit. ＰＫ (m) is input and homomorphic operation is performed to obtain the ciphertext C ＰＫ and a homomorphic arithmetic unit that generates (M).

2. The homomorphic computing device according to claim 1, wherein the homomorphic computing process is a homomorphic computing process in a homomorphic encryption method with circuit confidentiality.

3. The homomorphic computing device according to claim 2, wherein the encryption key PK and the decryption key SK are encryption and decryption keys in the homomorphic encryption method.

4. The computer generates ciphertext C, which is the plaintext m encrypted using the encryption key PK. ＰＫ A decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is input to perform homomorphic computation to generate a new ciphertext C' ＰＫ (m), and the computer generates the new ciphertext C' using the arithmetic circuit f. ＰＫ (m) is input and homomorphic operation is performed to obtain the ciphertext C ＰＫ A homomorphic computation method for generating (M).

5. Ciphertext C is the plaintext m encrypted using the encryption key PK. ＰＫ A decryption circuit decrypts (m) with a decryption key SK, and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is input to perform homomorphic computation to generate a new ciphertext C' ＰＫ a bootstrapping process for generating (m); an arithmetic circuit f; and the new ciphertext C′ generated by the bootstrapping process. ＰＫ (m) is input and homomorphic operation is performed to obtain the ciphertext C ＰＫ A homomorphic arithmetic program that causes a computer to function as a homomorphic arithmetic device that performs homomorphic arithmetic processing to generate (M).

6. Encrypt the plaintext m using the encryption key PK to obtain the ciphertext C ＰＫ (m), and the ciphertext C generated by the encryption device ＰＫ (m) to generate new ciphertext C' ＰＫ (m), and the operation circuit f and the new ciphertext C' ＰＫ (m) is input and homomorphic operation is performed to obtain the ciphertext C ＰＫ a homomorphic arithmetic unit that generates (M), and a post-operation ciphertext C generated by the homomorphic arithmetic unit ＰＫ and a decryption device that decrypts the ciphertext C (M) with a decryption key SK, ＰＫ A decryption circuit that decrypts (m) with the decryption key SK and a bootstrapping key BK generated by encrypting the decryption key SK with the encryption key PK is used as an input to perform homomorphic arithmetic processing to generate the new ciphertext C' ＰＫ A secret information processing system that generates (m).

Images