Data processing method using homomorphic encryption-based ensemble decision tree model or apparatus therefor

Abstract

A data processing method using a homomorphic encryption-based ensemble decision tree model may comprise the steps of: padding specific elements (X) in a homomorphic encrypted intermediate ciphertext so that the number of the elements (X) included in the intermediate ciphertext is a preset number, and thereby obtaining a padded intermediate ciphertext; shuffling the elements (X) in the padded intermediate ciphertext by using a shuffling algorithm; and transmitting the shuffled intermediate ciphertext and a mapping table for bootstrapping to a client.

Description

Data processing method using a homomorphic encryption-based ensemble decision tree model or device for the same

[0001] The present invention relates to a data processing method or apparatus for the same using a homomorphic encryption-based ensemble decision tree model, and more specifically, to an inference method or apparatus for the same using homomorphic encryption-based bootstrapping processing, homomorphic operations, or data compression.

[0002] Machine learning models provide various inference capabilities that make modern life more convenient and intelligent. These systems contribute to improving the quality of daily life by analyzing users' lifestyle patterns, environmental data, and personal health information to provide customized services. Among them, ensemble decision tree models, such as Random Forest and its sub-model XGBoost, generally demonstrate more effective inference performance on table-based data than deep learning models.

[0003] One embodiment of a Random Forest and XGBoost-based inference service is an indoor heating and cooling usage optimization service. Specifically, the user transmits user data to the server, such as usage records of air conditioners / heaters in their physical living environment, indoor and outdoor temperatures, weather forecasts, and time-based GPS location information of the user while they are away. Based on this data, the server can determine the optimal timing to turn the air conditioners / heaters on and off to minimize indoor power consumption while the user is away and to maintain the indoor temperature at an optimal state upon the user's return. In this process, the server can provide the user with an inference model trained on the XGBoost inference model, which is one of the supervised learning techniques in machine learning, in order to infer the user's behavioral patterns.

[0004] Another embodiment of the IoT smart home service is a home healthcare service, which measures the user's sleep time within the residence using indoor light sensors and bed sensors, measures the user's dietary patterns based on food items captured by a camera sensor mounted inside the refrigerator, and measures the user's blood pressure, heart rate, and blood sugar levels using the user's wearable sensors and transmits them to a server. Based on this data, the server can infer the user's health status and use an XGBoost inference model to make recommendations for improving the user's health.

[0005] While machine learning inference services based on Random Forest and XGBoost are useful, they require users' personal data to function. However, when this data is transmitted to a server, there is a risk that users' personal information may be leaked externally and misused. In particular, users' real-time GPS location data and physical health information constitute sensitive personal information. If such personal data is processed on an external server, users must bear the risk of privacy infringement, and the server also bears the burden of data management as it faces legal liability in the event of the theft or leakage of user personal data.

[0006] Homomorphic encryption technology can resolve the issue of personal data leakage when implementing machine learning services on cloud and external servers. Homomorphic encryption is an advanced cryptographic technique that allows operations to be performed on encrypted data without decryption. Users can encrypt data and store it on external servers, such as the cloud, and various calculations, including basic arithmetic, can be performed on this data even while it remains encrypted. For example, if a user encrypts two numbers and sends them to a server, the server can perform addition, subtraction, multiplication, and division operations on them. The result of the operation also remains encrypted; the server returns the final encrypted result to the user, who then decrypts the result locally. A key aspect of this process is that the server does not need to know, nor can it know, the actual contents of the data to perform the calculations. In other words, it is a technology that enables necessary operations to be performed externally while guaranteeing data confidentiality. These characteristics of homomorphic encryption can be effectively utilized in fields such as IoT smart homes and home healthcare services, where secure data processing, analysis, and personal information protection are critical.

[0007] Meanwhile, one of the biggest drawbacks of homomorphic encryption is that it requires significantly more resources and computation time compared to general operations. In particular, Random Forest and XGBoost derive inference results by computing an average of 100 to 1,000 decision trees simultaneously, which presents a problem in that the amount of homomorphic encryption computation required is very large. Excessive computation time can lead to client service latency, and excessive resource usage can cause an overload on the server providing the service.

[0008] The present invention aims to provide an efficient data processing method for a homomorphic encryption-based decision tree model.

[0009] The problems to be solved by the present invention are not limited to the problems to be solved above, and other problems not mentioned will be clearly understood by those skilled in the art to which the present invention belongs from the description below.

[0010] According to the present invention, a data processing method using a homomorphic encryption-based ensemble decision tree model is proposed, and the method may include the steps of: obtaining a padded intermediate ciphertext by padding the intermediate ciphertext with the element (x) so that the number of specific elements (x) included in the homomorphically encrypted intermediate ciphertext becomes a preset number; shuffling the elements of the padded intermediate ciphertext using a shuffling algorithm; and transmitting the shuffled intermediate ciphertext and a mapping table for bootstrapping to a client.

[0011] Additionally or alternatively, the method may include the step of receiving from the client a second ciphertext in which the shuffled intermediate ciphertext is decrypted with a homomorphic encryption key and the bootstrapped plaintext is homomorphically encrypted using the mapping table; and the step of unshuffling the second ciphertext using the shuffling algorithm.

[0012] Additionally or alternatively, the mapping table instructs that the value of a specific element of the shuffled intermediate ciphertext to be decrypted be converted to a and the value of the remaining element be converted to b, and a and b may be integers.

[0013] Additionally or alternatively, a can be 1 and b can be 0.

[0014] Additionally or alternatively, the shuffling step may include the step of obtaining an intermediate ciphertext that is randomly shuffled using two masking arrays and a random number, from the padded intermediate ciphertext.

[0015] Additionally or alternatively, the two masking arrays may be configured to have a relationship in which they are rotated and transformed relative to each other by a preset number of digits or bits.

[0016] Additionally or alternatively, the two masking arrays may be configured to have a structure in which 1 and 0 are repeated a number of times equal to a power of 2 selected within a preset range.

[0017] Additionally or alternatively, the shuffling step may include the step of obtaining an intermediate ciphertext that is randomly shuffled using a permutation matrix of the padded intermediate ciphertext.

[0018] Additionally or alternatively, the method comprises the step of performing a homomorphic operation on the homomorphically encrypted intermediate ciphertext or the unshuffled second ciphertext, and the homomorphic operation may include a comparison operation between the intermediate ciphertext or the second ciphertext and a plaintext composed of thresholds of a plurality of nodes of the ensemble decision tree.

[0019] Additionally or alternatively, the method comprises the steps of: selecting a first group of nodes among the plurality of nodes in which the feature value corresponding to the ciphertext is identical and the threshold value falls within a specific range; and obtaining a common threshold value of the nodes in the first group, wherein the comparison operation is performed only on one of the nodes in the first group, and the result of the comparison operation performed on the remainder of the nodes in the first group may be used.

[0020] Additionally or alternatively, the method comprises the steps of: identifying paths among the paths of the ensemble decision tree in which the combination of feature values ​​and thresholds to be compared is the same; and performing the comparison operation on any one of the identified paths. For the remaining paths among the identified paths, the result of the comparison operation performed may be used.

[0021] Additionally or alternatively, the method comprises the step of receiving a plurality of homomorphically encrypted feature values ​​from the client, wherein the homomorphically encrypted feature values ​​are coded by repeating the plurality of feature values ​​a predetermined number of repetitions (M) and may be coded to have a constant slot offset between the feature values ​​within a single ciphertext containing the plurality of homomorphically encrypted feature values.

[0022] According to the present invention, a data processing method using a homomorphic encryption-based ensemble decision tree model is proposed, the method may include the steps of: receiving a shuffled intermediate ciphertext and a mapping table for bootstrapping from a server—the intermediate ciphertext being encrypted by a client using a homomorphic encryption key—; decrypting the shuffled intermediate ciphertext using the homomorphic encryption key; bootstrapping the decrypted shuffled intermediate ciphertext using the mapping table; encrypting the bootstrapped shuffled intermediate ciphertext using the homomorphic encryption key; and transmitting the encrypted bootstrapped shuffled intermediate ciphertext to the server.

[0023] Additionally or alternatively, the mapping table instructs the value of a specific element of the decoded shuffled intermediate ciphertext to be converted to a and the value of the remaining element to b, and a and b may be integers.

[0024] Additionally or alternatively, a can be 1 and b can be 0.

[0025] Additionally or alternatively, the bootstrapping step may include the step of converting a specific element of the decoded shuffled intermediate ciphertext to a and converting the remaining elements to b according to the mapping table.

[0026] Additionally or alternatively, the method comprises the step of transmitting a plurality of homomorphically encrypted feature values ​​to the server, wherein the homomorphically encrypted feature values ​​are coded by repeating the plurality of feature values ​​a predetermined number of repetitions (M) and may be coded to have a constant slot offset between the feature values ​​within a single ciphertext containing the plurality of homomorphically encrypted feature values.

[0027] According to the present invention, a computer-readable medium is proposed for storing a computer program composed of code configured to perform the method described above.

[0028] According to the present invention, an apparatus for data processing using a homomorphic encryption-based ensemble decision tree model is proposed, wherein the apparatus comprises: a transceiver configured to receive a ciphertext from a client or transmit a homomorphic operation result to the client; and a processor configured to perform processing of the ciphertext using the homomorphic encryption-based ensemble decision tree model, wherein the processor may be configured to obtain a padded intermediate ciphertext by padding the intermediate ciphertext with the element (x) such that the number of specific elements (x) included in the homomorphically encrypted intermediate ciphertext becomes a preset number; to shuffle the elements of the padded intermediate ciphertext using a shuffling algorithm; and to transmit the shuffled intermediate ciphertext and a mapping table for bootstrapping to the client.

[0029] According to the present invention, an apparatus for data processing using a homomorphic encryption-based ensemble decision tree model is proposed, wherein the apparatus comprises: a transceiver configured to transmit a homomorphically encrypted ciphertext to a server or to receive a result of homomorphic operation on the ciphertext from the server; and a processor configured to obtain the homomorphically encrypted ciphertext or to process the ciphertext, wherein the processor receives a shuffled intermediate ciphertext and a mapping table for bootstrapping from the server—the intermediate ciphertext being encrypted by a client using a homomorphic encryption key—; decrypts the shuffled intermediate ciphertext using the homomorphic encryption key; bootstraps the decrypted shuffled intermediate ciphertext using the mapping table; encrypts the bootstrapped shuffled intermediate ciphertext using the homomorphic encryption key; and may be configured to transmit the encrypted bootstrapped shuffled intermediate ciphertext to the server.

[0030] The above-mentioned problem-solving methods are merely some of the embodiments of the present invention, and various embodiments reflecting the technical features of the present invention can be derived and understood by those skilled in the art based on the detailed description of the present invention to be described below.

[0031] The present invention has the following technical effects.

[0032] According to the present invention, a client (user) can be provided with an inference function without their personal information being exposed to the server.

[0033] In addition, the present invention has the advantage of reducing the computation time and amount of computation on the server and reducing the data processing delay experienced by the user by performing homomorphic encryption operations on the user's homomorphic encrypted data in a more efficient manner on the server.

[0034] In addition, the present invention has the advantage of reducing the total computation time and amount of computation of a service by combining the request data of multiple clients and performing fewer homomorphic encryption operations when a server performs requests from multiple clients.

[0035] The effects according to the present invention are not limited to those mentioned above, and other unmentioned effects will be clearly understood by those skilled in the art from the following detailed description of the invention.

[0036] The accompanying drawings, which are included as part of the detailed description to aid in understanding the present invention, provide embodiments of the present invention and explain the technical concept of the present invention together with the detailed description.

[0037] FIG. 1 schematically illustrates a system configuration for performing an efficient inference method for a homomorphic encryption-based random forest and XGBoost model according to an embodiment of the present invention.

[0038] Figure 2 is a figure for explaining a multiplypath operation or algorithm based on homomorphic encryption.

[0039] Figure 3 is a figure illustrating a sumpath operation or algorithm based on homomorphic encryption.

[0040] Figure 4 shows a tree structure for explaining ensemble decision tree-based score calculation.

[0041] Figure 5 illustrates a flowchart of a homomorphic encryption-based inference method.

[0042] FIG. 6 illustrates a schematic flowchart of 2-party bootstrapping according to the present invention.

[0043] Figure 7 illustrates a tree structure for explaining point encoding for encoding the feature values ​​of a client.

[0044] Figure 8 illustrates a tree structure for explaining RC (range cover) encoding for encoding the threshold of a node in an ensemble decision tree.

[0045] FIG. 9 illustrates a tree structure for explaining a method of grouping nodes having the same threshold value and performing operations according to the present invention.

[0046] FIG. 10 illustrates a tree structure for explaining a method of unifying nodes having similar thresholds and performing operations according to the present invention.

[0047] FIG. 11 is a figure illustrating an embodiment for optimizing the operation of addition path values ​​according to the present invention.

[0048] Figure 12 illustrates an example of an ensemble decision tree structure.

[0049] FIG. 13 illustrates a block diagram of a device for processing homomorphic encrypted data according to the present invention.

[0050] FIG. 14 illustrates a block diagram of a device for processing homomorphic encrypted data according to the present invention.

[0051] Hereinafter, embodiments disclosed in this specification will be described in detail with reference to the attached drawings. Identical or similar components regardless of drawing symbols will be assigned the same reference number, and redundant descriptions thereof will be omitted. The suffixes "module" and "part" used for components in the following description are assigned or used interchangeably solely for the ease of drafting the specification and do not inherently possess distinct meanings or roles. Furthermore, in describing embodiments disclosed in this specification, if it is determined that a detailed description of related prior art could obscure the essence of the embodiments disclosed in this specification, such detailed description will be omitted. Additionally, the attached drawings are intended only to facilitate understanding of the embodiments disclosed in this specification; the technical concept disclosed in this specification is not limited by the attached drawings, and it should be understood that they include all modifications, equivalents, and substitutions that fall within the spirit and technical scope of the present invention.

[0052] Terms including ordinal numbers, such as first, second, etc., may be used to describe various components, but said components are not limited by said terms. These terms are used solely for the purpose of distinguishing one component from another.

[0053] When it is stated that one component is "connected" or "connected" to another component, it should be understood that while it may be directly connected or connected to that other component, there may also be other components in between. On the other hand, when it is stated that one component is "directly connected" or "directly connected" to another component, it should be understood that there are no other components in between.

[0054] A singular expression includes a plural expression unless the context clearly indicates otherwise.

[0055] In this application, terms such as “comprising” or “having” are intended to specify the existence of the features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, and should be understood as not precluding the existence or addition of one or more other features, numbers, steps, actions, components, parts, or combinations thereof.

[0056] The "client" mentioned below may be implemented as a computer or portable terminal capable of connecting to a server or other terminal via a network. Here, the computer includes, for example, a notebook, desktop, laptop, or smart home IoT device equipped with a web browser, and the portable terminal may include, for example, all types of handheld-based wireless communication devices that ensure portability and mobility, such as smartphones, smartwatches, smart rings, smart glasses, smart brain chips, Personal Communication System (PSM), Global System for Mobile Communications (GSM), Personal Digital Cellular (PDC), Personal Handyphone System (PHS), Personal Digital Assistant (PDA), International Mobile Telecommunication (IMT)-2000, Code Division Multiple Access (CDMA)-2000, W-CDMA, and Wibro terminals. In addition, the “network” can be implemented as a wired network such as a Local Area Network (LAN), Wide Area Network (WAN), or Value Added Network (VAN), or as any type of wireless network such as a mobile radio communication network or a satellite communication network.

[0057] Prior to the detailed description of the present invention, the term 'machine learning inference model' may be abbreviated as 'machine learning model', 'model', etc. below.

[0058] In the following, a homomorphic encryption-based Random Forest or XGBoost model is described as an example, but the present invention is not limited thereto and proposes an inference method applicable to an ensemble decision tree model.

[0059]

[0060] FIG. 1 schematically illustrates a system configuration for performing an efficient inference method for a homomorphic encryption-based random forest and XGBoost model according to an embodiment of the present invention.

[0061] As illustrated in FIG. 1, a system for efficient inference of homomorphic encryption-based Random Forest and XGBoost models is largely composed of a client (1000) and a server (2000). Specifically, the client (1000) consists of a homomorphic encryption engine (1100) and an application (1200). The homomorphic encryption engine (1100) may use one of the RLWE (Ring Learning With Error) based homomorphic encryption schemes such as CKKS (Cheon-Kim-Kim-Song), BFV (Brakerski-Fan-Vercauteren), or BGV (Brakerski-Gentry-Vaikuntanathan). The application (1200) serves as a means for the client (1000) to communicate with the server (2000) and transmits feature values ​​of the client (1000) to the server (2000).

[0062] Meanwhile, the server (2000) is largely composed of a homomorphic encryption model conversion engine (2100), an original random forest and XGBoost model (2200), and a homomorphic encryption random forest and XGBoost model (2300). The homomorphic encryption model conversion engine (2100) converts the original random forest and XGBoost model (2200) into a homomorphic encryption random forest and XGBoost model (2300) that is compatible with homomorphic encryption operations. The homomorphic encryption schemes supported by the homomorphic encryption model conversion engine (2100) include CKKS, BFV, and BGV, which are RLWE (Ring Learning With Error) based homomorphic encryption schemes.

[0063] In the following paragraphs of the present invention, the term "user" is used to distinguish it from "client" (1000). A client (1000) is a device owned by a specific user, which may include an IoT smart home service device or a PC / smartphone, etc. On the other hand, a user is an entity that owns one or more client devices (1000). In other words, a user may own multiple client devices (1000), and data generated by a client device (1000) is considered to be the personal data of the user who owns the said client device (1000).

[0064] All communication between the client (1000) and the server (2000) can be protected to prevent a man-in-the-middle from eavesdropping on or tampering with the data by using an end-to-end encryption protocol such as TLS. However, this end-to-end encryption is a separate encryption system from the homomorphic encryption system that forms the basis of the technology presented in this invention. While the role of the end-to-end encryption system is to prevent external entities from eavesdropping on or tampering with the communication content between the client (1000) and the server (2000), the role of the homomorphic encryption system is to prevent the server (2000) from knowing the client's (1000) data and the result values ​​derived therefrom while processing the client's (1000) data. Even if the two encryption systems are used simultaneously, they perform their respective roles independently without conflict.

[0065]

[0066] According to conventional technology, there are several problems with score calculation based on ensemble decision trees. We would like to briefly explain these problems and propose a solution to solve them.

[0067]

[0068] Figure 2 is a figure for explaining a multiplypath operation or algorithm based on homomorphic encryption.

[0069] First, a function α_geq_β(a, b) is defined.

[0070] α_geq_β(a, b) = 1 when a>=b,

[0071] α_geq_β(a, b) = 0 when a

[0072] It is defined as follows. That is, if the comparison judgment is true, it returns 1, and if it is false, it returns 0. In Fig. 2, the nodes t0, t1, and t2 represent thresholds. In the example of Fig. 2, it is assumed that the input feature vector X=[x0, x1, x2] = [3 10 6]. ​

[0073] The value (result) of a multiplication path is represented as the product of each path value and is displayed at the bottom of the leaf node of the tree. True for the operation result corresponds to the rightmost leaf node, where the path value is 1.

[0074] When calculating the isomorphic score of a multiply path-based ensemble tree, the weight of the leaf node of each tree path is multiplied by the multiply path value (1 or 0), and then the sum of the (MultiplyPath value * weight) list values ​​of all such leaf nodes is obtained to obtain the final score of the tree.

[0075] In this way, the final scores of all trees are added by class to calculate the final class score. However, the number of multiplications required is equal to the depth of the path, and the number of required homomorphic multiplications increases accordingly. In homomorphic encryption, as the maximum number of multiplications supported by the ciphertext increases, the amount of computation increases exponentially; consequently, a phenomenon occurs where the computation time for homomorphic operations increases exponentially in proportion to the depth of the tree path. Although bootstrapping to reset the multiplication depth is possible, bootstrapping has the problem of taking too long.

[0076]

[0077] Figure 3 is a diagram illustrating a sumpath operation or algorithm based on homomorphic encryption. As in Figure 2, the function α_geq_β(a, b) is used. In Figure 3, the nodes t0, t1, and t2 represent thresholds. In the example of Figure 3, the input feature vector X=[x0, x1, x2] = [3 10 6] is assumed.

[0078] In addition, in the addition operation path of FIG. 3, each addition path value (result) is defined as the product of a random number generated for each path and a function α_geq_β(a, b). It is indicated at the bottom of the leaf node of the tree. The true result of the operation corresponds to the rightmost leaf node, and the path value at this time is 0.

[0079] When calculating isomorphism scores for addition-based ensemble trees, the path value (SumPath) for the True path in each tree is 0, and the remaining False paths are random numbers; however, the final scores for each class cannot be calculated by summing the values ​​of the True paths, as the values ​​of the True paths are 0. This is because multiplying 0 by the stored weight of any leaf node will ultimately result in 0.

[0080]

[0081] Figure 4 shows a tree structure for explaining ensemble decision tree-based score calculation.

[0082] In an ensemble decision tree structure, to calculate the final score, a score for a specific class is calculated for each tree. The final score for each class is the sum of the final scores for each class across all trees.

[0083] For example, the final score for Class 1 is a2+b3, and the final score for Class 2 is c4+d4.

[0084] The present invention proposes a 2-party bootstrapping method to solve the problems of the multiplication path and addition path described with reference to FIGS. 2 and FIGS. 3.

[0085] Before explaining 2-party bootstrapping, I will explain the general procedure of homomorphic encryption.

[0086]

[0087] Figure 5 illustrates a flowchart of a homomorphic encryption-based inference method.

[0088] In advance, the server (1000) converts the ensemble decision tree model into a homomorphic encryption compatible model that is compatible with homomorphic encryption operations (hereinafter, “homomorphic operations”).

[0089] The client (1000) obtains a ciphertext by homomorphically encrypting input data (e.g., user information, etc.) required for inference using a homomorphic encryption key (S51). The client (1000) can transmit the obtained ciphertext to the server (2000) (S52). This is to perform homomorphic operations on the ciphertext.

[0090] The server (2000) can perform homomorphic operations on the received ciphertext (S53). The server (2000) can transmit the homomorphic ciphertext to the client (1000) (S54).

[0091] The client (1000) can decrypt the homomorphic ciphertext using a homomorphic encryption key.

[0092]

[0093] FIG. 6 illustrates a schematic flowchart of 2-party bootstrapping according to the present invention. FIG. 5 illustrates data processing (e.g., inference) using a homomorphic encryption-based ensemble decision tree, and the procedure of FIG. 6 is a procedure belonging to S53 of FIG. 5.

[0094] The server (2000) can perform a first-1 homomorphic operation on the received homomorphically encrypted ciphertext (S531). After that, the server (2000) can perform a first bootstrapping on the “intermediate” ciphertext (S532). “First-1 homomorphic operation” is an expression used to refer to a part of the first homomorphic operation. Additionally, the intermediate result for which the homomorphic operation has been performed but is not completed is referred to as the “intermediate” ciphertext.

[0095] The first bootstrapping may include a procedure for masking the intermediate ciphertext. Here, the intermediate ciphertext is bootstrapped in a homomorphically encrypted state.

[0096] Alternatively, the first bootstrapping may include padding with elements identical to specific elements of the intermediate ciphertext and shuffling of the ciphertext. As previously explained, here, the intermediate ciphertext is bootstrapped in a homomorphically encrypted state.

[0097] The first bootstrapping will be described later.

[0098] The server (2000) can transmit the intermediate ciphertext obtained through the first bootstrapping to the client (1000) (S533). At this time, a mapping table may be transmitted together depending on the type of bootstrapping.

[0099] The client (1000) may perform a second bootstrapping on the received intermediate ciphertext (S534). The second bootstrapping may include decrypting the intermediate ciphertext (using the homomorphic encryption key used in S31), converting the values ​​of specific elements or remaining elements of the decrypted intermediate ciphertext using a mapping table, or encryption using the homomorphic encryption key. As previously explained, the ciphertext is bootstrapped in a decrypted state using the homomorphic encryption key. The second bootstrapping will be described later.

[0100] The client (1000) can send the second bootstrapped intermediate ciphertext back to the server (2000) (S535).

[0101] The server (2000) may perform a third bootstrapping on the received second bootstrapped intermediate ciphertext (S536). The third bootstrapping may include processing that is complementary or corresponding to the processing of the intermediate ciphertext in the first bootstrapping.

[0102] The server (2000) can perform the first-2 homomorphic operation on the intermediate ciphertext again after the third bootstrapping and obtain the homomorphic ciphertext (S537). “First-2 homomorphic operation” is an expression used to refer to a part of the first homomorphic operation. In FIG. 6, the first homomorphic operation may consist of the first-1 homomorphic operation and the first-2 homomorphic operation.

[0103]

[0104] A bootstrapping consisting of the first to third bootstrapping of the client (1000) and the server (2000) will be explained further.

[0105] The present invention proposes two types of bootstrapping. Each bootstrapping may consist of the aforementioned first to third bootstrappings.

[0106] First, I will explain the first type of bootstrapping.

[0107] The first type of bootstrapping is intended to initialize the multiplication depth / noise of the ciphertext without both the server and the client knowing the values ​​contained in the intermediate ciphertext (or its slots) during the operation.

[0108] The server (2000) can obtain an intermediate ciphertext while performing homomorphic operations on the homomorphically encrypted ciphertext. This intermediate ciphertext is to be represented as RLWE(slots[]).

[0109] The server (2000) is r val []:=z n Defines RLWE(slots'[]):=RLWE(slots[]) + r val [] can be obtained (S532). r val [] is a random array used to mask the slot values ​​of the plaintext, and accordingly, RLWE(slots'[]) corresponds to the ciphertext masked by homomorphic addition of the above random array.

[0110] The server (2000) can send RLWE(slots'[]) to the client (1000) (S533).

[0111] The client (1000) can obtain slots'[] by decrypting RLWE(slots'[]) using a homomorphic encryption key, and can homomorphically encrypt slots'[] again using a homomorphic encryption key (S534). The client (1000) can send the homomorphically encrypted intermediate ciphertext (RLWE(slots'[])) back to the server (2000) (S535).

[0112] The server (2000) uses a previously used random array (r) from the received RLWE(slots'[]). val By subtracting []), a new intermediate ciphertext (RLWE(slots[])) can be obtained (S536). After that, the server (2000) can perform the first-second homomorphic operation (S537) on the new intermediate ciphertext.

[0113] According to the first type of bootstrapping, the multiplication depth can be initialized, so the amount of isomorphic operations can be reduced.

[0114]

[0115] Next, I will explain the second type of bootstrapping.

[0116] The second type of bootstrapping is intended to perform Programmable Bootstrapping (PBS) on slots without both the server and the client knowing the values ​​contained in the intermediate ciphertext (or its slots) during the operation.

[0117] PBS must map the slot values ​​within the ciphertext, and the slot values ​​are r add If masked with [], there is a problem where the result of PBS changes because the mapping is based on the masked values ​​rather than the original slot values.

[0118] The prerequisites and solutions from a security perspective for performing PBS without additive masking are as follows.

[0119] The server must not be able to know the values ​​of the encrypted slots of the intermediate ciphertext. To this end, we propose a method in which the client receives the intermediate ciphertext from the server, decrypts it, performs PBS, encrypts it, and then sends it back to the server.

[0120] From the client's perspective, the content of the server's decrypted intermediate ciphertext must appear as completely random information. In other words, the client must not be able to determine the actual values ​​of the decrypted values ​​or the correlations between them.

[0121] In other words, no information should be obtainable even if the frequency histogram of the slot values ​​resulting from the decryption of the PBS target is analyzed. To achieve this, client analysis can be prevented by using a padding technique that creates and inserts additional fake (dummy) values ​​to force the distribution of slot values ​​to always remain the same.

[0122] In addition, no information based on the order of slot values ​​obtained after decrypting the ciphertext of the PBS target should be obtained. To this end, a shuffling technique that mixes the order of slot values ​​can be used to prevent analysis by the client.

[0123] The server (2000) can obtain an intermediate ciphertext while performing homomorphic operations on the homomorphically encrypted ciphertext (S531). This intermediate ciphertext is to be represented as RLWE(slots[]).

[0124] The first bootstrapping of the server (2000) is as follows.

[0125] The server (2000) can select a sensitive x value (e.g., 0) among the x∈Z values ​​in slots[] such that the distribution of the frequency of occurrence of a specific value may expose the algorithm information of the server (2000). Then, additional fake (dummy) 0 values ​​can be generated so that the frequency of occurrence of the selected x value is always the same, and can be padded (concatenate) into slots[]. At this time, if there are not enough slots for padding in the intermediate ciphertext, the padding can be performed by dividing the intermediate ciphertext into multiple new parts.

[0126] The server (2000) can shuffle the order of the elements of slots[] (i.e., shuffle) to hide the order correlation of the slots[] values. Shuffle can be performed by the following specific procedure.

[0127] ①s:= [1, CEIL(n / 2) ] #s is a power of 2 increasing sequentially from 1 between 1 and CEIL(n / 2) (n: number of PBS target slots)

[0128] ② m[] := s-cells consisting of {0, 1} - sparse masking slot array

[0129] (That is, in the form 111..000…111…, where the same 1 and 0 each appear consecutively s times)

[0130] ③ m'[] := Rotate(m[], s) # Rotates m[] s spaces to the left

[0131] ④ RLWE(slots'[]) := RLWE(slots[]) * m[] + Rotate(RLWE(slots[]) * m'[], s * 2r) # 2r: random even number

[0132] # RLWE(slots'[]) is a new intermediate ciphertext obtained by randomly shuffling the intermediate ciphertext RLWE(slots[]) in units of s.

[0133] Here, m[] and m'[] have the same length as RLWE(slots'[]) or RLWE(slots[]).

[0134] ⑤ Perform ①~④ once for all possible s values ​​between [1, CEIL(n / 2) ] ( CEIL(log n) times ) # As a result, the slots in RLWE(slots[]) are randomly and evenly shuffled

[0135] Here, r is a positive integer randomly selected whenever a value of s is selected.

[0136] After that, the server (2000) can transmit the acquired RLWE(slots'[]) (i.e., randomly shuffled intermediate ciphertext) and the mapping table (Map(X:Y)) to the client (1000) (S533).

[0137] The client (1000) can decrypt the received RLWE(slots'[]) using a homomorphic encryption key (S534). The decryption result can be represented as slots'[], and even after decryption is completed, the client (1000) cannot know information about slots'[]. This is because the frequency-based correlation is diluted because the frequency of appearance of the sensitive value (the specific value (x) described earlier) within slots'[] is padded so that it always appears the same, and the order of the values ​​stored within slots'[] is also randomly shuffled, so the order-based correlation of the stored values ​​is also diluted.

[0138] After that, the client (1000) can convert specific values ​​of the decrypted intermediate ciphertext (slots'[]) into specified values ​​using the received mapping table (S534). Here, the specific values ​​or specified values ​​may include positive integers or binary numbers. The data obtained through this can be represented as pbsSlot'[]. The client (1000) can encrypt the decrypted intermediate ciphertext composed of the converted values ​​again using a homomorphic encryption key for transmission to the server (2000) (S534). This new intermediate ciphertext can be represented as RLWE(slot'[]) and referred to as the mapped intermediate ciphertext.

[0139] The client (1000) can send the mapped intermediate ciphertext (RLWE(slot'[])) to the server (2000) (S535).

[0140] The server (2000) can restore the received mapped intermediate ciphertext to its original state by performing operations in the reverse or corresponding direction to the first bootstrapping (S532) (i.e., padding and shuffling) (S536). Alternatively, since the server (2000) is the entity that padded and shuffled the intermediate ciphertext and knows the entire layout of which original slot value is in which slot, the padded and shuffled ciphertext can be used as is without expensive restoration operations.

[0141] After that, the server (2000) can perform the first-second homomorphic operation (S537) on the new intermediate ciphertext.

[0142] Through the second type of bootstrapping, the problem of the Sumpath value for the True path becoming 0, which is a problem in addition path-based homomorphic score calculation, can be solved without exposing the ensemble decision tree structure of the server (2000) to the client (1000). Specifically, by converting the 0s of the homomorphic intermediate ciphertext to 1s and converting the remaining values ​​to 0s, the value of the True path will have a non-zero value.

[0143] Explain the computation time of the second type of bootstrapping described earlier.

[0144] ENCRYPT: encryption operation time, DECRYPT: decryption operation time, D: number of data to be encrypted C: number of ciphertexts = CEIL(D / 16382), C_SIZE: size of ciphertext data, DELAY(C_SIZE): corresponds to network transmission time of C_SIZE.

[0145] In addition, P_MULT corresponds to the time for homomorphic multiplication of plaintext to ciphertext, ROTATE to the time for homomorphic rotation, and ADD to the time for homomorphic addition.

[0146] Slot shuffling operation time:

[0147] ADD + CEIL(log D) * (P_MULT * 2 + ROTATE + ADD)

[0148] ▶ Calculation amount for padding a specific value (e.g., 0): P_MULT

[0149] ▶Computational load of 1-time slot shuffling:

[0150] P_MULT * 2 (create 2 s-sparsely masked ciphertexts that are offset from each other) + ROTATE (create s*2r offset parts) + ADD (add the sum of the two offsetly masked ciphertexts)

[0151] ▶Number of times slots are shuffled: CEIL(log D)

[0152] Client ciphertext encryption / decryption time: C * (ENCRYPT + DECRYPT)

[0153] Network round-trip latency: 2 * DELAY(C * C_SIZE)

[0154] *Final 2P-PBS computation time:

[0155] C * ( ADD + ENCRYPT + DECRYPT + CEIL(log D) * (P_MULT * 2 + ROTATE + ADD) ) + 2 * DELAY(C * C_SIZE)

[0156]

[0157] Next, we would like to propose a solution to address the problem of delayed computation speed caused by the need for as many isomorphic rotation operations as there are tree nodes and paths when computing the final values ​​of paths in an ensemble decision tree.

[0158] The most time-consuming part of homomorphic operations is homomorphic rotation. Homomorphic rotation is 60 times slower than homomorphic addition, 10 times slower than homomorphic plaintext-ciphertext multiplication, and 1.1 times slower than homomorphic ciphertext-ciphertext multiplication. In SumPath homomorphic operations, homomorphic rotations equal to the number of edges in the tree and equal to the number of leaf nodes are required.

[0159] To improve this, we propose a method to reduce the number of isomorphic operations by performing isomorphic operations on only one of the nodes with the same threshold in an ensemble decision tree, and sharing the result of the isomorphic operation among the remaining nodes.

[0160] Before that, I will explain the basic isomorphic operations.

[0161]

[0162] Figure 7 illustrates a tree structure for explaining point encoding for encoding the feature values ​​of a client.

[0163] The ensemble decision tree has a total of 4 levels (levels 0 to 3), and level 3 has a total of 8 leaf nodes. Figure 7 illustrates encoding the feature value {3} of a client at level 3.

[0164] Level 3's {3} can be represented as Level 0's 000, Level 1's 000, Level 2's 001, and Level 3's 011, as shaded in Fig. 7, and when represented as PE (point encoding), it can be expressed as PE(3)=[000, 000, 001, 011].

[0165] Referring to Fig. 7, point encoding of feature values ​​was described, but the client's feature values ​​may also be RC (range cover) encoded as described later.

[0166]

[0167] Figure 8 illustrates a tree structure for explaining RC encoding for encoding the threshold of a node in an ensemble decision tree.

[0168] The ensemble decision tree has a total of 4 levels (levels 0 to 3), and level 3 has a total of 8 leaf nodes. Figure 8 illustrates the encoding of the threshold [2, 7] of the server (tree) at level 3.

[0169] Therefore, RC(2) can be represented as [null, 001, 001, null].

[0170] Referring to Fig. 8, RC encoding of the server threshold was described, but the server threshold may also be point encoded.

[0171]

[0172] In addition, size comparison operations between PE() and RC() are possible. Array operations can also be performed using α_geq_β(a, b). Defined as α_geq_β(PE(), RC()), it returns 1 if there are overlapping nodes between PE() and RC() (i.e., the same value in the same position of the vector (array), and returns 0 if there are no overlapping nodes between PE() and RC().

[0173] This can be represented in code as follows.

[0174] bool α_geq_β(PE(α), RC(β)):

[0175] for (i = 0; i < n-1; i++) :

[0176] if (li == l'i) # Check if the same number (node) exists in the same position of the two vectors

[0177] return true # α ≥ β

[0178] return false # α < β

[0179] Accordingly, when comparing PE (3) and RC (2) of FIGS. 7 and FIG. 8 described above with the above function, since both arrays have 001 in the third position (level 2) within the array, 1 can be returned.

[0180] However, when comparing the magnitude of values, the conditional statement (determining whether they are the same, “==”) is not supported in homomorphic encryption, so it is impossible to use it as is and it must be converted into a logic or algorithm expressed as homomorphic addition / multiplication.

[0181]

[0182] In addition path isomorphic operations, the plaintext (threshold) and ciphertext (client feature values, e.g., personal information) are each stored in a single array (or vector) and used for the operation.

[0183] For example, the feature values ​​are as follows, and

[0184] PE(x1) = [010, 010, 001, 010]

[0185] PE(x2) = [001, 001, 010, 100]

[0186] … , (rest omitted)

[0187] If the thresholds are as follows,

[0188] RC(t1) = [100, 001, 010, 010]

[0189] RC(t2) = [100, 001, 010, 100]

[0190] … , (rest omitted)

[0191] The plaintext or ciphertext used in the present invention is represented as a binary number having the same Hamming weight, and accordingly, size comparison can be determined using the Hamming weight (e.g., H=1).

[0192] Ciphertext 1 (the first bit value of each feature value) can be represented as 00000000 …, ciphertext 2 (the second bit value of each feature value) can be represented as 11010010 …, and up to ciphertext k (the k-th bit value of each feature value) can be represented and stored in this way.

[0193] Plaintext 1 (the first bit value of each threshold) can be represented as 10001001…, plaintext 2 (the second bit value of each threshold) can be represented as 00110010…, and plaintext l (the lth bit value of each threshold) can be represented in this way.

[0194] Subsequently, for the addition path operation, an equality check function (CW_EQ_OP()) is used to perform a homomorphic operation on the aforementioned plaintext and ciphertext (i.e., the threshold of the server's tree node and the client feature value). This is the multiplication operation of multiple plaintexts and ciphertexts as previously explained; when representing a list containing multiple plaintexts as RC_list() and a list containing multiple ciphertexts as PE_list(), the plaintexts and ciphertexts at the same index are multiplied together. That is, RC_list(i) and PE_list(i) are multiplied together. The values ​​obtained by performing the multiplication operation for all i are summed, and the values ​​obtained by subtracting "Hamming Weight - 1" from 0 for each are combined and added together. Finally, the result is obtained by dividing by (Hamming Weight = H) * (H - 1) * …. This can be expressed as follows.

[0195] bool CW_EQ_OP(RC_List, PE_List)

[0196] int h = 0

[0197] for (int i = 0; i < W; i++)

[0198] h += RC_List[i] * PE_List[i]

[0199] m = 1

[0200] H = 1

[0201] for (int i = 0; i < H; i++)

[0202] m *= h - i

[0203] int H_FULL = H*(H-1)*… *2*1

[0204] return (H_FULL) -1 * m

[0205]

[0206] Ultimately, the size comparison operations described above can be expressed as isomorphic addition and multiplication without conditional statements as follows.

[0207] bool α_geq_β(PE(α), RC(β)):

[0208] int count = 0

[0209] for (i = 0; i < n-1; i++) :

[0210] count += CW_EQ_OP(l i , l' i )

[0211] return count # 1 if α ≥ β; otherwise 0

[0212] Accordingly, the operation result (true or false) at each node in the tree can be obtained, and when stored in an array, the operation result of the nodes at each level of the tree is placed in each slot of the array. At this time, an isomorphic rotation operation is performed (Rotate()).

[0213] This can be represented as CT_RCC(Range Cover Comparison), and assuming it is an operation of the tree in Fig. 8,

[0214] CT_RCC can be obtained as [Size comparison result of Level 0 node ∥ Size comparison result of Level 1 node 1 ∥ Size comparison result of Level 1 node 2 ∥ Size comparison result of Level 2 node 1 ∥ Size comparison result of Level 2 node 2 ∥ Size comparison result of Level 2 node 3 ∥ Size comparison result of Level 2 node 4 ∥ Size comparison result of Level 3 node 1 ∥ Size comparison result of Level 3 node 2 ∥ Size comparison result of Level 3 node 3 ∥ Size comparison result of Level 3 node 4 ∥ Size comparison result of Level 3 node 5 ∥ Size comparison result of Level 3 node 6 ∥ Size comparison result of Level 3 node 7 ∥ Size comparison result of Level 3 node 8].

[0215] The result of the isomorphic operation at the server (2000) is not transmitted to the client (1000) as CT_RCC, but is transmitted as the result of the addition path of each leaf node.

[0216] Referring to Fig. 9, the addition path results of sp1, sp2, sp3, sp4, and sp5 are transmitted to the client, included in a single homomorphic ciphertext, and the addition path results for a single leaf node are stored in a single slot and transmitted. That is, in this case as well, a homomorphic rotation operation is performed.

[0217] FIG. 9 illustrates a tree structure for explaining a method of grouping nodes having the same threshold value and performing operations according to the present invention.

[0218] Each node has a threshold for inference-related decisions, and multiple nodes with the same threshold have the same size comparison result when compared with a feature. Therefore, we propose a method in which the isomorphic rotation operation is performed only once for any one of these multiple nodes, and the remaining nodes with the same threshold use the size comparison result corresponding to the result of the isomorphic rotation operation.

[0219] If, in Fig. 9, nodes n1 and n4 have the same threshold and perform a comparison operation on the same feature value, the rotation value for one of the two nodes is obtained, and the remaining node uses the previously obtained rotation value.

[0220] In other words, in the previously described CT_RCC, rotation operations had to be performed for every node equal to the number of slots corresponding to the node's position (or order) in CT_RCC in order to extract the comparison operation results at each node. However, this proposal suggests that if multiple nodes have the same threshold and identical feature values ​​to be compared, rotation operations should be performed on only one of those nodes. That is, for example, by performing rotation operations on CT_RCC to CT_rcc 4,≥ If (the rotation result of the comparison operation result of Node 4) has been obtained, CT_rcc 1,≥ (The rotation result of the comparison operation result of Node 1) is not rotated, and CT_rcc4,≥ Make sure to use . The opposite is also true.

[0221] Also, CT_1-rcc 4,≥ If obtained by performing a rotation operation of CT_RCC'' (the inverse value of CT_RCC, i.e., 1-CT_RCC), then CT_1-rcc 1,≥ is not performing rotation operations, CT_1-rcc 4,≥ Make sure to use . The opposite is also true.

[0222]

[0223] FIG. 10 illustrates a tree structure for explaining a method of unifying nodes having similar thresholds and performing operations according to the present invention.

[0224] Each node has a threshold for inference-related decisions, and multiple nodes with similar thresholds have similar size comparison results when compared to the same feature. Therefore, we propose a method in which the thresholds for these multiple nodes are set to a single unified threshold, the isomorphic rotation operation is performed only once for any one of the nodes, and the remaining nodes use the size comparison result corresponding to the isomorphic rotation operation.

[0225] For example, nodes whose threshold falls within a 1% error range can be clustered into a single group. Referring to Fig. 10, it is assumed that the thresholds of nodes n1, n3, and n4 fall within a 1% range. For the nodes in that group, for example, the average value of the thresholds of each node can be set as the new threshold.

[0226] This should be applied starting from the operation to acquire CT_RCC, which can reduce the CTT_RCC operation process and the associated isomorphic rotation operation.

[0227]

[0228] The results of the performance test for the method described with reference to FIGS. 9 and 10 are as follows.

[0229] (Benchmark) Number of Features: Original tree node count (unoptimized), Number of unique node thresholds, Number of unique nodes with an error margin within 1%, Number of unique nodes merged with Cls: Heart 30, 278, 918, 947; Cancer 13, 170, 952, 6; Steel 28, 413, 169, 74; Spam 58, 1715, 866, 485

[0230] When only nodes with unique thresholds are included, the average number of nodes used for isomorphic operations is reduced by about 61.4%, and when threshold nodes within an error range of 1% are merged, the average number of nodes used for isomorphic operations is reduced by 80.0%. The number of isomorphic rotation operations is reduced by the number of these reduced nodes.

[0231]

[0232] As another embodiment of the present invention, a method for optimizing the addition path operation is proposed to resolve the speed delay of isomorphic operations.

[0233] Paths within a tree composed of the same feature type and the same threshold will have the same result of addition path operations. Therefore, these addition paths can perform server-client 2-party bootstrapping using only a single operation value without the need to repeatedly use the same value.

[0234] For leaf nodes that have the same additive path value, the weight values ​​of the leaf nodes are summed, and the result is homomorphically multiplied with the additive path value that has been bootstrapped by the client and added to the final score.

[0235] If there are multiple classes, the above operation can be configured to be performed by grouping the trees belonging to each class together.

[0236]

[0237] FIG. 11 is a figure illustrating an embodiment for optimizing the operation of addition path values ​​according to the present invention.

[0238] Since the paths between node a5 and node b5 have the same types of feature values ​​(age, sleep duration) and the same thresholds, the sum path values ​​will also be the same. In other words, SumPath a5 ==SumPath b5 .

[0239] The server (2000) gives the isomorphic operation result, i.e., SumPath, to the client (1000). a5 or SumPath b5 Any one of the following (e.g., SumPath a5 Only ) can be transmitted. Accordingly, the client (1000) receives the result of the bootstrapping completed, i.e., PBS(SumPath a5 The value can be included in the ciphertext and transmitted to the server (2000).

[0240] When the server (2000) calculates the final result of the sum path value of class 1, it uses the following relationship to SumPath a5 You may not use .

[0241] a5*PBS(SumPath a5 ) + b5*PBS(SumPath b5 ) = (a5+ b5)*PBS(SumPath a5 )

[0242] In conclusion, it is possible to calculate the final score of Class 1 using only SumPatha5 without using SumPathb5.

[0243] Accordingly, the performance test results were obtained as follows.

[0244] Table 2 shows a comparison of the number of addition paths when addition path optimization is not applied and when it is applied.

[0245] (Bench)NotAppliedAppliedHeart29271611Cancer335219Steel531343Spam18531770

[0246] Table 3 shows the inference time when additive path optimization is not applied.

[0247] (Bench)8-bit16-bit32-bitHeart2.56s2.70s3.09sCancer0.47s0.52s0.75sSteel0.64s0.80s1.00sSpam1.85s2.26s3.47

[0248] Table 4 shows the inference time when applying additive path optimization.

[0249] (Bench)8-bit16-bit32-bitHeart2.56s2.70s3.09sCancer0.47s0.52s0.75sSteel0.64s0.80s1.00sSpam1.85s2.26s3.47s

[0250] When optimizing addition paths, the number of addition paths used for isomorphic operations was reduced by an average of about 30%, and the inference time was reduced by an average of 9.8%.

[0251]

[0252] Meanwhile, when performing inference operations for a homomorphic encryption-based ensemble decision tree, the amount of data transmitted between the server and the client is as follows.

[0253] Client to Server: {ciphertext obtained by encrypting feature values ​​bit by bit} # Usually 8 to 70 (8MB to 70MB)

[0254] Server to Client: {Intermediate ciphertext for quantum programmable bootstrapping} # Usually 1 (0.4 MB)

[0255] Client to Server: {Programmable Bootstrapped Ciphertext} # Usually 1 (1 MB)

[0256] From Server to Client: {ciphertext storing class-specific inference values} # Usually 1 (0.4 MB)

[0257] Among these, the feature values ​​transmitted by the client to the server cause the largest network load, and when the size of the ciphertext is large, most of the inference time delay occurs during the transmission and reception process over the network. This invention proposes ciphertext compression to reduce network delay.

[0258]

[0259] First, we propose using a symmetric key as a homomorphic encryption key.

[0260] The initial ciphertext encrypted with a homomorphic symmetric key (ciphertext that has not yet started homomorphic encryption operations) can reduce the ciphertext size by 50% compared to a ciphertext encrypted with an asymmetric key.

[0261] In a symmetric key / asymmetric key homomorphic ciphertext (A, B), A and B are usually polynomials of degree 16384.

[0262] A = 16,384th degree random polynomial (generated by RNG random number generator)

[0263] B = A*S + Delta*M + E

[0264] If symmetric-key encryption is used instead of asymmetric-key encryption, for the initially encrypted ciphertext, instead of storing the random polynomial A as is, it is sufficient to store only the single seed value of the random number generator used to randomly generate the 16,384 coefficients of polynomial A.

[0265] When the server receives the corresponding seed value, the server can use the seed value to restore the same polynomial A. B must store the entire 16384th degree polynomial as is. This is because M and E, which are the values ​​required to generate B, are values ​​that the server does not know.

[0266] Therefore, the initial symmetric key ciphertext can be replaced with (seedA, B) instead of (A, B). That is, the ciphertext size can be reduced by 50%.

[0267] After receiving the ciphertext (seedA, B), the server can recover polynomial A using the value of seedA and a random number generator. Finally, the server can recover the ciphertext (A, B).

[0268]

[0269] Secondly, we propose a method that utilizes column rotation operations to ensure there are no empty slots in the ciphertext.

[0270] Generally, in homomorphic encryption, one ciphertext consists of 16,382 slots. In addition to addition, subtraction, and multiplication, homomorphic encryption supports rotation operations, which allow the entire set of slots to be rotated in one direction. A rotation operation is a round-robin operation. For example, if a 2-position rotation operation is performed on a homomorphic ciphertext, the (encrypted) value stored in slot 2 moves to slot 0, the value stored in slot 1 moves to slot 8,191 (a full rotation), and the value stored in slot 0 moves to slot 8,190.

[0271] However, although the total number of slots is 16,382, the reason it does not move to the 16,381st position but to the 8,191st position when rotating once is that, due to the characteristics of homomorphic ciphertext, the slots form individual rotation groups, with the first half (8,192 slots) and the second half (8,192 slots). Therefore, if the value stored in the 8,192nd slot is rotated homomorphically by one position, that value moves to the 16,381st slot.

[0272] Meanwhile, since rotation is possible in both directions, both right and left rotation are possible. When rotating, all slots move simultaneously in the corresponding direction, and if they cross the boundary of the slots at both ends, they move to the opposite end within that rotation group. As such, when performing isomorphic rotation, the movement path of the stored values ​​is not applied equally to all 16,382 slots, and the front and back halves are separated independently and rotate within each; therefore, to avoid this complexity in slot management, the existing algorithm used only 8,192 slots in the front half for computation.

[0273] On the other hand, the present invention proposes a method of using both the front and rear half slots.

[0274] Ultimately, regarding the slots of the ciphertext, we intend to use all slots of the ciphertext by utilizing both row rotation and column rotation.

[0275] The client (1000) is,

[0276] The data corresponding to the [1, code_length / 2] bit positions are stored in the full-half slots, and

[0277] Data in [code_length / 2 + 1, code_length] bit positions can be stored in the latter half slots and transmitted.

[0278] In the process of summing the data of all bit positions of the ciphertext, the server (2000) sums all the ciphertexts, then performs a column rotation operation on the resulting ciphertexts, and sums the front half slots and the back half slots to derive the final summed ciphertexts.

[0279] Additionally, when the server (2000) obtains or generates a comparison result value between a feature value and a threshold at each node,

[0280] Half of the summed ciphertexts can be column-rotated to place the necessary values ​​in the rear half slot, and then summed with the remaining half (unrotated) ciphertexts. That is, the data required for the size comparison operation is divided and placed in the front half slot and the rear half slot. In all subsequent isomorphic operation processes, the server (2000) performs operations on the front half and rear half slots simultaneously, and when the final size comparison result values ​​are derived, the columns are rotated again to place all data in the front half slot, and then each is row-rotated appropriately to sort all size comparison result values ​​into slot[0].

[0281] To briefly explain the existing method,

[0282] It is assumed that there are W ciphertexts representing input feature values ​​and W plaintexts representing server thresholds, and that the feature values ​​and weight data encoded with Hamming weights each consist of W bits. As previously explained, one i-th bit value among the W bit positions of the client's i-th ciphertext is stored in an array, and this is performed for all feature values. Additionally, one i-th bit value among the W bit positions of the server's i-th plaintext is stored in an array, and this is performed for all thresholds. However, each ciphertext or plaintext consists of 16,382 slots, but while values ​​are stored in the first half slots (i.e., slots 0 to 8191), the second half slots are left empty.

[0283] The method proposed in the present invention is,

[0284] Compared to the basic method described earlier, this method uses W / 2 ciphertexts representing input feature values ​​and W / 2 plaintexts representing server thresholds, assuming that the feature values ​​and weight data encoded with Hamming weights each consist of W bits. Compared to the existing method, the number of ciphertexts and plaintexts is reduced by half because it utilizes the latter half slots of the ciphertext / plaintext.

[0285] The proposed method described above will be explained by applying it to the process of obtaining the previously explained bool CW_EQ_OP(RC_List, PE_List).

[0286] 1. Perform homomorphic multiplication of W / 2 ciphertexts and W / 2 plaintexts.

[0287] - In each ciphertext, feature values ​​are stored in both the front half slots [0 ~ 8191] and the back half slots [8192 ~ 16381].

[0288] - Thresholds are stored in both the front half slots [0 ~ 8191] and the back half slots [8192 ~ 16381] of each plaintext.

[0289] 2. Perform homomorphic addition to combine W / 2 ciphertexts obtained by homomorphic multiplication into a single ciphertext.

[0290] - For one ciphertext h, create another ciphertext h' by performing a homomorphic column rotation, align the front half slots and the back half slots of the two ciphertexts (h, h'), and then perform homomorphic addition once more to obtain a new ciphertext h'' = h + h'.

[0291] - Create a new masked plaintext k (plaintext where slots [0~8191] are 1 and slots [8192~16381] are 0) to keep only the summed values ​​of the first half slots [0~8191] of the h'' ciphertext and set the values ​​of the second half slots [8192~16381] to 0, then perform homomorphic multiplication of this masked plaintext with the ciphertext: h''' = h'' * k

[0292] - Through the above process, the final value is summed and collected in the first half slots [0~8191], and the values ​​in the second half slots [8192~16381] become 0.

[0293] - Replace the existing h with the new h''' and continue with the following operations

[0294] 3. For each ciphertext h'', perform isomorphic subtraction of 0, 1, 2, … (H-1) (H is the Hamming weight) to obtain a total of H ciphertexts (hi).

[0295] - Obtain (hi)' by performing homomorphic column rotation on the even-indexed H / 2 ciphertexts and duplicating them, then perform homomorphic addition between the odd-indexed H / 2 ciphertexts (hi) (which were not rotated homomorphically) and the 2 ciphertexts with the same i: (hi)'' = (hi) + (hi)'

[0296] - (hi)'' is a form in which half of the values ​​that were gathered only in the first half slots [0~8191] within H / 2 ciphertexts (hi)'' are distributed to the second half slots [0~8191].

[0297] - As a result, compared to the existing method which generated H ciphertexts using only the front half slots [0~8191], the new method can reduce the number of ciphertexts to half, H / 2, by utilizing both the front and back half slots.

[0298] 4. Perform homomorphic multiplication of all H / 2 ciphertexts

[0299] - Compared to the existing method which homomorphically multiplies H (hi) ciphertexts, the proposed method homomorphically multiplies H / 2 (hi)'' ciphertexts; by reducing the number of homomorphic ciphertexts to be multiplied by half, the time required for homomorphic operation can be shortened compared to the existing method.

[0300] 5. Constant value (H_FULL) for one acquired ciphertext -1 Performs isomorphic multiplication of .

[0301] Based on a similar principle, in the process of 2-party PBS bootstrapping between a server and a client, the number of intermediate ciphertexts exchanged can be reduced by half by using both the front half slots and the back half slots for the bootstrapping ciphertexts exchanged between the server and the client.

[0302]

[0303] Finally, we propose a method to omit the repetitive encoding of data within the ciphertext.

[0304] When the client transmits input feature values, the repeatedly encoded feature values ​​are included only once in the ciphertext and transmitted, and after the server receives the ciphertext, homomorphic rotation, homomorphic addition, or homomorphic multiplication is appropriately performed to restore the original number of omitted feature values ​​included only once.

[0305] In an ensemble decision tree, there may exist multiple thresholds (nodes with thresholds) for a single feature. Therefore, when performing size comparison operations on nodes in an ensemble decision tree, it is often necessary to compare multiple thresholds for each feature value of the client.

[0306] Accordingly, before executing homomorphic encryption-based inference procedures between the server and the client, they agree on matters including the homomorphic encryption scheme, information on cryptographic parameters, and the number of features.

[0307] Among these agreements is information regarding how many times each of the initial feature values ​​transmitted by the client to the server should be repeated-encoded. For example, if the feature values ​​are <Feature 1, Feature 2, Feature 3> = <Weight 60kg, Age 24, Height 175cm>, the server is configured to compare (operate) Feature 1 3 times, Feature 2 2 times, and Feature 3 5 times, according to the structure of the ensemble decision tree. However, in this case, the server does not instruct the client to repeat-encode Feature 1 3 times, Feature 2 2 times, and Feature 3 5 times; instead, it may request or instruct the client to send all features repeated-encoded 5 times. This is to avoid exposing the ensemble decision tree structure to the client.

[0308] Referring to the figure below, a method to omit the repetitive encoding of data within the ciphertext will be explained in more detail.

[0309] Referring to Fig. 12, the same feature value (age=28) must be compared with a total of 3 thresholds, and the same feature value (sleep=7) must be compared with a total of 2 thresholds.

[0310] Therefore, during homomorphic encryption operations, the efficiency of homomorphic operations can be improved by storing multiple thresholds with the same characteristics together within the plaintext of a single server and performing homomorphic operations simultaneously.

[0311] The same feature values ​​to be compared with the server's thresholds can also be stored repeatedly in the client's ciphertext.

[0312] The number of times the client's feature values ​​are stored can be adjusted to match the number of thresholds that appear most frequently for the same feature in the server's ensemble decision trees (padding technique). As explained earlier, this is a matter that the server requests or instructs the client to do.

[0313] In other words, if the exact number of occurrences of thresholds for each feature type is stored in the client's ciphertext to save ciphertext space, the client will know the number of thresholds for each feature type in the server's ensemble decision tree, which can be problematic because the client will then know some of the feature information of the server's ensemble decision tree.

[0314] Referring to the ciphertext construction method explained earlier, I will now explain the proposed method.

[0315] For example, when the feature values ​​are as follows,

[0316] PE(x1) = [010, 010, 001, 010]

[0317] PE(x2) = [010, 010, 001, 010]

[0318] PE(x3) = [010, 010, 001, 010]

[0319] That is, when the three ciphertexts are identical,

[0320] It was stated that ciphertext 1 (the first bit value of each feature value) can be represented as 0000 0000 0000, ciphertext 2 (the second bit value of each feature value) can be represented as 1101 1101 1101, and ciphertext 3 (the third bit value of each feature value) can be represented as 0010 0010 0010.

[0321] According to the proposed method, since the three feature values ​​are identical, instead of repeating the three feature values ​​to construct the ciphertext,

[0322] Ciphertext 1 (the first to fourth bit values ​​of the feature values) can be represented as 0100…, ciphertext 2 (the fifth to eighth bit values ​​of the feature values) can be represented as 1000…, and ciphertext 3 (the ninth to twelfth bit values ​​of the feature values) can be represented as 1010….

[0323] That is, in the example, the number of transmitted ciphertexts can be reduced to one-third. This is because there are three identical (repeating) feature values, and generally, the number of transmitted ciphertexts can be reduced to the inverse of the number of repeating feature values ​​(R) (1 / R).

[0324] I will explain the compression method in more detail.

[0325] The feature values ​​that are the subject of iteration encoding can be defined as a, b, and c. The repeating values ​​can be defined as a1, a2, a3, … b1, b2, b3, … c1, c2, c3, … respectively (where a1 = a2 = a3, b1 = b2 = b3, c1 = c2 = c3). Small repeating numbers 1, 2, 3… referring to the repeating values ​​are defined as “repeat indices”.

[0326] Within the same “repeating index,” there exist several different feature values ​​(i.e., a, b, c,…).

[0327] M can be defined as the maximum number of encoding iterations in which identical feature values ​​are repeated within the ciphertext transmitted by the client to the server.

[0328] Feature values ​​are repeatedly stored in the slots within the ciphertext. For example, slot[0] = a1, slot[1] = a2, … slot

[0012] = b1, slot

[0013] = b2.

[0329] These conditions must be satisfied so that feature values ​​for a new “repeat index” can be duplicated each time a homomorphic rotation is performed based on feature values ​​with “repeat index” 1.

[0330] In other words, by performing only n-1 isomorphic rotations, the feature values ​​corresponding to the remaining n “repetition indices” (=2, 3, …n) can be replicated to the appropriate slot positions of the corresponding ciphertext.

[0331] Here, the repetition status and number of repetitions of the repeating feature values ​​are considered to be the encoding rules of the public algorithm; therefore, the number of repetitions and slot positions of the feature values ​​are not client secret information, but the feature values ​​themselves are client secret information.

[0332] I will explain the compression method described earlier with an example.

[0333] [Scenario 1]

[0334] slot[0] = a1slot[3] = b1slot[6] = c1

[0335] slot[1] = a2slot[4] = b2slot[7] = c2

[0336] slot[2] = a3slot[5] = b3slot[8] = c3

[0337] In Scenario 1, the slot intervals of feature values ​​a1, b1, and c1 (slot[0], slot[3], slot[6]) with “repetition index” 1 are 3 and 3, respectively, and the slot intervals of feature values ​​a2, b2, and c2 (slot[1], slot[4], slot[7]) with “repetition index” 2 are also 3 and 3, respectively. Additionally, the slot intervals of feature values ​​a3, b3, and c3 (slot[2], slot[5], slot[8]) with “repetition index” 3 are also 3 and 3.

[0338] That is, even if the “repeat index” changes, the slot spacing of the feature values ​​all take the same encoding of 3, 3.

[0339] Therefore, by performing 2 isomorphic rotation operations with the feature values ​​with “repeat index” 1, the feature values ​​corresponding to the remaining 2 “repeat indices” (=2,3) can be duplicated and placed at the target slot positions. That is, only slot[0], slot[3], and slot[6] can be included in the ciphertext and transmitted.

[0340] The feature values ​​of “repeat index” 2 can be duplicated to the slot positions of “repeat index” 2 (slot[1], slot[4], slot[7]) by isomorphically rotating the feature values ​​of “repeat index” 1 (slot[0], slot[3], slot[6]) by 1 slot to the right. The feature values ​​of “repeat index” 3 can be duplicated to the slot positions of “repeat index” 3 (slot[2], slot[5], slot[8]) by isomorphically rotating the feature values ​​of “repeat index” 1 (slot[0], slot[3], slot[6]) by 2 slots to the right.

[0341] That is, it is possible to restore the slot state to the same state as before compression through two isomorphic rotation operations.

[0342] [Scenario 2]

[0343] slot[0] = a1 slot[4] = b1 slot[7] = c1

[0344] slot[1] = a2 slot[5] = unused slot[8] = c2

[0345] slot[2] = a3 slot[6] = b2 slot[9] = c3

[0346] slot[3] = garbage slot[7] = b3

[0347] In Scenario 2, the slot intervals for feature values ​​a1, b1, c1 (slot[0], slot[4], slot[7]) with “repeat index” 1 are 4 and 3, and the slot intervals for feature values ​​a2, b2, c2 (slot[1], slot[6], slot[8]) with “repeat index” 2 are 6 and 2. The slot intervals for feature values ​​a3, b3, c3 (slot[2], slot[7], slot[9]) with “repeat index” 3 are 5 and 2.

[0348] Since the slot spacing of feature values ​​changes when the “repeat index” changes, it is not possible to replicate the feature values ​​corresponding to the other two “repeat indices” (=2,3) to the target slot positions by performing only two isomorphic rotations on the feature values ​​with “repeat index” 1. If the feature values ​​with “repeat index” 1 (slot[0], slot[4], slot[7]) are isomorphically rotated one slot to the right, the corresponding feature values ​​are located at slot[1], slot[5], and slot[8], which is different from the slot positions of “repeat index” 2 (slot[1], slot[6], slot[9]). In other words, it is not possible to restore the slot state exactly as it was before compression with only two isomorphic rotations.

[0349] In summary, when plaintext stores identical data n times, the size of the encrypted plaintext can be reduced to a maximum of 1 / n using ciphertext compression technology. There is almost no additional computational load during ciphertext compression, and the additional computational load during ciphertext decompression is: 1) n-1 homomorphic rotations: generating n new ciphertexts by placing the feature values ​​of each “repetition index” in appropriate positions; 2) n homomorphic multiplications: performing homomorphic multiplication by creating masked plaintexts so that each ciphertext stores only the feature values ​​of a specific unique “repetition index” in appropriate slots and all other slot values ​​become 0; 3) n homomorphic additions: summing the n ciphertexts, in which only the feature values ​​of a specific unique “repetition index” are stored and all other slots are masked, to form a single ciphertext.

[0350] The computation time of the ciphertext compression method proposed in this invention can be summarized as follows.

[0351] R: Number of repetitions of each identical data within the same ciphertext

[0352] N: Total number of ciphertexts for data iteration encoding

[0353] N': Total number of ciphertexts in the case of ciphertext compression (removal of data repetitions).

[0354] ROTATE: Average operation time per isomorphic rotation

[0355] P_MULT: Operation time for a single plaintext-ciphertext homomorphic multiplication

[0356] ADD_MANY(n): Operation time of homomorphic addition (summation) of n ciphertexts

[0357] Final data decompression (iterative restoration) isomorphic operation time: = N' * ( Rotate * (R - 1) + P_MULT * R + ADD_MANY(R) )

[0358] In addition, the use of the “method of omitting repetitive encoding of data within the ciphertext” may be determined based on the following conditions.

[0359] DELAY( (N - N') * C_SIZE ) ≥ N' * ( Rotate * (R - 1) + P_MULT * R + ADD_MANY(R) )

[0360] Here, C_SIZE refers to the size of one ciphertext, and DELAY() refers to the network delay time required to transmit data of that size. That is, DELAY(N * C_SIZE) is the time required to transmit the ciphertext without compression, and DELAY(N'*C_SIZE) is the time required to transmit the compressed ciphertext.

[0361] Therefore, compression may be performed when the time improved through compression of the ciphertext (a reduction in the time required for transmission) is greater than or equal to the time required for decompression of the ciphertext, such as homomorphic rotation, homomorphic multiplication, and homomorphic addition. Accordingly, the server can monitor the client's network status to determine whether to perform the compression.

[0362] The performance test results based on the second and third compression schemes described above are as follows.

[0363] Tables 5 and 6 show the ciphertext size and inference operation time in the case of uncompressed ciphertext.

[0364] (BENCH)8-bit16-bit32-bitHeart9.38MB15.5MB40,0MBCancer5.67MB11.3MB35.9MBSteel5.67MB11.3MB35.9MBSpam5.89MB11.6MB36.1MB

[0365]

[0366] (BENCH)8-bit16-bit32-bitHeart3.35s3.40s4.26sCancer0.54s0.59s0.85sSteel0.71s0.93s1.17sSpam2.37s2.64s5.13s

[0367] Tables 7 and 8 show the ciphertext size and inference operation time during column rotation operations.

[0368] (BENCH)8-bit16-bit32-bitHeart8.03MB10.9MB23.2MBCancer3.89MB6.61MB18.9MBSteel3.89MB6.61MB18.9MBSpam4.13MB6.84MB19.2MB

[0369]

[0370] (BENCH)8-bit16-bit32-bitHeart3.39s2.80s3.23sCancer.59s0.60s0.80sSteel0.70s0.80s1.02sSpam1.99s2.37s3.58s

[0371] Tables 9 and 10 show the ciphertext size and inference operation time during column rotation and ciphertext compression.

[0372] (BENCH)8-bit16-bit32-bitHeart6.03MB6.82MB8.79MBCancer1.57MB2.49MB8.39MBSteel1.57MB2.49MB6.42MBSpam1.84MB3.41MB11.9MB

[0373]

[0374] (BENCH)8-bit16-bit32-bitHeart2.73s3.16s3.82sCancer0.65s0.72s0.94sSteel0.79s0.96s1.20sSpam2.86s3.02s4.35s

[0375] When column rotation was applied, the average ciphertext size was reduced by 45.9% and the inference speed was improved by 24.18%.

[0376] In addition, when column rotation and removal / restoration of repetitive data (ciphertext compression) were performed, the average ciphertext size was reduced by 80.0% and the inference speed was improved by 3.1%.

[0377]

[0378] In summary, various techniques were proposed regarding data processing technology using homomorphic encryption-based ensemble decision tree structures. To summarize,

[0379] 1) 2-party bootstrapping that initializes the multiplication depth of homomorphic ciphertexts and transforms values ​​so that the sum of the addition paths is a non-zero value to address the increase in homomorphic computational load,

[0380] 2) Measures to improve (fasten) the speed of isomorphic operations,

[0381] 2-1. Grouping nodes with the same threshold

[0382] 2-2. Unify thresholds for nodes with similar thresholds

[0383] 2-3. Methods to Optimize Additive Path Operations

[0384] 3) Measures to improve (reduce) network latency

[0385] 3-1. Using symmetric keys as homomorphic encryption keys

[0386] 3-2. Method using column rotation to ensure no empty slots in homomorphic ciphertexts

[0387] 3-3. Method to Omit Repeated Encoding of Ciphertext to Data

[0388] Suggested the back.

[0389] These individual techniques may be implemented by combining at least two individual techniques in relation to the operation of a client or server not illustrated in the flowchart of FIG. 5. Additionally, these individual techniques may be implemented independently in relation to the operation of a client or server not illustrated in the flowchart of FIG. 5.

[0390]

[0391] FIG. 13 illustrates a block diagram of a device for processing homomorphic encrypted data according to the present invention.

[0392] FIG. 13 illustrates a client device (100). The client device (100) may include a transceiver (110), a processor (120), and a memory (130).

[0393] The client device (100) is configured to perform the operation of the client (1000) described above.

[0394] The processor (120) may be configured to receive shuffled intermediate ciphertext and a mapping table for bootstrapping from the server device (200). Here, the intermediate ciphertext may include ciphertext encrypted using a homomorphic encryption key by the client device (100).

[0395] The processor (120) may be configured to decrypt the shuffled intermediate ciphertext using a homomorphic encryption key. Additionally, the processor (120) may be configured to bootstrap the decrypted shuffled intermediate ciphertext using a received mapping table. Here, bootstrapping may include the operation of converting or replacing specific values ​​of the decrypted shuffled intermediate ciphertext with a first predetermined value and converting or replacing the remaining values ​​with a second predetermined value.

[0396] The processor (120) may be configured to encrypt the bootstrapped shuffled intermediate ciphertext using a homomorphic encryption key. The processor (120) may be configured to transmit the encrypted bootstrapped shuffled intermediate ciphertext to a server device (200) through a transceiver (110).

[0397] The operation of the aforementioned client (1000), which is not described with reference to FIG. 13, can be performed by the client device (100).

[0398]

[0399] FIG. 14 illustrates a block diagram of a device for processing homomorphic encrypted data according to the present invention.

[0400] FIG. 14 illustrates a server device (200). The server device (200) may include a transceiver (210), a processor (220), and a memory (230).

[0401] The server device (200) is configured to perform the operation of the server (2000) described above.

[0402] The processor (220) may be configured to obtain a padded intermediate ciphertext by padding the element (x) into the intermediate ciphertext so that the number of specific elements (x) included in the homomorphically encrypted intermediate ciphertext becomes a preset number. Additionally, the processor (220) may be configured to shuffle the elements of the padded intermediate ciphertext using a shuffling algorithm.

[0403] The processor (220) may be configured to transmit the shuffled intermediate ciphertext and the mapping table for bootstrapping to the client through the transceiver (210).

[0404] The operation of the aforementioned server (2000), which is not described with reference to FIG. 14, can be performed by the server device (200).

[0405]

[0406] In addition, as another aspect of the present invention, the operation of the above-described proposal or invention may be provided as code that can be implemented, practiced, or executed by a "computer" (a comprehensive concept including a system on chip (SoC) or (micro)processor, etc.), or as a computer-readable storage medium or computer program product that stores or contains said code, and the scope of the present invention may be extended to said code or as a computer-readable storage medium or computer program product that stores or contains said code.

[0407]

[0408] The detailed description of the preferred embodiments of the present invention disclosed above is provided to enable those skilled in the art to implement and practice the present invention. Although the present invention has been described with reference to preferred embodiments, those skilled in the art will understand that various modifications and changes can be made to the present invention as described in the following claims. Accordingly, the present invention is not intended to be limited to the embodiments shown herein, but to be given the broadest scope consistent with the principles and novel features disclosed herein.

Claims

1. In a data processing method using a homomorphic encryption-based ensemble decision tree model, A step of obtaining a padded intermediate ciphertext by padding the element (x) into the intermediate ciphertext so that the number of specific elements (x) included in the homomorphically encrypted intermediate ciphertext becomes a preset number; A step of shuffling the elements of the padded intermediate ciphertext using a shuffling algorithm; and A method comprising the step of transmitting the shuffled intermediate ciphertext and a mapping table for bootstrapping to a client.

2. In claim 1, the step of receiving from the client a second ciphertext obtained by decrypting the shuffled intermediate ciphertext with a homomorphic encryption key and then homomorphically encrypting the bootstrapped plaintext using the mapping table; and A method comprising the step of unshuffling the second ciphertext using the shuffling algorithm above.

3. In paragraph 1 or 2, the mapping table is, A method instructing the conversion of the value of a specific element of the shuffled intermediate ciphertext to be decrypted to a and the value of the remaining element to b, wherein a and b are integers.

4. In paragraph 3, a is 1 and b is 0.

5. In paragraph 1, the shuffling step is, A method comprising the step of obtaining an intermediate ciphertext that is randomly shuffled using two masking arrays and a random number from the padded intermediate ciphertext.

6. A method according to paragraph 5, wherein the two masking arrays are set to have a relationship in which they are rotated and transformed relative to each other by a preset number of digits or bits.

7. A method according to claim 5, wherein the two masking arrays are configured to have a structure in which 1 and 0 are each repeated as many times as a power of 2 selected within a preset range.

8. In paragraph 1, the shuffling step is, A method comprising the step of obtaining an intermediate ciphertext that is randomly shuffled using a permutation matrix from the padded intermediate ciphertext.

9. In claim 1 or 2, the method comprises the step of performing a homomorphic operation on the homomorphically encrypted intermediate ciphertext or the unshuffled second ciphertext, and A method comprising a comparison operation between the intermediate ciphertext or the second ciphertext and a plaintext composed of thresholds of a plurality of nodes of the ensemble decision tree, wherein the above homomorphic operation includes the above intermediate ciphertext or the above second ciphertext.

10. In Paragraph 9, A step of selecting a first group of nodes among the plurality of nodes in which the feature value corresponding to the ciphertext is identical and the threshold value falls within a specific range; and The method includes the step of obtaining a common threshold of the nodes of the first group, and A method in which only the comparison operation is performed on any one of the nodes of the first group, and the result of the comparison operation performed is used for the rest of the nodes of the first group.

11. In claim 9, the step of identifying paths among the paths of the ensemble decision tree in which the combination of feature values ​​and thresholds to be compared is the same; and The method includes the step of performing the comparison operation on any one of the identified paths, A method in which the result of the comparison operation performed above is used for the remaining paths among the paths identified above.

12. In claim 1, the step of receiving a plurality of homomorphically encrypted feature values ​​from the client, and The above homomorphic encrypted feature values ​​are, A method in which the above-mentioned plurality of feature values ​​are coded repeatedly for a predetermined number of repetitions (M), and coded to have a constant slot offset between the feature values ​​within a single ciphertext containing the above-mentioned homomorphically encrypted plurality of feature values.

13. In a data processing method using a homomorphic encryption-based ensemble decision tree model, Step of receiving a shuffled intermediate ciphertext and a mapping table for bootstrapping from a server - the intermediate ciphertext is encrypted by a client using a homomorphic encryption key - ; A step of decrypting the shuffled intermediate ciphertext using the homomorphic encryption key; A step of bootstrapping the decrypted shuffled intermediate ciphertext using the mapping table above; A step of encrypting the bootstrapped and shuffled intermediate ciphertext using the homomorphic encryption key; and A step comprising transmitting the above encrypted bootstrapped shuffled intermediate ciphertext to the server, method.

14. In Clause 13, the above mapping table is, A method instructing the conversion of the value of a specific element of the above decoded shuffled intermediate ciphertext to a and the value of the remaining element to b, wherein a and b are integers.

15. In paragraph 14, a is 1 and b is 0.

16. In paragraph 13, the bootstrapping step is, A method comprising the step of converting a specific element of the decoded shuffled intermediate ciphertext to a and converting the remaining elements to b according to the mapping table above.

17. In paragraph 13, the step of transmitting a plurality of homomorphically encrypted feature values ​​to the server, and The above homomorphic encrypted feature values ​​are, A method in which the above-mentioned plurality of feature values ​​are coded repeatedly for a predetermined number of repetitions (M), and coded to have a constant slot offset between the feature values ​​within a single ciphertext containing the above-mentioned homomorphically encrypted plurality of feature values.

18. A computer-readable medium storing a computer program composed of code configured to perform a method according to any one of paragraphs 1 through 17.

19. An apparatus for data processing using a homomorphic encryption-based ensemble decision tree model, A transceiver configured to receive a ciphertext from a client or transmit a homomorphic result to said client; and It includes a processor configured to perform processing of ciphertext using the above homomorphic encryption-based ensemble decision tree model, and The above processor is, Obtaining a padded intermediate ciphertext by padding the intermediate ciphertext with the element (x) such that the number of specific elements (x) included in the homomorphically encrypted intermediate ciphertext becomes a preset number; The elements of the padded intermediate ciphertext are shuffled using a shuffling algorithm; and A device configured to transmit the shuffled intermediate ciphertext and a mapping table for bootstrapping to a client.

20. An apparatus for data processing using a homomorphic encryption-based ensemble decision tree model, A transceiver configured to transmit a homomorphically encrypted ciphertext to a server or to receive the result of a homomorphic operation on the ciphertext from the server; and It includes a processor configured to obtain the homomorphically encrypted ciphertext or to process the ciphertext, and The above processor is, Receive shuffled intermediate ciphertext and a mapping table for bootstrapping from the above server - the above intermediate ciphertext is encrypted by the client using a homomorphic encryption key - ; Decrypt the above-mentioned shuffled intermediate ciphertext using the above-mentioned homomorphic encryption key; Bootstrapping the decrypted shuffled intermediate ciphertext using the above mapping table; Encrypting the bootstrapped and shuffled intermediate ciphertext using the homomorphic key; and A device configured to transmit the above-mentioned encrypted bootstrapped shuffled intermediate ciphertext to the server.

Images