Method performed by device, server and storage medium, method performed by server, and device and storage medium

Abstract

This device may: generate a private key and an evaluation key; generate a first homomorphic ciphertext by homomorphically encrypting information on user data; transmit the first homomorphic ciphertext and the evaluation key to a server; receive a second homomorphic ciphertext related to the first homomorphic ciphertext from the server; obtain first data compression-related information by decrypting the second homomorphic ciphertext using the private key; generate compressed data by compressing the user data on the basis that the first data compression-related information includes a first value; generate a third homomorphic ciphertext by homomorphically encrypting the compressed data; and transmit the third homomorphic ciphertext to the server.

Description

A method performed by a device, a server and a storage medium, and a method performed by a server, a device and a storage medium

[0001] This specification relates to a method and apparatus for providing improved security services in a communication system.

[0002] The challenge lies in finding a method to transmit information between two parties in a communication system while preventing a third party from obtaining it. For instance, in the field of electronic financial transactions, maintaining confidentiality between the two entities during the communication process is critical. To address security issues in communication, many techniques have been developed, such as private key cryptography and public key cryptography.

[0003] Private key cryptography is also known as symmetric key cryptography, symmetric encryption, secret key cryptography, or single key cryptography. In private key cryptography, a single secret key shared between the sending side and the receiving side is used for both encryption and decryption. This secret key is also referred to as a symmetric key or a private key. Although private key cryptography is a simple and easy-to-use encryption method, since the key must be shared between the sending side that sends information and the receiving side that receives the information, there is a risk that the key may be exposed to a third party who does not have the authority to read the information during the process of sharing the key between the sending side and the receiving side.

[0004] Public key cryptography is also known as asymmetric key cryptography or asymmetric encryption. In public key cryptography, a public key, which is made public for anyone to use, and a private key (also called a secret key), which is kept secret by the entity receiving the ciphertext encrypted with the public key, are used. Each entity on the network generates a pair of keys for encryption and decryption. When the sending side encrypts information using the recipient's public key and transmits the resulting ciphertext, the receiving side attempts to decrypt the ciphertext using its own private key. Ciphertext encrypted with a public key can only be decrypted using the private key that is paired with the public key. In public key cryptography, prior distribution of private keys is not required; for secure communication, if the sending side encrypts information using the receiving side's public key and transmits the resulting ciphertext, the receiving side can decrypt the ciphertext using the private key corresponding to the public key. However, in the case of public key cryptography, there is a possibility that a malicious user could impersonate the sending side and communicate with the receiving side. To prevent this, a trusted third party (TTP) (also referred to as a certificate authority, CA) may be utilized. For example, a certificate authority can certify the credentials of an entity identified by a digital certificate by issuing said digital certificate. The receiving party can verify said transmitting party through the digital certificate of said transmitting party, and once the verification of said transmitting party is successfully completed, it can decrypt the ciphertext received from said transmitting party using its own private key.

[0005] This specification provides a method to secure against the disadvantages caused by homomorphic encryption when the homomorphic encryption method is applied to communication.

[0006] The technical problems that this specification aims to solve are not limited to those mentioned above, and other technical problems not mentioned will be clearly understood by those skilled in the art related to this specification from the detailed description below.

[0007] In one aspect of the present specification, a method performed in a device is provided. In another aspect of the present specification, a device is provided comprising: at least one processor; and at least one computer memory operably connectable to the at least one processor and, when executed, storing instructions that cause the at least one processor to perform operations. In yet another aspect of the present specification, a computer-readable non-transient storage medium is provided, storing instructions that, when executed, cause the at least one processor to perform operations. The operations of the method, or the device or storage medium, are provided: generating a private key sk and an evaluation key ek; homomorphically encrypting information regarding user data m to generate a first homomorphic ciphertext; transmitting the first homomorphic ciphertext and the evaluation key ek to a server; receiving a second homomorphic ciphertext associated with the first homomorphic ciphertext from the server; decrypting the second homomorphic ciphertext with the private key sk to obtain information related to the first data compression; Compressed data f by compressing the user data m based on the fact that the above first data compression information includes a first value c Generate (m); the compressed data f c It may include homomorphically encrypting (m) to generate a third homomorphic ciphertext; and transmitting the third homomorphic ciphertext to the server.

[0008] In each aspect of the present specification, based on the first data compression information including the first value, the first data compression information further includes information regarding a compression method, and the user data m can be compressed according to the compression method.

[0009] In each aspect of the present specification, the operations of the method, or the device or storage medium may include: generating a fifth homomorphic ciphertext by homomorphically encrypting decompression-related information based on the first data compression-related information including the first value, and transmitting the third homomorphic ciphertext to the server may include: transmitting the third homomorphic ciphertext and the fifth homomorphic ciphertext to the server.

[0010] In each aspect of the present specification, transmitting the third homomorphic ciphertext to the server may include transmitting second data compression-related information to the server, the information regarding the third homomorphic ciphertext, the fifth homomorphic ciphertext, and the compression technique applied to the user data m.

[0011] In each aspect of the present specification, the second data compression-related information is the third homomorphic ciphertext being the compressed data f c It may include information indicating that (m) is included.

[0012] In each aspect of the present specification, the operations of the method, or the device or storage medium may include: receiving a sixth homomorphic ciphertext from the server based on transmitting the third homomorphic ciphertext to the server; and decrypting the sixth homomorphic ciphertext with the private key sk to obtain an operation result related to the user data m.

[0013] In each aspect of the present specification, based on the first data compression information including a second value, the operations of the method, or the device or storage medium may include: generating a fourth homomorphic ciphertext by homomorphically encrypting the user data m without compression; transmitting the fourth homomorphic ciphertext to the server; receiving a sixth homomorphic ciphertext from the server based on transmitting the fourth homomorphic ciphertext to the server; and decrypting the sixth homomorphic ciphertext with the private key sk to obtain an operation result related to the user data m.

[0014] In another aspect of the present specification, a method performed on a server is provided. In another aspect of the present specification, a server is provided comprising: at least one processor; and at least one computer memory operably connectable to the at least one processor and, when executed, storing instructions that cause the at least one processor to perform operations. In another aspect of the present specification, a computer-readable non-transient storage medium is provided that stores instructions that cause the at least one processor to perform operations when executed. The methods, or the operations of the device or storage medium, are provided as follows: receiving a first homomorphic ciphertext and an evaluation key from the device; generating a second homomorphic ciphertext by performing a first homomorphic operation on the first homomorphic ciphertext based on the evaluation key; transmitting the second homomorphic ciphertext to the device; receiving a third homomorphic ciphertext containing compressed data and a fourth homomorphic ciphertext containing decompression information from the device; Based on the third homomorphic ciphertext, the fourth homomorphic ciphertext, and the evaluation key, a second homomorphic operation for decompression of the third homomorphic ciphertext is performed to generate a fifth homomorphic ciphertext; based on the evaluation key, a third homomorphic operation is performed on the fifth homomorphic ciphertext to generate a sixth homomorphic ciphertext; and the sixth homomorphic ciphertext is transmitted to the device.

[0015] In each aspect of the present specification, receiving the third homomorphic ciphertext and the fourth homomorphic ciphertext from the device may include further receiving data compression-related information from the device.

[0016] In each aspect of the present specification, the data compression information may include information regarding a compression method for the compressed data.

[0017] In each aspect of the present specification, the data compression information may include information regarding whether the third homomorphic ciphertext includes compressed data.

[0018] The above-mentioned problem-solving methods are merely some of the examples of this specification, and various examples reflecting the technical features of this specification can be derived and understood by a person with ordinary knowledge in the relevant technical field based on the detailed description below.

[0019] According to some implementations of this specification, whether and / or the method of compressing the user's plaintext data can be determined through a prior communication process between the server and the user.

[0020] According to some implementations of this specification, the size of the ciphertext can be reduced.

[0021] According to some implementations of this specification, network resources (e.g., wireless resources) used for communication between a server and a user can be saved.

[0022] According to some implementations of this specification, the storage space, computational load, and / or communication load required for security services can be optimized accordingly.

[0023] The effects of this specification are not limited to those mentioned above, and other unmentioned effects will be clearly understood by those skilled in the art related to this specification from the detailed description below.

[0024] The attached drawings, included as part of the detailed description to aid in understanding the implementations of this specification, provide examples of the implementations of this specification and describe the implementations of this specification together with the detailed description:

[0025] FIG. 1 illustrates an example of a communication system 1 to which the implementations of the present specification are applied;

[0026] FIG. 2 is a block diagram illustrating examples of communication devices capable of performing the method according to the present specification;

[0027] FIG. 3 illustrates another example of a wireless device capable of performing implementation(s) of the present specification;

[0028] Figure 4 is an example of a homomorphic encryption model;

[0029] FIGS. 5 through 7 illustrate computational processes occurring at a transmitter (e.g., user) and a receiver (e.g., server) when data compression is used and when it is not used in some implementations of the present specification;

[0030] FIG. 8 illustrates the signal transmission / reception flow in a device according to some implementations of the present specification;

[0031] FIG. 9 illustrates the signal transmission / reception flow in a server according to some implementations of the present specification.

[0032] Implementations according to this specification are described below with reference to the accompanying drawings. The detailed description disclosed below, together with the accompanying drawings, is intended to describe exemplary implementations of this specification and is not intended to represent the only form in which this specification may be practiced. The detailed description below includes specific details to provide a complete understanding of this specification. However, those skilled in the art will know that this specification may be practiced without such specific details.

[0033] In some cases, to avoid ambiguity regarding the concepts of this specification, known structures and devices may be omitted or illustrated in the form of block diagrams focusing on the core functions of each structure and device. Additionally, the same reference numerals are used to describe identical components throughout this specification.

[0034] The techniques, devices, and systems described below can be applied to various wireless multiple access systems. Examples of multiple access systems include CDMA (code division multiple access) systems, FDMA (frequency division multiple access) systems, TDMA (time division multiple access) systems, OFDMA (orthogonal frequency division multiple access) systems, SC-FDMA (single carrier frequency division multiple access) systems, and MC-FDMA (multi carrier frequency division multiple access) systems. CDMA can be implemented in wireless technologies such as UTRA (Universal Terrestrial Radio Access) or CDMA2000. TDMA can be implemented in wireless technologies such as GSM (Global System for Mobile communication), GPRS (General Packet Radio Service), and EDGE (Enhanced Data Rates for GSM Evolution) (i.e., GERAN). OFDMA can be implemented in wireless technologies such as IEEE (Institute of Electrical and Electronics Engineers) 802.11 (WiFi), IEEE 802.16 (WiMAX), IEEE 802-20, and E-UTRA (evolved-UTRA). UTRA is part of UMTS (Universal Mobile Telecommunication System), and 3GPP (3rd Generation Partnership Project) LTE (Long Term Evolution) is part of E-UMTS that utilizes E-UTRA.3GPP LTE adopts OFDMA for the downlink (DL) and SC-FDMA for the uplink (UL). LTE-A (LTE-advanced) is an evolved form of 3GPP LTE.

[0035] In this specification, a user (also referred to as a client) may refer to the communication device itself, or an entity that sends information or data related to itself to a server through said communication device. In this case, said communication device may be user equipment (UE). In this specification, a UE may be fixed or mobile, and includes various devices that communicate with a base station (BS) to transmit and / or receive user data and / or various control information. A UE may be referred to as Terminal Equipment, Mobile Station (MS), Mobile Terminal (MT), User Terminal (UT), Subscribe Station (SS), wireless device, Personal Digital Assistant (PDA), wireless modem, handheld device, etc. Furthermore, in this specification, a BS generally refers to a fixed station that communicates with a UE and / or other BSs, and exchanges various data and control information by communicating with a UE and other BSs. BS can be referred to by other terms such as ABS (Advanced Base Station), NB (Node-B), eNB (evolved-NodeB), BTS (Base Transceiver System), Access Point, and PS (Processing Server).

[0036] FIG. 1 illustrates an example of a communication system 1 to which the implementations of the present specification apply. Referring to FIG. 1, the communication system (1) to which the present specification applies includes a wireless device, a BS, and a network. Here, a wireless device refers to a device that performs communication using wireless access technology (e.g., 5G NR (New RAT), communication technology after 5G)) and may be referred to as a communication / wireless / 5G / 6G device. Although not limited thereto, a wireless device may include a robot (100a), a vehicle (100b-1, 100b-2), an XR (eXtended Reality) device (100c), a hand-held device (100d), a home appliance (100e), an IoT (Internet of Thing) device (100f), and an AI device / server (400). For example, a vehicle may include a vehicle equipped with wireless communication capabilities, an autonomous vehicle, a vehicle capable of performing inter-vehicle communication, etc. Here, vehicles may include UAVs (Unmanned Aerial Vehicles) (e.g., drones). XR devices include AR (Augmented Reality) / VR (Virtual Reality) / MR (Mixed Reality) devices and may be implemented in the form of HMDs (Head-Mounted Devices), HUDs (Head-Up Displays) equipped in vehicles, televisions, smartphones, computers, wearable devices, home appliances, digital signage, vehicles, robots, etc. Portable devices may include smartphones, smartpads, wearable devices (e.g., smartwatches, smart glasses), computers (e.g., laptops, etc.). Home appliances may include TVs, refrigerators, washing machines, etc. IoT devices may include sensors, smart meters, etc. For example, BS and networks may be implemented as wireless devices, and specific wireless devices may operate as BS / network nodes to other wireless devices.

[0037] Wireless devices (100a to 100f) can be connected to a network (300) via a BS (200). Artificial Intelligence (AI) technology may be applied to the wireless devices (100a to 100f), and the wireless devices (100a to 100f) can be connected to an AI server (400) via the network (300). The network (300) can be configured using a 3G network, a 4G (e.g., LTE) network, or a 5G (e.g., NR) network. The wireless devices (100a to 100f) may communicate with each other via the BS (200) / network (300), but they may also communicate directly (e.g., sidelink communication) without using the BS / network. For example, vehicles (100b-1, 100b-2) can communicate directly (e.g., V2V (Vehicle to Vehicle) / V2X (Vehicle to everything) communication). Also, IoT devices (e.g., sensors) can communicate directly with other IoT devices (e.g., sensors) or other wireless devices (100a to 100f).

[0038] Wireless communication / connection (150a, 150b) may be established between wireless devices (100a~100f) / BS (200) and BS (200) / wireless devices (100a~100f). Here, the wireless communication / connection may be established through uplink / downlink communication (150a) and sidelink communication (150b) (or D2D communication) using various wireless access technologies (e.g., 5G NR). Through the wireless communication / connection (150a, 150b), wireless devices and BS / wireless devices may transmit / receive wireless signals to / from each other. To this end, based on various proposals of the present specification, at least some of the following may be performed: a process for setting various configuration information for transmitting / receiving wireless signals, a process for various signal processing (e.g., channel encoding / decoding, modulation / demodulation, resource mapping / demapping, etc.), and a resource allocation process.

[0039] FIG. 2 is a block diagram illustrating examples of communication devices capable of performing the method according to the present specification. Referring to FIG. 2, a first wireless device (100) and a second wireless device (200) can transmit and / or receive wireless signals through various wireless access technologies (e.g., LTE, NR). Here, {the first wireless device (100), the second wireless device (200)} may correspond to {wireless device (100x), BS (200)} and / or {wireless device (100x), wireless device (100x)} of FIG. 1.

[0040] The first wireless device (100) includes one or more processors (102) and one or more memories (104), and may additionally include one or more transceivers (106) and / or one or more antennas (108). The processor (102) controls the memory (104) and / or transceivers (106) and may be configured to implement the functions, procedures and / or methods described / suggested below. For example, the processor (102) may process information within the memory (104) to generate a first information / signal and then transmit a wireless signal containing the first information / signal through the transceiver (106). Additionally, the processor (102) may receive a wireless signal containing a second information / signal through the transceiver (106) and then store information obtained from the signal processing of the second information / signal in the memory (104). Memory (104) may be connected to the processor (102) and may store various information related to the operation of the processor (102). For example, memory (104) may store software code containing instructions for performing some or all of the processes controlled by the processor (102) or for performing the procedures and / or methods described / suggested below. Here, the processor (102) and memory (104) may be part of a communication modem / circuit / chip designed to implement wireless communication technology (e.g., LTE, NR). A transceiver (106) may be connected to the processor (102) and may transmit and / or receive wireless signals through one or more antennas (108). The transceiver (106) may include a transmitter and / or receiver. The transceiver (106) may be interchangeably used with an RF (Radio Frequency) unit. In this specification, a wireless device may mean a communication modem / circuit / chip.

[0041] The second wireless device (200) includes one or more processors (202) and one or more memories (204), and may additionally include one or more transceivers (206) and / or one or more antennas (208). The processor (202) controls the memory (204) and / or transceivers (206) and may be configured to implement the functions, procedures and / or methods described / suggested below. For example, the processor (202) may process information within the memory (204) to generate a third information / signal and then transmit a wireless signal containing the third information / signal through the transceiver (206). Additionally, the processor (202) may receive a wireless signal containing a fourth information / signal through the transceiver (206) and then store information obtained from the signal processing of the fourth information / signal in the memory (204). Memory (204) may be connected to the processor (202) and may store various information related to the operation of the processor (202). For example, memory (204) may store software code containing instructions for performing some or all of the processes controlled by the processor (202) or for performing the procedures and / or methods described / suggested below. Here, the processor (202) and memory (204) may be part of a communication modem / circuit / chip designed to implement wireless communication technology (e.g., LTE, NR). A transceiver (206) may be connected to the processor (202) and may transmit and / or receive wireless signals through one or more antennas (208). The transceiver (206) may include a transmitter and / or receiver. The transceiver (206) may be interchangeably used with an RF unit. In this specification, a wireless device may mean a communication modem / circuit / chip.

[0042] Hereinafter, hardware elements of the wireless device (100, 200) will be described in more detail. Although not limited thereto, one or more protocol layers may be implemented by one or more processors (102, 202). For example, one or more processors (102, 202) may implement one or more layers (e.g., functional layers such as a physical (PHY) layer, a medium access control (MAC) layer, a radio link control (RLC) layer, a packet data convergence protocol (PDCP) layer, a radio resource control (RRC) layer, and a service data adaptation protocol (SDAP) layer). One or more processors (102, 202) may generate one or more protocol data units (PDU) and / or one or more service data units (SDU) according to the functions, procedures, proposals and / or methods disclosed in this document. One or more processors (102, 202) may generate messages, control information, data, or information according to the functions, procedures, proposals, and / or methods disclosed in this document. One or more processors (102, 202) may generate a signal (e.g., baseband signal) containing a PDU, SDU, message, control information, data, or information according to the functions, procedures, proposals, and / or methods disclosed in this document and provide it to one or more transceivers (106, 206). One or more processors (102, 202) may receive a signal (e.g., baseband signal) from one or more transceivers (106, 206) and may obtain a PDU, SDU, message, control information, data, or information according to the functions, procedures, proposals, and / or methods disclosed in this document.

[0043] One or more processors (102, 202) may be referred to as a controller, microcontroller, microprocessor, or microcomputer. One or more processors (102, 202) may be implemented by hardware, firmware, software, or a combination thereof. For example, one or more Application Specific Integrated Circuits (ASICs), one or more Digital Signal Processors (DSPs), one or more Digital Signal Processing Devices (DSPDs), one or more Programmable Logic Devices (PLDs), or one or more Field Programmable Gate Arrays (FPGAs) may be included in one or more processors (102, 202). The functions, procedures, proposals, and / or methods disclosed in this document may be implemented using firmware or software, and the firmware or software may be implemented to include modules, procedures, functions, etc. Firmware or software configured to perform the functions, procedures, proposals, and / or methods disclosed in this document may be included in one or more processors (102, 202) or stored in one or more memories (104, 204) and driven by one or more processors (102, 202). The functions, procedures, proposals, and / or methods disclosed in this document may be implemented using firmware or software in the form of code, instructions, and / or sets of instructions.

[0044] One or more memories (104, 204) may be connected to one or more processors (102, 202) and may store various forms of data, signals, messages, information, programs, codes, instructions, and / or commands. One or more memories (104, 204) may be composed of ROM, RAM, EPROM, flash memory, hard drive, registers, cache memory, computer read storage media, and / or combinations thereof. One or more memories (104, 204) may be located inside and / or outside of one or more processors (102, 202). Additionally, one or more memories (104, 204) may be connected to one or more processors (102, 202) through various technologies such as wired or wireless connections.

[0045] One or more transceivers (106, 206) may transmit user data, control information, wireless signals / channels, etc., as mentioned in the methods and / or operation flowcharts, etc., of this document to one or more other devices. One or more transceivers (106, 206) may receive user data, control information, wireless signals / channels, etc., as mentioned in the functions, procedures, proposals, methods and / or operation flowcharts, etc., disclosed in this document from one or more other devices. For example, one or more transceivers (106, 206) may be connected to one or more processors (102, 202) and may transmit and / or receive wireless signals. For example, one or more processors (102, 202) may control one or more transceivers (106, 206) to transmit user data, control information, or wireless signals to one or more other devices. Additionally, one or more processors (102, 202) may control one or more transceivers (106, 206) to receive user data, control information, or wireless signals from one or more other devices. Additionally, one or more transceivers (106, 206) may be connected to one or more antennas (108, 208), and one or more transceivers (106, 206) may be configured to transmit and / or receive user data, control information, wireless signals / channels, etc., as mentioned in the functions, procedures, proposals, methods, and / or operation flowcharts disclosed in this document through one or more antennas (108, 208). In this document, one or more antennas may be multiple physical antennas or multiple logical antennas (e.g., antenna ports). One or more transceivers (106, 206) can convert the received wireless signal / channel, etc. from an RF band signal to a baseband signal in order to process the received user data, control information, wireless signal / channel, etc. using one or more processors (102, 202).One or more transceivers (106, 206) can convert user data, control information, wireless signals / channels, etc. processed using one or more processors (102, 202) from baseband signals to RF band signals. To this end, one or more transceivers (106, 206) may include (analog) oscillators and / or filters.

[0046] FIG. 3 illustrates another example of a wireless device capable of performing implementation(s) of the present specification. Referring to FIG. 3, the wireless device (100, 200) corresponds to the wireless device (100, 200) of FIG. 2 and may be composed of various elements, components, units / parts, and / or modules. For example, the wireless device (100, 200) may include a communication unit (110), a control unit (120), a memory unit (130), and an additional component (140). The communication unit may include a communication circuit (112) and transceiver(s) (114). For example, the communication circuit (112) may include one or more processors (102, 202) and / or one or more memories (104, 204) of FIG. 2. For example, the transceiver(s) (114) may include one or more transceivers (106, 206) and / or one or more antennas (108, 208) of FIG. 2. The control unit (120) is electrically connected to the communication unit (110), the memory unit (130), and additional components (140) and controls the general operation of the wireless device. For example, the control unit (120) may control the electrical / mechanical operation of the wireless device based on a program / code / command / information stored in the memory unit (130). Additionally, the control unit (120) may transmit information stored in the memory unit (130) to an external (e.g., another communication device) via a wireless / wired interface through the communication unit (110), or store information received from an external (e.g., another communication device) via a wireless / wired interface through the communication unit (110) in the memory unit (130).

[0047] The additional configuration (140) can be configured in various ways depending on the type of wireless device. For example, the additional configuration (140) may include at least one of a power unit / battery, an input / output unit (I / O unit), a driving unit, and a computing unit. Although not limited thereto, the wireless device may be implemented in the form of a robot (Fig. 1, 100a), a vehicle (Fig. 1, 100b-1, 100b-2), an XR device (Fig. 1, 100c), a portable device (Fig. 1, 100d), a home appliance (Fig. 1, 100e), an IoT device (Fig. 1, 100f), a UE for digital broadcasting, a hologram device, a public safety device, an MTC device, a medical device, a fintech device (or financial device), a security device, a climate / environment device, an AI server / device (Fig. 1, 400), a BS (Fig. 1, 200), a network node, etc. Wireless devices can be used in a movable or fixed location depending on the use—e.g., service.

[0048] In FIG. 3, various elements, components, units / parts, and / or modules within the wireless device (100, 200) may be entirely interconnected via a wired interface, or at least a portion may be wirelessly connected via a communication unit (110). For example, within the wireless device (100, 200), the control unit (120) and the communication unit (110) may be wired, and the control unit (120) and the first unit (e.g., 130, 140) may be wirelessly connected via the communication unit (110). Additionally, each element, component, unit / part, and / or module within the wireless device (100, 200) may include one or more additional elements. For example, the control unit (120) may be composed of one or more sets of processors. For example, the control unit (120) may be composed of a set of communication control processors, application processors, ECUs (Electronic Control Units), graphics processing processors, memory control processors, etc. As another example, the memory unit (130) may be composed of RAM (Random Access Memory), DRAM (Dynamic RAM), ROM (Read Only Memory), flash memory, volatile memory, non-volatile memory, and / or a combination thereof.

[0049] In this specification, at least one memory (e.g., 104 or 204) may store instructions or programs, and said instructions or programs may, when executed, cause at least one processor operablely connected to said at least one memory to perform operations according to some embodiments or implementations of this specification.

[0050] In this specification, a computer-readable (non-transient) storage medium may store at least one instruction or computer program, and when executed by at least one processor, said at least one instruction or computer program may cause said at least one processor to perform operations according to some embodiments or implementations of this specification.

[0051] In this specification, a processing device or apparatus may include at least one processor and at least one computer memory connectable to said at least one processor. said at least one computer memory may store instructions or programs, and said instructions or programs, when executed, may cause at least one processor operablely connected to said at least one memory to perform operations according to some embodiments or implementations of this specification.

[0052] In this specification, a computer program may include program code stored on at least one computer-readable (non-transient) storage medium and, when executed, perform operations according to some implementations of this specification or cause at least one processor to perform operations according to some implementations of this specification. The computer program may be provided in the form of a computer program product. The computer program product may include at least one computer-readable (non-transient) storage medium.

[0053] A communication device of this specification comprises at least one processor; and at least one computer memory operably connected to said at least one processor and storing instructions that, when executed, cause said at least one processor to perform operations according to the examples(s) of this specification described below.

[0054] In some implementations of this specification, the user or client may be a communication device described in FIG. 2 or FIG. 3 or an entity that performs transmission / reception through said communication device.

[0055] In some implementations of this specification, the (cloud) server may be a communication device, a processing device, or an object on which such communication / processing device is installed as described in FIG. 2 or FIG. 3, and / or an object connected wirelessly and / or wired to another server or a trusted party.

[0056] Various encryption methods have been proposed to address security issues in communications. However, according to conventional encryption methods, if a receiving end needs to perform verification or operations on user data contained in ciphertext received from a transmitting end, said receiving end can only perform such verification or operations after decrypting the data to obtain the plaintext. However, if the plaintext contains information of critical security importance, such as personal information, there is a problem in that such personal information is exposed to the receiving end. To resolve this issue, the introduction of homomorphic cryptography into communication systems, which allows operations to be performed on encrypted data without decryption, is being discussed. Below, several implementations of this specification regarding methods for transmitting and analyzing user data in an encrypted state between communication devices or between a communication device and a server by adopting homomorphic encryption (HE) techniques are described. The following notations are used in this specification.

[0057] - λ: security parameter

[0058] - m: A binary file or sequence of length k that the user intends to encrypt. Also called a plaintext message.

[0059] - ct: Ciphertext from homomorphic encryption (HE)

[0060] - pk: HE public key

[0061] - sk: HE secret key

[0062] - ek: HE evaluation key

[0063] - Enc: Encryption algorithm or encryptor

[0064] - Dec: Decryption algorithm or decryptor

[0065] - Eval: Isomorphic operation (also called evaluation)

[0066] -f c : Compression function

[0067] -f c (m): A compressed file of size n (i.e., a binary sequence of size n)

[0068] Homomorphic encryption (HE), or homomorphic cryptography, is an encryption technique that enables operations between ciphertexts (without decryption) and is utilized within a user-server model. In the HE realm, a user encrypts data using homomorphic encryption and then transmits the encrypted data to a server along with an evaluation key to be used for operations. The server can perform operations on the encrypted ciphertext without decrypting it, using the encrypted data and the evaluation key. The operations performed on the homomorphic ciphertext using the evaluation key are called evaluations. After all these operations are completed, the server transmits the ciphertext obtained as the result of the operations back to the user, and the user can verify the operation results by decrypting the ciphertext using their private key (i.e., secret key). In other words, in the case of homomorphic encryption, the server performs operation(s) on the encrypted data as is, and since the result is also encrypted, the server cannot verify the user's original data throughout the entire communication and computation process between the user and the server. Therefore, according to homomorphic encryption methods, the user can delegate computation(s) to the server without revealing their data—that is, while the user's data remains securely protected.

[0069] The size of the ciphertext obtained through encryption increases compared to the size of the plaintext. The ciphertext obtained by applying homomorphic encryption to plaintext is significantly larger than the ciphertext obtained by applying conventional symmetric key encryption (i.e., private key or secret key encryption) or conventional asymmetric key encryption (i.e., public key encryption) to the same plaintext. Therefore, compared to other encryption techniques, homomorphic encryption requires significantly more network resources to transmit and / or receive the encryption results. Furthermore, analyzing or processing the ciphertext obtained through homomorphic encryption at the receiving end also requires greater performance and / or capacity compared to other encryption techniques.

[0070] To resolve or reduce these problems, some implementations of this specification are described below that utilize the communication process between the sender and the receiver during the transmission and / or reception phases to account for all costs incurred for encryption and transmission of the entire data, and / or homomorphic encryption operations at the receiver side, and perform compression of the data if necessary before encryption.

[0071] Homomorphic encryption techniques are explained in more detail below.

[0072] Homomorphic Encryption (HE)

[0073] HE is a quantum-resistant cryptography based on the Leaning With Error (LWE) problem. A distinguishing feature of HE compared to conventional cryptography is an additional step involving the operation Eval between ciphertexts.

[0074] In traditional encryption models, data is shared between a user and a server through an end-to-end encryption process in which the data remains secure during transmission. However, HE provides the capability for operations between ciphertexts (e.g., addition and / or multiplication between ciphertexts) through an evaluation phase (i.e., a computational process). Thus, HE brings an innovative twist to encryption systems by incorporating an evaluation phase that operates directly on the encrypted data or ciphertext. Unlike the traditional approach where the server is granted the capability to decrypt the data, HE does not provide the decryption key to the server, thereby preventing the server from accessing the plaintext data. Despite these restrictions, HE enables the server to perform specific computation(s) on the ciphertext. Using this unique feature, computationally intensive operations that might be too burdensome for the user can be offloaded to the server, provided the server possesses sufficient computational resources.

[0075] HE can generally include the following steps and functions:

[0076] - ParamGen(λ): Generates various parameters based on the security level λ. Examples of parameters may include the variance of noise α, the dimensions of LWE samples, etc.

[0077] - KeyGen(Params): Once the parameters are established, various keys required for homomorphic encryption are generated. These keys include a secret key sk, an evaluation key ek, and, if necessary, a public key pk depending on the homomorphic encryption scheme. The secret key sk is used only on the sender side and is used for encryption and decryption. The public key p can be generated based on the secret key sk, is disclosed by the user, and is used only for encryption and not for decryption. The evaluation key ek can be generated on the sender side based on the secret key sk. The evaluation key ek is provided to the receiver side and is used for homomorphic operations between ciphertexts performed on the receiver side.

[0078] - Enc(m, pk), Enc(m, sk): Message m is encrypted with the public key pk to generate the homomorphic ciphertext ct. In the case of homomorphic encryption methods that do not generate a public key, the secret sk is used to encrypt message m.

[0079] - Dec(ct, sk): To retrieve message m, ciphertext ct is decrypted with secret key sk.

[0080] - Eval f (ct, ek): An operation f is performed on the ciphertext ct using the evaluation key ek. Generally, Eval involves addition and / or multiplication between ciphertexts.

[0081] Figure 4 is an example of a homomorphic encryption model.

[0082] To explain the concept of HE, an HE model including two entities, a user (i.e., a client) and a server, can be considered. This model focuses on the user's goal of delegating computational tasks to the server. In the example of Figure 4, data can be shared between the user and the server through the following process.

[0083] 1. The user (or the device used by the user) can generate a secret key sk and an evaluation key ek (and a public key pk if necessary) based on a security level λ.

[0084] 2. The user encrypts file m using the secret key sk (or the public key k in the case of a public key cryptography method) to generate ciphertext ct, and sends the ciphertext ct and the evaluation key ek (and the public key pk if necessary depending on the cryptography method) to the server.

[0085] 3. Using the evaluation key ek, the server evaluates the ciphertexts ct (i.e., performs a homomorphic operation on the ciphertext ct) to generate the ciphertext ct*, which is the encryption of f(m). Then, the result is transmitted to the user.

[0086] 4. The user decrypts the ciphertext ct* using the secret key sk to obtain the result m*. Therefore, in FIG. 4, decryption occurs only on the user's side.

[0087] According to this framework, data privacy is maintained because decryption never occurs outside the user's domain.

[0088] CKKS("Cheon, JH, Kim, A., Kim, M., & Song, Y. (2017). Homomorphic encryption for arithmetic of approximate numbers. In Advances in Cryptology-ASIACRYPT 2017: 23rd International Conference on the Theory and Applications of Cryptology and Information Security, Hong Kong, China, December 3-7, 2017, Proceedings, Part I23 (pp. 409-437) and TFHE (see "Chillotti, I., Gama, N., Georgieva, M., & Izabachne, M. (2020). TFHE: fast fully homomorphic encryption over the torus. Journal of Cryptology, 33(1), 34-91.").

[0089] The CKKS technique enables efficient operations in the real number domain, provides approximate results, and supports addition and multiplication operations. There is a parameter called depth that determines the number of possible multiplication operations, and additional multiplications are possible using bootstrapping.

[0090] - The TFHE technique designs these isomorphic gates, which enable the design of arbitrary operations using basic isomorphic gates (e.g., NAND, OR, AND). Since the TFHE technique uses bootstrapping for all gate operations, there is no limit to the number of operations.

[0091] Both of the aforementioned homomorphic encryption methods suffer from the problem of the ciphertext size becoming excessively large relative to the plaintext during the encryption process. For example, in the case of TFHE, using the parameters presented in the paper requires 2KB to encrypt one bit, which is equivalent to expanding one bit by 16,032 times. Additionally, in the case of CKKS, the ciphertext modulus is often set high to maintain high precision; consequently, a single ciphertext often exceeds 5MB, and in some cases, the ciphertext size expands by hundreds of thousands of times compared to the size of a single plaintext. Therefore, when homomorphic encryption is used for communication security, the following problems may occur: ciphertext expansion, excessive memory and communication requirements, and increased computational load. Here, ciphertext expansion refers to the ratio by which the ciphertext size increases relative to the plaintext when a single message is encrypted. In the case of homomorphic encryption, this ratio is known to increase from as little as 10 times to as much as over 100,000 times. Consequently, when a transmitter encrypts and transmits a large amount of data using homomorphic encryption, excessive memory and communication resources are required, which may reduce the utility of homomorphic encryption. Furthermore, performing operations on homomorphic ciphertext—that is, performing operations homomorphically—requires hundreds of thousands of times more computation than performing operations on plaintext; thus, computation speeds may be longer than when performing operations on plaintext. This causes delays in data transmission and reception and can lead to a degradation in the quality of the user experience. Therefore, to reduce network traffic when encrypting using homomorphic encryption, it is necessary to reduce the size or number of ciphertexts themselves, or to reduce the size of the data being encrypted. According to some implementations of this specification, these problems can be resolved through data compression.

[0092] Data compression can be broadly classified into two types: lossless compression and lossy compression. The following are examples of the characteristics of each compression technique.

[0093]

[0094] However, when using data compression, there are many cases where the receiving end must decompress the data for use, and since this operation must be performed over homomorphic encryption, it can consume significant resources. In other words, even if the amount of communication is reduced through data compression, the server side may still need to perform operations that incur additional costs for data decompression, and this may vary depending on the data compression technique. Therefore, in some implementations of this specification, the transmitter may perform encryption by compressing the data if the cost reduction is significant, simply by comparing the cost reduction from data compression with the cost of data decompression. In some implementations of this specification, whether to compress the data to be encrypted can be determined by utilizing prior communication between the transmitter and the receiver during the homomorphic encryption and transmission process.

[0095] Meanwhile, most compression techniques generally require additional information (tables, dictionaries, etc.), which is generated during the data compression process and used during the decompression process. In other words, in many compression techniques, it may be necessary to create additional information (tables, dictionaries, etc.) during data compression. Representative examples of such compression techniques include LZ77 / LZ78, LZW (Lempel-Ziv-Welch), and Huffman Coding. These compression techniques can be classified into dictionary-based compression and entropy-based compression depending on the compression method. Dictionary-based compression techniques utilize a method in which a dictionary is generated during compression to store information such as compressing specific strings within a file (e.g., abcde) into '101'. Furthermore, entropy-based compression generates additional information, such as code tables, probability models, and frequency data, to perform efficient encoding based on the probability distribution or frequency of the data. On the other hand, if this information is sent to a server for decompression without encryption, it provides some information about the original file, which contradicts the purpose of homomorphic encryption to perform operations without disclosing the data to the server. Therefore, in some implementations of this specification, the transmitter may additionally encrypt the relevant information to be transmitted using homomorphic encryption and transmit it as auxiliary information, allowing the receiver to use it during the homomorphic decompression process.

[0096] In the following description, m∈{0,1} k represents the original file to be encrypted, specifically a binary file, and k is the number of bits in the file to be encrypted, that is, the number of bits in the file before encryption. In the following explanation, f c : {0,1} k → {0,1} n is defined as representing a data compression function that compresses a k-bit file into an n-bit file, where n <k이고,fc (m) refers to the file after compressing the original file m using the above compression function. Additionally, the homomorphic operation performed on the data is denoted as g. After the homomorphic operation, the ciphertext Enc(g(m)) for g(m) is obtained, and after decrypting the ciphertext Enc(g(m)), g(m) must be obtained.

[0097] FIGS. 5 through 7 illustrate the operation processes that occur at a transmitter (e.g., user) and a receiver (e.g., server) when data compression is used and when it is not used in some implementations of this specification. In particular, FIG. 6 illustrates the entire protocol of homomorphic encryption operation(s) performed at a transmitter (e.g., user) and a receiver (server) when data compression is not used in some implementations of this specification, and FIG. 7 illustrates the entire protocol of homomorphic encryption operation(s) performed at a transmitter (e.g., user) and a receiver (e.g., server) when data compression is used in some implementations of this specification.

[0098] As illustrated in FIGS. 6 and 7, the entire homomorphic encryption protocol according to some implementations of the present specification can be divided into two phases. Referring to FIGS. 6 or 7, the homomorphic encryption protocol according to some implementations of the present specification is broadly divided into 1) a Decision Phase, which is the first phase in which a transmitter (i.e., user side) and a receiver (i.e., server side) share information about the unencrypted file of the transmitter with each other and decide whether to compress the data, and ii) an Evaluation Phase (hereinafter, Eval Phase), which is the second phase in which the transmitter subsequently sends the encrypted file and an evaluation key ek to the receiver and performs homomorphic operations at the receiver.

[0099] In the Decision Phase, the user can first perform basic settings for homomorphic encryption. The user can generate parameter(s) Params using security parameter λ. Subsequently, the user can generate the user's private key sk (and, if necessary, public key pk) and evaluation key ek during the KeyGen process using the parameter(s). Subsequently, to determine whether to compress plaintext data, the user encrypts statistical information (e.g., Stats(m), type (e.g., text, voice, video, etc.), extension, and / or file size, etc.) regarding the user's file m using the private key sk or the public key pk (represented as "sk / pk" in FIGS. 6 and 7) to generate ciphertext Enc(Stats(m)), and transmits the ciphertext Enc(Stats(m)) to the server along with the evaluation key ek.

[0100] Afterward, the server compares the resources required when data is compressed and when it is not compressed (e.g., data compression rate, ciphertext size, decompression operation cost, etc.) using the encrypted statistical information Enc(Stats(m)) transmitted by the user and the evaluation key ek, and finally determines (1) whether to compress data and (2) the method of data compression for the user's file(s), and transmits the result of the determination to the user so that the user can perform data encryption.

[0101] For example, let CR be defined as the data compression ratio when k-bit plaintext is compressed into n-bits as CR = (1 - / k)*100 [%], and let CE (Computational cost for Evaluation) be the computational cost required to decompress the compressed data over homomorphic encryption. In this case, the server can determine whether to perform data compression at the user by calculating the efficiency S = α*CE + β*CR when compression is used at the user, using predefined or predetermined parameters α and β. For example, the server can set a threshold t, and if S≥t, the user performs compression, and S <t이면 사용자가 압축을 진행하지 않는 것으로 결정할 수 있다. 한편, 이러한 계산(예, CR, CE, 및 / 또는 S 등에 계산, S와 t의 비교 등)은 동형 암호화된 상태에서 수행되기 때문에 상기 서버는 동형적 min 및 / 또는 max 함수(들) 등을 이용하여 S와 t의 대소를 계산할 수는 있지만, 그 결과에 대해서는 알 수 없다. 따라서, 상기 서버는 상기 결과와는 상관 없이 black-box 형태로 최적의 압축 알고리즘을 찾는 연산 또한 수행한다. 해당 과정(예, 압축 여부를 동형적으로 결정, 파일의 정보가 동형 암호화된 상태에서 최적 알고리즘을 탐색 등)들은 동형적 탐색 트리(decision tree) 등의 형태로 설계되어 한 번에 해당 연산이 수행될 수 있다. 도 6 및 도 7에서 EvalDT는 사용자의 데이터 압축 여부 및 최적 알고리즘을 탐색하는 과정을 표시한다. 이러한 동형적 연산(들) 후에 상기 서버는 데이터 압축 여부 및 압축 알고리즘과 관련된 연산(들)의 결과가 동형 암호로 암호화된 형태인 암호문 Enc(Decision(m))을 상기 사용자에게 반환한다.

[0102] Subsequently, before entering the Eval Phase, the user can decrypt the received ciphertext Enc(Decision(m)) from the server using the user's private key sk to obtain the following two pieces of information: (1) bits Comp∈{0, 1} regarding whether to compress the data, and (2) information METHOD regarding the method of data compression. For example, if the user's data compression status is expressed as 0 and 1, if Comp = 0, the user can decide to encrypt the plaintext as is without compression, and if Comp = 1, the user can decide to perform data compression on the data m to be transmitted. In some implementations, the length of the ciphertext Enc(Decision(m)) may be the same when Comp = 0 and when Comp = 1. When Comp = 0, the ciphertext Enc(Decision(m)) does not contain valid information regarding the METHOD (e.g., the information regarding the METHOD is a predefined sequence of bits that does not represent a specific compression technique), and when Comp = 1, the ciphertext Enc(Decision(m)) may contain valid information regarding the METHOD.

[0103] Referring to FIG. 6, if Comp = 0, the user can obtain ciphertext Enc(m) by encrypting the plaintext as is without compression using the user's private key sk or public key pk, and transmit the ciphertext Enc(m) to the server. Subsequently, in the Eval Phase, the server performs a homomorphic operation using the ciphertext Enc(m) transmitted by the user and the evaluation key ek. In other words, the server can obtain the ciphertext Enc(g(m)), which is the result obtained by performing a homomorphic operation on the ciphertext Enc(m) using the user's evaluation key k. In the case where data compression is not performed by the user, since the server receives the ciphertext Enc(m) encrypted from an uncompressed file m as shown on the left side of FIG. 5, it can obtain the ciphertext Enc(g(m)) by performing operation g directly on the ciphertext Enc(m) without an additional operation process, as exemplified in FIG. 6. The server may return the ciphertext Enc(g(m)) to the user, and the user may decrypt the ciphertext Enc(g(m)) with the private key sk to obtain the plaintext g(m) of the evaluation result by the server for the user's data m.

[0104] Referring to FIG. 7, if Comp = 1, the user may decide to perform data compression on the data m to be transmitted. At this time, data compression is performed using a METHOD determined based on the ciphertext Enc(Decision(m)) to obtain the compressed data f. c (m) can be obtained, and the above compressed data f c Encrypt (m) with the above user's private key sk or public key pk to create the ciphertext Enc(f c(m)) can be generated. At this time, the user can obtain the ciphertext Enc(Aux(m, METHOD)) by encrypting Aux(m, METHOD), which is additional information (e.g., tables, dictionaries, etc.) to be used in the decompression process during compression, using the private key sk or public key pk. In some implementations, the additional information Aux(m, METHOD) may be information that depends on the original file m and the compression technique METHOD. Subsequently, in the Eval Phase, the server obtains the ciphertext Enc(f transmitted by the user). c Performs an isomorphic operation using (m)) and the evaluation key ek. g(f c (m)) =f c If (g(m)), the result of performing operation g on compressed data without decompression is the same as compressing after performing operation g, so it would be acceptable to proceed with the operation without decompression. However, generally, g(f c (m)) ≠f c Because (g(m)), if data compression is performed by the user, the server will not be able to perform operations directly on the compressed data. Therefore, if data compression is performed by the user, an additional procedure to decompress isomorphically may be required.

[0105] Referring to Fig. 7, the process isomorphically compute f through c -1 This may need to be performed. However, if data compression has been performed on the user's data but a decompression process is not required for the compressed data, f c - = can be set or configured as id (where id is the identity function). That is, if a decompression process is not required for the compressed data, the server does not perform decompression on the compressed data and the received ciphertext f cThe isomorphic operation (i.e., evaluation) is performed using (g(m)) as is. Through this isomorphic operation process (i.e., evaluation process) of the Eval Phase, the server performs Enc(Enc(f c -1 (f c (m))) = Enc(m) can be obtained.

[0106] In FIG. 6, the user transmits Enc(m) to the server without additional information; whereas, referring to FIG. 7, when data compression is performed by the user, for the evaluation process at the server, the ciphertext Enc(f) obtained through encryption of the compressed file (i.e., compressed data) c (m)) as well as the ciphertext Enc(Aux(m, METHOD)) obtained by encrypting additional information Aux(m, METHOD) required for compression, and the compression method METHOD are also transmitted to the server. Since the ciphertext Enc(Decision(m)) is generated by the server through homomorphic operation(s), the server cannot know whether Comp = 0 or Comp = 1, nor can it know the METHOD, even if it has generated the ciphertext Enc(Decsion(m)); therefore, in some implementations of this specification, the user may inform the server of information regarding whether the ciphertext being transmitted contains compressed data or uncompressed data, and if it contains compressed data, the corresponding compression method METHOD. The server transmits the ciphertext Enc(f c (m)), ciphertext Enc(Aux(m, METHOD)) and operation using METHOD ...can be performed, and thereby the ciphertext Enc(m) can be obtained. Therefore, after homomorphic decompression, the server can perform the target operation g on the ciphertext Enc(m), just as in the case where no compression was performed (i.e., Eval g(Enc(m), ek) can be performed). Finally, the server performs all targeted homomorphic operations (e.g., homomorphic operations related to decompression and evaluation operations on the ciphertext Enc(m)) to obtain the ciphertext Enc(g(m)), and the server returns the ciphertext Enc(g(m)) to the user. Afterwards, the user can obtain g(m) by decrypting the received ciphertext Enc(g(m)) using the private key sk.

[0107] To aid in understanding some implementations of this specification, an example of a user transmitting images requiring security to a server may be described as follows. The user may request deep learning model inference from the server using homomorphic encryption for multiple images they possess. In this case, the user can calculate in homomorphic encryption that when image(s) are compressed into JPEG using lossy compression, the compression rate is 80%, meaning the size of the ciphertext can be reduced to one-fifth of the size without compression, and thus the communication volume can be reduced to one-fifth. The user can then transmit the result (in its original homomorphic ciphertext form) to the server. The user can decrypt this and perform compression on the image(s); upon receiving information to use JPEG as the compression method, the user can perform JPEG compression on the image(s) and encrypt the compressed image(s) using homomorphic encryption before transmitting them to the server, thereby significantly reducing communication costs and the size of the ciphertext. However, in order to perform model inference using data compressed in JPEG format, decompression is required, so the server can receive the user's encrypted data and perform a JPEG decompression process including the inverse Discrete Cosine Transform (DCT) on homomorphic encryption.

[0108] According to some implementations of this specification, when an encryption method using homomorphic encryption is applied in communication, the amount of wireless resources, storage capacity, computational load, etc. used can be reduced.

[0109] FIG. 8 illustrates a signal transmission / reception flow in a device according to some implementations of the present specification. A device acting as a user or a device used by said user may perform operations according to some implementations of the present specification in relation to data transmission. The device may include at least one transceiver; at least one processor; and at least one computer memory operably connected to said at least one processor and storing instructions that, when executed, cause said at least one processor to perform operations according to some implementations of the present specification. A processing device for said device may include at least one processor; and at least one computer memory operably connected to said at least one processor and storing instructions that, when executed, cause said at least one processor to perform operations according to some implementations of the present specification. A computer-readable (non-transient) storage medium may store at least one computer program including instructions that, when executed by said at least one processor, cause said at least one processor to perform operations according to some implementations of the present specification. A computer program or computer program product is written on at least one computer-readable (non-transient) storage medium and may include instructions that, when executed, cause (at least one processor) to perform operations according to some implementations of this specification.

[0110] Referring to FIGS. 5, FIGS. 7 and / or FIGS. 8, in a method performed by said device, or said server, said processing unit, said computer-readable (non-transient) storage medium, and / or said computer program product, said operations are: generating a private key sk and an evaluation key ek (S801); homomorphically encrypting information Stats(m) regarding user data m to generate a first homomorphic ciphertext Enc(Stats(m)) (S802); transmitting said first homomorphic ciphertext Enc(Stats(m)) and said evaluation key ek to a server (S803); receiving a second homomorphic ciphertext Enc(Decision(m)) associated with said first homomorphic ciphertext Enc(Stats(m)) from said server (S804); decrypting said second homomorphic ciphertext Enc(Decision(m)) with said private key sk to obtain first data compression related information (see comp and METHOD in FIG. 7) (S805); Based on the fact that the above first data compression information includes a first value (e.g., comp = 1), the user data m is compressed to obtain compressed data f. c Generate (m) (S806); the compressed data f c Homomorphically encrypt (m) to obtain the third homomorphic ciphertext Enc(f c (m)) generate (S807); and the third homomorphic ciphertext Enc(f c It may include transmitting (m)) to the above server.

[0111] In some implementations, based on the first data compression information including the first value, the first data compression information may further include information regarding a compression method, and the user data m may be compressed according to the compression method.

[0112] In some implementations, the method or operations may include: generating a fifth homomorphic ciphertext Enc(Aux(m, METHOD)) by homomorphically encrypting decompression information Aux(m, METHOD) based on the first data compression information including the first value.

[0113] In some implementations, the above third homomorphic ciphertext Enc(f c Transmitting (m)) to the above server is: the above third homomorphic ciphertext Enc(f c (m)) and may include transmitting the fifth homomorphic ciphertext Enc(Aux(m, METHOD)) to the server.

[0114] In some implementations, the above third homomorphic ciphertext Enc(f c Transmitting (m)) to the above server is: the above third homomorphic ciphertext Enc(f c It may include transmitting to the server second data compression information including (m)), the fifth homomorphic ciphertext Enc(Aux(m, METHOD)), and information regarding the compression technique applied to the user data m.

[0115] In some implementations, the second data compression information is the third homomorphic ciphertext of the compressed data f c It may include information indicating that (m) is included.

[0116] In some implementations, the above method or above operations are: the above third homomorphic ciphertext Enc(f c Based on transmitting (m)) to the server, it may further include receiving the 6th homomorphic ciphertext Enc(g(m)) from the server.

[0117] In some implementations, the method or operations may further include decrypting the sixth homomorphic ciphertext Enc(g(m)) with the private key sk to obtain the operation result g(m) associated with the user data m.

[0118] In some implementations, referring to FIG. 5 or FIG. 6, based on the first data compression related information including a second value, the method or the operations may include: generating a fourth homomorphic ciphertext Enc(m) by homomorphically encrypting the user data m without compression; transmitting the fourth homomorphic ciphertext Enc(m) to the server; receiving a sixth homomorphic ciphertext Enc(g(m)) from the server based on transmitting the fourth homomorphic ciphertext Enc(m) to the server; and decrypting the sixth homomorphic ciphertext Enc(g(m)) with the private key sk to obtain an operation result g(m) related to the user data m.

[0119] FIG. 9 illustrates a signal transmission / reception flow in a server according to some implementations of the present specification. The server may perform operations according to some implementations of the present specification in relation to data transmission / reception. The server may include at least one transceiver; at least one processor; and at least one computer memory operably connected to the at least one processor and storing instructions that, when executed, cause the at least one processor to perform operations according to some implementations of the present specification. A processing device for the server may include at least one processor; and at least one computer memory operably connected to the at least one processor and storing instructions that, when executed, cause the at least one processor to perform operations according to some implementations of the present specification. A computer-readable (non-transient) storage medium may store at least one computer program including instructions that, when executed by at least one processor, cause the at least one processor to perform operations according to some implementations of the present specification. A computer program or computer program product is written on at least one computer-readable (non-transient) storage medium and may include instructions that, when executed, cause (at least one processor) to perform operations according to some implementations of this specification.

[0120] Referring to FIG. 5, FIG. 7 and / or FIG. 9, in a method performed by the server, or in the server, the processing device, the computer-readable (non-transient) storage medium, and / or the computer program product, the operations are: receiving a first homomorphic ciphertext Enc(Stats(m)) and an evaluation key ek from the device (S901); generating a second homomorphic ciphertext Enc(Decision(m)) by performing a first homomorphic operation EvalDT(Enc(Stats(m)), ek) on the first homomorphic ciphertext Enc(Stats(m)) based on the evaluation key ek (S902); transmitting the second homomorphic ciphertext Enc(Decision(m)) to the device (S903); and compressed data f from the device c The third homomorphic ciphertext Enc(f containing (m) c (m)), and receiving a fourth homomorphic ciphertext Enc(Aux(m, METHOD)) including decompression information Aux(m, METHOD) (S904); the third homomorphic ciphertext Enc(f c (m)), based on the fourth homomorphic ciphertext Enc(Aux(m, METHOD)) and the evaluation key ek, the third homomorphic ciphertext Enc(f c Second isomorphic operation for decompression of (m)) Perform to generate the fifth homomorphic ciphertext Enc(m) (S905); perform the third homomorphic operation Eval on the fifth homomorphic ciphertext Enc(m) based on the evaluation key ek. g It may include performing (Enc(m),ek) to generate a sixth homomorphic ciphertext Enc(g(m)) (S906); and transmitting the sixth homomorphic ciphertext Enc(g(m)) to the device (S907).

[0121] In some implementations, the third homomorphic ciphertext Enc(f from the device cReceiving (m)) and the fourth homomorphic ciphertext Enc(Aux(m, METHOD)) may include receiving data compression-related information from the device.

[0122] In some implementations, the data compression information may include information regarding a compression method for the compressed data.

[0123] In some implementations, the data compression information is the third homomorphic ciphertext Enc(f c (m)) may include information indicating that it contains compressed data.

[0124] Referring to FIG. 6, in some implementations, the method or the operation comprises: after transmitting the second homomorphic ciphertext Enc(Decision(m)) to the device, the third homomorphic ciphertext Enc(f) from the device c (m)) and, rather than the fourth homomorphic ciphertext Enc(Aux(m, METHOD)), may include receiving a seventh homomorphic ciphertext Enc(m) containing uncompressed user data m. In some implementations, the method or the operation may include receiving information indicating that the seventh homomorphic ciphertext Enc(m) contains uncompressed data along with the seventh homomorphic ciphertext Enc(m). In some implementations, the method or the operation may include: based on not receiving the fourth homomorphic ciphertext Enc(Aux(m, METHOD)) or based on receiving information indicating that the seventh homomorphic ciphertext Enc(m) contains uncompressed data, without performing a second homomorphic operation for decompression on the seventh homomorphic ciphertext Enc(m), performing the third homomorphic operation Eval on the seventh homomorphic ciphertext Enc(m) with the evaluation key ek. gIt may include generating the sixth homomorphic ciphertext Enc(g(m)) by performing (Enc(m),ek). The method or the operations may include transmitting the sixth homomorphic ciphertext Enc(g(m)) to the device.

[0125] As described above, the examples of this specification disclosed are provided to enable a person skilled in the art related to this specification to implement and practice this specification. Although the foregoing has been described by reference to the examples of this specification, a person skilled in the art may modify and change the examples of this specification in various ways. Accordingly, this specification is not intended to be limited to the examples described herein, but to be given the broadest possible scope consistent with the principles and novel features disclosed herein.

[0126] Implementations of this specification may be used in authentication systems, user devices or servers, or other equipment.

Claims

1. Generate private key sk and evaluation key ek; Generate a first homomorphic ciphertext by homomorphically encrypting information regarding user data m; Transmit the above first homomorphic ciphertext and the above evaluation key ek to the server; Receiving a second homomorphic ciphertext associated with the first homomorphic ciphertext from the above server; Decrypt the above second homomorphic ciphertext with the above private key sk to obtain first data compression-related information; Compressed data f by compressing the user data m based on the fact that the above first data compression information includes a first value c Generate (m); The above compressed data f c Generate a third homomorphic ciphertext by homomorphically encrypting (m); and including transmitting the above third homomorphic ciphertext to the server, Method performed on the device.

2. In Paragraph 1, Based on the fact that the above first data compression related information includes the above first value, the above first data compression related information further includes information regarding a compression method, and the user data m is compressed according to the above compression method, Method performed on the device.

3. In Paragraph 1, Based on the fact that the first data compression information includes the first value, the method includes homomorphically encrypting the decompression information to generate a fifth homomorphic ciphertext. Transmitting the above third homomorphic ciphertext to the above server is: including transmitting the third homomorphic ciphertext and the fifth homomorphic ciphertext to the server. Method performed on the device.

4. In Paragraph 3, Transmitting the above third homomorphic ciphertext to the above server is: A method comprising transmitting to the server second data compression-related information including information regarding the third homomorphic ciphertext, the fifth homomorphic ciphertext, and the compression technique applied to the user data m. Method performed on the device.

5. In Paragraph 4, The above second data compression information is the above third homomorphic ciphertext is the compressed data f c Includes information indicating that (m) is included, Method performed on the device.

6. In Paragraph 1, Based on transmitting the above third homomorphic ciphertext to the server, receiving a sixth homomorphic ciphertext from the server; and The method comprising decrypting the above-mentioned sixth homomorphic ciphertext with the above-mentioned private key sk to obtain an operation result related to the above-mentioned user data m, Method performed on the device.

7. In Paragraph 1, Based on the fact that the above first data compression related information includes a second value Generate a fourth homomorphic ciphertext by homomorphically encrypting the above user data m without compression; Transmit the above 4 homomorphic ciphertext to the above server; Based on transmitting the above-mentioned fourth homomorphic ciphertext to the server, receiving a sixth homomorphic ciphertext from the server; and The method comprising decrypting the above-mentioned sixth homomorphic ciphertext with the above-mentioned private key sk to obtain an operation result related to the above-mentioned user data m, Method performed on the device.

8. At least one processor; and It includes at least one computer memory operablely connectable to the at least one processor and, when executed, stores instructions that cause the at least one processor to perform operations, wherein the operations are: Generate private key sk and evaluation key ek; Generate a first homomorphic ciphertext by homomorphically encrypting information regarding user data m; Transmit the above first homomorphic ciphertext and the above evaluation key ek to the server; Receiving a second homomorphic ciphertext associated with the first homomorphic ciphertext from the above server; Decrypt the above second homomorphic ciphertext with the above private key sk to obtain data compression-related information; Compressed data f by compressing the user data m based on the fact that the above data compression information includes a first value c Generate (m); The above compressed data f c Generate a third homomorphic ciphertext by homomorphically encrypting (m); and including transmitting the above third homomorphic ciphertext to the server, machinery and tools.

9. A computer-readable, non-transient storage medium storing instructions that, when executed, cause at least one processor to perform operations, wherein the operations are: Generate private key sk and evaluation key ek; Generate a first homomorphic ciphertext by homomorphically encrypting information regarding user data m; Transmit the above first homomorphic ciphertext and the above evaluation key ek to the server; Receiving a second homomorphic ciphertext associated with the first homomorphic ciphertext from the above server; Decrypting the above second homomorphic ciphertext with the above private key sk to obtain data compression-related information; and Compressed data f by compressing the user data m based on the fact that the above data compression information includes a first value c Generate (m); The above compressed data f c Generate a third homomorphic ciphertext by homomorphically encrypting (m); and including transmitting the above third homomorphic ciphertext to the server, Storage medium.

10. Receive the first homomorphic ciphertext and evaluation key from the device; A second homomorphic ciphertext is generated by performing a first homomorphic operation on the first homomorphic ciphertext based on the above evaluation key; Transmit the above second homomorphic ciphertext to the above device; Receiving a third homomorphic ciphertext containing compressed data from the above device, and a fourth homomorphic ciphertext containing decompression information; Based on the third homomorphic ciphertext, the fourth homomorphic ciphertext, and the evaluation key, a second homomorphic operation for decompression of the third homomorphic ciphertext is performed to generate a fifth homomorphic ciphertext; Generating a sixth homomorphic ciphertext by performing a third homomorphic operation on the fifth homomorphic ciphertext based on the above evaluation key; and including transmitting the above-mentioned sixth homomorphic ciphertext to the device, Method performed on the server.

11. In Paragraph 10, Receiving the third homomorphic ciphertext and the fourth homomorphic ciphertext from the above device is: including receiving additional data compression-related information from the above device, Method performed on the server.

12. In Paragraph 11, The above data compression information includes information regarding a compression method for the above compressed data. Method performed on the server.

13. In Paragraph 11, The above data compression information includes information regarding whether the above third homomorphic ciphertext includes compressed data. Method performed on the server.

14. At least one processor; and It includes at least one computer memory operablely connectable to the at least one processor and, when executed, stores instructions that cause the at least one processor to perform operations, wherein the operations are: Receive a first homomorphic ciphertext and an evaluation key from the device; A second homomorphic ciphertext is generated by performing a first homomorphic operation on the first homomorphic ciphertext based on the above evaluation key; Transmit the above second homomorphic ciphertext to the above device; Receiving a third homomorphic ciphertext containing compressed data from the above device, and a fourth homomorphic ciphertext containing decompression information; Based on the third homomorphic ciphertext, the fourth homomorphic ciphertext, and the evaluation key, a second homomorphic operation for decompression of the third homomorphic ciphertext is performed to generate a fifth homomorphic ciphertext; Generating a sixth homomorphic ciphertext by performing a third homomorphic operation on the fifth homomorphic ciphertext based on the above evaluation key; and including transmitting the above-mentioned sixth homomorphic ciphertext to the device, Server.

15. A computer-readable, non-transient storage medium storing instructions that, when executed, cause at least one processor to perform operations, wherein the operations are: Receive a first homomorphic ciphertext and an evaluation key from the device; A second homomorphic ciphertext is generated by performing a first homomorphic operation on the first homomorphic ciphertext based on the above evaluation key; Transmit the above second homomorphic ciphertext to the above device; Receiving a third homomorphic ciphertext containing compressed data from the above device, and a fourth homomorphic ciphertext containing decompression information; Based on the third homomorphic ciphertext, the fourth homomorphic ciphertext, and the evaluation key, a second homomorphic operation for decompression of the third homomorphic ciphertext is performed to generate a fifth homomorphic ciphertext; Generating a sixth homomorphic ciphertext by performing a third homomorphic operation on the fifth homomorphic ciphertext based on the above evaluation key; and including transmitting the above-mentioned sixth homomorphic ciphertext to the device, Storage medium.

Images