FHE Polynomial Evaluation with Reduced Product Depth
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing polynomial evaluation methods under fully homomorphic encryption (FHE) are inefficient in minimizing the number of non-scalar products and product depth, leading to errors due to multiplication of very large and very small numbers, especially when dealing with polynomials of high degree.
Innovation Solution
The method involves expanding a polynomial into a plurality of products, each comprising a scaling coefficient multiplied by a sub-polynomial, and computing ciphertext products to evaluate the polynomial, optimizing the number and depth of computations while maintaining accuracy by reusing lower-power ciphertext products.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a polynomial with high degree is used to improve estimation accuracy, then the accuracy of function estimation is improved, but the number of non-scalar products increases and numerical errors increase due to multiplication of very large and very small numbers
Solution Approach 1:
The patent divides the high-degree polynomial evaluation into multiple stages using Horner's method, where the polynomial is evaluated in a nested form: P(x) = (...((a_n*x + a_{n-1})*x + a_{n-2})*x + ...)*x + a0. This segmentation avoids computing large powers of x directly and multiplying them by small coefficients, instead performing a sequence of simpler multiplications and additions that accumulate error more gracefully
Solution Approach 2:
The patent changes the computational parameters by transforming the polynomial representation from standard form to nested Horner form, and by carefully selecting the precision parameters of the FHE scheme (security parameter, modulus chain parameters) to accommodate the accumulated numerical errors while maintaining accuracy
2Measurement precision
If a polynomial with high degree is used to improve estimation accuracy, then the accuracy of function estimation is improved, but the number of non-scalar products increases leading to increased computation time
Solution Approach 1:
The patent segments the polynomial evaluation into Horner's nested form, which reduces the number of non-scalar products from O(n) in the standard form to exactly n multiplications regardless of polynomial degree. This segmentation strategy makes the computation scalable to high-degree polynomials without linearly increasing the number of expensive non-scalar operations
Solution Approach 2:
The patent performs preliminary setup of the FHE cryptographic parameters and polynomial coefficients in plaintext form before encryption, so that during the encrypted evaluation phase, only the necessary Horner's method multiplications need to be performed on ciphertexts, minimizing the number of non-scalar products executed in the encrypted domain
3Productivity
If the number of non-scalar products is minimized, then the computation time is reduced, but the product depth increases leading to accumulated cryptographic errors
Solution Approach 1:
The patent segments the computation into shallow Horner's method steps where each multiplication operates on ciphertexts with controlled noise growth. By structuring the computation as a sequence of n simple multiplications rather than fewer deep nested multiplications, the patent limits the product depth at any point in the computation tree, preventing exponential noise accumulation
Solution Approach 2:
The patent incorporates noise analysis and management as feedback into the FHE parameter selection process, where the expected noise growth from the Horner's method computation is calculated and used to adjust the cryptographic parameters (modulus chain, security level) to ensure the final decrypted result maintains the required precision
Data Source
AI summary
An embodiment expands a polynomial into a plurality of products, each product in the plurality of products comprising a scaling coefficient multiplied by a sub-polynomial, each sub-polynomial comprising a sum of a plurality of addends, wherein a degree of each sub-polynomial is equal to a grouping parameter. An embodiment computes a plurality of ciphertext products, each ciphertext product equal to a ciphertext multiplied by itself a number of times, the number of times ranging from two to the grouping parameter. An embodiment computes, using the ciphertext and the plurality of ciphertext products in place of a variable of the polynomial, each of the plurality of products. An embodiment multiplies the plurality of products together.