KR20210130620A - Homomorhpic encryption based encryption method and apparatus using composition of function - Google Patents

Abstract

A homomorphic encryption-based encryption method using synthesis of functions and a device thereof are disclosed. The encryption method uses homomorphic encryption. The encryption method comprises the following steps of: generating a ciphertext by encrypting data; and performing bootstrapping on the ciphertext by performing modular reduction based on synthesis of functions for a modulus corresponding to the ciphertext.

Description

Homomorphic cipher-based encryption method and device using function composition

The following embodiments relate to a homomorphic encryption-based encryption method and apparatus using function composition.

Fully homomorphic encryption is an encryption method that enables arbitrary logical or mathematical operations using encrypted data. Fully homogeneous encryption ensures security in data processing.

However, since the conventional encryption method is difficult to process encrypted data, the protection of customer privacy was inevitably insufficient.

Fully homogeneous encryption enables customers to receive many services while maintaining their privacy.

In the encryption method using homomorphic encryption, the encryption method comprises the steps of: generating a ciphertext by encrypting data; and performing bootstrapping on the ciphertext by performing modular reduction.

The performing may include performing the bootstrapping by approximating the modular reduction based on the function and an inverse function of the function.

The step of performing the bootstrapping by approximating the modular reduction based on the function and the inverse of the function comprises: obtaining an approximate polynomial of the function; obtaining an approximate polynomial of the inverse function; and generating a synthesis function approximating the modular reduction based on the synthesis function of the approximate polynomial of the function and the approximate polynomial of the inverse function.

The function may include a trigonometric function.

The obtaining of the approximate polynomial of the function may include, when the function is a trigonometric function, obtaining a quadrangular function of the trigonometric function by applying a quadrangular formula to the trigonometric function.

The obtaining of the approximate polynomial of the function comprises: determining one or more reference points based on a degree of the approximate polynomial; obtaining an arbitrary polynomial based on the one or more reference points; generating the approximate polynomial based on one or more poles.

The obtaining of the arbitrary polynomial may include obtaining a piecewise continuous function passing through the one or more reference points, and an absolute value of an error with the piecewise continuous function at the one or more reference points being a predetermined value. obtaining the arbitrary polynomial by generating the polynomial.

The obtaining of the arbitrary polynomial by generating a polynomial in which the absolute value of the error with the piecewise continuous function is a predetermined value may include: an error at a first reference point included in the one or more reference points and an error at the first reference point adjacent to the first reference point and obtaining the arbitrary polynomial by generating a polynomial in which the sign of the error of the second reference point is different and the absolute value is the predetermined value.

The generating of the approximate polynomial based on the one or more poles selected from the arbitrary polynomial may include: an absolute value greater than or equal to a predetermined value among poles of an error between the arbitrary polynomial and the fragment continuous function passing through the one or more reference points. The method may include obtaining candidate points, selecting a number of target points based on the order from among the candidate points, and generating the approximate polynomial based on the target points.

In an encryption device using homomorphic encryption, the encryption device generates a ciphertext by encrypting data, and modular reduction based on the synthesis of a function with respect to a modulus corresponding to the ciphertext. and a processor that bootstraps the ciphertext by performing modular reduction, and a memory that stores instructions executable by the processor.

The processor may perform the bootstrapping by approximating the modular reduction based on the function and an inverse function of the function.

The processor is configured to obtain an approximate polynomial of the function, obtain an approximate polynomial of the inverse function, and generate a synthesis function approximating the modular reduction based on a synthesis function of the approximate polynomial of the function and the approximate polynomial of the inverse function. can

The function may include a trigonometric function.

When the function is a trigonometric function, the processor may obtain a quadrangular function of the trigonometric function by applying a quadrangular formula to the trigonometric function.

The processor determines one or more reference points based on the degree of the approximate polynomial, obtains an arbitrary polynomial based on the one or more reference points, and generates the approximate polynomial based on one or more poles selected from the arbitrary polynomial. can do.

The processor is configured to obtain a piecewise continuous function passing through the one or more reference points, and generate a polynomial such that an absolute value of an error from the piecewise continuous function at the one or more reference points is a predetermined value. can be obtained.

The processor is configured to generate a polynomial in which an error at a first reference point included in the one or more reference points is different from an error of a second reference point adjacent to the first reference point and an absolute value becomes the predetermined value by generating a polynomial. polynomials can be obtained.

The processor is configured to obtain candidate points whose absolute value is greater than or equal to a predetermined value from among the poles of the error between the arbitrary polynomial and the fragment continuous function passing through the one or more reference points, and among the candidate points, the number of points based on the degree Target points may be selected and the approximate polynomial may be generated based on the target points.

1 shows a schematic block diagram of an encryption apparatus according to an embodiment.
FIG. 2 shows a sequence of operations in which the encryption device shown in FIG. 1 obtains an approximation function.
FIG. 3 shows an example of an algorithm in which the encryption device shown in FIG. 1 obtains an approximate polynomial for a function and its inverse function.
4 shows another example of an algorithm in which the encryption device shown in FIG. 1 obtains an approximate polynomial for a function and its inverse function.
FIG. 5 shows an operation sequence of the encryption device shown in FIG. 1 .

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, since various changes may be made to the embodiments, the scope of the patent application is not limited or limited by these embodiments. It should be understood that all modifications, equivalents and substitutes for the embodiments are included in the scope of the rights.

The terms used in the examples are used for description purposes only, and should not be construed as limiting. The singular expression includes the plural expression unless the context clearly dictates otherwise. In the present specification, terms such as “comprise” or “have” are intended to designate that a feature, number, step, operation, component, part, or combination thereof described in the specification exists, but one or more other features It should be understood that this does not preclude the existence or addition of numbers, steps, operations, components, parts, or combinations thereof.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which the embodiment belongs. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related art, and should not be interpreted in an ideal or excessively formal meaning unless explicitly defined in the present application. does not

In addition, in the description with reference to the accompanying drawings, the same components are given the same reference numerals regardless of the reference numerals, and the overlapping description thereof will be omitted. In the description of the embodiment, if it is determined that a detailed description of a related known technology may unnecessarily obscure the gist of the embodiment, the detailed description thereof will be omitted.

In addition, in describing the components of the embodiment, terms such as first, second, A, B, (a), (b), etc. may be used. These terms are only for distinguishing the components from other components, and the essence, order, or order of the components are not limited by the terms. When it is described that a component is “connected”, “coupled” or “connected” to another component, the component may be directly connected or connected to the other component, but another component is between each component. It will be understood that may also be "connected", "coupled" or "connected".

Components included in one embodiment and components having a common function will be described using the same names in other embodiments. Unless otherwise stated, a description described in one embodiment may be applied to another embodiment, and a detailed description in the overlapping range will be omitted.

1 shows a schematic block diagram of an encryption apparatus according to an embodiment.

Referring to FIG. 1 , an encryption device 10 may perform data encryption. The encryption device 10 may generate encrypted data through data encryption. Hereinafter, encrypted data may be referred to as ciphertext.

The encryption apparatus 10 may perform encryption and decryption using homomorphic encryption. The encryption device 10 may provide an encryption technology capable of calculating data encrypted using homomorphic encryption without decryption. For example, the encryption device 10 may derive the same result as the result of calculating data in a plain text state by decrypting the result of the operation in the encrypted state using the homomorphic encryption. The encryption device 10 may provide a homomorphic encryption operation for any real number or complex number.

The encryption device 10 may perform bootstrapping required for homomorphic encryption. The encryption device 10 may generate an approximate polynomial to approximate a function corresponding to a modular reduction required for homomorphic encryption.

The cryptographic device 10 may find a minimax approximation error for each order of an optimal minimax approximate polynomial.

The encryption apparatus 10 may provide excellent performance in terms of the minimum and maximum approximation error of the homomorphic encryption method by finding an approximate polynomial that optimally approximates the modular reduction operation.

The encryption device 10 may generate an approximate polynomial for approximating the modular reduction function by using the approximate region information for approximating the modular reduction function. The encryption device 10 may perform modular reduction based on function synthesis. The encryption device 10 may perform bootstrapping by performing modular reduction based on function synthesis.

The encryption device 10 includes a processor 100 and a memory 200 .

The processor 100 may process data stored in the memory 200 . The processor 100 may execute computer-readable codes (eg, software) stored in the memory 200 and instructions induced by the processor 100 .

The “processor 100” may be a data processing device implemented in hardware having circuitry having a physical structure for executing desired operations. For example, desired operations may include code or instructions included in a program.

For example, a data processing device implemented as hardware includes a microprocessor, a central processing unit, a processor core, a multi-core processor, and a multiprocessor. , an Application-Specific Integrated Circuit (ASIC), and a Field Programmable Gate Array (FPGA).

The processor 100 may generate ciphertext by encrypting data. Data may refer to information in the form of letters, numbers, sounds, pictures, etc. that a computer can process.

The processor 100 may perform bootstrapping on the ciphertext by performing modular reduction based on a composition of a function on a modulus corresponding to the generated ciphertext.

The processor 100 may perform bootstrapping by approximating the modular reduction based on the function and the inverse function of the function. The processor 100 may obtain an approximate polynomial of the function. The processor 100 may obtain an approximate polynomial of the inverse function.

The processor 100 may determine one or more reference points based on the degree of the approximate polynomial. The processor 100 may obtain any polynomial based on one or more reference points. The processor 100 may obtain a piecewise continuous function passing through one or more reference points. The processor 100 may obtain an arbitrary polynomial by generating a polynomial in which the absolute value of the error with the piece continuity function at one or more reference points is a predetermined value.

The processor 100 obtains an arbitrary polynomial by generating a polynomial in which the sign of the error at the first reference point included in one or more reference points and the error of the second reference point adjacent to the first reference point are different and the absolute value is a predetermined value. can do.

The processor 100 may generate an approximate polynomial based on one or more poles selected from any polynomial. The processor 100 may obtain candidate points whose absolute value is greater than or equal to a predetermined value among the poles of the error between the arbitrary polynomial and the fragment continuous function passing through one or more reference points.

The processor 100 may select the number of target points based on the degree from among the candidate points. The processor 100 may generate an approximate polynomial based on the target points.

After obtaining at least one approximate polynomial of a function and an inverse function thereof, the processor 100 may perform modular reduction by performing synthesis of a function based on the obtained approximate polynomial. A process of obtaining an approximate polynomial of a function and its inverse function will be described in detail with reference to FIGS. 3 and 4 .

The processor 100 may generate a synthesis function approximating the modular reduction based on the synthesis function of the approximate polynomial of the function and the approximate polynomial of the inverse function. In this case, the function may include a trigonometric function. For example, the trigonometric function may include at least one of a sin function and a cos function.

When the function is a trigonometric function, the processor 100 may obtain a quadrangular function of the trigonometric function by applying a quadrangular formula to the trigonometric function.

The memory 200 may store instructions (or programs) executable by the processor. For example, the instructions may include instructions for executing an operation of a processor and/or an operation of each component of the processor.

The memory 200 may be implemented as a volatile memory device or a nonvolatile memory device.

The volatile memory device may be implemented as dynamic random access memory (DRAM), static random access memory (SRAM), thyristor RAM (T-RAM), zero capacitor RAM (Z-RAM), or twin transistor RAM (TTRAM).

Nonvolatile memory devices include EEPROM (Electrically Erasable Programmable Read-Only Memory), Flash memory, MRAM (Magnetic RAM), Spin-Transfer Torque (STT)-MRAM (Spin-Transfer Torque (STT)-MRAM), Conductive Bridging RAM (CBRAM). , FeRAM (Ferroelectric RAM), PRAM (Phase change RAM), Resistive RAM (RRAM), Nanotube RRAM (Nanotube RRAM), Polymer RAM (PoRAM), Nano Floating Gate Memory Memory (NFGM)), a holographic memory, a molecular electronic memory device, or an Insulator Resistance Change Memory.

FIG. 2 shows a sequence of operations in which the encryption device shown in FIG. 1 obtains an approximation function.

Referring to FIG. 2 , the processor 100 may perform bootstrapping by approximating the modular reduction function. The processor 100 may detect a ciphertext (or ciphertext) requiring a modulus operation (eg, a modulus reduction operation) during the bootstrapping process ( 210 ). For example, the processor 100 may detect a ciphertext in which the modulus has a value less than or equal to a threshold, so that no further operation can be performed.

The processor 100 may approximate a modular reduction function to perform bootstrapping. The processor 100 may obtain an approximate polynomial of an arbitrary function and obtain an approximate polynomial of an inverse function. For example, any function may include a trigonometric function.

The example of FIG. 2 is described based on a case in which an arbitrary function is a sin function, but in the case of cos, the modular reduction function may be approximated in the same manner.

The processor 100 may generate a synthesis function approximating the modular reduction based on the synthesis function of the approximate polynomial of the function and the approximate polynomial of the inverse function. The processor 100 may approximate the modular reduction function through synthesis of a plurality of polynomials having a relatively low order.

For example, the processor 100 may obtain an approximate polynomial f(t) for sin(t) ( 230 ). The processor 100 may obtain an approximate polynomial g(t) for arcsin(t) ( 250 ). A process of obtaining the approximate polynomial will be described in more detail with reference to FIGS. 3 and 4 .

f(t)를 획득할 수 있다(270). 프로세서(100)는 합성 함수에 기초하여 모듈러스 함수(예를 들어, 모듈러 리덕션 함수)를 근사할 수 있다(290).The processor 100 synthesizes the obtained g(t) and f(t) to obtain g

f(t) can be obtained (270). The processor 100 may approximate a modulus function (eg, a modular reduction function) based on the composition function ( 290 ).

The processor 100 approximates the modulus function as a composite function of a trigonometric function and an inverse trigonometric function, thereby reducing an error compared to an approximated modulus function using only trigonometric trigonometric functions.

The processor 100 may reduce a fundamental error caused by approximation using only trigonometric functions by using a modular reduction function based on the synthesis of an approximate polynomial of a function and its inverse function. The processor 100 may reduce the number of non-scalar multiplications by applying the quadrangular formula of the trigonometric function. Through the synthesis of functions and their inverse functions, the processor 100 can reduce the number of operations for the approximate function.

When the function f is a sin function and g is an arcsin function, the two functions may be defined as in Equations 1 and 2.

은

의 범위를 가질 수 있다.here,

silver

may have a range of

A synthesis function for the functions of Equations 1 and 2 can be expressed as Equation 3 above.

를 대입하면 합성 함수는 수학식 4와 같을 수 있다.here,

By substituting , the composition function may be the same as in Equation (4).

Here, normod(t) may mean a normalized modular reduction function. Referring to Equations 1 to 4, the processor 100 may reduce the error of the modular reduction function by approximating the functions f and g through an approximate polynomial and then synthesizing them.

에 대해서도 선형 다항식을 이용하여 g(x)를 근사시킬 수 있다. 예를 들어, 프로세서(100)는 g(x)를 항등 함수(identity function)인 x로 근사시킬 수 있다.The processor 100 is relatively small

Also, g(x) can be approximated using a linear polynomial. For example, the processor 100 may approximate g(x) to x, which is an identity function.

In addition, since the cos function is a parallel shift function of the sin function, the processor 100 may perform synthesis of the same function as above for the cos function.

When an arbitrary function is an odd function, its approximate polynomial may also be an odd function. That is, if the inverse function is an arcsine function, the approximate polynomial of the arcsin function may be a Hall function.

Therefore, since the approximate polynomial of the arcsin function is a linear polynomial among polynomials of second order or less, the error between the approximate polynomial and the arsin function is four global extreme points satisfying the Chebyshev alternating theorem. ) can have

에서 arcsin 함수에 대한 최소 최대 근사 다항식

을 수학식 5와 같이 획득할 수 있다.The processor 100 is a section

min max approximation polynomial for arcsin function in

can be obtained as in Equation 5.

Also, the relation of Equation 6 may be satisfied.

일 수 있다.In this case, the domain of all functions is

can be

이고,

일 때, 수학식 4의 정규화된 모듈러 리덕션 함수는 수학식 7과 같이 계산될 수 있다.

ego,

When , the normalized modular reduction function of Equation 4 may be calculated as Equation 7.

의 최소 선형 다항식은

와 같을 수 있다. 따라서, 원래의 근사 공식에 상수

가 곱해진 형태를 가지기 때문에, 프로세서(100)는 cos 근사가 가지는 근본적인 근사 오차를 1/4 배만큼 감소시킬 수 있다.here,

The least linear polynomial of

can be the same as Therefore, constant in the original approximation formula

Since has a multiplied form, the processor 100 can reduce the fundamental approximation error of the cos approximation by a factor of 1/4.

Through this, the processor 100 may additionally acquire 2-bit accuracy only by adjusting a multiplicative factor.

Equations 5 to 7 describe a case where the order of the approximate polynomial of the inverse function is first-order, and the processor 100 may further reduce the minimum and maximum error by approximating the order of the approximate polynomial of the inverse function to the second or higher order. .

The processor 100 may increase the degree of the approximate polynomial to the third order to approximate it as shown in Equation (8).

Here, a process of obtaining the coefficients c ₁ and c ₃ of the polynomial will be described with reference to FIG. 3 . When Equation 8 is applied to Equation 4, a normalized modular reduction function as Equation 9 can be obtained.

를 근사할 수 있다. 프로세서(100)는 sin 또는 cos 함수를 근사하기 위해 배각 공식을 적용할 수 있다.In order to approximate the modular reduction function, the processor 100 approximates the sin or cos function using the minimum and maximum approximate polynomial, and then

can be approximated. The processor 100 may apply a double angle formula to approximate a sin or cos function.

와 수학식 8을 이용하여 모듈러 리덕션 함수를 근사한 경우의 최소 최대 근사 오차인

사이의 값을 가질 수 있다.After the sin or cos function is approximated by applying the double angle formula, two depth and two nonscalar multiplications may be additionally required. Through the double angle formula, the minimum and maximum approximation error for the normalized modular reduction function is the approximation flat error when the approximate polynomial of the inverse function is of degree 1.

The minimum maximum approximate error when the modular reduction function is approximated using Equation 8 and

It can have values between

를

의 2n+1 차의 최적의 최소최대 근사 다항식(optimal minimax approximate polynomial)이라고 할 때,

은 홀수 차항만을 포함할 수 있다. 이하에서,

은

의 최소최대 근사 오차를 의미할 수 있다.

cast

Given the optimal minimax approximate polynomial of the 2n+1 order of

can contain only odd derivative terms. Below,

silver

It may mean the minimum maximum approximate error of .

와

사이의 값을 갖도록 하기 위해, 프로세서(100)는 수학식 10과 같은 정규화된 모듈러 리덕션 함수를 획득할 수 있다.Minimum Maximum Approximate Error

Wow

In order to have a value between, the processor 100 may obtain a normalized modular reduction function as in Equation (10).

은 0에 가까워질 수 있다. 프로세서(100)는 삼각 함수와 역삼각 함수의 근사 함수의 합성을 통해서, 근사 오차를 감소시킬 수 있다.Here, as n increases,

can be close to 0. The processor 100 may reduce an approximation error by synthesizing an approximate function of a trigonometric function and an inverse trigonometric function.

Hereinafter, a process of obtaining an approximate polynomial of a function and its inverse function will be described in detail with reference to FIGS. 3 and 4 .

FIG. 3 shows an example of an algorithm in which the encryption device shown in FIG. 1 obtains an approximate polynomial for a function and its inverse function.

Referring to FIG. 3 , the processor 100 may obtain an approximate polynomial of a function and/or an inverse of the function. The processor 100 may obtain an approximate polynomial of a function and/or an inverse function thereof using Algorithm 1 of FIG. 3 .

The processor 100 may obtain an approximate polynomial for at least one of a function and an inverse function thereof. A process for obtaining an approximate polynomial of a function and its inverse function may be the same.

The processor 100 may generate the approximate polynomial by finding the minimum and maximum approximate polynomial for any continuous function on the interval [a, b] using Algorithm 1 of FIG. 3 . The processor 100 may generate an approximate polynomial that satisfies an equioscillation condition by using the Chebyshev alternation theorem.

를 갖는 근사 다항식을 생성할 수 있다. 프로세서(100)는 차수가 d인 근사 다항식을 생성하기 위해서, 기저 함수

를 멱 기저(power basis)

로 선택할 수 있다. 여기서, n=d+1일 수 있다.The processor 100 is a basis function that satisfies a Haar condition

We can create an approximate polynomial with The processor 100 generates an approximate polynomial of degree d, the basis function

is the power basis

can be selected as Here, n=d+1 may be present.

The processor 100 may determine one or more reference points based on the degree d of the approximate polynomial to be obtained. The processor 100 may initialize a set of reference points converging to the poles of the minimum and maximum approximate polynomials. The processor 100 may obtain a minimum and maximum polynomial for a set of reference points. Since the set of reference points is a set of finite points in [a, b], it can be a closed subset of [a, b], and the Chebyshev alternating theorem can be satisfied for the set of reference points.

The processor 100 may obtain any polynomial based on one or more reference points. The processor 100 may obtain a fragment continuous function passing through one or more reference points. The processor 100 may obtain an arbitrary polynomial by generating a polynomial in which the absolute value of the error with the piece continuity function at one or more reference points is a predetermined value.

The processor 100 obtains an arbitrary polynomial by generating a polynomial in which the sign of the error at the first reference point included in one or more reference points and the error of the second reference point adjacent to the first reference point are different and the absolute value is a predetermined value. can do.

는 하나 이상의 기준점을 지나는 조각 연속 함수일 수 있다.

가 [a, b] 상의 연속 함수라고 할 때, 기준점의 집합 상의 최소최대 근사 다항식은 기저

를 갖는 일반화된 다항식

이고, 임의의 E 값에 대하여 수학식 11의 조건을 만족할 수 있다. 임의의 E 값은 위에서 설명한 미리 결정된 값일 수 있다.

may be a fragment continuous function passing through one or more reference points.

When is a continuous function on [a, b], the minimum-maximum approximate polynomial on the set of reference points is the basis

generalized polynomial with

, and the condition of Equation 11 may be satisfied for any E value. Any E value may be the predetermined value described above.

를 획득할 수 있다. 수학식 11에 따라,

및 E의 n 계수의 n+1 변수들 및 n+1 방정식들을 갖는 선형 방적식의 시스템이 형성되고, 선형 방적식은 하르 조건에 의해 특이적(singular)이지 않으므로, 프로세서(100)는 수학식 11의 조건을 만족하는 다항식

를 획득할 수 있다.The processor 100 uses Equation (11) to obtain an arbitrary polynomial

can be obtained. According to Equation 11,

And since a system of linear equations with n+1 variables and n+1 equations of n coefficients of E is formed, and the linear equation is not singular by the Harr condition, the processor 100 is polynomial that satisfies the condition

can be obtained.

The processor 100 may generate an approximate polynomial based on one or more poles selected from any polynomial. Specifically, the processor 100 may obtain candidate points whose absolute value is greater than or equal to a predetermined value among the poles of the error between the arbitrary polynomial and the fragment continuous function passing through the one or more reference points. The processor 100 may select the number of target points based on the order from among the candidate points. The processor 100 may generate an approximate polynomial based on the selected target points.

,

일 때,

와

사이에서

의 n 개의 영점들(zeros)

를 획득할 수 있고, 각각의

에서

의 n+1 개의 극점(extreme point)들인

를 획득할 수 있다.The processor 100

,

when,

Wow

between

n zeros of

can be obtained, and each

at

n+1 extreme points of

can be obtained.

일 때,

에서

의 최소점(minimum point)을 선택하고,

일 때,

에서

의 최대점을 선택할 수 있다.The processor 100

when,

at

Choose the minimum point of

when,

at

You can choose the maximum point of

을 후보점으로 선택할 수 있다. 이러한 후보점들이 이퀴오실레이션 컨디션을 만족한다면 프로세서(100)는 체비셰프 교번 정리로부터 최소 최대 근사 다항식을 반환함으로써 함수 또는 그 역함수의 근사 다항식을 생성할 수 있다.Through this, the processor 100 sets a new pole

can be selected as a candidate point. If these candidate points satisfy the equioscillation condition, the processor 100 may generate an approximate polynomial of a function or its inverse function by returning a minimum and maximum approximate polynomial from Chebyshev's alternating theorem.

로 대체하고, 상술한 다항식의 생성 과정을 반복적으로 수행할 수 있다.In addition, the processor 100 is a set of new pole points obtained through the above-described process for the set of reference points.

, and the above-described polynomial generation process may be repeatedly performed.

Algorithm 1 shown in FIG. 3 may be extended to multiple sub-intervals of one interval. When applied by extending to multiple partial sections, steps 3 and 4 of FIG. 3 may be changed.

의 모든 지역 극점(local extreme point)들을 획득할 수 있고, 이러한 지역 극점들의 절대 오차값은 현재 기준점들에서의 절대 오차값 보다 클 수 있다.At each iteration, the processor 100 returns an error function

It is possible to obtain all local extreme points of , and the absolute error value of these local extreme points may be greater than the absolute error value at the current reference points.

Thereafter, the processor 100 may select n+1 new poles that satisfy the following two conditions from among all the acquired local poles.

1. Error values are indicated by alternating signs.

2. The set of new poles contains a global extreme point.

The above two conditions can ensure convergence of the minimum and maximum generalized polynomials.

4 shows another example of an algorithm in which the encryption device shown in FIG. 1 obtains an approximate polynomial for a function and its inverse function.

Referring to FIG. 4 , the processor 100 may obtain an approximate polynomial of a function and/or an inverse of the function using Algorithm 2 of FIG. 4 .

The modular reduction function that the processor 100 intends to obtain through approximation may be a normalized modular reduction function defined only in the vicinity of a finite number of integers expressed by Equation (12).

Equation 12 may represent a scaled modular reduction function with respect to a domain and a range.

를 근사하기 위해 코사인 함수를 배각 공식(double-angle formula)을 이용하여 근사할 수 있다.The processor 100 is configured to efficiently perform homomorphic evaluation,

To approximate , the cosine function can be approximated using the double-angle formula.

번 사용하면 수학식 13의 코사인 함수가 근사되어야 할 수 있다.doubling formula

When used, the cosine function of Equation 13 may have to be approximated.

In order to approximate a piecewise continuous function including the functions of Equations 12 and 13, the processor 100 is defined on the union of a finite number of closed intervals given as Equation 14. A general fragmentary continuous function can be assumed.

에 대해서,

일 수 있다.here, all

about,

can be

The processor 100 sets a criterion for selecting d+2 new reference points from among a plurality of poles in order to approximate a fragment continuous function given by a polynomial having a degree of d or less on D of Equation 14. can

를 다항식의 기저로 하여 근사 다항식을 생성할 수 있다. 프로세서(100)는 각 반복에서 기준점들의 집합에 따른 최소최대 근사 다항식을 획득할 수 있고, 다음 반복에서 새로운 기준점의 집합을 선택할 수 있다.The processor 100 satisfies the Haar condition on [a, b]

An approximate polynomial can be generated by using as the basis of the polynomial. The processor 100 may obtain a minimum-maximum approximate polynomial according to the set of reference points in each iteration, and may select a new set of reference points in the next iteration.

The number of cases in which the processor 100 selects n+1 points from among poles of an error function calculated using an arbitrary polynomial obtained by using a set of reference points may be very large. Since many sections may be considered in the encryption process performed by the processor 100, the number of candidate poles may be very large.

The processor 100 may select n+1 target points from among a large number of candidate points in each iteration in order to minimize the number of iterations. Through this, the processor 100 converges the approximate polynomial generated in each iteration to generate the minimum and maximum approximate polynomial. In this case, the finally generated min/max approximation polynomial may be an approximation polynomial of the above-described function and/or an inverse function thereof.

In order to set a criterion for selecting n+1 target points, the processor 100 may define a function of Equation (15).

각 반복에서 획득한 임의의 다항식을 의미하고,

는 근사될 조각 연속 함수를 의미할 수 있다. 이하에서 편의를 위해

는

로 지칭될 수 있다.here,

means any polynomial obtained at each iteration,

may mean a fragment continuous function to be approximated. Below for convenience

Is

may be referred to as

의 모든 극점을 획득하여 집합

를 생성할 수 있다.

는 유한 집합으로

와 같이 나타낼 수 있다. 프로세서(100)는

에 속한 하나의 구간에서 한 점을 선택할 수 있다.The processor 100

Set by obtaining all poles of

can create

is a finite set

can be expressed as The processor 100

You can select a point in one interval belonging to .

가

와 같이 오름차순으로 정렬되어 있다고 가정하면,

의 값은 1 또는 -1일 수 있다. 극점의 수는

를 만족할 수 있다.

go

Assuming they are sorted in ascending order,

The value of may be 1 or -1. number of poles

can be satisfied

를 수학식 16과 같이 정의할 수 있다.The processor 100 is a set of functions

can be defined as in Equation 16.

는 항등 함수(identity function)만을 포함할 수 있다. At this time, if n+1=m, set

may include only an identity function.

The processor 100 may set three criteria to select n+1 poles.

가 설정된 기준점들에서의 절대 오차라면, 수학식 17의 조건이 설정될 수 있다.As a first condition, the processor 100 may set a condition of a local extreme value. if,

If is an absolute error at the set reference points, the condition of Equation 17 may be set.

의 지역 최대값이 음수이거나

의 지역 최소값이 양수인 경우에 그 극점을 버릴 수 있다.The processor 100 is configured to satisfy the local extrema condition.

If the local maximum of is negative, or

If the local minimum of is positive, the pole can be discarded.

Second, the processor 100 may set an alternating condition. In other words, the condition of Equation 18 may be set. In other words, if one of the two adjacent poles is a local maximum, the other pole may be a local minimum.

들 중에서 수학식 19의 값을 최대화하는

를 선택할 수 있다.Third, the processor 100 may set a maximum absolute sum condition. The processor 100 is configured to satisfy the local extrema condition and the alternating condition.

Among them, which maximizes the value of Equation 19

can be selected.

에서의 절대 오차 값은 최소최대 근사 오차보다 작고, 반복 횟수가 증가할수록 최소최대 근사 오차로 수렴할 수 있다.current reference points

The absolute error value at is smaller than the minimum and maximum approximation error, and as the number of iterations increases, it can converge to the minimum and maximum approximation error.

에서 이전 반복에서의 근사 다항식의 절대 오차값의 가중 평균(weighted average)일 수 있다.In addition, the absolute error value of the current reference points is

may be a weighted average of the absolute error values of the approximate polynomials in the previous iteration.

The processor 100 may allow the absolute error values of current reference points to quickly converge to the minimum maximum approximate error using the maximum absolute sum condition.

The local extrema condition and the alternating condition may be applied to both the algorithms of FIGS. 3 and 4 , and the maximum absolute sum condition may be applied to the algorithm 2 of FIG. 4 . The processor 100 may accelerate the convergence of the minimum maximum approximate polynomial by applying the maximum absolute sum condition.

는 지역 극값 조건 및 교번 조건을 만족하는 적어도 하나의 원소

를 항상 포함하고, 어떠한

에 대하여,

를 만족하는

를 가질 수 있다.set

is at least one element that satisfies the local extrema condition and the alternating condition

always include, and any

about,

to satisfy

can have

에 대한 현재의 기준점에서의 멱 기저를 갖는 근사 다항식의 계수들을 찾아낼 수 있다.The processor 100 may perform steps 2, 3, and 4 of Algorithm 2 of FIG. 4 more efficiently as follows. The processor 100 is a continuous function

We can find the coefficients of an approximate polynomial with a power basis at the current reference point for .

값들을 획득함으로써 근사 다항식을 생성할 수 있다. In other words, the processor 100 is a coefficient of Equation 20

An approximate polynomial can be generated by obtaining the values.

Here, it may be an unknown of the linear equation. As the order of the basis of the approximate polynomial increases, the coefficients may decrease. The processor 100 may need to set higher accuracy for higher-order basis coefficients.

Accordingly, the processor 100 can effectively solve the accuracy problem by using the basis of the Chebyshev polynomial as the basis of the approximate polynomial. Since most coefficients of polynomials using the Chebyshev basis have the same order, the processor 100 may generate an approximate polynomial using the Chebyshev basis instead of the power basis.

및 E를 계산함으로써 근사 다항식을 획득할 수 있다.The Chebyshev polynomial satisfies the above-mentioned Harr condition, and the processor 100 solves the system of d+2 linear equations in Equation 21 using d+2 reference points.

and E, an approximate polynomial can be obtained.

FIG. 5 shows a sequence of operations of the encryption device shown in FIG. 1 .

Referring to FIG. 5 , the processor 100 may generate ciphertext by encrypting data ( 510 ). The processor 100 may perform bootstrapping on the ciphertext by performing modular reduction based on the synthesis of a function on the modulus corresponding to the generated ciphertext ( 530 ). In this case, the function may include a trigonometric function.

The processor 100 may perform bootstrapping by approximating the modular reduction based on the function and the inverse function of the function. The processor 100 may obtain an approximate polynomial of a function and obtain an approximate polynomial of an inverse function.

The processor 100 may determine one or more reference points based on the degree of the approximate polynomial, and obtain an arbitrary polynomial based on the one or more reference points.

The processor 100 may obtain an arbitrary polynomial by obtaining a fragment continuity function passing through one or more reference points, and generating a polynomial such that an absolute value of an error with the fragment continuity function at one or more reference points becomes a predetermined value.

The processor 100 obtains an arbitrary polynomial by generating a polynomial in which the sign of the error at the first reference point included in one or more reference points and the error of the second reference point adjacent to the first reference point are different and the absolute value is a predetermined value. can do.

The processor 100 may generate an approximate polynomial based on one or more poles selected from any polynomial. The processor 100 obtains candidate points whose absolute value is greater than or equal to a predetermined value among the poles of the error between the arbitrary polynomial and the fragment continuous function passing through one or more reference points, and selects a number of target points based on the degree among the candidate points. You can choose.

The processor 100 may generate an approximate polynomial of a function or its inverse function based on the selected target points.

The processor 100 may generate a synthesis function approximating the modular reduction based on the synthesis function of the approximate polynomial of the function and the approximate polynomial of the inverse function. In this case, when the function is a trigonometric function, the processor 100 may obtain a quadrangular function of the trigonometric function by applying a quadrangular formula to the trigonometric function.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. Examples of the computer readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

The software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or device, to be interpreted by or to provide instructions or data to the processing device. , or may be permanently or temporarily embody in a transmitted signal wave. The software may be distributed over networked computer systems, and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

As described above, although the embodiments have been described with reference to the limited drawings, those skilled in the art may apply various technical modifications and variations based on the above. For example, the described techniques are performed in a different order than the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (19)

In the encryption method using homomorphic encryption,
generating ciphertext by encrypting the data; and
performing bootstrapping on the ciphertext by performing modular reduction based on the synthesis of a function on a modulus corresponding to the ciphertext;
An encryption method comprising
According to claim 1,
The performing step is,
performing the bootstrapping by approximating the modular reduction based on the function and the inverse of the function.
An encryption method comprising
3. The method of claim 2,
Performing the bootstrapping by approximating the modular reduction based on the function and the inverse function of the function,
obtaining an approximate polynomial of the function;
obtaining an approximate polynomial of the inverse function; and
generating a synthesis function approximating the modular reduction based on the synthesis function of the approximate polynomial of the function and the approximate polynomial of the inverse function;
An encryption method comprising
According to claim 1,
The function is
An encryption method involving trigonometric functions.
4. The method of claim 3,
Obtaining an approximate polynomial of the function comprises:
When the function is a trigonometric function, applying a quadrangular formula to the trigonometric function to obtain a quadrangular function of the trigonometric function
An encryption method comprising
4. The method of claim 3,
Obtaining an approximate polynomial of the function comprises:
determining one or more reference points based on the degree of the approximate polynomial;
obtaining an arbitrary polynomial based on the one or more reference points; and
generating the approximate polynomial based on one or more poles selected from the arbitrary polynomial;
An encryption method comprising
7. The method of claim 6,
The step of obtaining the arbitrary polynomial is,
obtaining a piecewise continuous function passing through the one or more reference points; and
obtaining the arbitrary polynomial by generating a polynomial in which the absolute value of the error with the piecewise continuous function at the one or more reference points is a predetermined value;
An encryption method comprising
8. The method of claim 7,
Obtaining the arbitrary polynomial by generating a polynomial in which the absolute value of the error with the piecewise continuous function is a predetermined value comprises:
Obtaining the arbitrary polynomial by generating a polynomial whose sign is different from an error at a first reference point included in the one or more reference points and an error of a second reference point adjacent to the first reference point and whose absolute value is the predetermined value step
An encryption method comprising
7. The method of claim 6,
generating the approximate polynomial based on one or more poles selected from the arbitrary polynomial,
obtaining candidate points whose absolute value is greater than or equal to a predetermined value among the poles of the error between the arbitrary polynomial and the fragment continuous function passing through the one or more reference points;
selecting a number of target points based on the order from among the candidate points; and
generating the approximate polynomial based on the target points;
An encryption method comprising
A computer program stored in a medium for executing the method of any one of claims 1 to 9 in combination with hardware.
In the encryption device using homomorphic encryption,
By encrypting data, a ciphertext is generated, and the modulus corresponding to the ciphertext is subjected to modular reduction based on the synthesis of a function to perform bootstrapping on the ciphertext. the processor; and
a memory storing instructions executable by the processor
Encryption device comprising.
12. The method of claim 11,
The processor is
performing the bootstrapping by approximating the modular reduction based on the function and the inverse function of the function
encryption device.
13. The method of claim 12,
The processor is
obtaining an approximate polynomial of the function,
obtaining an approximate polynomial of the inverse function,
generating a synthesis function approximating the modular reduction based on the synthesis function of the approximate polynomial of the function and the approximate polynomial of the inverse function
encryption device.
12. The method of claim 11,
The function is
A cryptographic device containing a trigonometric function.
14. The method of claim 13,
The processor is
When the function is a trigonometric function, applying a quadrangular formula to the trigonometric function to obtain a quadrangular function of the trigonometric function
encryption device.
14. The method of claim 13,
The processor is
determining one or more reference points based on the degree of the approximate polynomial;
obtain an arbitrary polynomial based on the one or more reference points,
generating the approximate polynomial based on one or more poles selected from the arbitrary polynomial
encryption device.
17. The method of claim 16,
The processor is
obtaining a piecewise continuous function passing through the one or more reference points;
obtaining the arbitrary polynomial by generating a polynomial in which the absolute value of the error with the fragment continuous function at the one or more reference points is a predetermined value
encryption device.
18. The method of claim 17,
The processor is
Obtaining the arbitrary polynomial by generating a polynomial whose sign is different from an error at a first reference point included in the one or more reference points and an error of a second reference point adjacent to the first reference point and whose absolute value is the predetermined value
encryption device.
17. The method of claim 16,
The processor is
obtain candidate points whose absolute value is greater than or equal to a predetermined value among the poles of the error between the arbitrary polynomial and the fragment continuous function passing through the one or more reference points,
selecting a number of target points based on the order from among the candidate points;
generating the approximate polynomial based on the target points
encryption device.

Images