JPWO2021229157A5 - Cryptographic methods, systems, and services for evaluating real-valued functions on encrypted data - Google Patents

Claims (15)

in digital form by at least one information processing system specifically programmed to perform an approximate homomorphic evaluation of a univariate function f of a real-valued variable x with arbitrary precision in the domain D and with real values in the image I. A cryptographic method that takes as input a ciphertext of the encoding of x, E(encode(x)), and a ciphertext of the encoding of an approximate value of f(x), y≈f(x). returns E'(encode'(y)), where E and E' are homomorphic encryption algorithms, the respective native spaces of their plaintexts are M and M',
- an integer N≧1, which quantifies the actual precision of the representation of the variable at the input of the function f being evaluated;
- an encoding function encode that takes as input an element of region D and associates with it an element of M;
- an encoding function encode' which takes as input an element of image I and associates with it an element of M';
- a discretize function that takes as input an element of M and associates with it an index represented by an integer;
- a homomorphic encryption scheme with an encryption algorithm _EH , whose plaintext native space _MH has a cardinality of at least N;
- an encoding function encode _H that takes an integer as input and returns the elements of M _H
parameterized by
As a result, the image of area D by encoding encode and subsequent discretize,

is a set of at most N indices selected from S={0,...,N-1},
-a. precomputing a table corresponding to the univariate function f,
○ Decomposing the region D into N selected subintervals R ₀ ,...,R _N-1 whose union constitutes D;
○For each index i in S={0,...,N-1}, determine the representative x(i) of subinterval R _i , and calculate the value y(i)=f(x(i)) to calculate,
○For 0≦i≦N-1, by returning a table T consisting of N components T[0], ..., T[N-1] where T[i] = y(i). There is a step,
- b. A step of homomorphic evaluation of a table,
○If x∈R _i , index in set S={0,...,N-1}

an integer with expected value

, let the ciphertext E(encode(x)) be the ciphertext

to convert into
○Ciphertext

and Table T, as the expected value

element with

For, the ciphertext

to obtain,
○

The step and homomorphic encryption algorithm E which is to return the torus

given by the LWE-type encryption algorithm applied to the plaintext native space.

An encryption method characterized by having the following. - The domain of the function f to be evaluated is given by the real number interval D = [x _min , x _max ),
- N intervals R _i (for 0≦i≦N-1) covering region D are half-open subintervals

The cryptographic method according to claim 1, characterized in that D is divided in a regular manner. The set S is an additive group for integers M≧N

The cryptographic method according to claim 1, characterized in that it is a subset of . group

is expressed multiplicatively as a power of the primitive root of the unit represented by X to the M power,

For the multiplication modulo (X ^{M -1 )} , all the Mth roots of the unit ^{ 1,

4. The cryptographic method according to claim 3, wherein the cryptographic method forms a group isomorphic as . parameterized by an integer M≧N,
- The encoding function encode is a subinterval of a torus

having its image contained in
- The discretization function discretise applies the torus element t to the rounded integer of the product M×t modulo M, where M×t is

Calculated in mathematical form:

,

An encryption method according to any one or more of claims 1 to 4, characterized in that: When the domain of the function f is the real number interval D = [x _min , x _max ), the encoding function encode is

，

The encryption method according to claim 5, characterized in that: 5. Encryption method according to claim 1, characterized in that the homomorphic encryption algorithm _EH is an LWE encryption algorithm and the encoding function encode _H is an identity function. parameterized by an even integer M, the homomorphic encryption algorithm E _H is an encryption algorithm of the RLWE type, and the encoding function encode _H is

For any polynomial p, the function

，

The encryption method according to any one of claims 1 to 4, characterized in that: LWE type ciphertext on the torus, parameterized by an even number M equal to 2N

but,

of

, and the polynomial T'[j]=encode'(T[j]), 0≦j≦N-1

The encryption method according to claim 7 or 8, wherein the encryption method is extracted from an RLWE ciphertext that approaches . When the image of the function f is in the real number interval I = [y _min , y _max ),
- The homomorphic encryption algorithm E' is a torus

given by the LWE-type encryption algorithm applied to the plaintext native space.

has
- The encoding function encode' is

，

The encryption method according to any one of claims 1 to 4, characterized in that: The at least one univariate function subjected to said approximate homomorphic evaluation comprises the following preceding steps:
-a. a pre-computation step consisting of converting each of said multivariable functions into a network of univariable functions consisting of compositions and summations of univariate real-valued functions;
- b. In said network of precomputed univariate functions, there are three types:
- the same univariable function applied to the same arguments,
- different univariate functions applied to the same argument,
- the same univariable function applied to arguments that differ by a nonzero additive constant
a pre-selection step, which is identifying the redundancy of one of the and selecting all or part of it ;
- c. In the step of homomorphic evaluation of each network of precomputed univariable functions, if all or part of one or more of these univariable functions are to be reused, the preselection step 11. The method according to claim 1, characterized in that the method is derived from a prior processing of at least one multivariable function by implementing a step of homomorphic evaluation, in which the redundancy of the multivariate function is evaluated in a shared manner. The encryption method described in paragraph (1). 11. The method according to claim 1, wherein the input encrypted data is derived from a previous re-encryption step in such a way that the input encrypted data is set in the form of a ciphertext encrypted by the homomorphic encryption algorithm E. The encryption method described in any one of the paragraphs. An information processing system, characterized in that it is programmed to implement the homomorphic evaluation encryption method according to any one or more of claims 1 to 12. A computer program intended to be loaded and implemented on the information processing system according to claim 13. Implementing a cryptographic method according to any one or more of claims 1 to 14, wherein the task is shared between a data owner and one or more third parties acting as digital processing service providers. A cloud computing remote service.